@ghostpaw/questlog 0.10.1 → 0.11.1

package/dist/chunk-NBCCA6AX.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+// src/hooks/list_hooks.ts
+function listHooks(db) {
+  return db.prepare(`SELECT id, url, headers, tag, events, min_gap, created_at, last_wake,
+ (SELECT COUNT(*) FROM hook_assignments a LEFT JOIN hook_deliveries d ON d.id = a.delivery_id WHERE a.target_id = t.id AND (a.delivery_id IS NULL OR d.status = 'pending')) AS pending,
+ (SELECT COUNT(*) FROM hook_deliveries d WHERE d.target_id = t.id AND d.status = 'failed') AS failed
+ FROM hook_targets t ORDER BY id`).all().map((row) => {
+    const url = new URL(String(row.url));
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return {
+      id: Number(row.id),
+      headers: Object.fromEntries(
+        Object.keys(JSON.parse(String(row.headers))).map((name) => [name, "***"])
+      ),
+      scope: row.tag == null ? "database" : "tag",
+      url: url.href,
+      tag: row.tag == null ? null : String(row.tag),
+      events: JSON.parse(String(row.events)),
+      minGap: Number(row.min_gap),
+      createdAt: Number(row.created_at),
+      lastWake: row.last_wake == null ? null : Number(row.last_wake),
+      pending: Number(row.pending),
+      failed: Number(row.failed)
+    };
+  });
+}
+
+export { listHooks };

package/dist/chunk-QK3H2AL5.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// src/surfaces/text_output.ts
+var isTime = (key, value) => typeof value === "number" && value > 1e12 && /(At|Wake)$/.test(key);
+function scalar(key, value) {
+  if (value == null || value === "") return "-";
+  if (isTime(key, value)) return new Date(value).toISOString();
+  return String(value).replace(/[\r\n]+/g, " ");
+}
+function lines(value, indent, key = "") {
+  if (Array.isArray(value)) {
+    if (!value.length) return [`${indent}none`];
+    if (value.every((item) => item === null || typeof item !== "object"))
+      return [`${indent}${value.map((item) => scalar(key, item)).join(", ")}`];
+    return value.flatMap((item, index) => [...index ? [""] : [], ...lines(item, indent, key)]);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = [];
+    for (const [name, item] of Object.entries(value)) {
+      if (item !== null && typeof item === "object") {
+        const nested = lines(item, `${indent}  `, name);
+        if (Array.isArray(item) && nested.length === 1)
+          out.push(`${indent}${name}: ${nested[0]?.trim()}`);
+        else out.push(`${indent}${name}:`, ...nested);
+      } else out.push(`${indent}${name}: ${scalar(name, item)}`);
+    }
+    return out.length ? out : [`${indent}-`];
+  }
+  return [`${indent}${scalar(key, value)}`];
+}
+function textOutput(value) {
+  if (value == null) return "-";
+  if (Array.isArray(value) && !value.length) return "None";
+  return lines(value, "").join("\n");
+}
+
+export { textOutput };

package/dist/{chunk-55JAQORX.js → chunk-R56MXZ2K.js}

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
-import { tickQuestlog, removeHook, listDeliveries, listHooks, listDueRepeatableQuestAnchors, getRepeatableQuestOrThrow, spawnDueRepeatableQuests, deriveQuestState, deriveQuestMarkerId, queryQuestDetailRecords, resolveNow, withTransaction, getQuestOrThrow, parseRRule, mapQuestRewardRow, normalizeTagName } from './chunk-N7V7VUI5.js';
+import { tickQuestlog, removeHook, listDueRepeatableQuestAnchors, getRepeatableQuestOrThrow, spawnDueRepeatableQuests, deriveQuestState, deriveQuestMarkerId, queryQuestDetailRecords, resolveNow, withTransaction, getQuestOrThrow, parseRRule, mapQuestRewardRow, normalizeTagName } from './chunk-FORPYJT4.js';
+import { listDeliveries } from './chunk-D6EGZCT7.js';
+import { listHooks } from './chunk-NBCCA6AX.js';
 import { registerSchemaActions, minimalInput, requiredForAction } from './chunk-QYSIJ2YN.js';
 
