@hasna/todos 0.11.56 → 0.11.57

package/dist/storage.js

@@ -3050,7 +3050,7 @@ var init_redaction = __esm(() => {
 });
 
 // src/lib/secret-redaction.ts
-import { readFileSync as readFileSync2, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync6 } from "fs";
 function registerCustomRedactor(fn) {
   customRedactors.push(fn);
 }
@@ -3115,7 +3115,7 @@ function scanAndRedactText(text, options = {}) {
   };
 }
 function scanFileForSecrets(path, options = {}) {
-  if (!existsSync5(path))
+  if (!existsSync6(path))
     throw new Error(`File not found: ${path}`);
   const content = readFileSync2(path, "utf8");
   return scanAndRedactText(content, options);
@@ -4175,6 +4175,7 @@ function explainRunnerSandbox(input = {}) {
 // src/lib/event-hooks.ts
 init_config();
 var LOCAL_EVENT_TYPES = [
+  "task.created",
   "task.assigned",
   "task.blocked",
   "task.started",
@@ -4417,6 +4418,568 @@ async function testLocalEventHook(name, input) {
   return emitLocalEventHooks({ ...input, hooks: [hook] });
 }
 
+// node_modules/.bun/@hasna+events@0.1.7/node_modules/@hasna/events/dist/index.js
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import { homedir } from "os";
+import { join as join4 } from "path";
+import { createHmac, timingSafeEqual } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
+import { spawn } from "child_process";
+import { randomUUID as randomUUID22 } from "crypto";
+function getPathValue(input, path) {
+  return path.split(".").reduce((value, part) => {
+    if (value && typeof value === "object" && part in value) {
+      return value[part];
+    }
+    return;
+  }, input);
+}
+function wildcardToRegExp(pattern) {
+  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+function matchString(value, matcher) {
+  if (matcher === undefined)
+    return true;
+  if (value === undefined)
+    return false;
+  const matchers = Array.isArray(matcher) ? matcher : [matcher];
+  return matchers.some((item) => wildcardToRegExp(item).test(value));
+}
+function matchRecord(input, matcher) {
+  if (!matcher)
+    return true;
+  return Object.entries(matcher).every(([path, expected]) => {
+    const actual = getPathValue(input, path);
+    if (typeof expected === "string" || Array.isArray(expected)) {
+      return matchString(actual === undefined ? undefined : String(actual), expected);
+    }
+    return actual === expected;
+  });
+}
+function eventMatchesFilter(event, filter) {
+  return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
+}
+function channelMatchesEvent(channel, event) {
+  if (!channel.enabled)
+    return false;
+  if (!channel.filters || channel.filters.length === 0)
+    return true;
+  return channel.filters.some((filter) => eventMatchesFilter(event, filter));
+}
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
+var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
+function getEventsDataDir(override) {
+  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join4(homedir(), ".hasna", "events");
+}
+
+class JsonEventsStore {
+  dataDir;
+  channelsPath;
+  eventsPath;
+  deliveriesPath;
+  constructor(dataDir = getEventsDataDir()) {
+    this.dataDir = dataDir;
+    this.channelsPath = join4(dataDir, "channels.json");
+    this.eventsPath = join4(dataDir, "events.json");
+    this.deliveriesPath = join4(dataDir, "deliveries.json");
+  }
+  async init() {
+    await mkdir(this.dataDir, { recursive: true, mode: 448 });
+    await chmod(this.dataDir, 448).catch(() => {
+      return;
+    });
+    await this.ensureArrayFile(this.channelsPath);
+    await this.ensureArrayFile(this.eventsPath);
+    await this.ensureArrayFile(this.deliveriesPath);
+  }
+  async addChannel(channel) {
+    await this.init();
+    const channels = await this.readJson(this.channelsPath, []);
+    const index = channels.findIndex((item) => item.id === channel.id);
+    if (index >= 0) {
+      channels[index] = { ...channel, createdAt: channels[index].createdAt, updatedAt: new Date().toISOString() };
+    } else {
+      channels.push(channel);
+    }
+    await this.writeJson(this.channelsPath, channels);
+    return index >= 0 ? channels[index] : channel;
+  }
+  async listChannels() {
+    await this.init();
+    return this.readJson(this.channelsPath, []);
+  }
+  async getChannel(id) {
+    const channels = await this.listChannels();
+    return channels.find((channel) => channel.id === id);
+  }
+  async removeChannel(id) {
+    await this.init();
+    const channels = await this.readJson(this.channelsPath, []);
+    const next = channels.filter((channel) => channel.id !== id);
+    await this.writeJson(this.channelsPath, next);
+    return next.length !== channels.length;
+  }
+  async appendEvent(event) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return event;
+  }
+  async listEvents() {
+    await this.init();
+    return this.readJson(this.eventsPath, []);
+  }
+  async findEventByIdentity(identity) {
+    const events = await this.listEvents();
+    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+  }
