@hasna/todos 0.11.66 → 0.11.67

package/dist/index.js

@@ -1182,6 +1182,22 @@ var init_migrations = __esm(() => {
   CREATE INDEX IF NOT EXISTS idx_task_findings_source ON task_findings(source);
   CREATE INDEX IF NOT EXISTS idx_task_findings_fingerprint ON task_findings(fingerprint);
   INSERT OR IGNORE INTO _migrations (id) VALUES (62);
+  `,
+    `
+  CREATE TABLE IF NOT EXISTS storage_tombstones (
+    id TEXT PRIMARY KEY,
+    object_type TEXT NOT NULL,
+    object_id TEXT NOT NULL,
+    deleted_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    source_machine_id TEXT,
+    payload TEXT,
+    version INTEGER,
+    UNIQUE(object_type, object_id)
+  );
+  CREATE INDEX IF NOT EXISTS idx_storage_tombstones_object ON storage_tombstones(object_type, object_id);
+  CREATE INDEX IF NOT EXISTS idx_storage_tombstones_updated ON storage_tombstones(updated_at);
+  INSERT OR IGNORE INTO _migrations (id) VALUES (63);
   `
   ];
 });
@@ -1703,6 +1719,20 @@ function ensureSchema(db) {
     )`);
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_project_machine_paths_project ON project_machine_paths(project_id)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_project_machine_paths_machine ON project_machine_paths(machine_id)");
+  ensureTable("storage_tombstones", `
+    CREATE TABLE storage_tombstones (
+      id TEXT PRIMARY KEY,
+      object_type TEXT NOT NULL,
+      object_id TEXT NOT NULL,
+      deleted_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      source_machine_id TEXT,
+      payload TEXT,
+      version INTEGER,
+      UNIQUE(object_type, object_id)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_storage_tombstones_object ON storage_tombstones(object_type, object_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_storage_tombstones_updated ON storage_tombstones(updated_at)");
   ensureTable("machines", `
     CREATE TABLE machines (
       id TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE, hostname TEXT, platform TEXT,
@@ -6173,6 +6203,80 @@ init_config();
 init_types();
 init_database();
 init_machines();
+
+// src/db/storage-tombstones.ts
+init_database();
+init_machines();
+function recordStorageTombstone(input, db) {
+  const d = db ?? getDatabase();
+  const deletedAt = input.deleted_at ?? now();
+  const machineId = input.source_machine_id ?? currentStorageMachineId(d);
+  d.run(`INSERT INTO storage_tombstones (
+       id, object_type, object_id, deleted_at, updated_at, source_machine_id, payload, version
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(object_type, object_id) DO UPDATE SET
+       deleted_at = excluded.deleted_at,
+       updated_at = excluded.updated_at,
+       source_machine_id = excluded.source_machine_id,
+       payload = excluded.payload,
+       version = excluded.version
+     WHERE storage_tombstones.updated_at IS NULL OR storage_tombstones.updated_at <= excluded.updated_at`, [
+    uuid(),
+    input.object_type,
+    input.object_id,
+    deletedAt,
+    deletedAt,
+    machineId,
+    input.payload ? JSON.stringify(input.payload) : null,
+    input.version ?? null
+  ]);
+  return getStorageTombstone(input.object_type, input.object_id, d);
+}
+function getStorageTombstone(objectType, objectId, db) {
+  const d = db ?? getDatabase();
+  const row = d.query("SELECT * FROM storage_tombstones WHERE object_type = ? AND object_id = ?").get(objectType, objectId);
+  return row ? rowToStorageTombstone(row) : null;
+}
+function listStorageTombstones(db) {
+  const d = db ?? getDatabase();
+  return d.query("SELECT * FROM storage_tombstones ORDER BY updated_at ASC, object_type ASC, object_id ASC").all().map(rowToStorageTombstone);
+}
+function shouldApplyStorageTombstone(tombstone, existingUpdatedAt) {
+  const tombstoneClock = Date.parse(tombstone.updated_at || tombstone.deleted_at);
+  if (!existingUpdatedAt)
+    return true;
+  const existingClock = Date.parse(existingUpdatedAt);
+  if (Number.isNaN(tombstoneClock))
+    return true;
+  if (Number.isNaN(existingClock))
+    return true;
+  return tombstoneClock >= existingClock;
+}
+function rowToStorageTombstone(row) {
+  return {
+    ...row,
+    payload: parsePayload(row.payload)
+  };
+}
+function parsePayload(value) {
+  if (!value)
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function currentStorageMachineId(db) {
+  try {
+    return getMachineId(db);
+  } catch {
+    return null;
+  }
+}
+
+// src/db/projects.ts
 function slugify(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
@@ -6202,8 +6306,9 @@ function createProject(input, db) {
   const timestamp = now();
   const taskListId = input.task_list_id ?? `todos-${slugify(input.name)}`;
   const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
-  d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp]);
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp, machineId]);
   return getProject(id, d);
 }
 function getProject(id, db) {
@@ -6282,6 +6387,14 @@ function renameProject(id, input, db) {
 }
 function deleteProject(id, db) {
   const d = db || getDatabase();
+  const project = getProject(id, d);
+  if (!project)
+    return false;
+  recordStorageTombstone({
+    object_type: "projects",
+    object_id: id,
+    payload: project
+  }, d);
   const result = d.run("DELETE FROM projects WHERE id = ?", [id]);
   return result.changes > 0;
 }
@@ -6386,6 +6499,14 @@ function listMachineLocalPaths(projectId, db) {
 function removeMachineLocalPath(projectId, machineId, db) {
   const d = db || getDatabase();
   const mid = machineId ?? getMachineId(d);
+  const existing = d.query("SELECT * FROM project_machine_paths WHERE project_id = ? AND machine_id = ?").get(projectId, mid);
+  if (!existing)
+    return false;
+  recordStorageTombstone({
+    object_type: "project_machine_paths",
+    object_id: existing.id,
+    payload: existing
+  }, d);
   const result = d.run("DELETE FROM project_machine_paths WHERE project_id = ? AND machine_id = ?", [projectId, mid]);
   return result.changes > 0;
 }
@@ -6434,20 +6555,69 @@ function checkCompletionGuard(task, agentId, db, configOverride) {
   }
 }
 
+// src/lib/event-emission-safety.ts
+init_database();
+init_sync_utils();
+import { tmpdir } from "os";
+import { resolve as resolve3, sep } from "path";
+function envFlag(name) {
+  const value = process.env[name];
+  return value === "1" || value === "true" || value === "yes";
+}
+function isUnder(parent, child) {
+  const normalizedParent = resolve3(parent);
+  const normalizedChild = resolve3(child);
+  return normalizedChild === normalizedParent || normalizedChild.startsWith(`${normalizedParent}${sep}`);
+}
+function databasePathFromDatabase(db) {
+  const filename = db?.filename;
+  return typeof filename === "string" && filename.trim() ? filename : undefined;
+}
+function isEphemeralTodosDatabase(dbPath) {
+  const resolvedPath = dbPath ?? getDatabasePath();
+  if (resolvedPath === ":memory:" || resolvedPath.startsWith("file::memory:"))
+    return true;
+  return isUnder(tmpdir(), resolvedPath);
+}
+function hasExplicitSharedEventsStore() {
+  return Boolean(process.env["HASNA_EVENTS_DIR"] || process.env["HASNA_EVENTS_HOME"]);
+}
+function usesIsolatedTodosHome() {
+  return isUnder(tmpdir(), getTodosGlobalDir());
+}
+function shouldEmitSharedTaskEvents(dbPath) {
+  if (envFlag("TODOS_DISABLE_SHARED_EVENTS"))
+    return false;
+  if (envFlag("TODOS_ALLOW_EPHEMERAL_SHARED_EVENTS"))
+    return true;
+  if (!isEphemeralTodosDatabase(dbPath))
+    return true;
+  return hasExplicitSharedEventsStore();
+}
+function shouldDeliverLocalLifecycleHooks(dbPath) {
+  if (envFlag("TODOS_DISABLE_LOCAL_EVENT_HOOKS"))
+    return false;
+  if (envFlag("TODOS_ALLOW_EPHEMERAL_LOCAL_EVENT_HOOKS"))
+    return true;
+  if (!isEphemeralTodosDatabase(dbPath))
+    return true;
+  return usesIsolatedTodosHome();
+}
+
 // src/lib/event-hooks.ts
 init_redaction();
 import { createHash, randomUUID } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
-import { dirname as dirname4, resolve as resolve5 } from "path";
+import { dirname as dirname4, resolve as resolve6 } from "path";
 import { createConnection } from "net";
 
 // src/lib/runner-sandbox.ts
 init_config();
-import { relative as relative2, resolve as resolve4 } from "path";
+import { relative as relative2, resolve as resolve5 } from "path";
 
 // src/lib/workspace-trust.ts
 init_config();
-import { relative, resolve as resolve3 } from "path";
+import { relative, resolve as resolve4 } from "path";
 var DEFAULT_DENYLIST = ["rm -rf", "mkfs", "dd if=", "curl | sh", "wget | sh"];
 var DEFAULT_ENV_REDACTIONS = ["API_KEY", "TOKEN", "SECRET", "PASSWORD", "AUTH"];
 var PRESET_DEFAULTS = {
@@ -6493,7 +6663,7 @@ var PRESET_DEFAULTS = {
   }
 };
 function normalizePath(path) {
-  return resolve3(path);
+  return resolve4(path);
 }
 function unique2(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -6630,7 +6800,7 @@ function checkWorkspacePermission(input = {}) {
 var DEFAULT_COMMAND_DENYLIST = ["rm -rf", "mkfs", "dd if=", "curl | sh", "wget | sh"];
 var DEFAULT_ENV_REDACTIONS2 = ["API_KEY", "TOKEN", "SECRET", "PASSWORD", "AUTH"];
 function normalizePath2(path) {
-  return resolve4(path);
+  return resolve5(path);
 }
 function unique3(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -6976,7 +7146,7 @@ async function deliverHook(hook, envelope) {
       if (hook.target === "stdout") {
         output = line.trim();
       } else if (hook.target === "file") {
-        const filePath = resolve5(hook.file_path);
