@hasna/todos 0.11.52 → 0.11.53

package/dist/mcp/index.js

@@ -1224,6 +1224,15 @@ function ensureSchema(db) {
       task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
       tag TEXT NOT NULL, PRIMARY KEY (task_id, tag)
     )`);
+  ensureTable("tags", `
+    CREATE TABLE tags (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL UNIQUE,
+      color TEXT,
+      description TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
   ensureTable("task_dependencies", `
     CREATE TABLE task_dependencies (
       task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
@@ -1437,6 +1446,36 @@ function ensureSchema(db) {
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_git_refs_task ON task_git_refs(task_id)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_git_refs_lookup ON task_git_refs(ref_type, name)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_git_refs_url ON task_git_refs(url)");
+  ensureTable("task_commits", `
+    CREATE TABLE task_commits (
+      id TEXT PRIMARY KEY,
+      task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      sha TEXT NOT NULL,
+      message TEXT,
+      author TEXT,
+      files_changed TEXT,
+      committed_at TEXT,
+      branch TEXT,
+      pr_url TEXT,
+      pr_number INTEGER,
+      pr_state TEXT,
+      ci_snapshot TEXT,
+      release_tag TEXT,
+      repo_path TEXT,
+      traceability TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE(task_id, sha)
+    )`);
+  ensureColumn("task_commits", "branch", "TEXT");
+  ensureColumn("task_commits", "pr_url", "TEXT");
+  ensureColumn("task_commits", "pr_number", "INTEGER");
+  ensureColumn("task_commits", "pr_state", "TEXT");
+  ensureColumn("task_commits", "ci_snapshot", "TEXT");
+  ensureColumn("task_commits", "release_tag", "TEXT");
+  ensureColumn("task_commits", "repo_path", "TEXT");
+  ensureColumn("task_commits", "traceability", "TEXT DEFAULT '{}'");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_commits_task ON task_commits(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_commits_sha ON task_commits(sha)");
   ensureTable("task_verifications", `
     CREATE TABLE task_verifications (
       id TEXT PRIMARY KEY,
@@ -1621,6 +1660,9 @@ function ensureSchema(db) {
   ensureColumn("tasks", "max_retries", "INTEGER DEFAULT 3");
   ensureColumn("tasks", "retry_after", "TEXT");
   ensureColumn("tasks", "sla_minutes", "INTEGER");
+  ensureColumn("tasks", "scheduled_start_at", "TEXT");
+  ensureColumn("tasks", "priority_score", "INTEGER");
+  ensureColumn("tasks", "priority_reason", "TEXT");
   ensureColumn("tasks", "archived_at", "TEXT");
   ensureColumn("agents", "role", "TEXT DEFAULT 'agent'");
   ensureColumn("agents", "permissions", `TEXT DEFAULT '["*"]'`);
@@ -1743,6 +1785,7 @@ function ensureSchema(db) {
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_lists_slug ON task_lists(slug)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_tags_tag ON task_tags(tag)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_tags_task ON task_tags(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_tags_name ON tags(name)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_project ON plans(project_id)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_status ON plans(status)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_task_list ON plans(task_list_id)");
@@ -1880,6 +1923,217 @@ function ensureSchema(db) {
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_cycles_dates ON cycles(start_date, end_date)");
   ensureColumn("tasks", "cycle_id", "TEXT REFERENCES cycles(id) ON DELETE SET NULL");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_tasks_cycle ON tasks(cycle_id) WHERE cycle_id IS NOT NULL");
+  ensureTable("labels", `
+    CREATE TABLE labels (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+      name TEXT NOT NULL,
+      color TEXT,
+      description TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE(project_id, name)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_labels_project ON labels(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_labels_name ON labels(name)");
+  ensureTable("task_labels", `
+    CREATE TABLE task_labels (
+      task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      label_id TEXT NOT NULL REFERENCES labels(id) ON DELETE CASCADE,
+      PRIMARY KEY (task_id, label_id)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_labels_task ON task_labels(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_labels_label ON task_labels(label_id)");
+  ensureTable("custom_field_definitions", `
+    CREATE TABLE custom_field_definitions (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+      name TEXT NOT NULL,
+      slug TEXT NOT NULL,
+      field_type TEXT NOT NULL CHECK(field_type IN ('text', 'number', 'boolean', 'date', 'enum')),
+      options TEXT DEFAULT '[]',
+      required INTEGER NOT NULL DEFAULT 0,
+      default_value TEXT,
+      sort_order INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE(project_id, slug)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_custom_fields_project ON custom_field_definitions(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_custom_fields_slug ON custom_field_definitions(slug)");
+  ensureTable("task_custom_field_values", `
+    CREATE TABLE task_custom_field_values (
