@geekbeer/minion 3.34.0 → 3.40.1

package/core/routes/workflows.js

@@ -52,10 +52,12 @@ async function workflowRoutes(fastify, opts) {
     console.log(`[Workflows] Receiving ${incomingWorkflows.length} workflows from HQ`)
 
     try {
-      // Load existing workflows
+      // Load existing workflows (unfiltered — this is cross-workspace admin sync)
       const existingWorkflows = await workflowStore.load()
 
-      // Merge: update existing or add new (upsert by id)
+      // Merge: update existing or add new (upsert by id).
+      // Incoming workflows from HQ should carry workspace_id; the store will
+      // persist it alongside the DB row for fast filtering later.
       const workflowMap = new Map(existingWorkflows.map(w => [w.id, w]))
       for (const incoming of incomingWorkflows) {
         workflowMap.set(incoming.id, incoming)
@@ -82,14 +84,18 @@ async function workflowRoutes(fastify, opts) {
     }
   })
 
-  // List all workflows with their current status
+  // List workflows with their current status.
+  // Optional ?workspace_id= filter: when provided, scope to that workspace;
+  // when absent, return all (used by admin/cross-workspace views).
   fastify.get('/api/workflows', async (request, reply) => {
     if (!verifyToken(request)) {
       reply.code(401)
       return { success: false, error: 'Unauthorized' }
     }
 
-    const workflows = await workflowStore.load()
+    const rawWs = request.query?.workspace_id
+    const workspaceId = (rawWs === '' || typeof rawWs === 'string') ? rawWs : undefined
+    const workflows = await workflowStore.load(workspaceId)
     const status = workflowRunner.getStatus()
 
     // Merge workflow data with runtime status
@@ -251,6 +257,7 @@ async function workflowRoutes(fastify, opts) {
         })),
         content: workflow.content || '',
         project_id: workflow.project_id || null,
+        workspace_id: workflow.workspace_id || '',
       })
 
       // 4. Reload cron jobs
@@ -413,7 +420,8 @@ async function workflowRoutes(fastify, opts) {
     }
   })
 
-  // List execution history
+  // List execution history.
+  // Optional ?workspace_id= filter scopes to a workspace; omit for cross-workspace view.
   fastify.get('/api/executions', async (request, reply) => {
     if (!verifyToken(request)) {
       reply.code(401)
@@ -422,12 +430,14 @@ async function workflowRoutes(fastify, opts) {
 
     const limit = parseInt(request.query.limit) || 50
     const workflow_id = request.query.workflow_id
+    const rawWs = request.query.workspace_id
+    const workspaceId = (rawWs === '' || typeof rawWs === 'string') ? rawWs : undefined
 
     let executions
     if (workflow_id) {
-      executions = await executionStore.getByWorkflow(workflow_id, limit)
+      executions = await executionStore.getByWorkflow(workflow_id, limit, workspaceId)
     } else {
-      executions = await executionStore.list(limit)
+      executions = await executionStore.list(limit, workspaceId)
     }
 
     return { executions }

package/core/stores/daily-log-store.js

@@ -1,8 +1,12 @@
 /**
  * Daily Log Store (SQLite)
- * Stores daily conversation summaries.
- * One entry per day, keyed by YYYY-MM-DD date string.
+ * Stores daily conversation summaries scoped by workspace.
+ * One entry per (workspace_id, date), keyed by YYYY-MM-DD date string.
  * Supports full-text search via FTS5.
+ *
+ * workspaceId semantics:
+ * - non-empty string: specific workspace's log
+ * - '' (empty string): unassigned / legacy (pre-workspace-scoping) logs
  */
 
 const { getDb } = require('../db')
@@ -14,85 +18,112 @@ function isValidDate(date) {
   return /^\d{4}-\d{2}-\d{2}$/.test(date)
 }
 