 // src/questlines/map_questline_row.ts

package/dist/cli.js

@@ -13,5 +13,5 @@ function checkNodeVersion(version, stderr) {
 if (!checkNodeVersion(process.versions.node, process.stderr)) {
   process.exitCode = 2;
 } else {
-  await import('./cli_main-7AIEZV75.js');
+  await import('./cli_main-YW3E2NJM.js');
 }

package/dist/{cli_main-7AIEZV75.js → cli_main-YW3E2NJM.js}

@@ -1,9 +1,12 @@
 #!/usr/bin/env node
-import { CliUsageError, renderCliHelp, parseCliArgs } from './chunk-GVD6A3RR.js';
+import { questlogSkills } from './chunk-I2AMIXGP.js';
+import { CliUsageError, renderCliHelp, parseCliArgs } from './chunk-B5KVA6XE.js';
 import { isErrorResult, resolveQuestlogDbPath } from './chunk-IL2QRKZL.js';
-import { questlogSkills } from './chunk-D2W5MYNO.js';
-import { reviewQuestlogTool, validateInput, getQuestDetail, questlogSurfaceTools } from './chunk-55JAQORX.js';
-import { listDeliveries, questlogVersion } from './chunk-N7V7VUI5.js';
+import { reviewQuestlogTool, validateInput, getQuestDetail, questlogSurfaceTools } from './chunk-R56MXZ2K.js';
+import { questlogVersion } from './chunk-FORPYJT4.js';
+import { listDeliveries } from './chunk-D6EGZCT7.js';
+import './chunk-NBCCA6AX.js';
+import { schemaRows } from './chunk-7KTRNXTU.js';
 import { minimalInput } from './chunk-QYSIJ2YN.js';
 import { isSea } from 'node:sea';
 import { existsSync } from 'node:fs';
@@ -36,7 +39,7 @@ function cliVersion(version, {
 // src/surface/plain_dates.ts
 function parsePlainDue(raw, now = Date.now()) {
   const invalid = () => new CliUsageError(
-    `Invalid --due "${raw}". Use YYYY-MM-DD, DD.MM.YYYY, today, tomorrow, +3d or an ISO date-time.`
+    `Invalid --due "${raw}". Use YYYY-MM-DD, DD.MM.YYYY, today, tomorrow, +Nd (for example +3d), integer epoch milliseconds, or YYYY-MM-DDTHH:mm[:ss[.fraction]][Z|\xB1HH:mm] (no zone means local time).`
   );
   if (/^-?\d+$/.test(raw)) {
     const value = Number(raw);
@@ -62,7 +65,7 @@ function parsePlainDue(raw, now = Date.now()) {
     );
     date.setHours(23, 59, 59, 999);
   } else {
-    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/.test(raw))
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})?$/.test(raw))
       throw invalid();
     parsePlainDue(raw.slice(0, 10), now);
     date = new Date(raw);
@@ -115,7 +118,8 @@ Missing: ${r.clarification.missing.map((name) => `--${name}`).join(", ")}
 ` : `${r.summary}
 ${r.error.message}
 `;
-  if (r.data.deliveries && !r.data.item) return `${JSON.stringify(r.data.deliveries, null, 2)}
+  if (r.data.deliveries && !r.data.item)
+    return `${r.data.deliveries.map((d) => `${d.id} target ${d.targetId} ${d.status} attempts ${d.attempts} HTTP ${d.httpStatus ?? "-"} next ${new Date(d.nextAttemptAt).toISOString()} events ${d.events.map((e) => e.id).join(", ")}`).join("\n") || "No deliveries"}
 `;
   if (r.data.items) {
     const items = values.limit === void 0 ? r.data.items : r.data.items.slice(0, Math.max(0, Number(values.limit)));
@@ -205,7 +209,12 @@ ${values.dryRun ? `${JSON.stringify({ events: d.events, batches: d.batches }, nu
         flags: [
           { name: "title", type: "string" },
           { name: "tag", type: "array" },
-          { name: "objective", type: "string" },
+          {
+            name: "objective",
+            type: "string",
+            file: true,
+            description: "Quest objective text; defaults to the title."
+          },
           {
             name: "due",
             type: "string",
@@ -221,7 +230,10 @@ ${values.dryRun ? `${JSON.stringify({ events: d.events, batches: d.batches }, nu
             "give the title once: either as the first argument or with --title"
           );
         const title = v.positionalTitle ?? v.title;
-        if (title === void 0) throw new CliUsageError("Missing required argument: title");
+        if (title === void 0)
+          throw new CliUsageError(
+            'Missing required argument: title. Example: questlog add "Write the report" --due tomorrow'
+          );
         const quest = {
           title,
           objective: v.objective ?? title
@@ -315,7 +327,7 @@ var questlogCliOptions = {
   describeDb: (options) => `Database: ${selectedDbPath(options)}
 Use --db <path> or GHOSTPAW_QUESTLOG_DB to override the default ~/.ghostpaw/questlog.db.`,
   openContext: async (options) => {
-    const { openQuestlogDb } = await import('./open_questlog_db-LAEH7UDM.js');
+    const { openQuestlogDb } = await import('./open_questlog_db-6NS6BVBC.js');
     const path = selectedDbPath(options);
     const created = path !== ":memory:" && !existsSync(path);
     const db = await openQuestlogDb(path);
@@ -327,22 +339,56 @@ Use --db <path> or GHOSTPAW_QUESTLOG_DB to override the default ~/.ghostpaw/ques
   commands: {
     names: ["hook", "watch"],
     run: async (command, args, options, io) => {
+      if (command === "show" && args[0]?.startsWith("d_")) {
+        const { listDeliveries: listDeliveries2 } = await import('./list_deliveries-WJEJUZIQ.js');
+        const { listHooks } = await import('./list_hooks-C5CAA2C7.js');
+        const { textOutput } = await import('./text_output-X7F3K23Q.js');
