@hasna/todos 0.11.86 → 0.11.87

package/dist/cli/index.js

@@ -1011,7 +1011,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -8478,6 +8478,310 @@ var init_storage = __esm(() => {
   IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
 });
 
+// src/lib/sync-utils.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, readdirSync, statSync, writeFileSync } from "fs";
+import { join as join2 } from "path";
+function getHomeDir() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || "~";
+}
+function getTodosGlobalDir() {
+  return join2(getHomeDir(), ".hasna", "todos");
+}
+function ensureDir(dir) {
+  if (!existsSync2(dir))
+    mkdirSync(dir, { recursive: true });
+}
+function listJsonFiles(dir) {
+  if (!existsSync2(dir))
+    return [];
+  return readdirSync(dir).filter((f) => f.endsWith(".json"));
+}
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeJsonFile(path, data) {
+  writeFileSync(path, JSON.stringify(data, null, 2) + `
+`);
+}
+function readHighWaterMark(dir) {
+  const path = join2(dir, ".highwatermark");
+  if (!existsSync2(path))
+    return 1;
+  const val = parseInt(readFileSync2(path, "utf-8").trim(), 10);
+  return isNaN(val) ? 1 : val;
+}
+function writeHighWaterMark(dir, value) {
+  writeFileSync(join2(dir, ".highwatermark"), String(value));
+}
+function getFileMtimeMs(path) {
+  try {
+    return statSync(path).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function parseTimestamp(value) {
+  if (typeof value !== "string")
+    return null;
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+function appendSyncConflict(metadata, conflict, limit = 5) {
+  const current = Array.isArray(metadata["sync_conflicts"]) ? metadata["sync_conflicts"] : [];
+  const next = [conflict, ...current].slice(0, limit);
+  return { ...metadata, sync_conflicts: next };
+}
+var HOME;
+var init_sync_utils = __esm(() => {
+  HOME = process.env["HOME"] || process.env["USERPROFILE"] || "~";
+});
+
+// src/lib/config.ts
+var exports_config = {};
+__export(exports_config, {
+  updateConfig: () => updateConfig,
+  saveConfig: () => saveConfig,
+  resetConfig: () => resetConfig,
+  normalizeApiUrl: () => normalizeApiUrl,
+  loadConfig: () => loadConfig,
+  getTaskPrefixConfig: () => getTaskPrefixConfig,
+  getSyncAgentsFromConfig: () => getSyncAgentsFromConfig,
+  getLocalApiConfig: () => getLocalApiConfig,
+  getConfigPath: () => getConfigPath,
+  getCompletionGuardConfig: () => getCompletionGuardConfig,
+  getAgentTasksDir: () => getAgentTasksDir,
+  getAgentTaskListId: () => getAgentTaskListId,
+  getAgentPoolForProject: () => getAgentPoolForProject
+});
+import { existsSync as existsSync3 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+function getConfigPath() {
+  return join3(getTodosGlobalDir(), "config.json");
+}
+function resetConfig() {
+  cached = null;
+}
+function normalizeAgent(agent) {
+  return agent.trim().toLowerCase();
+}
+function loadConfig() {
+  if (cached)
+    return cached;
+  if (!existsSync3(getConfigPath())) {
+    cached = {};
+    return cached;
+  }
+  const config = readJsonFile(getConfigPath()) || {};
+  if (typeof config.sync_agents === "string") {
+    config.sync_agents = config.sync_agents.split(",").map((a) => a.trim()).filter(Boolean);
+  }
+  cached = config;
+  return cached;
+}
+function saveConfig(config) {
+  const configPath = getConfigPath();
+  ensureDir(dirname2(configPath));
+  writeJsonFile(configPath, config);
+  cached = config;
+  return config;
+}
+function updateConfig(patch) {
+  return saveConfig({ ...loadConfig(), ...patch });
+}
+function normalizeApiUrl(value) {
+  const trimmed = value?.trim();
+  if (!trimmed)
+    return null;
+  return trimmed.replace(/\/+$/, "");
+}
+function getLocalApiConfig(env = process.env) {
+  const config = loadConfig();
+  const envApiUrl = normalizeApiUrl(env["TODOS_URL"]);
+  const configApiUrl = normalizeApiUrl(config.apiUrl);
+  const apiUrl = envApiUrl ?? configApiUrl;
+  const apiKey = env["TODOS_API_KEY"] || config.apiKey || null;
+  return {
+    apiUrl,
+    apiKey,
+    source: {
+      apiUrl: envApiUrl ? "TODOS_URL" : configApiUrl ? "config" : "none",
+      apiKey: env["TODOS_API_KEY"] ? "TODOS_API_KEY" : config.apiKey ? "config" : "none"
+    }
+  };
+}
+function getSyncAgentsFromConfig() {
+  const config = loadConfig();
+  const agents = config.sync_agents;
+  if (Array.isArray(agents) && agents.length > 0)
+    return agents.map(normalizeAgent);
+  return null;
+}
+function getAgentTaskListId(agent) {
+  const config = loadConfig();
+  const key = normalizeAgent(agent);
+  return config.agents?.[key]?.task_list_id || config.task_list_id || null;
+}
+function getAgentTasksDir(agent) {
+  const config = loadConfig();
+  const key = normalizeAgent(agent);
+  return config.agents?.[key]?.tasks_dir || config.agent_tasks_dir || null;
+}
+function getTaskPrefixConfig() {
+  const config = loadConfig();
+  return config.task_prefix || null;
+}
+function getAgentPoolForProject(workingDir) {
+  const config = loadConfig();
+  if (workingDir && config.project_pools) {
+    let bestKey = null;
+    let bestLen = 0;
+    for (const key of Object.keys(config.project_pools)) {
+      if (workingDir.startsWith(key) && key.length > bestLen) {
+        bestKey = key;
+        bestLen = key.length;
+      }
+    }
+    if (bestKey && config.project_pools[bestKey]) {
+      return config.project_pools[bestKey];
+    }
+  }
+  return config.agent_pool || null;
+}
+function getCompletionGuardConfig(projectPath) {
+  const config = loadConfig();