+function normalizeWorkspaceId(workspaceId) {
+  return workspaceId == null ? '' : String(workspaceId)
+}
+
 /**
- * List all daily logs with date, content size, and timestamps.
+ * List all daily logs for a workspace with date, content size, and timestamps.
+ * @param {string} workspaceId - Workspace to scope logs to ('' = unassigned)
  * @returns {Array<{ date, size, created_at, updated_at }>} Sorted descending by date
  */
-function listLogs() {
+function listLogs(workspaceId) {
+  const wsId = normalizeWorkspaceId(workspaceId)
   const db = getDb()
   const rows = db.prepare(`
     SELECT date, length(content) as size, created_at, updated_at
     FROM daily_logs
+    WHERE workspace_id = ?
     ORDER BY date DESC
-  `).all()
+  `).all(wsId)
   return rows
 }
 
 /**
- * Load a specific day's log.
+ * Load a specific day's log for a workspace.
+ * @param {string} workspaceId - Workspace to scope to ('' = unassigned)
  * @param {string} date - YYYY-MM-DD format
  * @returns {string|null} Log content or null
  */
-function loadLog(date) {
+function loadLog(workspaceId, date) {
   if (!isValidDate(date)) return null
+  const wsId = normalizeWorkspaceId(workspaceId)
   const db = getDb()
-  const row = db.prepare('SELECT content FROM daily_logs WHERE date = ?').get(date)
+  const row = db.prepare(
+    'SELECT content FROM daily_logs WHERE workspace_id = ? AND date = ?'
+  ).get(wsId, date)
   return row ? row.content : null
 }
 
 /**
- * Save a daily log. Upserts (overwrites existing log for the same date).
+ * Save a daily log. Upserts (overwrites existing log for same workspace+date).
+ * @param {string} workspaceId - Workspace to scope to ('' = unassigned)
  * @param {string} date - YYYY-MM-DD format
  * @param {string} content - Markdown content
  */
-function saveLog(date, content) {
+function saveLog(workspaceId, date, content) {
   if (!isValidDate(date)) {
     throw new Error(`Invalid date format: ${date}. Expected YYYY-MM-DD.`)
   }
+  const wsId = normalizeWorkspaceId(workspaceId)
   const db = getDb()
   const now = new Date().toISOString()
-  const existing = db.prepare('SELECT date FROM daily_logs WHERE date = ?').get(date)
+  const existing = db.prepare(
+    'SELECT date FROM daily_logs WHERE workspace_id = ? AND date = ?'
+  ).get(wsId, date)
 
   if (existing) {
-    db.prepare('UPDATE daily_logs SET content = ?, updated_at = ? WHERE date = ?').run(content, now, date)
+    db.prepare(
+      'UPDATE daily_logs SET content = ?, updated_at = ? WHERE workspace_id = ? AND date = ?'
+    ).run(content, now, wsId, date)
   } else {
-    db.prepare('INSERT INTO daily_logs (date, content, created_at, updated_at) VALUES (?, ?, ?, ?)').run(
-      date, content, now, now
-    )
+    db.prepare(
+      'INSERT INTO daily_logs (workspace_id, date, content, created_at, updated_at) VALUES (?, ?, ?, ?, ?)'
+    ).run(wsId, date, content, now, now)
   }
 }
 
 /**
- * Delete a daily log.
+ * Delete a daily log for a specific workspace.
+ * @param {string} workspaceId - Workspace to scope to ('' = unassigned)
  * @param {string} date - YYYY-MM-DD format
  * @returns {boolean}
  */
-function deleteLog(date) {
+function deleteLog(workspaceId, date) {
   if (!isValidDate(date)) return false
+  const wsId = normalizeWorkspaceId(workspaceId)
   const db = getDb()
-  const result = db.prepare('DELETE FROM daily_logs WHERE date = ?').run(date)
+  const result = db.prepare(
+    'DELETE FROM daily_logs WHERE workspace_id = ? AND date = ?'
+  ).run(wsId, date)
   return result.changes > 0
 }
 
