@hasna/todos 0.11.66 → 0.11.68

package/dist/server/index.js

@@ -1232,6 +1232,22 @@ var init_migrations = __esm(() => {
   CREATE INDEX IF NOT EXISTS idx_task_findings_source ON task_findings(source);
   CREATE INDEX IF NOT EXISTS idx_task_findings_fingerprint ON task_findings(fingerprint);
   INSERT OR IGNORE INTO _migrations (id) VALUES (62);
+  `,
+    `
+  CREATE TABLE IF NOT EXISTS storage_tombstones (
+    id TEXT PRIMARY KEY,
+    object_type TEXT NOT NULL,
+    object_id TEXT NOT NULL,
+    deleted_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    source_machine_id TEXT,
+    payload TEXT,
+    version INTEGER,
+    UNIQUE(object_type, object_id)
+  );
+  CREATE INDEX IF NOT EXISTS idx_storage_tombstones_object ON storage_tombstones(object_type, object_id);
+  CREATE INDEX IF NOT EXISTS idx_storage_tombstones_updated ON storage_tombstones(updated_at);
+  INSERT OR IGNORE INTO _migrations (id) VALUES (63);
   `
   ];
 });
@@ -1753,6 +1769,20 @@ function ensureSchema(db) {
     )`);
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_project_machine_paths_project ON project_machine_paths(project_id)");
   ensureIndex("CREATE INDEX IF NOT EXISTS idx_project_machine_paths_machine ON project_machine_paths(machine_id)");
+  ensureTable("storage_tombstones", `
+    CREATE TABLE storage_tombstones (
+      id TEXT PRIMARY KEY,
+      object_type TEXT NOT NULL,
+      object_id TEXT NOT NULL,
+      deleted_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      source_machine_id TEXT,
+      payload TEXT,
+      version INTEGER,
+      UNIQUE(object_type, object_id)
+    )`);
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_storage_tombstones_object ON storage_tombstones(object_type, object_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_storage_tombstones_updated ON storage_tombstones(updated_at)");
   ensureTable("machines", `
     CREATE TABLE machines (
       id TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE, hostname TEXT, platform TEXT,
@@ -3077,6 +3107,65 @@ var init_config = __esm(() => {
   };
 });
 
+// src/db/storage-tombstones.ts
+function recordStorageTombstone(input, db) {
+  const d = db ?? getDatabase();
+  const deletedAt = input.deleted_at ?? now();
+  const machineId = input.source_machine_id ?? currentStorageMachineId(d);
+  d.run(`INSERT INTO storage_tombstones (
+       id, object_type, object_id, deleted_at, updated_at, source_machine_id, payload, version
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(object_type, object_id) DO UPDATE SET
+       deleted_at = excluded.deleted_at,
+       updated_at = excluded.updated_at,
+       source_machine_id = excluded.source_machine_id,
+       payload = excluded.payload,
+       version = excluded.version
+     WHERE storage_tombstones.updated_at IS NULL OR storage_tombstones.updated_at <= excluded.updated_at`, [
+    uuid(),
+    input.object_type,
+    input.object_id,
+    deletedAt,
+    deletedAt,
+    machineId,
+    input.payload ? JSON.stringify(input.payload) : null,
+    input.version ?? null
+  ]);
+  return getStorageTombstone(input.object_type, input.object_id, d);
+}
+function getStorageTombstone(objectType, objectId, db) {
+  const d = db ?? getDatabase();
+  const row = d.query("SELECT * FROM storage_tombstones WHERE object_type = ? AND object_id = ?").get(objectType, objectId);
+  return row ? rowToStorageTombstone(row) : null;
+}
+function rowToStorageTombstone(row) {
+  return {
+    ...row,
+    payload: parsePayload(row.payload)
+  };
+}
+function parsePayload(value) {
+  if (!value)
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function currentStorageMachineId(db) {
+  try {
+    return getMachineId(db);
+  } catch {
+    return null;
+  }
+}
+var init_storage_tombstones = __esm(() => {
+  init_database();
+  init_machines();
+});
+
 // src/db/projects.ts
 var exports_projects = {};
 __export(exports_projects, {
@@ -3128,8 +3217,9 @@ function createProject(input, db) {
   const timestamp = now();
   const taskListId = input.task_list_id ?? `todos-${slugify(input.name)}`;
   const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
-  d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp]);
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp, timestamp, machineId]);
   return getProject(id, d);
 }
 function getProject(id, db) {
@@ -3208,6 +3298,14 @@ function renameProject(id, input, db) {
 }
 function deleteProject(id, db) {
   const d = db || getDatabase();
+  const project = getProject(id, d);
+  if (!project)
+    return false;
+  recordStorageTombstone({
+    object_type: "projects",
+    object_id: id,
+    payload: project
+  }, d);
   const result = d.run("DELETE FROM projects WHERE id = ?", [id]);
   return result.changes > 0;
 }
@@ -3312,6 +3410,14 @@ function listMachineLocalPaths(projectId, db) {
 function removeMachineLocalPath(projectId, machineId, db) {
   const d = db || getDatabase();
   const mid = machineId ?? getMachineId(d);
+  const existing = d.query("SELECT * FROM project_machine_paths WHERE project_id = ? AND machine_id = ?").get(projectId, mid);
+  if (!existing)
+    return false;
+  recordStorageTombstone({
+    object_type: "project_machine_paths",
+    object_id: existing.id,
+    payload: existing
+  }, d);
   const result = d.run("DELETE FROM project_machine_paths WHERE project_id = ? AND machine_id = ?", [projectId, mid]);
   return result.changes > 0;
 }
@@ -3319,6 +3425,7 @@ var init_projects = __esm(() => {
   init_types();
   init_database();
   init_machines();
+  init_storage_tombstones();
 });
 
 // src/lib/completion-guard.ts
@@ -3370,6 +3477,57 @@ var init_completion_guard = __esm(() => {
   init_projects();
 });
 
+// src/lib/event-emission-safety.ts
+import { tmpdir } from "os";
+import { resolve as resolve3, sep } from "path";
+function envFlag(name) {
+  const value = process.env[name];
+  return value === "1" || value === "true" || value === "yes";
+}
+function isUnder(parent, child) {
+  const normalizedParent = resolve3(parent);
+  const normalizedChild = resolve3(child);
+  return normalizedChild === normalizedParent || normalizedChild.startsWith(`${normalizedParent}${sep}`);
+}
+function databasePathFromDatabase(db) {
+  const filename = db?.filename;
+  return typeof filename === "string" && filename.trim() ? filename : undefined;
+}
+function isEphemeralTodosDatabase(dbPath) {
+  const resolvedPath = dbPath ?? getDatabasePath();
+  if (resolvedPath === ":memory:" || resolvedPath.startsWith("file::memory:"))
+    return true;
+  return isUnder(tmpdir(), resolvedPath);
+}
+function hasExplicitSharedEventsStore() {
+  return Boolean(process.env["HASNA_EVENTS_DIR"] || process.env["HASNA_EVENTS_HOME"]);
+}
+function usesIsolatedTodosHome() {
+  return isUnder(tmpdir(), getTodosGlobalDir());
+}
+function shouldEmitSharedTaskEvents(dbPath) {
+  if (envFlag("TODOS_DISABLE_SHARED_EVENTS"))
+    return false;
+  if (envFlag("TODOS_ALLOW_EPHEMERAL_SHARED_EVENTS"))
+    return true;
+  if (!isEphemeralTodosDatabase(dbPath))
+    return true;
+  return hasExplicitSharedEventsStore();
+}
+function shouldDeliverLocalLifecycleHooks(dbPath) {
+  if (envFlag("TODOS_DISABLE_LOCAL_EVENT_HOOKS"))
+    return false;
+  if (envFlag("TODOS_ALLOW_EPHEMERAL_LOCAL_EVENT_HOOKS"))
+    return true;
+  if (!isEphemeralTodosDatabase(dbPath))
+    return true;
+  return usesIsolatedTodosHome();
+}
+var init_event_emission_safety = __esm(() => {
+  init_database();
+  init_sync_utils();
+});
+
 // src/lib/redaction.ts
 function unique(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -3470,9 +3628,9 @@ var init_redaction = __esm(() => {
 });
 
