@hasna/todos 0.11.75 → 0.11.81

package/dist/index.js

@@ -2643,6 +2643,294 @@ var init_machines = __esm(() => {
   ];
 });
 
+// src/storage/config.ts
+var exports_config = {};
+__export(exports_config, {
+  parseStorageMode: () => parseStorageMode,
+  loadTodosStorageConfig: () => loadTodosStorageConfig,
+  loadStorageConfig: () => loadStorageConfig,
+  isTodosShadowEnabled: () => isTodosShadowEnabled,
+  isTodosRemoteStorageEnabled: () => isTodosRemoteStorageEnabled,
+  getTodosStorageShadowEnvName: () => getTodosStorageShadowEnvName,
+  getTodosStorageMode: () => getTodosStorageMode,
+  getTodosStorageEnvName: () => getTodosStorageEnvName,
+  getTodosStorageDatabaseUrl: () => getTodosStorageDatabaseUrl,
+  getTodosStorageDatabaseEnv: () => getTodosStorageDatabaseEnv,
+  getStorageMode: () => getStorageMode,
+  getStorageDatabaseUrl: () => getStorageDatabaseUrl,
+  getStorageDatabaseEnv: () => getStorageDatabaseEnv,
+  getCanonicalTodosRdsConfig: () => getCanonicalTodosRdsConfig,
+  assertTodosShadowConfig: () => assertTodosShadowConfig,
+  assertTodosRemoteStorageConfig: () => assertTodosRemoteStorageConfig,
+  TODOS_STORAGE_TABLES: () => TODOS_STORAGE_TABLES,
+  TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
+  TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
+  STORAGE_TABLES: () => STORAGE_TABLES,
+  CANONICAL_TODOS_RDS_RUNTIME_PATH: () => CANONICAL_TODOS_RDS_RUNTIME_PATH,
+  CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
+  CANONICAL_TODOS_RDS_CLUSTER: () => CANONICAL_TODOS_RDS_CLUSTER
+});
+function getCanonicalTodosRdsConfig() {
+  return {
+    cluster: CANONICAL_TODOS_RDS_CLUSTER,
+    database: CANONICAL_TODOS_RDS_DATABASE,
+    runtimeSecretPath: CANONICAL_TODOS_RDS_RUNTIME_PATH,
+    primaryEnv: TODOS_STORAGE_ENV.databaseUrl,
+    fallbackEnv: TODOS_STORAGE_FALLBACK_ENV.databaseUrl
+  };
+}
+function loadTodosStorageConfig(env = process.env) {
+  const mode = getTodosStorageMode(env);
+  const databaseUrl = getTodosStorageDatabaseUrl(env);
+  const bucket = readStorageEnv(env, "s3Bucket").value;
+  const prefix = readStorageEnv(env, "s3Prefix").value ?? "todos/";
+  const region = readStorageEnv(env, "awsRegion").value;
+  const endpoint = readStorageEnv(env, "s3Endpoint").value;
+  const schema = readStorageEnv(env, "databaseSchema").value;
+  return {
+    service: "todos",
+    mode,
+    ...databaseUrl ? {
+      database: {
+        provider: "postgres",
+        url: databaseUrl,
+        ssl: parseBoolean(readStorageEnv(env, "databaseSsl").value, true),
+        ...schema ? { schema } : {}
+      }
+    } : {},
+    ...bucket ? {
+      objectStorage: {
+        provider: "s3",
+        bucket,
+        prefix,
+        ...region ? { region } : {},
+        ...endpoint ? { endpoint } : {},
+        forcePathStyle: parseBoolean(readStorageEnv(env, "s3ForcePathStyle").value, false)
+      }
+    } : {},
+    sync: {
+      batchSize: parsePositiveInteger(readStorageEnv(env, "syncBatchSize").value, 500),
+      dryRun: parseBoolean(readStorageEnv(env, "syncDryRun").value, false)
+    }
+  };
+}
+function loadStorageConfig(env = process.env) {
+  return loadTodosStorageConfig(env);
+}
+function isTodosRemoteStorageEnabled(config) {
+  return config.mode === "remote" || config.mode === "hybrid";
+}
+function assertTodosRemoteStorageConfig(config) {
+  if (!isTodosRemoteStorageEnabled(config))
+    return;
+  if (!config.database?.url) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+  }
+}
+function parseStorageMode(value) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return "local";
+  if (normalized === "local" || normalized === "remote" || normalized === "hybrid")
+    return normalized;
+  throw new Error(`${TODOS_STORAGE_ENV.mode} must be local, remote, or hybrid`);
+}
+function getTodosStorageMode(env = process.env) {
+  return parseStorageMode(readStorageEnv(env, "mode").value);
+}
+function getStorageMode(env = process.env) {
+  return getTodosStorageMode(env);
+}
+function isTodosShadowEnabled(env = process.env) {
+  return parseBoolean(readStorageEnv(env, "shadow").value, false);
+}
+function getTodosStorageShadowEnvName(env = process.env) {
+  return readStorageEnv(env, "shadow").name;
+}
+function assertTodosShadowConfig(config, env = process.env) {
+  if (!isTodosShadowEnabled(env))
+    return;
+  if (config.mode !== "local") {
+    throw new Error(`${readStorageEnv(env, "shadow").name} shadow mirror requires ${TODOS_STORAGE_ENV.mode}=local (got ${config.mode})`);
+  }
+  if (!config.database?.url) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${readStorageEnv(env, "shadow").name} is enabled`);
+  }
+}
+function getTodosStorageDatabaseEnv(env = process.env) {
+  return readStorageEnv(env, "databaseUrl").name;
+}
+function getStorageDatabaseEnv(env = process.env) {
+  return getTodosStorageDatabaseEnv(env);
+}
+function getTodosStorageDatabaseUrl(env = process.env) {
+  return readStorageEnv(env, "databaseUrl").value;
+}
+function getStorageDatabaseUrl(env = process.env) {
+  return getTodosStorageDatabaseUrl(env);
+}
+function getTodosStorageEnvName(env, key) {
+  return readStorageEnv(env, key).name;
+}
+function readStorageEnv(env, key) {
+  const primaryName = TODOS_STORAGE_ENV[key];
+  const primaryValue = clean(env[primaryName]);
+  if (primaryValue !== undefined)
+    return { name: primaryName, value: primaryValue };
+  const fallbackName = TODOS_STORAGE_FALLBACK_ENV[key];
+  const fallbackValue = clean(env[fallbackName]);
+  if (fallbackValue !== undefined)
+    return { name: fallbackName, value: fallbackValue };
+  return { name: primaryName };
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function parseBoolean(value, fallback) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return fallback;
+  if (["1", "true", "yes", "on"].includes(normalized))
+    return true;
+  if (["0", "false", "no", "off"].includes(normalized))
+    return false;
+  throw new Error(`Expected boolean env value, got ${value}`);
+}
+function parsePositiveInteger(value, fallback) {
+  const normalized = clean(value);
+  if (!normalized)
+    return fallback;
+  const parsed = Number.parseInt(normalized, 10);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new Error(`${TODOS_STORAGE_ENV.syncBatchSize} must be a positive integer`);
+  }
+  return parsed;
+}
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER = "hasna-xyz-infra-apps-prod-postgres", CANONICAL_TODOS_RDS_DATABASE = "todos", CANONICAL_TODOS_RDS_RUNTIME_PATH = "hasna/xyz/opensource/todos/prod/rds";
+var init_config = __esm(() => {
+  TODOS_STORAGE_TABLES = [
+    "todos_sync_records",
+    "todos_sync_cursors"
+  ];
+  STORAGE_TABLES = TODOS_STORAGE_TABLES;
+  TODOS_STORAGE_ENV = {
+    mode: "HASNA_TODOS_STORAGE_MODE",
+    shadow: "HASNA_TODOS_SHADOW",
+    databaseUrl: "HASNA_TODOS_DATABASE_URL",
+    databaseSsl: "HASNA_TODOS_DATABASE_SSL",
+    databaseSchema: "HASNA_TODOS_DATABASE_SCHEMA",
+    s3Bucket: "HASNA_TODOS_S3_BUCKET",
+    s3Prefix: "HASNA_TODOS_S3_PREFIX",
+    awsRegion: "HASNA_TODOS_AWS_REGION",
+    s3Endpoint: "HASNA_TODOS_S3_ENDPOINT",
+    s3ForcePathStyle: "HASNA_TODOS_S3_FORCE_PATH_STYLE",