+  async appendDelivery(result) {
+    await this.init();
+    const deliveries = await this.readJson(this.deliveriesPath, []);
+    deliveries.push(result);
+    await this.writeJson(this.deliveriesPath, deliveries);
+    return result;
+  }
+  async listDeliveries() {
+    await this.init();
+    return this.readJson(this.deliveriesPath, []);
+  }
+  async exportData() {
+    return {
+      channels: await this.listChannels(),
+      events: await this.listEvents(),
+      deliveries: await this.listDeliveries()
+    };
+  }
+  async ensureArrayFile(path) {
+    if (!existsSync5(path)) {
+      await writeFile(path, `[]
+`, { encoding: "utf-8", mode: 384 });
+    }
+    await chmod(path, 384).catch(() => {
+      return;
+    });
+  }
+  async readJson(path, fallback) {
+    try {
+      const raw = await readFile(path, "utf-8");
+      if (!raw.trim())
+        return fallback;
+      return JSON.parse(raw);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return fallback;
+      throw error;
+    }
+  }
+  async writeJson(path, value) {
+    const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tempPath, `${JSON.stringify(value, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+    await rename(tempPath, path);
+    await chmod(path, 384).catch(() => {
+      return;
+    });
+  }
+}
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+function buildSignatureBase(timestamp, body) {
+  return `${timestamp}.${body}`;
+}
+function signPayload(secret, timestamp, body) {
+  const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
+  return `sha256=${digest}`;
+}
+function now2() {
+  return new Date().toISOString();
+}
+function truncate(value, max = 4096) {
+  return value.length > max ? `${value.slice(0, max)}...` : value;
+}
+function buildWebhookRequest(event, channel) {
+  if (!channel.webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const body = JSON.stringify(event);
+  const timestamp = event.time;
+  const headers = {
+    "Content-Type": "application/json",
+    "User-Agent": "@hasna/events",
+    "X-Hasna-Event-Id": event.id,
+    "X-Hasna-Event-Type": event.type,
+    "X-Hasna-Timestamp": timestamp,
+    ...channel.webhook.headers
+  };
+  if (channel.webhook.secret) {
+    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+  }
+  return { body, headers };
+}
+async function dispatchWebhook(event, channel, options = {}) {
+  if (!channel.webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const startedAt = now2();
+  const { body, headers } = buildWebhookRequest(event, channel);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
+  try {
+    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    const responseBody = truncate(await response.text());
+    return {
+      attempt: 1,
+      status: response.ok ? "success" : "failed",
+      startedAt,
+      completedAt: now2(),
+      responseStatus: response.status,
+      responseBody,
+      error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+    };
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now2(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function dispatchCommand(event, channel) {
+  if (!channel.command)
+    throw new Error(`Channel ${channel.id} has no command config`);
+  const startedAt = now2();
+  const eventJson = JSON.stringify(event);
+  const env = {
+    ...process.env,
+    ...channel.command.env,
+    HASNA_CHANNEL_ID: channel.id,
+    HASNA_EVENT_ID: event.id,
+    HASNA_EVENT_TYPE: event.type,
+    HASNA_EVENT_SOURCE: event.source,
+    HASNA_EVENT_SUBJECT: event.subject ?? "",
+    HASNA_EVENT_SEVERITY: event.severity,
+    HASNA_EVENT_TIME: event.time,
+    HASNA_EVENT_DEDUPE_KEY: event.dedupeKey ?? "",
+    HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
+    HASNA_EVENT_JSON: eventJson
+  };
+  return new Promise((resolve6) => {
+    const child = spawn(channel.command.command, channel.command.args ?? [], {
+      cwd: channel.command.cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => child.kill("SIGTERM"), channel.command.timeoutMs ?? 15000);
+    child.stdin.end(eventJson);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      clearTimeout(timeout);
+      resolve6({
+        attempt: 1,
+        status: "failed",
+        startedAt,
+        completedAt: now2(),
+        stdout: truncate(stdout),
+        stderr: truncate(stderr),
+        error: error.message
+      });
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timeout);
+      const success = code === 0;
+      resolve6({
+        attempt: 1,
+        status: success ? "success" : "failed",
+        startedAt,
+        completedAt: now2(),
+        stdout: truncate(stdout),
+        stderr: truncate(stderr),
+        error: success ? undefined : `Command exited with ${signal ? `signal ${signal}` : `code ${code}`}`
+      });
+    });
+  });
+}
+async function dispatchChannel(event, channel, options = {}) {
+  if (channel.transport === "webhook")