 // src/lib/workspace-trust.ts
-import { relative, resolve as resolve3 } from "path";
+import { relative, resolve as resolve4 } from "path";
 function normalizePath(path) {
-  return resolve3(path);
+  return resolve4(path);
 }
 function unique2(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -3654,9 +3812,9 @@ var init_workspace_trust = __esm(() => {
 });
 
 // src/lib/runner-sandbox.ts
-import { relative as relative2, resolve as resolve4 } from "path";
+import { relative as relative2, resolve as resolve5 } from "path";
 function normalizePath2(path) {
-  return resolve4(path);
+  return resolve5(path);
 }
 function unique3(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -3846,7 +4004,7 @@ var init_runner_sandbox = __esm(() => {
 // src/lib/event-hooks.ts
 import { createHash as createHash2, randomUUID } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
-import { dirname as dirname4, resolve as resolve5 } from "path";
+import { dirname as dirname4, resolve as resolve6 } from "path";
 import { createConnection } from "net";
 function safeName(name) {
   const trimmed = name.trim();
@@ -3984,7 +4142,7 @@ async function deliverHook(hook, envelope) {
       if (hook.target === "stdout") {
         output = line.trim();
       } else if (hook.target === "file") {
-        const filePath = resolve5(hook.file_path);
+        const filePath = resolve6(hook.file_path);
         mkdirSync3(dirname4(filePath), { recursive: true });
         appendFileSync(filePath, line);
       } else if (hook.target === "socket") {
@@ -4059,6 +4217,8 @@ async function emitLocalEventHooks(input) {
   return Promise.all(hooks.map((hook) => deliverHook(hook, envelope)));
 }
 function emitLocalEventHooksQuiet(input) {
+  if (!shouldDeliverLocalLifecycleHooks(input.databasePath))
+    return;
   emitLocalEventHooks(input).catch(() => {});
 }
 async function testLocalEventHook(name, input) {
@@ -4072,6 +4232,7 @@ var init_event_hooks = __esm(() => {
   init_redaction();
   init_runner_sandbox();
   init_config();
+  init_event_emission_safety();
   LOCAL_EVENT_TYPES = [
     "task.created",
     "task.assigned",
@@ -4404,7 +4565,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -4422,7 +4583,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve6({
+      resolve7({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -4435,7 +4596,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve6({
+      resolve7({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -4702,14 +4863,15 @@ function createTaskList(input, db) {
   const id = uuid();
   const timestamp = now();
   const slug = input.slug || slugify(input.name);
+  const machineId = currentStorageMachineId(d);
   if (!input.project_id) {
     const existing = d.query("SELECT id FROM task_lists WHERE project_id IS NULL AND slug = ?").get(slug);
     if (existing) {
       throw new Error(`Standalone task list with slug "${slug}" already exists`);
     }
   }
-  d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp]);
+  d.run(`INSERT INTO task_lists (id, project_id, slug, name, description, metadata, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, input.project_id || null, slug, input.name, input.description || null, JSON.stringify(input.metadata || {}), timestamp, timestamp, machineId]);
   return getTaskList(id, d);
 }
 function getTaskList(id, db) {
@@ -4759,6 +4921,14 @@ function updateTaskList(id, input, db) {
 }
 function deleteTaskList(id, db) {
   const d = db || getDatabase();
+  const list = getTaskList(id, d);
+  if (!list)
+    return false;
+  recordStorageTombstone({
+    object_type: "task_lists",
+    object_id: id,
+    payload: list
+  }, d);
   return d.run("DELETE FROM task_lists WHERE id = ?", [id]).changes > 0;
 }
 function ensureTaskList(name, slug, projectId, db) {
@@ -4772,6 +4942,7 @@ var init_task_lists = __esm(() => {
   init_types();
   init_database();
   init_projects();
+  init_storage_tombstones();
 });
 
 // src/lib/task-route-contract.ts
@@ -4975,6 +5146,8 @@ function readMachineLocalPath(project) {
   }
 }
 async function emitSharedTaskEvent(input) {
+  if (!shouldEmitSharedTaskEvents(input.databasePath))
+    return;
   const data = taskEventData(input.task, input.data);
   await new EventsClient().emit({
     source: SOURCE,
@@ -4998,6 +5171,7 @@ var init_shared_events = __esm(() => {
   init_database();
   init_projects();
   init_task_lists();
+  init_event_emission_safety();
 });
 
 // src/lib/secret-redaction.ts
@@ -5246,8 +5420,9 @@ function logTaskChange(taskId, action, field, oldValue, newValue, agentId, db) {
   const d = db || getDatabase();
   const id = uuid();
   const timestamp = now();
-  d.run(`INSERT INTO task_history (id, task_id, action, field, old_value, new_value, agent_id, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field || null, oldValue ?? null, newValue ?? null, agentId || null, timestamp]);
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO task_history (id, task_id, action, field, old_value, new_value, agent_id, created_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field || null, oldValue ?? null, newValue ?? null, agentId || null, timestamp, machineId]);
   try {
     const { logActivity: logActivity2 } = (init_activity_audit(), __toCommonJS(exports_activity_audit));
     logActivity2({
@@ -5260,7 +5435,7 @@ function logTaskChange(taskId, action, field, oldValue, newValue, agentId, db) {
       actor_id: agentId ?? undefined
     }, d);
   } catch {}
-  return { id, task_id: taskId, action, field: field || null, old_value: oldValue ?? null, new_value: newValue ?? null, agent_id: agentId || null, created_at: timestamp };
+  return { id, task_id: taskId, action, field: field || null, old_value: oldValue ?? null, new_value: newValue ?? null, agent_id: agentId || null, created_at: timestamp, machine_id: machineId };
 }
 function getTaskHistory(taskId, db) {
   const d = db || getDatabase();
@@ -5272,6 +5447,7 @@ function getRecentActivity(limit = 50, db) {
 }
 var init_audit = __esm(() => {
   init_database();
+  init_storage_tombstones();
 });
 