+        const filePath = resolve6(hook.file_path);
         mkdirSync3(dirname4(filePath), { recursive: true });
         appendFileSync(filePath, line);
       } else if (hook.target === "socket") {
@@ -7051,6 +7221,8 @@ async function emitLocalEventHooks(input) {
   return Promise.all(hooks.map((hook) => deliverHook(hook, envelope)));
 }
 function emitLocalEventHooksQuiet(input) {
+  if (!shouldDeliverLocalLifecycleHooks(input.databasePath))
+    return;
   emitLocalEventHooks(input).catch(() => {});
 }
 async function testLocalEventHook(name, input) {
@@ -7367,7 +7539,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -7385,7 +7557,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve6({
+      resolve7({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -7398,7 +7570,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve6({
+      resolve7({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -7666,14 +7838,15 @@ function createTaskList(input, db) {
   const id = uuid();
   const timestamp = now();
   const slug = input.slug || slugify(input.name);
+  const machineId = currentStorageMachineId(d);
   if (!input.project_id) {
     const existing = d.query("SELECT id FROM task_lists WHERE project_id IS NULL AND slug = ?").get(slug);
     if (existing) {
       throw new Error(`Standalone task list with slug "${slug}" already exists`);
     }
   }
-  d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp]);
+  d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp, machineId]);
   return getTaskList(id, d);
 }
 function getTaskList(id, db) {
@@ -7723,6 +7896,14 @@ function updateTaskList(id, input, db) {
 }
 function deleteTaskList(id, db) {
   const d = db || getDatabase();
+  const list = getTaskList(id, d);
+  if (!list)
+    return false;
+  recordStorageTombstone({
+    object_type: "task_lists",
+    object_id: id,
+    payload: list
+  }, d);
   return d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
 }
 function ensureTaskList(name, slug, projectId, db) {
@@ -7939,6 +8120,8 @@ function readMachineLocalPath(project) {
   }
 }
 async function emitSharedTaskEvent(input) {
+  if (!shouldEmitSharedTaskEvents(input.databasePath))
+    return;
   const data = taskEventData(input.task, input.data);
   await new EventsClient().emit({
     source: SOURCE,
@@ -7963,8 +8146,9 @@ function logTaskChange(taskId, action, field2, oldValue, newValue, agentId, db)
   const d = db || getDatabase();
   const id = uuid();
   const timestamp = now();
-  d.run(`INSERT INTO task_history (id, task_id, action, field, old_value, new_value, agent_id, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field2 || null, oldValue ?? null, newValue ?? null, agentId || null, timestamp]);
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO task_history (id, task_id, action, field, old_value, new_value, agent_id, created_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field2 || null, oldValue ?? null, newValue ?? null, agentId || null, timestamp, machineId]);
   try {
     const { logActivity: logActivity2 } = (init_activity_audit(), __toCommonJS(exports_activity_audit));
     logActivity2({
@@ -7977,7 +8161,7 @@ function logTaskChange(taskId, action, field2, oldValue, newValue, agentId, db)
       actor_id: agentId ?? undefined
     }, d);
   } catch {}
-  return { id, task_id: taskId, action, field: field2 || null, old_value: oldValue ?? null, new_value: newValue ?? null, agent_id: agentId || null, created_at: timestamp };
+  return { id, task_id: taskId, action, field: field2 || null, old_value: oldValue ?? null, new_value: newValue ?? null, agent_id: agentId || null, created_at: timestamp, machine_id: machineId };
 }
 function getTaskHistory(taskId, db) {
   const d = db || getDatabase();
@@ -8326,13 +8510,14 @@ function createTask(input, db) {
   const d = db || getDatabase();
   const timestamp = now();
   const tags = input.tags || [];
+  const machineId = currentStorageMachineId(d);
   const assignedBy = input.assigned_by || input.agent_id;
   const assignedFromProject = input.assigned_from_project || null;
   let id = uuid();
   for (let attempt = 0;attempt < 3; attempt++) {
     try {
-      d.run(`INSERT INTO tasks (id, short_id, project_id, parent_id, plan_id, task_list_id, cycle_id, title, description, status, priority, agent_id, assigned_to, session_id, working_dir, tags, metadata, version, created_at, updated_at, due_at, estimated_minutes, sla_minutes, confidence, retry_count, max_retries, retry_after, requires_approval, approved_by, approved_at, recurrence_rule, recurrence_parent_id, spawns_template_id, reason, spawned_from_session, assigned_by, assigned_from_project, task_type)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      d.run(`INSERT INTO tasks (id, short_id, project_id, parent_id, plan_id, task_list_id, cycle_id, title, description, status, priority, agent_id, assigned_to, session_id, working_dir, tags, metadata, version, created_at, updated_at, due_at, estimated_minutes, sla_minutes, confidence, retry_count, max_retries, retry_after, requires_approval, approved_by, approved_at, recurrence_rule, recurrence_parent_id, spawns_template_id, reason, spawned_from_session, assigned_by, assigned_from_project, task_type, machine_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
         id,
         null,
         input.project_id || null,
@@ -8369,7 +8554,8 @@ function createTask(input, db) {
         input.spawned_from_session || null,
         assignedBy || null,
         assignedFromProject || null,
-        input.task_type || null
+        input.task_type || null,
+        machineId
       ]);
       break;
     } catch (e) {
@@ -8385,9 +8571,10 @@ function createTask(input, db) {
   }
   const task = getTask(id, d);
   const payload = taskEventData(task);
+  const databasePath = databasePathFromDatabase(d);
   dispatchWebhook2("task.created", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.created", payload });
-  emitSharedTaskEventQuiet({ type: "task.created", task });
+  emitLocalEventHooksQuiet({ type: "task.created", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.created", task, databasePath });
   return task;
 }
 function getTask(id, db) {
@@ -8805,29 +8992,39 @@ function updateTask(id, input, db) {
     approved_by: input.approved_by ?? task.approved_by,
     approved_at: input.approved_by ? timestamp : task.approved_at
   };
+  const databasePath = databasePathFromDatabase(d);
   if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to) {
     const payload = taskEventData(updatedTask, { assigned_to: input.assigned_to, old_assigned_to: task.assigned_to });
     dispatchWebhook2("task.assigned", payload, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.assigned", payload });
-    emitSharedTaskEventQuiet({ type: "task.assigned", task: updatedTask, data: { old_assigned_to: task.assigned_to } });
+    emitLocalEventHooksQuiet({ type: "task.assigned", payload, databasePath });
+    emitSharedTaskEventQuiet({ type: "task.assigned", task: updatedTask, data: { old_assigned_to: task.assigned_to }, databasePath });
   }
   if (input.status !== undefined && input.status !== task.status) {
     const payload = taskEventData(updatedTask, { old_status: task.status, new_status: input.status });
     dispatchWebhook2("task.status_changed", payload, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.status_changed", payload });
-    emitSharedTaskEventQuiet({ type: "task.status_changed", task: updatedTask, data: { old_status: task.status, new_status: input.status } });
+    emitLocalEventHooksQuiet({ type: "task.status_changed", payload, databasePath });
+    emitSharedTaskEventQuiet({ type: "task.status_changed", task: updatedTask, data: { old_status: task.status, new_status: input.status }, databasePath });
   }
   if (input.approved_by !== undefined) {
-    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title } });
+    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title }, databasePath });
   }
   const updatePayload = taskEventData(updatedTask);
   dispatchWebhook2("task.updated", updatePayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.updated", payload: updatePayload });
-  emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask });
+  emitLocalEventHooksQuiet({ type: "task.updated", payload: updatePayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask, databasePath });
   return updatedTask;
 }
 function deleteTask(id, db) {
   const d = db || getDatabase();
+  const row = d.query("SELECT * FROM tasks WHERE id = ?").get(id);
+  if (!row)
+    return false;
+  recordStorageTombstone({
+    object_type: "tasks",
+    object_id: id,
+    payload: rowToTask(row),
+    version: row.version
+  }, d);
   const result = d.run("DELETE FROM tasks WHERE id = ?", [id]);
   return result.changes > 0;
 }
@@ -8959,8 +9156,9 @@ function resolveTemplateId(id, d) {
 function createTemplate(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  d.run(`INSERT INTO task_templates (id, name, title_pattern, description, priority, tags, variables, project_id, plan_id, metadata, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO task_templates (id, name, title_pattern, description, priority, tags, variables, project_id, plan_id, metadata, created_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     input.name,
     input.title_pattern,
@@ -8971,7 +9169,8 @@ function createTemplate(input, db) {
     input.project_id || null,
     input.plan_id || null,
     JSON.stringify(input.metadata || {}),