+    return dispatchWebhook(event, channel, options);
+  if (channel.transport === "command")
+    return dispatchCommand(event, channel);
+  return {
+    attempt: 1,
+    status: "skipped",
+    startedAt: now2(),
+    completedAt: now2(),
+    error: `Unsupported transport: ${channel.transport}`
+  };
+}
+function createDeliveryResult(event, channel, attempts) {
+  const status = attempts.some((attempt) => attempt.status === "success") ? "success" : attempts.every((attempt) => attempt.status === "skipped") ? "skipped" : "failed";
+  return {
+    id: randomUUID2(),
+    eventId: event.id,
+    channelId: channel.id,
+    transport: channel.transport,
+    status,
+    attempts,
+    createdAt: attempts[0]?.startedAt ?? now2(),
+    completedAt: attempts.at(-1)?.completedAt ?? now2()
+  };
+}
+function createEvent(input) {
+  return {
+    id: input.id ?? randomUUID22(),
+    source: input.source,
+    type: input.type,
+    time: normalizeTime(input.time),
+    subject: input.subject,
+    severity: input.severity ?? "info",
+    data: input.data ?? {},
+    message: input.message,
+    dedupeKey: input.dedupeKey,
+    schemaVersion: input.schemaVersion ?? "1.0",
+    metadata: input.metadata ?? {}
+  };
+}
+
+class EventsClient {
+  store;
+  redactors;
+  transportOptions;
+  constructor(options = {}) {
+    this.store = options.store ?? new JsonEventsStore(options.dataDir);
+    this.redactors = options.redactors ?? [];
+    this.transportOptions = { fetchImpl: options.fetchImpl };
+  }
+  async addChannel(input) {
+    const timestamp = new Date().toISOString();
+    return this.store.addChannel({
+      ...input,
+      createdAt: input.createdAt ?? timestamp,
+      updatedAt: input.updatedAt ?? timestamp
+    });
+  }
+  async listChannels() {
+    return this.store.listChannels();
+  }
+  async removeChannel(id) {
+    return this.store.removeChannel(id);
+  }
+  async emit(input, options = {}) {
+    const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
+    if (options.dedupe !== false) {
+      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return { event: existing, deliveries: [], deduped: true };
+      }
+    }
+    await this.store.appendEvent(event);
+    const deliveries = options.deliver === false ? [] : await this.deliver(event);
+    return { event, deliveries, deduped: false };
+  }
+  async listEvents() {
+    return this.store.listEvents();
+  }
+  async listDeliveries() {
+    return this.store.listDeliveries();
+  }
+  async deliver(event) {
+    const channels = await this.store.listChannels();
+    const selected = channels.filter((channel) => channelMatchesEvent(channel, event));
+    const deliveries = [];
+    for (const channel of selected) {
+      const eventForChannel = await this.applyRedaction(event, channel);
+      const result = await this.deliverWithRetry(eventForChannel, channel);
+      await this.store.appendDelivery(result);
+      deliveries.push(result);
+    }
+    return deliveries;
+  }
+  async testChannel(id, input = {}) {
+    const channel = await this.store.getChannel(id);
+    if (!channel)
+      throw new Error(`Channel not found: ${id}`);
+    const event = createEvent({
+      source: input.source ?? "hasna.events",
+      type: input.type ?? "events.test",
+      subject: input.subject ?? id,
+      severity: input.severity ?? "info",
+      data: input.data ?? { test: true },
+      message: input.message ?? "Hasna events test delivery",
+      dedupeKey: input.dedupeKey,
+      schemaVersion: input.schemaVersion,
+      metadata: input.metadata,
+      time: input.time,
+      id: input.id
+    });
+    const eventForChannel = await this.applyRedaction(event, channel);
+    const result = await this.deliverWithRetry(eventForChannel, channel);
+    await this.store.appendDelivery(result);
+    return result;
+  }
+  async replay(options = {}) {
+    const events = (await this.store.listEvents()).filter((event) => {
+      if (options.eventId && event.id !== options.eventId)
+        return false;
+      if (options.source && event.source !== options.source)
+        return false;
+      if (options.type && event.type !== options.type)
+        return false;
+      return true;
+    });
+    if (options.dryRun)
+      return { events, deliveries: [] };
+    const deliveries = [];
+    for (const event of events) {
+      deliveries.push(...await this.deliver(event));
+    }
+    return { events, deliveries };
+  }
+  async applyRedaction(event, channel) {
+    let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
+    for (const redactor of this.redactors) {
+      next = await redactor(next, channel);
+    }
+    return next;
+  }
+  async deliverWithRetry(event, channel) {
+    const policy = normalizeRetryPolicy(channel.retry);
+    const attempts = [];
+    for (let index = 0;index < policy.maxAttempts; index += 1) {
+      const attempt = await dispatchChannel(event, channel, this.transportOptions);
+      attempt.attempt = index + 1;
