@hasna/todos 0.11.56 → 0.11.57

package/dist/mcp/index.js

@@ -8628,6 +8628,7 @@ var init_event_hooks = __esm(() => {
   init_runner_sandbox();
   init_config();
   LOCAL_EVENT_TYPES = [
+    "task.created",
     "task.assigned",
     "task.blocked",
     "task.started",
@@ -8652,6 +8653,572 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
+// node_modules/.bun/@hasna+events@0.1.7/node_modules/@hasna/events/dist/index.js
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { existsSync as existsSync5 } from "fs";
+import { homedir } from "os";
+import { join as join4 } from "path";
+import { createHmac, timingSafeEqual } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
+import { spawn } from "child_process";
+import { randomUUID as randomUUID22 } from "crypto";
+function getPathValue(input, path) {
+  return path.split(".").reduce((value, part) => {
+    if (value && typeof value === "object" && part in value) {
+      return value[part];
+    }
+    return;
+  }, input);
+}
+function wildcardToRegExp(pattern) {
+  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+function matchString(value, matcher) {
+  if (matcher === undefined)
+    return true;
+  if (value === undefined)
+    return false;
+  const matchers = Array.isArray(matcher) ? matcher : [matcher];
+  return matchers.some((item) => wildcardToRegExp(item).test(value));
+}
+function matchRecord(input, matcher) {
+  if (!matcher)
+    return true;
+  return Object.entries(matcher).every(([path, expected]) => {
+    const actual = getPathValue(input, path);
+    if (typeof expected === "string" || Array.isArray(expected)) {
+      return matchString(actual === undefined ? undefined : String(actual), expected);
+    }
+    return actual === expected;
+  });
+}
+function eventMatchesFilter(event, filter) {
+  return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
+}
+function channelMatchesEvent(channel, event) {
+  if (!channel.enabled)
+    return false;
+  if (!channel.filters || channel.filters.length === 0)
+    return true;
+  return channel.filters.some((filter) => eventMatchesFilter(event, filter));
+}
+function getEventsDataDir(override) {
+  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join4(homedir(), ".hasna", "events");
+}
+
+class JsonEventsStore {
+  dataDir;
+  channelsPath;
+  eventsPath;
+  deliveriesPath;
+  constructor(dataDir = getEventsDataDir()) {
+    this.dataDir = dataDir;
+    this.channelsPath = join4(dataDir, "channels.json");
+    this.eventsPath = join4(dataDir, "events.json");
+    this.deliveriesPath = join4(dataDir, "deliveries.json");
+  }
+  async init() {
+    await mkdir(this.dataDir, { recursive: true, mode: 448 });
+    await chmod(this.dataDir, 448).catch(() => {
+      return;
+    });
+    await this.ensureArrayFile(this.channelsPath);
+    await this.ensureArrayFile(this.eventsPath);
+    await this.ensureArrayFile(this.deliveriesPath);
+  }
+  async addChannel(channel) {
+    await this.init();
+    const channels = await this.readJson(this.channelsPath, []);
+    const index = channels.findIndex((item) => item.id === channel.id);
+    if (index >= 0) {
+      channels[index] = { ...channel, createdAt: channels[index].createdAt, updatedAt: new Date().toISOString() };
+    } else {
+      channels.push(channel);
+    }
+    await this.writeJson(this.channelsPath, channels);
+    return index >= 0 ? channels[index] : channel;
+  }
+  async listChannels() {
+    await this.init();
+    return this.readJson(this.channelsPath, []);
+  }
+  async getChannel(id) {
+    const channels = await this.listChannels();
+    return channels.find((channel) => channel.id === id);
+  }
+  async removeChannel(id) {
+    await this.init();
+    const channels = await this.readJson(this.channelsPath, []);
+    const next = channels.filter((channel) => channel.id !== id);
+    await this.writeJson(this.channelsPath, next);
+    return next.length !== channels.length;
+  }
+  async appendEvent(event) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return event;
+  }
+  async listEvents() {
+    await this.init();
+    return this.readJson(this.eventsPath, []);
+  }
+  async findEventByIdentity(identity) {
+    const events = await this.listEvents();
+    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+  }
+  async appendDelivery(result) {
+    await this.init();
+    const deliveries = await this.readJson(this.deliveriesPath, []);
+    deliveries.push(result);
+    await this.writeJson(this.deliveriesPath, deliveries);
+    return result;
+  }
+  async listDeliveries() {
+    await this.init();
+    return this.readJson(this.deliveriesPath, []);
+  }
+  async exportData() {
+    return {
+      channels: await this.listChannels(),
+      events: await this.listEvents(),
+      deliveries: await this.listDeliveries()
+    };
+  }
+  async ensureArrayFile(path) {
+    if (!existsSync5(path)) {
+      await writeFile(path, `[]
+`, { encoding: "utf-8", mode: 384 });
+    }
+    await chmod(path, 384).catch(() => {
+      return;
+    });
+  }
+  async readJson(path, fallback) {
+    try {
+      const raw = await readFile(path, "utf-8");
+      if (!raw.trim())
+        return fallback;
+      return JSON.parse(raw);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return fallback;
+      throw error;
+    }
+  }
+  async writeJson(path, value) {
+    const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tempPath, `${JSON.stringify(value, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+    await rename(tempPath, path);
+    await chmod(path, 384).catch(() => {
+      return;
+    });
+  }
+}
+function buildSignatureBase(timestamp, body) {
+  return `${timestamp}.${body}`;
+}
+function signPayload(secret, timestamp, body) {
+  const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
+  return `sha256=${digest}`;
+}
+function now2() {
+  return new Date().toISOString();
+}
+function truncate(value, max = 4096) {
+  return value.length > max ? `${value.slice(0, max)}...` : value;
+}
+function buildWebhookRequest(event, channel) {
+  if (!channel.webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const body = JSON.stringify(event);
+  const timestamp = event.time;
+  const headers = {
+    "Content-Type": "application/json",
+    "User-Agent": "@hasna/events",
+    "X-Hasna-Event-Id": event.id,
+    "X-Hasna-Event-Type": event.type,
+    "X-Hasna-Timestamp": timestamp,
+    ...channel.webhook.headers
+  };
+  if (channel.webhook.secret) {
+    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+  }
+  return { body, headers };
+}
+async function dispatchWebhook(event, channel, options = {}) {
+  if (!channel.webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const startedAt = now2();
+  const { body, headers } = buildWebhookRequest(event, channel);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
+  try {
+    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    const responseBody = truncate(await response.text());
+    return {
+      attempt: 1,
+      status: response.ok ? "success" : "failed",
+      startedAt,
+      completedAt: now2(),
+      responseStatus: response.status,
+      responseBody,
+      error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+    };
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now2(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function dispatchCommand(event, channel) {
+  if (!channel.command)
+    throw new Error(`Channel ${channel.id} has no command config`);
+  const startedAt = now2();
+  const eventJson = JSON.stringify(event);
+  const env = {
+    ...process.env,
+    ...channel.command.env,
+    HASNA_CHANNEL_ID: channel.id,
+    HASNA_EVENT_ID: event.id,
+    HASNA_EVENT_TYPE: event.type,
+    HASNA_EVENT_SOURCE: event.source,
+    HASNA_EVENT_SUBJECT: event.subject ?? "",
+    HASNA_EVENT_SEVERITY: event.severity,
+    HASNA_EVENT_TIME: event.time,
+    HASNA_EVENT_DEDUPE_KEY: event.dedupeKey ?? "",
+    HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
+    HASNA_EVENT_JSON: eventJson
+  };
+  return new Promise((resolve6) => {
+    const child = spawn(channel.command.command, channel.command.args ?? [], {
+      cwd: channel.command.cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => child.kill("SIGTERM"), channel.command.timeoutMs ?? 15000);
+    child.stdin.end(eventJson);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      clearTimeout(timeout);
+      resolve6({
+        attempt: 1,
+        status: "failed",
+        startedAt,
+        completedAt: now2(),
+        stdout: truncate(stdout),
+        stderr: truncate(stderr),
+        error: error.message
+      });
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timeout);
+      const success = code === 0;
+      resolve6({
+        attempt: 1,
+        status: success ? "success" : "failed",
+        startedAt,
+        completedAt: now2(),
+        stdout: truncate(stdout),
+        stderr: truncate(stderr),
+        error: success ? undefined : `Command exited with ${signal ? `signal ${signal}` : `code ${code}`}`
+      });
+    });
+  });
+}
+async function dispatchChannel(event, channel, options = {}) {
+  if (channel.transport === "webhook")
+    return dispatchWebhook(event, channel, options);
+  if (channel.transport === "command")
+    return dispatchCommand(event, channel);
+  return {
+    attempt: 1,
+    status: "skipped",
+    startedAt: now2(),
+    completedAt: now2(),
+    error: `Unsupported transport: ${channel.transport}`
+  };
+}
+function createDeliveryResult(event, channel, attempts) {
+  const status = attempts.some((attempt) => attempt.status === "success") ? "success" : attempts.every((attempt) => attempt.status === "skipped") ? "skipped" : "failed";
+  return {
+    id: randomUUID2(),
+    eventId: event.id,
+    channelId: channel.id,
+    transport: channel.transport,
+    status,
+    attempts,
+    createdAt: attempts[0]?.startedAt ?? now2(),
+    completedAt: attempts.at(-1)?.completedAt ?? now2()
+  };
+}
+function createEvent(input) {
+  return {
+    id: input.id ?? randomUUID22(),
+    source: input.source,
+    type: input.type,
+    time: normalizeTime(input.time),
+    subject: input.subject,
+    severity: input.severity ?? "info",
+    data: input.data ?? {},
+    message: input.message,
+    dedupeKey: input.dedupeKey,
+    schemaVersion: input.schemaVersion ?? "1.0",
+    metadata: input.metadata ?? {}
+  };
+}
+
+class EventsClient {
+  store;
+  redactors;
+  transportOptions;
+  constructor(options = {}) {
+    this.store = options.store ?? new JsonEventsStore(options.dataDir);
+    this.redactors = options.redactors ?? [];
+    this.transportOptions = { fetchImpl: options.fetchImpl };
+  }
+  async addChannel(input) {
+    const timestamp = new Date().toISOString();
+    return this.store.addChannel({
+      ...input,
+      createdAt: input.createdAt ?? timestamp,
+      updatedAt: input.updatedAt ?? timestamp
+    });
+  }
+  async listChannels() {
+    return this.store.listChannels();
+  }
+  async removeChannel(id) {
+    return this.store.removeChannel(id);
+  }
+  async emit(input, options = {}) {
+    const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
+    if (options.dedupe !== false) {
+      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return { event: existing, deliveries: [], deduped: true };
+      }
+    }
+    await this.store.appendEvent(event);
+    const deliveries = options.deliver === false ? [] : await this.deliver(event);
+    return { event, deliveries, deduped: false };
+  }
+  async listEvents() {
+    return this.store.listEvents();
+  }
+  async listDeliveries() {
+    return this.store.listDeliveries();
+  }
+  async deliver(event) {
+    const channels = await this.store.listChannels();
+    const selected = channels.filter((channel) => channelMatchesEvent(channel, event));
+    const deliveries = [];
+    for (const channel of selected) {
+      const eventForChannel = await this.applyRedaction(event, channel);
+      const result = await this.deliverWithRetry(eventForChannel, channel);
+      await this.store.appendDelivery(result);
+      deliveries.push(result);
+    }
+    return deliveries;
+  }
+  async testChannel(id, input = {}) {
+    const channel = await this.store.getChannel(id);
+    if (!channel)
+      throw new Error(`Channel not found: ${id}`);
+    const event = createEvent({
+      source: input.source ?? "hasna.events",
+      type: input.type ?? "events.test",
+      subject: input.subject ?? id,
+      severity: input.severity ?? "info",
+      data: input.data ?? { test: true },
+      message: input.message ?? "Hasna events test delivery",
+      dedupeKey: input.dedupeKey,
+      schemaVersion: input.schemaVersion,
+      metadata: input.metadata,
+      time: input.time,
+      id: input.id
+    });
+    const eventForChannel = await this.applyRedaction(event, channel);
+    const result = await this.deliverWithRetry(eventForChannel, channel);
+    await this.store.appendDelivery(result);
+    return result;
+  }
+  async replay(options = {}) {
+    const events = (await this.store.listEvents()).filter((event) => {
+      if (options.eventId && event.id !== options.eventId)
+        return false;
+      if (options.source && event.source !== options.source)
+        return false;
+      if (options.type && event.type !== options.type)
+        return false;
+      return true;
+    });
+    if (options.dryRun)
+      return { events, deliveries: [] };
+    const deliveries = [];
+    for (const event of events) {
+      deliveries.push(...await this.deliver(event));
+    }
+    return { events, deliveries };
+  }
+  async applyRedaction(event, channel) {
+    let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
+    for (const redactor of this.redactors) {
+      next = await redactor(next, channel);
+    }
+    return next;
+  }
+  async deliverWithRetry(event, channel) {
+    const policy = normalizeRetryPolicy(channel.retry);