-    now()
+    now(),
+    machineId
   ]);
   if (input.tasks && input.tasks.length > 0) {
     addTemplateTasks(id, input.tasks, d);
@@ -8995,6 +9194,15 @@ function deleteTemplate(id, db) {
   const resolved = resolveTemplateId(id, d);
   if (!resolved)
     return false;
+  const template = getTemplate(resolved, d);
+  if (!template)
+    return false;
+  recordStorageTombstone({
+    object_type: "templates",
+    object_id: resolved,
+    payload: template,
+    version: template.version
+  }, d);
   return d.run("DELETE FROM task_templates WHERE id = ?", [resolved]).changes > 0;
 }
 function updateTemplate(id, updates, db) {
@@ -9524,6 +9732,7 @@ function getBlockingDeps(id, db) {
 }
 function startTask(id, agentId, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -9538,7 +9747,8 @@ function startTask(id, agentId, db) {
         agent_id: agentId,
         title: task.title,
         blockers: blocking.map((b) => ({ id: b.id, short_id: b.short_id, title: b.title, status: b.status }))
-      }
+      },
+      databasePath
     });
     throw new Error(`Task is blocked by ${blocking.length} unfinished dependency(ies): ${blockerIds}`);
   }
@@ -9560,12 +9770,13 @@ function startTask(id, agentId, db) {
   const startedTask = { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp, started_at: task.started_at || timestamp, version: task.version + 1, updated_at: timestamp };
   const payload = taskEventData(startedTask, { agent_id: agentId });
   dispatchWebhook2("task.started", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.started", payload });
-  emitSharedTaskEventQuiet({ type: "task.started", task: startedTask, data: { agent_id: agentId } });
+  emitLocalEventHooksQuiet({ type: "task.started", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.started", task: startedTask, data: { agent_id: agentId }, databasePath });
   return startedTask;
 }
 function completeTask(id, agentId, db, options) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -9611,8 +9822,8 @@ function completeTask(id, agentId, db, options) {
   };
   const completionPayload = taskEventData(completedTaskForEvent, { agent_id: agentId, completed_at: timestamp });
   dispatchWebhook2("task.completed", completionPayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload });
-  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp } });
+  emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp }, databasePath });
   let spawnedTask = null;
   if (task.recurrence_rule && !options?.skip_recurrence) {
     spawnedTask = spawnNextRecurrence(task, d, timestamp);
@@ -9656,9 +9867,9 @@ function completeTask(id, agentId, db, options) {
       const depTask = getTask(dep.id, d);
       const payload = depTask ? taskEventData(depTask, { unblocked_by: id }) : { id: dep.id, unblocked_by: id, title: dep.title };
       dispatchWebhook2("task.unblocked", payload, d).catch(() => {});
-      emitLocalEventHooksQuiet({ type: "task.unblocked", payload });
+      emitLocalEventHooksQuiet({ type: "task.unblocked", payload, databasePath });
       if (depTask)
-        emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id } });
+        emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id }, databasePath });
     }
   }
   return { ...task, status: "completed", locked_by: null, locked_at: null, completed_at: timestamp, confidence, version: task.version + 1, updated_at: timestamp, metadata: meta };
@@ -9828,6 +10039,7 @@ function getTasksChangedSince(since, filters, db) {
 }
 function failTask(id, agentId, reason, options, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -9856,8 +10068,8 @@ function failTask(id, agentId, reason, options, db) {
   logTaskChange(id, "fail", "status", task.status, "failed", agentId || null, d);
   const failurePayload = taskEventData(failedTask, { reason, error_code: options?.error_code, agent_id: agentId });
   dispatchWebhook2("task.failed", failurePayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload });
-  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning" });
+  emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning", databasePath });
   let retryTask;
   if (options?.retry) {
     const retryCount = (task.retry_count || 0) + 1;
@@ -9917,6 +10129,7 @@ function getStaleTasks(staleQuery = 30, filters, db) {
 }
 function stealTask(agentId, opts, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const staleMinutes = opts?.stale_minutes ?? 30;
   const staleTasks = getStaleTasks(staleMinutes, { project_id: opts?.project_id, task_list_id: opts?.task_list_id }, d);
   if (staleTasks.length === 0)
@@ -9935,8 +10148,8 @@ function stealTask(agentId, opts, db) {
   const stolenTask = { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp, updated_at: timestamp, version: target.version + 1 };
   const payload = taskEventData(stolenTask, { agent_id: agentId, stolen_from: target.assigned_to });
   dispatchWebhook2("task.assigned", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.assigned", payload });
-  emitSharedTaskEventQuiet({ type: "task.assigned", task: stolenTask, data: { agent_id: agentId, stolen_from: target.assigned_to } });
+  emitLocalEventHooksQuiet({ type: "task.assigned", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.assigned", task: stolenTask, data: { agent_id: agentId, stolen_from: target.assigned_to }, databasePath });
   return stolenTask;
 }
 function claimOrSteal(agentId, filters, db) {
@@ -10527,8 +10740,9 @@ function createPlan(input, db) {
   const d = db || getDatabase();
   const id = uuid();
   const timestamp = now();
-  d.run(`INSERT INTO plans (id, project_id, task_list_id, agent_id, name, description, status, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO plans (id, project_id, task_list_id, agent_id, name, description, status, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     input.project_id || null,
     input.task_list_id || null,
@@ -10537,7 +10751,8 @@ function createPlan(input, db) {
     input.description || null,
     input.status || "active",
     timestamp,
-    timestamp
+    timestamp,
+    machineId
   ]);
   return getPlan(id, d);
 }
@@ -10585,12 +10800,21 @@ function updatePlan(id, input, db) {
   const updated = getPlan(id, d);
   emitLocalEventHooksQuiet({
     type: "plan.updated",
-    payload: { id, old_status: plan.status, new_status: updated.status, name: updated.name, project_id: updated.project_id }
+    payload: { id, old_status: plan.status, new_status: updated.status, name: updated.name, project_id: updated.project_id },
+    databasePath: databasePathFromDatabase(d)
   });
   return updated;
 }
 function deletePlan(id, db) {
   const d = db || getDatabase();
+  const plan = getPlan(id, d);
+  if (!plan)
+    return false;
+  recordStorageTombstone({
+    object_type: "plans",
+    object_id: id,
+    payload: plan
+  }, d);
   const result = d.run("DELETE FROM plans WHERE id = ?", [id]);
   return result.changes > 0;
 }
@@ -10997,20 +11221,20 @@ init_database();
 init_redaction();
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname5, join as join6, resolve as resolve6 } from "path";
-import { tmpdir } from "os";
+import { basename, dirname as dirname5, join as join6, resolve as resolve7 } from "path";
+import { tmpdir as tmpdir2 } from "os";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
 function artifactStoreRoot() {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve6(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve7(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve6(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve7(process.env["TODOS_ARTIFACTS_DIR"]);
   const dbPath = getDatabasePath();
   if (isInMemoryDb2(dbPath))
-    return join6(tmpdir(), "hasna-todos-artifacts");
-  return join6(dirname5(resolve6(dbPath)), "artifacts");
+    return join6(tmpdir2(), "hasna-todos-artifacts");
+  return join6(dirname5(resolve7(dbPath)), "artifacts");
 }
 function artifactStorePath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
@@ -11057,7 +11281,7 @@ function mediaTypeFor(path, textLike) {
   return "application/octet-stream";
 }
 function storeArtifactContent(input) {
-  const sourcePath = resolve6(input.path);
+  const sourcePath = resolve7(input.path);
   if (!existsSync8(sourcePath))
     return null;
   const sourceStat = statSync2(sourcePath);
@@ -11213,19 +11437,19 @@ function importStoredArtifactContent(content) {
 var DEFAULT_DELETED_RETENTION_DAYS = 30;
 function getArtifactStoreRoot(dbPath) {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve6(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve7(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve6(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve7(process.env["TODOS_ARTIFACTS_DIR"]);
   const path = dbPath ?? getDatabasePath();
   if (isInMemoryDb2(path))
-    return join6(tmpdir(), "hasna-todos-artifacts");
-  return join6(dirname5(resolve6(path)), "artifacts");
+    return join6(tmpdir2(), "hasna-todos-artifacts");
+  return join6(dirname5(resolve7(path)), "artifacts");
 }
 function computeContentHash(path) {
-  return sha256(readFileSync4(resolve6(path)));
+  return sha256(readFileSync4(resolve7(path)));
 }
 function storeArtifactFile(input) {
-  const sourcePath = resolve6(input.sourcePath);
+  const sourcePath = resolve7(input.sourcePath);
   if (!existsSync8(sourcePath)) {
     throw new Error(`Source file not found: ${input.sourcePath}`);
   }
@@ -11274,7 +11498,7 @@ function buildArtifactExportManifest(artifacts, dbPath) {
