@hasna/todos 0.11.85 → 0.11.87

package/dist/server/index.js

@@ -701,6 +701,128 @@ var init_cloud_client = __esm(() => {
   init_config();
 });
 
+// src/types/index.ts
+var TASK_STATUSES, VersionConflictError, TaskNotFoundError, ProjectNotFoundError, PlanNotFoundError, LockError, AgentNotFoundError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DispatchNotFoundError;
+var init_types = __esm(() => {
+  TASK_STATUSES = [
+    "pending",
+    "in_progress",
+    "completed",
+    "failed",
+    "cancelled"
+  ];
+  VersionConflictError = class VersionConflictError extends Error {
+    taskId;
+    expectedVersion;
+    actualVersion;
+    static code = "VERSION_CONFLICT";
+    static suggestion = "Fetch the task with get_task to get the current version before updating.";
+    constructor(taskId, expectedVersion, actualVersion) {
+      super(`Version conflict for task ${taskId}: expected ${expectedVersion}, got ${actualVersion}`);
+      this.taskId = taskId;
+      this.expectedVersion = expectedVersion;
+      this.actualVersion = actualVersion;
+      this.name = "VersionConflictError";
+    }
+  };
+  TaskNotFoundError = class TaskNotFoundError extends Error {
+    taskId;
+    static code = "TASK_NOT_FOUND";
+    static suggestion = "Verify the task ID. Use list_tasks or search_tasks to find the correct ID.";
+    constructor(taskId) {
+      super(`Task not found: ${taskId}`);
+      this.taskId = taskId;
+      this.name = "TaskNotFoundError";
+    }
+  };
+  ProjectNotFoundError = class ProjectNotFoundError extends Error {
+    projectId;
+    static code = "PROJECT_NOT_FOUND";
+    static suggestion = "Use list_projects to see available projects.";
+    constructor(projectId) {
+      super(`Project not found: ${projectId}`);
+      this.projectId = projectId;
+      this.name = "ProjectNotFoundError";
+    }
+  };
+  PlanNotFoundError = class PlanNotFoundError extends Error {
+    planId;
+    static code = "PLAN_NOT_FOUND";
+    static suggestion = "Use list_plans to see available plans.";
+    constructor(planId) {
+      super(`Plan not found: ${planId}`);
+      this.planId = planId;
+      this.name = "PlanNotFoundError";
+    }
+  };
+  LockError = class LockError extends Error {
+    taskId;
+    lockedBy;
+    static code = "LOCK_ERROR";
+    static suggestion = "Wait for the lock to expire (30 min) or contact the lock holder.";
+    constructor(taskId, lockedBy) {
+      super(`Task ${taskId} is locked by ${lockedBy}`);
+      this.taskId = taskId;
+      this.lockedBy = lockedBy;
+      this.name = "LockError";
+    }
+  };
+  AgentNotFoundError = class AgentNotFoundError extends Error {
+    agentId;
+    static code = "AGENT_NOT_FOUND";
+    static suggestion = "Use register_agent to create the agent first, or list_agents to find existing ones.";
+    constructor(agentId) {
+      super(`Agent not found: ${agentId}`);
+      this.agentId = agentId;
+      this.name = "AgentNotFoundError";
+    }
+  };
+  TaskListNotFoundError = class TaskListNotFoundError extends Error {
+    taskListId;
+    static code = "TASK_LIST_NOT_FOUND";
+    static suggestion = "Use list_task_lists to see available lists.";
+    constructor(taskListId) {
+      super(`Task list not found: ${taskListId}`);
+      this.taskListId = taskListId;
+      this.name = "TaskListNotFoundError";
+    }
+  };
+  DependencyCycleError = class DependencyCycleError extends Error {
+    taskId;
+    dependsOn;
+    static code = "DEPENDENCY_CYCLE";
+    static suggestion = "Check the dependency chain with get_task to avoid circular references.";
+    constructor(taskId, dependsOn) {
+      super(`Adding dependency ${taskId} -> ${dependsOn} would create a cycle`);
+      this.taskId = taskId;
+      this.dependsOn = dependsOn;
+      this.name = "DependencyCycleError";
+    }
+  };
+  CompletionGuardError = class CompletionGuardError extends Error {
+    reason;
+    retryAfterSeconds;
+    static code = "COMPLETION_BLOCKED";
+    static suggestion = "Wait for the cooldown period, then retry.";
+    constructor(reason, retryAfterSeconds) {
+      super(reason);
+      this.reason = reason;
+      this.retryAfterSeconds = retryAfterSeconds;
+      this.name = "CompletionGuardError";
+    }
+  };
+  DispatchNotFoundError = class DispatchNotFoundError extends Error {
+    dispatchId;
+    static code = "DISPATCH_NOT_FOUND";
+    static suggestion = "Check the dispatch ID with list_dispatches.";
+    constructor(dispatchId) {
+      super(`Dispatch not found: ${dispatchId}`);
+      this.dispatchId = dispatchId;
+      this.name = "DispatchNotFoundError";
+    }
+  };
+});
+
 // src/storage/postgres-sync.ts
 function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE, cursorTableName = DEFAULT_TODOS_POSTGRES_CURSOR_TABLE) {
   assertSafeIdentifier(tableName);
@@ -730,6 +852,12 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
     )`
   ];
 }
+function postgresTodosCommentCursorIndexSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  assertSafeIdentifier(tableName);
+  return `CREATE INDEX CONCURRENTLY IF NOT EXISTS ${tableName}_comment_task_created_idx
+    ON ${tableName} (service, (payload->>'task_id'), (payload->>'created_at'), object_id)
+    WHERE object_type = 'comments' AND deleted_at IS NULL`;
+}
 
 class PostgresTodosSyncStore {
   client;
@@ -917,6 +1045,203 @@ function assertSafeIdentifier(value) {
 }
 var DEFAULT_TODOS_POSTGRES_SYNC_TABLE = "todos_sync_records", DEFAULT_TODOS_POSTGRES_CURSOR_TABLE = "todos_sync_cursors";
 