 // src/db/webhooks.ts
@@ -5537,13 +5713,14 @@ function createTask(input, db) {
   const d = db || getDatabase();
   const timestamp = now();
   const tags = input.tags || [];
+  const machineId = currentStorageMachineId(d);
   const assignedBy = input.assigned_by || input.agent_id;
   const assignedFromProject = input.assigned_from_project || null;
   let id = uuid();
   for (let attempt = 0;attempt < 3; attempt++) {
     try {
-      d.run(`INSERT INTO tasks (id, short_id, project_id, parent_id, plan_id, task_list_id, cycle_id, title, description, status, priority, agent_id, assigned_to, session_id, working_dir, tags, metadata, version, created_at, updated_at, due_at, estimated_minutes, sla_minutes, confidence, retry_count, max_retries, retry_after, requires_approval, approved_by, approved_at, recurrence_rule, recurrence_parent_id, spawns_template_id, reason, spawned_from_session, assigned_by, assigned_from_project, task_type)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      d.run(`INSERT INTO tasks (id, short_id, project_id, parent_id, plan_id, task_list_id, cycle_id, title, description, status, priority, agent_id, assigned_to, session_id, working_dir, tags, metadata, version, created_at, updated_at, due_at, estimated_minutes, sla_minutes, confidence, retry_count, max_retries, retry_after, requires_approval, approved_by, approved_at, recurrence_rule, recurrence_parent_id, spawns_template_id, reason, spawned_from_session, assigned_by, assigned_from_project, task_type, machine_id)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
         id,
         null,
         input.project_id || null,
@@ -5580,7 +5757,8 @@ function createTask(input, db) {
         input.spawned_from_session || null,
         assignedBy || null,
         assignedFromProject || null,
-        input.task_type || null
+        input.task_type || null,
+        machineId
       ]);
       break;
     } catch (e) {
@@ -5596,9 +5774,10 @@ function createTask(input, db) {
   }
   const task = getTask(id, d);
   const payload = taskEventData(task);
+  const databasePath = databasePathFromDatabase(d);
   dispatchWebhook2("task.created", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.created", payload });
-  emitSharedTaskEventQuiet({ type: "task.created", task });
+  emitLocalEventHooksQuiet({ type: "task.created", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.created", task, databasePath });
   return task;
 }
 function getTask(id, db) {
@@ -6016,29 +6195,39 @@ function updateTask(id, input, db) {
     approved_by: input.approved_by ?? task.approved_by,
     approved_at: input.approved_by ? timestamp : task.approved_at
   };
+  const databasePath = databasePathFromDatabase(d);
   if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to) {
     const payload = taskEventData(updatedTask, { assigned_to: input.assigned_to, old_assigned_to: task.assigned_to });
     dispatchWebhook2("task.assigned", payload, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.assigned", payload });
-    emitSharedTaskEventQuiet({ type: "task.assigned", task: updatedTask, data: { old_assigned_to: task.assigned_to } });
+    emitLocalEventHooksQuiet({ type: "task.assigned", payload, databasePath });
+    emitSharedTaskEventQuiet({ type: "task.assigned", task: updatedTask, data: { old_assigned_to: task.assigned_to }, databasePath });
   }
   if (input.status !== undefined && input.status !== task.status) {
     const payload = taskEventData(updatedTask, { old_status: task.status, new_status: input.status });
     dispatchWebhook2("task.status_changed", payload, d).catch(() => {});
-    emitLocalEventHooksQuiet({ type: "task.status_changed", payload });
-    emitSharedTaskEventQuiet({ type: "task.status_changed", task: updatedTask, data: { old_status: task.status, new_status: input.status } });
+    emitLocalEventHooksQuiet({ type: "task.status_changed", payload, databasePath });
+    emitSharedTaskEventQuiet({ type: "task.status_changed", task: updatedTask, data: { old_status: task.status, new_status: input.status }, databasePath });
   }
   if (input.approved_by !== undefined) {
-    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title } });
+    emitLocalEventHooksQuiet({ type: "approval.decided", payload: { id, approved_by: input.approved_by, title: task.title }, databasePath });
   }
   const updatePayload = taskEventData(updatedTask);
   dispatchWebhook2("task.updated", updatePayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.updated", payload: updatePayload });
-  emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask });
+  emitLocalEventHooksQuiet({ type: "task.updated", payload: updatePayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.updated", task: updatedTask, databasePath });
   return updatedTask;
 }
 function deleteTask(id, db) {
   const d = db || getDatabase();
+  const row = d.query("SELECT * FROM tasks WHERE id = ?").get(id);
+  if (!row)
+    return false;
+  recordStorageTombstone({
+    object_type: "tasks",
+    object_id: id,
+    payload: rowToTask(row),
+    version: row.version
+  }, d);
   const result = d.run("DELETE FROM tasks WHERE id = ?", [id]);
   return result.changes > 0;
 }
@@ -6046,11 +6235,13 @@ var init_task_crud = __esm(() => {
   init_types();
   init_database();
   init_completion_guard();
+  init_event_emission_safety();
   init_event_hooks();
   init_shared_events();
   init_audit();
   init_webhooks();
   init_checklists();
+  init_storage_tombstones();
 });
 
 // src/lib/recurrence.ts
@@ -6199,8 +6390,9 @@ function resolveTemplateId(id, d) {
 function createTemplate(input, db) {
   const d = db || getDatabase();
   const id = uuid();
-  d.run(`INSERT INTO task_templates (id, name, title_pattern, description, priority, tags, variables, project_id, plan_id, metadata, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO task_templates (id, name, title_pattern, description, priority, tags, variables, project_id, plan_id, metadata, created_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     input.name,
     input.title_pattern,
@@ -6211,7 +6403,8 @@ function createTemplate(input, db) {
     input.project_id || null,
     input.plan_id || null,
     JSON.stringify(input.metadata || {}),
-    now()
+    now(),
+    machineId
   ]);
   if (input.tasks && input.tasks.length > 0) {
     addTemplateTasks(id, input.tasks, d);
@@ -6235,6 +6428,15 @@ function deleteTemplate(id, db) {
   const resolved = resolveTemplateId(id, d);
   if (!resolved)
     return false;
+  const template = getTemplate(resolved, d);
+  if (!template)
+    return false;
+  recordStorageTombstone({
+    object_type: "templates",
+    object_id: resolved,
+    payload: template,
+    version: template.version
+  }, d);
   return d.run("DELETE FROM task_templates WHERE id = ?", [resolved]).changes > 0;
 }
 function updateTemplate(id, updates, db) {
@@ -6604,6 +6806,7 @@ function previewTemplate(templateId, variables, db) {
 var init_templates = __esm(() => {
   init_database();
   init_tasks();
+  init_storage_tombstones();
 });
 