+      task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      field_id TEXT NOT NULL REFERENCES custom_field_definitions(id) ON DELETE CASCADE,
+      value TEXT,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      PRIMARY KEY (task_id, field_id)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_custom_values_task ON task_custom_field_values(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_custom_values_field ON task_custom_field_values(field_id)");
+  ensureTable("saved_views", `
+    CREATE TABLE saved_views (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL UNIQUE,
+      slug TEXT NOT NULL UNIQUE,
+      entity_type TEXT NOT NULL DEFAULT 'task',
+      filters TEXT NOT NULL DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_saved_views_slug ON saved_views(slug)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_saved_views_entity ON saved_views(entity_type)");
+  ensureTable("decision_records", `
+    CREATE TABLE decision_records (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      task_id TEXT REFERENCES tasks(id) ON DELETE SET NULL,
+      plan_id TEXT REFERENCES plans(id) ON DELETE SET NULL,
+      agent_id TEXT,
+      sequence_num INTEGER NOT NULL,
+      short_ref TEXT NOT NULL UNIQUE,
+      title TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'proposed' CHECK(status IN ('proposed', 'accepted', 'deprecated', 'superseded', 'rejected')),
+      context TEXT,
+      decision TEXT NOT NULL,
+      consequences TEXT,
+      alternatives TEXT DEFAULT '[]',
+      tags TEXT DEFAULT '[]',
+      supersedes_id TEXT REFERENCES decision_records(id) ON DELETE SET NULL,
+      superseded_by_id TEXT REFERENCES decision_records(id) ON DELETE SET NULL,
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_project ON decision_records(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_task ON decision_records(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_plan ON decision_records(plan_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_status ON decision_records(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_decision_records_short_ref ON decision_records(short_ref)");
+  ensureTable("knowledge_snapshots", `
+    CREATE TABLE knowledge_snapshots (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      title TEXT NOT NULL,
+      summary TEXT,
+      content_hash TEXT NOT NULL,
+      snapshot TEXT NOT NULL,
+      decision_ids TEXT DEFAULT '[]',
+      topics TEXT DEFAULT '[]',
+      source TEXT NOT NULL DEFAULT 'auto' CHECK(source IN ('manual', 'auto', 'import')),
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_knowledge_snapshots_project ON knowledge_snapshots(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_knowledge_snapshots_hash ON knowledge_snapshots(content_hash)");
+  ensureTable("verification_records", `
+    CREATE TABLE verification_records (
+      id TEXT PRIMARY KEY,
+      task_id TEXT REFERENCES tasks(id) ON DELETE CASCADE,
+      provider_name TEXT NOT NULL,
+      provider_type TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'unknown' CHECK(status IN ('passed', 'failed', 'unknown')),
+      summary TEXT,
+      evidence TEXT DEFAULT '{}',
+      artifact_id TEXT,
+      started_at TEXT,
+      completed_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_verification_records_task ON verification_records(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_verification_records_status ON verification_records(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_verification_records_created ON verification_records(created_at)");
+  ensureTable("task_leases", `
+    CREATE TABLE task_leases (
+      task_id TEXT PRIMARY KEY REFERENCES tasks(id) ON DELETE CASCADE,
+      agent_id TEXT NOT NULL,
+      acquired_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      heartbeat_at TEXT,
+      steal_count INTEGER NOT NULL DEFAULT 0,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_leases_agent ON task_leases(agent_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_leases_expires ON task_leases(expires_at)");
+  ensureTable("reminder_preferences", `
+    CREATE TABLE reminder_preferences (
+      id TEXT PRIMARY KEY,
+      due_soon_hours INTEGER NOT NULL DEFAULT 24,
+      sla_warning_minutes INTEGER NOT NULL DEFAULT 30,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      desktop_notify INTEGER NOT NULL DEFAULT 0,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureTable("notification_reminders", `
+    CREATE TABLE notification_reminders (
+      id TEXT PRIMARY KEY,
+      task_id TEXT REFERENCES tasks(id) ON DELETE CASCADE,
+      reminder_type TEXT NOT NULL CHECK(reminder_type IN ('due_soon', 'due_overdue', 'sla_warning', 'sla_breach', 'custom')),
+      title TEXT NOT NULL,
+      message TEXT,
+      trigger_at TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'fired', 'dismissed', 'snoozed')),
+      snoozed_until TEXT,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      agent_id TEXT,
+      priority TEXT NOT NULL DEFAULT 'medium',
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      fired_at TEXT,
+      dismissed_at TEXT
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_task ON notification_reminders(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_status ON notification_reminders(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_trigger ON notification_reminders(trigger_at)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_project ON notification_reminders(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_notification_reminders_agent ON notification_reminders(agent_id)");