   };
 }
 function writeArtifactExportManifest(manifest, outputPath) {
-  const destination = resolve6(outputPath);
+  const destination = resolve7(outputPath);
   mkdirSync4(dirname5(destination), { recursive: true });
   writeFileSync2(destination, `${JSON.stringify(manifest, null, 2)}
 `);
@@ -11661,7 +11885,11 @@ function startTaskRun(input, db) {
     }, d);
   }
   const run = getTaskRun(id, d);
-  emitLocalEventHooksQuiet({ type: "run.started", payload: { id: run.id, task_id: run.task_id, agent_id: run.agent_id, title: run.title } });
+  emitLocalEventHooksQuiet({
+    type: "run.started",
+    payload: { id: run.id, task_id: run.task_id, agent_id: run.agent_id, title: run.title },
+    databasePath: databasePathFromDatabase(d)
+  });
   return run;
 }
 function beginTaskRunTransaction(input, db) {
@@ -11930,7 +12158,8 @@ function finishTaskRun(input, db) {
   const updated = getTaskRun(run.id, d);
   emitLocalEventHooksQuiet({
     type: `run.${input.status}`,
-    payload: { id: updated.id, task_id: updated.task_id, agent_id: updated.agent_id, status: updated.status, summary: updated.summary, completed_at: timestamp }
+    payload: { id: updated.id, task_id: updated.task_id, agent_id: updated.agent_id, status: updated.status, summary: updated.summary, completed_at: timestamp },
+    databasePath: databasePathFromDatabase(d)
   });
   return updated;
 }
@@ -13264,7 +13493,7 @@ function importOnboardingFixture(options = {}) {
 init_database();
 import { createHash as createHash3 } from "crypto";
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname6, resolve as resolve7 } from "path";
+import { dirname as dirname6, resolve as resolve8 } from "path";
 import { mkdirSync as mkdirSync6 } from "fs";
 var TODOS_LOCAL_BACKUP_KIND = "hasna.todos.local-backup";
 var TODOS_LOCAL_BACKUP_SCHEMA_VERSION = 1;
@@ -13371,14 +13600,14 @@ function createLocalBackup(options = {}, db) {
   return backup;
 }
 function writeLocalBackupFile(backup, outputPath) {
-  const path = resolve7(outputPath);
+  const path = resolve8(outputPath);
   mkdirSync6(dirname6(path), { recursive: true });
   writeFileSync4(path, `${JSON.stringify(backup, null, 2)}
 `);
   return path;
 }
 function readLocalBackupFile(path) {
-  return JSON.parse(readFileSync5(resolve7(path), "utf-8"));
+  return JSON.parse(readFileSync5(resolve8(path), "utf-8"));
 }
 function verifyLocalBackup(value, options = {}, db) {
   const verifiedAt = options.verified_at ?? now();
@@ -16346,7 +16575,8 @@ function writeQueue(task2, queue, actor, action, db) {
   logTaskChange(task2.id, `review_queue.${action}`, "review_queue", null, JSON.stringify(queue), actor, d);
   emitLocalEventHooksQuiet({
     type: `review.${action}`,
-    payload: { task_id: task2.id, queue: queue.queue, state: queue.state, reviewer: queue.reviewer, claimed_by: queue.claimed_by }
+    payload: { task_id: task2.id, queue: queue.queue, state: queue.state, reviewer: queue.reviewer, claimed_by: queue.claimed_by },
+    databasePath: databasePathFromDatabase(d)
   });
   return itemFromTask(taskOrThrow2(task2.id, d), queue, d);
 }
@@ -17027,7 +17257,7 @@ function canonicalize(value) {
 function hash(value) {
   return createHash5("sha256").update(value).digest("hex");
 }
-function parsePayload(value) {
+function parsePayload2(value) {
   if (!value)
     return {};
   try {
@@ -17126,7 +17356,7 @@ function taskScopedRows(db, scope) {
       FROM handoffs h
       WHERE h.project_id IS NULL OR h.project_id = COALESCE(?, h.project_id)
     `).all(scope.project_id ?? null).filter((row) => {
-      const payload = parsePayload(row.payload_json);
+      const payload = parsePayload2(row.payload_json);
       const taskRefs = parseStringArray(payload["task_ids"]);
       const runRefs = parseStringArray(payload["run_ids"]);
       if (scope.project_id && row.project_id !== scope.project_id)
@@ -17157,7 +17387,7 @@ function toLedgerEntries(rows) {
   });
   let previous = LOCAL_AUDIT_LEDGER_INITIAL_HASH;
   return ordered.map((row, index) => {
-    const payload = parsePayload(row.payload_json);
+    const payload = parsePayload2(row.payload_json);
     const payloadHash = hash(canonicalize({ source: row.source, source_id: row.source_id, created_at: row.created_at, payload }));
     const chainHash = hash(`${previous}
 ${payloadHash}`);
@@ -17292,7 +17522,7 @@ function renderLocalAuditLedgerMarkdown(ledger) {
 init_migrations();
 init_schema();
 import { readFileSync as readFileSync6 } from "fs";
-import { join as join9, resolve as resolve8 } from "path";
+import { join as join9, resolve as resolve9 } from "path";
 import { Database as Database2 } from "bun:sqlite";
 var LOCAL_RELEASE_COMPATIBILITY_SCHEMA_VERSION = 1;
 var EXPECTED_PACKAGE_NAME = "@hasna/todos";
@@ -17434,7 +17664,7 @@ function checkChangelog() {
   ];
 }
 function createReleaseCompatibilityReport(options = {}) {
-  const root = resolve8(options.root ?? process.cwd());
+  const root = resolve9(options.root ?? process.cwd());
   const packageJson = readPackageJson(root);
   const simulatedLevels = options.simulated_levels ?? defaultSimulationLevels();
   const checks = [
@@ -21762,6 +21992,7 @@ function rowToAgent(row) {
 }
 function registerAgent(input, db) {
   const d = db || getDatabase();
+  const machineId = currentStorageMachineId(d);
   const existingNames = d.query("SELECT name FROM agents").all().map((row) => row.name);
   const normalizedName = validateAgentName(input.name, existingNames);
   const existing = getAgentByName(normalizedName, d);
@@ -21802,14 +22033,18 @@ function registerAgent(input, db) {
       updates.push("active_project_id = ?");
       params.push(input.project_id);
     }
+    if (!existing.machine_id && machineId) {
+      updates.push("machine_id = ?");
+      params.push(machineId);
+    }
     params.push(existing.id);
     d.run(`UPDATE agents SET ${updates.join(", ")} WHERE id = ?`, params);
     return getAgent(existing.id, d);
   }
   const id = shortUuid();
   const timestamp2 = now();
-  d.run(`INSERT INTO agents (id, name, description, role, title, level, permissions, capabilities, reports_to, org_id, metadata, created_at, last_seen_at, session_id, working_dir, active_project_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  d.run(`INSERT INTO agents (id, name, description, role, title, level, permissions, capabilities, reports_to, org_id, metadata, created_at, last_seen_at, session_id, working_dir, active_project_id, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     normalizedName,
     input.description || null,
@@ -21825,7 +22060,8 @@ function registerAgent(input, db) {
     timestamp2,
     input.session_id || null,
     input.working_dir || null,
-    input.project_id && input.session_id ? input.project_id : null
+    input.project_id && input.session_id ? input.project_id : null,
+    machineId
   ]);
   return getAgent(id, d);
 }
@@ -22025,6 +22261,14 @@ var PROJECT_COLUMNS = [
   "machine_id",
   "synced_at"
 ];
+var PROJECT_MACHINE_PATH_COLUMNS = [
+  "id",
+  "project_id",
+  "machine_id",
+  "path",
+  "created_at",
+  "updated_at"
+];
 var TASK_LIST_COLUMNS = [
   "id",
   "project_id",
@@ -22164,11 +22408,13 @@ function exportSqliteTodosStorageSnapshot(db) {
     source: "sqlite",
     tasks: listTasks({ include_archived: true }, d),
     projects: listProjects(d),
+    projectMachinePaths: listProjectMachinePaths(d),
     plans: listPlans(undefined, d),
     agents: listAgents({ include_archived: true }, d),
     taskLists: listTaskLists(undefined, d),
     templates: listTemplates(d),
-    auditHistory: getRecentActivity(Number.MAX_SAFE_INTEGER, d)
+    auditHistory: getRecentActivity(Number.MAX_SAFE_INTEGER, d),
+    tombstones: listStorageTombstones(d)
   };
 }
 function importSqliteTodosStorageSnapshot(snapshot, db) {
@@ -22176,13 +22422,19 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
   const result = {
     inserted: 0,
     updated: 0,
+    deleted: 0,
     skipped: 0,
     errors: []
   };
-  const applyRows = (table, columns, rows, updateClockColumn, afterUpsert) => {
+  const applyRows = (objectType, table, columns, rows, updateClockColumn, afterUpsert) => {
     for (const row of rows) {
       try {
         const record = asRecord2(row);
+        const tombstone = typeof record["id"] === "string" ? getStorageTombstone(objectType, record["id"], d) : null;
+        if (tombstone && shouldApplyStorageTombstone(tombstone, rowClock(record, updateClockColumn))) {
+          result.skipped += 1;
+          continue;
+        }
         const state = upsertById(d, table, columns, record, updateClockColumn);
         if (state === "inserted")
           result.inserted += 1;
@@ -22196,17 +22448,19 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
       }
     }
   };
-  applyRows("projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
-  applyRows("agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
-  applyRows("task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
-  applyRows("plans", PLAN_COLUMNS, snapshot.plans, "updated_at");
-  applyRows("task_templates", TEMPLATE_COLUMNS, snapshot.templates);
-  applyRows("tasks", TASK_COLUMNS, sortedTasks2(snapshot.tasks), "updated_at", (row, changed) => {
+  applyRows("projects", "projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
+  applyRows("project_machine_paths", "project_machine_paths", PROJECT_MACHINE_PATH_COLUMNS, snapshot.projectMachinePaths ?? [], "updated_at");