+// src/lib/sync-utils.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, readdirSync, statSync, writeFileSync } from "fs";
+import { join as join2 } from "path";
+function getHomeDir() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || "~";
+}
+function getTodosGlobalDir() {
+  return join2(getHomeDir(), ".hasna", "todos");
+}
+function ensureDir(dir) {
+  if (!existsSync2(dir))
+    mkdirSync(dir, { recursive: true });
+}
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeJsonFile(path, data) {
+  writeFileSync(path, JSON.stringify(data, null, 2) + `
+`);
+}
+function appendSyncConflict(metadata, conflict, limit = 5) {
+  const current = Array.isArray(metadata["sync_conflicts"]) ? metadata["sync_conflicts"] : [];
+  const next = [conflict, ...current].slice(0, limit);
+  return { ...metadata, sync_conflicts: next };
+}
+var HOME;
+var init_sync_utils = __esm(() => {
+  HOME = process.env["HOME"] || process.env["USERPROFILE"] || "~";
+});
+
+// src/lib/config.ts
+import { existsSync as existsSync3 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+function getConfigPath() {
+  return join3(getTodosGlobalDir(), "config.json");
+}
+function loadConfig() {
+  if (cached)
+    return cached;
+  if (!existsSync3(getConfigPath())) {
+    cached = {};
+    return cached;
+  }
+  const config = readJsonFile(getConfigPath()) || {};
+  if (typeof config.sync_agents === "string") {
+    config.sync_agents = config.sync_agents.split(",").map((a) => a.trim()).filter(Boolean);
+  }
+  cached = config;
+  return cached;
+}
+function saveConfig(config) {
+  const configPath = getConfigPath();
+  ensureDir(dirname2(configPath));
+  writeJsonFile(configPath, config);
+  cached = config;
+  return config;
+}
+function getAgentPoolForProject(workingDir) {
+  const config = loadConfig();
+  if (workingDir && config.project_pools) {
+    let bestKey = null;
+    let bestLen = 0;
+    for (const key of Object.keys(config.project_pools)) {
+      if (workingDir.startsWith(key) && key.length > bestLen) {
+        bestKey = key;
+        bestLen = key.length;
+      }
+    }
+    if (bestKey && config.project_pools[bestKey]) {
+      return config.project_pools[bestKey];
+    }
+  }
+  return config.agent_pool || null;
+}
+function getCompletionGuardConfig(projectPath) {
+  const config = loadConfig();
+  const global = { ...GUARD_DEFAULTS, ...config.completion_guard };
+  if (projectPath && config.project_overrides?.[projectPath]?.completion_guard) {
+    return { ...global, ...config.project_overrides[projectPath].completion_guard };
+  }
+  return global;
+}
+var cached = null, GUARD_DEFAULTS;
+var init_config2 = __esm(() => {
+  init_sync_utils();
+  GUARD_DEFAULTS = {
+    enabled: false,
+    min_work_seconds: 30,
+    max_completions_per_window: 5,
+    window_minutes: 10,
+    cooldown_seconds: 60
+  };
+});
+
+// src/lib/redaction.ts
+function unique(values) {
+  return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
+}
+function cloneRegex(regex) {
+  return new RegExp(regex.source, regex.flags.includes("g") ? regex.flags : `${regex.flags}g`);
+}
+function customPatterns() {
+  return unique(loadConfig().secret_safety?.redaction_patterns).flatMap((pattern) => {
+    try {
+      return [{ name: `custom:${pattern}`, regex: new RegExp(pattern, "g") }];
+    } catch {
+      return [];
+    }
+  });
+}
+function secretPatterns() {
+  return [...customPatterns(), ...DEFAULT_SECRET_PATTERNS];
+}
+function isSecretKey(key) {
+  if (NON_SECRET_USAGE_KEYS.has(key.toLowerCase()))
+    return false;
+  if (DEFAULT_SECRET_KEY_PATTERN.test(key))
+    return true;
+  return unique(loadConfig().secret_safety?.redaction_keys).some((pattern) => key.toLowerCase().includes(pattern.toLowerCase()));
+}
+function redactEvidenceText(value) {
+  let redacted = value;
+  for (const pattern of secretPatterns()) {
+    const regex = cloneRegex(pattern.regex);
+    const replacement = pattern.replacement ?? "[REDACTED]";
+    redacted = typeof replacement === "string" ? redacted.replace(regex, replacement) : redacted.replace(regex, replacement);
+  }
+  return redacted;
+}
+function redactValue(value) {
+  if (typeof value === "string")
+    return redactEvidenceText(value);
+  if (Array.isArray(value))
+    return value.map(redactValue);
+  if (value && typeof value === "object") {
+    const redacted = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (isSecretKey(key)) {
+        redacted[key] = "[REDACTED]";
+      } else {
+        redacted[key] = redactValue(child);
+      }
+    }
+    return redacted;
+  }
+  return value;
+}
+function listSecretFindings(value) {
+  const findings = [];
+  for (const pattern of secretPatterns()) {
+    const matches = value.match(cloneRegex(pattern.regex));
+    if (matches?.length)
+      findings.push({ pattern: pattern.name, count: matches.length });
+  }
+  return findings;
+}
+function getSecretSafetyConfig() {
+  return {
+    redaction_patterns: unique(loadConfig().secret_safety?.redaction_patterns),
+    redaction_keys: unique(loadConfig().secret_safety?.redaction_keys)
+  };
+}
+function upsertSecretSafetyConfig(input) {
+  const config = loadConfig();
+  const next = {
+    redaction_patterns: unique([...config.secret_safety?.redaction_patterns || [], ...input.redaction_patterns || []]),
+    redaction_keys: unique([...config.secret_safety?.redaction_keys || [], ...input.redaction_keys || []])
+  };
+  saveConfig({ ...config, secret_safety: next });
+  return next;
+}
+var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS;
+var init_redaction = __esm(() => {
+  init_config2();
+  DEFAULT_SECRET_PATTERNS = [
+    { name: "aws-access-key", regex: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
+    { name: "private-key", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
+    { name: "openai-token", regex: /\bsk-[A-Za-z0-9_-]{12,}\b/g, replacement: "[REDACTED_TOKEN]" },
+    { name: "env-secret-assignment", regex: /\b([A-Za-z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)[A-Za-z0-9_]*)\s*=\s*['"]?[^'"\s]{8,}/gi, replacement: "$1=[REDACTED]" },
+    { name: "bearer-token", regex: /\b(bearer)\s+[A-Za-z0-9._~+/=-]{12,}/gi, replacement: "$1 [REDACTED]" }
+  ];
+  DEFAULT_SECRET_KEY_PATTERN = /api[_-]?key|token|secret|password/i;
+  NON_SECRET_USAGE_KEYS = new Set([
+    "tokens",
+    "total_tokens",
+    "token_count",
+    "input_tokens",
+    "output_tokens",
+    "prompt_tokens",
+    "completion_tokens"
+  ]);
+});
+
 // src/storage/postgres-adapter.ts
 import { randomUUID } from "crypto";
 function createPostgresTodosStorageAdapter(options) {
@@ -945,7 +1270,8 @@ function createPostgresTodosStorageAdapter(options) {
       getActiveWork: (filters) => getActiveWork(filters, store),
       getChangedSince: (since, filters) => getChangedSince(since, filters, store),
       lock: (id, agentId) => lockTask(id, agentId, store),
-      unlock: (id, agentId) => unlockTask(id, agentId, store)
+      unlock: (id, agentId) => unlockTask(id, agentId, store),
+      getByFingerprint: (fingerprint) => store.getTaskByFingerprint(fingerprint)
     },
     dependencies: {
       add: (taskId, dependsOn, context) => addDependency(taskId, dependsOn, store, context),
@@ -1013,7 +1339,24 @@ function createPostgresTodosStorageAdapter(options) {
     audit: {
       logTaskChange: (taskId, action, field, oldValue, newValue, agentId, context) => logTaskChange(taskId, action, field, oldValue, newValue, agentId, store, context),
       addComment: (input, context) => addComment(input, store, context),
-      getComments: async (taskId) => (await store.list("comments")).filter((comment) => comment.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
+      getComments: async (taskId) => {
+        const pages = [];
+        let before;
+        while (true) {
+          const page = await store.listComments(taskId, { limit: 1000, ...before ? { before } : {} });
+          if (page.length === 0)
+            break;
+          pages.unshift(page);
+          if (page.length < 1000)
+            break;
+          const oldest = page[0];
+          before = { created_at: oldest.created_at, id: oldest.id };
+        }
+        return pages.flat().map(redactComment).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
+      getCommentsPage: async (taskId, options2) => {
+        return (await store.listComments(taskId, options2)).map(redactComment).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
       getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
       getRecentActivity: async (limit = 20) => (await store.list("audit_history")).sort((a, b) => b.created_at.localeCompare(a.created_at)).slice(0, limit)
     },
@@ -1063,6 +1406,27 @@ class PostgresJsonRecordStore {
   async list(type) {
     return (await this.listRecords(type)).map((record) => record.payload);
   }
+  async listComments(taskId, options = {}) {
+    await this.ensureSchema();
+    const limit = options.limit ?? 100;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1001) {
+      throw new Error("Postgres comment limit must be an integer between 1 and 1001");
+    }
+    const params = [this.service, taskId];
+    let cursorPredicate = "";
+    if (options.before) {
+      params.push(options.before.created_at, options.before.id);
+      cursorPredicate = `AND (payload->>'created_at', object_id) < ($3, $4)`;
+    }
+    params.push(limit);
+    const result = await this.options.client.query(`/* todos:list-comments */ SELECT payload FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'comments' AND deleted_at IS NULL
+         AND payload->>'task_id' = $2
+         ${cursorPredicate}
+       ORDER BY payload->>'created_at' DESC, object_id DESC
+       LIMIT $${params.length}`, params);
+    return result.rows.map((row) => payloadRecord2(row.payload)).reverse();
+  }
   async listRecords(type) {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at
@@ -1134,6 +1498,17 @@ class PostgresJsonRecordStore {
     const result = await this.options.client.query(sql, params);
     return result.rows.map((row) => payloadRecord2(row.payload));
   }
+  async getTaskByFingerprint(fingerprint) {
+    await this.ensureSchema();
+    const sql = `/* todos:task-by-fingerprint */ SELECT payload FROM ${this.tableName}
+      WHERE service = $1 AND object_type = $2 AND deleted_at IS NULL
+        AND payload->'metadata'->>'fingerprint' = $3
+      ORDER BY payload->>'created_at' ASC
+      LIMIT 1`;
+    const result = await this.options.client.query(sql, [this.service, "tasks", fingerprint]);
+    const row = result.rows[0];
+    return row ? payloadRecord2(row.payload) : null;
+  }
   async countTasks(filter) {
     await this.ensureSchema();
     const { where, params } = this.buildTaskFilterSql(filter);
@@ -1445,7 +1820,7 @@ async function lockTask(id, agentId, store) {
 async function unlockTask(id, agentId, store) {
   const task = await requireRecord("tasks", id, store);
   if (agentId && task.locked_by && task.locked_by !== agentId) {
-    throw new Error(`Task ${id} is locked by ${task.locked_by}, not ${agentId}`);
+    throw new LockError(id, task.locked_by);
   }
   await patchTask(task, { locked_by: null, locked_at: null }, store);
   return true;
@@ -1810,13 +2185,16 @@ async function addComment(input, store, context) {
     task_id: input.task_id,
     agent_id: input.agent_id ?? context?.agentId ?? null,
     session_id: input.session_id ?? context?.sessionId ?? null,
-    content: input.content,
+    content: redactEvidenceText(input.content),
     type: input.type ?? "comment",
     progress_pct: input.progress_pct ?? null,
     created_at: new Date().toISOString()
   };
   return store.upsert("comments", comment, context);
 }
+function redactComment(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
+}
 async function exportSnapshot(store) {
   return {
     exportedAt: new Date().toISOString(),
@@ -1962,7 +2340,115 @@ function numberValue2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
 var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_BY = "ORDER BY CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC";
-var init_postgres_adapter = () => {};
+var init_postgres_adapter = __esm(() => {
+  init_types();
+  init_redaction();
+});
+
+// src/storage/comment-redaction-backfill.ts
+var exports_comment_redaction_backfill = {};
+__export(exports_comment_redaction_backfill, {
+  isCommentRedactionBackfillComplete: () => isCommentRedactionBackfillComplete,
+  backfillPostgresCommentRedaction: () => backfillPostgresCommentRedaction,
+  COMMENT_REDACTION_BACKFILL_CONFIRMATION: () => COMMENT_REDACTION_BACKFILL_CONFIRMATION
+});
+function assertSafeIdentifier2(value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`Unsafe Postgres identifier: ${value}`);
+  }
+}
+function payloadObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  if (typeof value !== "string")
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function backfillPostgresCommentRedaction(client, options = {}) {
+  const apply = options.apply === true;
+  if (apply && options.confirmation !== COMMENT_REDACTION_BACKFILL_CONFIRMATION) {
+    throw new Error(`Applying the comment redaction backfill requires confirmation ${COMMENT_REDACTION_BACKFILL_CONFIRMATION}`);
+  }
+  const tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
+  assertSafeIdentifier2(tableName);
+  const service = options.service ?? "todos";
+  const batchSize = options.batchSize ?? 100;
+  if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 500) {
+    throw new Error("Comment redaction backfill batchSize must be an integer between 1 and 500");
+  }
+  const result = {
+    dry_run: !apply,
+    scanned: 0,
+    candidates: 0,
+    updated: 0,
+    conflicts: 0,
+    batches: 0,
+    remaining_candidates: 0
+  };
+  let afterId = "";
+  while (true) {
+    const page = await client.query(`/* todos:comment-redaction-backfill-scan */
+       SELECT object_id, payload
+       FROM ${tableName}
+       WHERE service = $1 AND object_type = 'comments'
+         AND object_id > $2
+       ORDER BY object_id ASC
+       LIMIT $3`, [service, afterId, batchSize]);
+    if (page.rows.length === 0)
+      break;
+    result.batches += 1;
+    for (const row of page.rows) {
+      afterId = row.object_id;
+      result.scanned += 1;
+      const payload = payloadObject(row.payload);
+      const original = payload?.["content"];
+      if (typeof original !== "string")
+        continue;
+      const redacted = redactEvidenceText(original);
+      if (redacted === original)
+        continue;
+      result.candidates += 1;
+      if (!apply)
+        continue;
+      const nextPayload = { ...payload, content: redacted };
+      const update = await client.query(`/* todos:comment-redaction-backfill-apply */
+         UPDATE ${tableName}
+         SET payload = $3::jsonb
+         WHERE service = $1 AND object_type = 'comments' AND object_id = $2
+           AND payload = $4::jsonb
+         RETURNING object_id`, [service, row.object_id, nextPayload, row.payload]);
+      if (update.rows.length === 1)
+        result.updated += 1;
+      else
+        result.conflicts += 1;
+    }
+    if (page.rows.length < batchSize)
+      break;
+  }
+  if (!apply) {
+    result.remaining_candidates = result.candidates;
+    return result;
+  }
+  const verification = await backfillPostgresCommentRedaction(client, {
+    ...options,
+    apply: false,
+    confirmation: undefined
+  });
+  result.remaining_candidates = verification.candidates;
+  return result;
+}
+function isCommentRedactionBackfillComplete(result) {
+  return !result.dry_run && result.conflicts === 0 && result.remaining_candidates === 0;
+}
+var COMMENT_REDACTION_BACKFILL_CONFIRMATION = "REDACT_STORED_TODOS_COMMENTS";
+var init_comment_redaction_backfill = __esm(() => {
+  init_redaction();
+});
 