+  const global = { ...GUARD_DEFAULTS, ...config.completion_guard };
+  if (projectPath && config.project_overrides?.[projectPath]?.completion_guard) {
+    return { ...global, ...config.project_overrides[projectPath].completion_guard };
+  }
+  return global;
+}
+var cached = null, GUARD_DEFAULTS;
+var init_config = __esm(() => {
+  init_sync_utils();
+  GUARD_DEFAULTS = {
+    enabled: false,
+    min_work_seconds: 30,
+    max_completions_per_window: 5,
+    window_minutes: 10,
+    cooldown_seconds: 60
+  };
+});
+
+// src/lib/redaction.ts
+var exports_redaction = {};
+__export(exports_redaction, {
+  upsertSecretSafetyConfig: () => upsertSecretSafetyConfig,
+  redactValue: () => redactValue,
+  redactEvidenceText: () => redactEvidenceText,
+  listSecretFindings: () => listSecretFindings,
+  hasSecretFindings: () => hasSecretFindings,
+  getSecretSafetyConfig: () => getSecretSafetyConfig
+});
+function unique(values) {
+  return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
+}
+function cloneRegex(regex) {
+  return new RegExp(regex.source, regex.flags.includes("g") ? regex.flags : `${regex.flags}g`);
+}
+function customPatterns() {
+  return unique(loadConfig().secret_safety?.redaction_patterns).flatMap((pattern) => {
+    try {
+      return [{ name: `custom:${pattern}`, regex: new RegExp(pattern, "g") }];
+    } catch {
+      return [];
+    }
+  });
+}
+function secretPatterns() {
+  return [...customPatterns(), ...DEFAULT_SECRET_PATTERNS];
+}
+function isSecretKey(key) {
+  if (NON_SECRET_USAGE_KEYS.has(key.toLowerCase()))
+    return false;
+  if (DEFAULT_SECRET_KEY_PATTERN.test(key))
+    return true;
+  return unique(loadConfig().secret_safety?.redaction_keys).some((pattern) => key.toLowerCase().includes(pattern.toLowerCase()));
+}
+function redactEvidenceText(value) {
+  let redacted = value;
+  for (const pattern of secretPatterns()) {
+    const regex = cloneRegex(pattern.regex);
+    const replacement = pattern.replacement ?? "[REDACTED]";
+    redacted = typeof replacement === "string" ? redacted.replace(regex, replacement) : redacted.replace(regex, replacement);
+  }
+  return redacted;
+}
+function redactValue(value) {
+  if (typeof value === "string")
+    return redactEvidenceText(value);
+  if (Array.isArray(value))
+    return value.map(redactValue);
+  if (value && typeof value === "object") {
+    const redacted = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (isSecretKey(key)) {
+        redacted[key] = "[REDACTED]";
+      } else {
+        redacted[key] = redactValue(child);
+      }
+    }
+    return redacted;
+  }
+  return value;
+}
+function listSecretFindings(value) {
+  const findings = [];
+  for (const pattern of secretPatterns()) {
+    const matches = value.match(cloneRegex(pattern.regex));
+    if (matches?.length)
+      findings.push({ pattern: pattern.name, count: matches.length });
+  }
+  return findings;
+}
+function hasSecretFindings(value) {
+  return listSecretFindings(value).length > 0;
+}
+function getSecretSafetyConfig() {
+  return {
+    redaction_patterns: unique(loadConfig().secret_safety?.redaction_patterns),
+    redaction_keys: unique(loadConfig().secret_safety?.redaction_keys)
+  };
+}
+function upsertSecretSafetyConfig(input) {
+  const config = loadConfig();
+  const next = {
+    redaction_patterns: unique([...config.secret_safety?.redaction_patterns || [], ...input.redaction_patterns || []]),
+    redaction_keys: unique([...config.secret_safety?.redaction_keys || [], ...input.redaction_keys || []])
+  };
+  saveConfig({ ...config, secret_safety: next });
+  return next;
+}
+var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS;
+var init_redaction = __esm(() => {
+  init_config();
+  DEFAULT_SECRET_PATTERNS = [
+    { name: "aws-access-key", regex: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
+    { name: "private-key", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
+    { name: "openai-token", regex: /\bsk-[A-Za-z0-9_-]{12,}\b/g, replacement: "[REDACTED_TOKEN]" },
+    { name: "env-secret-assignment", regex: /\b([A-Za-z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)[A-Za-z0-9_]*)\s*=\s*['"]?[^'"\s]{8,}/gi, replacement: "$1=[REDACTED]" },
+    { name: "bearer-token", regex: /\b(bearer)\s+[A-Za-z0-9._~+/=-]{12,}/gi, replacement: "$1 [REDACTED]" }
+  ];
+  DEFAULT_SECRET_KEY_PATTERN = /api[_-]?key|token|secret|password/i;
+  NON_SECRET_USAGE_KEYS = new Set([
+    "tokens",
+    "total_tokens",
+    "token_count",
+    "input_tokens",
+    "output_tokens",
+    "prompt_tokens",
+    "completion_tokens"
+  ]);
+});
+
 // src/cli/cloud-router.ts
 function getTodosCloudClient(env = process.env) {
   if (_cache !== undefined)
@@ -8503,14 +8807,18 @@ function unwrapTask(raw) {
 }
 function toListQuery(filter = {}) {
   const query = {};
-  if (typeof filter.status === "string")
-    query["status"] = filter.status;
-  if (typeof filter.priority === "string")
-    query["priority"] = filter.priority;
+  if (filter.status)
+    query["status"] = Array.isArray(filter.status) ? filter.status.join(",") : filter.status;
+  if (filter.priority)
+    query["priority"] = Array.isArray(filter.priority) ? filter.priority.join(",") : filter.priority;
   if (filter.project_id)
     query["project_id"] = filter.project_id;
+  if (filter.parent_id !== undefined)
+    query["parent_id"] = filter.parent_id ?? "";
   if (filter.plan_id)
     query["plan_id"] = filter.plan_id;
+  if (filter.task_list_id)
+    query["task_list_id"] = filter.task_list_id;