 /**
- * Get the most recent N days of logs.
+ * Get the most recent N days of logs for a workspace.
+ * @param {string} workspaceId - Workspace to scope to ('' = unassigned)
  * @param {number} days - Number of recent days to fetch
  * @returns {Array<{ date, content }>}
  */
-function getRecentLogs(days = 3) {
+function getRecentLogs(workspaceId, days = 3) {
+  const wsId = normalizeWorkspaceId(workspaceId)
   const db = getDb()
-  const rows = db.prepare('SELECT date, content FROM daily_logs ORDER BY date DESC LIMIT ?').all(days)
+  const rows = db.prepare(
+    'SELECT date, content FROM daily_logs WHERE workspace_id = ? ORDER BY date DESC LIMIT ?'
+  ).all(wsId, days)
   return rows
 }
 
 /**
- * Search daily logs using FTS5 full-text search (trigram tokenizer).
+ * Search daily logs in a specific workspace using FTS5 full-text search.
  * Falls back to LIKE for queries shorter than 3 characters (trigram minimum).
+ * @param {string} workspaceId - Workspace to scope to ('' = unassigned)
  * @param {string} query - Search query
  * @param {number} limit - Max results
  * @returns {Array<{ date, content, created_at, updated_at }>}
  */
-function searchLogs(query, limit = 20) {
+function searchLogs(workspaceId, query, limit = 20) {
+  const wsId = normalizeWorkspaceId(workspaceId)
   const db = getDb()
   const terms = query.split(/\s+/).filter(Boolean)
   if (terms.length === 0) return []
@@ -101,12 +132,11 @@ function searchLogs(query, limit = 20) {
 
   if (hasShortTerm) {
     const conditions = terms.map(() => 'content LIKE ?').join(' AND ')
-    const params = terms.map(t => `%${t}%`)
-    params.push(limit)
+    const params = [wsId, ...terms.map(t => `%${t}%`), limit]
     return db.prepare(`
       SELECT date, content, created_at, updated_at
       FROM daily_logs
-      WHERE ${conditions}
+      WHERE workspace_id = ? AND ${conditions}
       ORDER BY date DESC
       LIMIT ?
     `).all(...params)
@@ -117,20 +147,21 @@ function searchLogs(query, limit = 20) {
     SELECT d.date, d.content, d.created_at, d.updated_at
     FROM daily_logs d
     JOIN daily_logs_fts f ON d.rowid = f.rowid
-    WHERE daily_logs_fts MATCH ?
+    WHERE d.workspace_id = ? AND daily_logs_fts MATCH ?
     ORDER BY rank
     LIMIT ?
-  `).all(sanitized, limit)
+  `).all(wsId, sanitized, limit)
 }
 
 /**
  * Get a context snippet of recent daily logs for chat injection.
+ * @param {string} workspaceId - Workspace to scope to ('' = unassigned)
  * @param {number} days - Number of days to include
  * @param {number} maxChars - Maximum total characters
  * @returns {string}
  */
-function getContextSnippet(days = 3, maxChars = 1500) {
-  const logs = getRecentLogs(days)
+function getContextSnippet(workspaceId, days = 3, maxChars = 1500) {
+  const logs = getRecentLogs(workspaceId, days)
   if (logs.length === 0) return ''
 
   const parts = []

package/core/stores/execution-store.js

@@ -2,6 +2,9 @@
  * Execution Store (SQLite)
  * Persists skill execution history to local SQLite database.
  * Single source of truth for execution records.
+ *
+ * Each execution is scoped by workspace_id (added in v3.38.0). Execution records
+ * inherit workspace_id from their parent workflow or routine. '' means unassigned/legacy.
  */
 
 const { getDb } = require('../db')
@@ -9,39 +12,47 @@ const { getDb } = require('../db')
 // Max executions to keep (older ones are pruned)
 const MAX_EXECUTIONS = 200
 