+      if (attempt.status === "failed" && index + 1 < policy.maxAttempts) {
+        attempt.nextBackoffMs = Math.round(policy.backoffMs * policy.multiplier ** index);
+      }
+      attempts.push(attempt);
+      if (attempt.status !== "failed")
+        break;
+      if (attempt.nextBackoffMs)
+        await Bun.sleep(attempt.nextBackoffMs);
+    }
+    return createDeliveryResult(event, channel, attempts);
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue2(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue2(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue2(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
+function normalizeTime(value) {
+  if (!value)
+    return new Date().toISOString();
+  return value instanceof Date ? value.toISOString() : value;
+}
+function normalizeRetryPolicy(policy) {
+  return {
+    maxAttempts: Math.max(1, policy?.maxAttempts ?? 1),
+    backoffMs: Math.max(0, policy?.backoffMs ?? 250),
+    multiplier: Math.max(1, policy?.multiplier ?? 2)
+  };
+}
+
+// src/lib/shared-events.ts
+var SOURCE = "todos";
+function taskEventData(task, extra = {}) {
+  return {
+    id: task.id,
+    task_id: task.id,
+    short_id: task.short_id,
+    title: task.title,
+    description: task.description,
+    status: task.status,
+    priority: task.priority,
+    project_id: task.project_id,
+    parent_id: task.parent_id,
+    plan_id: task.plan_id,
+    task_list_id: task.task_list_id,
+    agent_id: task.agent_id,
+    assigned_to: task.assigned_to,
+    session_id: task.session_id,
+    working_dir: task.working_dir,
+    tags: task.tags,
+    metadata: task.metadata,
+    version: task.version,
+    created_at: task.created_at,
+    updated_at: task.updated_at,
+    started_at: task.started_at,
+    completed_at: task.completed_at,
+    due_at: task.due_at,
+    ...extra
+  };
+}
+async function emitSharedTaskEvent(input) {
+  const data = taskEventData(input.task, input.data);
+  await new EventsClient().emit({
+    source: SOURCE,
+    type: input.type,
+    subject: input.task.id,
+    severity: input.severity ?? "info",
+    message: input.message ?? `${input.type}: ${input.task.title}`,
+    data,
+    dedupeKey: input.dedupeKey ?? `${input.type}:${input.task.id}:${input.task.version}`,
+    metadata: {
+      package: "@hasna/todos",
+      task_id: input.task.id,
+      project_id: input.task.project_id,
+      task_list_id: input.task.task_list_id
+    }
+  }, { deliver: true, dedupe: true });
+}
+function emitSharedTaskEventQuiet(input) {
+  emitSharedTaskEvent(input).catch(() => {
+    return;
+  });
+}
+
 // src/db/audit.ts
 init_database();
 function logTaskChange(taskId, action, field, oldValue, newValue, agentId, db) {
@@ -4679,7 +5242,7 @@ async function deliverWebhook(wh, event, body, attempt, db) {
     activeDeliveries--;
   }
 }
-async function dispatchWebhook(event, payload, db) {
+async function dispatchWebhook2(event, payload, db) {
   const d = db || getDatabase();
   const webhooks = listWebhooks(d).filter((w) => w.active && (w.events.length === 0 || w.events.includes(event)));
   const payloadObj = typeof payload === "object" && payload !== null ? payload : {};
@@ -4833,7 +5396,10 @@ function createTask(input, db) {
     insertTaskTags(id, tags, d);
   }
   const task = getTask(id, d);
-  dispatchWebhook("task.created", { id: task.id, short_id: task.short_id, title: task.title, status: task.status, priority: task.priority, project_id: task.project_id, assigned_to: task.assigned_to }, d).catch(() => {});
+  const payload = taskEventData(task);
+  dispatchWebhook2("task.created", payload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.created", payload });
+  emitSharedTaskEventQuiet({ type: "task.created", task });
   return task;
 }
 function getTask(id, db) {
@@ -5177,18 +5743,7 @@ function updateTask(id, input, db) {
     logTaskChange(id, "update", "assigned_to", task.assigned_to, input.assigned_to, agentId, d);
   if (input.approved_by !== undefined)
     logTaskChange(id, "approve", "approved_by", null, input.approved_by, agentId, d);
-  if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to) {
-    dispatchWebhook("task.assigned", { id, assigned_to: input.assigned_to, title: task.title }, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.assigned", payload: { id, assigned_to: input.assigned_to, title: task.title } });
-  }
-  if (input.status !== undefined && input.status !== task.status) {
-    dispatchWebhook("task.status_changed", { id, old_status: task.status, new_status: input.status, title: task.title }, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.status_changed", payload: { id, old_status: task.status, new_status: input.status, title: task.title } });
-  }
-  if (input.approved_by !== undefined) {
-    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title } });
-  }
-  return {
+  const updatedTask = {
     ...task,
     ...Object.fromEntries(Object.entries(input).filter(([, v]) => v !== undefined)),
     tags: input.tags ?? task.tags,