 // src/server/cloud.ts
 var exports_cloud = {};
@@ -1976,7 +2462,9 @@ __export(exports_cloud, {
   getCloudStorageAdapter: () => getCloudStorageAdapter,
   getApiKeyStore: () => getApiKeyStore,
   ensureCloudSchema: () => ensureCloudSchema,
+  ensureCloudCommentCursorIndex: () => ensureCloudCommentCursorIndex,
   closeCloud: () => closeCloud,
+  backfillCloudCommentRedaction: () => backfillCloudCommentRedaction,
   TODOS_APP_SLUG: () => TODOS_APP_SLUG
 });
 function resolveCloudDatabaseUrl(env = process.env) {
@@ -2054,6 +2542,9 @@ async function ensureCloudSchema() {
   })();
   return schemaEnsured;
 }
+async function ensureCloudCommentCursorIndex() {
+  await getClient().query(postgresTodosCommentCursorIndexSql());
+}
 async function normalizeCloudPayloads() {
   const client = getClient();
   const res = await client.query(`UPDATE todos_sync_records
@@ -2062,6 +2553,9 @@ async function normalizeCloudPayloads() {
      RETURNING object_id AS id`);
   return res.rows.length;
 }
+function backfillCloudCommentRedaction(options = {}) {
+  return backfillPostgresCommentRedaction(getClient(), { ...options, service: TODOS_APP_SLUG });
+}
 async function pingCloud() {
   const client = getClient();
   const res = await client.query("select 1 as ok");
@@ -2082,6 +2576,7 @@ var init_cloud = __esm(() => {
   init_auth();
   init_cloud_client();
   init_postgres_adapter();
+  init_comment_redaction_backfill();
 });
 
 // src/db/migrations.ts
@@ -4383,7 +4878,7 @@ var init_schema = __esm(() => {
 });
 