+        if (args.includes("--help") || args.includes("-h")) {
+          io.stdout.write("questlog show <delivery-id> [--json]\n");
+          return 0;
+        }
+        const { openQuestlogDb } = await import('./open_questlog_db-6NS6BVBC.js');
+        const db = await openQuestlogDb(selectedDbPath(options));
+        try {
+          const delivery = listDeliveries2(db, { includeDelivered: true }).find(
+            (d) => d.id === args[0]
+          );
+          if (!delivery) {
+            io.stderr.write(`Delivery ${args[0]} not found
+`);
+            return 1;
+          }
+          const target = listHooks(db).find((h) => h.id === delivery.targetId);
+          const result = {
+            ...delivery,
+            target: target ?? null,
+            eventIds: delivery.events.map((e) => e.id)
+          };
+          io.stdout.write(
+            `${args.includes("--json") ? JSON.stringify(result, null, 2) : textOutput(result)}
+`
+          );
+          return 0;
+        } finally {
+          db.close();
+        }
+      }
       if (command !== "hook" && command !== "watch") return void 0;
-      const { runHookCommand } = await import('./run_hook_command-C42BQC36.js');
+      const { runHookCommand } = await import('./run_hook_command-OGLBKXAV.js');
       return runHookCommand(command, args, io, async () => {
-        const { openQuestlogDb } = await import('./open_questlog_db-LAEH7UDM.js');
+        const { openQuestlogDb } = await import('./open_questlog_db-6NS6BVBC.js');
         return openQuestlogDb(selectedDbPath(options));
       });
     },
     plain: questlogPlainCommands(),
     guides: questlogSkills,
     mcp: async (options) => {
-      const { serveQuestlogMcp } = await import('./serve_questlog_mcp-W3R63HW4.js');
+      const { serveQuestlogMcp } = await import('./serve_questlog_mcp-YRCT3GA3.js');
       await serveQuestlogMcp(options.db === void 0 ? {} : { dbPath: options.db });
     },
     skill: async () => {
-      const { renderSkillMarkdown } = await import('./skill_markdown-HXYQ3K6U.js');
-      const { questlogSkillSpec } = await import('./questlog_skill_spec-HEW2B6EB.js');
+      const { renderSkillMarkdown } = await import('./skill_markdown-EGKYZ3W2.js');
+      const { questlogSkillSpec } = await import('./questlog_skill_spec-S5OYGF5X.js');
       return renderSkillMarkdown(questlogSkillSpec);
     }
   }
@@ -437,6 +483,13 @@ Version formats: --version --short, --version --json
 ${options.describeDb ? `${options.describeDb(ctxOptions)}
 ` : ""}
 ${options.tools.map((tool2) => `${tool2.name}  ${tool2.description}`).join("\n")}
+`
+    );
+    return 0;
+  }
+  if (["tools", "call", "describe"].includes(command) && args.length === 1 && ["--help", "-h"].includes(args[0] ?? "")) {
+    stdout.write(
+      `Usage: ${options.bin} ${command}${command === "tools" ? " [--json]" : " <tool> [--help]"}
 `
     );
     return 0;
@@ -455,16 +508,21 @@ ${options.tools.map((tool2) => `${tool2.name}  ${tool2.description}`).join("\n")
   }
   if (command === "skill") {
     if (!options.commands?.skill) return fail("skill command unavailable");
-    if (args.length > 1) return fail(`Usage: ${options.bin} skill [--list | <guide> | --help]`);
-    const guide = args[0];
+    if (args.length > 1 && !args.some((arg) => ["--help", "-h"].includes(arg)))
+      return fail(`Usage: ${options.bin} skill [--short | --list | <guide> | --help]`);
+    const guide = args.some((arg) => ["--help", "-h"].includes(arg)) ? "--help" : args[0];
     if (guide === "--help" || guide === "-h") {
       stdout.write(
         `Usage:
   ${options.bin} skill
   ${options.bin} skill --list
+  ${options.bin} skill --short
   ${options.bin} skill <guide>
 `
       );
+    } else if (guide === "--short") {
+      const full = await options.commands.skill();
+      stdout.write(full.split("## Appendix:")[0]?.replace(/^---[\s\S]*?---\n+/, "") ?? full);
     } else if (guide === "--list") {
       stdout.write(
         `${(options.commands.guides ?? []).map((entry) => `${entry.name}  ${entry.description.replace(/\s+/g, " ")}`).join("\n")}
@@ -477,6 +535,11 @@ ${options.tools.map((tool2) => `${tool2.name}  ${tool2.description}`).join("\n")
     } else stdout.write(await options.commands.skill());
     return 0;
   }
+  if (command === "mcp" && (args.includes("--help") || args.includes("-h"))) {
+    stdout.write(`${options.bin} mcp [--db path]
+`);
+    return 0;
+  }
   if (command === "mcp") {
     if (!options.commands?.mcp) return fail("mcp command unavailable");
     await options.commands.mcp(ctxOptions);
@@ -528,26 +591,25 @@ ${options.tools.map((tool2) => `${tool2.name}  ${tool2.description}`).join("\n")
     ]);
     return fail(`Unknown command: ${command}.${suggestion ? ` Did you mean ${suggestion}?` : ""}`);
   }
-  if (command === "describe") {
+  if (command === "describe" || args.includes("--help") || args.includes("-h")) {
     stdout.write(
       `${tool.name}
+Usage: ${options.bin} ${tool.name} --parameter value [--json]
 ${tool.description}
 Use when: ${tool.whenToUse ?? ""}
 Not for: ${tool.whenNotToUse ?? ""}
 Read only: ${tool.readOnly ?? false}
 