+    const attempts = [];
+    for (let index = 0;index < policy.maxAttempts; index += 1) {
+      const attempt = await dispatchChannel(event, channel, this.transportOptions);
+      attempt.attempt = index + 1;
+      if (attempt.status === "failed" && index + 1 < policy.maxAttempts) {
+        attempt.nextBackoffMs = Math.round(policy.backoffMs * policy.multiplier ** index);
+      }
+      attempts.push(attempt);
+      if (attempt.status !== "failed")
+        break;
+      if (attempt.nextBackoffMs)
+        await Bun.sleep(attempt.nextBackoffMs);
+    }
+    return createDeliveryResult(event, channel, attempts);
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue2(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue2(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue2(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
+function normalizeTime(value) {
+  if (!value)
+    return new Date().toISOString();
+  return value instanceof Date ? value.toISOString() : value;
+}
+function normalizeRetryPolicy(policy) {
+  return {
+    maxAttempts: Math.max(1, policy?.maxAttempts ?? 1),
+    backoffMs: Math.max(0, policy?.backoffMs ?? 250),
+    multiplier: Math.max(1, policy?.multiplier ?? 2)
+  };
+}
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", DEFAULT_SIGNATURE_TOLERANCE_MS;
+var init_dist = __esm(() => {
+  DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+});
+
+// src/lib/shared-events.ts
+function taskEventData(task, extra = {}) {
+  return {
+    id: task.id,
+    task_id: task.id,
+    short_id: task.short_id,
+    title: task.title,
+    description: task.description,
+    status: task.status,
+    priority: task.priority,
+    project_id: task.project_id,
+    parent_id: task.parent_id,
+    plan_id: task.plan_id,
+    task_list_id: task.task_list_id,
+    agent_id: task.agent_id,
+    assigned_to: task.assigned_to,
+    session_id: task.session_id,
+    working_dir: task.working_dir,
+    tags: task.tags,
+    metadata: task.metadata,
+    version: task.version,
+    created_at: task.created_at,
+    updated_at: task.updated_at,
+    started_at: task.started_at,
+    completed_at: task.completed_at,
+    due_at: task.due_at,
+    ...extra
+  };
+}
+async function emitSharedTaskEvent(input) {
+  const data = taskEventData(input.task, input.data);
+  await new EventsClient().emit({
+    source: SOURCE,
+    type: input.type,
+    subject: input.task.id,
+    severity: input.severity ?? "info",
+    message: input.message ?? `${input.type}: ${input.task.title}`,
+    data,
+    dedupeKey: input.dedupeKey ?? `${input.type}:${input.task.id}:${input.task.version}`,
+    metadata: {
+      package: "@hasna/todos",
+      task_id: input.task.id,
+      project_id: input.task.project_id,
+      task_list_id: input.task.task_list_id
+    }
+  }, { deliver: true, dedupe: true });
+}
+function emitSharedTaskEventQuiet(input) {
+  emitSharedTaskEvent(input).catch(() => {
+    return;
+  });
+}
+var SOURCE = "todos";
+var init_shared_events = __esm(() => {
+  init_dist();
+});
+
 // src/lib/secret-redaction.ts
 function isAllowlisted(text, match, allowlist) {
   const context = text.slice(Math.max(0, text.indexOf(match) - 20), text.indexOf(match) + match.length + 20);
@@ -9119,7 +9686,7 @@ async function deliverWebhook(wh, event, body, attempt, db) {
     activeDeliveries--;
   }
 }
-async function dispatchWebhook(event, payload, db) {
+async function dispatchWebhook2(event, payload, db) {
   const d = db || getDatabase();
   const webhooks = listWebhooks(d).filter((w) => w.active && (w.events.length === 0 || w.events.includes(event)));
   const payloadObj = typeof payload === "object" && payload !== null ? payload : {};
@@ -9236,7 +9803,10 @@ function createTask(input, db) {
     insertTaskTags(id, tags, d);
   }
   const task = getTask(id, d);
-  dispatchWebhook("task.created", { id: task.id, short_id: task.short_id, title: task.title, status: task.status, priority: task.priority, project_id: task.project_id, assigned_to: task.assigned_to }, d).catch(() => {});
+  const payload = taskEventData(task);
+  dispatchWebhook2("task.created", payload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.created", payload });
+  emitSharedTaskEventQuiet({ type: "task.created", task });
   return task;
 }
 function getTask(id, db) {
@@ -9580,18 +10150,7 @@ function updateTask(id, input, db) {
     logTaskChange(id, "update", "assigned_to", task.assigned_to, input.assigned_to, agentId, d);
   if (input.approved_by !== undefined)
     logTaskChange(id, "approve", "approved_by", null, input.approved_by, agentId, d);
-  if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to) {
-    dispatchWebhook("task.assigned", { id, assigned_to: input.assigned_to, title: task.title }, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.assigned", payload: { id, assigned_to: input.assigned_to, title: task.title } });
-  }
-  if (input.status !== undefined && input.status !== task.status) {
-    dispatchWebhook("task.status_changed", { id, old_status: task.status, new_status: input.status, title: task.title }, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.status_changed", payload: { id, old_status: task.status, new_status: input.status, title: task.title } });
-  }
-  if (input.approved_by !== undefined) {
-    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title } });
-  }
-  return {
+  const updatedTask = {
     ...task,
     ...Object.fromEntries(Object.entries(input).filter(([, v]) => v !== undefined)),
     tags: input.tags ?? task.tags,
@@ -9609,6 +10168,22 @@ function updateTask(id, input, db) {
     approved_by: input.approved_by ?? task.approved_by,
     approved_at: input.approved_by ? timestamp : task.approved_at
   };
+  if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to) {
+    const payload = taskEventData(updatedTask, { assigned_to: input.assigned_to, old_assigned_to: task.assigned_to });
+    dispatchWebhook2("task.assigned", payload, d).catch(() => {});
+    emitLocalEventHooksQuiet({ type: "task.assigned", payload });
+    emitSharedTaskEventQuiet({ type: "task.assigned", task: updatedTask, data: { old_assigned_to: task.assigned_to } });
+  }
+  if (input.status !== undefined && input.status !== task.status) {
+    const payload = taskEventData(updatedTask, { old_status: task.status, new_status: input.status });
+    dispatchWebhook2("task.status_changed", payload, d).catch(() => {});
+    emitLocalEventHooksQuiet({ type: "task.status_changed", payload });
+    emitSharedTaskEventQuiet({ type: "task.status_changed", task: updatedTask, data: { old_status: task.status, new_status: input.status } });
+  }
+  if (input.approved_by !== undefined) {
+    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title } });
+  }
+  return updatedTask;
 }
 function deleteTask(id, db) {
   const d = db || getDatabase();
@@ -9620,6 +10195,7 @@ var init_task_crud = __esm(() => {
   init_database();
   init_completion_guard();
   init_event_hooks();
+  init_shared_events();
   init_audit();
   init_webhooks();
   init_checklists();
@@ -10375,9 +10951,12 @@ function startTask(id, agentId, db) {
     throw new Error(`Task ${id} could not be started because it changed during claim`);
   }
   logTaskChange(id, "start", "status", "pending", "in_progress", agentId, d);
-  dispatchWebhook("task.started", { id, agent_id: agentId, title: task.title }, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.started", payload: { id, agent_id: agentId, title: task.title } });
-  return { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp, started_at: task.started_at || timestamp, version: task.version + 1, updated_at: timestamp };
+  const startedTask = { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp, started_at: task.started_at || timestamp, version: task.version + 1, updated_at: timestamp };
+  const payload = taskEventData(startedTask, { agent_id: agentId });
+  dispatchWebhook2("task.started", payload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.started", payload });
+  emitSharedTaskEventQuiet({ type: "task.started", task: startedTask, data: { agent_id: agentId } });
+  return startedTask;
 }
 function completeTask(id, agentId, db, options) {
   const d = db || getDatabase();
@@ -10413,8 +10992,21 @@ function completeTask(id, agentId, db, options) {
   });
   tx();
   logTaskChange(id, "complete", "status", task.status, "completed", agentId || null, d);
-  dispatchWebhook("task.completed", { id, agent_id: agentId, title: task.title, completed_at: timestamp }, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.completed", payload: { id, agent_id: agentId, title: task.title, completed_at: timestamp } });
+  const completedTaskForEvent = {
+    ...task,
+    status: "completed",
+    locked_by: null,
+    locked_at: null,
+    completed_at: timestamp,
+    confidence,
+    version: task.version + 1,
+    updated_at: timestamp,
+    metadata: hasMeta ? { ...task.metadata, ...completionMeta } : task.metadata
+  };
+  const completionPayload = taskEventData(completedTaskForEvent, { agent_id: agentId, completed_at: timestamp });
+  dispatchWebhook2("task.completed", completionPayload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload });
+  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp } });
   let spawnedTask = null;
   if (task.recurrence_rule && !options?.skip_recurrence) {
     spawnedTask = spawnNextRecurrence(task, d, timestamp);
@@ -10455,8 +11047,12 @@ function completeTask(id, agentId, db, options) {
   if (unblockedDeps.length > 0) {
     meta._unblocked = unblockedDeps.map((d2) => ({ id: d2.id, short_id: d2.short_id, title: d2.title }));
     for (const dep of unblockedDeps) {
-      dispatchWebhook("task.unblocked", { id: dep.id, unblocked_by: id, title: dep.title }, d).catch(() => {});
-      emitLocalEventHooksQuiet({ type: "task.unblocked", payload: { id: dep.id, unblocked_by: id, title: dep.title } });
+      const depTask = getTask(dep.id, d);
+      const payload = depTask ? taskEventData(depTask, { unblocked_by: id }) : { id: dep.id, unblocked_by: id, title: dep.title };
+      dispatchWebhook2("task.unblocked", payload, d).catch(() => {});
+      emitLocalEventHooksQuiet({ type: "task.unblocked", payload });
+      if (depTask)
+        emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id } });
     }
   }
   return { ...task, status: "completed", locked_by: null, locked_at: null, completed_at: timestamp, confidence, version: task.version + 1, updated_at: timestamp, metadata: meta };
@@ -10642,9 +11238,6 @@ function failTask(id, agentId, reason, options, db) {
   const timestamp = now();
   d.run(`UPDATE tasks SET status = 'failed', locked_by = NULL, locked_at = NULL, metadata = ?, version = version + 1, updated_at = ?
      WHERE id = ?`, [JSON.stringify(meta), timestamp, id]);
-  logTaskChange(id, "fail", "status", task.status, "failed", agentId || null, d);
-  dispatchWebhook("task.failed", { id, reason, error_code: options?.error_code, agent_id: agentId, title: task.title }, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.failed", payload: { id, reason, error_code: options?.error_code, agent_id: agentId, title: task.title } });
   const failedTask = {
     ...task,
     status: "failed",
@@ -10654,6 +11247,11 @@ function failTask(id, agentId, reason, options, db) {
     version: task.version + 1,
     updated_at: timestamp
   };
+  logTaskChange(id, "fail", "status", task.status, "failed", agentId || null, d);
+  const failurePayload = taskEventData(failedTask, { reason, error_code: options?.error_code, agent_id: agentId });
+  dispatchWebhook2("task.failed", failurePayload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload });
+  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning" });
   let retryTask;
   if (options?.retry) {
     const retryCount = (task.retry_count || 0) + 1;
@@ -10728,9 +11326,12 @@ function stealTask(agentId, opts, db) {
     return null;
   logTaskChange(target.id, "steal", "assigned_to", target.assigned_to, agentId, agentId, d);
   logTaskChange(target.id, "steal", "locked_by", target.locked_by, agentId, agentId, d);
-  dispatchWebhook("task.assigned", { id: target.id, agent_id: agentId, title: target.title, stolen_from: target.assigned_to }, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.assigned", payload: { id: target.id, agent_id: agentId, title: target.title, stolen_from: target.assigned_to } });
-  return { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp, updated_at: timestamp, version: target.version + 1 };
+  const stolenTask = { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp, updated_at: timestamp, version: target.version + 1 };
+  const payload = taskEventData(stolenTask, { agent_id: agentId, stolen_from: target.assigned_to });
+  dispatchWebhook2("task.assigned", payload, d).catch(() => {});
+  emitLocalEventHooksQuiet({ type: "task.assigned", payload });
+  emitSharedTaskEventQuiet({ type: "task.assigned", task: stolenTask, data: { agent_id: agentId, stolen_from: target.assigned_to } });
+  return stolenTask;
 }
 function claimOrSteal(agentId, filters, db) {
   const d = db || getDatabase();
@@ -10778,6 +11379,7 @@ var init_task_lifecycle = __esm(() => {
   init_database();
   init_completion_guard();
   init_event_hooks();
+  init_shared_events();
   init_audit();
   init_recurrence();
   init_webhooks();
@@ -11465,7 +12067,7 @@ function getTaskWatchers(taskId, db) {
 }
 function notifyWatchers(taskId, event, data, db) {
   const watchers = getTaskWatchers(taskId, db);
-  dispatchWebhook(`task.watcher.${event}`, { task_id: taskId, watchers: watchers.map((w) => w.agent_id), ...data }, db).catch(() => {});
+  dispatchWebhook2(`task.watcher.${event}`, { task_id: taskId, watchers: watchers.map((w) => w.agent_id), ...data }, db).catch(() => {});
 }
 function logCost(taskId, tokens, usd, db) {
   const d = db || getDatabase();
@@ -11959,8 +12561,8 @@ var init_boards = __esm(() => {
 