+function normalizeWorkspaceId(workspaceId) {
+  return workspaceId == null ? '' : String(workspaceId)
+}
+
 /**
  * Save a single execution record.
  * Upserts by ID, prunes old records if over limit.
- * @param {object} execution - Execution record
+ * @param {object} execution - Execution record (should include workspace_id)
  */
 function save(execution) {
   const db = getDb()
-  console.log(`[ExecutionStore] save() called: id=${execution.id}, skill=${execution.skill_name}, status=${execution.status}`)
+  const wsId = normalizeWorkspaceId(execution.workspace_id)
+  const stored = { ...execution, workspace_id: wsId }
+  console.log(`[ExecutionStore] save() called: id=${execution.id}, skill=${execution.skill_name}, status=${execution.status}, ws=${wsId || '(unassigned)'}`)
 
   const existing = db.prepare('SELECT data FROM executions WHERE id = ?').get(execution.id)
 
   if (existing) {
-    const merged = { ...JSON.parse(existing.data), ...execution }
+    const merged = { ...JSON.parse(existing.data), ...stored }
     db.prepare(
-      'UPDATE executions SET skill_name = ?, workflow_id = ?, status = ?, data = ? WHERE id = ?'
+      'UPDATE executions SET skill_name = ?, workflow_id = ?, status = ?, workspace_id = ?, data = ? WHERE id = ?'
     ).run(
       merged.skill_name || null,
       merged.workflow_id || null,
       merged.status || null,
+      normalizeWorkspaceId(merged.workspace_id),
       JSON.stringify(merged),
       execution.id
     )
     console.log(`[ExecutionStore] Updated existing record: ${execution.status}`)
   } else {
     db.prepare(
-      'INSERT INTO executions (id, skill_name, workflow_id, status, created_at, data) VALUES (?, ?, ?, ?, ?, ?)'
+      'INSERT INTO executions (id, skill_name, workflow_id, status, workspace_id, created_at, data) VALUES (?, ?, ?, ?, ?, ?, ?)'
     ).run(
       execution.id,
-      execution.skill_name || null,
-      execution.workflow_id || null,
-      execution.status || null,
-      execution.created_at || new Date().toISOString(),
-      JSON.stringify(execution)
+      stored.skill_name || null,
+      stored.workflow_id || null,
+      stored.status || null,
+      wsId,
+      stored.created_at || new Date().toISOString(),
+      JSON.stringify(stored)
     )
     console.log(`[ExecutionStore] Added new record`)
   }
@@ -60,27 +71,38 @@ function save(execution) {
 }
 
 /**
- * List executions with optional limit
+ * List executions with optional limit and workspace filter.
  * @param {number} limit - Max number of executions to return
+ * @param {string} [workspaceId] - Optional workspace filter
  * @returns {Array} Array of execution objects (newest first)
  */
-function list(limit = 50) {
+function list(limit = 50, workspaceId) {
   const db = getDb()
-  const rows = db.prepare('SELECT data FROM executions ORDER BY created_at DESC LIMIT ?').all(limit)
+  const rows = workspaceId !== undefined
+    ? db.prepare(
+        'SELECT data FROM executions WHERE workspace_id = ? ORDER BY created_at DESC LIMIT ?'
+      ).all(normalizeWorkspaceId(workspaceId), limit)
+    : db.prepare('SELECT data FROM executions ORDER BY created_at DESC LIMIT ?').all(limit)
   return rows.map(r => JSON.parse(r.data))
 }
 