   if (filter.assigned_to)
     query["assigned_to"] = filter.assigned_to;
   if (filter.agent_id)
@@ -8566,10 +8874,82 @@ async function cloudListPlans(client, projectId) {
 }
 async function cloudAddComment(client, taskId, input) {
   const raw = await client.transport.post(`/tasks/${encodeURIComponent(taskId)}/comments`, input);
-  if (raw && typeof raw === "object" && "comment" in raw) {
-    return raw.comment;
+  const comment = raw && typeof raw === "object" && "comment" in raw ? raw.comment : raw;
+  if (!isTaskComment(comment))
+    throw new Error("Invalid cloud comment response");
+  return redactComment(comment);
+}
+async function cloudListComments(client, taskId, options = {}) {
+  const limit = options.limit ?? 100;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+    throw new Error("Cloud comment limit must be an integer between 1 and 500");
   }
-  return raw;
+  if (options.cursor !== undefined && (typeof options.cursor !== "string" || !options.cursor || options.cursor.length > 1024)) {
+    throw new Error("Cloud comment cursor must be a non-empty string");
+  }
+  let raw;
+  try {
+    raw = await client.transport.get(`/tasks/${encodeURIComponent(taskId)}/comments`, {
+      query: { limit, ...options.cursor ? { cursor: options.cursor } : {} }
+    });
+  } catch (error) {
+    const status = error && typeof error === "object" ? error.status : undefined;
+    if (status === 404 || status === 405) {
+      throw new Error("Cloud task comments require a compatible @hasna/todos server; deploy the server endpoint before this CLI.", { cause: error });
+    }
+    throw error;
+  }
+  const envelope = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+  const candidate = Array.isArray(raw) ? raw : envelope?.comments;
+  if (!Array.isArray(candidate) || !candidate.every(isTaskComment)) {
+    throw new Error("Invalid cloud comments response");
+  }
+  if (envelope?.count !== undefined && (!Number.isSafeInteger(envelope.count) || envelope.count < 0 || envelope.count !== candidate.length)) {
+    throw new Error("Invalid cloud comments response count");
+  }
+  const hasHasMore = envelope ? Object.prototype.hasOwnProperty.call(envelope, "has_more") : false;
+  const hasNextCursor = envelope ? Object.prototype.hasOwnProperty.call(envelope, "next_cursor") : false;
+  if (hasHasMore !== hasNextCursor)
+    throw new Error("Invalid cloud comments pagination response");
+  const paginationSupported = hasHasMore && hasNextCursor;
+  if (!paginationSupported) {
+    const comments = candidate.slice(-limit).map(redactComment);
+    return {
+      comments,
+      count: comments.length,
+      has_more: candidate.length > limit,
+      next_cursor: null,
+      limit,
+      pagination_supported: false
+    };
+  }
+  if (candidate.length > limit)
+    throw new Error("Invalid cloud comments response: page exceeds requested limit");
+  const hasMore = envelope.has_more;
+  const nextCursor = envelope.next_cursor;
+  if (typeof hasMore !== "boolean" || nextCursor !== null && (typeof nextCursor !== "string" || !nextCursor)) {
+    throw new Error("Invalid cloud comments pagination response");
+  }
+  if (hasMore && nextCursor === null || !hasMore && nextCursor !== null) {
+    throw new Error("Invalid cloud comments pagination response");
+  }
+  return {
+    comments: candidate.map(redactComment),
+    count: candidate.length,
+    has_more: hasMore,
+    next_cursor: nextCursor,
+    limit,
+    pagination_supported: true
+  };
+}
+function isTaskComment(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const comment = value;
+  return typeof comment["id"] === "string" && typeof comment["task_id"] === "string" && (comment["agent_id"] === null || typeof comment["agent_id"] === "string") && (comment["session_id"] === null || typeof comment["session_id"] === "string") && typeof comment["content"] === "string" && (comment["type"] === "comment" || comment["type"] === "progress" || comment["type"] === "note") && (comment["progress_pct"] === null || typeof comment["progress_pct"] === "number") && typeof comment["created_at"] === "string";
+}
+function redactComment(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
 }
 async function cloudTaskHistory(client, taskId) {
   const raw = await client.transport.get(`/tasks/${encodeURIComponent(taskId)}/history`);
@@ -8657,8 +9037,8 @@ async function cloudLockTask(client, id, agentId) {
   }
   return raw ?? { success: true };
 }
-async function cloudUnlockTask(client, id, agentId) {
-  const raw = await client.transport.post(`/tasks/${encodeURIComponent(id)}/unlock`, agentId ? { agent_id: agentId } : {});
+async function cloudUnlockTask(client, id, agentId, force = false) {
+  const raw = await client.transport.post(`/tasks/${encodeURIComponent(id)}/unlock`, { ...agentId ? { agent_id: agentId } : {}, ...force ? { force: true } : {} });
   if (raw && typeof raw === "object" && "success" in raw) {
     return Boolean(raw.success);
   }
@@ -8787,6 +9167,25 @@ async function cloudListTaskLists(client, projectId) {
     return envelope.taskLists;
   return Array.isArray(raw) ? raw : [];
 }
+async function cloudResolveTaskListRef(client, ref, projectId) {
+  const lists = await cloudListTaskLists(client, projectId);
+  const exact = lists.find((list) => list.id === ref || list.slug === ref);
+  if (exact)
+    return exact.id;
+  const prefixes = lists.filter((list) => list.id.startsWith(ref));
+  return prefixes.length === 1 ? prefixes[0].id : null;
+}
+async function cloudCreateTaskList(client, input) {