+  applyRows("agents", "agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
+  applyRows("task_lists", "task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
+  applyRows("plans", "plans", PLAN_COLUMNS, snapshot.plans, "updated_at");
+  applyRows("templates", "task_templates", TEMPLATE_COLUMNS, snapshot.templates);
+  applyRows("tasks", "tasks", TASK_COLUMNS, sortedTasks2(snapshot.tasks), "updated_at", (row, changed) => {
     if (changed && Array.isArray(row["tags"]) && typeof row["id"] === "string") {
       replaceTaskTags(row["id"], row["tags"].filter((tag) => typeof tag === "string"), d);
     }
   });
-  applyRows("task_history", AUDIT_COLUMNS, snapshot.auditHistory);
+  applyRows("audit_history", "task_history", AUDIT_COLUMNS, snapshot.auditHistory);
+  applyTombstones(d, snapshot.tombstones ?? [], result);
   return result;
 }
 function upsertById(db, table, columns, row, updateClockColumn) {
@@ -22261,6 +22515,85 @@ function sortedTasks2(tasks) {
     visit(task2);
   return result;
 }
+function applyTombstones(db, tombstones, result) {
+  for (const tombstone of tombstones) {
+    try {
+      recordStorageTombstone({
+        object_type: tombstone.object_type,
+        object_id: tombstone.object_id,
+        deleted_at: tombstone.deleted_at,
+        source_machine_id: tombstone.source_machine_id ?? null,
+        payload: tombstone.payload ?? null,
+        version: tombstone.version ?? null
+      }, db);
+      const table = tableForTombstone(tombstone.object_type);
+      const existing = existingClock(db, table, tombstone.object_id);
+      if (!shouldApplyStorageTombstone(tombstone, existing)) {
+        result.skipped += 1;
+        continue;
+      }
+      const deletedTags = table === "tasks" ? db.run("DELETE FROM task_tags WHERE task_id = ?", [tombstone.object_id]).changes : 0;
+      const deleted = db.run(`DELETE FROM ${table} WHERE id = ?`, [tombstone.object_id]).changes;
+      if (deleted > 0 || deletedTags > 0)
+        result.deleted = (result.deleted ?? 0) + 1;
+      else
+        result.skipped += 1;
+    } catch (error) {
+      result.errors.push(error instanceof Error ? error.message : String(error));
+    }
+  }
+}
+function tableForTombstone(objectType) {
+  if (objectType === "tasks")
+    return "tasks";
+  if (objectType === "projects")
+    return "projects";
+  if (objectType === "project_machine_paths")
+    return "project_machine_paths";
+  if (objectType === "plans")
+    return "plans";
+  if (objectType === "agents")
+    return "agents";
+  if (objectType === "task_lists")
+    return "task_lists";
+  if (objectType === "templates")
+    return "task_templates";
+  return "task_history";
+}
+function listRows(db, table, columns) {
+  return db.query(`SELECT ${columns.join(", ")} FROM ${table} ORDER BY id`).all();
+}
+function listProjectMachinePaths(db) {
+  return listRows(db, "project_machine_paths", PROJECT_MACHINE_PATH_COLUMNS).map((row) => ({
+    id: String(row.id),
+    project_id: String(row.project_id),
+    machine_id: String(row.machine_id),
+    path: String(row.path),
+    created_at: String(row.created_at),
+    updated_at: String(row.updated_at)
+  }));
+}
+function existingClock(db, table, id) {
+  const clockColumns = clockColumnsForTable(table);
+  const row = db.query(`SELECT ${clockColumns.join(", ")} FROM ${table} WHERE id = ?`).get(id);
+  return row?.updated_at ?? row?.last_seen_at ?? row?.created_at ?? null;
+}
+function rowClock(row, updateClockColumn) {
+  const value = updateClockColumn ? row[updateClockColumn] : null;
+  return stringClock(value) ?? stringClock(row["updated_at"]) ?? stringClock(row["last_seen_at"]) ?? stringClock(row["created_at"]);
+}
+function stringClock(value) {
+  return typeof value === "string" && value ? value : null;
+}
+function clockColumnsForTable(table) {
+  if (table === "agents")
+    return ["last_seen_at", "created_at"];
+  if (table === "task_templates")
+    return ["created_at"];
+  if (table === "task_history")
+    return ["created_at"];
+  return ["updated_at", "created_at"];
+}
 
 // src/storage/local-sqlite.ts
 function createLocalSqliteTodosStorageAdapter(options = {}) {
@@ -22427,7 +22760,7 @@ class PostgresTodosSyncStore {
   }
   async pullSnapshot(options = {}) {
     const params = [this.service];
-    const filters = ["service = $1", "deleted_at IS NULL"];
+    const filters = ["service = $1"];
     if (options.since) {
       params.push(options.since);
       filters.push(`updated_at > $${params.length}::timestamptz`);
@@ -22436,7 +22769,7 @@ class PostgresTodosSyncStore {
       params.push(options.objectTypes);
       filters.push(`object_type = ANY($${params.length}::text[])`);
     }
-    const response = await this.client.query(`SELECT object_type, payload FROM ${this.tableName}
+    const response = await this.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version FROM ${this.tableName}
        WHERE ${filters.join(" AND ")}
        ORDER BY updated_at ASC, object_type ASC, object_id ASC`, params);
     return rowsToSnapshot(response.rows);
@@ -22460,11 +22793,20 @@ function snapshotEntries(snapshot) {
   return [
     ...snapshot.tasks.map((payload) => entry("tasks", payload, snapshot.exportedAt)),
     ...snapshot.projects.map((payload) => entry("projects", payload, snapshot.exportedAt)),
+    ...(snapshot.projectMachinePaths ?? []).map((payload) => entry("project_machine_paths", payload, snapshot.exportedAt)),
     ...snapshot.plans.map((payload) => entry("plans", payload, snapshot.exportedAt)),
     ...snapshot.agents.map((payload) => entry("agents", payload, snapshot.exportedAt)),
     ...snapshot.taskLists.map((payload) => entry("task_lists", payload, snapshot.exportedAt)),
     ...snapshot.templates.map((payload) => entry("templates", payload, snapshot.exportedAt)),
-    ...snapshot.auditHistory.map((payload) => entry("audit_history", payload, snapshot.exportedAt))
+    ...snapshot.auditHistory.map((payload) => entry("audit_history", payload, snapshot.exportedAt)),
+    ...(snapshot.tombstones ?? []).map((tombstone) => ({
+      type: tombstone.object_type,
+      id: tombstone.object_id,
+      payload: tombstone.payload ?? { id: tombstone.object_id, deleted_at: tombstone.deleted_at },
+      updatedAt: tombstone.updated_at || tombstone.deleted_at,
+      deletedAt: tombstone.deleted_at,
+      version: tombstone.version ?? null
+    }))
   ];
 }
 function entry(type, payload, fallbackUpdatedAt) {
@@ -22486,19 +22828,38 @@ function rowsToSnapshot(rows) {
     source: "postgres",
     tasks: [],
     projects: [],
+    projectMachinePaths: [],
     plans: [],
     agents: [],
     taskLists: [],
     templates: [],
-    auditHistory: []
+    auditHistory: [],
+    tombstones: []
   };
   for (const row of rows) {
     const payload = payloadRecord(row.payload);
+    const deletedAt = stringValue(row.deleted_at);
+    if (deletedAt) {
+      snapshot.tombstones ??= [];
+      snapshot.tombstones.push({
+        object_type: row.object_type,
+        object_id: stringValue(row.object_id) ?? stringValue(payload["id"]) ?? "",
+        deleted_at: deletedAt,
+        updated_at: stringValue(row.updated_at) ?? deletedAt,
+        source_machine_id: stringValue(row.source_machine_id),
+        payload,
+        version: numberValue2(row.version)
+      });
+      continue;
+    }
     if (row.object_type === "tasks")
       snapshot.tasks.push(payload);
     else if (row.object_type === "projects")
       snapshot.projects.push(payload);
-    else if (row.object_type === "plans")
+    else if (row.object_type === "project_machine_paths") {
+      snapshot.projectMachinePaths ??= [];
+      snapshot.projectMachinePaths.push(payload);
+    } else if (row.object_type === "plans")
       snapshot.plans.push(payload);
     else if (row.object_type === "agents")
       snapshot.agents.push(payload);
@@ -22519,6 +22880,8 @@ function payloadRecord(value) {
   throw new Error("Postgres sync payload must be a JSON object");
 }
 function stringValue(value) {
+  if (value instanceof Date)
+    return value.toISOString();
   return typeof value === "string" && value ? value : null;
 }
 function numberValue2(value) {
@@ -22673,6 +23036,9 @@ class PostgresJsonRecordStore {
     this.tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
     this.cursorTableName = options.cursorTableName ?? DEFAULT_TODOS_POSTGRES_CURSOR_TABLE;
   }
+  machineId(context) {
+    return context?.requestId ?? this.sourceMachineId ?? null;
+  }
   async ensureSchema() {
     this.schemaReady ??= (async () => {
       for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
@@ -22704,6 +23070,25 @@ class PostgresJsonRecordStore {
       updatedAt: stringValue2(row.updated_at) ?? new Date().toISOString()
     }));
   }
+  async listTombstones() {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
+       FROM ${this.tableName}
+       WHERE service = $1 AND deleted_at IS NOT NULL
+       ORDER BY updated_at ASC, object_type ASC, object_id ASC`, [this.service]);
+    return result.rows.map((row) => {
+      const deletedAt = stringValue2(row.deleted_at) ?? stringValue2(row.updated_at) ?? new Date().toISOString();
+      return {
+        object_type: row.object_type,
+        object_id: row.object_id,
+        deleted_at: deletedAt,
+        updated_at: stringValue2(row.updated_at) ?? deletedAt,
+        source_machine_id: stringValue2(row.source_machine_id),
+        payload: payloadRecord2(row.payload),
+        version: numberValue3(row.version)