 // src/db/task-graph.ts
@@ -6770,6 +6973,7 @@ function getBlockingDeps(id, db) {
 }
 function startTask(id, agentId, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -6784,7 +6988,8 @@ function startTask(id, agentId, db) {
         agent_id: agentId,
         title: task.title,
         blockers: blocking.map((b) => ({ id: b.id, short_id: b.short_id, title: b.title, status: b.status }))
-      }
+      },
+      databasePath
     });
     throw new Error(`Task is blocked by ${blocking.length} unfinished dependency(ies): ${blockerIds}`);
   }
@@ -6806,12 +7011,13 @@ function startTask(id, agentId, db) {
   const startedTask = { ...task, status: "in_progress", assigned_to: agentId, locked_by: agentId, locked_at: timestamp, started_at: task.started_at || timestamp, version: task.version + 1, updated_at: timestamp };
   const payload = taskEventData(startedTask, { agent_id: agentId });
   dispatchWebhook2("task.started", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.started", payload });
-  emitSharedTaskEventQuiet({ type: "task.started", task: startedTask, data: { agent_id: agentId } });
+  emitLocalEventHooksQuiet({ type: "task.started", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.started", task: startedTask, data: { agent_id: agentId }, databasePath });
   return startedTask;
 }
 function completeTask(id, agentId, db, options) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -6857,8 +7063,8 @@ function completeTask(id, agentId, db, options) {
   };
   const completionPayload = taskEventData(completedTaskForEvent, { agent_id: agentId, completed_at: timestamp });
   dispatchWebhook2("task.completed", completionPayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload });
-  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp } });
+  emitLocalEventHooksQuiet({ type: "task.completed", payload: completionPayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.completed", task: completedTaskForEvent, data: { agent_id: agentId, completed_at: timestamp }, databasePath });
   let spawnedTask = null;
   if (task.recurrence_rule && !options?.skip_recurrence) {
     spawnedTask = spawnNextRecurrence(task, d, timestamp);
@@ -6902,9 +7108,9 @@ function completeTask(id, agentId, db, options) {
       const depTask = getTask(dep.id, d);
       const payload = depTask ? taskEventData(depTask, { unblocked_by: id }) : { id: dep.id, unblocked_by: id, title: dep.title };
       dispatchWebhook2("task.unblocked", payload, d).catch(() => {});
-      emitLocalEventHooksQuiet({ type: "task.unblocked", payload });
+      emitLocalEventHooksQuiet({ type: "task.unblocked", payload, databasePath });
       if (depTask)
-        emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id } });
+        emitSharedTaskEventQuiet({ type: "task.unblocked", task: depTask, data: { unblocked_by: id }, databasePath });
     }
   }
   return { ...task, status: "completed", locked_by: null, locked_at: null, completed_at: timestamp, confidence, version: task.version + 1, updated_at: timestamp, metadata: meta };
@@ -7074,6 +7280,7 @@ function getTasksChangedSince(since, filters, db) {
 }
 function failTask(id, agentId, reason, options, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
@@ -7102,8 +7309,8 @@ function failTask(id, agentId, reason, options, db) {
   logTaskChange(id, "fail", "status", task.status, "failed", agentId || null, d);
   const failurePayload = taskEventData(failedTask, { reason, error_code: options?.error_code, agent_id: agentId });
   dispatchWebhook2("task.failed", failurePayload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload });
-  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning" });
+  emitLocalEventHooksQuiet({ type: "task.failed", payload: failurePayload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.failed", task: failedTask, data: { reason, error_code: options?.error_code, agent_id: agentId }, severity: "warning", databasePath });
   let retryTask;
   if (options?.retry) {
     const retryCount = (task.retry_count || 0) + 1;
@@ -7163,6 +7370,7 @@ function getStaleTasks(staleQuery = 30, filters, db) {
 }
 function stealTask(agentId, opts, db) {
   const d = db || getDatabase();
+  const databasePath = databasePathFromDatabase(d);
   const staleMinutes = opts?.stale_minutes ?? 30;
   const staleTasks = getStaleTasks(staleMinutes, { project_id: opts?.project_id, task_list_id: opts?.task_list_id }, d);
   if (staleTasks.length === 0)
@@ -7181,8 +7389,8 @@ function stealTask(agentId, opts, db) {
   const stolenTask = { ...target, assigned_to: agentId, locked_by: agentId, locked_at: timestamp, updated_at: timestamp, version: target.version + 1 };
   const payload = taskEventData(stolenTask, { agent_id: agentId, stolen_from: target.assigned_to });
   dispatchWebhook2("task.assigned", payload, d).catch(() => {});
-  emitLocalEventHooksQuiet({ type: "task.assigned", payload });
-  emitSharedTaskEventQuiet({ type: "task.assigned", task: stolenTask, data: { agent_id: agentId, stolen_from: target.assigned_to } });
+  emitLocalEventHooksQuiet({ type: "task.assigned", payload, databasePath });
+  emitSharedTaskEventQuiet({ type: "task.assigned", task: stolenTask, data: { agent_id: agentId, stolen_from: target.assigned_to }, databasePath });
   return stolenTask;
 }
 function claimOrSteal(agentId, filters, db) {
@@ -7230,6 +7438,7 @@ var init_task_lifecycle = __esm(() => {
   init_types();
   init_database();
   init_completion_guard();
+  init_event_emission_safety();
   init_event_hooks();
   init_shared_events();
   init_audit();
@@ -7937,8 +8146,9 @@ function createPlan(input, db) {
   const d = db || getDatabase();
   const id = uuid();
   const timestamp = now();
-  d.run(`INSERT INTO plans (id, project_id, task_list_id, agent_id, name, description, status, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  const machineId = currentStorageMachineId(d);
+  d.run(`INSERT INTO plans (id, project_id, task_list_id, agent_id, name, description, status, created_at, updated_at, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     input.project_id || null,
     input.task_list_id || null,
@@ -7947,7 +8157,8 @@ function createPlan(input, db) {
     input.description || null,
     input.status || "active",
     timestamp,
-    timestamp
+    timestamp,
+    machineId
   ]);
   return getPlan(id, d);
 }
@@ -7995,19 +8206,30 @@ function updatePlan(id, input, db) {
   const updated = getPlan(id, d);
   emitLocalEventHooksQuiet({
     type: "plan.updated",
-    payload: { id, old_status: plan.status, new_status: updated.status, name: updated.name, project_id: updated.project_id }
+    payload: { id, old_status: plan.status, new_status: updated.status, name: updated.name, project_id: updated.project_id },
+    databasePath: databasePathFromDatabase(d)
   });
   return updated;
 }
 function deletePlan(id, db) {
   const d = db || getDatabase();
+  const plan = getPlan(id, d);
+  if (!plan)
+    return false;
+  recordStorageTombstone({
+    object_type: "plans",
+    object_id: id,
+    payload: plan
+  }, d);
   const result = d.run("DELETE FROM plans WHERE id = ?", [id]);
   return result.changes > 0;
 }
 var init_plans = __esm(() => {
   init_types();
+  init_event_emission_safety();
   init_event_hooks();
   init_database();
+  init_storage_tombstones();
 });
 