+    s3AccessKeyId: "HASNA_TODOS_S3_ACCESS_KEY_ID",
+    s3SecretAccessKey: "HASNA_TODOS_S3_SECRET_ACCESS_KEY",
+    s3SessionToken: "HASNA_TODOS_S3_SESSION_TOKEN",
+    syncBatchSize: "HASNA_TODOS_SYNC_BATCH_SIZE",
+    syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
+  };
+  TODOS_STORAGE_FALLBACK_ENV = {
+    mode: "TODOS_STORAGE_MODE",
+    shadow: "TODOS_SHADOW",
+    databaseUrl: "TODOS_DATABASE_URL",
+    databaseSsl: "TODOS_DATABASE_SSL",
+    databaseSchema: "TODOS_DATABASE_SCHEMA",
+    s3Bucket: "TODOS_S3_BUCKET",
+    s3Prefix: "TODOS_S3_PREFIX",
+    awsRegion: "TODOS_AWS_REGION",
+    s3Endpoint: "TODOS_S3_ENDPOINT",
+    s3ForcePathStyle: "TODOS_S3_FORCE_PATH_STYLE",
+    s3AccessKeyId: "TODOS_S3_ACCESS_KEY_ID",
+    s3SecretAccessKey: "TODOS_S3_SECRET_ACCESS_KEY",
+    s3SessionToken: "TODOS_S3_SESSION_TOKEN",
+    syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
+    syncDryRun: "TODOS_SYNC_DRY_RUN"
+  };
+});
+
+// src/storage/shadow-outbox-schema.ts
+var exports_shadow_outbox_schema = {};
+__export(exports_shadow_outbox_schema, {
+  installShadowOutboxSchema: () => installShadowOutboxSchema,
+  SHADOW_TRIGGER_TABLES: () => SHADOW_TRIGGER_TABLES
+});
+function installShadowOutboxSchema(db) {
+  db.run(`CREATE TABLE IF NOT EXISTS shadow_outbox (
+    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    object_type TEXT NOT NULL,
+    object_id TEXT NOT NULL,
+    op TEXT NOT NULL,
+    enqueued_at INTEGER NOT NULL,
+    attempts INTEGER NOT NULL DEFAULT 0,
+    next_attempt_at INTEGER NOT NULL DEFAULT 0,
+    last_error TEXT,
+    status TEXT NOT NULL DEFAULT 'pending',
+    revision INTEGER NOT NULL DEFAULT 0
+  )`);
+  ensureColumn(db, "shadow_outbox", "revision", "INTEGER NOT NULL DEFAULT 0");
+  db.run(`CREATE UNIQUE INDEX IF NOT EXISTS shadow_outbox_pending_uq
+       ON shadow_outbox(object_type, object_id) WHERE status='pending'`);
+  db.run(`CREATE INDEX IF NOT EXISTS shadow_outbox_ready_idx
+       ON shadow_outbox(status, next_attempt_at)`);
+  for (const { table, objectType, deletes } of SHADOW_TRIGGER_TABLES) {
+    const exists = db.query(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`).get(table);
+    if (!exists)
+      continue;
+    const insertTrigger = `shadow_ob_${table}_ai`;
+    const updateTrigger = `shadow_ob_${table}_au`;
+    db.run(`DROP TRIGGER IF EXISTS ${insertTrigger}`);
+    db.run(`DROP TRIGGER IF EXISTS ${updateTrigger}`);
+    db.run(upsertTriggerSql(insertTrigger, table, objectType, "INSERT", "NEW"));
+    db.run(upsertTriggerSql(updateTrigger, table, objectType, "UPDATE", "NEW"));
+    if (deletes) {
+      const deleteTrigger = `shadow_ob_${table}_ad`;
+      db.run(`DROP TRIGGER IF EXISTS ${deleteTrigger}`);
+      db.run(deleteTriggerSql(deleteTrigger, table, objectType));
+    }
+  }
+}
+function ensureColumn(db, table, column, definition) {
+  const rows = db.query(`PRAGMA table_info(${table})`).all();
+  if (rows.some((row) => row.name === column))
+    return;
+  db.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+}
+function upsertTriggerSql(name, table, objectType, event, row) {
+  return `CREATE TRIGGER IF NOT EXISTS ${name}
+    AFTER ${event} ON ${table}
+    BEGIN
+      INSERT INTO shadow_outbox(object_type, object_id, op, enqueued_at, attempts, next_attempt_at, last_error, status, revision)
+      VALUES('${objectType}', ${row}.id, 'upsert', CAST(strftime('%s','now') AS INTEGER) * 1000, 0, 0, NULL, 'pending', 0)
+      ON CONFLICT(object_type, object_id) WHERE status='pending'
+      DO UPDATE SET op='upsert', enqueued_at=excluded.enqueued_at, attempts=0, next_attempt_at=0, last_error=NULL, revision=shadow_outbox.revision + 1;
+    END`;
+}
+function deleteTriggerSql(name, table, objectType) {
+  return `CREATE TRIGGER IF NOT EXISTS ${name}
+    AFTER DELETE ON ${table}
+    BEGIN
+      INSERT INTO shadow_outbox(object_type, object_id, op, enqueued_at, attempts, next_attempt_at, last_error, status, revision)
+      VALUES('${objectType}', OLD.id, 'delete', CAST(strftime('%s','now') AS INTEGER) * 1000, 0, 0, NULL, 'pending', 0)
+      ON CONFLICT(object_type, object_id) WHERE status='pending'
+      DO UPDATE SET op='delete', enqueued_at=excluded.enqueued_at, attempts=0, next_attempt_at=0, last_error=NULL, revision=shadow_outbox.revision + 1;
+    END`;
+}
+var SHADOW_TRIGGER_TABLES;
+var init_shadow_outbox_schema = __esm(() => {
+  SHADOW_TRIGGER_TABLES = [
+    { table: "tasks", objectType: "tasks", deletes: true },
+    { table: "projects", objectType: "projects", deletes: true },
+    { table: "project_machine_paths", objectType: "project_machine_paths", deletes: true },
+    { table: "plans", objectType: "plans", deletes: true },
+    { table: "agents", objectType: "agents", deletes: false },
+    { table: "task_lists", objectType: "task_lists", deletes: true },
+    { table: "task_templates", objectType: "templates", deletes: true },
+    { table: "task_history", objectType: "audit_history", deletes: false }
+  ];
+});
+
 // src/db/database.ts
 var exports_database = {};
 __export(exports_database, {
@@ -2733,8 +3021,20 @@ function openDatabase(path) {
   runMigrations(db);
   backfillTaskTags(db);
   backfillMachineId(db);
+  maybeInstallShadowCapture(db);
   return db;
 }
+function maybeInstallShadowCapture(db) {
+  try {
+    const { isTodosShadowEnabled: isTodosShadowEnabled2 } = (init_config(), __toCommonJS(exports_config));
+    if (!isTodosShadowEnabled2())
+      return;
+    const { installShadowOutboxSchema: installShadowOutboxSchema2 } = (init_shadow_outbox_schema(), __toCommonJS(exports_shadow_outbox_schema));
+    installShadowOutboxSchema2(db);
+  } catch (error) {
+    console.error(`[todos] shadow capture install failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
 function getDatabase(dbPath) {
   const path = dbPath || getDbPath();
   if (_db && _dbPath === path)
@@ -3111,7 +3411,7 @@ function getCompletionGuardConfig(projectPath) {
   return global;
 }
 var cached = null, GUARD_DEFAULTS;
-var init_config = __esm(() => {
+var init_config2 = __esm(() => {
   init_sync_utils();
   GUARD_DEFAULTS = {
     enabled: false,
@@ -3482,7 +3782,7 @@ function checkCompletionGuard(task, agentId, db, configOverride) {
 }
 var init_completion_guard = __esm(() => {
   init_types();
-  init_config();
+  init_config2();
   init_projects();
 });
 
@@ -3490,8 +3790,8 @@ var init_completion_guard = __esm(() => {
 import { tmpdir } from "os";
 import { resolve as resolve3, sep } from "path";
 function envFlag(name) {
-  const value = process.env[name];
-  return value === "1" || value === "true" || value === "yes";
+  const value = process.env[name]?.trim().toLowerCase();
+  return value === "1" || value === "true" || value === "yes" || value === "on";
 }
 function isUnder(parent, child) {
   const normalizedParent = resolve3(parent);
@@ -3517,7 +3817,7 @@ function usesIsolatedTodosHome() {
 function shouldEmitSharedTaskEvents(dbPath) {
   if (envFlag("TODOS_DISABLE_SHARED_EVENTS"))
     return false;
-  if (envFlag("TODOS_ALLOW_EPHEMERAL_SHARED_EVENTS"))
+  if (envFlag("TODOS_ALLOW_EPHEMERAL_SHARED_EVENTS") || envFlag("HASNA_TODOS_ALLOW_GLOBAL_EVENTS_FROM_TEMP_DB"))