 Parameter | Type | Required | Description
-${Object.entries(
-        tool.inputSchema.properties ?? {}
-      ).map(
-        ([key, schema]) => `${key} | ${schema.type ?? "oneOf"} | ${tool.inputSchema.required?.includes(key) ?? false} | ${schema.description ?? ""}`
-      ).join("\n")}
+${schemaRows(tool.inputSchema).join("\n")}
 
 ${JSON.stringify(tool.inputSchema, null, 2)}
 `
     );
     return 0;
   }
+  const json = args.includes("--json");
+  if (!plain && json) args.splice(args.indexOf("--json"), 1);
   let input = {};
   try {
     const readStdin = async () => {

package/dist/index.cjs

@@ -45,13 +45,20 @@ function addHook(db, input) {
   } catch {
     throw new Error("Expected an HTTP or HTTPS URL");
   }
-  if (!["http:", "https:"].includes(url.protocol)) throw new Error("Expected an HTTP or HTTPS URL");
+  if (!["http:", "https:"].includes(url.protocol))
+    throw new Error(`unsupported scheme ${url.protocol}; use http or https`);
+  if (url.username || url.password)
+    throw new Error(
+      "URL userinfo is not supported; use a custom header (--header or --header-stdin) or a query key instead"
+    );
   const minGap = input.minGap ?? 60;
   if (!Number.isSafeInteger(minGap) || minGap < 0)
     throw new Error("Min gap must be a nonnegative integer");
   const events = input.events ?? [...hookEventTypes];
   if (!events.length || events.some((e) => !hookEventTypes.includes(e)))
-    throw new Error("Unknown event filter");
+    throw new Error(
+      `unknown event ${events.find((e) => !hookEventTypes.includes(e)) ?? "(empty)"}; valid: ${hookEventTypes.join(", ")}`
+    );
   if (input.tag !== void 0 && !normalizeTagName(input.tag))
     throw new Error("Expected a tag name");
   const secret = input.secret ?? node_crypto.randomBytes(32).toString("hex");
@@ -106,7 +113,7 @@ function listDeliveries(db, options = {}) {
 