 // src/db/boards.ts
@@ -8414,20 +8636,20 @@ var init_boards = __esm(() => {
 // src/lib/artifact-store.ts
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname5, join as join6, resolve as resolve6 } from "path";
-import { tmpdir } from "os";
+import { basename, dirname as dirname5, join as join6, resolve as resolve7 } from "path";
+import { tmpdir as tmpdir2 } from "os";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
 function artifactStoreRoot() {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve6(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve7(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve6(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve7(process.env["TODOS_ARTIFACTS_DIR"]);
   const dbPath = getDatabasePath();
   if (isInMemoryDb2(dbPath))
-    return join6(tmpdir(), "hasna-todos-artifacts");
-  return join6(dirname5(resolve6(dbPath)), "artifacts");
+    return join6(tmpdir2(), "hasna-todos-artifacts");
+  return join6(dirname5(resolve7(dbPath)), "artifacts");
 }
 function artifactStorePath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
@@ -8474,7 +8696,7 @@ function mediaTypeFor(path, textLike) {
   return "application/octet-stream";
 }
 function storeArtifactContent(input) {
-  const sourcePath = resolve6(input.path);
+  const sourcePath = resolve7(input.path);
   if (!existsSync7(sourcePath))
     return null;
   const sourceStat = statSync2(sourcePath);
@@ -9171,7 +9393,11 @@ function startTaskRun(input, db) {
     }, d);
   }
   const run = getTaskRun(id, d);
-  emitLocalEventHooksQuiet({ type: "run.started", payload: { id: run.id, task_id: run.task_id, agent_id: run.agent_id, title: run.title } });
+  emitLocalEventHooksQuiet({
+    type: "run.started",
+    payload: { id: run.id, task_id: run.task_id, agent_id: run.agent_id, title: run.title },
+    databasePath: databasePathFromDatabase(d)
+  });
   return run;
 }
 function beginTaskRunTransaction(input, db) {
@@ -9440,7 +9666,8 @@ function finishTaskRun(input, db) {
   const updated = getTaskRun(run.id, d);
   emitLocalEventHooksQuiet({
     type: `run.${input.status}`,
-    payload: { id: updated.id, task_id: updated.task_id, agent_id: updated.agent_id, status: updated.status, summary: updated.summary, completed_at: timestamp }
+    payload: { id: updated.id, task_id: updated.task_id, agent_id: updated.agent_id, status: updated.status, summary: updated.summary, completed_at: timestamp },
+    databasePath: databasePathFromDatabase(d)
   });
   return updated;
 }
@@ -9524,6 +9751,7 @@ function getTaskRunLedger(runId, db) {
 var LOOP_RUN_TRANSACTION_SCHEMA_VERSION = "todos.loop_run_transaction.v1";
 var init_task_runs = __esm(() => {
   init_artifact_store();
+  init_event_emission_safety();
   init_event_hooks();
   init_redaction();
   init_types();
@@ -10410,6 +10638,7 @@ function rowToAgent(row) {
 }
 function registerAgent(input, db) {
   const d = db || getDatabase();
+  const machineId = currentStorageMachineId(d);
   const existingNames = d.query("SELECT name FROM agents").all().map((row) => row.name);
   const normalizedName = validateAgentName(input.name, existingNames);
   const existing = getAgentByName(normalizedName, d);
@@ -10450,14 +10679,18 @@ function registerAgent(input, db) {
       updates.push("active_project_id = ?");
       params.push(input.project_id);
     }
+    if (!existing.machine_id && machineId) {
+      updates.push("machine_id = ?");
+      params.push(machineId);
+    }
     params.push(existing.id);
     d.run(`UPDATE agents SET ${updates.join(", ")} WHERE id = ?`, params);
     return getAgent(existing.id, d);
   }
   const id = shortUuid();
   const timestamp = now();
-  d.run(`INSERT INTO agents (id, name, description, role, title, level, permissions, capabilities, reports_to, org_id, metadata, created_at, last_seen_at, session_id, working_dir, active_project_id)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+  d.run(`INSERT INTO agents (id, name, description, role, title, level, permissions, capabilities, reports_to, org_id, metadata, created_at, last_seen_at, session_id, working_dir, active_project_id, machine_id)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     id,
     normalizedName,
     input.description || null,
@@ -10473,7 +10706,8 @@ function registerAgent(input, db) {
     timestamp,
     input.session_id || null,
     input.working_dir || null,
-    input.project_id && input.session_id ? input.project_id : null
+    input.project_id && input.session_id ? input.project_id : null,
+    machineId
   ]);
   return getAgent(id, d);
 }
@@ -10656,6 +10890,7 @@ function getCapableAgents(capabilities, opts, db) {
 }
 var init_agents = __esm(() => {
   init_database();
+  init_storage_tombstones();
   init_agent_names();
 });
 
@@ -11191,7 +11426,7 @@ var init_doctor = __esm(() => {
 });
 
 // src/server/routes.ts
-import { join as join8, resolve as resolve7, sep } from "path";
+import { join as join8, resolve as resolve8, sep as sep2 } from "path";
 function parseFieldsParam(url) {
   const fieldsParam = url.searchParams.get("fields");
   return fieldsParam ? fieldsParam.split(",").map((f) => f.trim()).filter(Boolean) : undefined;
@@ -11929,9 +12164,9 @@ function handleStaticFiles(path, method, ctx, json2, serveStaticFile2) {
     return null;
   if (path !== "/") {
     const filePath = join8(ctx.dashboardDir, path);
-    const resolvedFile = resolve7(filePath);
-    const resolvedBase = resolve7(ctx.dashboardDir);
-    if (!resolvedFile.startsWith(resolvedBase + sep) && resolvedFile !== resolvedBase) {
+    const resolvedFile = resolve8(filePath);
+    const resolvedBase = resolve8(ctx.dashboardDir);
+    if (!resolvedFile.startsWith(resolvedBase + sep2) && resolvedFile !== resolvedBase) {
       return json2({ error: "Forbidden" }, 403);
     }
     const res2 = serveStaticFile2(filePath);
@@ -15330,7 +15565,7 @@ class JSONSchemaGenerator {
               if (val === undefined) {
                 if (this.unrepresentable === "throw") {
                   throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                } else {}
+                }
               } else if (typeof val === "bigint") {
                 if (this.unrepresentable === "throw") {
                   throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -17696,9 +17931,9 @@ data:
       const initRequest = messages.find((m) => isInitializeRequest(m));
       const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
       if (this._enableJsonResponse) {
-        return new Promise((resolve8) => {
+        return new Promise((resolve9) => {
           this._streamMapping.set(streamId, {
-            resolveJson: resolve8,
+            resolveJson: resolve9,
             cleanup: () => {
               this._streamMapping.delete(streamId);
             }
@@ -23998,7 +24233,7 @@ class Protocol {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1000;
-        await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
+        await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -24010,7 +24245,7 @@ class Protocol {
   }
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -24088,7 +24323,7 @@ class Protocol {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve8(parseResult.data);
+            resolve9(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -24279,12 +24514,12 @@ class Protocol {
         interval = task.pollInterval;
       }
     } catch {}
-    return new Promise((resolve8, reject) => {
+    return new Promise((resolve9, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve8, interval);
+      const timeoutId = setTimeout(resolve9, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -27269,7 +27504,7 @@ var require_compile = __commonJS((exports) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve8.call(this, root, ref);
+    let _sch = resolve9.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a = root.localRefs) === null || _a === undefined ? undefined : _a[ref];
       const { schemaId } = this.opts;
@@ -27296,7 +27531,7 @@ var require_compile = __commonJS((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve8(root, ref) {
+  function resolve9(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -27826,7 +28061,7 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     return uri;
   }
-  function resolve8(baseURI, relativeURI, options) {
+  function resolve9(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse6(baseURI, schemelessOptions), parse6(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -28054,7 +28289,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   var fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve8,
+    resolve: resolve9,
     resolveComponent,
     equal,
     serialize,
@@ -31580,7 +31815,7 @@ class McpServer {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5000;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
+      await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -32204,12 +32439,12 @@ class StdioServerTransport {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve8) => {
+    return new Promise((resolve9) => {
       const json2 = serializeMessage(message);
       if (this._stdout.write(json2)) {
-        resolve8();
+        resolve9();
       } else {
-        this._stdout.once("drain", resolve8);
+        this._stdout.once("drain", resolve9);
       }
     });
   }
@@ -33616,7 +33851,7 @@ var init_task_crud2 = __esm(() => {
 