+  ensureTable("run_records", `
+    CREATE TABLE run_records (
+      id TEXT PRIMARY KEY,
+      agent_run_id TEXT,
+      agent_id TEXT,
+      objective TEXT,
+      plan_id TEXT REFERENCES plans(id) ON DELETE SET NULL,
+      claimed_task_ids TEXT DEFAULT '[]',
+      commands TEXT DEFAULT '[]',
+      stdout_summary TEXT,
+      stderr_summary TEXT,
+      files_touched TEXT DEFAULT '[]',
+      verification_results TEXT DEFAULT '[]',
+      artifact_ids TEXT DEFAULT '[]',
+      status_transitions TEXT DEFAULT '[]',
+      status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active', 'completed', 'failed', 'archived')),
+      replay_bundle TEXT,
+      metadata TEXT DEFAULT '{}',
+      started_at TEXT NOT NULL DEFAULT (datetime('now')),
+      completed_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_agent_run ON run_records(agent_run_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_agent ON run_records(agent_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_plan ON run_records(plan_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_status ON run_records(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_run_records_started ON run_records(started_at)");
+  ensureTable("activity_log", `
+    CREATE TABLE activity_log (
+      id TEXT PRIMARY KEY,
+      entity_type TEXT NOT NULL,
+      entity_id TEXT NOT NULL,
+      action TEXT NOT NULL,
+      field TEXT,
+      old_value TEXT,
+      new_value TEXT,
+      actor_id TEXT,
+      session_id TEXT,
+      machine_id TEXT,
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_activity_log_entity ON activity_log(entity_type, entity_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_activity_log_actor ON activity_log(actor_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_activity_log_action ON activity_log(action)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_activity_log_created ON activity_log(created_at)");
   ensureTable("api_keys", `
     CREATE TABLE api_keys (
       id TEXT PRIMARY KEY,
@@ -2331,11 +2585,17 @@ function ensureDir(filePath) {
   }
 }
 function getDatabase(dbPath) {
-  if (_db)
-    return _db;
   const path = dbPath || getDbPath();
+  if (_db && _dbPath === path)
+    return _db;
+  if (_db && _dbPath !== path) {
+    _db.close();
+    _db = null;
+    _dbPath = null;
+  }
   ensureDir(path);
   _db = new Database(path);
+  _dbPath = path;
   _db.run("PRAGMA journal_mode = WAL");
   _db.run("PRAGMA busy_timeout = 5000");
   _db.run("PRAGMA foreign_keys = ON");
@@ -2348,10 +2608,12 @@ function closeDatabase() {
   if (_db) {
     _db.close();
     _db = null;
+    _dbPath = null;
   }
 }
 function resetDatabase() {
   _db = null;
+  _dbPath = null;
 }
 function now() {
   return new Date().toISOString();
@@ -2412,7 +2674,7 @@ function resolvePartialId(db, table, partialId) {
   }
   return null;
 }
-var LOCK_EXPIRY_MINUTES = 30, _db = null, ALLOWED_TABLES;
+var LOCK_EXPIRY_MINUTES = 30, _db = null, _dbPath = null, ALLOWED_TABLES;
 var init_database = __esm(() => {
   init_schema();
   init_machines();
@@ -8423,9 +8685,10 @@ function redactExportRecord(record) {
   }
   return base;
 }
-var REDACTION_PLACEHOLDER = "[REDACTED]", DEFAULT_PATTERNS, DEFAULT_ALLOWLIST, customRedactors;
+var SECRET_REDACTION_SCHEMA, REDACTION_PLACEHOLDER = "[REDACTED]", DEFAULT_PATTERNS, DEFAULT_ALLOWLIST, customRedactors;
 var init_secret_redaction = __esm(() => {
   init_redaction();
+  SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
     { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
@@ -12293,11 +12556,19 @@ function getTaskVerifications(taskId, db) {
 }
 function getTaskTraceability(taskId, db) {
   const d = db || getDatabase();
+  const commits = getTaskCommits(taskId, d);
+  const gitRefs = getTaskGitRefs(taskId, d);
   return {
     task_id: taskId,
-    commits: getTaskCommits(taskId, d),
-    git_refs: getTaskGitRefs(taskId, d),
-    verifications: getTaskVerifications(taskId, d)
+    commits,
+    git_refs: gitRefs,
+    verifications: getTaskVerifications(taskId, d),
+    branches: Array.from(new Set([
+      ...commits.map((commit) => commit.branch).filter((branch) => Boolean(branch)),
+      ...gitRefs.filter((ref) => ref.ref_type === "branch").map((ref) => ref.name)
+    ])).sort(),
+    release_tags: Array.from(new Set(commits.map((commit) => commit.release_tag).filter((tag) => Boolean(tag)))).sort(),
+    pull_requests: commits.filter((commit) => commit.pr_url).map((commit) => ({ url: commit.pr_url, state: commit.pr_state, number: commit.pr_number }))
   };
 }
 var init_task_commits = __esm(() => {
@@ -14069,6 +14340,13 @@ function registerTaskCrudTools(server, ctx) {
     }
     return current.version;
   }
+  function resolveAssignee(value) {
+    try {
+      return resolveId(value, "agents");
+    } catch {
+      return value;
+    }
+  }
   if (shouldRegisterTool("create_task")) {
     server.tool("create_task", "Create a new task in a project. Pass short_id=null to auto-generate.", {
       title: exports_external.string().describe("Task title"),
@@ -14091,7 +14369,7 @@ function registerTaskCrudTools(server, ctx) {