 // src/hooks/list_hooks.ts
 function listHooks(db) {
-  return db.prepare(`SELECT id, url, tag, events, min_gap, created_at, last_wake,
+  return db.prepare(`SELECT id, url, headers, tag, events, min_gap, created_at, last_wake,
  (SELECT COUNT(*) FROM hook_assignments a LEFT JOIN hook_deliveries d ON d.id = a.delivery_id WHERE a.target_id = t.id AND (a.delivery_id IS NULL OR d.status = 'pending')) AS pending,
  (SELECT COUNT(*) FROM hook_deliveries d WHERE d.target_id = t.id AND d.status = 'failed') AS failed
  FROM hook_targets t ORDER BY id`).all().map((row) => {
@@ -117,6 +124,9 @@ function listHooks(db) {
     url.hash = "";
     return {
       id: Number(row.id),
+      headers: Object.fromEntries(
+        Object.keys(JSON.parse(String(row.headers))).map((name) => [name, "***"])
+      ),
       scope: row.tag == null ? "database" : "tag",
       url: url.href,
       tag: row.tag == null ? null : String(row.tag),
@@ -175,7 +185,7 @@ function removeHook(db, id) {
 }
 
 // src/version.ts
-var questlogVersion = "0.10.1";
+var questlogVersion = "0.11.1";
 
 // src/hooks/send_hook_delivery.ts
 async function sendHookDelivery(db, delivery, target, options) {
@@ -196,8 +206,13 @@ async function sendHookDelivery(db, delivery, target, options) {
       method: "POST",
       redirect: "error",
       headers: {
-        "content-type": "application/json",
         "user-agent": `questlog/${questlogVersion}`,
+        ...JSON.parse(
+          String(
+            db.prepare("SELECT headers FROM hook_targets WHERE id = ?").get(target.id)?.headers ?? "{}"
+          )
+        ),
+        "content-type": "application/json",
         "x-questlog-delivery": delivery.id,
         "x-questlog-timestamp": timestamp,
         "x-questlog-signature": `sha256=${signature}`
@@ -1021,6 +1036,8 @@ function initHookTables(db) {
  CREATE INDEX IF NOT EXISTS idx_hook_deliveries_target ON hook_deliveries(target_id, status, next_attempt_at);
  CREATE TABLE IF NOT EXISTS hook_settings (id INTEGER PRIMARY KEY CHECK(id = 1), label TEXT NOT NULL);
  `);
+  if (!db.prepare("PRAGMA table_info(hook_targets)").all().some((row) => row.name === "headers"))
+    db.exec("ALTER TABLE hook_targets ADD COLUMN headers TEXT NOT NULL DEFAULT '{}'");
 }
 
 // src/questlines/init_questline_tables.ts
@@ -3300,7 +3317,7 @@ Failure handling:
 var webhooksSkill = defineQuestlogSkill({
   name: "webhooks",
   description: "Configure signed outbound event webhooks and verify deliveries.",
-  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
+  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets and custom header values are stored in the DB. New POSIX DB/WAL/SHM files use 0600 and created directories use 0700; existing DB modes are preserved. Windows uses existing access controls.\nUse repeatable `--header "Name: value"` or `--header-stdin` (one line per header, avoiding shell history). Headers are sent on every delivery and test; output shows names with `***` values. HTTP token names are required; host, content-length, content-type, and x-questlog-* are reserved. Change headers by removing and adding the hook again. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected; use a custom header or query key.\n`questlog show d_\u2026` displays delivery status, attempts, HTTP status, next attempt, redacted target URL and event ids. Text is the default; --json prints JSON. Missing hook remove/test targets exit 3; missing quests/deliveries exit 1. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
 });
 