 /**
- * Get executions for a specific workflow
+ * Get executions for a specific workflow (workflow_id is unique enough; workspace
+ * filter is redundant but supported for defense-in-depth).
  * @param {string} workflowId - Workflow UUID
  * @param {number} limit - Max number to return
+ * @param {string} [workspaceId] - Optional workspace filter
  * @returns {Array} Array of execution objects
  */
-function getByWorkflow(workflowId, limit = 20) {
+function getByWorkflow(workflowId, limit = 20, workspaceId) {
   const db = getDb()
-  const rows = db.prepare(
-    'SELECT data FROM executions WHERE workflow_id = ? ORDER BY created_at DESC LIMIT ?'
-  ).all(workflowId, limit)
+  const rows = workspaceId !== undefined
+    ? db.prepare(
+        'SELECT data FROM executions WHERE workflow_id = ? AND workspace_id = ? ORDER BY created_at DESC LIMIT ?'
+      ).all(workflowId, normalizeWorkspaceId(workspaceId), limit)
+    : db.prepare(
+        'SELECT data FROM executions WHERE workflow_id = ? ORDER BY created_at DESC LIMIT ?'
+      ).all(workflowId, limit)
   return rows.map(r => JSON.parse(r.data))
 }
 

package/core/stores/routine-store.js

@@ -2,31 +2,44 @@
  * Routine Store (SQLite)
  * Persists routine configurations to local SQLite database.
  * Allows minion to continue operating when HQ is offline.
+ *
+ * Each routine is scoped by workspace_id (added in v3.38.0). '' means unassigned/legacy.
  */
 
 const { getDb } = require('../db')
 
+function normalizeWorkspaceId(workspaceId) {
+  return workspaceId == null ? '' : String(workspaceId)
+}
+
 /**
- * Load all routines
+ * Load routines. If workspaceId is provided, filter to that workspace;
+ * otherwise returns all (used by the runner to load cron jobs across all workspaces).
+ * @param {string} [workspaceId] - Optional workspace filter
  * @returns {Array} Array of routine objects
  */
-function load() {
+function load(workspaceId) {
   const db = getDb()
-  const rows = db.prepare('SELECT data FROM routines ORDER BY name').all()
+  const rows = workspaceId !== undefined
+    ? db.prepare('SELECT data FROM routines WHERE workspace_id = ? ORDER BY name').all(normalizeWorkspaceId(workspaceId))
+    : db.prepare('SELECT data FROM routines ORDER BY name').all()
   return rows.map(r => JSON.parse(r.data))
 }
 
 /**
- * Save routines (replace all)
+ * Save routines (replace all). Each routine's workspace_id is taken from
+ * `r.workspace_id` if present, else ''.
  * @param {Array} routines - Array of routine objects
  */
 function save(routines) {
   const db = getDb()
   const tx = db.transaction(() => {
     db.prepare('DELETE FROM routines').run()
-    const insert = db.prepare('INSERT INTO routines (id, name, data) VALUES (?, ?, ?)')
+    const insert = db.prepare('INSERT INTO routines (id, name, workspace_id, data) VALUES (?, ?, ?, ?)')
     for (const r of routines) {
-      insert.run(r.id, r.name, JSON.stringify(r))
+      const wsId = normalizeWorkspaceId(r.workspace_id)
+      const stored = { ...r, workspace_id: wsId }
+      insert.run(r.id, r.name, wsId, JSON.stringify(stored))
     }
   })
   tx()
@@ -48,24 +61,25 @@ function updateLastRun(routineId) {
 }
 
 /**
- * Find a routine by name
+ * Find a routine by name (cross-workspace).
  * @param {string} name - Routine name
  * @returns {object|null} Routine object or null
  */
 function findByName(name) {
   const db = getDb()
-  const row = db.prepare('SELECT data FROM routines WHERE name = ?').get(name)
+  const row = db.prepare('SELECT data FROM routines WHERE name = ? ORDER BY name LIMIT 1').get(name)
   return row ? JSON.parse(row.data) : null
 }
 