         const { depends_on, assigned_to, project_id, task_list_id, tags, estimate, confidence, retry_count, deadline, ...rest } = params;
         const resolved = { ...rest };
         if (assigned_to)
-          resolved.assigned_to = resolveId(assigned_to, "agents");
+          resolved.assigned_to = resolveAssignee(assigned_to);
         if (project_id)
           resolved.project_id = resolveId(project_id, "projects");
         if (task_list_id)
@@ -14135,7 +14413,7 @@ function registerTaskCrudTools(server, ctx) {
         if (params.task_list_id)
           resolved.task_list_id = resolveId(params.task_list_id, "task_lists");
         if (params.assigned_to)
-          resolved.assigned_to = resolveId(params.assigned_to, "agents");
+          resolved.assigned_to = resolveAssignee(params.assigned_to);
         const tasks = listTasks(resolved, undefined);
         if (tasks.length === 0)
           return { content: [{ type: "text", text: "No tasks found." }] };
@@ -14232,7 +14510,7 @@ ${task.description}` : null
         if (resolved.assigned_to === "")
           resolved.assigned_to = null;
         if (resolved.assigned_to && typeof resolved.assigned_to === "string")
-          resolved.assigned_to = resolveId(resolved.assigned_to, "agents");
+          resolved.assigned_to = resolveAssignee(resolved.assigned_to);
         if (resolved.project_id && typeof resolved.project_id === "string")
           resolved.project_id = resolveId(resolved.project_id, "projects");
         if (resolved.task_list_id && typeof resolved.task_list_id === "string")
@@ -14446,6 +14724,25 @@ var init_project_bootstrap = __esm(() => {
 function rowToLabel(row) {
   return { ...row };
 }
+function normalizeName(name) {
+  return name.trim().toLowerCase();
+}
+function createLabel(input, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  d.run(`INSERT INTO labels (id, project_id, name, color, description, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id ?? null, input.name.trim(), input.color ?? null, input.description ?? null, ts, ts]);
+  return rowToLabel(d.query("SELECT * FROM labels WHERE id = ?").get(id));
+}
+function getLabel(idOrName, db) {
+  const d = db || getDatabase();
+  let row = d.query("SELECT * FROM labels WHERE id = ?").get(idOrName);
+  if (!row) {
+    row = d.query("SELECT * FROM labels WHERE lower(name) = ?").get(normalizeName(idOrName));
+  }
+  return row ? rowToLabel(row) : null;
+}
 function listLabels(projectId, db) {
   const d = db || getDatabase();
   if (projectId) {
@@ -14453,10 +14750,164 @@ function listLabels(projectId, db) {
   }
   return d.query("SELECT * FROM labels ORDER BY name").all().map(rowToLabel);
 }
+function updateLabel(idOrName, input, db) {
+  const d = db || getDatabase();
+  const existing = getLabel(idOrName, d);
+  if (!existing)
+    throw new Error(`Label not found: ${idOrName}`);
+  const ts = now();
+  d.run(`UPDATE labels SET
+      name = COALESCE(?, name),
+      color = COALESCE(?, color),
+      description = COALESCE(?, description),
+      updated_at = ?
+     WHERE id = ?`, [input.name?.trim() ?? null, input.color ?? null, input.description ?? null, ts, existing.id]);
+  return getLabel(existing.id, d);
+}
+function deleteLabel(idOrName, db) {
+  const d = db || getDatabase();
+  const existing = getLabel(idOrName, d);
+  if (!existing)
+    return false;
+  d.run("DELETE FROM task_labels WHERE label_id = ?", [existing.id]);
+  return d.run("DELETE FROM labels WHERE id = ?", [existing.id]).changes > 0;
+}
+function assignLabelToTask(taskId, labelIdOrName, db) {
+  const d = db || getDatabase();
+  const label = getLabel(labelIdOrName, d);
+  if (!label)
+    throw new Error(`Label not found: ${labelIdOrName}`);
+  d.run("INSERT OR IGNORE INTO task_labels (task_id, label_id) VALUES (?, ?)", [taskId, label.id]);
+  d.run("INSERT OR IGNORE INTO task_tags (task_id, tag) VALUES (?, ?)", [taskId, label.name]);
+  return label;
+}
 var init_labels = __esm(() => {
   init_database();
 });
 
+// src/db/tags.ts
+function normalizeName2(name) {
+  return name.trim();
+}
+function taskCount(name, db) {
+  const row = db.query("SELECT COUNT(*) AS count FROM task_tags WHERE tag = ?").get(name);
+  return row?.count ?? 0;
+}
+function rowToTag(row, db) {
+  return {
+    ...row,
+    task_count: taskCount(row.name, db)
+  };
+}
+function virtualTag(name, db) {
+  return {
+    id: name,
+    name,
+    color: null,
+    description: null,
+    task_count: taskCount(name, db),
+    created_at: null,
+    updated_at: null
+  };
+}
+function getTagRow(idOrName, db) {
+  return db.query("SELECT * FROM tags WHERE id = ?").get(idOrName) ?? db.query("SELECT * FROM tags WHERE lower(name) = lower(?)").get(idOrName);
+}
+function updateTaskTagJson(oldName, newName, db) {
+  const rows = db.query("SELECT id, tags FROM tasks WHERE tags IS NOT NULL AND tags != '[]'").all();
+  const update = db.prepare("UPDATE tasks SET tags = ?, updated_at = ? WHERE id = ?");
+  const ts = now();
+  for (const row of rows) {
+    if (!row.tags)
+      continue;
+    let tags;
+    try {
+      tags = JSON.parse(row.tags);
+    } catch {
+      continue;
+    }
+    if (!tags.includes(oldName))
+      continue;
+    const next = newName ? Array.from(new Set(tags.map((tag) => tag === oldName ? newName : tag))) : tags.filter((tag) => tag !== oldName);
+    update.run(JSON.stringify(next), ts, row.id);
+  }