 // src/skills/skill_registry.ts

package/dist/index.js

@@ -43,13 +43,20 @@ function addHook(db, input) {
   } catch {
     throw new Error("Expected an HTTP or HTTPS URL");
   }
-  if (!["http:", "https:"].includes(url.protocol)) throw new Error("Expected an HTTP or HTTPS URL");
+  if (!["http:", "https:"].includes(url.protocol))
+    throw new Error(`unsupported scheme ${url.protocol}; use http or https`);
+  if (url.username || url.password)
+    throw new Error(
+      "URL userinfo is not supported; use a custom header (--header or --header-stdin) or a query key instead"
+    );
   const minGap = input.minGap ?? 60;
   if (!Number.isSafeInteger(minGap) || minGap < 0)
     throw new Error("Min gap must be a nonnegative integer");
   const events = input.events ?? [...hookEventTypes];
   if (!events.length || events.some((e) => !hookEventTypes.includes(e)))
-    throw new Error("Unknown event filter");
+    throw new Error(
+      `unknown event ${events.find((e) => !hookEventTypes.includes(e)) ?? "(empty)"}; valid: ${hookEventTypes.join(", ")}`
+    );
   if (input.tag !== void 0 && !normalizeTagName(input.tag))
     throw new Error("Expected a tag name");
   const secret = input.secret ?? randomBytes(32).toString("hex");
@@ -104,7 +111,7 @@ function listDeliveries(db, options = {}) {
 
 // src/hooks/list_hooks.ts
 function listHooks(db) {
-  return db.prepare(`SELECT id, url, tag, events, min_gap, created_at, last_wake,
+  return db.prepare(`SELECT id, url, headers, tag, events, min_gap, created_at, last_wake,
  (SELECT COUNT(*) FROM hook_assignments a LEFT JOIN hook_deliveries d ON d.id = a.delivery_id WHERE a.target_id = t.id AND (a.delivery_id IS NULL OR d.status = 'pending')) AS pending,
  (SELECT COUNT(*) FROM hook_deliveries d WHERE d.target_id = t.id AND d.status = 'failed') AS failed
  FROM hook_targets t ORDER BY id`).all().map((row) => {
@@ -115,6 +122,9 @@ function listHooks(db) {
     url.hash = "";
     return {
       id: Number(row.id),
+      headers: Object.fromEntries(
+        Object.keys(JSON.parse(String(row.headers))).map((name) => [name, "***"])
+      ),
       scope: row.tag == null ? "database" : "tag",
       url: url.href,
       tag: row.tag == null ? null : String(row.tag),
@@ -173,7 +183,7 @@ function removeHook(db, id) {
 }
 
 // src/version.ts
-var questlogVersion = "0.10.1";
+var questlogVersion = "0.11.1";
 
 // src/hooks/send_hook_delivery.ts
 async function sendHookDelivery(db, delivery, target, options) {
@@ -194,8 +204,13 @@ async function sendHookDelivery(db, delivery, target, options) {
       method: "POST",
       redirect: "error",
       headers: {
-        "content-type": "application/json",
         "user-agent": `questlog/${questlogVersion}`,
+        ...JSON.parse(
+          String(
+            db.prepare("SELECT headers FROM hook_targets WHERE id = ?").get(target.id)?.headers ?? "{}"
+          )
+        ),
+        "content-type": "application/json",
         "x-questlog-delivery": delivery.id,
         "x-questlog-timestamp": timestamp,
         "x-questlog-signature": `sha256=${signature}`
@@ -1019,6 +1034,8 @@ function initHookTables(db) {
  CREATE INDEX IF NOT EXISTS idx_hook_deliveries_target ON hook_deliveries(target_id, status, next_attempt_at);
  CREATE TABLE IF NOT EXISTS hook_settings (id INTEGER PRIMARY KEY CHECK(id = 1), label TEXT NOT NULL);
  `);
+  if (!db.prepare("PRAGMA table_info(hook_targets)").all().some((row) => row.name === "headers"))
+    db.exec("ALTER TABLE hook_targets ADD COLUMN headers TEXT NOT NULL DEFAULT '{}'");
 }
 