@@ -5206,6 +5761,22 @@ function updateTask(id, input, db) {
     approved_by: input.approved_by ?? task.approved_by,
     approved_at: input.approved_by ? timestamp : task.approved_at
   };
+  if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to) {
+    const payload = taskEventData(updatedTask, { assigned_to: input.assigned_to, old_assigned_to: task.assigned_to });
+    dispatchWebhook2("task.assigned", payload, d).catch(() => {});
+    emitLocalEventHooksQuiet({ type: "task.assigned", payload });
+    emitSharedTaskEventQuiet({ type: "task.assigned", task: updatedTask, data: { old_assigned_to: task.assigned_to } });
+  }
+  if (input.status !== undefined && input.status !== task.status) {
+    const payload = taskEventData(updatedTask, { old_status: task.status, new_status: input.status });
+    dispatchWebhook2("task.status_changed", payload, d).catch(() => {});
+    emitLocalEventHooksQuiet({ type: "task.status_changed", payload });
+    emitSharedTaskEventQuiet({ type: "task.status_changed", task: updatedTask, data: { old_status: task.status, new_status: input.status } });
+  }
+  if (input.approved_by !== undefined) {
+    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title } });
+  }
+  return updatedTask;
 }
 function deleteTask(id, db) {
   const d = db || getDatabase();
@@ -5938,9 +6509,12 @@ function startTask(id, agentId, db) {
     throw new Error(`Task ${id} could not be started because it changed during claim`);
   }
   logTaskChange(id, "start", "status", "pending", "in_progress", agentId, d);
-  dispatchWebhook("task.started", { id, agent_id: agentId, title: task.title }, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.started", payload: { id, agent_id: agentId, title: task.title } });
-  return { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp, started_at: task.started_at || timestamp, version: task.version + 1, updated_at: timestamp };
+  const startedTask = { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp, started_at: task.started_at || timestamp, version: task.version + 1, updated_at: timestamp };
+  const payload = taskEventData(startedTask, { agent_id: agentId });
+  dispatchWebhook2("task.started", payload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.started", payload });
+  emitSharedTaskEventQuiet({ type: "task.started", task: startedTask, data: { agent_id: agentId } });
+  return startedTask;
 }
 function completeTask(id, agentId, db, options) {
   const d = db || getDatabase();
@@ -5976,8 +6550,21 @@ function completeTask(id, agentId, db, options) {
   });
   tx();
   logTaskChange(id, "complete", "status", task.status, "completed", agentId || null, d);
-  dispatchWebhook("task.completed", { id, agent_id: agentId, title: task.title, completed_at: timestamp }, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.completed", payload: { id, agent_id: agentId, title: task.title, completed_at: timestamp } });
+  const completedTaskForEvent = {
+    ...task,
+    status: "completed",
+    locked_by: null,
+    locked_at: null,
+    completed_at: timestamp,
+    confidence,
+    version: task.version + 1,
+    updated_at: timestamp,
+    metadata: hasMeta ? { ...task.metadata, ...completionMeta } : task.metadata
+  };
+  const completionPayload = taskEventData(completedTaskForEvent, { agent_id: agentId, completed_at: timestamp });
+  dispatchWebhook2("task.completed", completionPayload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload });
+  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp } });
   let spawnedTask = null;
   if (task.recurrence_rule && !options?.skip_recurrence) {
     spawnedTask = spawnNextRecurrence(task, d, timestamp);
@@ -6018,8 +6605,12 @@ function completeTask(id, agentId, db, options) {
   if (unblockedDeps.length > 0) {
     meta._unblocked = unblockedDeps.map((d2) => ({ id: d2.id, short_id: d2.short_id, title: d2.title }));
     for (const dep of unblockedDeps) {
-      dispatchWebhook("task.unblocked", { id: dep.id, unblocked_by: id, title: dep.title }, d).catch(() => {});
-      emitLocalEventHooksQuiet({ type: "task.unblocked", payload: { id: dep.id, unblocked_by: id, title: dep.title } });
+      const depTask = getTask(dep.id, d);
+      const payload = depTask ? taskEventData(depTask, { unblocked_by: id }) : { id: dep.id, unblocked_by: id, title: dep.title };
+      dispatchWebhook2("task.unblocked", payload, d).catch(() => {});
+      emitLocalEventHooksQuiet({ type: "task.unblocked", payload });
+      if (depTask)
+        emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id } });
     }
   }
   return { ...task, status: "completed", locked_by: null, locked_at: null, completed_at: timestamp, confidence, version: task.version + 1, updated_at: timestamp, metadata: meta };
@@ -6205,9 +6796,6 @@ function failTask(id, agentId, reason, options, db) {
   const timestamp = now();
   d.run(`UPDATE tasks SET status = 'failed', locked_by = NULL, locked_at = NULL, metadata = ?, version = version + 1, updated_at = ?