+}
+function renameTaskTagRows(oldName, newName, db) {
+  const rows = db.query("SELECT task_id FROM task_tags WHERE tag = ?").all(oldName);
+  const insert = db.prepare("INSERT OR IGNORE INTO task_tags (task_id, tag) VALUES (?, ?)");
+  for (const row of rows)
+    insert.run(row.task_id, newName);
+  db.run("DELETE FROM task_tags WHERE tag = ?", [oldName]);
+}
+function createTag(input, db) {
+  const d = db || getDatabase();
+  const name = normalizeName2(input.name);
+  if (!name)
+    throw new Error("Tag name is required");
+  const id = uuid();
+  const ts = now();
+  d.run(`INSERT INTO tags (id, name, color, description, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)`, [id, name, input.color ?? null, input.description ?? null, ts, ts]);
+  return rowToTag(d.query("SELECT * FROM tags WHERE id = ?").get(id), d);
+}
+function listTags(db) {
+  const d = db || getDatabase();
+  const rows = d.query("SELECT * FROM tags ORDER BY name").all();
+  const tagsByName = new Map(rows.map((row) => [row.name.toLowerCase(), rowToTag(row, d)]));
+  const taskTags = d.query("SELECT tag, COUNT(*) AS count FROM task_tags GROUP BY tag ORDER BY tag").all();
+  for (const row of taskTags) {
+    const key = row.tag.toLowerCase();
+    if (!tagsByName.has(key))
+      tagsByName.set(key, { ...virtualTag(row.tag, d), task_count: row.count });
+  }
+  return [...tagsByName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function getTag(idOrName, db) {
+  const d = db || getDatabase();
+  const row = getTagRow(idOrName, d);
+  if (row)
+    return rowToTag(row, d);
+  const existing = d.query("SELECT tag FROM task_tags WHERE lower(tag) = lower(?) LIMIT 1").get(idOrName);
+  return existing ? virtualTag(existing.tag, d) : null;
+}
+function updateTag(idOrName, input, db) {
+  const d = db || getDatabase();
+  const existing = getTag(idOrName, d);
+  if (!existing)
+    throw new Error(`Tag not found: ${idOrName}`);
+  const row = getTagRow(existing.id, d);
+  if (!row)
+    createTag({ name: existing.name, color: existing.color ?? undefined, description: existing.description ?? undefined }, d);
+  const stored = getTagRow(existing.id, d) ?? getTagRow(existing.name, d);
+  if (!stored)
+    throw new Error(`Tag not found: ${idOrName}`);
+  const nextName = input.name !== undefined ? normalizeName2(input.name) : stored.name;
+  if (!nextName)
+    throw new Error("Tag name is required");
+  const duplicate = getTagRow(nextName, d);
+  if (duplicate && duplicate.id !== stored.id)
+    throw new Error(`Tag already exists: ${nextName}`);
+  if (nextName !== stored.name) {
+    renameTaskTagRows(stored.name, nextName, d);
+    updateTaskTagJson(stored.name, nextName, d);
+  }
+  d.run(`UPDATE tags SET name = ?, color = COALESCE(?, color), description = COALESCE(?, description), updated_at = ? WHERE id = ?`, [nextName, input.color ?? null, input.description ?? null, now(), stored.id]);
+  return getTag(stored.id, d);
+}
+function deleteTag(idOrName, db) {
+  const d = db || getDatabase();
+  const existing = getTag(idOrName, d);
+  if (!existing)
+    return false;
+  d.run("DELETE FROM tags WHERE id = ? OR lower(name) = lower(?)", [existing.id, existing.name]);
+  d.run("DELETE FROM task_tags WHERE tag = ?", [existing.name]);
+  updateTaskTagJson(existing.name, null, d);
+  return true;
+}
+var init_tags = __esm(() => {
+  init_database();
+});
+
 // src/lib/retention-cleanup.ts
 import { existsSync as existsSync7, unlinkSync } from "fs";
 function normalizeScopes(scopes) {
@@ -16691,18 +17142,18 @@ var init_local_fields = __esm(() => {
 });
 
 // src/lib/workflow-states.ts
-function normalizeName(value) {
+function normalizeName3(value) {
   return value.trim().toLowerCase().replace(/[\s-]+/g, "_");
 }
 function isTaskStatus(value) {
   return TASK_STATUSES.includes(value);
 }
 function normalizeState(input) {
-  const name = normalizeName(input.name || "");
+  const name = normalizeName3(input.name || "");
   if (!name || !isTaskStatus(input.canonical_status))
     return null;
-  const aliases = [...new Set((input.aliases || []).map(normalizeName).filter((alias) => alias && alias !== name))].sort();
-  const transitions = input.transitions ? [...new Set(input.transitions.map(normalizeName).filter(Boolean))].sort() : null;
+  const aliases = [...new Set((input.aliases || []).map(normalizeName3).filter((alias) => alias && alias !== name))].sort();
+  const transitions = input.transitions ? [...new Set(input.transitions.map(normalizeName3).filter(Boolean))].sort() : null;
   return {
     name,
     canonical_status: input.canonical_status,
@@ -16731,7 +17182,7 @@ function listWorkflowStates(projectPath) {
   return mergeWorkflowConfig(workflowConfig);
 }
 function resolveWorkflowState(input, projectPath) {
-  const normalized = normalizeName(input);
+  const normalized = normalizeName3(input);
   const states = listWorkflowStates(projectPath);
   const byName = states.find((state) => state.name === normalized);
   if (byName)
@@ -17721,10 +18172,10 @@ function summarizeTasks(taskIds, planIds, runIds, db) {
   const completed = tasks.filter((task) => task.status === "completed");
   const inProgress = tasks.filter((task) => task.status === "in_progress");
   const pending = tasks.filter((task) => task.status === "pending");
-  const taskCount = tasks.length;