+      };
+    });
+  }
   async upsert(type, value, context = {}) {
     await this.ensureSchema();
     const updatedAt = stringValue2(value.updated_at) ?? stringValue2(value.created_at) ?? new Date().toISOString();
@@ -22716,7 +23101,8 @@ class PostgresJsonRecordStore {
         updated_at = EXCLUDED.updated_at,
         deleted_at = NULL,
         source_machine_id = EXCLUDED.source_machine_id,
-        version = EXCLUDED.version`, [
+        version = EXCLUDED.version
+      WHERE ${this.tableName}.updated_at IS NULL OR ${this.tableName}.updated_at <= EXCLUDED.updated_at`, [
       this.service,
       type,
       value.id,
@@ -22733,13 +23119,58 @@ class PostgresJsonRecordStore {
     if (!existing)
       return false;
     const timestamp2 = new Date().toISOString();
-    await this.options.client.query(`UPDATE ${this.tableName}
-       SET deleted_at = $4::timestamptz,
-           updated_at = $4::timestamptz,
-           source_machine_id = $5
-       WHERE service = $1 AND object_type = $2 AND object_id = $3`, [this.service, type, id, timestamp2, context.requestId ?? this.sourceMachineId ?? null]);
+    return this.tombstone({
+      object_type: type,
+      object_id: id,
+      deleted_at: timestamp2,
+      updated_at: timestamp2,
+      payload: existing,
+      version: numberValue3(existing["version"])
+    }, context);
+  }
+  async tombstone(tombstone, context = {}) {
+    await this.ensureSchema();
+    const deletedAt = stringValue2(tombstone.deleted_at) ?? new Date().toISOString();
+    const updatedAt = stringValue2(tombstone.updated_at) ?? deletedAt;
+    const existing = await this.clock(tombstone.object_type, tombstone.object_id);
+    if (existing && compareClock(existing.updatedAt, updatedAt) > 0)
+      return false;
+    await this.options.client.query(`INSERT INTO ${this.tableName} (
+        service, object_type, object_id, payload, updated_at,
+        deleted_at, source_machine_id, version
+      ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, $6::timestamptz, $7, $8)
+      ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+        payload = EXCLUDED.payload,
+        updated_at = EXCLUDED.updated_at,
+        deleted_at = EXCLUDED.deleted_at,
+        source_machine_id = EXCLUDED.source_machine_id,
+        version = EXCLUDED.version
+      WHERE ${this.tableName}.updated_at IS NULL OR ${this.tableName}.updated_at <= EXCLUDED.updated_at`, [
+      this.service,
+      tombstone.object_type,
+      tombstone.object_id,
+      JSON.stringify(tombstone.payload ?? { id: tombstone.object_id, deleted_at: deletedAt }),
+      updatedAt,
+      deletedAt,
+      tombstone.source_machine_id ?? context.requestId ?? this.sourceMachineId ?? null,
+      tombstone.version ?? null
+    ]);
     return true;
   }
+  async clock(type, id) {
+    await this.ensureSchema();
+    const result = await this.options.client.query(`SELECT object_type, object_id, updated_at, deleted_at
+       FROM ${this.tableName}
+       WHERE service = $1 AND object_type = $2 AND object_id = $3
+       LIMIT 1`, [this.service, type, id]);
+    const row = result.rows[0];
+    if (!row)
+      return null;
+    return {
+      updatedAt: stringValue2(row.updated_at) ?? new Date().toISOString(),
+      deletedAt: stringValue2(row.deleted_at)
+    };
+  }
   async getCursor(name) {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT value FROM ${this.cursorTableName} WHERE service = $1 AND cursor_name = $2`, [this.service, name]);
@@ -22808,7 +23239,10 @@ async function createTask2(input, store, context) {
     runner_started_at: null,
     runner_completed_at: null,
     current_step: null,
-    total_steps: null
+    total_steps: null,
+    machine_id: store.machineId(context),
+    synced_at: null,
+    archived_at: null
   };
   await store.upsert("tasks", task2, context);
   await logTaskChange2(task2.id, "created", "status", null, task2.status, task2.assigned_by ?? task2.agent_id, store, context);
@@ -22933,7 +23367,9 @@ async function createProject2(input, store, context) {
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
     task_counter: 0,
     created_at: timestamp2,
-    updated_at: timestamp2
+    updated_at: timestamp2,
+    machine_id: store.machineId(context),
+    synced_at: null
   };
   return store.upsert("projects", project, context);
 }
@@ -22953,7 +23389,9 @@ async function createPlan2(input, store, context) {
     description: input.description ?? null,
     status: input.status ?? "active",
     created_at: timestamp2,
-    updated_at: timestamp2
+    updated_at: timestamp2,
+    machine_id: store.machineId(context),
+    synced_at: null
   }, context);
 }
 async function updatePlan2(id, input, store) {
@@ -22983,7 +23421,9 @@ async function registerAgent2(input, store, context) {
     last_seen_at: timestamp2,
     session_id: input.session_id ?? context?.sessionId ?? existing?.session_id ?? null,
     working_dir: input.working_dir ?? existing?.working_dir ?? null,
-    active_project_id: input.project_id ?? context?.projectId ?? existing?.active_project_id ?? null
+    active_project_id: input.project_id ?? context?.projectId ?? existing?.active_project_id ?? null,
+    machine_id: existing?.machine_id ?? store.machineId(context),
+    synced_at: existing?.synced_at ?? null
   };
   return store.upsert("agents", agent, context);
 }
@@ -23010,7 +23450,9 @@ async function createTaskList2(input, store, context) {
     description: input.description ?? null,
     metadata: input.metadata ?? {},
     created_at: timestamp2,
-    updated_at: timestamp2
+    updated_at: timestamp2,
+    machine_id: store.machineId(context),
+    synced_at: null
   }, context);
 }
 async function updateTaskList2(id, input, store) {
@@ -23036,7 +23478,9 @@ async function createTemplate2(input, store, context) {
     project_id: input.project_id ?? context?.projectId ?? null,
     plan_id: input.plan_id ?? null,
     metadata: input.metadata ?? {},
-    created_at: timestamp2
+    created_at: timestamp2,
+    machine_id: store.machineId(context),
+    synced_at: null
   }, context);
 }
 async function updateTemplate2(id, input, store) {
@@ -23061,7 +23505,8 @@ async function logTaskChange2(taskId, action, field2, oldValue, newValue, agentI
     old_value: oldValue ?? null,
     new_value: newValue ?? null,
     agent_id: agentId ?? context?.agentId ?? null,
-    created_at: new Date().toISOString()
+    created_at: new Date().toISOString(),
+    machine_id: store.machineId(context)
   };
   return store.upsert("audit_history", entry2, context);
 }
@@ -23084,18 +23529,21 @@ async function exportSnapshot(store) {
     source: "postgres",
     tasks: await store.list("tasks"),
     projects: await store.list("projects"),
+    projectMachinePaths: await store.list("project_machine_paths"),
     plans: await store.list("plans"),
     agents: await store.list("agents"),
     taskLists: await store.list("task_lists"),
     templates: await store.list("templates"),
-    auditHistory: await store.list("audit_history")
+    auditHistory: await store.list("audit_history"),
+    tombstones: await store.listTombstones()
   };
 }
 async function importSnapshot(snapshot, store, context) {
-  const result = { inserted: 0, updated: 0, skipped: 0, errors: [] };
+  const result = { inserted: 0, updated: 0, deleted: 0, skipped: 0, errors: [] };
   const entries = [
     ...snapshot.tasks.map((row) => ["tasks", row]),
     ...snapshot.projects.map((row) => ["projects", row]),
+    ...(snapshot.projectMachinePaths ?? []).map((row) => ["project_machine_paths", row]),
     ...snapshot.plans.map((row) => ["plans", row]),
     ...snapshot.agents.map((row) => ["agents", row]),
     ...snapshot.taskLists.map((row) => ["task_lists", row]),
@@ -23114,6 +23562,25 @@ async function importSnapshot(snapshot, store, context) {
       result.errors.push(error instanceof Error ? error.message : String(error));
     }
   }
+  for (const tombstone of snapshot.tombstones ?? []) {
+    try {
+      const deleted = await store.tombstone({
+        object_type: tombstone.object_type,
+        object_id: tombstone.object_id,
+        deleted_at: tombstone.deleted_at,
+        updated_at: tombstone.updated_at,
+        source_machine_id: tombstone.source_machine_id ?? null,
+        payload: tombstone.payload ?? null,
+        version: tombstone.version ?? null
+      }, context);
+      if (deleted)
+        result.deleted = (result.deleted ?? 0) + 1;
+      else
+        result.skipped += 1;
+    } catch (error) {
+      result.errors.push(error instanceof Error ? error.message : String(error));
+    }
+  }
   return result;
 }
 async function requireRecord(type, id, store) {
@@ -23196,8 +23663,17 @@ function payloadRecord2(value) {
   throw new Error("Postgres storage payload must be a JSON object");
 }
 function stringValue2(value) {
+  if (value instanceof Date)
+    return value.toISOString();
   return typeof value === "string" && value ? value : null;
 }
+function compareClock(left, right) {
+  const leftClock = Date.parse(left);
+  const rightClock = Date.parse(right);
+  if (Number.isNaN(leftClock) || Number.isNaN(rightClock))
+    return left.localeCompare(right);
+  return leftClock - rightClock;
+}
 function numberValue3(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
@@ -24132,7 +24608,7 @@ class TodosClient {
     return this._fetchWithRetry(path, { method: "DELETE" });
   }
   _sleep(ms) {
-    return new Promise((resolve9) => setTimeout(resolve9, ms));