+  const raw = await client.transport.post("/task-lists", input);
+  if (raw && typeof raw === "object" && "task_list" in raw) {
+    return raw.task_list;
+  }
+  return raw;
+}
+async function cloudDeleteTaskList(client, id) {
+  await client.delete("task-lists", id);
+  return true;
+}
 async function cloudNextTask(client, agent, filters) {
   const query = {};
   if (agent)
@@ -8811,11 +9210,11 @@ async function cloudAllDependencies(client) {
   return Array.isArray(raw) ? raw : [];
 }
 async function cloudGetTasksByIds(client, ids) {
-  const unique = Array.from(new Set(ids));
+  const unique2 = Array.from(new Set(ids));
   const map = new Map;
   const CONCURRENCY = 8;
-  for (let i = 0;i < unique.length; i += CONCURRENCY) {
-    const batch = unique.slice(i, i + CONCURRENCY);
+  for (let i = 0;i < unique2.length; i += CONCURRENCY) {
+    const batch = unique2.slice(i, i + CONCURRENCY);
     const tasks = await Promise.all(batch.map((id) => cloudGetTask(client, id)));
     for (const task of tasks)
       if (task && task.id)
@@ -8913,6 +9312,7 @@ async function cloudTimeline(client, options = {}) {
 var _cache, PRIORITY_RANK;
 var init_cloud_router = __esm(() => {
   init_storage();
+  init_redaction();
   PRIORITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
 });
 
@@ -11215,7 +11615,7 @@ var init_schema = __esm(() => {
 });
 
 // src/db/machines.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { hostname as osHostname, platform as osPlatform, arch as osArch } from "os";
 import { resolve } from "path";
 import { spawnSync } from "child_process";
@@ -11422,7 +11822,7 @@ function getMachineTopologyDiagnostics(opts = {}, db, at = new Date) {
         message: `${project.name} has ${distinctPaths.length} different machine-local paths`
       });
     }
-    if (localRow && !existsSync2(localRow.path)) {
+    if (localRow && !existsSync4(localRow.path)) {
       pathIssues.push({
         type: "path_missing",
         project_id: project.id,
@@ -11433,7 +11833,7 @@ function getMachineTopologyDiagnostics(opts = {}, db, at = new Date) {
         message: `Local path does not exist on this machine: ${localRow.path}`
       });
     }
-    if (!localRow && project.path && machineById.has(localMachine.id) && !existsSync2(project.path)) {
+    if (!localRow && project.path && machineById.has(localMachine.id) && !existsSync4(project.path)) {
       pathIssues.push({
         type: "path_missing",
         project_id: project.id,
@@ -11541,8 +11941,8 @@ var init_machines = __esm(() => {
 });
 
 // src/storage/config.ts
-var exports_config = {};
-__export(exports_config, {
+var exports_config2 = {};
+__export(exports_config2, {
   parseStorageMode: () => parseStorageMode,
   loadTodosStorageConfig: () => loadTodosStorageConfig,
   loadStorageConfig: () => loadStorageConfig,
@@ -11705,7 +12105,7 @@ function parsePositiveInteger(value, fallback) {
   return parsed;
 }
 var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER = "hasna-xyz-infra-apps-prod-postgres", CANONICAL_TODOS_RDS_DATABASE = "todos", CANONICAL_TODOS_RDS_RUNTIME_PATH = "hasna/xyz/opensource/todos/prod/rds";
-var init_config = __esm(() => {
+var init_config2 = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
     "todos_sync_cursors"
@@ -11844,8 +12244,8 @@ __export(exports_database, {
   LOCK_EXPIRY_MINUTES: () => LOCK_EXPIRY_MINUTES
 });
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync3, mkdirSync } from "fs";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "path";
 function isInMemoryDb(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
@@ -11854,12 +12254,12 @@ function findNearestProjectDb(startDir) {
   const stopAt = gitRoot ? resolve2(gitRoot) : resolve2(startDir);
   let dir = resolve2(startDir);
   while (true) {
-    const candidate = join2(dir, ".hasna", "todos", "todos.db");
-    if (existsSync3(candidate))
+    const candidate = join4(dir, ".hasna", "todos", "todos.db");
+    if (existsSync5(candidate))
       return candidate;
     if (dir === stopAt)
       break;
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -11869,9 +12269,9 @@ function findNearestProjectDb(startDir) {
 function findGitRoot(startDir) {
   let dir = resolve2(startDir);
   while (true) {
-    if (existsSync3(join2(dir, ".git")))
+    if (existsSync5(join4(dir, ".git")))
       return dir;
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -11892,25 +12292,25 @@ function getDbPath() {
   if (process.env["TODOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot) {
-      return join2(gitRoot, ".hasna", "todos", "todos.db");
+      return join4(gitRoot, ".hasna", "todos", "todos.db");
     }
   }
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  return join2(home, ".hasna", "todos", "todos.db");
+  return join4(home, ".hasna", "todos", "todos.db");
 }
 function getDatabasePath() {
   return getDbPath();
 }
-function ensureDir(filePath) {
+function ensureDir2(filePath) {
   if (isInMemoryDb(filePath))
     return;
-  const dir = dirname2(resolve2(filePath));
-  if (!existsSync3(dir)) {
-    mkdirSync(dir, { recursive: true });
+  const dir = dirname3(resolve2(filePath));
+  if (!existsSync5(dir)) {
+    mkdirSync2(dir, { recursive: true });
   }
 }
 function openDatabase(path) {
-  ensureDir(path);
+  ensureDir2(path);
   const db = new Database(path);
   db.run("PRAGMA journal_mode = WAL");
   db.run("PRAGMA busy_timeout = 5000");
@@ -11923,7 +12323,7 @@ function openDatabase(path) {
 }
 function maybeInstallShadowCapture(db) {