     return true;
   if (!isEphemeralTodosDatabase(dbPath))
     return true;
@@ -3619,7 +3919,7 @@ function upsertSecretSafetyConfig(input) {
 }
 var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS;
 var init_redaction = __esm(() => {
-  init_config();
+  init_config2();
   DEFAULT_SECRET_PATTERNS = [
     { name: "aws-access-key", regex: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
     { name: "private-key", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
@@ -3776,7 +4076,7 @@ function checkWorkspacePermission(input = {}) {
 }
 var DEFAULT_DENYLIST, DEFAULT_ENV_REDACTIONS, PRESET_DEFAULTS;
 var init_workspace_trust = __esm(() => {
-  init_config();
+  init_config2();
   DEFAULT_DENYLIST = ["rm -rf", "mkfs", "dd if=", "curl | sh", "wget | sh"];
   DEFAULT_ENV_REDACTIONS = ["API_KEY", "TOKEN", "SECRET", "PASSWORD", "AUTH"];
   PRESET_DEFAULTS = {
@@ -4010,7 +4310,7 @@ function explainRunnerSandbox(input = {}) {
 }
 var DEFAULT_COMMAND_DENYLIST, DEFAULT_ENV_REDACTIONS2;
 var init_runner_sandbox = __esm(() => {
-  init_config();
+  init_config2();
   init_workspace_trust();
   DEFAULT_COMMAND_DENYLIST = ["rm -rf", "mkfs", "dd if=", "curl | sh", "wget | sh"];
   DEFAULT_ENV_REDACTIONS2 = ["API_KEY", "TOKEN", "SECRET", "PASSWORD", "AUTH"];
@@ -4246,7 +4546,7 @@ var LOCAL_EVENT_TYPES, VALID_TARGETS;
 var init_event_hooks = __esm(() => {
   init_redaction();
   init_runner_sandbox();
-  init_config();
+  init_config2();
   init_event_emission_safety();
   LOCAL_EVENT_TYPES = [
     "task.created",
@@ -16636,7 +16936,7 @@ function writeSdkIntegrationFixtures(directory, options = {}) {
 init_audit();
 init_database();
 init_tasks();
-init_config();
+init_config2();
 init_event_emission_safety();
 init_event_hooks();
 
@@ -17260,7 +17560,7 @@ init_task_lifecycle();
 init_tasks();
 init_plans();
 init_task_runs();
-init_config();
+init_config2();
 var LOCAL_ROADMAP_SCHEMA_VERSION = 1;
 function timestamp() {
   return new Date().toISOString();
@@ -17626,7 +17926,7 @@ function renderRoadmapMarkdown(idOrName, db) {
 // src/lib/audit-ledger.ts
 init_database();
 init_task_runs();
-init_config();
+init_config2();
 init_redaction();
 import { createHash as createHash5 } from "crypto";
 var LOCAL_AUDIT_LEDGER_SCHEMA_VERSION = 1;
@@ -19843,7 +20143,7 @@ init_task_runs();
 init_event_hooks();
 
 // src/lib/terminal-notifications.ts
-init_config();
+init_config2();
 init_event_hooks();
 init_redaction();
 var SEVERITY_ORDER = {
@@ -21013,7 +21313,7 @@ function renderLocalReportMarkdown(report) {
 `;
 }
 // src/lib/local-encryption.ts
-init_config();
+init_config2();
 init_redaction();
 import { createCipheriv, createDecipheriv, createHash as createHash8, randomBytes, scryptSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var TODOS_ENCRYPTED_VALUE_KIND = "hasna.todos.encrypted-value";
@@ -21842,168 +22142,9 @@ var TODOS_REGISTRY = createTodosRegistry({
   generatedAt: "1970-01-01T00:00:00.000Z"
 });
 
-// src/storage/config.ts
-var TODOS_STORAGE_TABLES = [
-  "todos_sync_records",
-  "todos_sync_cursors"
-];
-var STORAGE_TABLES = TODOS_STORAGE_TABLES;
-var TODOS_STORAGE_ENV = {
-  mode: "HASNA_TODOS_STORAGE_MODE",
-  databaseUrl: "HASNA_TODOS_DATABASE_URL",
-  databaseSsl: "HASNA_TODOS_DATABASE_SSL",
-  databaseSchema: "HASNA_TODOS_DATABASE_SCHEMA",
-  s3Bucket: "HASNA_TODOS_S3_BUCKET",
-  s3Prefix: "HASNA_TODOS_S3_PREFIX",
-  awsRegion: "HASNA_TODOS_AWS_REGION",
-  s3Endpoint: "HASNA_TODOS_S3_ENDPOINT",
-  s3ForcePathStyle: "HASNA_TODOS_S3_FORCE_PATH_STYLE",
-  s3AccessKeyId: "HASNA_TODOS_S3_ACCESS_KEY_ID",
-  s3SecretAccessKey: "HASNA_TODOS_S3_SECRET_ACCESS_KEY",
-  s3SessionToken: "HASNA_TODOS_S3_SESSION_TOKEN",
-  syncBatchSize: "HASNA_TODOS_SYNC_BATCH_SIZE",
-  syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
-};
-var TODOS_STORAGE_FALLBACK_ENV = {
-  mode: "TODOS_STORAGE_MODE",
-  databaseUrl: "TODOS_DATABASE_URL",
-  databaseSsl: "TODOS_DATABASE_SSL",
-  databaseSchema: "TODOS_DATABASE_SCHEMA",
-  s3Bucket: "TODOS_S3_BUCKET",
-  s3Prefix: "TODOS_S3_PREFIX",
-  awsRegion: "TODOS_AWS_REGION",
-  s3Endpoint: "TODOS_S3_ENDPOINT",
-  s3ForcePathStyle: "TODOS_S3_FORCE_PATH_STYLE",
-  s3AccessKeyId: "TODOS_S3_ACCESS_KEY_ID",
-  s3SecretAccessKey: "TODOS_S3_SECRET_ACCESS_KEY",
-  s3SessionToken: "TODOS_S3_SESSION_TOKEN",
-  syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
-  syncDryRun: "TODOS_SYNC_DRY_RUN"
-};
-var CANONICAL_TODOS_RDS_CLUSTER = "hasna-xyz-infra-apps-prod-postgres";
-var CANONICAL_TODOS_RDS_DATABASE = "todos";
-var CANONICAL_TODOS_RDS_RUNTIME_PATH = "hasna/xyz/opensource/todos/prod/rds";
-function getCanonicalTodosRdsConfig() {
-  return {
-    cluster: CANONICAL_TODOS_RDS_CLUSTER,
-    database: CANONICAL_TODOS_RDS_DATABASE,
-    runtimeSecretPath: CANONICAL_TODOS_RDS_RUNTIME_PATH,
-    primaryEnv: TODOS_STORAGE_ENV.databaseUrl,
-    fallbackEnv: TODOS_STORAGE_FALLBACK_ENV.databaseUrl
-  };
-}
-function loadTodosStorageConfig(env = process.env) {
-  const mode = getTodosStorageMode(env);
-  const databaseUrl = getTodosStorageDatabaseUrl(env);
-  const bucket = readStorageEnv(env, "s3Bucket").value;
-  const prefix = readStorageEnv(env, "s3Prefix").value ?? "todos/";
-  const region = readStorageEnv(env, "awsRegion").value;
-  const endpoint = readStorageEnv(env, "s3Endpoint").value;
-  const schema = readStorageEnv(env, "databaseSchema").value;
-  return {
-    service: "todos",
-    mode,
-    ...databaseUrl ? {
-      database: {
-        provider: "postgres",
-        url: databaseUrl,
-        ssl: parseBoolean(readStorageEnv(env, "databaseSsl").value, true),
-        ...schema ? { schema } : {}
-      }
-    } : {},
-    ...bucket ? {
-      objectStorage: {
-        provider: "s3",
-        bucket,
-        prefix,
-        ...region ? { region } : {},
-        ...endpoint ? { endpoint } : {},
-        forcePathStyle: parseBoolean(readStorageEnv(env, "s3ForcePathStyle").value, false)
-      }
-    } : {},
-    sync: {
-      batchSize: parsePositiveInteger(readStorageEnv(env, "syncBatchSize").value, 500),
-      dryRun: parseBoolean(readStorageEnv(env, "syncDryRun").value, false)
-    }
-  };
-}
-function loadStorageConfig(env = process.env) {
-  return loadTodosStorageConfig(env);
-}
-function isTodosRemoteStorageEnabled(config) {
-  return config.mode === "remote" || config.mode === "hybrid";
-}
-function assertTodosRemoteStorageConfig(config) {
-  if (!isTodosRemoteStorageEnabled(config))
-    return;
-  if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
-  }
-}
-function parseStorageMode(value) {
-  const normalized = clean(value)?.toLowerCase();
-  if (!normalized)
-    return "local";
-  if (normalized === "local" || normalized === "remote" || normalized === "hybrid")
-    return normalized;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be local, remote, or hybrid`);
-}
-function getTodosStorageMode(env = process.env) {
-  return parseStorageMode(readStorageEnv(env, "mode").value);
-}
-function getStorageMode(env = process.env) {
-  return getTodosStorageMode(env);
-}
-function getTodosStorageDatabaseEnv(env = process.env) {