+    return new Promise((resolve10) => setTimeout(resolve10, ms));
   }
   async getHealth() {
     return this._get("/api/health");
@@ -25514,7 +25990,7 @@ function renderRetrospectiveMarkdown(record) {
 // src/lib/project-bootstrap.ts
 init_database();
 import { existsSync as existsSync9, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
-import { basename as basename2, dirname as dirname7, resolve as resolve9 } from "path";
+import { basename as basename2, dirname as dirname7, resolve as resolve10 } from "path";
 function safeStat(path) {
   try {
     return statSync3(path);
@@ -25523,7 +25999,7 @@ function safeStat(path) {
   }
 }
 function canonicalPath(input) {
-  const resolved = resolve9(input);
+  const resolved = resolve10(input);
   const stats2 = safeStat(resolved);
   if (stats2?.isFile())
     return dirname7(resolved);
@@ -25532,7 +26008,7 @@ function canonicalPath(input) {
 function findUp(start, marker) {
   let current = canonicalPath(start);
   while (true) {
-    if (existsSync9(resolve9(current, marker)))
+    if (existsSync9(resolve10(current, marker)))
       return current;
     const parent = dirname7(current);
     if (parent === current)
@@ -25543,7 +26019,7 @@ function findUp(start, marker) {
 function readPackageJson2(path) {
   if (!path)
     return null;
-  const file = resolve9(path, "package.json");
+  const file = resolve10(path, "package.json");
   if (!existsSync9(file))
     return null;
   try {
@@ -25566,7 +26042,7 @@ function workspaceMarker(root, rootPackage) {
   if (rootPackage?.workspaces)
     markers.push("package.json#workspaces");
   for (const marker of ["pnpm-workspace.yaml", "turbo.json", "nx.json", "lerna.json", "rush.json", "bun.lock", "bun.lockb"]) {
-    if (existsSync9(resolve9(root, marker)))
+    if (existsSync9(resolve10(root, marker)))
       markers.push(marker);
   }
   const kind = markers.find((marker) => marker !== "bun.lock" && marker !== "bun.lockb") ?? null;
@@ -25848,6 +26324,8 @@ function pointerPatch(previous, input, key) {
   if (!Object.prototype.hasOwnProperty.call(input, key))
     return previous;
   const value = input[key];
+  if (value === undefined)
+    return previous;
   return typeof value === "string" && value.trim() ? value : undefined;
 }
 // src/db/api-keys.ts
@@ -26915,7 +27393,7 @@ function classifyLog(text) {
 async function sleep2(ms) {
   if (ms <= 0)
     return;
-  await new Promise((resolve10) => setTimeout(resolve10, ms));
+  await new Promise((resolve11) => setTimeout(resolve11, ms));
 }
 async function runCommandProvider(provider, input) {
   const commandTemplate = input.command || provider.command;
@@ -27271,11 +27749,11 @@ function writeVerificationExport(bundle, path) {
   writeFileSync7(path, JSON.stringify(bundle, null, 2), "utf8");
 }
 // src/lib/policy-packs.ts
-import { relative as relative3, resolve as resolve10 } from "path";
+import { relative as relative3, resolve as resolve11 } from "path";
 init_database();
 init_config();
 function normalizePath3(path) {
-  return resolve10(path);
+  return resolve11(path);
 }
 function unique4(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -27330,7 +27808,7 @@ function commandMatches(commands, pattern) {
 }
 function pathMatches(paths, pattern, root) {
   return paths.filter((path) => {
-    const candidate = path.startsWith("/") ? path : resolve10(root, path);
+    const candidate = path.startsWith("/") ? path : resolve11(root, path);
     if (!isPathInside3(root, candidate))
       return matchesPattern3(path, pattern);
     return matchesPattern3(path, pattern) || matchesPattern3(relative3(root, candidate), pattern);
@@ -28042,7 +28520,7 @@ function resetAgentAdapterCache() {}
 // src/lib/git-traceability.ts
 import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 var GIT_TRACEABILITY_SCHEMA_VERSION = "todos.git_traceability.v1";
 function runGit(args, cwd) {
   const result = spawnSync2("git", args, { cwd, encoding: "utf8" });
@@ -28085,7 +28563,7 @@ function inspectGitCommit(sha, cwd) {
   };
 }
 function loadCiSnapshot(path) {
-  const target = path ? resolve11(path) : resolve11(process.cwd(), ".todos", "ci-snapshot.json");
+  const target = path ? resolve12(path) : resolve12(process.cwd(), ".todos", "ci-snapshot.json");
   if (!existsSync13(target))
     return null;
   try {
@@ -28183,7 +28661,7 @@ function formatTraceabilityReport(report) {
 }
 // src/lib/mention-resolver.ts
 import { existsSync as existsSync14, readdirSync as readdirSync2, readFileSync as readFileSync12, statSync as statSync4 } from "fs";
-import { basename as basename3, isAbsolute, join as join12, relative as relative4, resolve as resolve12, sep } from "path";
+import { basename as basename3, isAbsolute, join as join12, relative as relative4, resolve as resolve13, sep as sep2 } from "path";
 init_database();
 var PREFIXES = {
   file: "file",
@@ -28259,11 +28737,11 @@ function backlink(kind, key, label, target = key) {
   return { kind, key, label, target };
 }
 function normalizeWorkspace(workspace) {
-  return resolve12(workspace || process.cwd());
+  return resolve13(workspace || process.cwd());
 }
 function isInside(root, absolutePath) {
   const rel = relative4(root, absolutePath);
-  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep}`) && !isAbsolute(rel);
+  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep2}`) && !isAbsolute(rel);
 }
 function normalizeRelativePath(value) {
   const normalized = value.trim().replace(/^\.?\//, "").replace(/\\/g, "/");
@@ -28327,7 +28805,7 @@ function resolveFile(parsed, workspace) {
     resolution.warnings.push("path is empty or escapes the workspace");
     return resolution;
   }
-  const absolutePath = resolve12(workspace, relPath);
+  const absolutePath = resolve13(workspace, relPath);
   if (!isInside(workspace, absolutePath)) {
     resolution.path = relPath;
     resolution.warnings.push("path escapes the workspace");
@@ -29263,7 +29741,8 @@ function logApprovalEvent(taskId, action, gate, agentId, db) {
   if (action === "approved" || action === "rejected" || action === "expired") {
     emitLocalEventHooksQuiet({
       type: "approval.decided",
-      payload: { task_id: taskId, gate: gate.gate, status: gate.status, reviewer: gate.reviewer, run_id: gate.run_id }
+      payload: { task_id: taskId, gate: gate.gate, status: gate.status, reviewer: gate.reviewer, run_id: gate.run_id },
+      databasePath: databasePathFromDatabase(db)
     });
   }
 }
@@ -31913,14 +32392,14 @@ function renderReleaseNotesMarkdown(document) {
 init_database();
 init_migrations();
 import { existsSync as existsSync19, copyFileSync, mkdirSync as mkdirSync12, readFileSync as readFileSync16, statSync as statSync6, writeFileSync as writeFileSync10, unlinkSync } from "fs";
-import { dirname as dirname11, join as join15, resolve as resolve13 } from "path";
+import { dirname as dirname11, join as join15, resolve as resolve14 } from "path";
 import { Database as Database3 } from "bun:sqlite";
 var DB_BACKUP_SCHEMA = "todos.db_backup.v1";
 function resolveDbPath(dbPath) {
   if (dbPath)
-    return resolve13(dbPath);
+    return resolve14(dbPath);
   if (process.env["TODOS_DB_PATH"] && process.env["TODOS_DB_PATH"] !== ":memory:") {
-    return resolve13(process.env["TODOS_DB_PATH"]);
+    return resolve14(process.env["TODOS_DB_PATH"]);
   }
   const db = getDatabase();
   const filename = db.filename;
@@ -31959,7 +32438,7 @@ function restoreDatabase(backupPath, targetPath) {
   if (!integrity.ok) {
     throw new Error(`Backup failed integrity check: ${integrity.errors.join("; ")}`);
   }
-  const target = targetPath ? resolve13(targetPath) : resolveDbPath();
+  const target = targetPath ? resolve14(targetPath) : resolveDbPath();
   mkdirSync12(dirname11(target), { recursive: true });
   const staging = `${target}.restore.tmp`;
   copyFileSync(backupPath, staging);
@@ -31978,7 +32457,7 @@ function restoreDatabase(backupPath, targetPath) {
   };
 }
 function checkDatabaseIntegrity(dbPath) {
-  const path = dbPath ? resolve13(dbPath) : resolveDbPath();
+  const path = dbPath ? resolve14(dbPath) : resolveDbPath();
   const errors = [];
   if (!existsSync19(path)) {
     return {
@@ -32043,7 +32522,7 @@ function checkDatabaseIntegrity(dbPath) {
   };
 }
 function compactDatabase(dbPath) {
-  const path = dbPath ? resolve13(dbPath) : resolveDbPath();
+  const path = dbPath ? resolve14(dbPath) : resolveDbPath();
   const before = statSync6(path).size;
   const db = new Database3(path);
   db.exec("VACUUM");
@@ -32053,7 +32532,7 @@ function compactDatabase(dbPath) {
   return { path, bytes_before: before, bytes_after: after };
 }
 function migrationDryRun(dbPath) {
-  const path = dbPath ? resolve13(dbPath) : resolveDbPath();
+  const path = dbPath ? resolve14(dbPath) : resolveDbPath();
   const db = new Database3(path, { readonly: true });
   let current = 0;
   try {
@@ -32077,7 +32556,7 @@ function migrationDryRun(dbPath) {
   };
 }
 function defaultBackupPath(dbPath) {
-  const base = dbPath ? dirname11(resolve13(dbPath)) : dirname11(resolveDbPath());
+  const base = dbPath ? dirname11(resolve14(dbPath)) : dirname11(resolveDbPath());
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
   return join15(base, "backups", `todos-${stamp}.db`);
 }
@@ -35741,8 +36220,8 @@ todos machines topology      # full diagnostic report
 import { createHash as createHash12 } from "crypto";
 import { existsSync as existsSync20, readFileSync as readFileSync19, statSync as statSync7 } from "fs";