 // src/lib/project-bootstrap.ts
 import { existsSync as existsSync9, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
-import { basename as basename3, dirname as dirname7, resolve as resolve8 } from "path";
+import { basename as basename3, dirname as dirname7, resolve as resolve9 } from "path";
 function safeStat(path) {
   try {
     return statSync4(path);
@@ -33625,7 +33860,7 @@ function safeStat(path) {
   }
 }
 function canonicalPath(input) {
-  const resolved = resolve8(input);
+  const resolved = resolve9(input);
   const stats = safeStat(resolved);
   if (stats?.isFile())
     return dirname7(resolved);
@@ -33634,7 +33869,7 @@ function canonicalPath(input) {
 function findUp(start, marker) {
   let current = canonicalPath(start);
   while (true) {
-    if (existsSync9(resolve8(current, marker)))
+    if (existsSync9(resolve9(current, marker)))
       return current;
     const parent = dirname7(current);
     if (parent === current)
@@ -33645,7 +33880,7 @@ function findUp(start, marker) {
 function readPackageJson(path) {
   if (!path)
     return null;
-  const file = resolve8(path, "package.json");
+  const file = resolve9(path, "package.json");
   if (!existsSync9(file))
     return null;
   try {
@@ -33668,7 +33903,7 @@ function workspaceMarker(root, rootPackage) {
   if (rootPackage?.workspaces)
     markers.push("package.json#workspaces");
   for (const marker of ["pnpm-workspace.yaml", "turbo.json", "nx.json", "lerna.json", "rush.json", "bun.lock", "bun.lockb"]) {
-    if (existsSync9(resolve8(root, marker)))
+    if (existsSync9(resolve9(root, marker)))
       markers.push(marker);
   }
   const kind = markers.find((marker) => marker !== "bun.lock" && marker !== "bun.lockb") ?? null;
@@ -34212,7 +34447,7 @@ var init_retention_cleanup = __esm(() => {
 
 // src/lib/mention-resolver.ts
 import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync5 } from "fs";
-import { basename as basename4, isAbsolute, join as join9, relative as relative3, resolve as resolve9, sep as sep2 } from "path";
+import { basename as basename4, isAbsolute, join as join9, relative as relative3, resolve as resolve10, sep as sep3 } from "path";
 function blankResolution(parsed) {
   return {
     input: parsed.input,
@@ -34235,11 +34470,11 @@ function backlink(kind, key, label, target = key) {
   return { kind, key, label, target };
 }
 function normalizeWorkspace(workspace) {
-  return resolve9(workspace || process.cwd());
+  return resolve10(workspace || process.cwd());
 }
 function isInside(root, absolutePath) {
   const rel = relative3(root, absolutePath);
-  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep2}`) && !isAbsolute(rel);
+  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep3}`) && !isAbsolute(rel);
 }
 function normalizeRelativePath(value) {
   const normalized = value.trim().replace(/^\.?\//, "").replace(/\\/g, "/");
@@ -34303,7 +34538,7 @@ function resolveFile(parsed, workspace) {
     resolution.warnings.push("path is empty or escapes the workspace");
     return resolution;
   }
-  const absolutePath = resolve9(workspace, relPath);
+  const absolutePath = resolve10(workspace, relPath);
   if (!isInside(workspace, absolutePath)) {
     resolution.path = relPath;
     resolution.warnings.push("path escapes the workspace");
@@ -34648,9 +34883,9 @@ var init_mention_resolver = __esm(() => {
 });
 
 // src/lib/policy-packs.ts
-import { relative as relative4, resolve as resolve10 } from "path";
+import { relative as relative4, resolve as resolve11 } from "path";
 function normalizePath3(path) {
-  return resolve10(path);
+  return resolve11(path);
 }
 function unique4(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -34705,7 +34940,7 @@ function commandMatches(commands, pattern) {
 }
 function pathMatches(paths, pattern, root) {
   return paths.filter((path) => {
-    const candidate = path.startsWith("/") ? path : resolve10(root, path);
+    const candidate = path.startsWith("/") ? path : resolve11(root, path);
     if (!isPathInside3(root, candidate))
       return matchesPattern3(path, pattern);
     return matchesPattern3(path, pattern) || matchesPattern3(relative4(root, candidate), pattern);
@@ -35052,7 +35287,8 @@ function logApprovalEvent(taskId, action, gate, agentId, db) {
   if (action === "approved" || action === "rejected" || action === "expired") {
     emitLocalEventHooksQuiet({
       type: "approval.decided",
-      payload: { task_id: taskId, gate: gate.gate, status: gate.status, reviewer: gate.reviewer, run_id: gate.run_id }
+      payload: { task_id: taskId, gate: gate.gate, status: gate.status, reviewer: gate.reviewer, run_id: gate.run_id },
+      databasePath: databasePathFromDatabase(db)
     });
   }
 }
@@ -35192,6 +35428,7 @@ var init_approval_gates = __esm(() => {
   init_task_runs();
   init_tasks();
   init_types();
+  init_event_emission_safety();
   init_event_hooks();
 });
 
@@ -37758,7 +37995,7 @@ function canonicalize(value) {
 function hash(value) {
   return createHash5("sha256").update(value).digest("hex");
 }
-function parsePayload(value) {
+function parsePayload2(value) {
   if (!value)
     return {};
   try {
@@ -37857,7 +38094,7 @@ function taskScopedRows(db, scope) {
       FROM handoffs h
       WHERE h.project_id IS NULL OR h.project_id = COALESCE(?, h.project_id)
     `).all(scope.project_id ?? null).filter((row) => {
-      const payload = parsePayload(row.payload_json);
+      const payload = parsePayload2(row.payload_json);
       const taskRefs = parseStringArray(payload["task_ids"]);
       const runRefs = parseStringArray(payload["run_ids"]);
       if (scope.project_id && row.project_id !== scope.project_id)
@@ -37888,7 +38125,7 @@ function toLedgerEntries(rows) {
   });
   let previous = LOCAL_AUDIT_LEDGER_INITIAL_HASH;
   return ordered.map((row, index) => {
-    const payload = parsePayload(row.payload_json);
+    const payload = parsePayload2(row.payload_json);
     const payloadHash = hash(canonicalize({ source: row.source, source_id: row.source_id, created_at: row.created_at, payload }));
     const chainHash = hash(`${previous}
 ${payloadHash}`);
@@ -38030,7 +38267,7 @@ var init_audit_ledger = __esm(() => {
 