 // src/lib/artifact-store.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync2, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname4, join as join4, resolve as resolve6 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync2, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname as dirname4, join as join5, resolve as resolve6 } from "path";
 import { tmpdir } from "os";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
@@ -11972,15 +12574,15 @@ function artifactStoreRoot() {
     return resolve6(process.env["TODOS_ARTIFACTS_DIR"]);
   const dbPath = getDatabasePath();
   if (isInMemoryDb2(dbPath))
-    return join4(tmpdir(), "hasna-todos-artifacts");
-  return join4(dirname4(resolve6(dbPath)), "artifacts");
+    return join5(tmpdir(), "hasna-todos-artifacts");
+  return join5(dirname4(resolve6(dbPath)), "artifacts");
 }
 function artifactStorePath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
   if (normalized.includes("..") || normalized.startsWith("/") || normalized.length === 0) {
     throw new Error("Invalid artifact store path");
   }
-  return join4(artifactStoreRoot(), normalized);
+  return join5(artifactStoreRoot(), normalized);
 }
 function sha256(buffer) {
   return createHash2("sha256").update(buffer).digest("hex");
@@ -12021,7 +12623,7 @@ function mediaTypeFor(path, textLike) {
 }
 function storeArtifactContent(input) {
   const sourcePath = resolve6(input.path);
-  if (!existsSync5(sourcePath))
+  if (!existsSync6(sourcePath))
     return null;
   const sourceStat = statSync2(sourcePath);
   if (!sourceStat.isFile())
@@ -12038,9 +12640,9 @@ function storeArtifactContent(input) {
       redactionStatus = "redacted";
   }
   const storedSha = sha256(storedBuffer);
-  const relativePath = join4("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
+  const relativePath = join5("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
   const destination = artifactStorePath(relativePath);
-  if (!existsSync5(destination)) {
+  if (!existsSync6(destination)) {
     mkdirSync4(dirname4(destination), { recursive: true });
     writeFileSync2(destination, storedBuffer);
   }
@@ -12100,7 +12702,7 @@ function verifyStoredArtifact(input) {
     };
   }
   const storedPath = artifactStorePath(store.relative_path);
-  if (!existsSync5(storedPath)) {
+  if (!existsSync6(storedPath)) {
     return {
       id: input.id,
       path: input.path,
@@ -13385,17 +13987,73 @@ var init_dispatch_formatter = __esm(() => {
 });
 