 /**
  * Upsert a routine from HQ data.
  * Upserts by ID (routines come from HQ with UUIDs).
- * @param {object} routineData - { id, name, pipeline_skill_names, content, is_active, cron_expression, last_run, next_run }
- * @returns {Array} Updated routines array
+ * @param {object} routineData - { id, name, pipeline_skill_names, content, is_active, cron_expression, last_run, next_run, workspace_id }
+ * @returns {Array} All routines (unfiltered)
  */
 function upsertFromHQ(routineData) {
   const db = getDb()
+  const wsId = normalizeWorkspaceId(routineData.workspace_id)
   const existing = db.prepare('SELECT data FROM routines WHERE id = ?').get(String(routineData.id))
 
   if (existing) {
@@ -76,8 +90,11 @@ function upsertFromHQ(routineData) {
     routine.context = routineData.context || null
     routine.is_active = routineData.is_active
     routine.cron_expression = routineData.cron_expression || ''
-    db.prepare('UPDATE routines SET name = ?, data = ? WHERE id = ?').run(
-      routine.name, JSON.stringify(routine), String(routineData.id)
+    if (routineData.workspace_id !== undefined) {
+      routine.workspace_id = wsId
+    }
+    db.prepare('UPDATE routines SET name = ?, workspace_id = ?, data = ? WHERE id = ?').run(
+      routine.name, normalizeWorkspaceId(routine.workspace_id), JSON.stringify(routine), String(routineData.id)
     )
   } else {
     const routine = {
@@ -90,9 +107,10 @@ function upsertFromHQ(routineData) {
       cron_expression: routineData.cron_expression || '',
       last_run: routineData.last_run || null,
       next_run: routineData.next_run || null,
+      workspace_id: wsId,
     }
-    db.prepare('INSERT INTO routines (id, name, data) VALUES (?, ?, ?)').run(
-      String(routine.id), routine.name, JSON.stringify(routine)
+    db.prepare('INSERT INTO routines (id, name, workspace_id, data) VALUES (?, ?, ?, ?)').run(
+      String(routine.id), routine.name, wsId, JSON.stringify(routine)
     )
   }
 

package/core/stores/todo-store.js

@@ -26,7 +26,12 @@ const MAX_INJECTION_COUNT = 5
 
 /**
  * Create a new TODO.
- * @param {object} todo - { title, description?, priority?, source_type?, source_id?, project_id?, due_at?, data? }
+ *
+ * workspace_id is REQUIRED (no auto-resolution). Callers must decide up-front
+ * which workspace a todo belongs to — passing '' for unassigned/legacy. This
+ * avoids "orphan" todos that appear in no workspace UI and cannot be routed.
+ *
+ * @param {object} todo - { title, workspace_id, description?, priority?, source_type?, source_id?, project_id?, due_at?, data?, session_id? }
  * @returns {object} Created todo with generated ID
  */
 function add(todo) {
@@ -35,6 +40,9 @@ function add(todo) {
   if (!todo.title) {
     throw new Error('title is required')
   }
+  if (todo.workspace_id !== '' && typeof todo.workspace_id !== 'string') {
+    throw new Error('workspace_id is required (pass "" for unassigned/legacy todos)')
+  }
 
   const id = crypto.randomBytes(6).toString('hex')
   const now = new Date().toISOString()
@@ -51,6 +59,7 @@ function add(todo) {
     source_type,
     source_id: todo.source_id || null,
     project_id: todo.project_id || null,
+    workspace_id: todo.workspace_id,
     due_at: todo.due_at || null,
     created_at: now,
     updated_at: now,
@@ -61,8 +70,8 @@ function add(todo) {
   }
 
   db.prepare(`
-    INSERT INTO todos (id, title, description, status, priority, source_type, source_id, project_id, due_at, created_at, updated_at, completed_at, data, session_id, injection_count)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO todos (id, title, description, status, priority, source_type, source_id, project_id, workspace_id, due_at, created_at, updated_at, completed_at, data, session_id, injection_count)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     record.id,
     record.title,
@@ -72,6 +81,7 @@ function add(todo) {
     record.source_type,
     record.source_id,
     record.project_id,
+    record.workspace_id,
     record.due_at,
     record.created_at,
     record.updated_at,
@@ -81,7 +91,7 @@ function add(todo) {
     record.injection_count
   )
 