-  const percent = taskCount === 0 ? 0 : Math.round(completed.length / taskCount * 100);
+  const taskCount2 = tasks.length;
+  const percent = taskCount2 === 0 ? 0 : Math.round(completed.length / taskCount2 * 100);
   return {
-    task_count: taskCount,
+    task_count: taskCount2,
     completed_count: completed.length,
     in_progress_count: inProgress.length,
     pending_count: pending.length,
@@ -17732,7 +18183,7 @@ function summarizeTasks(taskIds, planIds, runIds, db) {
     plan_count: planIds.length,
     run_count: runIds.length,
     percent_complete: percent,
-    readiness: taskCount === 0 ? "empty" : blocked.length > 0 ? "blocked" : completed.length === taskCount ? "complete" : inProgress.length > 0 ? "in_progress" : "ready"
+    readiness: taskCount2 === 0 ? "empty" : blocked.length > 0 ? "blocked" : completed.length === taskCount2 ? "complete" : inProgress.length > 0 ? "in_progress" : "ready"
   };
 }
 function createRoadmap(input) {
@@ -18911,7 +19362,7 @@ function normalizeScope(scope) {
   }
   return "tasks";
 }
-function normalizeName2(name) {
+function normalizeName4(name) {
   const normalized = name.trim();
   if (!normalized)
     throw new Error("Saved view name is required");
@@ -19161,7 +19612,7 @@ function runSavedSearch(filters = {}, scope = "tasks", db) {
 }
 function saveSearchView(input, db) {
   const d = db || getDatabase();
-  const name = normalizeName2(input.name);
+  const name = normalizeName4(input.name);
   const timestamp3 = now();
   const existing = getSearchView(name, d);
   if (existing) {
@@ -20818,10 +21269,10 @@ Tasks:` : null,
   if (shouldRegisterTool("list_tags")) {
     server.tool("list_tags", "List all distinct task tags in use, with task counts.", async () => {
       try {
-        const rows = getDatabase().query("SELECT tag, COUNT(*) AS count FROM task_tags GROUP BY tag ORDER BY tag").all();
+        const rows = listTags();
         if (rows.length === 0)
           return { content: [{ type: "text", text: "No tags found." }] };
-        const lines = rows.map((r) => `${r.tag} (${r.count})`);
+        const lines = rows.map((r) => `${r.color ? "[" + r.color + "] " : ""}${r.name} (${r.task_count})`);
         return { content: [{ type: "text", text: lines.join(`
 `) }] };
       } catch (e) {
@@ -21390,8 +21841,8 @@ var init_task_project_tools = __esm(() => {
   init_comments();
   init_task_runs();
   init_project_bootstrap();
-  init_database();
   init_labels();
+  init_tags();
   init_redaction();
   init_retention_cleanup();
   init_mention_resolver();
@@ -24537,7 +24988,7 @@ var init_agent_run_dispatcher = __esm(() => {
 
 // src/lib/verification-providers.ts
 import { existsSync as existsSync10, readFileSync as readFileSync6 } from "fs";
-function normalizeName3(name) {
+function normalizeName5(name) {
   const normalized = name.trim().toLowerCase();
   if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(normalized)) {
     throw new Error("verification provider name must use lowercase letters, numbers, dashes, or underscores");
@@ -24556,10 +25007,10 @@ function timeoutMs(value) {
   return Math.max(1, Math.min(24 * 60 * 60000, Math.floor(value)));
 }
 function getProvider(name) {
-  return loadConfig().verification_providers?.[normalizeName3(name)] || null;
+  return loadConfig().verification_providers?.[normalizeName5(name)] || null;
 }
 function upsertVerificationProvider(input) {
-  const name = normalizeName3(input.name);
+  const name = normalizeName5(input.name);
   const config = loadConfig();
   const existing = config.verification_providers?.[name];
   const timestamp3 = new Date().toISOString();
@@ -24589,7 +25040,7 @@ function listVerificationProviders() {
   return Object.values(loadConfig().verification_providers || {}).sort((a, b) => a.name.localeCompare(b.name));
 }
 function removeVerificationProvider(name) {
-  const normalized = normalizeName3(name);
+  const normalized = normalizeName5(name);
   const config = loadConfig();
   if (!config.verification_providers?.[normalized])
     return false;
@@ -28949,7 +29400,7 @@ import { basename as basename5, join as join9, resolve as resolve12 } from "path
 function isObject2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function normalizeName4(name) {
+function normalizeName6(name) {
   const normalized = name.trim().toLowerCase();
   if (!/^[a-z0-9][a-z0-9_.-]{0,63}$/.test(normalized)) {
     throw new Error("extension name must use lowercase letters, numbers, dots, dashes, or underscores");
@@ -28967,7 +29418,7 @@ function permissionList(value) {
 function normalizeManifest(input) {
   if (!isObject2(input))
     throw new Error("extension manifest must be a JSON object");
-  const name = normalizeName4(String(input["name"] || ""));
+  const name = normalizeName6(String(input["name"] || ""));
   const version = String(input["version"] || "").trim();
   if (!version)
     throw new Error("extension manifest requires version");
@@ -28975,7 +29426,7 @@ function normalizeManifest(input) {
     todos: typeof input["compatibility"]["todos"] === "string" ? input["compatibility"]["todos"] : undefined
   } : undefined;
   const commands = Array.isArray(input["commands"]) ? input["commands"].filter(isObject2).map((command) => ({
-    name: normalizeName4(String(command["name"] || "")),
+    name: normalizeName6(String(command["name"] || "")),
     command: typeof command["command"] === "string" ? command["command"] : undefined,