 // src/lib/tmux.ts
+async function inspectTmuxPane(target) {
+  const proc = Bun.spawn([
+    "tmux",
+    "display-message",
+    "-p",
+    "-t",
+    target,
+    "#{pane_id}\t#{pane_current_command}\t#{pane_dead}\t#{pane_input_off}\t#{pane_in_mode}"
+  ], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const exitCode = await proc.exited;
+  if (exitCode !== 0) {
+    const stderr = await new Response(proc.stderr).text();
+    throw new Error(`tmux target "${target}" not found: ${stderr.trim() || "unknown error"}`);
+  }
+  const stdout = (await new Response(proc.stdout).text()).trim();
+  const [paneId, currentCommand = "", paneDead = "0", inputOff = "0", inMode = "0"] = stdout.split("\t");
+  if (!paneId) {
+    throw new Error(`tmux target "${target}" did not resolve to a pane`);
+  }
+  return {
+    target,
+    paneId,
+    currentCommand,
+    paneDead: paneDead === "1",
+    inputOff: inputOff === "1",
+    inMode: inMode === "1"
+  };
+}
+function tmuxPaneBusyStatus(pane) {
+  if (pane.paneDead) {
+    return { busy: true, reason: "pane is dead" };
+  }
+  if (pane.inputOff) {
+    return { busy: true, reason: "pane input is disabled" };
+  }
+  if (pane.inMode) {
+    return { busy: true, reason: "pane is in copy or alternate mode" };
+  }
+  const currentCommand = pane.currentCommand.trim();
+  if (currentCommand && !IDLE_TMUX_COMMANDS.has(currentCommand)) {
+    return { busy: true, reason: `pane is running ${currentCommand}` };
+  }
+  return { busy: false, reason: null };
+}
 function calculateDelay(message) {
   const len = message.length;
   const extra = Math.floor(len / 100 * 40);
   return Math.min(DELAY_MIN + extra, DELAY_MAX);
 }
-async function sendToTmux(target, message, delayMs, dryRun = false) {
+async function sendToTmux(target, message, delayMs, options = false) {
+  const opts = typeof options === "boolean" ? { dryRun: options } : options;
+  const dryRun = opts.dryRun ?? false;
   if (dryRun) {
     console.log(`[dry-run] sendToTmux target=${target} delay=${delayMs}ms`);
     console.log(`[dry-run] message: ${message.slice(0, 200)}`);
     return;
   }
+  if (!opts.confirmBusy) {
+    const pane = await inspectTmuxPane(target);
+    const status = tmuxPaneBusyStatus(pane);
+    if (status.busy) {
+      throw new Error(`tmux target "${target}" appears busy (${status.reason}). Re-run with --confirm-busy to send anyway.`);
+    }
+  }
   const sendProc = Bun.spawn(["tmux", "send-keys", "-t", target, message, ""], {
     stdout: "pipe",
     stderr: "pipe"
@@ -13416,7 +14074,21 @@ async function sendToTmux(target, message, delayMs, dryRun = false) {
     throw new Error(`tmux send-keys Enter failed for target "${target}": ${stderr.trim()}`);
   }
 }
-var DELAY_MIN = 3000, DELAY_MAX = 5000;
+var DELAY_MIN = 3000, DELAY_MAX = 5000, IDLE_TMUX_COMMANDS;
+var init_tmux = __esm(() => {
+  IDLE_TMUX_COMMANDS = new Set([
+    "bash",
+    "dash",
+    "elvish",
+    "fish",
+    "ksh",
+    "nu",
+    "pwsh",
+    "sh",
+    "tmux",
+    "zsh"
+  ]);
+});
 
 // src/lib/dispatch.ts
 var exports_dispatch = {};
@@ -13434,7 +14106,10 @@ async function executeDispatch(dispatch, opts = {}, db) {
   }
   const delayMs = dispatch.delay_ms ?? calculateDelay(message);
   try {
-    await sendToTmux(dispatch.target_window, message, delayMs, opts.dryRun ?? false);
+    await sendToTmux(dispatch.target_window, message, delayMs, {
+      dryRun: opts.dryRun ?? false,
+      confirmBusy: opts.confirmBusy ?? false
+    });
     createDispatchLog({
       dispatch_id: dispatch.id,
       target_window: dispatch.target_window,
@@ -13493,6 +14168,7 @@ var init_dispatch = __esm(() => {
   init_tasks();
   init_database();
   init_dispatch_formatter();
+  init_tmux();
 });
 
 // src/db/task-lists.ts
@@ -13587,8 +14263,9 @@ function registerDispatchTools(server, { shouldRegisterTool, resolveId, formatEr
       target: exports_external.string().describe("tmux target \u2014 window name, session:window, or session:window.pane"),
       delay_ms: exports_external.number().optional().describe("Delay in ms between sending the message and hitting Enter. Auto-calculated from message length (3-5s) if omitted."),
       scheduled_at: exports_external.string().optional().describe("ISO datetime to schedule the dispatch for. Fires immediately if omitted."),
+      confirm_busy: exports_external.boolean().optional().describe("Send even if the target tmux pane appears busy. Default: false."),
       dry_run: exports_external.boolean().optional().describe("Preview the formatted message without sending. Default: false.")
-    }, async ({ task_ids, target, delay_ms, scheduled_at, dry_run }) => {
+    }, async ({ task_ids, target, delay_ms, scheduled_at, confirm_busy, dry_run }) => {
       try {
         const db = getDatabase();
         const resolvedIds = task_ids.map((id) => resolveId(id));
@@ -13604,7 +14281,7 @@ ${message}` }]
         }
         const dispatch = createDispatch({ task_ids: resolvedIds, target_window: target, message, delay_ms: effectiveDelay, scheduled_at }, db);
         if (!scheduled_at)
-          await executeDispatch(dispatch, {}, db);
+          await executeDispatch(dispatch, { confirmBusy: confirm_busy ?? false }, db);
         return {
           content: [{
             type: "text",
@@ -13630,8 +14307,9 @@ ${message}`
       filter_status: exports_external.array(exports_external.enum(["pending", "in_progress", "completed", "failed", "cancelled"])).optional().describe("Only include tasks with these statuses. Default: pending."),
       delay_ms: exports_external.number().optional().describe("Delay in ms between sending and Enter. Auto-calculated if omitted."),
       scheduled_at: exports_external.string().optional().describe("ISO datetime to schedule. Fires immediately if omitted."),
+      confirm_busy: exports_external.boolean().optional().describe("Send even if the target tmux pane appears busy. Default: false."),
       dry_run: exports_external.boolean().optional().describe("Preview without sending. Default: false.")
-    }, async ({ task_list_id, target, filter_status, delay_ms, scheduled_at, dry_run }) => {
+    }, async ({ task_list_id, target, filter_status, delay_ms, scheduled_at, confirm_busy, dry_run }) => {
       try {
         const db = getDatabase();
         const resolvedListId = resolveId(task_list_id, "task_lists");
@@ -13651,7 +14329,7 @@ ${message}` }]
         }
         const dispatch = createDispatch({ title: `Task list: ${taskList.name}`, task_list_id: resolvedListId, target_window: target, message, delay_ms: effectiveDelay, scheduled_at }, db);
         if (!scheduled_at)
-          await executeDispatch(dispatch, {}, db);
+          await executeDispatch(dispatch, { confirmBusy: confirm_busy ?? false }, db);
         return {
           content: [{
             type: "text",
@@ -13678,15 +14356,16 @@ ${message}`
       task_list_id: exports_external.string().optional().describe("Task list ID to dispatch (use this or task_ids)"),
       stagger_ms: exports_external.number().optional().describe("Delay between each window dispatch. Default: 500ms."),
       delay_ms: exports_external.number().optional().describe("Delay between message send and Enter. Auto-calculated if omitted."),
+      confirm_busy: exports_external.boolean().optional().describe("Send even if target tmux panes appear busy. Default: false."),
       dry_run: exports_external.boolean().optional().describe("Preview without sending. Default: false.")
-    }, async ({ targets, task_ids, task_list_id, stagger_ms, delay_ms, dry_run }) => {
+    }, async ({ targets, task_ids, task_list_id, stagger_ms, delay_ms, confirm_busy, dry_run }) => {
       try {
         if (!task_ids && !task_list_id)
           throw new Error("Either task_ids or task_list_id is required");
         const db = getDatabase();
         const resolvedTaskIds = task_ids ? task_ids.map((id) => resolveId(id)) : undefined;
         const resolvedListId = task_list_id ? resolveId(task_list_id, "task_lists") : undefined;
-        const dispatches = await dispatchToMultiple({ targets, task_ids: resolvedTaskIds, task_list_id: resolvedListId, delay_ms, stagger_ms }, { dryRun: dry_run }, db);
+        const dispatches = await dispatchToMultiple({ targets, task_ids: resolvedTaskIds, task_list_id: resolvedListId, delay_ms, stagger_ms }, { dryRun: dry_run, confirmBusy: confirm_busy ?? false }, db);
         const lines = dispatches.map((d) => `${d.target_window}: ${d.id} [${d.status}]`);
         return { content: [{ type: "text", text: `Dispatched to ${dispatches.length} target(s):
 ${lines.join(`
@@ -13731,11 +14410,12 @@ ${lines.join(`
   if (shouldRegisterTool("run_due_dispatches")) {
     server.tool("run_due_dispatches", "Manually trigger all pending dispatches that are due (scheduled_at <= now). Returns the count fired.", {
       dry_run: exports_external.boolean().optional().describe("Preview without sending. Default: false."),
+      confirm_busy: exports_external.boolean().optional().describe("Send even if target tmux panes appear busy. Default: false."),
       all: exports_external.boolean().optional().describe("Ignore scheduled_at and fire all pending dispatches immediately.")
-    }, async ({ dry_run }) => {
+    }, async ({ dry_run, confirm_busy }) => {
       try {
         const { runDueDispatches: runDueDispatches2 } = await Promise.resolve().then(() => (init_dispatch(), exports_dispatch));
-        const count = await runDueDispatches2({ dryRun: dry_run });
+        const count = await runDueDispatches2({ dryRun: dry_run, confirmBusy: confirm_busy ?? false });
         return { content: [{ type: "text", text: `Fired ${count} dispatch(es).` }] };
       } catch (e) {
         return { content: [{ type: "text", text: formatError(e) }], isError: true };
@@ -13748,6 +14428,7 @@ var init_dispatch2 = __esm(() => {
   init_dispatches();
   init_dispatch();
   init_dispatch_formatter();
+  init_tmux();
   init_tasks();
   init_task_lists();
   init_database();
@@ -14555,7 +15236,7 @@ var init_task_crud2 = __esm(() => {
 });
 
 // src/lib/project-bootstrap.ts
-import { existsSync as existsSync6, readFileSync as readFileSync3, statSync as statSync3 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync3, statSync as statSync3 } from "fs";
 import { basename as basename2, dirname as dirname5, resolve as resolve7 } from "path";
 function safeStat(path) {
   try {
@@ -14574,7 +15255,7 @@ function canonicalPath(input) {
 function findUp(start, marker) {
   let current = canonicalPath(start);
   while (true) {
-    if (existsSync6(resolve7(current, marker)))
+    if (existsSync7(resolve7(current, marker)))
       return current;
     const parent = dirname5(current);
     if (parent === current)
@@ -14586,7 +15267,7 @@ function readPackageJson(path) {
   if (!path)
     return null;
   const file = resolve7(path, "package.json");
-  if (!existsSync6(file))
+  if (!existsSync7(file))
     return null;
   try {
     const parsed = JSON.parse(readFileSync3(file, "utf-8"));
@@ -14608,7 +15289,7 @@ function workspaceMarker(root, rootPackage) {
   if (rootPackage?.workspaces)
     markers.push("package.json#workspaces");
   for (const marker of ["pnpm-workspace.yaml", "turbo.json", "nx.json", "lerna.json", "rush.json", "bun.lock", "bun.lockb"]) {
-    if (existsSync6(resolve7(root, marker)))
+    if (existsSync7(resolve7(root, marker)))
       markers.push(marker);
   }
   const kind = markers.find((marker) => marker !== "bun.lock" && marker !== "bun.lockb") ?? null;
@@ -14909,7 +15590,7 @@ var init_tags = __esm(() => {
 });
 