 // src/lib/release-compatibility.ts
 import { readFileSync as readFileSync6 } from "fs";
-import { join as join10, resolve as resolve11 } from "path";
+import { join as join10, resolve as resolve12 } from "path";
 import { Database as Database2 } from "bun:sqlite";
 function pass(id, message, details) {
   return { id, status: "passed", message, details };
@@ -38138,7 +38375,7 @@ function checkChangelog() {
   ];
 }
 function createReleaseCompatibilityReport(options = {}) {
-  const root = resolve11(options.root ?? process.cwd());
+  const root = resolve12(options.root ?? process.cwd());
   const packageJson = readPackageJson2(root);
   const simulatedLevels = options.simulated_levels ?? defaultSimulationLevels();
   const checks4 = [
@@ -58415,7 +58652,7 @@ var require_to_json_schema = __commonJS((exports) => {
                 if (val === undefined) {
                   if (this.unrepresentable === "throw") {
                     throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                  } else {}
+                  }
                 } else if (typeof val === "bigint") {
                   if (this.unrepresentable === "throw") {
                     throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -65057,7 +65294,7 @@ var require_protocol = __commonJS((exports) => {
             return;
           }
           const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1000;
-          await new Promise((resolve12) => setTimeout(resolve12, pollInterval));
+          await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
           options?.signal?.throwIfAborted();
         }
       } catch (error2) {
@@ -65069,7 +65306,7 @@ var require_protocol = __commonJS((exports) => {
     }
     request(request, resultSchema, options) {
       const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-      return new Promise((resolve12, reject) => {
+      return new Promise((resolve13, reject) => {
         const earlyReject = (error2) => {
           reject(error2);
         };
@@ -65147,7 +65384,7 @@ var require_protocol = __commonJS((exports) => {
             if (!parseResult.success) {
               reject(parseResult.error);
             } else {
-              resolve12(parseResult.data);
+              resolve13(parseResult.data);
             }
           } catch (error2) {
             reject(error2);
@@ -65338,12 +65575,12 @@ var require_protocol = __commonJS((exports) => {
           interval = task.pollInterval;
         }
       } catch {}
-      return new Promise((resolve12, reject) => {
+      return new Promise((resolve13, reject) => {
         if (signal.aborted) {
           reject(new types_js_1.McpError(types_js_1.ErrorCode.InvalidRequest, "Request cancelled"));
           return;
         }
-        const timeoutId = setTimeout(resolve12, interval);
+        const timeoutId = setTimeout(resolve13, interval);
         signal.addEventListener("abort", () => {
           clearTimeout(timeoutId);
           reject(new types_js_1.McpError(types_js_1.ErrorCode.InvalidRequest, "Request cancelled"));
@@ -66489,7 +66726,7 @@ var require_mcp = __commonJS((exports) => {
       let task = createTaskResult.task;
       const pollInterval = task.pollInterval ?? 5000;
       while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-        await new Promise((resolve12) => setTimeout(resolve12, pollInterval));
+        await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
         const updatedTask = await extra.taskStore.getTask(taskId);
         if (!updatedTask) {
           throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -67898,7 +68135,7 @@ function classifyLog(text) {
 async function sleep2(ms) {
   if (ms <= 0)
     return;
-  await new Promise((resolve12) => setTimeout(resolve12, ms));
+  await new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 async function runCommandProvider(provider, input) {
   const commandTemplate = input.command || provider.command;
@@ -70627,7 +70864,7 @@ var init_local_bridge = __esm(() => {
 // src/lib/local-backups.ts
 import { createHash as createHash6 } from "crypto";
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname8, resolve as resolve12 } from "path";
+import { dirname as dirname8, resolve as resolve13 } from "path";
 import { mkdirSync as mkdirSync6 } from "fs";
 function stableJson(value) {
   if (value === null || typeof value !== "object")
@@ -70729,14 +70966,14 @@ function createLocalBackup(options = {}, db) {
   return backup;
 }
 function writeLocalBackupFile(backup, outputPath) {
-  const path = resolve12(outputPath);
+  const path = resolve13(outputPath);
   mkdirSync6(dirname8(path), { recursive: true });
   writeFileSync3(path, `${JSON.stringify(backup, null, 2)}
 `);
   return path;
 }
 function readLocalBackupFile(path) {
-  return JSON.parse(readFileSync8(resolve12(path), "utf-8"));
+  return JSON.parse(readFileSync8(resolve13(path), "utf-8"));
 }
 function verifyLocalBackup(value, options = {}, db) {
   const verifiedAt = options.verified_at ?? now();
@@ -72186,7 +72423,7 @@ __export(exports_local_extensions, {
 });
 import { createHash as createHash9, createVerify } from "crypto";
 import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
-import { basename as basename5, join as join11, resolve as resolve13 } from "path";
+import { basename as basename5, join as join11, resolve as resolve14 } from "path";
 function isObject3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -72444,7 +72681,7 @@ function verifyExtensionSignature(input) {
   return verifier.verify(input.public_key, decodeSignature(input.signature));
 }
 function inspectExtensionSource(source3) {
-  const resolved = resolve13(source3);
+  const resolved = resolve14(source3);
   if (!existsSync13(resolved))
     throw new Error(`extension source not found: ${source3}`);
   const stat = statSync6(resolved);
@@ -72542,7 +72779,7 @@ function testExtensionCompatibility(sourceOrManifest) {
 function projectExtensionSources(projectPath) {
   if (!projectPath)
     return [];
-  const root = resolve13(projectPath);
+  const root = resolve14(projectPath);
   const candidates = [
     join11(root, "todos.extension.json"),
     join11(root, ".todos", "todos.extension.json")
@@ -72561,7 +72798,7 @@ function projectExtensionSources(projectPath) {
 }
 function discoverLocalExtensions(options = {}) {
   const config2 = loadConfig();
-  const projectPath = options.project_path ? resolve13(options.project_path) : null;
+  const projectPath = options.project_path ? resolve14(options.project_path) : null;
   const configuredSources = [
     ...config2.extension_sources || [],
     ...projectPath ? config2.project_overrides?.[projectPath]?.extension_sources || [] : []
@@ -72569,7 +72806,7 @@ function discoverLocalExtensions(options = {}) {
   const sources = Array.from(new Set([
     ...configuredSources,
     ...projectExtensionSources(projectPath || undefined)