-  return readStorageEnv(env, "databaseUrl").name;
-}
-function getStorageDatabaseEnv(env = process.env) {
-  return getTodosStorageDatabaseEnv(env);
-}
-function getTodosStorageDatabaseUrl(env = process.env) {
-  return readStorageEnv(env, "databaseUrl").value;
-}
-function getStorageDatabaseUrl(env = process.env) {
-  return getTodosStorageDatabaseUrl(env);
-}
-function getTodosStorageEnvName(env, key) {
-  return readStorageEnv(env, key).name;
-}
-function readStorageEnv(env, key) {
-  const primaryName = TODOS_STORAGE_ENV[key];
-  const primaryValue = clean(env[primaryName]);
-  if (primaryValue !== undefined)
-    return { name: primaryName, value: primaryValue };
-  const fallbackName = TODOS_STORAGE_FALLBACK_ENV[key];
-  const fallbackValue = clean(env[fallbackName]);
-  if (fallbackValue !== undefined)
-    return { name: fallbackName, value: fallbackValue };
-  return { name: primaryName };
-}
-function clean(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : undefined;
-}
-function parseBoolean(value, fallback) {
-  const normalized = clean(value)?.toLowerCase();
-  if (!normalized)
-    return fallback;
-  if (["1", "true", "yes", "on"].includes(normalized))
-    return true;
-  if (["0", "false", "no", "off"].includes(normalized))
-    return false;
-  throw new Error(`Expected boolean env value, got ${value}`);
-}
-function parsePositiveInteger(value, fallback) {
-  const normalized = clean(value);
-  if (!normalized)
-    return fallback;
-  const parsed = Number.parseInt(normalized, 10);
-  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
-    throw new Error(`${TODOS_STORAGE_ENV.syncBatchSize} must be a positive integer`);
-  }
-  return parsed;
-}
+// src/storage/index.ts
+init_config();
+
 // src/storage/local-sqlite.ts
 init_tasks();
 init_projects();
@@ -23114,6 +23255,9 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
       PRIMARY KEY (service, object_type, object_id)
     )`,
     `CREATE INDEX IF NOT EXISTS ${tableName}_updated_idx ON ${tableName} (service, updated_at)`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_task_status_idx ON ${tableName} ((payload->>'status')) WHERE object_type = 'tasks' AND deleted_at IS NULL`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_task_project_idx ON ${tableName} ((payload->>'project_id')) WHERE object_type = 'tasks' AND deleted_at IS NULL`,
+    `CREATE INDEX IF NOT EXISTS ${tableName}_payload_gin ON ${tableName} USING gin (payload jsonb_path_ops)`,
     `CREATE TABLE IF NOT EXISTS ${cursorTableName} (
       service text NOT NULL,
       cursor_name text NOT NULL,
@@ -23164,7 +23308,7 @@ class PostgresTodosSyncStore {
         this.service,
         entry.type,
         entry.id,
-        JSON.stringify(entry.payload),
+        entry.payload,
         entry.updatedAt,
         entry.deletedAt,
         sourceMachineId,
@@ -23370,8 +23514,8 @@ function createPostgresTodosStorageAdapter(options) {
     tasks: {
       create: (input, context) => createTask2(input, store, context),
       get: (id) => store.get("tasks", id),
-      list: (filter = {}) => listTasks2(filter, store),
-      count: async (filter = {}) => (await listTasks2(filter, store)).length,
+      list: (filter = {}) => store.listTasks(filter),
+      count: (filter = {}) => store.countTasks(filter),
       update: (id, input) => updateTask2(id, input, store),
       delete: (id, context) => store.delete("tasks", id, context),
       start: (id, agentId) => startTask2(id, agentId, store),
@@ -23487,6 +23631,72 @@ class PostgresJsonRecordStore {
       updatedAt: stringValue2(row.updated_at) ?? new Date().toISOString()
     }));
   }
+  buildTaskFilterSql(filter) {
+    const params = [this.service, "tasks"];
+    const conds = ["service = $1", "object_type = $2", "deleted_at IS NULL"];
+    const p = (value) => {
+      params.push(value);
+      return `$${params.length}`;
+    };
+    const inClause = (column, values) => {
+      if (values.length === 0)
+        return "1=0";
+      return `${column} IN (${values.map((v) => p(v)).join(", ")})`;
+    };
+    if (filter.ids)
+      conds.push(inClause("payload->>'id'", filter.ids));
+    if (filter.project_id !== undefined)
+      conds.push(`payload->>'project_id' = ${p(filter.project_id)}`);
+    if (filter.parent_id !== undefined)
+      conds.push(`payload->>'parent_id' IS NOT DISTINCT FROM ${p(filter.parent_id)}`);
+    if (filter.plan_id !== undefined)
+      conds.push(`payload->>'plan_id' = ${p(filter.plan_id)}`);
+    if (filter.task_list_id !== undefined)
+      conds.push(`payload->>'task_list_id' = ${p(filter.task_list_id)}`);
+    if (filter.status !== undefined)
+      conds.push(inClause("payload->>'status'", toFilterArray(filter.status)));
+    if (filter.priority !== undefined)
+      conds.push(inClause("payload->>'priority'", toFilterArray(filter.priority)));
+    if (filter.assigned_to !== undefined)
+      conds.push(`payload->>'assigned_to' = ${p(filter.assigned_to)}`);
+    if (filter.agent_id !== undefined)
+      conds.push(`payload->>'agent_id' = ${p(filter.agent_id)}`);
+    if (filter.session_id !== undefined)
+      conds.push(`payload->>'session_id' = ${p(filter.session_id)}`);
+    if (filter.tags?.length)
+      conds.push(`payload->'tags' @> ${p(filter.tags)}::jsonb`);
+    if (filter.has_recurrence !== undefined) {
+      conds.push(`(COALESCE(payload->>'recurrence_rule', '') <> '') = ${p(filter.has_recurrence)}`);
+    }
+    if (filter.task_type !== undefined) {
+      conds.push(inClause("COALESCE(payload->>'task_type', '')", toFilterArray(filter.task_type)));
+    }
+    if (filter.include_subtasks !== true)
+      conds.push(`(payload->>'parent_id' IS NULL OR payload->>'parent_id' = '')`);
+    return { where: conds.join(" AND "), params };
+  }
+  async listTasks(filter) {
+    await this.ensureSchema();
+    const { where, params } = this.buildTaskFilterSql(filter);
+    let sql = `/* todos:list-tasks */ SELECT payload FROM ${this.tableName} WHERE ${where} ${TASK_ORDER_BY}`;
+    if (filter.limit !== undefined) {
+      params.push(filter.limit);
+      sql += ` LIMIT $${params.length}`;
+    }
+    if (filter.offset) {
+      params.push(filter.offset);
+      sql += ` OFFSET $${params.length}`;
+    }
+    const result = await this.options.client.query(sql, params);
+    return result.rows.map((row) => payloadRecord2(row.payload));
+  }
+  async countTasks(filter) {
+    await this.ensureSchema();
+    const { where, params } = this.buildTaskFilterSql(filter);
+    const sql = `/* todos:count-tasks */ SELECT COUNT(*)::int AS count FROM ${this.tableName} WHERE ${where}`;
+    const result = await this.options.client.query(sql, params);
+    return Number(result.rows[0]?.count ?? 0);
+  }
   async listTombstones() {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
@@ -23527,7 +23737,7 @@ class PostgresJsonRecordStore {
       this.service,
       type,
       value.id,
-      JSON.stringify(value),
+      jsonbParam(value),
       updatedAt,
       context.requestId ?? this.sourceMachineId ?? null,
       numberValue3(value.version)
@@ -23589,7 +23799,7 @@ class PostgresJsonRecordStore {