 // src/lib/retention-cleanup.ts
-import { existsSync as existsSync7, unlinkSync } from "fs";
+import { existsSync as existsSync8, unlinkSync } from "fs";
 function normalizeScopes(scopes) {
   if (!scopes || scopes.length === 0)
     return [...ALL_SCOPES];
@@ -15112,7 +15793,7 @@ function applyRetentionCleanup(input, db) {
   for (const artifact of report.candidates.artifact_files) {
     try {
       const path = artifactStorePath(artifact.relative_path);
-      if (!existsSync7(path)) {
+      if (!existsSync8(path)) {
         report.warnings.push(`stored artifact already missing: ${artifact.relative_path}`);
         continue;
       }
@@ -15139,8 +15820,8 @@ var init_retention_cleanup = __esm(() => {
 });
 
 // src/lib/mention-resolver.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
-import { basename as basename3, isAbsolute, join as join5, relative as relative3, resolve as resolve8, sep } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { basename as basename3, isAbsolute, join as join6, relative as relative3, resolve as resolve8, sep } from "path";
 function blankResolution(parsed) {
   return {
     input: parsed.input,
@@ -15238,7 +15919,7 @@ function resolveFile(parsed, workspace) {
     return resolution;
   }
   resolution.path = relPath;
-  if (!existsSync8(absolutePath)) {
+  if (!existsSync9(absolutePath)) {
     resolution.warnings.push("file does not exist in the local workspace");
     return resolution;
   }
@@ -15271,7 +15952,7 @@ function walkSourceFiles(root, current = root, files = []) {
       if (SKIP_DIRS.has(entry.name))
         continue;
     }
-    const absolutePath = join5(current, entry.name);
+    const absolutePath = join6(current, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkSourceFiles(root, absolutePath, files);
@@ -16538,8 +17219,8 @@ var init_local_notifications = __esm(() => {
 });
 
 // src/lib/local-encryption.ts
-import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes, scryptSync, timingSafeEqual } from "crypto";
-function now2() {
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes, scryptSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
+function now3() {
   return new Date().toISOString();
 }
 function sha2562(value) {
@@ -16576,7 +17257,7 @@ function upsertEncryptionProfile(input) {
   const name = normalizeProfileName(input.name);
   const config = loadConfig();
   const existing = config.encryption_profiles?.[name];
-  const timestamp = now2();
+  const timestamp = now3();
   const profile = {
     name,
     algorithm: "aes-256-gcm",
@@ -16633,7 +17314,7 @@ function encryptString(plaintext, options = {}) {
   return {
     schemaVersion: TODOS_ENCRYPTION_SCHEMA_VERSION,
     kind: TODOS_ENCRYPTED_VALUE_KIND,
-    encryptedAt: options.encryptedAt ?? now2(),
+    encryptedAt: options.encryptedAt ?? now3(),
     profile: profile.name,
     key_env: profile.key_env,
     algorithm: "aes-256-gcm",
@@ -16668,7 +17349,7 @@ function decryptString(envelope, env = process.env) {
   ]).toString("utf8");
   const expected = Buffer.from(envelope.plaintext_sha256, "hex");
   const actual = Buffer.from(sha2562(plaintext), "hex");
-  if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+  if (expected.length !== actual.length || !timingSafeEqual2(expected, actual)) {
     throw new EncryptedPayloadError("decrypted payload checksum mismatch");
   }
   return plaintext;
@@ -18191,7 +18872,7 @@ function createRoadmap(input) {
   if (!name)
     throw new Error("Roadmap name is required");
   const store = readStore();
-  const now3 = timestamp();
+  const now4 = timestamp();
   const roadmap = {
     id: newId("roadmap"),
     name,
@@ -18202,8 +18883,8 @@ function createRoadmap(input) {
     agent_id: cleanString(input.agent_id),
     release: cleanString(input.release),
     milestone_ids: [],
-    created_at: now3,
-    updated_at: now3
+    created_at: now4,
+    updated_at: now4
   };
   store.roadmaps[roadmap.id] = roadmap;
   writeStore(store);
@@ -18255,7 +18936,7 @@ function createMilestone(input) {
   const title = input.title.trim();
   if (!title)
     throw new Error("Milestone title is required");
-  const now3 = timestamp();
+  const now4 = timestamp();
   const milestone = {
     id: newId("milestone"),
     roadmap_id: roadmapId,
@@ -18270,11 +18951,11 @@ function createMilestone(input) {
     run_ids: cleanList(input.run_ids),
     release: cleanString(input.release ?? roadmap.release ?? undefined),
     tags: cleanList(input.tags),
-    created_at: now3,
-    updated_at: now3
+    created_at: now4,
+    updated_at: now4
   };
   store.milestones[milestone.id] = milestone;
-  store.roadmaps[roadmapId] = { ...roadmap, milestone_ids: cleanList([...roadmap.milestone_ids, milestone.id]), updated_at: now3 };
+  store.roadmaps[roadmapId] = { ...roadmap, milestone_ids: cleanList([...roadmap.milestone_ids, milestone.id]), updated_at: now4 };
   writeStore(store);
   return milestone;
 }
@@ -18329,7 +19010,7 @@ function upsertReleaseGroup(input) {
     throw new Error("Release group name is required");
   const key = releaseKey(roadmapId, name);
   const existing = store.releases[key];
-  const now3 = timestamp();
+  const now4 = timestamp();
   const release = {
     name,
     version: input.version === undefined ? existing?.version ?? null : cleanString(input.version),
@@ -18340,8 +19021,8 @@ function upsertReleaseGroup(input) {
     plan_ids: input.plan_ids === undefined ? existing?.plan_ids ?? [] : cleanList(input.plan_ids),
     run_ids: input.run_ids === undefined ? existing?.run_ids ?? [] : cleanList(input.run_ids),
     notes: input.notes === undefined ? existing?.notes ?? null : cleanString(input.notes),
-    created_at: existing?.created_at ?? now3,
-    updated_at: now3
+    created_at: existing?.created_at ?? now4,
+    updated_at: now4
   };
   store.releases[key] = release;
   writeStore(store);
@@ -18540,7 +19221,7 @@ function upsertCapacityProfile(input) {
   const store = readStore2();
   const key = profileKey(agentId, projectId);
   const existing = store.profiles[key];
-  const now3 = timestamp2();
+  const now4 = timestamp2();
   const profile = {
     id: existing?.id ?? key,
     agent_id: agentId,
@@ -18548,8 +19229,8 @@ function upsertCapacityProfile(input) {
     minutes_per_day: assertMinutes(input.minutes_per_day),
     working_days: normalizeWorkingDays(input.working_days),
     effective_from: cleanString2(input.effective_from),
-    created_at: existing?.created_at ?? now3,
-    updated_at: now3
+    created_at: existing?.created_at ?? now4,
+    updated_at: now4
   };
   store.profiles[key] = profile;
   writeStore2(store);
@@ -18958,7 +19639,7 @@ var init_audit_ledger = __esm(() => {
 