 import { hostname as hostname3, platform, arch } from "os";
-import { dirname as dirname15, join as join17, resolve as resolve14 } from "path";
-import { tmpdir as tmpdir2 } from "os";
+import { dirname as dirname15, join as join17, resolve as resolve15 } from "path";
+import { tmpdir as tmpdir3 } from "os";
 init_database();
 init_redaction();
 init_sync_utils();
@@ -35874,15 +36353,15 @@ function commandEnv(env, includeValues) {
 function defaultSnapshotDir() {
   const dbPath = getDatabasePath();
   if (dbPath === ":memory:" || dbPath.startsWith("file::memory:"))
-    return join17(tmpdir2(), "hasna-todos", "environment-snapshots");
-  return join17(dirname15(resolve14(dbPath)), "environment-snapshots");
+    return join17(tmpdir3(), "hasna-todos", "environment-snapshots");
+  return join17(dirname15(resolve15(dbPath)), "environment-snapshots");
 }
 function snapshotWithId(snapshot) {
   const digest = sha2565(JSON.stringify(snapshot)).slice(0, 24);
   return { id: `env_${digest}`, ...snapshot };
 }
 function captureEnvironmentSnapshot(input = {}) {
-  const root = resolve14(input.root || process.cwd());
+  const root = resolve15(input.root || process.cwd());
   const env = input.env || process.env;
   const warnings = [];
   const manifests = MANIFEST_FILES.map((file) => manifestRecord(root, file)).filter((file) => Boolean(file));
@@ -35922,13 +36401,13 @@ function captureEnvironmentSnapshot(input = {}) {
   });
 }
 function writeEnvironmentSnapshot(snapshot, outputPath) {
-  const path = outputPath ? resolve14(outputPath) : join17(defaultSnapshotDir(), `${snapshot.id}.json`);
+  const path = outputPath ? resolve15(outputPath) : join17(defaultSnapshotDir(), `${snapshot.id}.json`);
   ensureDir2(dirname15(path));
   writeJsonFile(path, snapshot);
   return path;
 }
 function readEnvironmentSnapshot(path) {
-  const snapshot = readJsonFile(resolve14(path));
+  const snapshot = readJsonFile(resolve15(path));
   if (!snapshot || snapshot.schema_version !== 1 || typeof snapshot.id !== "string") {
     throw new Error(`Invalid environment snapshot: ${path}`);
   }
@@ -37667,7 +38146,7 @@ function listLinkedTemplates(db, cwd) {
 init_database();
 import { mkdtempSync } from "fs";
 import { join as join21 } from "path";
-import { tmpdir as tmpdir3 } from "os";
+import { tmpdir as tmpdir4 } from "os";
 var AGENT_WORKFLOW_DEMO_SCHEMA = "todos.agent_workflow_demo.v1";
 var DEMO_DEFAULT_AGENT = "demoagent";
 var DEMO_DEFAULT_PROJECT = "Agent Workflow Demo";
@@ -37682,7 +38161,7 @@ function setupEphemeralDemoDb(options = {}) {
   if (options.db_path) {
     db_path = options.db_path;
   } else if (options.persist) {
-    db_path = join21(mkdtempSync(join21(tmpdir3(), "todos-demo-")), "todos.db");
+    db_path = join21(mkdtempSync(join21(tmpdir4(), "todos-demo-")), "todos.db");
   } else {
     db_path = ":memory:";
   }
@@ -38304,11 +38783,6 @@ var ALL_MCP_TOOLS = [
   "template_history",
   "todos_inbox",
   "todos_retro",
-  "todos_storage_conflicts",
-  "todos_storage_feedback",
-  "todos_storage_pull",
-  "todos_storage_push",
-  "todos_storage_status",
   "trust_workspace",
   "unarchive_agent",
   "unarchive_task",
@@ -38445,12 +38919,6 @@ var MCP_GROUP_DEFS = [
     description: "Sandbox, trust, secrets, crypto, and verification.",
     match: (t) => /sandbox|trust|secret|crypto|verification|policy_pack|redact|scan_/.test(t)
   },
-  {
-    id: "storage",
-    name: "Storage bridge",
-    description: "Optional storage sync tools (admin profile).",
-    match: (t) => t.startsWith("todos_storage_") || t === "sync_all" || t === "migrate_pg"
-  },
   {
     id: "workflow",
     name: "Workflow utilities",
@@ -40541,7 +41009,7 @@ function syncWithAgents(agents, taskListIdByAgent, projectId, direction = "both"
 // src/lib/extract.ts
 import { existsSync as existsSync25, readFileSync as readFileSync23, statSync as statSync8 } from "fs";
 import { createHash as createHash14 } from "crypto";
-import { relative as relative6, resolve as resolve15, join as join24 } from "path";
+import { relative as relative6, resolve as resolve16, join as join24 } from "path";
 var EXTRACT_TAGS = ["TODO", "FIXME", "HACK", "XXX", "BUG", "NOTE"];
 var DEFAULT_EXTENSIONS = new Set([
   ".ts",
@@ -40611,7 +41079,7 @@ function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function readGitignorePatterns(basePath) {
-  const root = statSync8(basePath).isFile() ? resolve15(basePath, "..") : basePath;
+  const root = statSync8(basePath).isFile() ? resolve16(basePath, "..") : basePath;
   const gitignorePath = join24(root, ".gitignore");
   if (!existsSync25(gitignorePath))
     return [];
@@ -40747,7 +41215,7 @@ function collectFiles(basePath, extensions, excludes, respectGitignore) {
   return files.sort();
 }
 function buildCodebaseIndex(options) {
-  const basePath = resolve15(options.path);
+  const basePath = resolve16(options.path);
   const tags = options.patterns || [...EXTRACT_TAGS];
   const extensions = options.extensions ? new Set(options.extensions.map((e) => e.startsWith(".") ? e : `.${e}`)) : DEFAULT_EXTENSIONS;
   const excludes = options.exclude || [];
@@ -40758,7 +41226,7 @@ function buildCodebaseIndex(options) {
     const fullPath = statSync8(basePath).isFile() ? basePath : join24(basePath, file);
     try {
       const source9 = readFileSync23(fullPath, "utf-8");
-      const relPath = statSync8(basePath).isFile() ? relative6(resolve15(basePath, ".."), fullPath) : file;
+      const relPath = statSync8(basePath).isFile() ? relative6(resolve16(basePath, ".."), fullPath) : file;
       indexed.push({
         file: relPath,
         checksum: stableHash(source9).slice(0, 24),
@@ -40778,7 +41246,7 @@ function buildCodebaseIndex(options) {
   };
 }
 function extractTodos(options, db) {
-  const basePath = resolve15(options.path);
+  const basePath = resolve16(options.path);
   const tags = options.patterns || [...EXTRACT_TAGS];
   const extensions = options.extensions ? new Set(options.extensions.map((e) => e.startsWith(".") ? e : `.${e}`)) : DEFAULT_EXTENSIONS;
   const excludes = options.exclude || [];
@@ -40789,7 +41257,7 @@ function extractTodos(options, db) {
     const fullPath = statSync8(basePath).isFile() ? basePath : join24(basePath, file);
     try {
       const source9 = readFileSync23(fullPath, "utf-8");
-      const relPath = statSync8(basePath).isFile() ? relative6(resolve15(basePath, ".."), fullPath) : file;
+      const relPath = statSync8(basePath).isFile() ? relative6(resolve16(basePath, ".."), fullPath) : file;
       const comments = extractFromSource(source9, relPath, tags);
       allComments.push(...comments);
     } catch {}
@@ -40883,7 +41351,7 @@ async function watchSourceTodos(options, onRun) {
   const interval = Math.max(100, options.interval_ms || 2000);
   const once = options.once !== false && (!options.max_runs || options.max_runs <= 1);
   const maxRuns = options.max_runs ?? (once ? 1 : Number.POSITIVE_INFINITY);
-  const root = resolve15(options.path);
+  const root = resolve16(options.path);
   const runs = [];
   let previous = new Map;
   for (let runNumber = 1;runNumber <= maxRuns; runNumber++) {
@@ -41756,7 +42224,7 @@ function renderAgentReplaySimulationMarkdown(simulation) {
 init_config();
 import { createHash as createHash16, createVerify } from "crypto";
 import { existsSync as existsSync26, readdirSync as readdirSync5, readFileSync as readFileSync25, statSync as statSync9 } from "fs";
-import { basename as basename5, join as join25, resolve as resolve16 } from "path";
+import { basename as basename5, join as join25, resolve as resolve17 } from "path";
 init_redaction();
 function isObject2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -42036,7 +42504,7 @@ function verifyExtensionSignature(input) {
   return verifier.verify(input.public_key, decodeSignature(input.signature));
 }
 function inspectExtensionSource(source9) {
-  const resolved = resolve16(source9);
+  const resolved = resolve17(source9);
   if (!existsSync26(resolved))
     throw new Error(`extension source not found: ${source9}`);
   const stat = statSync9(resolved);
@@ -42134,7 +42602,7 @@ function testExtensionCompatibility(sourceOrManifest) {
 function projectExtensionSources(projectPath) {
   if (!projectPath)
     return [];
-  const root = resolve16(projectPath);
+  const root = resolve17(projectPath);
   const candidates = [
     join25(root, "todos.extension.json"),
     join25(root, ".todos", "todos.extension.json")
@@ -42153,7 +42621,7 @@ function projectExtensionSources(projectPath) {
 }
 function discoverLocalExtensions(options = {}) {
   const config = loadConfig();
-  const projectPath = options.project_path ? resolve16(options.project_path) : null;
+  const projectPath = options.project_path ? resolve17(options.project_path) : null;
   const configuredSources = [
     ...config.extension_sources || [],
     ...projectPath ? config.project_overrides?.[projectPath]?.extension_sources || [] : []
@@ -42161,7 +42629,7 @@ function discoverLocalExtensions(options = {}) {
   const sources = Array.from(new Set([
     ...configuredSources,
     ...projectExtensionSources(projectPath || undefined)
-  ])).map((source9) => projectPath && !source9.startsWith("/") ? resolve16(projectPath, source9) : resolve16(source9));
+  ])).map((source9) => projectPath && !source9.startsWith("/") ? resolve17(projectPath, source9) : resolve17(source9));
   const warnings = [];
   const discovered = [];
   for (const source9 of sources) {