 // src/questlines/init_questline_tables.ts
@@ -3298,7 +3315,7 @@ Failure handling:
 var webhooksSkill = defineQuestlogSkill({
   name: "webhooks",
   description: "Configure signed outbound event webhooks and verify deliveries.",
-  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
+  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets and custom header values are stored in the DB. New POSIX DB/WAL/SHM files use 0600 and created directories use 0700; existing DB modes are preserved. Windows uses existing access controls.\nUse repeatable `--header "Name: value"` or `--header-stdin` (one line per header, avoiding shell history). Headers are sent on every delivery and test; output shows names with `***` values. HTTP token names are required; host, content-length, content-type, and x-questlog-* are reserved. Change headers by removing and adding the hook again. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected; use a custom header or query key.\n`questlog show d_\u2026` displays delivery status, attempts, HTTP status, next attempt, redacted target URL and event ids. Text is the default; --json prints JSON. Missing hook remove/test targets exit 3; missing quests/deliveries exit 1. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
 });
 
 // src/skills/skill_registry.ts

package/dist/list_deliveries-WJEJUZIQ.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { listDeliveries } from './chunk-D6EGZCT7.js';

package/dist/list_hooks-C5CAA2C7.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { listHooks } from './chunk-NBCCA6AX.js';

package/dist/mcp-server.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { mkdirSync } from 'node:fs';
+import { mkdirSync, closeSync, openSync } from 'node:fs';
 import { basename, extname, dirname, join } from 'node:path';
 import { randomBytes, createHmac } from 'node:crypto';
 import { homedir } from 'node:os';
@@ -345,6 +345,8 @@ function initHookTables(db) {
  CREATE INDEX IF NOT EXISTS idx_hook_deliveries_target ON hook_deliveries(target_id, status, next_attempt_at);
  CREATE TABLE IF NOT EXISTS hook_settings (id INTEGER PRIMARY KEY CHECK(id = 1), label TEXT NOT NULL);
  `);
+  if (!db.prepare("PRAGMA table_info(hook_targets)").all().some((row) => row.name === "headers"))
+    db.exec("ALTER TABLE hook_targets ADD COLUMN headers TEXT NOT NULL DEFAULT '{}'");
 }
 var init_init_hook_tables = __esm({
   "src/hooks/init_hook_tables.ts"() {
@@ -766,7 +768,14 @@ async function openQuestlogDb(path) {
   } finally {
     process.emitWarning = original;
   }
-  if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });
+  if (path !== ":memory:") {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    try {
+      closeSync(openSync(path, "wx", 384));
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+  }
   const db = new sqlite.DatabaseSync(path);
   try {
     db.exec("PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000;");
@@ -788,7 +797,7 @@ var init_open_questlog_db = __esm({
 var questlogVersion;
 var init_version = __esm({
   "src/version.ts"() {
-    questlogVersion = "0.10.1";
+    questlogVersion = "0.11.1";
   }
 });
 
@@ -2137,7 +2146,7 @@ var init_hook_label = __esm({
 
 // src/hooks/list_hooks.ts
 function listHooks(db) {
-  return db.prepare(`SELECT id, url, tag, events, min_gap, created_at, last_wake,
+  return db.prepare(`SELECT id, url, headers, tag, events, min_gap, created_at, last_wake,
  (SELECT COUNT(*) FROM hook_assignments a LEFT JOIN hook_deliveries d ON d.id = a.delivery_id WHERE a.target_id = t.id AND (a.delivery_id IS NULL OR d.status = 'pending')) AS pending,
  (SELECT COUNT(*) FROM hook_deliveries d WHERE d.target_id = t.id AND d.status = 'failed') AS failed
  FROM hook_targets t ORDER BY id`).all().map((row) => {
@@ -2148,6 +2157,9 @@ function listHooks(db) {
     url.hash = "";
     return {
       id: Number(row.id),
+      headers: Object.fromEntries(
+        Object.keys(JSON.parse(String(row.headers))).map((name) => [name, "***"])
+      ),
       scope: row.tag == null ? "database" : "tag",
       url: url.href,
       tag: row.tag == null ? null : String(row.tag),
@@ -2236,8 +2248,13 @@ async function sendHookDelivery(db, delivery, target, options) {
       method: "POST",
       redirect: "error",
       headers: {
-        "content-type": "application/json",
         "user-agent": `questlog/${questlogVersion}`,
+        ...JSON.parse(
+          String(
+            db.prepare("SELECT headers FROM hook_targets WHERE id = ?").get(target.id)?.headers ?? "{}"
+          )
+        ),
+        "content-type": "application/json",
         "x-questlog-delivery": delivery.id,
         "x-questlog-timestamp": timestamp,
         "x-questlog-signature": `sha256=${signature}`