 // src/lib/release-compatibility.ts
 import { readFileSync as readFileSync5 } from "fs";
-import { join as join6, resolve as resolve10 } from "path";
+import { join as join7, resolve as resolve10 } from "path";
 import { Database as Database2 } from "bun:sqlite";
 function pass(id, message, details) {
   return { id, status: "passed", message, details };
@@ -18970,7 +19651,7 @@ function warn(id, message, details) {
   return { id, status: "warning", message, details };
 }
 function readPackageJson2(root) {
-  return JSON.parse(readFileSync5(join6(root, "package.json"), "utf8"));
+  return JSON.parse(readFileSync5(join7(root, "package.json"), "utf8"));
 }
 function sortedKeys(value) {
   return Object.keys(value ?? {}).sort((left, right) => left.localeCompare(right));
@@ -19239,6 +19920,9 @@ function hasFts(db) {
 function escapeFtsQuery(q) {
   return q.replace(/["*^()]/g, " ").trim().split(/\s+/).filter(Boolean).map((token) => `"${token}"*`).join(" ");
 }
+function shouldUseFts(q) {
+  return /^[\p{L}\p{N}_\-\s]+$/u.test(q);
+}
 function searchTasks(options, projectId, taskListId, db) {
   const opts = typeof options === "string" ? { query: options || undefined, project_id: projectId, task_list_id: taskListId } : options;
   const d = db || getDatabase();
@@ -19247,7 +19931,8 @@ function searchTasks(options, projectId, taskListId, db) {
   let sql;
   const raw = opts.query?.trim() ?? "";
   const q = raw === "*" ? "" : raw;
-  if (hasFts(d) && q) {
+  const useFts = hasFts(d) && q && shouldUseFts(q);
+  if (useFts) {
     const ftsQuery = escapeFtsQuery(q);
     sql = `SELECT t.* FROM tasks t
       INNER JOIN tasks_fts fts ON fts.rowid = t.rowid
@@ -19255,8 +19940,16 @@ function searchTasks(options, projectId, taskListId, db) {
     params.push(ftsQuery);
   } else if (q) {
     const pattern = `%${q}%`;
-    sql = `SELECT * FROM tasks t WHERE (t.title LIKE ? OR t.description LIKE ? OR EXISTS (SELECT 1 FROM task_tags WHERE task_tags.task_id = t.id AND tag LIKE ?))`;
-    params.push(pattern, pattern, pattern);
+    sql = `SELECT * FROM tasks t WHERE (
+      t.id LIKE ?
+      OR t.short_id LIKE ?
+      OR t.title LIKE ?
+      OR t.description LIKE ?
+      OR t.working_dir LIKE ?
+      OR t.metadata LIKE ?
+      OR EXISTS (SELECT 1 FROM task_tags WHERE task_tags.task_id = t.id AND tag LIKE ?)
+    )`;
+    params.push(pattern, pattern, pattern, pattern, pattern, pattern, pattern);
   } else {
     sql = `SELECT * FROM tasks t WHERE 1=1`;
   }
@@ -19312,7 +20005,7 @@ function searchTasks(options, projectId, taskListId, db) {
   } else if (opts.is_blocked === false) {
     sql += " AND t.id NOT IN (SELECT td.task_id FROM task_dependencies td JOIN tasks dep ON dep.id = td.depends_on WHERE dep.status != 'completed')";
   }
-  if (hasFts(d) && q) {
+  if (useFts) {
     sql += ` ORDER BY bm25(tasks_fts),
       CASE t.priority WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 END,
       t.created_at DESC`;
@@ -22407,7 +23100,7 @@ function registerTaskWorkflowTools(server, ctx) {
             const globalRole = n.agent.role ? ` [${n.agent.role}]` : "";
             const lead = n.is_lead ? " \u2605" : "";
             const lastSeen = new Date(n.agent.last_seen_at).getTime();
-            const active = now3 - lastSeen < ACTIVE_MS ? " \u25CF" : " \u25CB";
+            const active = now4 - lastSeen < ACTIVE_MS ? " \u25CF" : " \u25CB";
             const line = `${prefix}${active} ${n.agent.name}${title}${globalRole}${lead}`;
             const children = n.reports.length > 0 ? `
 ` + render(n.reports, indent + 1) : "";
@@ -22420,7 +23113,7 @@ function registerTaskWorkflowTools(server, ctx) {
         if (format === "json") {
           return { content: [{ type: "text", text: JSON.stringify(tree, null, 2) }] };
         }
-        const now3 = Date.now();
+        const now4 = Date.now();
         const ACTIVE_MS = 30 * 60 * 1000;
         const text = tree.length > 0 ? render(tree) : "No agents in org chart.";
         return { content: [{ type: "text", text }] };
@@ -22542,8 +23235,8 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runTodosDoctor: () => runTodosDoctor
 });
-import { chmodSync, copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync5, statSync as statSync5 } from "fs";
-import { basename as basename4, dirname as dirname6, join as join7 } from "path";
+import { chmodSync, copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync5, statSync as statSync5 } from "fs";
+import { basename as basename4, dirname as dirname6, join as join8 } from "path";
 function tableExists(db, table) {
   return Boolean(db.query("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(table));
 }
@@ -22637,7 +23330,7 @@ function findMissingProjectRoots(db) {
       continue;
     if (!row.path.startsWith("/"))
       continue;
-    if (!existsSync9(row.path))
+    if (!existsSync10(row.path))
       missing++;
   }
   return missing;
@@ -22697,16 +23390,16 @@ function databasePermissionsAreUnsafe(dbPath) {
 function createBackup(dbPath) {
   if (dbPath === ":memory:" || dbPath.startsWith("file::memory:"))
     return;
-  if (!existsSync9(dbPath))
+  if (!existsSync10(dbPath))
     return;
   const stamp = now().replace(/[:.]/g, "-");
-  const backupDir = join7(dirname6(dbPath), `${basename4(dbPath)}.backup-${stamp}`);
+  const backupDir = join8(dirname6(dbPath), `${basename4(dbPath)}.backup-${stamp}`);
   const files = [];
   mkdirSync5(backupDir, { recursive: true });
   for (const source of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
-    if (!existsSync9(source))
+    if (!existsSync10(source))
       continue;
-    const target = join7(backupDir, basename4(source));
+    const target = join8(backupDir, basename4(source));
     copyFileSync(source, target);
     files.push(target);
   }
@@ -23010,14 +23703,14 @@ function registerTaskAutoTools(server, ctx) {
           return { content: [{ type: "text", text: "No agent_id provided and no agent focus is active." }], isError: true };
         }
         const assigned = listTasks3({ assigned_to: effectiveAgentId, limit: 500 }, undefined);
-        const now3 = Date.now();
-        const dueSoonCutoff = now3 + 24 * 60 * 60 * 1000;
+        const now4 = Date.now();
+        const dueSoonCutoff = now4 + 24 * 60 * 60 * 1000;
         const blocked = getBlockedTasks2().filter((t) => t.assigned_to === effectiveAgentId);
         const workload = {
           in_progress: assigned.filter((t) => t.status === "in_progress").length,
           pending: assigned.filter((t) => t.status === "pending").length,
-          completed_recent: assigned.filter((t) => t.status === "completed" && t.completed_at && now3 - new Date(t.completed_at).getTime() <= 7 * 24 * 60 * 60 * 1000).length,
-          due_soon: assigned.filter((t) => t.due_at && new Date(t.due_at).getTime() <= dueSoonCutoff && new Date(t.due_at).getTime() >= now3 && !["completed", "cancelled", "failed"].includes(t.status)).length,
+          completed_recent: assigned.filter((t) => t.status === "completed" && t.completed_at && now4 - new Date(t.completed_at).getTime() <= 7 * 24 * 60 * 60 * 1000).length,
+          due_soon: assigned.filter((t) => t.due_at && new Date(t.due_at).getTime() <= dueSoonCutoff && new Date(t.due_at).getTime() >= now4 && !["completed", "cancelled", "failed"].includes(t.status)).length,
           blocked: blocked.length
         };
         const lines = [
@@ -23244,7 +23937,7 @@ function limits(input) {
     stale_after_hours: clamp(input.stale_after_hours, DEFAULT_LIMITS.stale_after_hours, 24 * 365)
   };
 }
-function truncate(value, max) {
+function truncate2(value, max) {
   if (!value)
     return value ?? null;
   const redacted = redactEvidenceText(value);
@@ -23265,9 +23958,9 @@ function acceptanceCriteria(task, maxText) {
   const metadata = task.metadata || {};
   const raw = metadata["acceptance_criteria"] ?? metadata["acceptanceCriteria"] ?? metadata["criteria"];
   if (Array.isArray(raw))
-    return raw.map((item) => truncate(String(item), maxText)).filter((item) => Boolean(item));
+    return raw.map((item) => truncate2(String(item), maxText)).filter((item) => Boolean(item));
   if (typeof raw === "string") {
-    return raw.split(/\r?\n/).map((line) => line.replace(/^[-*]\s*/, "").trim()).filter(Boolean).map((line) => truncate(line, maxText)).filter((item) => Boolean(item));
+    return raw.split(/\r?\n/).map((line) => line.replace(/^[-*]\s*/, "").trim()).filter(Boolean).map((line) => truncate2(line, maxText)).filter((item) => Boolean(item));
   }
   return [];
 }
@@ -23290,7 +23983,7 @@ function addFile(files, path, source, base) {
     path,
     status: base?.status || "active",
     agent_id: base?.agent_id ?? null,
-    note: truncate(base?.note, 240),
+    note: truncate2(base?.note, 240),
     updated_at: base?.updated_at || "",
     sources: [source]
   });
@@ -23348,7 +24041,7 @@ function estimateTokens(value) {
   return Math.max(1, Math.ceil((text || "").length / 4));
 }
 function summarizeStrings(values, maxChars) {
-  return truncate(values.filter(Boolean).join("; "), maxChars) || "No local details were available before this section was omitted.";
+  return truncate2(values.filter(Boolean).join("; "), maxChars) || "No local details were available before this section was omitted.";
 }
 function summarizeSection(pack, section, maxChars) {
   if (section === "project")
@@ -23539,8 +24232,8 @@ function createAgentContextPack(input, db) {
     ...taskFiles.map((file) => file.updated_at)
   ], task.updated_at);
   const warnings = [];
-  const now3 = input.now ? new Date(input.now) : new Date;
-  if (Date.parse(task.updated_at) < now3.getTime() - limit.stale_after_hours * 60 * 60 * 1000) {
+  const now4 = input.now ? new Date(input.now) : new Date;
+  if (Date.parse(task.updated_at) < now4.getTime() - limit.stale_after_hours * 60 * 60 * 1000) {
     warnings.push(`task state is older than ${limit.stale_after_hours} hours`);
   }
   if (comments.length > recentComments.length)
@@ -23555,7 +24248,7 @@ function createAgentContextPack(input, db) {
     id: task.id,
     short_id: task.short_id,
     title: redactEvidenceText(task.title),
-    description: truncate(task.description, limit.max_text_chars),
+    description: truncate2(task.description, limit.max_text_chars),
     status: task.status,
     priority: task.priority,
     assigned_to: task.assigned_to,
@@ -23579,7 +24272,7 @@ function createAgentContextPack(input, db) {
     plan: plan ? {
       id: plan.id,
       name: plan.name,
-      description: truncate(plan.description, limit.max_text_chars),
+      description: truncate2(plan.description, limit.max_text_chars),
       status: plan.status,
       agent_id: plan.agent_id,
       tasks: planTasks.slice(0, limit.plan_task_limit).map(taskSummary).filter((item) => Boolean(item)),
@@ -23598,7 +24291,7 @@ function createAgentContextPack(input, db) {
         type: comment.type,
         progress_pct: comment.progress_pct,
         created_at: comment.created_at,
-        content: truncate(comment.content, limit.max_text_chars) || ""
+        content: truncate2(comment.content, limit.max_text_chars) || ""
       })),
       omitted: Math.max(0, comments.length - recentComments.length)
     },
@@ -23606,7 +24299,7 @@ function createAgentContextPack(input, db) {
     traceability: {
       commits: traceability.commits.map((commit) => ({
         sha: commit.sha,
-        message: truncate(commit.message, 240),
+        message: truncate2(commit.message, 240),
         files_changed: commit.files_changed,
         committed_at: commit.committed_at
       })),
@@ -23614,7 +24307,7 @@ function createAgentContextPack(input, db) {
       verifications: verifications.map((verification) => ({
         command: verification.command,
         status: verification.status,
-        output_summary: truncate(verification.output_summary, limit.max_text_chars),
+        output_summary: truncate2(verification.output_summary, limit.max_text_chars),
         artifact_path: verification.artifact_path,
         run_at: verification.run_at
       })),
@@ -23625,14 +24318,14 @@ function createAgentContextPack(input, db) {
         id: ledger.run.id,
         title: ledger.run.title,
         status: ledger.run.status,
-        summary: truncate(ledger.run.summary, limit.max_text_chars),
+        summary: truncate2(ledger.run.summary, limit.max_text_chars),
         agent_id: ledger.run.agent_id,
         started_at: ledger.run.started_at,
         completed_at: ledger.run.completed_at,
-        events: ledger.events.map((event) => ({ event_type: event.event_type, message: truncate(event.message, 500), created_at: event.created_at })),
-        commands: ledger.commands.map((command) => ({ command: command.command, status: command.status, output_summary: truncate(command.output_summary, limit.max_text_chars), artifact_path: command.artifact_path })),
-        files: ledger.files.map((file) => ({ path: file.path, status: file.status, note: truncate(file.note, 240) })),
-        artifacts: ledger.artifacts.map((artifact) => ({ path: artifact.path, artifact_type: artifact.artifact_type, description: truncate(artifact.description, 240), sha256: artifact.sha256 }))
+        events: ledger.events.map((event) => ({ event_type: event.event_type, message: truncate2(event.message, 500), created_at: event.created_at })),
+        commands: ledger.commands.map((command) => ({ command: command.command, status: command.status, output_summary: truncate2(command.output_summary, limit.max_text_chars), artifact_path: command.artifact_path })),
+        files: ledger.files.map((file) => ({ path: file.path, status: file.status, note: truncate2(file.note, 240) })),
+        artifacts: ledger.artifacts.map((artifact) => ({ path: artifact.path, artifact_type: artifact.artifact_type, description: truncate2(artifact.description, 240), sha256: artifact.sha256 }))
       })),
       omitted: Math.max(0, runs.length - selectedRuns.length)
     },
@@ -23737,7 +24430,7 @@ function renderAgentContextPackCompactMarkdown(pack) {
   const lines = [
     `# Context: ${pack.task.title}`,
     `${pack.task.status} | ${pack.task.priority} | ${pack.task.short_id || pack.task.id.slice(0, 8)}`,
-    pack.task.description ? truncate(pack.task.description, Math.min(pack.limits.summary_char_limit, 700)) : null,
+    pack.task.description ? truncate2(pack.task.description, Math.min(pack.limits.summary_char_limit, 700)) : null,
     "",
     "## Must Know",
     bullet([
@@ -24987,7 +25680,7 @@ var init_agent_run_dispatcher = __esm(() => {
 });
 