   try {
-    const { isTodosShadowEnabled: isTodosShadowEnabled2 } = (init_config(), __toCommonJS(exports_config));
+    const { isTodosShadowEnabled: isTodosShadowEnabled2 } = (init_config2(), __toCommonJS(exports_config2));
     if (!isTodosShadowEnabled2())
       return;
     const { installShadowOutboxSchema: installShadowOutboxSchema2 } = (init_shadow_outbox_schema(), __toCommonJS(exports_shadow_outbox_schema));
@@ -12704,199 +13104,6 @@ var init_helpers = __esm(() => {
   };
 });
 
-// src/lib/sync-utils.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, statSync, writeFileSync } from "fs";
-import { join as join3 } from "path";
-function getHomeDir() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || "~";
-}
-function getTodosGlobalDir() {
-  return join3(getHomeDir(), ".hasna", "todos");
-}
-function ensureDir2(dir) {
-  if (!existsSync4(dir))
-    mkdirSync2(dir, { recursive: true });
-}
-function listJsonFiles(dir) {
-  if (!existsSync4(dir))
-    return [];
-  return readdirSync(dir).filter((f) => f.endsWith(".json"));
-}
-function readJsonFile(path) {
-  try {
-    return JSON.parse(readFileSync2(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function writeJsonFile(path, data) {
-  writeFileSync(path, JSON.stringify(data, null, 2) + `
-`);
-}
-function readHighWaterMark(dir) {
-  const path = join3(dir, ".highwatermark");
-  if (!existsSync4(path))
-    return 1;
-  const val = parseInt(readFileSync2(path, "utf-8").trim(), 10);
-  return isNaN(val) ? 1 : val;
-}
-function writeHighWaterMark(dir, value) {
-  writeFileSync(join3(dir, ".highwatermark"), String(value));
-}
-function getFileMtimeMs(path) {
-  try {
-    return statSync(path).mtimeMs;
-  } catch {
-    return null;
-  }
-}
-function parseTimestamp(value) {
-  if (typeof value !== "string")
-    return null;
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? null : parsed;
-}
-function appendSyncConflict(metadata, conflict, limit = 5) {
-  const current = Array.isArray(metadata["sync_conflicts"]) ? metadata["sync_conflicts"] : [];
-  const next = [conflict, ...current].slice(0, limit);
-  return { ...metadata, sync_conflicts: next };
-}
-var HOME;
-var init_sync_utils = __esm(() => {
-  HOME = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-});
-
-// src/lib/config.ts
-var exports_config2 = {};
-__export(exports_config2, {
-  updateConfig: () => updateConfig,
-  saveConfig: () => saveConfig,
-  resetConfig: () => resetConfig,
-  normalizeApiUrl: () => normalizeApiUrl,
-  loadConfig: () => loadConfig,
-  getTaskPrefixConfig: () => getTaskPrefixConfig,
-  getSyncAgentsFromConfig: () => getSyncAgentsFromConfig,
-  getLocalApiConfig: () => getLocalApiConfig,
-  getConfigPath: () => getConfigPath,
-  getCompletionGuardConfig: () => getCompletionGuardConfig,
-  getAgentTasksDir: () => getAgentTasksDir,
-  getAgentTaskListId: () => getAgentTaskListId,
-  getAgentPoolForProject: () => getAgentPoolForProject
-});
-import { existsSync as existsSync5 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
-function getConfigPath() {
-  return join4(getTodosGlobalDir(), "config.json");
-}
-function resetConfig() {
-  cached = null;
-}
-function normalizeAgent(agent) {
-  return agent.trim().toLowerCase();
-}
-function loadConfig() {
-  if (cached)
-    return cached;
-  if (!existsSync5(getConfigPath())) {
-    cached = {};
-    return cached;
-  }
-  const config = readJsonFile(getConfigPath()) || {};
-  if (typeof config.sync_agents === "string") {
-    config.sync_agents = config.sync_agents.split(",").map((a) => a.trim()).filter(Boolean);
-  }
-  cached = config;
-  return cached;
-}
-function saveConfig(config) {
-  const configPath = getConfigPath();
-  ensureDir2(dirname3(configPath));
-  writeJsonFile(configPath, config);
-  cached = config;
-  return config;
-}
-function updateConfig(patch) {
-  return saveConfig({ ...loadConfig(), ...patch });
-}
-function normalizeApiUrl(value) {
-  const trimmed = value?.trim();
-  if (!trimmed)
-    return null;
-  return trimmed.replace(/\/+$/, "");
-}
-function getLocalApiConfig(env = process.env) {
-  const config = loadConfig();
-  const envApiUrl = normalizeApiUrl(env["TODOS_URL"]);
-  const configApiUrl = normalizeApiUrl(config.apiUrl);
-  const apiUrl = envApiUrl ?? configApiUrl;
-  const apiKey = env["TODOS_API_KEY"] || config.apiKey || null;
-  return {
-    apiUrl,
-    apiKey,
-    source: {
-      apiUrl: envApiUrl ? "TODOS_URL" : configApiUrl ? "config" : "none",
-      apiKey: env["TODOS_API_KEY"] ? "TODOS_API_KEY" : config.apiKey ? "config" : "none"
-    }
-  };
-}
-function getSyncAgentsFromConfig() {
-  const config = loadConfig();
-  const agents = config.sync_agents;
-  if (Array.isArray(agents) && agents.length > 0)
-    return agents.map(normalizeAgent);
-  return null;
-}
-function getAgentTaskListId(agent) {
-  const config = loadConfig();
-  const key = normalizeAgent(agent);
-  return config.agents?.[key]?.task_list_id || config.task_list_id || null;
-}
-function getAgentTasksDir(agent) {
-  const config = loadConfig();
-  const key = normalizeAgent(agent);
-  return config.agents?.[key]?.tasks_dir || config.agent_tasks_dir || null;
-}
-function getTaskPrefixConfig() {
-  const config = loadConfig();
-  return config.task_prefix || null;
-}
-function getAgentPoolForProject(workingDir) {
-  const config = loadConfig();
-  if (workingDir && config.project_pools) {
-    let bestKey = null;
-    let bestLen = 0;
-    for (const key of Object.keys(config.project_pools)) {