 // src/db/machines.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { hostname as osHostname, platform as osPlatform, arch as osArch } from "os";
 import { resolve } from "path";
 import { spawnSync } from "child_process";
@@ -4590,7 +5085,7 @@ function getMachineTopologyDiagnostics(opts = {}, db, at = new Date) {
         message: `${project.name} has ${distinctPaths.length} different machine-local paths`
       });
     }
-    if (localRow && !existsSync2(localRow.path)) {
+    if (localRow && !existsSync4(localRow.path)) {
       pathIssues.push({
         type: "path_missing",
         project_id: project.id,
@@ -4601,7 +5096,7 @@ function getMachineTopologyDiagnostics(opts = {}, db, at = new Date) {
         message: `Local path does not exist on this machine: ${localRow.path}`
       });
     }
-    if (!localRow && project.path && machineById.has(localMachine.id) && !existsSync2(project.path)) {
+    if (!localRow && project.path && machineById.has(localMachine.id) && !existsSync4(project.path)) {
       pathIssues.push({
         type: "path_missing",
         project_id: project.id,
@@ -4800,8 +5295,8 @@ __export(exports_database, {
   LOCK_EXPIRY_MINUTES: () => LOCK_EXPIRY_MINUTES
 });
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync3, mkdirSync } from "fs";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "path";
 function isInMemoryDb(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
@@ -4810,12 +5305,12 @@ function findNearestProjectDb(startDir) {
   const stopAt = gitRoot ? resolve2(gitRoot) : resolve2(startDir);
   let dir = resolve2(startDir);
   while (true) {
-    const candidate = join2(dir, ".hasna", "todos", "todos.db");
-    if (existsSync3(candidate))
+    const candidate = join4(dir, ".hasna", "todos", "todos.db");
+    if (existsSync5(candidate))
       return candidate;
     if (dir === stopAt)
       break;
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -4825,9 +5320,9 @@ function findNearestProjectDb(startDir) {
 function findGitRoot(startDir) {
   let dir = resolve2(startDir);
   while (true) {
-    if (existsSync3(join2(dir, ".git")))
+    if (existsSync5(join4(dir, ".git")))
       return dir;
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -4848,25 +5343,25 @@ function getDbPath() {
   if (process.env["TODOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot) {
-      return join2(gitRoot, ".hasna", "todos", "todos.db");
+      return join4(gitRoot, ".hasna", "todos", "todos.db");
     }
   }
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  return join2(home, ".hasna", "todos", "todos.db");
+  return join4(home, ".hasna", "todos", "todos.db");
 }
 function getDatabasePath() {
   return getDbPath();
 }
-function ensureDir(filePath) {
+function ensureDir2(filePath) {
   if (isInMemoryDb(filePath))
     return;
-  const dir = dirname2(resolve2(filePath));
-  if (!existsSync3(dir)) {
-    mkdirSync(dir, { recursive: true });
+  const dir = dirname3(resolve2(filePath));
+  if (!existsSync5(dir)) {
+    mkdirSync2(dir, { recursive: true });
   }
 }
 function openDatabase(path) {
-  ensureDir(path);
+  ensureDir2(path);
   const db = new Database(path);
   db.run("PRAGMA journal_mode = WAL");
   db.run("PRAGMA busy_timeout = 5000");
@@ -5041,226 +5536,6 @@ var init_api_keys = __esm(() => {
   init_database();
 });
 
-// src/types/index.ts
-var TASK_STATUSES, VersionConflictError, TaskNotFoundError, ProjectNotFoundError, PlanNotFoundError, LockError, AgentNotFoundError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DispatchNotFoundError;
-var init_types = __esm(() => {
-  TASK_STATUSES = [
-    "pending",
-    "in_progress",
-    "completed",
-    "failed",
-    "cancelled"
-  ];
-  VersionConflictError = class VersionConflictError extends Error {
-    taskId;
-    expectedVersion;
-    actualVersion;
-    static code = "VERSION_CONFLICT";
-    static suggestion = "Fetch the task with get_task to get the current version before updating.";
-    constructor(taskId, expectedVersion, actualVersion) {
-      super(`Version conflict for task ${taskId}: expected ${expectedVersion}, got ${actualVersion}`);
-      this.taskId = taskId;
-      this.expectedVersion = expectedVersion;
-      this.actualVersion = actualVersion;
-      this.name = "VersionConflictError";
-    }
-  };
-  TaskNotFoundError = class TaskNotFoundError extends Error {
-    taskId;
-    static code = "TASK_NOT_FOUND";
-    static suggestion = "Verify the task ID. Use list_tasks or search_tasks to find the correct ID.";
-    constructor(taskId) {
-      super(`Task not found: ${taskId}`);
-      this.taskId = taskId;
-      this.name = "TaskNotFoundError";
-    }
-  };
-  ProjectNotFoundError = class ProjectNotFoundError extends Error {
-    projectId;
-    static code = "PROJECT_NOT_FOUND";
-    static suggestion = "Use list_projects to see available projects.";
-    constructor(projectId) {
-      super(`Project not found: ${projectId}`);
-      this.projectId = projectId;
-      this.name = "ProjectNotFoundError";
-    }
-  };
-  PlanNotFoundError = class PlanNotFoundError extends Error {
-    planId;
-    static code = "PLAN_NOT_FOUND";
-    static suggestion = "Use list_plans to see available plans.";
-    constructor(planId) {
-      super(`Plan not found: ${planId}`);
-      this.planId = planId;
-      this.name = "PlanNotFoundError";
-    }
-  };
-  LockError = class LockError extends Error {
-    taskId;
-    lockedBy;
-    static code = "LOCK_ERROR";
-    static suggestion = "Wait for the lock to expire (30 min) or contact the lock holder.";
-    constructor(taskId, lockedBy) {
-      super(`Task ${taskId} is locked by ${lockedBy}`);
-      this.taskId = taskId;
-      this.lockedBy = lockedBy;
-      this.name = "LockError";
-    }
-  };
-  AgentNotFoundError = class AgentNotFoundError extends Error {
-    agentId;
-    static code = "AGENT_NOT_FOUND";
-    static suggestion = "Use register_agent to create the agent first, or list_agents to find existing ones.";
-    constructor(agentId) {
-      super(`Agent not found: ${agentId}`);
-      this.agentId = agentId;
-      this.name = "AgentNotFoundError";
-    }
-  };
-  TaskListNotFoundError = class TaskListNotFoundError extends Error {
-    taskListId;
-    static code = "TASK_LIST_NOT_FOUND";
-    static suggestion = "Use list_task_lists to see available lists.";
-    constructor(taskListId) {
-      super(`Task list not found: ${taskListId}`);
-      this.taskListId = taskListId;
-      this.name = "TaskListNotFoundError";
-    }
-  };
-  DependencyCycleError = class DependencyCycleError extends Error {
-    taskId;
-    dependsOn;
-    static code = "DEPENDENCY_CYCLE";
-    static suggestion = "Check the dependency chain with get_task to avoid circular references.";
-    constructor(taskId, dependsOn) {
-      super(`Adding dependency ${taskId} -> ${dependsOn} would create a cycle`);
-      this.taskId = taskId;
-      this.dependsOn = dependsOn;
-      this.name = "DependencyCycleError";
-    }
-  };
-  CompletionGuardError = class CompletionGuardError extends Error {
-    reason;
-    retryAfterSeconds;
-    static code = "COMPLETION_BLOCKED";
-    static suggestion = "Wait for the cooldown period, then retry.";
-    constructor(reason, retryAfterSeconds) {
-      super(reason);
-      this.reason = reason;
-      this.retryAfterSeconds = retryAfterSeconds;
-      this.name = "CompletionGuardError";
-    }
-  };
-  DispatchNotFoundError = class DispatchNotFoundError extends Error {
-    dispatchId;
-    static code = "DISPATCH_NOT_FOUND";
-    static suggestion = "Check the dispatch ID with list_dispatches.";
-    constructor(dispatchId) {
-      super(`Dispatch not found: ${dispatchId}`);
-      this.dispatchId = dispatchId;
-      this.name = "DispatchNotFoundError";
-    }
-  };
-});
-
-// src/lib/sync-utils.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, statSync, writeFileSync } from "fs";
-import { join as join3 } from "path";
-function getHomeDir() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || "~";
-}
-function getTodosGlobalDir() {
-  return join3(getHomeDir(), ".hasna", "todos");
-}
-function ensureDir2(dir) {
-  if (!existsSync4(dir))
-    mkdirSync2(dir, { recursive: true });
-}
-function readJsonFile(path) {
-  try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function writeJsonFile(path, data) {
-  writeFileSync(path, JSON.stringify(data, null, 2) + `
-`);
-}
-function appendSyncConflict(metadata, conflict, limit = 5) {
-  const current = Array.isArray(metadata["sync_conflicts"]) ? metadata["sync_conflicts"] : [];
-  const next = [conflict, ...current].slice(0, limit);
-  return { ...metadata, sync_conflicts: next };
-}
-var HOME;
-var init_sync_utils = __esm(() => {
-  HOME = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-});
-
-// src/lib/config.ts
-import { existsSync as existsSync5 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
-function getConfigPath() {
-  return join4(getTodosGlobalDir(), "config.json");
-}
-function loadConfig() {
-  if (cached)
-    return cached;
-  if (!existsSync5(getConfigPath())) {
-    cached = {};
-    return cached;
-  }
-  const config = readJsonFile(getConfigPath()) || {};
-  if (typeof config.sync_agents === "string") {
-    config.sync_agents = config.sync_agents.split(",").map((a) => a.trim()).filter(Boolean);
-  }
-  cached = config;
-  return cached;
-}
-function saveConfig(config) {
-  const configPath = getConfigPath();
-  ensureDir2(dirname3(configPath));
-  writeJsonFile(configPath, config);
-  cached = config;
-  return config;
-}
-function getAgentPoolForProject(workingDir) {
-  const config = loadConfig();
-  if (workingDir && config.project_pools) {
-    let bestKey = null;
-    let bestLen = 0;
-    for (const key of Object.keys(config.project_pools)) {
-      if (workingDir.startsWith(key) && key.length > bestLen) {
-        bestKey = key;
-        bestLen = key.length;
-      }
-    }
-    if (bestKey && config.project_pools[bestKey]) {
-      return config.project_pools[bestKey];
-    }
-  }
-  return config.agent_pool || null;
-}
-function getCompletionGuardConfig(projectPath) {
-  const config = loadConfig();
-  const global = { ...GUARD_DEFAULTS, ...config.completion_guard };
-  if (projectPath && config.project_overrides?.[projectPath]?.completion_guard) {
-    return { ...global, ...config.project_overrides[projectPath].completion_guard };
-  }
-  return global;
-}
-var cached = null, GUARD_DEFAULTS;
-var init_config2 = __esm(() => {
-  init_sync_utils();
-  GUARD_DEFAULTS = {
-    enabled: false,
-    min_work_seconds: 30,
-    max_completions_per_window: 5,
-    window_minutes: 10,
-    cooldown_seconds: 60
-  };
-});
-
 // src/db/storage-tombstones.ts
 function recordStorageTombstone(input, db) {
   const d = db ?? getDatabase();
@@ -5697,105 +5972,6 @@ var init_event_emission_safety = __esm(() => {
   init_sync_utils();
 });
 