 // src/lib/verification-providers.ts
-import { existsSync as existsSync10, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync6 } from "fs";
 function normalizeName5(name) {
   const normalized = name.trim().toLowerCase();
   if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(normalized)) {
@@ -25139,7 +25832,7 @@ Timed out after ${provider.timeout_ms}ms`);
   };
 }
 function runCiLogProvider(input) {
-  const text = input.log_text ?? (input.log_path && existsSync10(input.log_path) ? readFileSync6(input.log_path, "utf-8") : "");
+  const text = input.log_text ?? (input.log_path && existsSync11(input.log_path) ? readFileSync6(input.log_path, "utf-8") : "");
   return {
     status: classifyLog(text),
     attempts: 1,
@@ -25151,7 +25844,7 @@ function runBrowserProvider(input) {
   if (!input.artifact_path) {
     return { status: "unknown", attempts: 1, exit_code: null, output_summary: "browser provider needs a screenshot or artifact path" };
   }
-  if (!existsSync10(input.artifact_path)) {
+  if (!existsSync11(input.artifact_path)) {
     return { status: "failed", attempts: 1, exit_code: null, output_summary: `artifact not found: ${input.artifact_path}` };
   }
   return {
@@ -26941,12 +27634,12 @@ function summarizeTask(task) {
   };
 }
 function overdueTasks(tasks, nowIso) {
-  const now3 = Date.parse(nowIso);
+  const now4 = Date.parse(nowIso);
   return tasks.filter((task) => {
     if (isTerminal(task) || !task.due_at)
       return false;
     const due = Date.parse(task.due_at);
-    return Number.isFinite(due) && due < now3;
+    return Number.isFinite(due) && due < now4;
   });
 }
 function isReady(task, db) {
@@ -27296,15 +27989,15 @@ var init_local_reports = __esm(() => {
 });
 
 // src/lib/package-version.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname7, join as join8 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname7, join as join9 } from "path";
 import { fileURLToPath } from "url";
 function getPackageVersion(fromUrl = import.meta.url) {
   try {
     let dir = dirname7(fileURLToPath(fromUrl));
     for (let i = 0;i < 5; i++) {
-      const pkgPath = join8(dir, "package.json");
-      if (existsSync11(pkgPath)) {
+      const pkgPath = join9(dir, "package.json");
+      if (existsSync12(pkgPath)) {
         return JSON.parse(readFileSync7(pkgPath, "utf-8")).version || "0.0.0";
       }
       const parent = dirname7(dir);
@@ -29395,8 +30088,8 @@ __export(exports_local_extensions, {
   discoverLocalExtensions: () => discoverLocalExtensions
 });
 import { createHash as createHash8, createVerify } from "crypto";
-import { existsSync as existsSync12, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
-import { basename as basename5, join as join9, resolve as resolve12 } from "path";
+import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
+import { basename as basename5, join as join10, resolve as resolve12 } from "path";
 function isObject2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -29655,10 +30348,10 @@ function verifyExtensionSignature(input) {
 }
 function inspectExtensionSource(source3) {
   const resolved = resolve12(source3);
-  if (!existsSync12(resolved))
+  if (!existsSync13(resolved))
     throw new Error(`extension source not found: ${source3}`);
   const stat = statSync6(resolved);
-  const manifestPath = stat.isDirectory() ? [join9(resolved, "todos.extension.json"), join9(resolved, "extension.json")].find(existsSync12) : resolved;
+  const manifestPath = stat.isDirectory() ? [join10(resolved, "todos.extension.json"), join10(resolved, "extension.json")].find(existsSync13) : resolved;
   if (!manifestPath)
     throw new Error(`extension directory ${source3} is missing todos.extension.json`);
   const raw = readFileSync9(manifestPath);
@@ -29754,20 +30447,20 @@ function projectExtensionSources(projectPath) {
     return [];
   const root = resolve12(projectPath);
   const candidates = [
-    join9(root, "todos.extension.json"),
-    join9(root, ".todos", "todos.extension.json")
+    join10(root, "todos.extension.json"),
+    join10(root, ".todos", "todos.extension.json")
   ];
-  const extensionDir = join9(root, ".todos", "extensions");
-  if (existsSync12(extensionDir)) {
+  const extensionDir = join10(root, ".todos", "extensions");
+  if (existsSync13(extensionDir)) {
     for (const entry of readdirSync3(extensionDir)) {
       if (entry.startsWith("."))
         continue;
-      const full = join9(extensionDir, entry);
+      const full = join10(extensionDir, entry);
       if (statSync6(full).isDirectory() || entry.endsWith(".json"))
         candidates.push(full);
     }
   }
-  return candidates.filter(existsSync12);
+  return candidates.filter(existsSync13);
 }
 function discoverLocalExtensions(options = {}) {
   const config = loadConfig();
@@ -33289,7 +33982,7 @@ ${lines.join(`
             const projectRoles = n.project_roles.length > 0 ? ` <${n.project_roles.join(", ")}>` : "";
             const lead = n.is_project_lead ? " \u2605" : "";
             const lastSeen = new Date(n.agent.last_seen_at).getTime();
-            const active = now3 - lastSeen < ACTIVE_MS ? " \u25CF" : " \u25CB";
+            const active = now4 - lastSeen < ACTIVE_MS ? " \u25CF" : " \u25CB";
             const line = `${prefix}${active} ${n.agent.name}${title}${globalRole}${projectRoles}${lead}`;
             const children = n.reports.length > 0 ? `
 ` + render(n.reports, indent + 1) : "";
@@ -33303,7 +33996,7 @@ ${lines.join(`
         if (format === "json") {
           return { content: [{ type: "text", text: JSON.stringify(tree, null, 2) }] };
         }
-        const now3 = Date.now();
+        const now4 = Date.now();
         const ACTIVE_MS = 30 * 60 * 1000;
         const text2 = tree.length > 0 ? render(tree) : "No agents in this project's org chart.";
         return { content: [{ type: "text", text: text2 }] };
@@ -33853,10 +34546,10 @@ ${lines.join(`
     });
   }
   if (shouldRegisterTool("get_idle_focus_prompts")) {
-    server.tool("get_idle_focus_prompts", "Return local idle prompts for active focus sessions.", { agent_id: exports_external.string().optional(), now: exports_external.string().optional() }, async ({ agent_id, now: now3 }) => {
+    server.tool("get_idle_focus_prompts", "Return local idle prompts for active focus sessions.", { agent_id: exports_external.string().optional(), now: exports_external.string().optional() }, async ({ agent_id, now: now4 }) => {
       try {
         const { getIdleFocusSessionPrompts: getIdleFocusSessionPrompts2 } = (init_tasks(), __toCommonJS(exports_tasks));
-        return { content: [{ type: "text", text: JSON.stringify(getIdleFocusSessionPrompts2({ agent_id, now: now3 }), null, 2) }] };
+        return { content: [{ type: "text", text: JSON.stringify(getIdleFocusSessionPrompts2({ agent_id, now: now4 }), null, 2) }] };
       } catch (e) {
         return { content: [{ type: "text", text: formatError(e) }], isError: true };
       }
@@ -34051,9 +34744,9 @@ __export(exports_extract, {
   buildCodebaseIndex: () => buildCodebaseIndex,
   EXTRACT_TAGS: () => EXTRACT_TAGS
 });
-import { existsSync as existsSync13, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
 import { createHash as createHash10 } from "crypto";
-import { relative as relative5, resolve as resolve13, join as join10 } from "path";
+import { relative as relative5, resolve as resolve13, join as join11 } from "path";
 function stableHash(value) {
   return createHash10("sha256").update(value).digest("hex");
 }
@@ -34062,8 +34755,8 @@ function normalizePathForMatch(value) {
 }
 function readGitignorePatterns(basePath) {
   const root = statSync7(basePath).isFile() ? resolve13(basePath, "..") : basePath;
-  const gitignorePath = join10(root, ".gitignore");
-  if (!existsSync13(gitignorePath))
+  const gitignorePath = join11(root, ".gitignore");
+  if (!existsSync14(gitignorePath))
     return [];
   try {
     return readFileSync10(gitignorePath, "utf-8").split(`
@@ -34205,7 +34898,7 @@ function buildCodebaseIndex(options) {
   const files = collectFiles(basePath, extensions, excludes, respectGitignore);
   const indexed = [];
   for (const file of files) {
-    const fullPath = statSync7(basePath).isFile() ? basePath : join10(basePath, file);
+    const fullPath = statSync7(basePath).isFile() ? basePath : join11(basePath, file);
     try {
       const source3 = readFileSync10(fullPath, "utf-8");
       const relPath = statSync7(basePath).isFile() ? relative5(resolve13(basePath, ".."), fullPath) : file;
@@ -34236,7 +34929,7 @@ function extractTodos(options, db) {
   const files = collectFiles(basePath, extensions, excludes, respectGitignore);
   const allComments = [];
   for (const file of files) {
-    const fullPath = statSync7(basePath).isFile() ? basePath : join10(basePath, file);
+    const fullPath = statSync7(basePath).isFile() ? basePath : join11(basePath, file);
     try {
       const source3 = readFileSync10(fullPath, "utf-8");
       const relPath = statSync7(basePath).isFile() ? relative5(resolve13(basePath, ".."), fullPath) : file;
@@ -35129,7 +35822,7 @@ __export(exports_builtin_templates, {
   BUILTIN_TEMPLATES: () => BUILTIN_TEMPLATES
 });
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function templateMetadata(template) {
   return {
     source: BUILTIN_TEMPLATE_LIBRARY_SOURCE,
@@ -35188,7 +35881,7 @@ function writeBuiltinTemplateFiles(directory) {
   mkdirSync7(directory, { recursive: true });
   const files = [];
   for (const entry of exportBuiltinTemplateFiles()) {
-    const path = join11(directory, entry.filename);
+    const path = join12(directory, entry.filename);
     writeFileSync4(path, `${JSON.stringify(entry.template, null, 2)}
 `, "utf-8");
     files.push(path);
@@ -35714,16 +36407,16 @@ __export(exports_environment_snapshots, {
   captureEnvironmentSnapshot: () => captureEnvironmentSnapshot
 });
 import { createHash as createHash11 } from "crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
 import { hostname as hostname2, platform, arch } from "os";
-import { dirname as dirname9, join as join12, resolve as resolve14 } from "path";
+import { dirname as dirname9, join as join13, resolve as resolve14 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function sha2566(value) {
   return createHash11("sha256").update(value).digest("hex");
 }
 function fileRecord(root, relativePath) {
-  const path = join12(root, relativePath);
-  if (!existsSync14(path))
+  const path = join13(root, relativePath);
+  if (!existsSync15(path))
     return null;
   const stat = statSync8(path);
   if (!stat.isFile())
@@ -35735,7 +36428,7 @@ function manifestRecord(root, relativePath) {
   const base = fileRecord(root, relativePath);
   if (!base)
     return null;
-  const parsed = readJsonFile(join12(root, relativePath));
+  const parsed = readJsonFile(join13(root, relativePath));
   if (!parsed)
     return { ...base, redacted: {} };
   const redacted = redactValue({
@@ -35830,8 +36523,8 @@ function commandEnv(env, includeValues) {
 function defaultSnapshotDir() {
   const dbPath = getDatabasePath();
   if (dbPath === ":memory:" || dbPath.startsWith("file::memory:"))
-    return join12(tmpdir2(), "hasna-todos", "environment-snapshots");
-  return join12(dirname9(resolve14(dbPath)), "environment-snapshots");
+    return join13(tmpdir2(), "hasna-todos", "environment-snapshots");
+  return join13(dirname9(resolve14(dbPath)), "environment-snapshots");
 }
 function snapshotWithId(snapshot) {
   const digest = sha2566(JSON.stringify(snapshot)).slice(0, 24);
@@ -35878,7 +36571,7 @@ function captureEnvironmentSnapshot(input = {}) {
   });
 }
 function writeEnvironmentSnapshot(snapshot, outputPath) {
-  const path = outputPath ? resolve14(outputPath) : join12(defaultSnapshotDir(), `${snapshot.id}.json`);
+  const path = outputPath ? resolve14(outputPath) : join13(defaultSnapshotDir(), `${snapshot.id}.json`);
   ensureDir2(dirname9(path));
   writeJsonFile(path, snapshot);
   return path;
@@ -36250,7 +36943,7 @@ var init_http = __esm(() => {
 });
 