       this.service,
       tombstone.object_type,
       tombstone.object_id,
-      JSON.stringify(tombstone.payload ?? { id: tombstone.object_id, deleted_at: deletedAt }),
+      jsonbParam(tombstone.payload ?? { id: tombstone.object_id, deleted_at: deletedAt }),
       updatedAt,
       deletedAt,
       tombstone.source_machine_id ?? context.requestId ?? this.sourceMachineId ?? null,
@@ -23768,13 +23978,15 @@ async function patchTask(task2, patch, store) {
   await store.upsert("tasks", updated);
   return updated;
 }
+var TASK_ORDER_BY = "ORDER BY CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC";
+function toFilterArray(value) {
+  return Array.isArray(value) ? value : [value];
+}
+function jsonbParam(value) {
+  return value;
+}
 async function listTasks2(filter, store) {
-  let tasks = await store.list("tasks");
-  tasks = tasks.filter((task2) => taskMatchesFilter(task2, filter));
-  tasks.sort((a, b) => priorityRank(a.priority) - priorityRank(b.priority) || a.created_at.localeCompare(b.created_at));
-  const offset = filter.offset ?? 0;
-  const limit = filter.limit ?? tasks.length;
-  return tasks.slice(offset, offset + limit);
+  return store.listTasks(filter);
 }
 async function getNextTask2(filters, store) {
   return (await listTasks2({ ...filters, status: "pending", limit: 1 }, store))[0] ?? null;
@@ -24082,43 +24294,6 @@ async function generateProjectPrefix(name, store) {
   }
   return candidate;
 }
-function taskMatchesFilter(task2, filter) {
-  if (filter.ids && !filter.ids.includes(task2.id))
-    return false;
-  if (filter.project_id !== undefined && task2.project_id !== filter.project_id)
-    return false;
-  if (filter.parent_id !== undefined && task2.parent_id !== filter.parent_id)
-    return false;
-  if (filter.plan_id !== undefined && task2.plan_id !== filter.plan_id)
-    return false;
-  if (filter.task_list_id !== undefined && task2.task_list_id !== filter.task_list_id)
-    return false;
-  if (filter.status !== undefined && !matchesOne(task2.status, filter.status))
-    return false;
-  if (filter.priority !== undefined && !matchesOne(task2.priority, filter.priority))
-    return false;
-  if (filter.assigned_to !== undefined && task2.assigned_to !== filter.assigned_to)
-    return false;
-  if (filter.agent_id !== undefined && task2.agent_id !== filter.agent_id)
-    return false;
-  if (filter.session_id !== undefined && task2.session_id !== filter.session_id)
-    return false;
-  if (filter.tags?.length && !filter.tags.every((tag) => task2.tags.includes(tag)))
-    return false;
-  if (filter.has_recurrence !== undefined && Boolean(task2.recurrence_rule) !== filter.has_recurrence)
-    return false;
-  if (filter.include_subtasks !== true && task2.parent_id)
-    return false;
-  if (filter.task_type !== undefined && !matchesOne(task2.task_type ?? "", filter.task_type))
-    return false;
-  return true;
-}
-function matchesOne(value, expected) {
-  return Array.isArray(expected) ? expected.includes(value) : value === expected;
-}
-function priorityRank(priority) {
-  return { critical: 0, high: 1, medium: 2, low: 3 }[priority];
-}
 function slugifyRaw(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
@@ -24178,11 +24353,424 @@ function numberValue3(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
 
+// src/storage/shadow.ts
+var SNAPSHOT_TO_OBJECT_TYPE = {
+  tasks: "tasks",
+  projects: "projects",
+  plans: "plans",
+  agents: "agents",
+  taskLists: "task_lists",
+  templates: "templates",
+  auditHistory: "audit_history"
+};
+
+class TodosShadowMirror {
+  queue = [];
+  syncStore;
+  maxRetries;
+  retryBaseMs;
+  onEvent;
+  schemaReady;
+  pumping = false;
+  scheduledRetries = 0;
+  idleResolvers = [];
+  metrics = {
+    enqueued: 0,
+    mirrored: 0,
+    retries: 0,
+    failed: 0,
+    lastMirrorAt: null,
+    lastLagMs: null,
+    lastError: null
+  };
+  constructor(options) {
+    const syncStore = options.syncStore ?? (options.postgresClient ? createPostgresTodosSyncStore(options.postgresClient, {
+      ...options.sourceMachineId ? { sourceMachineId: options.sourceMachineId } : {}
+    }) : null);
+    if (!syncStore) {
+      throw new Error("shadow mirror requires a Postgres sync store or query client");
+    }
+    this.syncStore = syncStore;
+    this.maxRetries = Math.max(0, options.maxRetries ?? 5);
+    this.retryBaseMs = Math.max(1, options.retryBaseMs ?? 250);
+    if (options.onEvent)
+      this.onEvent = options.onEvent;
+    this.schemaReady = options.ensureSchema === false ? Promise.resolve() : null;
+  }
+  getMetrics() {
+    return {
+      enabled: true,
+      enqueued: this.metrics.enqueued,
+      mirrored: this.metrics.mirrored,
+      retries: this.metrics.retries,
+      failed: this.metrics.failed,
+      divergence: this.metrics.failed + this.queue.length + this.scheduledRetries,
+      pending: this.queue.length + this.scheduledRetries,
+      inFlight: this.pumping || this.scheduledRetries > 0,
+      lastMirrorAt: this.metrics.lastMirrorAt,
+      lastLagMs: this.metrics.lastLagMs,
+      lastError: this.metrics.lastError
+    };
+  }
+  enqueueUpsert(key, record, context) {
+    if (!record || typeof record !== "object")
+      return;
+    const payload = record;
+    if (typeof payload["id"] !== "string" || !payload["id"])
+      return;
+    this.metrics.enqueued += 1;
+    this.queue.push({
+      kind: "upsert",
+      key,
+      record: payload,
+      ...context ? { context } : {},
+      enqueuedAt: Date.now(),
+      attempts: 0
+    });
+    this.pump();
+  }
+  enqueueDelete(objectType, id, context) {
+    if (!id)
+      return;
+    this.metrics.enqueued += 1;
+    this.queue.push({
+      kind: "delete",
+      objectType,
+      id,
+      ...context ? { context } : {},
+      enqueuedAt: Date.now(),
+      attempts: 0
+    });
+    this.pump();
+  }
+  async flush() {
+    if (this.idle())
+      return;
+    await new Promise((resolve10) => {
+      this.idleResolvers.push(resolve10);
+      this.pump();
+    });
+  }
+  idle() {
+    return this.queue.length === 0 && !this.pumping && this.scheduledRetries === 0;
+  }
+  notifyIdle() {
+    if (!this.idle())
+      return;
+    const resolvers = this.idleResolvers;
+    this.idleResolvers = [];
+    for (const resolve10 of resolvers)
+      resolve10();
+  }
+  pump() {
+    if (this.pumping)
+      return;
+    this.pumping = true;
+    this.drain();
+  }
+  async drain() {
+    try {
+      while (this.queue.length > 0) {
+        const op = this.queue.shift();
+        await this.process(op);
+      }
+    } finally {
+      this.pumping = false;
+      this.notifyIdle();
+    }
+  }
+  async process(op) {
+    try {
+      await this.ensureSchema();
+      await this.push(op);
+      const objectType = op.kind === "upsert" ? SNAPSHOT_TO_OBJECT_TYPE[op.key] : op.objectType;
+      const id = op.kind === "upsert" ? String(op.record["id"]) : op.id;
+      const lagMs = Date.now() - op.enqueuedAt;
+      this.metrics.mirrored += 1;
+      this.metrics.lastMirrorAt = new Date().toISOString();
+      this.metrics.lastLagMs = lagMs;