-      if (workingDir.startsWith(key) && key.length > bestLen) {
-        bestKey = key;
-        bestLen = key.length;
-      }
-    }
-    if (bestKey && config.project_pools[bestKey]) {
-      return config.project_pools[bestKey];
-    }
-  }
-  return config.agent_pool || null;
-}
-function getCompletionGuardConfig(projectPath) {
-  const config = loadConfig();
-  const global = { ...GUARD_DEFAULTS, ...config.completion_guard };
-  if (projectPath && config.project_overrides?.[projectPath]?.completion_guard) {
-    return { ...global, ...config.project_overrides[projectPath].completion_guard };
-  }
-  return global;
-}
-var cached = null, GUARD_DEFAULTS;
-var init_config2 = __esm(() => {
-  init_sync_utils();
-  GUARD_DEFAULTS = {
-    enabled: false,
-    min_work_seconds: 30,
-    max_completions_per_window: 5,
-    window_minutes: 10,
-    cooldown_seconds: 60
-  };
-});
-
 // src/lib/completion-guard.ts
 function checkCompletionGuard(task, agentId, db, configOverride) {
   let config;
@@ -12942,7 +13149,7 @@ function checkCompletionGuard(task, agentId, db, configOverride) {
 }
 var init_completion_guard = __esm(() => {
   init_types();
-  init_config2();
+  init_config();
   init_projects();
 });
 
@@ -12997,117 +13204,6 @@ var init_event_emission_safety = __esm(() => {
   init_sync_utils();
 });
 
-// src/lib/redaction.ts
-var exports_redaction = {};
-__export(exports_redaction, {
-  upsertSecretSafetyConfig: () => upsertSecretSafetyConfig,
-  redactValue: () => redactValue,
-  redactEvidenceText: () => redactEvidenceText,
-  listSecretFindings: () => listSecretFindings,
-  hasSecretFindings: () => hasSecretFindings,
-  getSecretSafetyConfig: () => getSecretSafetyConfig
-});
-function unique(values) {
-  return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
-}
-function cloneRegex(regex) {
-  return new RegExp(regex.source, regex.flags.includes("g") ? regex.flags : `${regex.flags}g`);
-}
-function customPatterns() {
-  return unique(loadConfig().secret_safety?.redaction_patterns).flatMap((pattern) => {
-    try {
-      return [{ name: `custom:${pattern}`, regex: new RegExp(pattern, "g") }];
-    } catch {
-      return [];
-    }
-  });
-}
-function secretPatterns() {
-  return [...customPatterns(), ...DEFAULT_SECRET_PATTERNS];
-}
-function isSecretKey(key) {
-  if (NON_SECRET_USAGE_KEYS.has(key.toLowerCase()))
-    return false;
-  if (DEFAULT_SECRET_KEY_PATTERN.test(key))
-    return true;
-  return unique(loadConfig().secret_safety?.redaction_keys).some((pattern) => key.toLowerCase().includes(pattern.toLowerCase()));
-}
-function redactEvidenceText(value) {
-  let redacted = value;
-  for (const pattern of secretPatterns()) {
-    const regex = cloneRegex(pattern.regex);
-    const replacement = pattern.replacement ?? "[REDACTED]";
-    redacted = typeof replacement === "string" ? redacted.replace(regex, replacement) : redacted.replace(regex, replacement);
-  }
-  return redacted;
-}
-function redactValue(value) {
-  if (typeof value === "string")
-    return redactEvidenceText(value);
-  if (Array.isArray(value))
-    return value.map(redactValue);
-  if (value && typeof value === "object") {
-    const redacted = {};
-    for (const [key, child] of Object.entries(value)) {
-      if (isSecretKey(key)) {
-        redacted[key] = "[REDACTED]";
-      } else {
-        redacted[key] = redactValue(child);
-      }
-    }
-    return redacted;
-  }
-  return value;
-}
-function listSecretFindings(value) {
-  const findings = [];
-  for (const pattern of secretPatterns()) {
-    const matches = value.match(cloneRegex(pattern.regex));
-    if (matches?.length)
-      findings.push({ pattern: pattern.name, count: matches.length });
-  }
-  return findings;
-}
-function hasSecretFindings(value) {
-  return listSecretFindings(value).length > 0;
-}
-function getSecretSafetyConfig() {
-  return {
-    redaction_patterns: unique(loadConfig().secret_safety?.redaction_patterns),
-    redaction_keys: unique(loadConfig().secret_safety?.redaction_keys)
-  };
-}
-function upsertSecretSafetyConfig(input) {
-  const config = loadConfig();
-  const next = {
-    redaction_patterns: unique([...config.secret_safety?.redaction_patterns || [], ...input.redaction_patterns || []]),
-    redaction_keys: unique([...config.secret_safety?.redaction_keys || [], ...input.redaction_keys || []])
-  };
-  saveConfig({ ...config, secret_safety: next });
-  return next;
-}
-var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS;
-var init_redaction = __esm(() => {
-  init_config2();
-  DEFAULT_SECRET_PATTERNS = [
-    { name: "aws-access-key", regex: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
-    { name: "private-key", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
-    { name: "openai-token", regex: /\bsk-[A-Za-z0-9_-]{12,}\b/g, replacement: "[REDACTED_TOKEN]" },
-    { name: "env-secret-assignment", regex: /\b([A-Za-z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)[A-Za-z0-9_]*)\s*=\s*['"]?[^'"\s]{8,}/gi, replacement: "$1=[REDACTED]" },
-    { name: "bearer-token", regex: /\b(bearer)\s+[A-Za-z0-9._~+/=-]{12,}/gi, replacement: "$1 [REDACTED]" }
-  ];
-  DEFAULT_SECRET_KEY_PATTERN = /api[_-]?key|token|secret|password/i;
-  NON_SECRET_USAGE_KEYS = new Set([
-    "tokens",
-    "total_tokens",
-    "token_count",
-    "input_tokens",
-    "output_tokens",
-    "prompt_tokens",
-    "completion_tokens"
-  ]);
-});
-
 // src/lib/workspace-trust.ts
 var exports_workspace_trust = {};
 __export(exports_workspace_trust, {
@@ -13253,7 +13349,7 @@ function checkWorkspacePermission(input = {}) {