-  console.log(`[TodoStore] Added: "${record.title}" (${record.priority}, source=${record.source_type || 'none'})`)
+  console.log(`[TodoStore] Added: "${record.title}" (${record.priority}, source=${record.source_type || 'none'}, ws=${record.workspace_id || '(unassigned)'})`)
 
   // Auto-prune old completed todos
   pruneCompleted()
@@ -123,7 +133,7 @@ function update(id, updates) {
 
   db.prepare(`
     UPDATE todos SET title = ?, description = ?, status = ?, priority = ?,
-      source_type = ?, source_id = ?, project_id = ?, due_at = ?,
+      source_type = ?, source_id = ?, project_id = ?, workspace_id = ?, due_at = ?,
       updated_at = ?, completed_at = ?, data = ?,
       session_id = ?, injection_count = ?
     WHERE id = ?
@@ -135,6 +145,7 @@ function update(id, updates) {
     merged.source_type,
     merged.source_id,
     merged.project_id,
+    merged.workspace_id ?? '',
     merged.due_at,
     merged.updated_at,
     merged.completed_at,
@@ -175,7 +186,9 @@ function getById(id) {
 /**
  * List incomplete (pending/in_progress) todos linked to a chat session that
  * still have remaining injection budget. Used by the chat route to remind
- * Claude of unfinished work even after context compaction.
+ * Claude of unfinished work even after context compaction. Session IDs are
+ * already workspace-scoped (chat_sessions.workspace_id), so no additional
+ * workspace filter is needed here.
  * @param {string} sessionId
  * @returns {Array}
  */
@@ -215,7 +228,11 @@ function markInjected(ids) {
 
 /**
  * List TODOs with optional filters.
- * @param {object} opts - { status?, priority?, project_id?, source_type?, session_id?, limit? }
+ *
+ * workspace_id: when a string (including ''), scopes the list to that workspace;
+ * when undefined, returns across all workspaces (admin/cross-WS view).
+ *
+ * @param {object} opts - { status?, priority?, project_id?, source_type?, session_id?, workspace_id?, limit? }
  * @returns {Array}
  */
 function list(opts = {}) {
@@ -243,6 +260,10 @@ function list(opts = {}) {
     conditions.push('session_id = ?')
     params.push(opts.session_id)
   }
+  if (opts.workspace_id === '' || typeof opts.workspace_id === 'string') {
+    conditions.push('workspace_id = ?')
+    params.push(opts.workspace_id)
+  }
 
   const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : ''
   const limit = opts.limit || 100
@@ -260,11 +281,15 @@ function list(opts = {}) {
 
 /**
  * Get summary counts by status.
+ * @param {string} [workspaceId] - Optional workspace filter
  * @returns {{ pending: number, in_progress: number, done: number, cancelled: number, updated_at: string|null }}
  */
-function getSummary() {
+function getSummary(workspaceId) {
   const db = getDb()
-  const rows = db.prepare('SELECT status, COUNT(*) as cnt FROM todos GROUP BY status').all()
+  const scoped = workspaceId === '' || typeof workspaceId === 'string'
+  const rows = scoped
+    ? db.prepare('SELECT status, COUNT(*) as cnt FROM todos WHERE workspace_id = ? GROUP BY status').all(workspaceId)
+    : db.prepare('SELECT status, COUNT(*) as cnt FROM todos GROUP BY status').all()
   const summary = { pending: 0, in_progress: 0, done: 0, cancelled: 0 }
   for (const row of rows) {
     if (summary.hasOwnProperty(row.status)) {
@@ -272,7 +297,9 @@ function getSummary() {
     }
   }
 
-  const latest = db.prepare('SELECT MAX(updated_at) as latest FROM todos').get()
+  const latest = scoped
+    ? db.prepare('SELECT MAX(updated_at) as latest FROM todos WHERE workspace_id = ?').get(workspaceId)
+    : db.prepare('SELECT MAX(updated_at) as latest FROM todos').get()
   summary.updated_at = latest?.latest || null
 
   return summary