 // src/db/api-keys.ts
-import { createHash as createHash12, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
 function rowToRecord(row) {
   return {
     id: row.id,
@@ -36269,7 +36962,7 @@ function hashApiKey(key) {
 function safeEqualHex(a, b) {
   if (a.length !== b.length)
     return false;
-  return timingSafeEqual2(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  return timingSafeEqual3(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
 }
 function hasActiveApiKeys(db) {
   const d = db || getDatabase();
@@ -36430,7 +37123,7 @@ var init_headless_boundaries = __esm(() => {
 });
 
 // src/server/routes.ts
-import { join as join13, resolve as resolve15, sep as sep2 } from "path";
+import { join as join14, resolve as resolve15, sep as sep2 } from "path";
 function parseFieldsParam(url) {
   const fieldsParam = url.searchParams.get("fields");
   return fieldsParam ? fieldsParam.split(",").map((f) => f.trim()).filter(Boolean) : undefined;
@@ -37134,7 +37827,7 @@ function handleStaticFiles(path, method, ctx, json2, serveStaticFile2) {
   if (!ctx.dashboardExists || method !== "GET" && method !== "HEAD")
     return null;
   if (path !== "/") {
-    const filePath = join13(ctx.dashboardDir, path);
+    const filePath = join14(ctx.dashboardDir, path);
     const resolvedFile = resolve15(filePath);
     const resolvedBase = resolve15(ctx.dashboardDir);
     if (!resolvedFile.startsWith(resolvedBase + sep2) && resolvedFile !== resolvedBase) {
@@ -37144,7 +37837,7 @@ function handleStaticFiles(path, method, ctx, json2, serveStaticFile2) {
     if (res2)
       return res2;
   }
-  const indexPath = join13(ctx.dashboardDir, "index.html");
+  const indexPath = join14(ctx.dashboardDir, "index.html");
   const res = serveStaticFile2(indexPath);
   if (res)
     return res;
@@ -37173,27 +37866,27 @@ __export(exports_serve, {
   SECURITY_HEADERS: () => SECURITY_HEADERS,
   MIME_TYPES: () => MIME_TYPES
 });
-import { existsSync as existsSync15 } from "fs";
-import { join as join14, dirname as dirname10, extname } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join15, dirname as dirname10, extname } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolveDashboardDir() {
   const candidates = [];
   try {
     const scriptDir = dirname10(fileURLToPath2(import.meta.url));
-    candidates.push(join14(scriptDir, "..", "dashboard", "dist"));
-    candidates.push(join14(scriptDir, "..", "..", "dashboard", "dist"));
+    candidates.push(join15(scriptDir, "..", "dashboard", "dist"));
+    candidates.push(join15(scriptDir, "..", "..", "dashboard", "dist"));
   } catch {}
   if (process.argv[1]) {
     const mainDir = dirname10(process.argv[1]);
-    candidates.push(join14(mainDir, "..", "dashboard", "dist"));
-    candidates.push(join14(mainDir, "..", "..", "dashboard", "dist"));
+    candidates.push(join15(mainDir, "..", "dashboard", "dist"));
+    candidates.push(join15(mainDir, "..", "..", "dashboard", "dist"));
   }
-  candidates.push(join14(process.cwd(), "dashboard", "dist"));
+  candidates.push(join15(process.cwd(), "dashboard", "dist"));
   for (const candidate of candidates) {
-    if (existsSync15(candidate))
+    if (existsSync16(candidate))
       return candidate;
   }
-  return join14(process.cwd(), "dashboard", "dist");
+  return join15(process.cwd(), "dashboard", "dist");
 }
 function getProvidedApiKey(req) {
   const headerKey = req.headers.get("x-api-key");
@@ -37220,15 +37913,15 @@ function checkAuth(req, apiKey) {
   return null;
 }
 function checkRateLimit(ip) {
-  const now3 = Date.now();
+  const now4 = Date.now();
   const entry = rateLimitMap.get(ip);
-  if (!entry || now3 > entry.resetAt) {
-    rateLimitMap.set(ip, { count: 1, resetAt: now3 + RATE_LIMIT_WINDOW_MS });
+  if (!entry || now4 > entry.resetAt) {
+    rateLimitMap.set(ip, { count: 1, resetAt: now4 + RATE_LIMIT_WINDOW_MS });
     return { allowed: true };
   }
   entry.count++;
   if (entry.count > RATE_LIMIT_MAX) {
-    return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now3) / 1000) };
+    return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now4) / 1000) };
   }
   return { allowed: true };
 }
@@ -37243,7 +37936,7 @@ function json(data, status = 200, headers) {
   });
 }
 function serveStaticFile(filePath) {
-  if (!existsSync15(filePath))
+  if (!existsSync16(filePath))
     return null;
   const ext = extname(filePath);
   const contentType = MIME_TYPES[ext] || "application/octet-stream";
@@ -37322,7 +38015,7 @@ data: ${data}
       filteredSseClients.delete(client);
   }
   const dashboardDir = resolveDashboardDir();
-  const dashboardExists = existsSync15(dashboardDir);
+  const dashboardExists = existsSync16(dashboardDir);
   if (!dashboardExists) {
     console.error(`
 Dashboard not found at: ${dashboardDir}`);