+      this.onEvent?.({ type: "mirrored", objectType, id, lagMs });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const objectType = op.kind === "upsert" ? SNAPSHOT_TO_OBJECT_TYPE[op.key] : op.objectType;
+      const id = op.kind === "upsert" ? String(op.record["id"]) : op.id;
+      this.metrics.retries += 1;
+      this.metrics.lastError = message;
+      op.attempts += 1;
+      if (op.attempts <= this.maxRetries) {
+        this.onEvent?.({ type: "retry", objectType, id, attempt: op.attempts, error: message });
+        const delay = this.retryBaseMs * 2 ** (op.attempts - 1);
+        this.scheduledRetries += 1;
+        setTimeout(() => {
+          this.scheduledRetries -= 1;
+          this.queue.push(op);
+          this.pump();
+        }, delay);
+        return;
+      }
+      this.metrics.failed += 1;
+      this.onEvent?.({ type: "dropped", objectType, id, error: message });
+    }
+  }
+  ensureSchema() {
+    if (!this.schemaReady) {
+      this.schemaReady = this.syncStore.ensureSchema().catch((error) => {
+        this.schemaReady = null;
+        throw error;
+      });
+    }
+    return this.schemaReady;
+  }
+  async push(op) {
+    const snapshot = emptySnapshot();
+    const context = op.context ?? {};
+    if (op.kind === "upsert") {
+      snapshot[op.key].push(op.record);
+    } else {
+      const now4 = new Date().toISOString();
+      const tombstone = {
+        object_type: op.objectType,
+        object_id: op.id,
+        deleted_at: now4,
+        updated_at: now4,
+        payload: { id: op.id, deleted_at: now4 },
+        version: null
+      };
+      snapshot.tombstones = [tombstone];
+    }
+    await this.syncStore.pushSnapshot(snapshot, context);
+  }
+}
+function emptySnapshot() {
+  return {
+    exportedAt: new Date().toISOString(),
+    source: "sqlite",
+    tasks: [],
+    projects: [],
+    projectMachinePaths: [],
+    plans: [],
+    agents: [],
+    taskLists: [],
+    templates: [],
+    auditHistory: [],
+    tombstones: []
+  };
+}
+function createShadowTodosStorageAdapter(options) {
+  const local = options.localAdapter ?? createLocalSqliteTodosStorageAdapter(options.local);
+  const mirror = new TodosShadowMirror(options);
+  const adapter = {
+    ...local,
+    kind: "sqlite",
+    capabilities: { ...local.capabilities, remotePersistence: false, sync: true },
+    tasks: {
+      ...local.tasks,
+      async create(input, context) {
+        const task2 = await local.tasks.create(input, context);
+        mirror.enqueueUpsert("tasks", task2, context);
+        return task2;
+      },
+      async update(id, input, context) {
+        const task2 = await local.tasks.update(id, input, context);
+        mirror.enqueueUpsert("tasks", task2, context);
+        return task2;
+      },
+      async start(id, agentId, context) {
+        const task2 = await local.tasks.start(id, agentId, context);
+        mirror.enqueueUpsert("tasks", task2, context);
+        return task2;
+      },
+      async complete(id, agentId, opts, context) {
+        const task2 = await local.tasks.complete(id, agentId, opts, context);
+        mirror.enqueueUpsert("tasks", task2, context);
+        return task2;
+      },
+      async fail(id, agentId, reason, opts, context) {
+        const result = await local.tasks.fail(id, agentId, reason, opts, context);
+        mirror.enqueueUpsert("tasks", result.task, context);
+        if (result.retryTask)
+          mirror.enqueueUpsert("tasks", result.retryTask, context);
+        return result;
+      },
+      async claimNext(agentId, filters, context) {
+        const task2 = await local.tasks.claimNext(agentId, filters, context);
+        if (task2)
+          mirror.enqueueUpsert("tasks", task2, context);
+        return task2;
+      },
+      async delete(id, context) {
+        const deleted = await local.tasks.delete(id, context);
+        if (deleted)
+          mirror.enqueueDelete("tasks", id, context);
+        return deleted;
+      }
+    },
+    projects: {
+      ...local.projects,
+      async create(input, context) {
+        const project = await local.projects.create(input, context);
+        mirror.enqueueUpsert("projects", project, context);
+        return project;
+      },
+      async update(id, input, context) {
+        const project = await local.projects.update(id, input, context);
+        mirror.enqueueUpsert("projects", project, context);
+        return project;
+      },
+      async delete(id, context) {
+        const deleted = await local.projects.delete(id, context);
+        if (deleted)
+          mirror.enqueueDelete("projects", id, context);
+        return deleted;
+      }
+    },
+    plans: {
+      ...local.plans,
+      async create(input, context) {
+        const plan = await local.plans.create(input, context);
+        mirror.enqueueUpsert("plans", plan, context);
+        return plan;
+      },
+      async update(id, input, context) {
+        const plan = await local.plans.update(id, input, context);
+        mirror.enqueueUpsert("plans", plan, context);
+        return plan;
+      },
+      async delete(id, context) {
+        const deleted = await local.plans.delete(id, context);
+        if (deleted)
+          mirror.enqueueDelete("plans", id, context);
+        return deleted;
+      }
+    },
+    agents: {
+      ...local.agents,
+      async register(input, context) {
+        const result = await local.agents.register(input, context);
+        if (isAgent(result))
+          mirror.enqueueUpsert("agents", result, context);
+        return result;
+      },
+      async update(id, input, context) {
+        const agent = await local.agents.update(id, input, context);
+        if (agent)
+          mirror.enqueueUpsert("agents", agent, context);
+        return agent;
+      }
+    },
+    taskLists: {
+      ...local.taskLists,
+      async create(input, context) {
+        const list = await local.taskLists.create(input, context);
+        mirror.enqueueUpsert("taskLists", list, context);
+        return list;
+      },
+      async update(id, input, context) {
+        const list = await local.taskLists.update(id, input, context);
+        mirror.enqueueUpsert("taskLists", list, context);
+        return list;
+      },
+      async delete(id, context) {
+        const deleted = await local.taskLists.delete(id, context);
+        if (deleted)
+          mirror.enqueueDelete("task_lists", id, context);
+        return deleted;
+      }
+    },
+    templates: {
+      ...local.templates,
+      async create(input, context) {
+        const template = await local.templates.create(input, context);
+        mirror.enqueueUpsert("templates", template, context);
+        return template;
+      },
+      async update(id, input, context) {
+        const template = await local.templates.update(id, input, context);
+        if (template)
+          mirror.enqueueUpsert("templates", template, context);
+        return template;
+      },
+      async delete(id, context) {
+        const deleted = await local.templates.delete(id, context);
+        if (deleted)
+          mirror.enqueueDelete("templates", id, context);