-// src/lib/redaction.ts
-function unique(values) {
-  return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
-}
-function cloneRegex(regex) {
-  return new RegExp(regex.source, regex.flags.includes("g") ? regex.flags : `${regex.flags}g`);
-}
-function customPatterns() {
-  return unique(loadConfig().secret_safety?.redaction_patterns).flatMap((pattern) => {
-    try {
-      return [{ name: `custom:${pattern}`, regex: new RegExp(pattern, "g") }];
-    } catch {
-      return [];
-    }
-  });
-}
-function secretPatterns() {
-  return [...customPatterns(), ...DEFAULT_SECRET_PATTERNS];
-}
-function isSecretKey(key) {
-  if (NON_SECRET_USAGE_KEYS.has(key.toLowerCase()))
-    return false;
-  if (DEFAULT_SECRET_KEY_PATTERN.test(key))
-    return true;
-  return unique(loadConfig().secret_safety?.redaction_keys).some((pattern) => key.toLowerCase().includes(pattern.toLowerCase()));
-}
-function redactEvidenceText(value) {
-  let redacted = value;
-  for (const pattern of secretPatterns()) {
-    const regex = cloneRegex(pattern.regex);
-    const replacement = pattern.replacement ?? "[REDACTED]";
-    redacted = typeof replacement === "string" ? redacted.replace(regex, replacement) : redacted.replace(regex, replacement);
-  }
-  return redacted;
-}
-function redactValue(value) {
-  if (typeof value === "string")
-    return redactEvidenceText(value);
-  if (Array.isArray(value))
-    return value.map(redactValue);
-  if (value && typeof value === "object") {
-    const redacted = {};
-    for (const [key, child] of Object.entries(value)) {
-      if (isSecretKey(key)) {
-        redacted[key] = "[REDACTED]";
-      } else {
-        redacted[key] = redactValue(child);
-      }
-    }
-    return redacted;
-  }
-  return value;
-}
-function listSecretFindings(value) {
-  const findings = [];
-  for (const pattern of secretPatterns()) {
-    const matches = value.match(cloneRegex(pattern.regex));
-    if (matches?.length)
-      findings.push({ pattern: pattern.name, count: matches.length });
-  }
-  return findings;
-}
-function getSecretSafetyConfig() {
-  return {
-    redaction_patterns: unique(loadConfig().secret_safety?.redaction_patterns),
-    redaction_keys: unique(loadConfig().secret_safety?.redaction_keys)
-  };
-}
-function upsertSecretSafetyConfig(input) {
-  const config = loadConfig();
-  const next = {
-    redaction_patterns: unique([...config.secret_safety?.redaction_patterns || [], ...input.redaction_patterns || []]),
-    redaction_keys: unique([...config.secret_safety?.redaction_keys || [], ...input.redaction_keys || []])
-  };
-  saveConfig({ ...config, secret_safety: next });
-  return next;
-}
-var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS;
-var init_redaction = __esm(() => {
-  init_config2();
-  DEFAULT_SECRET_PATTERNS = [
-    { name: "aws-access-key", regex: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
-    { name: "private-key", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
-    { name: "openai-token", regex: /\bsk-[A-Za-z0-9_-]{12,}\b/g, replacement: "[REDACTED_TOKEN]" },
-    { name: "env-secret-assignment", regex: /\b([A-Za-z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)[A-Za-z0-9_]*)\s*=\s*['"]?[^'"\s]{8,}/gi, replacement: "$1=[REDACTED]" },
-    { name: "bearer-token", regex: /\b(bearer)\s+[A-Za-z0-9._~+/=-]{12,}/gi, replacement: "$1 [REDACTED]" }
-  ];
-  DEFAULT_SECRET_KEY_PATTERN = /api[_-]?key|token|secret|password/i;
-  NON_SECRET_USAGE_KEYS = new Set([
-    "tokens",
-    "total_tokens",
-    "token_count",
-    "input_tokens",
-    "output_tokens",
-    "prompt_tokens",
-    "completion_tokens"
-  ]);
-});
-
 // src/lib/workspace-trust.ts
 import { relative, resolve as resolve4 } from "path";
 function normalizePath(path) {
@@ -11232,7 +11408,7 @@ function getComment(id, db) {
 }
 function listComments(taskId, db) {
   const d = db || getDatabase();
-  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at").all(taskId);
+  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at, rowid").all(taskId);
 }
 function updateComment(id, input, db) {
   const d = db || getDatabase();
@@ -14966,6 +15142,10 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       list: (filter = {}) => listTasks2(filter, database()),
       count: (filter = {}) => countTasks(filter, database()),
       update: (id, input) => updateTask2(id, input, database()),
+      unlock: (id, agentId) => {
+        unlockTask2(id, agentId, database());
+        return true;
+      },
       delete: (id) => deleteTask(id, database()),
       start: (id, agentId) => startTask2(id, agentId, database()),
       complete: (id, agentId, options2) => completeTask2(id, agentId, database(), options2),
@@ -15017,6 +15197,20 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       logTaskChange: (taskId, action, field, oldValue, newValue, agentId) => logTaskChange2(taskId, action, field, oldValue, newValue, agentId, database()),
       addComment: (input) => addComment2(input, database()),
       getComments: (taskId) => listComments(taskId, database()),
+      getCommentsPage: (taskId, options2) => {
+        if (options2?.limit !== undefined && (!Number.isSafeInteger(options2.limit) || options2.limit < 1 || options2.limit > 1001)) {
+          throw new Error("Comment limit must be an integer between 1 and 1001");
+        }
+        let comments = listComments(taskId, database());
+        comments = comments.sort((left, right) => left.created_at.localeCompare(right.created_at) || left.id.localeCompare(right.id));
+        if (options2?.before) {
+          const before = options2.before;
+          comments = comments.filter((comment) => comment.created_at < before.created_at || comment.created_at === before.created_at && comment.id < before.id);
+        }
+        if (options2?.limit !== undefined)
+          comments = comments.slice(-options2.limit);
+        return comments;
+      },
       getTaskHistory: (taskId) => getTaskHistory(taskId, database()),
       getRecentActivity: (limit) => getRecentActivity(limit, database())
     },
@@ -15404,6 +15598,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
       schemas: {
         Task: taskSchema,
         Project: projectSchema,
+        TaskComment: taskCommentSchema,
         CreateTaskInput: {
           type: "object",
           required: ["title"],
@@ -15438,6 +15633,17 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             description: { type: "string" },
             task_prefix: { type: "string" }
           }
+        },
+        CreateTaskCommentInput: {
+          type: "object",
+          required: ["content"],
+          properties: {
+            content: { type: "string", minLength: 1 },
+            agent_id: { type: "string" },
+            session_id: { type: "string" },
+            type: { type: "string", enum: ["comment", "progress", "note"] },
+            progress_pct: { type: "number" }
+          }
         }
       }
     },
@@ -15536,6 +15742,61 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           }
         }
       },
+      "/v1/tasks/{id}/comments": {
+        get: {
+          operationId: "listTaskComments",
+          summary: "List a bounded page of task comments",
+          description: "Returns the newest page in oldest-to-newest display order. Use next_cursor to request older pages; count is the page size, not a total. Pagination-aware clients must send limit during the mixed-version rollout.",
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            { name: "limit", in: "query", required: true, schema: { type: "integer", minimum: 1, maximum: 500, default: 100 } },
+            { name: "cursor", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    required: ["comments", "count", "has_more", "next_cursor"],
+                    properties: {
+                      comments: { type: "array", maxItems: 500, items: { $ref: "#/components/schemas/TaskComment" } },
+                      count: { type: "integer", minimum: 0, maximum: 500 },
+                      has_more: { type: "boolean" },
+                      next_cursor: { type: "string", nullable: true }
+                    }
+                  }
+                }
+              }
+            },
+            "426": {
+              description: "Upgrade required: a predecessor client omitted limit and the complete legacy history exceeds 500 comments, or the configured storage adapter lacks cursor pagination support."
+            }
+          }
+        },
+        post: {
+          operationId: "createTaskComment",
+          summary: "Create a task comment",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/CreateTaskCommentInput" } } }
+          },
+          responses: {
+            "201": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    required: ["comment"],
+                    properties: { comment: { $ref: "#/components/schemas/TaskComment" } }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
       "/v1/tasks/{id}/start": {
         post: {
           operationId: "startTask",
@@ -15654,7 +15915,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     }
   };
 }
-var taskSchema, projectSchema;
+var taskSchema, projectSchema, taskCommentSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   taskSchema = {
@@ -15685,6 +15946,20 @@ var init_openapi = __esm(() => {
       updated_at: { type: "string" }
     }
   };
+  taskCommentSchema = {
+    type: "object",
+    required: ["id", "task_id", "agent_id", "session_id", "content", "type", "progress_pct", "created_at"],
+    properties: {
+      id: { type: "string" },
+      task_id: { type: "string" },
+      agent_id: { type: "string", nullable: true },
+      session_id: { type: "string", nullable: true },
+      content: { type: "string" },
+      type: { type: "string", enum: ["comment", "progress", "note"] },
+      progress_pct: { type: "number", nullable: true },
+      created_at: { type: "string", format: "date-time" }
+    }
+  };
 });
 