     description: typeof command["description"] === "string" ? command["description"] : undefined,
     permissions: permissionList(command["permissions"]),
@@ -28984,12 +29435,12 @@ function normalizeManifest(input) {
     network: typeof command["network"] === "boolean" ? command["network"] : undefined
   })) : [];
   const mcpTools = Array.isArray(input["mcp_tools"]) ? input["mcp_tools"].filter(isObject2).map((tool) => ({
-    name: normalizeName4(String(tool["name"] || "")),
+    name: normalizeName6(String(tool["name"] || "")),
     description: typeof tool["description"] === "string" ? tool["description"] : undefined,
     permissions: permissionList(tool["permissions"])
   })) : [];
   const templates = Array.isArray(input["templates"]) ? input["templates"].filter(isObject2).map((template) => ({
-    name: normalizeName4(String(template["name"] || "")),
+    name: normalizeName6(String(template["name"] || "")),
     kind: typeof template["kind"] === "string" ? template["kind"] : undefined,
     description: typeof template["description"] === "string" ? template["description"] : undefined,
     path: typeof template["path"] === "string" ? template["path"] : undefined,
@@ -28998,7 +29449,7 @@ function normalizeManifest(input) {
     permissions: permissionList(template["permissions"])
   })) : [];
   const renderers = Array.isArray(input["renderers"]) ? input["renderers"].filter(isObject2).map((renderer) => ({
-    name: normalizeName4(String(renderer["name"] || "")),
+    name: normalizeName6(String(renderer["name"] || "")),
     target: typeof renderer["target"] === "string" ? renderer["target"] : "",
     description: typeof renderer["description"] === "string" ? renderer["description"] : undefined,
     command: typeof renderer["command"] === "string" ? renderer["command"] : undefined,
@@ -29397,10 +29848,10 @@ function listLocalExtensions() {
   return Object.values(loadConfig().extension_registry || {}).sort((a, b) => a.name.localeCompare(b.name));
 }
 function getLocalExtension(name) {
-  return loadConfig().extension_registry?.[normalizeName4(name)] || null;
+  return loadConfig().extension_registry?.[normalizeName6(name)] || null;
 }
 function removeLocalExtension(name) {
-  const normalized = normalizeName4(name);
+  const normalized = normalizeName6(name);
   const config = loadConfig();
   if (!config.extension_registry?.[normalized])
     return false;
@@ -34911,8 +35362,6 @@ var init_builtin_templates = __esm(() => {
     },
     {
       name: "open-source-project",
-      version: 1,
-      category: "project",
       description: "Full open-source project bootstrap \u2014 scaffold to publish",
       category: "open-source",
       version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
@@ -34938,7 +35387,7 @@ var init_builtin_templates = __esm(() => {
     },
     {
       name: "release",
-      version: 1,
+      version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
       category: "ops",
       description: "Version release workflow \u2014 test, changelog, publish, verify",
       variables: [
@@ -34955,7 +35404,7 @@ var init_builtin_templates = __esm(() => {
     },
     {
       name: "docs-refresh",
-      version: 1,
+      version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
       category: "workflow",
       description: "Documentation refresh \u2014 audit, update, verify links",
       variables: [{ name: "scope", required: true, description: "Docs scope (README, API, AGENTS.md)" }],
@@ -34968,7 +35417,7 @@ var init_builtin_templates = __esm(() => {
     },
     {
       name: "migration",
-      version: 1,
+      version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
       category: "ops",
       description: "Schema/data migration workflow",
       variables: [
@@ -34985,7 +35434,7 @@ var init_builtin_templates = __esm(() => {
     },
     {
       name: "incident-response",
-      version: 1,
+      version: BUILTIN_TEMPLATE_LIBRARY_VERSION,
       category: "ops",
       description: "Incident triage, mitigation, postmortem",
       variables: [{ name: "incident", required: true, description: "Incident summary" }],
@@ -35032,8 +35481,8 @@ function registerTemplateTools(server, { shouldRegisterTool, resolveId, formatEr
         const { createTemplate: createTemplate2, getTemplateWithTasks: getTemplateWithTasks2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const t = createTemplate2(params);
         const withTasks = getTemplateWithTasks2(t.id);
-        const taskCount = withTasks?.tasks.length ?? 0;
-        const taskInfo = taskCount > 0 ? ` | ${taskCount} task(s)` : "";
+        const taskCount2 = withTasks?.tasks.length ?? 0;
+        const taskInfo = taskCount2 > 0 ? ` | ${taskCount2} task(s)` : "";
         return { content: [{ type: "text", text: `Template created: ${t.id.slice(0, 8)} | ${t.name} | "${t.title_pattern}"${taskInfo}` }] };
       } catch (e) {
         return { content: [{ type: "text", text: formatError(e) }], isError: true };
@@ -35952,22 +36401,27 @@ function getHeadlessBoundaryManifest() {
     notes: [
       "Use todos CLI or todos-mcp for agent workflows.",
       "todos serve exposes a local-only REST API on 127.0.0.1 \u2014 not a hosted SaaS.",
-      "Cloud sync via @hasna/cloud is explicit opt-in from CLI/MCP, never from the dashboard."