+        return deleted;
+      }
+    },
+    audit: {
+      ...local.audit,
+      async logTaskChange(taskId, action, field2, oldValue, newValue, agentId, context) {
+        const history = await local.audit.logTaskChange(taskId, action, field2, oldValue, newValue, agentId, context);
+        mirror.enqueueUpsert("auditHistory", history, context);
+        return history;
+      }
+    },
+    shadow: mirror
+  };
+  if (adapter.transaction) {
+    const localTransaction = local.transaction;
+    adapter.transaction = (fn, context) => localTransaction(() => fn(adapter), context);
+  }
+  return adapter;
+}
+function isAgent(value) {
+  return !value.conflict;
+}
+
+// src/storage/cloud-client.ts
+init_config();
+function resolveBunSql() {
+  const runtime = globalThis.Bun;
+  const ctor = runtime?.SQL;
+  if (typeof ctor !== "function") {
+    throw new Error("Live Postgres access requires the Bun runtime (Bun.SQL). Run todos under bun, or inject a TodosPostgresQueryClient.");
+  }
+  return ctor;
+}
+function toRows(result) {
+  if (Array.isArray(result))
+    return result;
+  if (result && typeof result === "object" && Array.isArray(result.rows)) {
+    return result.rows;
+  }
+  return [];
+}
+function createTodosCloudQueryClient(url, options = {}) {
+  const SQL = resolveBunSql();
+  const sql = new SQL(url, {
+    max: options.max ?? 2,
+    idleTimeout: options.idleTimeout ?? 20,
+    connectionTimeout: options.connectionTimeout ?? 15
+  });
+  return {
+    async query(text, values = []) {
+      const result = await sql.unsafe(text, values.length ? [...values] : []);
+      return { rows: toRows(result) };
+    },
+    async close() {
+      if (typeof sql.end === "function")
+        await sql.end();
+      else if (typeof sql.close === "function")
+        await sql.close();
+    }
+  };
+}
+function createTodosCloudQueryClientFromEnv(env = process.env, options = {}) {
+  const url = getTodosStorageDatabaseUrl(env);
+  if (!url)
+    return null;
+  return createTodosCloudQueryClient(url, options);
+}
+
 // src/storage/factory.ts
+init_config();
 function createTodosStorageAdapter(options = {}) {
   const config = options.config ?? loadTodosStorageConfig(options.env);
-  if (config.mode === "local")
+  if (config.mode === "local") {
+    if (isTodosShadowEnabled(options.env))
+      return createShadowAdapter(options, config);
     return createLocalSqliteTodosStorageAdapter(options.local);
+  }
   assertTodosRemoteStorageConfig(config);
   const adapter = config.mode === "hybrid" ? options.hybridAdapter ?? createImplicitHybridAdapter(options) ?? options.remoteAdapter : options.remoteAdapter ?? createImplicitPostgresAdapter(options);
   if (!adapter) {
@@ -24191,6 +24779,20 @@ function createTodosStorageAdapter(options = {}) {
   assertRemoteAdapterCapabilities(adapter, config.mode);
   return adapter;
 }
+function createShadowAdapter(options, config) {
+  assertTodosShadowConfig(config, options.env);
+  const postgresClient = options.postgresClient ?? createTodosCloudQueryClientFromEnv(options.env);
+  if (!options.postgresSyncStore && !postgresClient) {
+    throw new Error("shadow mirror requires a remote database URL or an injected Postgres client");
+  }
+  return createShadowTodosStorageAdapter({
+    ...options.shadow ?? {},
+    ...options.local ? { local: options.local } : {},
+    ...options.postgresSyncStore ? { syncStore: options.postgresSyncStore } : {},
+    ...postgresClient ? { postgresClient } : {},
+    ...options.hybrid?.sourceMachineId ? { sourceMachineId: options.hybrid.sourceMachineId } : {}
+  });
+}
 function createImplicitPostgresAdapter(options) {
   if (!options.postgresClient)
     return null;
@@ -24217,6 +24819,326 @@ function assertRemoteAdapterCapabilities(adapter, mode) {
     throw new Error("hybrid storage adapter must also set capabilities.localPersistence=true");
   }
 }
+// src/storage/shadow-outbox.ts
+init_shadow_outbox_schema();
+init_shadow_outbox_schema();
+var MAX_BACKOFF_MS = 5 * 60000;
+
+class TodosShadowOutbox {
+  db;
+  syncStore;
+  local;
+  maxRetries;
+  retryBaseMs;
+  batchSize;
+  onEvent;
+  schemaReady;
+  loopTimer = null;
+  draining = false;
+  metrics = {
+    mirrored: 0,
+    retries: 0,
+    lastMirrorAt: null,
+    lastLagMs: null,
+    lastError: null
+  };
+  constructor(options) {
+    this.db = options.db;
+    const syncStore = options.syncStore ?? (options.postgresClient ? createPostgresTodosSyncStore(options.postgresClient, {
+      ...options.sourceMachineId ? { sourceMachineId: options.sourceMachineId } : {}
+    }) : null);
+    if (!syncStore) {
+      throw new Error("shadow outbox requires a Postgres sync store or query client");
+    }
+    this.syncStore = syncStore;
+    this.local = options.localAdapter ?? createLocalSqliteTodosStorageAdapter({ db: options.db });
+    this.maxRetries = Math.max(0, options.maxRetries ?? 8);
+    this.retryBaseMs = Math.max(1, options.retryBaseMs ?? 500);
+    this.batchSize = Math.max(1, options.batchSize ?? 50);
+    if (options.onEvent)
+      this.onEvent = options.onEvent;
+    this.schemaReady = options.ensureSchema === false ? Promise.resolve() : null;
+  }
+  install() {
+    installShadowOutboxSchema(this.db);
+  }
+  getStats() {
+    const pending = this.countByStatus("pending");
+    const failed = this.countByStatus("failed");
+    return {
+      enabled: true,
+      durable: true,
+      pending,
+      failed,
+      depth: pending + failed,
+      mirrored: this.metrics.mirrored,
+      retries: this.metrics.retries,
+      lastMirrorAt: this.metrics.lastMirrorAt,
+      lastLagMs: this.metrics.lastLagMs,
+      lastError: this.metrics.lastError,
+      draining: this.loopTimer !== null
+    };
+  }
+  countByStatus(status) {
+    const row = this.db.query(`SELECT count(*) AS n FROM shadow_outbox WHERE status=?`).get(status);
+    return row?.n ?? 0;
+  }
+  startLoop(intervalMs = 2000) {
+    if (this.loopTimer)
+      return;
+    this.loopTimer = setInterval(() => {
+      this.drainOnce().catch(() => {});
+    }, Math.max(250, intervalMs));
+    if (typeof this.loopTimer.unref === "function")
+      this.loopTimer.unref();
+  }
+  stopLoop() {
+    if (this.loopTimer) {
+      clearInterval(this.loopTimer);
+      this.loopTimer = null;
+    }
+  }
+  async flush(timeoutMs = 15000) {
+    const deadline = Date.now() + Math.max(0, timeoutMs);
+    while (Date.now() < deadline) {
+      const processed = await this.drainOnce();
+      if (this.countByStatus("pending") === 0)
+        break;
+      if (processed === 0) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+          break;
+        await new Promise((resolve10) => setTimeout(resolve10, Math.min(200, remaining)));
+      }
+    }
+    return this.getStats();
+  }
+  async drainOnce() {
+    if (this.draining)
+      return 0;
+    this.draining = true;
+    try {
+      await this.ensureSchema();
+      const now4 = Date.now();
+      const rows = this.db.query(`SELECT seq, object_type, object_id, op, enqueued_at, attempts, revision
+             FROM shadow_outbox
+            WHERE status='pending' AND next_attempt_at <= ?