      WHERE id = ?`, [JSON.stringify(meta), timestamp, id]);
-  logTaskChange(id, "fail", "status", task.status, "failed", agentId || null, d);
-  dispatchWebhook("task.failed", { id, reason, error_code: options?.error_code, agent_id: agentId, title: task.title }, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.failed", payload: { id, reason, error_code: options?.error_code, agent_id: agentId, title: task.title } });
   const failedTask = {
     ...task,
     status: "failed",
@@ -6217,6 +6805,11 @@ function failTask(id, agentId, reason, options, db) {
     version: task.version + 1,
     updated_at: timestamp
   };
+  logTaskChange(id, "fail", "status", task.status, "failed", agentId || null, d);
+  const failurePayload = taskEventData(failedTask, { reason, error_code: options?.error_code, agent_id: agentId });
+  dispatchWebhook2("task.failed", failurePayload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload });
+  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning" });
   let retryTask;
   if (options?.retry) {
     const retryCount = (task.retry_count || 0) + 1;
@@ -6291,9 +6884,12 @@ function stealTask(agentId, opts, db) {
     return null;
   logTaskChange(target.id, "steal", "assigned_to", target.assigned_to, agentId, agentId, d);
   logTaskChange(target.id, "steal", "locked_by", target.locked_by, agentId, agentId, d);
-  dispatchWebhook("task.assigned", { id: target.id, agent_id: agentId, title: target.title, stolen_from: target.assigned_to }, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.assigned", payload: { id: target.id, agent_id: agentId, title: target.title, stolen_from: target.assigned_to } });
-  return { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp, updated_at: timestamp, version: target.version + 1 };
+  const stolenTask = { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp, updated_at: timestamp, version: target.version + 1 };
+  const payload = taskEventData(stolenTask, { agent_id: agentId, stolen_from: target.assigned_to });
+  dispatchWebhook2("task.assigned", payload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.assigned", payload });
+  emitSharedTaskEventQuiet({ type: "task.assigned", task: stolenTask, data: { agent_id: agentId, stolen_from: target.assigned_to } });
+  return stolenTask;
 }
 function claimOrSteal(agentId, filters, db) {
   const d = db || getDatabase();
@@ -7352,8 +7948,8 @@ init_database();
 init_database();
 init_redaction();
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname4, join as join4, resolve as resolve6 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname as dirname4, join as join5, resolve as resolve6 } from "path";
 import { tmpdir } from "os";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
@@ -7365,15 +7961,15 @@ function artifactStoreRoot() {
     return resolve6(process.env["TODOS_ARTIFACTS_DIR"]);
   const dbPath = getDatabasePath();
   if (isInMemoryDb2(dbPath))
-    return join4(tmpdir(), "hasna-todos-artifacts");
-  return join4(dirname4(resolve6(dbPath)), "artifacts");
+    return join5(tmpdir(), "hasna-todos-artifacts");
+  return join5(dirname4(resolve6(dbPath)), "artifacts");
 }
 function artifactStorePath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
   if (normalized.includes("..") || normalized.startsWith("/") || normalized.length === 0) {
     throw new Error("Invalid artifact store path");
   }
-  return join4(artifactStoreRoot(), normalized);
+  return join5(artifactStoreRoot(), normalized);
 }
 function sha256(buffer) {
   return createHash2("sha256").update(buffer).digest("hex");
@@ -7414,7 +8010,7 @@ function mediaTypeFor(path, textLike) {
 }
 function storeArtifactContent(input) {
   const sourcePath = resolve6(input.path);
-  if (!existsSync6(sourcePath))
+  if (!existsSync7(sourcePath))
     return null;
   const sourceStat = statSync2(sourcePath);
   if (!sourceStat.isFile())
@@ -7431,9 +8027,9 @@ function storeArtifactContent(input) {
       redactionStatus = "redacted";
   }
   const storedSha = sha256(storedBuffer);
-  const relativePath = join4("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
+  const relativePath = join5("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
   const destination = artifactStorePath(relativePath);
-  if (!existsSync6(destination)) {
+  if (!existsSync7(destination)) {
     mkdirSync4(dirname4(destination), { recursive: true });
     writeFileSync2(destination, storedBuffer);
   }
@@ -7493,7 +8089,7 @@ function verifyStoredArtifact(input) {
     };
   }
   const storedPath = artifactStorePath(store.relative_path);
-  if (!existsSync6(storedPath)) {
+  if (!existsSync7(storedPath)) {