 // src/server/v1.ts
@@ -15714,6 +15989,29 @@ function contextFromPrincipal(principal, body) {
   const agentId = body?.agent_id || principal.agent || undefined;
   return agentId ? { agentId } : {};
 }
+function redactComment2(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
+}
+function encodeCommentCursor(comment) {
+  return Buffer.from(JSON.stringify({ created_at: comment.created_at, id: comment.id }), "utf8").toString("base64url");
+}
+function decodeCommentCursor(value) {
+  if (value.length > 1024)
+    throw new Error("invalid comment cursor");
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    throw new Error("invalid comment cursor");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("invalid comment cursor");
+  const cursor = parsed;
+  if (typeof cursor["created_at"] !== "string" || cursor["created_at"].length > 64 || !Number.isFinite(Date.parse(cursor["created_at"])) || typeof cursor["id"] !== "string" || !cursor["id"] || cursor["id"].length > 256) {
+    throw new Error("invalid comment cursor");
+  }
+  return { created_at: cursor["created_at"], id: cursor["id"] };
+}
 function normalizeImportSnapshot(raw) {
   const body = raw && typeof raw === "object" ? raw : {};
   const arr = (v) => Array.isArray(v) ? v : [];
@@ -15734,7 +16032,7 @@ function normalizeImportSnapshot(raw) {
 function countSnapshotRecords(s) {
   return s.tasks.length + s.projects.length + (s.projectMachinePaths?.length ?? 0) + s.plans.length + s.agents.length + s.taskLists.length + s.templates.length + s.auditHistory.length + (s.tombstones?.length ?? 0);
 }
-async function handleV1Request(req, url) {
+async function handleV1Request(req, url, dependencies = {}) {
   const path = url.pathname;
   if (path !== "/v1" && !path.startsWith("/v1/"))
     return null;
@@ -15743,7 +16041,7 @@ async function handleV1Request(req, url) {
   const requiredScopes = [isWrite ? "todos:write" : "todos:read"];
   let verifier;
   try {
-    verifier = getCloudVerifier();
+    verifier = (dependencies.getVerifier ?? getCloudVerifier)();
   } catch (e) {
     return error(503, e.message);
   }
@@ -15752,8 +16050,8 @@ async function handleV1Request(req, url) {
     return error(decision.status, decision.message, { reason: decision.reason });
   }
   const principal = decision.principal;
-  await ensureCloudSchema();
-  const store = getCloudStorageAdapter();
+  await (dependencies.ensureSchema ?? ensureCloudSchema)();
+  const store = (dependencies.getStorageAdapter ?? getCloudStorageAdapter)();
   const segments = path.split("/").filter(Boolean);
   const resource = segments[1];
   const id = segments[2];
@@ -15781,13 +16079,74 @@ async function handleV1Request(req, url) {
           missing
         });
       }
+      if (id === "upsert" && !action) {
+        if (method !== "POST")
+          return error(405, `method ${method} not allowed on /v1/tasks/upsert`);
+        if (typeof store.tasks.getByFingerprint !== "function") {
+          return error(501, "fingerprint upsert is not supported by this storage backend");
+        }
+        const body = await readJson(req) ?? {};
+        const fingerprint = typeof body.fingerprint === "string" ? body.fingerprint.trim() : "";
+        if (!fingerprint)
+          return error(400, "fingerprint is required");
+        if (typeof body.title !== "string" || !body.title.trim())
+          return error(400, "title is required");
+        const existing = await store.tasks.getByFingerprint(fingerprint);
+        const metadata = {
+          ...existing?.metadata ?? {},
+          ...body.metadata ?? {},
+          fingerprint
+        };
+        const fields = { metadata };
+        for (const key of [
+          "title",
+          "description",
+          "priority",
+          "status",
+          "project_id",
+          "assigned_to",
+          "working_dir",
+          "plan_id",
+          "task_list_id",
+          "tags",
+          "due_at",
+          "estimated_minutes",
+          "sla_minutes",
+          "requires_approval",
+          "recurrence_rule",
+          "task_type"
+        ]) {
+          const bag = body;
+          if (bag[key] !== undefined)
+            fields[key] = bag[key];
+        }
+        if (!existing) {
+          const task = await store.tasks.create({ ...fields, title: body.title }, contextFromPrincipal(principal, body));
+          return json2({ task, created: true }, 201);
+        }
+        try {
+          const task = await store.tasks.update(existing.id, { ...fields, version: existing.version }, contextFromPrincipal(principal, body));
+          return json2({ task, created: false });
+        } catch (e) {
+          const msg = e.message || "";
+          if (msg.includes("version conflict"))
+            return error(409, msg);
+          throw e;
+        }
+      }
       if (!id) {
         if (method === "GET") {
           const filter = {
-            ...url.searchParams.get("status") ? { status: url.searchParams.get("status") } : {},
-            ...url.searchParams.get("priority") ? { priority: url.searchParams.get("priority") } : {},
+            ...url.searchParams.get("status") ? {
+              status: url.searchParams.get("status").includes(",") ? url.searchParams.get("status").split(",") : url.searchParams.get("status")
+            } : {},
+            ...url.searchParams.get("priority") ? {
+              priority: url.searchParams.get("priority").includes(",") ? url.searchParams.get("priority").split(",") : url.searchParams.get("priority")
+            } : {},
             ...url.searchParams.get("project_id") ? { project_id: url.searchParams.get("project_id") } : {},
+            ...url.searchParams.has("parent_id") ? { parent_id: url.searchParams.get("parent_id") || null, include_subtasks: true } : {},
             ...url.searchParams.get("plan_id") ? { plan_id: url.searchParams.get("plan_id") } : {},
+            ...url.searchParams.get("task_list_id") ? { task_list_id: url.searchParams.get("task_list_id") } : {},
             ...url.searchParams.get("assigned_to") ? { assigned_to: url.searchParams.get("assigned_to") } : {},
             ...url.searchParams.get("agent_id") ? { agent_id: url.searchParams.get("agent_id") } : {},
             ...url.searchParams.get("limit") ? { limit: Number(url.searchParams.get("limit")) } : {},
@@ -15811,8 +16170,47 @@ async function handleV1Request(req, url) {
       if (action) {
         if (action === "comments") {
           if (method === "GET") {
-            const comments = await store.audit.getComments(id);
-            return json2({ comments, count: comments.length });
+            if (!await store.tasks.get(id))
+              return error(404, "task not found");
+            const rawLimit = url.searchParams.get("limit");
+            const cursor = url.searchParams.get("cursor");
+            if (rawLimit === null && cursor === null) {
+              const storageContext = contextFromPrincipal(principal);
+              const legacyPage = (await (store.audit.getCommentsPage ? store.audit.getCommentsPage(id, { limit: LEGACY_COMMENT_RESPONSE_LIMIT + 1 }, storageContext) : store.audit.getComments(id, storageContext))).map(redactComment2);
+              if (legacyPage.length > LEGACY_COMMENT_RESPONSE_LIMIT) {
+                return error(426, "task has too many comments for this client; upgrade @hasna/todos to use cursor pagination");
+              }
+              return json2({
+                comments: legacyPage,
+                count: legacyPage.length,
+                has_more: false,
+                next_cursor: null
+              });
+            }
+            const limit = rawLimit === null ? DEFAULT_COMMENT_PAGE_SIZE : Number(rawLimit);
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_COMMENT_PAGE_SIZE) {
+              return error(400, `limit must be an integer between 1 and ${MAX_COMMENT_PAGE_SIZE}`);
+            }
+            let before;
+            if (cursor) {
+              try {
+                before = decodeCommentCursor(cursor);
+              } catch {
+                return error(400, "invalid comment cursor");
+              }
+            }
+            if (!store.audit.getCommentsPage) {
+              return error(426, "storage adapter must be upgraded to support cursor-paginated comments");
+            }
+            const page = (await store.audit.getCommentsPage(id, { limit: limit + 1, ...before ? { before } : {} }, contextFromPrincipal(principal))).map(redactComment2);
+            const hasMore = page.length > limit;
+            const comments = hasMore ? page.slice(1) : page;
+            return json2({
+              comments,
+              count: comments.length,
+              has_more: hasMore,
+              next_cursor: hasMore && comments[0] ? encodeCommentCursor(comments[0]) : null
+            });
           }
           if (method === "POST") {
             const body2 = await readJson(req) ?? {};
@@ -15830,24 +16228,45 @@ async function handleV1Request(req, url) {
               type: body2.type,
               progress_pct: body2.progress_pct
             }, contextFromPrincipal(principal, body2));
-            return json2({ comment }, 201);
+            return json2({ comment: redactComment2(comment) }, 201);
           }
           return error(405, `method ${method} not allowed on /v1/tasks/:id/comments`);
         }
+        if (action === "history") {
+          if (method !== "GET")
+            return error(405, `method ${method} not allowed on /v1/tasks/:id/history`);
+          if (!await store.tasks.get(id))
+            return error(404, "task not found");
+          const history = await store.audit.getTaskHistory(id);
+          return json2({ history, count: history.length });
+        }
         if (action === "lock" || action === "unlock") {
           if (method !== "POST")
             return error(405, `method ${method} not allowed on /v1/tasks/:id/${action}`);
-          if (typeof store.tasks.lock !== "function" || typeof store.tasks.unlock !== "function") {
-            return error(501, "task locking is not supported by this storage backend");
-          }
           const body2 = await readJson(req) ?? {};
           if (!await store.tasks.get(id))
             return error(404, "task not found");
           if (action === "lock") {
-            const agentId2 = body2.agent_id || principal.agent || "todos-serve";
-            return json2({ result: await store.tasks.lock(id, agentId2) });
-          }
-          const released = await store.tasks.unlock(id, body2.agent_id || principal.agent || undefined);
+            if (typeof store.tasks.lock !== "function")
+              return error(501, "task locking is not supported by this storage backend");
+            const agentId3 = body2.agent_id || principal.agent || "todos-serve";
+            return json2({ result: await store.tasks.lock(id, agentId3) });
+          }
+          if (typeof store.tasks.unlock !== "function")
+            return error(501, "task unlocking is not supported by this storage backend");
+          if (body2.force === true) {
+            if (!principal.scopes.includes("todos:*"))
+              return error(403, "force unlock requires todos:* scope");
+            const released2 = await store.tasks.unlock(id);
+            return json2({ success: released2 });
+          }
+          if (body2.agent_id && principal.agent && body2.agent_id !== principal.agent && !principal.scopes.includes("todos:*")) {
+            return error(403, "unlock agent_id must match the authenticated agent");
+          }
+          const agentId2 = principal.agent || body2.agent_id;
+          if (!agentId2)
+            return error(403, "unlock requires an agent-bound key or force=true");
+          const released = await store.tasks.unlock(id, agentId2);
           return json2({ success: released });
         }
         if (action === "dependencies") {
@@ -16130,12 +16549,28 @@ async function handleV1Request(req, url) {
       const activity = await store.audit.getRecentActivity(limit);
       return json2({ activity, count: activity.length });
     }
-    if (resource === "task-lists" && !id) {
-      if (method !== "GET")
-        return error(405, `method ${method} not allowed on /v1/task-lists`);
-      const projectId = url.searchParams.get("project_id") ?? undefined;
-      const taskLists = await store.taskLists.list(projectId);
-      return json2({ task_lists: taskLists, count: taskLists.length });
+    if (resource === "task-lists") {
+      if (!id && method === "GET") {
+        const projectId = url.searchParams.get("project_id") ?? undefined;
+        const taskLists = await store.taskLists.list(projectId);
+        return json2({ task_lists: taskLists, count: taskLists.length });
+      }
+      if (!id && method === "POST") {
+        const body = await readJson(req);
+        if (!body || typeof body.name !== "string" || !body.name.trim())
+          return error(400, "name is required");
+        const taskList = await store.taskLists.create(body, contextFromPrincipal(principal));
+        return json2({ task_list: taskList }, 201);
+      }
+      if (id && method === "GET") {
+        const taskList = await store.taskLists.get(id);
+        return taskList ? json2({ task_list: taskList }) : error(404, "task list not found");
+      }
+      if (id && method === "DELETE") {
+        const deleted = await store.taskLists.delete(id, contextFromPrincipal(principal));
+        return deleted ? json2({ deleted: true, id }) : error(404, "task list not found");
+      }
+      return error(405, `method ${method} not allowed on /v1/task-lists${id ? "/:id" : ""}`);
     }
     if (resource === "dependencies" && !id) {
       if (method !== "GET")
@@ -16143,8 +16578,8 @@ async function handleV1Request(req, url) {
       if (typeof store.dependencies?.listAll !== "function") {
         return error(501, "dependency edge listing is not supported by this storage backend");
       }
-      const dependencies = await store.dependencies.listAll();
-      return json2({ dependencies, count: dependencies.length });
+      const dependencies2 = await store.dependencies.listAll();
+      return json2({ dependencies: dependencies2, count: dependencies2.length });
     }
     if (resource === "commits" && id) {
       if (method !== "GET")
@@ -16201,12 +16636,16 @@ async function handleV1Request(req, url) {
     }
     return error(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
+    if (e instanceof LockError)
+      return error(409, e.message, { code: LockError.code });
     return error(500, e.message || "internal error");
   }
 }
-var JSON_HEADERS;
+var JSON_HEADERS, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500;
 var init_v1 = __esm(() => {
+  init_types();
   init_cloud();
+  init_redaction();
   JSON_HEADERS = { "Content-Type": "application/json" };
 });
 