-  ])).map((source3) => projectPath && !source3.startsWith("/") ? resolve13(projectPath, source3) : resolve13(source3));
+  ])).map((source3) => projectPath && !source3.startsWith("/") ? resolve14(projectPath, source3) : resolve14(source3));
   const warnings = [];
   const discovered = [];
   for (const source3 of sources) {
@@ -75519,7 +75756,8 @@ function writeQueue(task2, queue, actor, action, db) {
   logTaskChange(task2.id, `review_queue.${action}`, "review_queue", null, JSON.stringify(queue), actor, d);
   emitLocalEventHooksQuiet({
     type: `review.${action}`,
-    payload: { task_id: task2.id, queue: queue.queue, state: queue.state, reviewer: queue.reviewer, claimed_by: queue.claimed_by }
+    payload: { task_id: task2.id, queue: queue.queue, state: queue.state, reviewer: queue.reviewer, claimed_by: queue.claimed_by },
+    databasePath: databasePathFromDatabase(d)
   });
   return itemFromTask(taskOrThrow2(task2.id, d), queue, d);
 }
@@ -75823,6 +76061,7 @@ var init_review_queues = __esm(() => {
   init_database();
   init_tasks();
   init_config();
+  init_event_emission_safety();
   init_event_hooks();
   init_task_contracts();
   STATES = new Set(["requested", "claimed", "approved", "changes_requested", "returned", "reopened"]);
@@ -76978,7 +77217,7 @@ __export(exports_extract, {
 });
 import { existsSync as existsSync14, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
 import { createHash as createHash11 } from "crypto";
-import { relative as relative5, resolve as resolve14, join as join12 } from "path";
+import { relative as relative5, resolve as resolve15, join as join12 } from "path";
 function stableHash(value) {
   return createHash11("sha256").update(value).digest("hex");
 }
@@ -76986,7 +77225,7 @@ function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function readGitignorePatterns(basePath) {
-  const root = statSync7(basePath).isFile() ? resolve14(basePath, "..") : basePath;
+  const root = statSync7(basePath).isFile() ? resolve15(basePath, "..") : basePath;
   const gitignorePath = join12(root, ".gitignore");
   if (!existsSync14(gitignorePath))
     return [];
@@ -77122,7 +77361,7 @@ function collectFiles(basePath, extensions, excludes, respectGitignore) {
   return files.sort();
 }
 function buildCodebaseIndex(options) {
-  const basePath = resolve14(options.path);
+  const basePath = resolve15(options.path);
   const tags = options.patterns || [...EXTRACT_TAGS];
   const extensions = options.extensions ? new Set(options.extensions.map((e) => e.startsWith(".") ? e : `.${e}`)) : DEFAULT_EXTENSIONS;
   const excludes = options.exclude || [];
@@ -77133,7 +77372,7 @@ function buildCodebaseIndex(options) {
     const fullPath = statSync7(basePath).isFile() ? basePath : join12(basePath, file);
     try {
       const source3 = readFileSync10(fullPath, "utf-8");
-      const relPath = statSync7(basePath).isFile() ? relative5(resolve14(basePath, ".."), fullPath) : file;
+      const relPath = statSync7(basePath).isFile() ? relative5(resolve15(basePath, ".."), fullPath) : file;
       indexed.push({
         file: relPath,
         checksum: stableHash(source3).slice(0, 24),
@@ -77153,7 +77392,7 @@ function buildCodebaseIndex(options) {
   };
 }
 function extractTodos(options, db) {
-  const basePath = resolve14(options.path);
+  const basePath = resolve15(options.path);
   const tags = options.patterns || [...EXTRACT_TAGS];
   const extensions = options.extensions ? new Set(options.extensions.map((e) => e.startsWith(".") ? e : `.${e}`)) : DEFAULT_EXTENSIONS;
   const excludes = options.exclude || [];
@@ -77164,7 +77403,7 @@ function extractTodos(options, db) {
     const fullPath = statSync7(basePath).isFile() ? basePath : join12(basePath, file);
     try {
       const source3 = readFileSync10(fullPath, "utf-8");
-      const relPath = statSync7(basePath).isFile() ? relative5(resolve14(basePath, ".."), fullPath) : file;
+      const relPath = statSync7(basePath).isFile() ? relative5(resolve15(basePath, ".."), fullPath) : file;
       const comments = extractFromSource(source3, relPath, tags);
       allComments.push(...comments);
     } catch {}
@@ -77258,7 +77497,7 @@ async function watchSourceTodos(options, onRun) {
   const interval = Math.max(100, options.interval_ms || 2000);
   const once = options.once !== false && (!options.max_runs || options.max_runs <= 1);
   const maxRuns = options.max_runs ?? (once ? 1 : Number.POSITIVE_INFINITY);
-  const root = resolve14(options.path);
+  const root = resolve15(options.path);
   const runs = [];
   let previous = new Map;
   for (let runNumber = 1;runNumber <= maxRuns; runNumber++) {
@@ -78641,8 +78880,8 @@ __export(exports_environment_snapshots, {
 import { createHash as createHash12 } from "crypto";
 import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
 import { hostname as hostname3, platform, arch } from "os";
-import { dirname as dirname9, join as join14, resolve as resolve15 } from "path";
-import { tmpdir as tmpdir2 } from "os";
+import { dirname as dirname9, join as join14, resolve as resolve16 } from "path";
+import { tmpdir as tmpdir3 } from "os";
 function sha2566(value) {
   return createHash12("sha256").update(value).digest("hex");
 }
@@ -78755,15 +78994,15 @@ function commandEnv(env, includeValues) {
 function defaultSnapshotDir() {
   const dbPath = getDatabasePath();
   if (dbPath === ":memory:" || dbPath.startsWith("file::memory:"))
-    return join14(tmpdir2(), "hasna-todos", "environment-snapshots");
-  return join14(dirname9(resolve15(dbPath)), "environment-snapshots");
+    return join14(tmpdir3(), "hasna-todos", "environment-snapshots");
+  return join14(dirname9(resolve16(dbPath)), "environment-snapshots");
 }
 function snapshotWithId(snapshot) {
   const digest = sha2566(JSON.stringify(snapshot)).slice(0, 24);
   return { id: `env_${digest}`, ...snapshot };
 }
 function captureEnvironmentSnapshot(input = {}) {
-  const root = resolve15(input.root || process.cwd());
+  const root = resolve16(input.root || process.cwd());
   const env = input.env || process.env;
   const warnings = [];
   const manifests = MANIFEST_FILES.map((file) => manifestRecord(root, file)).filter((file) => Boolean(file));
@@ -78803,13 +79042,13 @@ function captureEnvironmentSnapshot(input = {}) {
   });
 }
 function writeEnvironmentSnapshot(snapshot, outputPath) {
-  const path = outputPath ? resolve15(outputPath) : join14(defaultSnapshotDir(), `${snapshot.id}.json`);
+  const path = outputPath ? resolve16(outputPath) : join14(defaultSnapshotDir(), `${snapshot.id}.json`);
   ensureDir2(dirname9(path));
   writeJsonFile(path, snapshot);
   return path;
 }
 function readEnvironmentSnapshot(path) {
-  const snapshot = readJsonFile(resolve15(path));
+  const snapshot = readJsonFile(resolve16(path));
   if (!snapshot || snapshot.schema_version !== 1 || typeof snapshot.id !== "string") {
     throw new Error(`Invalid environment snapshot: ${path}`);
   }