 }
 var DEFAULT_DENYLIST, DEFAULT_ENV_REDACTIONS, PRESET_DEFAULTS;
 var init_workspace_trust = __esm(() => {
-  init_config2();
+  init_config();
   DEFAULT_DENYLIST = ["rm -rf", "mkfs", "dd if=", "curl | sh", "wget | sh"];
   DEFAULT_ENV_REDACTIONS = ["API_KEY", "TOKEN", "SECRET", "PASSWORD", "AUTH"];
   PRESET_DEFAULTS = {
@@ -13496,7 +13592,7 @@ function explainRunnerSandbox(input = {}) {
 }
 var DEFAULT_COMMAND_DENYLIST, DEFAULT_ENV_REDACTIONS2;
 var init_runner_sandbox = __esm(() => {
-  init_config2();
+  init_config();
   init_workspace_trust();
   DEFAULT_COMMAND_DENYLIST = ["rm -rf", "mkfs", "dd if=", "curl | sh", "wget | sh"];
   DEFAULT_ENV_REDACTIONS2 = ["API_KEY", "TOKEN", "SECRET", "PASSWORD", "AUTH"];
@@ -13743,7 +13839,7 @@ var LOCAL_EVENT_TYPES, VALID_TARGETS;
 var init_event_hooks = __esm(() => {
   init_redaction();
   init_runner_sandbox();
-  init_config2();
+  init_config();
   init_event_emission_safety();
   LOCAL_EVENT_TYPES = [
     "task.created",
@@ -18628,7 +18724,7 @@ function getComment(id, db) {
 }
 function listComments(taskId, db) {
   const d = db || getDatabase();
-  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at").all(taskId);
+  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at, rowid").all(taskId);
 }
 function updateComment(id, input, db) {
   const d = db || getDatabase();
@@ -20256,10 +20352,27 @@ var init_task_routing = __esm(() => {
 // src/cli/commands/task-commands.ts
 var exports_task_commands = {};
 __export(exports_task_commands, {
-  registerTaskCommands: () => registerTaskCommands
+  registerTaskCommands: () => registerTaskCommands,
+  escapeTerminalControls: () => escapeTerminalControls
 });
 import chalk2 from "chalk";
 import { basename as basename3, resolve as resolve9 } from "path";
+function escapeTerminalControls(value) {
+  return value.replace(/[\u0000-\u001f\u007f-\u009f]/g, (character) => {
+    const code = character.charCodeAt(0);
+    if (code === 10)
+      return "\\n";
+    if (code === 13)
+      return "\\r";
+    if (code === 9)
+      return "\\t";
+    return `\\x${code.toString(16).padStart(2, "0")}`;
+  });
+}
+function formatHumanComment(comment) {
+  const agent = comment.agent_id ? chalk2.cyan(`[${escapeTerminalControls(comment.agent_id)}] `) : "";
+  return `    ${agent}${chalk2.dim(escapeTerminalControls(comment.created_at))}: ${escapeTerminalControls(comment.content)}`;
+}
 function resolveProjectIdOrSlug(input) {
   const db = getDatabase();
   if (isPathLike(input)) {
@@ -20416,18 +20529,24 @@ function registerTaskCommands(program2) {
     if (cloud) {
       let task3;
       try {
+        const cloudProjectId = opts.project || globalOpts.project;
+        const cloudTaskListId = opts.list ? await cloudResolveTaskListRef(cloud, opts.list, cloudProjectId) : undefined;
+        if (opts.list && !cloudTaskListId) {
+          throw new Error(`Could not resolve task list ID or slug: ${opts.list}`);
+        }
         task3 = await cloudCreateTask(cloud, {
           title,
           description: opts.description,
           priority: parsePriority(opts.priority),
+          parent_id: opts.parent,
           tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : undefined,
           plan_id: opts.plan,
           assigned_to: opts.assign,
           status: parseStatus(opts.status),
-          task_list_id: opts.list,
+          task_list_id: cloudTaskListId,
           agent_id: globalOpts.agent,
           session_id: globalOpts.session,
-          project_id: opts.project || globalOpts.project,
+          project_id: cloudProjectId,
           estimated_minutes: opts.estimated !== undefined ? parseIntOption(opts.estimated, "--estimated") : undefined,
           sla_minutes: opts.slaMinutes !== undefined || opts.sla !== undefined ? parseIntOption(opts.slaMinutes ?? opts.sla, "--sla-minutes") : undefined,
           requires_approval: opts.approval || undefined,
@@ -20786,7 +20905,22 @@ function registerTaskCommands(program2) {
     let task2;
     if (cloud) {
       const remote = await cloudGetTask(cloud, resolveTaskId(id));
-      task2 = remote ? { subtasks: [], dependencies: [], blocked_by: [], comments: [], ...remote, tags: remote.tags ?? [] } : null;
+      const commentPage = remote ? await cloudListComments(cloud, remote.id) : null;
+      task2 = remote ? {
+        subtasks: [],
+        dependencies: [],
+        blocked_by: [],
+        ...remote,
+        tags: remote.tags ?? [],
+        comments: commentPage.comments,
+        comments_page: {
+          count: commentPage.count,
+          limit: commentPage.limit,
+          has_more: commentPage.has_more,
+          next_cursor: commentPage.next_cursor,
+          pagination_supported: commentPage.pagination_supported
+        }
+      } : null;
     } else {
       const resolvedId = resolveTaskId(id);
       task2 = getTaskWithRelations(resolvedId);
@@ -20870,11 +21004,11 @@ function registerTaskCommands(program2) {
       }
     }
     if (task2.comments.length > 0) {
+      const suffix = task2.comments_page?.has_more ? task2.comments_page.pagination_supported ? ", newer page shown; older comments available" : ", newer comments shown; older comments omitted until the server is upgraded" : "";
       console.log(chalk2.bold(`
-  Comments (${task2.comments.length}):`));
+  Comments (${task2.comments.length}${suffix}):`));
       for (const c of task2.comments) {
-        const agent = c.agent_id ? chalk2.cyan(`[${c.agent_id}] `) : "";