@@ -19583,7 +20022,7 @@ class JSONSchemaGenerator {
               if (val === undefined) {
                 if (this.unrepresentable === "throw") {
                   throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                } else {}
+                }
               } else if (typeof val === "bigint") {
                 if (this.unrepresentable === "throw") {
                   throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -43949,14 +44388,18 @@ function unwrapTask(raw) {
 }
 function toListQuery(filter = {}) {
   const query = {};
-  if (typeof filter.status === "string")
-    query["status"] = filter.status;
-  if (typeof filter.priority === "string")
-    query["priority"] = filter.priority;
+  if (filter.status)
+    query["status"] = Array.isArray(filter.status) ? filter.status.join(",") : filter.status;
+  if (filter.priority)
+    query["priority"] = Array.isArray(filter.priority) ? filter.priority.join(",") : filter.priority;
   if (filter.project_id)
     query["project_id"] = filter.project_id;
+  if (filter.parent_id !== undefined)
+    query["parent_id"] = filter.parent_id ?? "";
   if (filter.plan_id)
     query["plan_id"] = filter.plan_id;
+  if (filter.task_list_id)
+    query["task_list_id"] = filter.task_list_id;
   if (filter.assigned_to)
     query["assigned_to"] = filter.assigned_to;
   if (filter.agent_id)
@@ -44006,10 +44449,19 @@ async function cloudListProjects(client) {
 }
 async function cloudAddComment(client, taskId, input) {
   const raw = await client.transport.post(`/tasks/${encodeURIComponent(taskId)}/comments`, input);
-  if (raw && typeof raw === "object" && "comment" in raw) {
-    return raw.comment;
-  }
-  return raw;
+  const comment = raw && typeof raw === "object" && "comment" in raw ? raw.comment : raw;
+  if (!isTaskComment(comment))
+    throw new Error("Invalid cloud comment response");
+  return redactComment3(comment);
+}
+function isTaskComment(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const comment = value;
+  return typeof comment["id"] === "string" && typeof comment["task_id"] === "string" && (comment["agent_id"] === null || typeof comment["agent_id"] === "string") && (comment["session_id"] === null || typeof comment["session_id"] === "string") && typeof comment["content"] === "string" && (comment["type"] === "comment" || comment["type"] === "progress" || comment["type"] === "note") && (comment["progress_pct"] === null || typeof comment["progress_pct"] === "number") && typeof comment["created_at"] === "string";
+}
+function redactComment3(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
 }
 async function cloudCountTasks(client, filter = {}) {
   const { limit: _drop, offset: _o, ...rest } = filter;
@@ -44042,6 +44494,7 @@ async function cloudReleaseAgent(client, idOrName, sessionId) {
 var _cache;
 var init_cloud_router = __esm(() => {
   init_storage();
+  init_redaction();
 });
 