     return {
       id: input.id,
       path: input.path,
@@ -7574,15 +8170,15 @@ function getArtifactStoreRoot(dbPath) {
     return resolve6(process.env["TODOS_ARTIFACTS_DIR"]);
   const path = dbPath ?? getDatabasePath();
   if (isInMemoryDb2(path))
-    return join4(tmpdir(), "hasna-todos-artifacts");
-  return join4(dirname4(resolve6(path)), "artifacts");
+    return join5(tmpdir(), "hasna-todos-artifacts");
+  return join5(dirname4(resolve6(path)), "artifacts");
 }
 function computeContentHash(path) {
   return sha256(readFileSync3(resolve6(path)));
 }
 function storeArtifactFile(input) {
   const sourcePath = resolve6(input.sourcePath);
-  if (!existsSync6(sourcePath)) {
+  if (!existsSync7(sourcePath)) {
     throw new Error(`Source file not found: ${input.sourcePath}`);
   }
   if (!statSync2(sourcePath).isFile()) {
@@ -7595,7 +8191,7 @@ function storeArtifactFile(input) {
   let localPath = sourcePath;
   if (storageMode === "copy") {
     const fileName = input.name && input.name.trim().length > 0 ? basename(input.name) : basename(sourcePath);
-    const destination = join4(getArtifactStoreRoot(input.dbPath), input.artifactId, fileName);
+    const destination = join5(getArtifactStoreRoot(input.dbPath), input.artifactId, fileName);
     mkdirSync4(dirname4(destination), { recursive: true });
     writeFileSync2(destination, buffer);
     localPath = destination;
@@ -7605,7 +8201,7 @@ function storeArtifactFile(input) {
 function deleteStoredArtifactFile(localPath, storageMode, _dbPath2) {
   if (storageMode === "reference")
     return false;
-  if (!localPath || !existsSync6(localPath))
+  if (!localPath || !existsSync7(localPath))
     return false;
   rmSync(localPath, { force: true });
   try {
@@ -7617,8 +8213,8 @@ function isArtifactExpired(deletedAt, policy = {}) {
   if (!deletedAt)
     return false;
   const retentionDays = policy.deleted_retention_days ?? DEFAULT_DELETED_RETENTION_DAYS;
-  const now2 = policy.now ?? new Date;
-  const ageMs = now2.getTime() - new Date(deletedAt).getTime();
+  const now3 = policy.now ?? new Date;
+  const ageMs = now3.getTime() - new Date(deletedAt).getTime();
   return ageMs > retentionDays * 24 * 60 * 60 * 1000;
 }
 function buildArtifactExportManifest(artifacts, dbPath) {
@@ -9794,7 +10390,7 @@ function createHybridTodosStorageAdapter(options) {
 }
 
 // src/storage/postgres-adapter.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 function createPostgresTodosStorageAdapter(options) {
   const store = new PostgresJsonRecordStore(options);
   const adapter = {
@@ -9977,7 +10573,7 @@ async function createTask2(input, store, context) {
   const timestamp = new Date().toISOString();
   const shortId = input.project_id ? await nextTaskShortId2(input.project_id, store, context) : null;
   const task = {
-    id: randomUUID2(),
+    id: randomUUID3(),
     short_id: shortId,
     project_id: input.project_id ?? context?.projectId ?? null,
     parent_id: input.parent_id ?? null,
@@ -10144,7 +10740,7 @@ async function getChangedSince(since, filters, store) {
 async function createProject2(input, store, context) {
   const timestamp = new Date().toISOString();
   const project = {
-    id: randomUUID2(),
+    id: randomUUID3(),
     name: input.name,
     path: input.path,
     description: input.description ?? null,
@@ -10164,7 +10760,7 @@ async function updateProject2(id, input, store) {
 async function createPlan2(input, store, context) {
   const timestamp = new Date().toISOString();
   return store.upsert("plans", {
-    id: randomUUID2(),
+    id: randomUUID3(),
     project_id: input.project_id ?? context?.projectId ?? null,
     task_list_id: input.task_list_id ?? context?.taskListId ?? null,
     agent_id: input.agent_id ?? context?.agentId ?? null,
@@ -10186,7 +10782,7 @@ async function registerAgent2(input, store, context) {
   }
   const timestamp = new Date().toISOString();
   const agent = {
-    id: existing?.id ?? randomUUID2().slice(0, 8),
+    id: existing?.id ?? randomUUID3().slice(0, 8),
     name: input.name,
     description: input.description ?? existing?.description ?? null,
     role: input.role ?? existing?.role ?? null,
@@ -10222,7 +10818,7 @@ async function updateAgent2(id, input, store) {
 async function createTaskList2(input, store, context) {
   const timestamp = new Date().toISOString();
   return store.upsert("task_lists", {
-    id: randomUUID2(),
+    id: randomUUID3(),
     project_id: input.project_id ?? context?.projectId ?? null,
     slug: input.slug ?? slugify2(input.name),
     name: input.name,
@@ -10244,7 +10840,7 @@ async function updateTaskList2(id, input, store) {