+            ORDER BY seq ASC
+            LIMIT ?`).all(now4, this.batchSize);
+      if (rows.length === 0)
+        return 0;
+      for (const row of rows) {
+        await this.processRow(row);
+      }
+      return rows.length;
+    } catch {
+      return 0;
+    } finally {
+      this.draining = false;
+    }
+  }
+  async processRow(row) {
+    try {
+      const snapshot = await this.buildSnapshot(row);
+      await this.syncStore.pushSnapshot(snapshot, {});
+      const lagMs = Date.now() - row.enqueued_at;
+      this.db.run(`DELETE FROM shadow_outbox WHERE seq=? AND revision=?`, [row.seq, row.revision]);
+      this.metrics.mirrored += 1;
+      this.metrics.lastMirrorAt = new Date().toISOString();
+      this.metrics.lastLagMs = lagMs;
+      this.onEvent?.({ type: "mirrored", objectType: row.object_type, id: row.object_id, lagMs });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.metrics.retries += 1;
+      this.metrics.lastError = message;
+      const attempts = row.attempts + 1;
+      if (attempts > this.maxRetries) {
+        this.db.run(`UPDATE shadow_outbox SET attempts=?, last_error=?, status='failed' WHERE seq=? AND revision=?`, [attempts, message, row.seq, row.revision]);
+        this.onEvent?.({ type: "parked", objectType: row.object_type, id: row.object_id, error: message });
+        return;
+      }
+      const delay = Math.min(MAX_BACKOFF_MS, this.retryBaseMs * 2 ** (attempts - 1));
+      this.db.run(`UPDATE shadow_outbox SET attempts=?, next_attempt_at=?, last_error=? WHERE seq=? AND revision=?`, [attempts, Date.now() + delay, message, row.seq, row.revision]);
+      this.onEvent?.({ type: "retry", objectType: row.object_type, id: row.object_id, attempt: attempts, error: message });
+    }
+  }
+  async buildSnapshot(row) {
+    const snapshot = emptySnapshot2();
+    if (row.op === "delete") {
+      snapshot.tombstones = [this.tombstone(row.object_type, row.object_id)];
+      return snapshot;
+    }
+    const record = await this.readCurrent(row.object_type, row.object_id);
+    if (!record) {
+      snapshot.tombstones = [this.tombstone(row.object_type, row.object_id)];
+      return snapshot;
+    }
+    switch (row.object_type) {
+      case "tasks":
+        snapshot.tasks.push(record);
+        break;
+      case "projects":
+        snapshot.projects.push(record);
+        break;
+      case "project_machine_paths":
+        snapshot.projectMachinePaths?.push(record);
+        break;
+      case "plans":
+        snapshot.plans.push(record);
+        break;
+      case "agents":
+        snapshot.agents.push(record);
+        break;
+      case "task_lists":
+        snapshot.taskLists.push(record);
+        break;
+      case "templates":
+        snapshot.templates.push(record);
+        break;
+      case "audit_history":
+        snapshot.auditHistory.push(record);
+        break;
+      default:
+        break;
+    }
+    return snapshot;
+  }
+  async readCurrent(objectType, id) {
+    switch (objectType) {
+      case "tasks":
+        return await this.local.tasks.get(id);
+      case "projects":
+        return await this.local.projects.get(id);
+      case "project_machine_paths": {
+        const raw = this.db.query(`SELECT * FROM project_machine_paths WHERE id=?`).get(id);
+        return raw ?? null;
+      }
+      case "plans":
+        return await this.local.plans.get(id);
+      case "agents":
+        return await this.local.agents.get(id);
+      case "task_lists":
+        return await this.local.taskLists.get(id);
+      case "templates":
+        return await this.local.templates.get(id);
+      case "audit_history": {
+        const raw = this.db.query(`SELECT * FROM task_history WHERE id=?`).get(id);
+        return raw ?? null;
+      }
+      default:
+        return null;
+    }
+  }
+  tombstone(objectType, id) {
+    const now4 = new Date().toISOString();
+    return {
+      object_type: objectType,
+      object_id: id,
+      deleted_at: now4,
+      updated_at: now4,
+      payload: { id, deleted_at: now4 },
+      version: null
+    };
+  }
+  ensureSchema() {
+    if (!this.schemaReady) {
+      this.schemaReady = this.syncStore.ensureSchema().catch((error) => {
+        this.schemaReady = null;
+        throw error;
+      });
+    }
+    return this.schemaReady;
+  }
+}
+function emptySnapshot2() {
+  return {
+    exportedAt: new Date().toISOString(),
+    source: "sqlite",
+    tasks: [],
+    projects: [],
+    projectMachinePaths: [],
+    plans: [],
+    agents: [],
+    taskLists: [],
+    templates: [],
+    auditHistory: [],
+    tombstones: []
+  };
+}
+function createTodosShadowOutbox(options) {
+  const outbox = new TodosShadowOutbox(options);
+  outbox.install();
+  return outbox;
+}
+// src/storage/shadow-runtime.ts
+init_config();
+var _capturedDb = null;
+var _outbox = null;
+var _cloud = null;
+var _exitRegistered = false;
+function maybeInstallShadowCapture2(db, env = process.env) {
+  if (!isTodosShadowEnabled(env))
+    return false;
+  if (_capturedDb === db)
+    return true;
+  installShadowOutboxSchema(db);
+  _capturedDb = db;
+  return true;
+}
+function getRuntimeShadowOutbox(db, env = process.env) {
+  if (!isTodosShadowEnabled(env)) {
+    throw new Error(`dual-write shadow is disabled: set ${getTodosStorageShadowEnvName(env)}=1 to enable it`);
+  }
+  if (_outbox && _capturedDb === db)
+    return _outbox;
+  const cloud = createTodosCloudQueryClientFromEnv(env);
+  if (!cloud) {
+    throw new Error(`dual-write shadow drain requires a remote Postgres DSN in ${getTodosStorageDatabaseEnv(env)}`);
+  }
+  _cloud = cloud;
+  installShadowOutboxSchema(db);
+  _capturedDb = db;
+  _outbox = new TodosShadowOutbox({ db, postgresClient: cloud });
+  return _outbox;
+}
+function startRuntimeShadowDrain(db, env = process.env) {
+  if (!isTodosShadowEnabled(env))
+    return;
+  maybeInstallShadowCapture2(db, env);
+  try {
+    const outbox = getRuntimeShadowOutbox(db, env);
+    outbox.startLoop();
+    registerShadowExitFlush(db, env);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[todos] shadow drain not started: ${message}`);
+  }
+}
+function registerShadowExitFlush(db, env = process.env) {
+  if (_exitRegistered)
+    return;
+  if (!isTodosShadowEnabled(env))
+    return;
+  _exitRegistered = true;
+  const flush = async () => {
+    try {
+      const outbox = getRuntimeShadowOutbox(db, env);
+      await outbox.flush(5000);
+    } catch {} finally {
+      await closeRuntimeShadowCloud();
+    }
+  };
+  process.once("beforeExit", () => {
+    flush();
+  });
+}
+async function closeRuntimeShadowCloud() {
+  if (_cloud) {
+    const cloud = _cloud;
+    _cloud = null;
+    await cloud.close().catch(() => {});
+  }
+}
 // src/storage/s3-artifacts.ts
 import { createHash as createHash9, createHmac as createHmac2 } from "crypto";
 function createTodosS3ArtifactStore(options) {
@@ -24697,7 +25619,7 @@ class TodosTimeoutError extends Error {
 }
 
 // src/sdk/client.ts
-init_config();
+init_config2();
 function buildQuery(params) {
   const search = new URLSearchParams;
   for (const [k, v] of Object.entries(params)) {
@@ -28558,7 +29480,7 @@ CLI equivalent: \`${r.equivalent_cli}\`
 init_task_commits();
 init_database();
 init_tasks();
-init_config();
+init_config2();
 init_redaction();
 import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
 var DEFAULT_RETRY = {
@@ -29028,7 +29950,7 @@ init_task_commits();
 init_database();
 init_tasks();
 init_task_runs();
-init_config();
+init_config2();
 import { relative as relative3, resolve as resolve13 } from "path";
 function normalizePath4(path) {
   return resolve13(path);
@@ -29496,7 +30418,7 @@ init_task_runs();
 init_database();
 init_redaction();
 init_runner_sandbox();
-init_config();
+init_config2();
 function dispatcherFromRun(run) {
   const value = run.metadata["agent_run_dispatcher"];
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -41875,7 +42797,7 @@ function runSearchView(idOrName, db) {
 }
 // src/lib/claude-tasks.ts
 init_tasks();
-init_config();
+init_config2();
 init_sync_utils();
 import { existsSync as existsSync26, readFileSync as readFileSync23, readdirSync as readdirSync5, writeFileSync as writeFileSync20 } from "fs";
 import { join as join24 } from "path";
@@ -42118,7 +43040,7 @@ function syncClaudeTaskList(taskListId, projectId, options = {}) {
 // src/lib/agent-tasks.ts
 init_tasks();
 init_sync_utils();
-init_config();
+init_config2();
 import { existsSync as existsSync27 } from "fs";
 import { join as join25 } from "path";
 function agentBaseDir(agent) {
@@ -42330,7 +43252,7 @@ function syncAgentTaskList(agent, taskListId, projectId, options = {}) {
 }
 
 // src/lib/sync.ts
-init_config();
+init_config2();
 function normalizeAgent2(agent) {
   return agent.trim().toLowerCase();
 }
@@ -42950,7 +43872,7 @@ function checkBudget(agentId, db) {
 }
 
 // src/index.ts
-init_config();
+init_config2();
 init_runner_sandbox();
 init_event_hooks();
 
@@ -43160,7 +44082,7 @@ ${line}`,
 init_tasks();
 init_types();
 init_database();
-init_config();
+init_config2();
 var LOCAL_FIELDS_KEY2 = "local_fields";
 var WORKFLOW_STATE_KEY = "workflow_state";
 var DEFAULT_WORKFLOW_STATES = [
@@ -43621,7 +44543,7 @@ function renderAgentReplaySimulationMarkdown(simulation) {
 `);
 }
 // src/lib/local-extensions.ts
-init_config();
+init_config2();
 import { createHash as createHash17, createVerify } from "crypto";
 import { existsSync as existsSync29, readdirSync as readdirSync6, readFileSync as readFileSync26, statSync as statSync11 } from "fs";
 import { basename as basename6, join as join27, resolve as resolve19 } from "path";
@@ -45729,7 +46651,7 @@ function runTodosDoctor(options = {}) {
 // src/lib/capacity-forecasts.ts
 init_tasks();
 init_task_relations();
-init_config();
+init_config2();
 var LOCAL_CAPACITY_SCHEMA_VERSION = 1;
 function timestamp2() {
   return new Date().toISOString();