 // src/mcp/tools/task-crud.ts
@@ -69380,7 +69833,7 @@ var require_to_json_schema = __commonJS((exports) => {
                 if (val === undefined) {
                   if (this.unrepresentable === "throw") {
                     throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                  } else {}
+                  }
                 } else if (typeof val === "bigint") {
                   if (this.unrepresentable === "throw") {
                     throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -89861,7 +90314,7 @@ function captureEnvironmentSnapshot(input = {}) {
 }
 function writeEnvironmentSnapshot(snapshot, outputPath) {
   const path = outputPath ? resolve16(outputPath) : join14(defaultSnapshotDir(), `${snapshot.id}.json`);
-  ensureDir2(dirname9(path));
+  ensureDir(dirname9(path));
   writeJsonFile(path, snapshot);
   return path;
 }
@@ -91048,11 +91501,19 @@ function printHelp2() {
 
 Start the @hasna/todos dashboard server.
 
+Commands:
+  migrate                 Apply idempotent schema migrations
+  redact-comments         Preview historical comment redaction (dry-run by default)
+
 Options:
   --port <port>     HTTP port to bind. Defaults to ${DEFAULT_PORT}
   --host <host>     Hostname to bind. Defaults to 127.0.0.1
   --api-key <key>   Require this API key for dashboard/API requests
   --no-open         Do not open the dashboard in a browser
+  --batch-size <n>  redact-comments batch size, 1-500 (default: 100)
+  --apply           Apply redact-comments changes (default is dry-run)
+  --confirm <value> Explicit confirmation required with --apply
+  --json            Emit redact-comments aggregate JSON
   -V, --version     output the version number
   -h, --help        display help for command
 
@@ -91091,7 +91552,14 @@ async function findFreePort(start) {
   return start;
 }
 async function runMigrate() {
-  const { ensureCloudSchema: ensureCloudSchema2, normalizeCloudPayloads: normalizeCloudPayloads2, pingCloud: pingCloud2, resolveCloudDatabaseUrl: resolveCloudDatabaseUrl2, closeCloud: closeCloud2 } = await Promise.resolve().then(() => (init_cloud(), exports_cloud));
+  const {
+    ensureCloudSchema: ensureCloudSchema2,
+    ensureCloudCommentCursorIndex: ensureCloudCommentCursorIndex2,
+    normalizeCloudPayloads: normalizeCloudPayloads2,
+    pingCloud: pingCloud2,
+    resolveCloudDatabaseUrl: resolveCloudDatabaseUrl2,
+    closeCloud: closeCloud2
+  } = await Promise.resolve().then(() => (init_cloud(), exports_cloud));
   if (!resolveCloudDatabaseUrl2()) {
     console.error("migrate: no database URL (HASNA_TODOS_DATABASE_URL / TODOS_DATABASE_URL / DATABASE_URL)");
     process.exit(2);
@@ -91103,15 +91571,55 @@ async function runMigrate() {
   console.log("migrate: normalizing legacy double-encoded jsonb payloads\u2026");
   const normalized = await normalizeCloudPayloads2();
   console.log(`migrate: normalized ${normalized} payload row(s)`);
+  console.log("migrate: prebuilding comment cursor index concurrently\u2026");
+  await ensureCloudCommentCursorIndex2();
   console.log("migrate: done");
   await closeCloud2();
   process.exit(0);
 }
-async function main2() {
-  if (process.argv.includes("migrate")) {
-    await runMigrate();
-    return;
+async function runCommentRedactionBackfill() {
+  const {
+    backfillCloudCommentRedaction: backfillCloudCommentRedaction2,
+    resolveCloudDatabaseUrl: resolveCloudDatabaseUrl2,
+    closeCloud: closeCloud2
+  } = await Promise.resolve().then(() => (init_cloud(), exports_cloud));
+  const {
+    COMMENT_REDACTION_BACKFILL_CONFIRMATION: COMMENT_REDACTION_BACKFILL_CONFIRMATION2,
+    isCommentRedactionBackfillComplete: isCommentRedactionBackfillComplete2
+  } = await Promise.resolve().then(() => (init_comment_redaction_backfill(), exports_comment_redaction_backfill));
+  if (!resolveCloudDatabaseUrl2()) {
+    console.error("redact-comments: no database URL (HASNA_TODOS_DATABASE_URL / TODOS_DATABASE_URL / DATABASE_URL)");
+    process.exit(2);
+  }
+  const apply = process.argv.includes("--apply");
+  const rawBatchSize = parseStringArg("--batch-size");
+  try {
+    const report = await backfillCloudCommentRedaction2({
+      apply,
+      confirmation: parseStringArg("--confirm"),
+      batchSize: rawBatchSize === undefined ? 100 : Number(rawBatchSize)
+    });
+    if (process.argv.includes("--json")) {
+      console.log(JSON.stringify(report));
+    } else {
+      console.log(`redact-comments: ${report.dry_run ? "dry-run" : "applied"}; scanned=${report.scanned} candidates=${report.candidates} updated=${report.updated} conflicts=${report.conflicts} remaining=${report.remaining_candidates} batches=${report.batches}`);
+      if (report.dry_run && report.candidates > 0) {
+        console.log(`redact-comments: obtain approval before using --apply --confirm=${COMMENT_REDACTION_BACKFILL_CONFIRMATION2}`);
+      }
+    }
+    if (apply && !isCommentRedactionBackfillComplete2(report)) {
+      console.error("redact-comments: incomplete apply; resolve conflicts and rerun until conflicts=0 and remaining=0");
+      process.exitCode = 1;
+    }
+  } catch (error3) {
+    const message = error3.message.replace(/postgres(?:ql)?:\/\/[^@\s]+@/gi, "postgresql://[REDACTED]@");
+    console.error(`redact-comments: failed: ${message}`);
+    process.exitCode = 1;
+  } finally {
+    await closeCloud2();
   }
+}
+async function main2() {
   if (hasVersionFlag2()) {
     console.log(getPackageVersion());
     return;
@@ -91120,6 +91628,14 @@ async function main2() {
     printHelp2();
     return;
   }
+  if (process.argv.includes("migrate")) {
+    await runMigrate();
+    return;
+  }
+  if (process.argv.includes("redact-comments")) {
+    await runCommentRedactionBackfill();
+    return;
+  }
   const explicitPortArg = process.argv.some((a) => a === "--port" || a.startsWith("--port="));
   const envPort = process.env.PORT ? parseInt(process.env.PORT, 10) : undefined;
   const requestedPort = explicitPortArg ? parsePort() : envPort ?? parsePort();