+      "Remote sync is explicit opt-in from CLI/MCP, never from the dashboard."
     ]
   };
 }
-var HEADLESS_BOUNDARY_VERSION = "todos.headless-boundary.v1", FORBIDDEN_HOSTED_HOSTS, FORBIDDEN_WEB_PATTERNS, LOCAL_HOSTS;
+var HEADLESS_BOUNDARY_VERSION = "todos.headless-boundary.v1", FORBIDDEN_HOSTED_HOSTS, PRIVATE_PLATFORM_ORG, HOSTED_TODOS_PACKAGE, FORBIDDEN_WEB_PATTERNS, LOCAL_HOSTS;
 var init_headless_boundaries = __esm(() => {
   FORBIDDEN_HOSTED_HOSTS = [
     "todos.md",
     "www.todos.md",
     "preview.todos.md",
     "pay.hasna.tools",
-    "platform-todos"
+    ["platform", "todos"].join("-")
   ];
+  PRIVATE_PLATFORM_ORG = ["hasna", "studio"].join("");
+  HOSTED_TODOS_PACKAGE = ["platform", "todos"].join("-");
   FORBIDDEN_WEB_PATTERNS = [
     { name: "hosted todos.md API", pattern: /https?:\/\/(?:www\.)?todos\.md/i },
-    { name: "platform-todos package", pattern: /@hasnastudio\/platform-todos|hasnastudio\/platform-todos/i },
+    {
+      name: "hosted platform package",
+      pattern: new RegExp(`@${PRIVATE_PLATFORM_ORG}/${HOSTED_TODOS_PACKAGE}|${PRIVATE_PLATFORM_ORG}/${HOSTED_TODOS_PACKAGE}`, "i")
+    },
     { name: "browser sign-in flow", pattern: /\/sign-?in\b|\/login\b.*(?:oauth|session|auth)/i },
     { name: "Stripe billing UI", pattern: /\bstripe\.(?:com|js)\b|\bcheckout\.sessions?\b/i },
     { name: "hosted OAuth redirect", pattern: /oauth.*redirect.*todos\.md/i }
@@ -36912,8 +37366,6 @@ Dashboard not found at: ${dashboardDir}`);
         return handleMcpHttpRequest2(req, buildServer2);
       }
       if (method === "OPTIONS") {
-        const reqOrigin2 = req.headers.get("origin") || undefined;
-        const allowed = reqOrigin2 && (reqOrigin2 === `http://localhost:${port}` || reqOrigin2 === "http://localhost:0");
         return new Response(null, {
           headers: corsHeaders || {
             Vary: "Origin"
@@ -37194,6 +37646,26 @@ function getMcpVersion() {
 function hasVersionFlag() {
   return process.argv.includes("--version") || process.argv.includes("-V");
 }
+function hasHelpFlag() {
+  return process.argv.includes("--help") || process.argv.includes("-h");
+}
+function printHelp() {
+  console.log(`Usage: todos-mcp [options]
+
+Start the @hasna/todos MCP server.
+
+Options:
+  --stdio          Use stdio transport
+  --port <port>    Use Streamable HTTP on the given port
+  -V, --version    output the version number
+  -h, --help       display help for command
+
+Environment:
+  TODOS_MCP_STDIO=true       Force stdio transport
+  TODOS_MCP_PORT=<port>      HTTP port when not using stdio
+  TODOS_PROFILE=<profile>    Tool profile filter
+  TODOS_TOOL_GROUPS=<list>   Comma-separated tool group filter`);
+}
 function shouldRegisterTool(name) {
   return shouldRegisterToolForProfile(name);
 }
@@ -37407,6 +37879,10 @@ var init_mcp2 = __esm(() => {
     console.log(getMcpVersion());
     process.exit(0);
   }
+  if (hasHelpFlag()) {
+    printHelp();
+    process.exit(0);
+  }
   agentFocusMap = new Map;
   isDirectRun = import.meta.main || process.argv[1]?.endsWith("/mcp/index.ts") || process.argv[1]?.endsWith("/mcp/index.js");
   if (isDirectRun) {