 async function createTemplate2(input, store, context) {
   const timestamp = new Date().toISOString();
   return store.upsert("templates", {
-    id: randomUUID2(),
+    id: randomUUID3(),
     name: input.name,
     title_pattern: input.title_pattern,
     description: input.description ?? null,
@@ -10273,7 +10869,7 @@ async function updateTemplate2(id, input, store) {
 }
 async function logTaskChange2(taskId, action, field, oldValue, newValue, agentId, store, context) {
   const entry2 = {
-    id: randomUUID2(),
+    id: randomUUID3(),
     task_id: taskId,
     action,
     field: field ?? null,
@@ -10286,7 +10882,7 @@ async function logTaskChange2(taskId, action, field, oldValue, newValue, agentId
 }
 async function addComment2(input, store, context) {
   const comment = {
-    id: randomUUID2(),
+    id: randomUUID3(),
     task_id: input.task_id,
     agent_id: input.agent_id ?? context?.agentId ?? null,
     session_id: input.session_id ?? context?.sessionId ?? null,
@@ -10461,10 +11057,10 @@ function assertRemoteAdapterCapabilities(adapter, mode) {
   }
 }
 // src/storage/s3-artifacts.ts
-import { createHash as createHash3, createHmac } from "crypto";
+import { createHash as createHash3, createHmac as createHmac2 } from "crypto";
 function createTodosS3ArtifactStore(options) {
   const requestFetch = options.fetch ?? fetch;
-  const now2 = options.now ?? (() => new Date);
+  const now3 = options.now ?? (() => new Date);
   return {
     objectKey: (relativePath) => buildS3ObjectKey(options.config, relativePath),
     objectUrl: (relativePath) => buildS3ObjectUrl(options.config, buildS3ObjectKey(options.config, relativePath)),
@@ -10486,7 +11082,7 @@ function createTodosS3ArtifactStore(options) {
         headers,
         body,
         credentials: options.credentials,
-        now: now2()
+        now: now3()
       });
       const response = await requestFetch(url, { method: "PUT", headers: signed.headers, body });
       if (!response.ok)
@@ -10507,7 +11103,7 @@ function createTodosS3ArtifactStore(options) {
         service: "s3",
         headers: {},
         credentials: options.credentials,
-        now: now2()
+        now: now3()
       });
       const response = await requestFetch(url, { method: "GET", headers: signed.headers });
       if (!response.ok)
@@ -10523,7 +11119,7 @@ function createTodosS3ArtifactStore(options) {
         service: "s3",
         headers: {},
         credentials: options.credentials,
-        now: now2()
+        now: now3()
       });
       const response = await requestFetch(url, { method: "DELETE", headers: signed.headers });
       if (!response.ok && response.status !== 404)
@@ -10636,10 +11232,10 @@ function sha256Hex(value) {
   return createHash3("sha256").update(value).digest("hex");
 }
 function hmac(key, value) {
-  return createHmac("sha256", key).update(value).digest();
+  return createHmac2("sha256", key).update(value).digest();
 }
 function hmacHex(key, value) {
-  return createHmac("sha256", key).update(value).digest("hex");
+  return createHmac2("sha256", key).update(value).digest("hex");
 }
 function getSigningKey(secretAccessKey, dateStamp, region, service) {
   const dateKey = hmac(`AWS4${secretAccessKey}`, dateStamp);
@@ -10651,7 +11247,7 @@ function getSigningKey(secretAccessKey, dateStamp, region, service) {
 init_database();
 async function uploadRunArtifactsToS3(options) {
   const db = options.db ?? getDatabase();
-  const now2 = options.now ?? (() => new Date);
+  const now3 = options.now ?? (() => new Date);
   const result = emptyResult();
   for (const artifact of listRunArtifacts(db, options.filter)) {
     try {
@@ -10690,7 +11286,7 @@ async function uploadRunArtifactsToS3(options) {
         url: ref.url,
         sha256: content.sha256,
         size_bytes: content.size_bytes,
-        uploaded_at: now2().toISOString()
+        uploaded_at: now3().toISOString()
       };
       updateArtifactMetadata(db, artifact.id, {
         ...metadata,
@@ -10765,7 +11361,7 @@ function planRunArtifactsS3Sync(options) {
 }
 async function downloadRunArtifactsFromS3(options) {
   const db = options.db ?? getDatabase();
-  const now2 = options.now ?? (() => new Date);
+  const now3 = options.now ?? (() => new Date);
   const result = emptyResult();
   for (const artifact of listRunArtifacts(db, options.filter)) {
     try {
@@ -10801,7 +11397,7 @@ async function downloadRunArtifactsFromS3(options) {
         ...metadata,
         remote_artifact_store: {
           ...remote,
-          downloaded_at: now2().toISOString()
+          downloaded_at: now3().toISOString()
         }
       });
       result.downloaded += 1;