-        console.log(`    ${agent}${chalk2.dim(c.created_at)}: ${c.content}`);
+        console.log(formatHumanComment(c));
       }
     }
   });
@@ -20900,7 +21034,23 @@ function registerTaskCommands(program2) {
     let task2;
     if (cloud) {
       const remote = await cloudGetTask(cloud, resolvedId);
-      task2 = remote ? { subtasks: [], dependencies: [], blocked_by: [], comments: [], checklist: [], ...remote, tags: remote.tags ?? [] } : null;
+      const commentPage = remote ? await cloudListComments(cloud, remote.id) : null;
+      task2 = remote ? {
+        subtasks: [],
+        dependencies: [],
+        blocked_by: [],
+        checklist: [],
+        ...remote,
+        tags: remote.tags ?? [],
+        comments: commentPage.comments,
+        comments_page: {
+          count: commentPage.count,
+          limit: commentPage.limit,
+          has_more: commentPage.has_more,
+          next_cursor: commentPage.next_cursor,
+          pagination_supported: commentPage.pagination_supported
+        }
+      } : null;
     } else {
       task2 = getTaskWithRelations(resolvedId);
     }
@@ -21007,11 +21157,11 @@ ${chalk2.cyan(sid)} ${statusColor(task2.status)} ${prioColor(task2.priority)} ${
       console.error(chalk2.dim(`Warning: could not load task commits: ${e instanceof Error ? e.message : String(e)}`));
     }
     if (task2.comments.length > 0) {
+      const suffix = task2.comments_page?.has_more ? task2.comments_page.pagination_supported ? ", newer page shown; older comments available" : ", newer comments shown; older comments omitted until the server is upgraded" : "";
       console.log(chalk2.bold(`
-  Comments (${task2.comments.length}):`));
+  Comments (${task2.comments.length}${suffix}):`));
       for (const c of task2.comments) {
-        const agent = c.agent_id ? chalk2.cyan(`[${c.agent_id}] `) : "";
-        console.log(`    ${agent}${chalk2.dim(c.created_at)}: ${c.content}`);
+        console.log(formatHumanComment(c));
       }
     }
     if (task2.checklist && task2.checklist.length > 0) {
@@ -21307,7 +21457,7 @@ ${chalk2.cyan(sid)} ${statusColor(task2.status)} ${prioColor(task2.priority)} ${
     const resolvedId = resolveTaskId(id);
     try {
       if (cloud)
-        await cloudUnlockTask(cloud, resolvedId, globalOpts.agent);
+        await cloudUnlockTask(cloud, resolvedId, globalOpts.agent, !globalOpts.agent);
       else
         unlockTask(resolvedId, globalOpts.agent);
     } catch (e) {
@@ -23262,7 +23412,7 @@ function taskToClaudeTask(task, claudeTaskId, existingMeta) {
 function pushToClaudeTaskList(taskListId, projectId, options = {}) {
   const dir = getTaskListDir(taskListId);
   if (!existsSync10(dir))
-    ensureDir2(dir);
+    ensureDir(dir);
   const filter = {};
   if (projectId)
     filter["project_id"] = projectId;
@@ -23445,7 +23595,7 @@ function syncClaudeTaskList(taskListId, projectId, options = {}) {
 }
 var init_claude_tasks = __esm(() => {
   init_tasks();
-  init_config2();
+  init_config();
   init_sync_utils();
 });
 
@@ -23489,7 +23639,7 @@ function metadataKey(agent) {
 function pushToAgentTaskList(agent, taskListId, projectId, options = {}) {
   const dir = getTaskListDir2(agent, taskListId);
   if (!existsSync11(dir))
-    ensureDir2(dir);
+    ensureDir(dir);
   const filter = {};
   if (projectId)
     filter["project_id"] = projectId;
@@ -23662,7 +23812,7 @@ function syncAgentTaskList(agent, taskListId, projectId, options = {}) {
 var init_agent_tasks = __esm(() => {
   init_tasks();
   init_sync_utils();
-  init_config2();
+  init_config();
 });
 
 // src/lib/sync.ts
@@ -23734,7 +23884,7 @@ function syncWithAgents(agents, taskListIdByAgent, projectId, direction = "both"
 var init_sync = __esm(() => {
   init_claude_tasks();
   init_agent_tasks();
-  init_config2();
+  init_config();
 });
 
 // src/lib/project-bootstrap.ts
@@ -31447,7 +31597,7 @@ function applyExportProfile(data, options = {}) {
 }
 var TODOS_ENCRYPTED_VALUE_KIND = "hasna.todos.encrypted-value", TODOS_ENCRYPTED_BRIDGE_KIND = "hasna.todos.encrypted-bridge", TODOS_ENCRYPTION_SCHEMA_VERSION = 1, DEFAULT_ENCRYPTION_PROFILE = "default", DEFAULT_ENCRYPTION_KEY_ENV = "TODOS_ENCRYPTION_KEY", EncryptionKeyUnavailableError, EncryptedPayloadError;
 var init_local_encryption = __esm(() => {
-  init_config2();
+  init_config();
   init_redaction();
   EncryptionKeyUnavailableError = class EncryptionKeyUnavailableError extends Error {
     keyEnv;
@@ -32626,7 +32776,7 @@ var init_project_commands = __esm(() => {
   init_cloud_router();
   init_saved_search_views();
   init_sync();
-  init_config2();
+  init_config();
   init_helpers();
 });
 
@@ -33626,9 +33776,11 @@ ${isOnline ? chalk5.green("\u25CF") : chalk5.dim("\u25CB")} ${chalk5.bold(agent.
   program2.command("lists").aliases(["task-lists", "tl"]).description("List and manage task lists").option("--add <name>", "Create a task list").option("--slug <slug>", "Custom slug (with --add)").option("-d, --description <text>", "Description (with --add)").option("--delete <id>", "Delete a task list").action(async (opts) => {
     try {
       const globalOpts = program2.opts();
-      const projectId = autoProject(globalOpts);
+      const cloud = getTodosCloudClient();
+      const projectId = cloud ? globalOpts.project : autoProject(globalOpts);
       if (opts.add) {
-        const list = createTaskList({ name: opts.add, slug: opts.slug, description: opts.description, project_id: projectId });
+        const input = { name: opts.add, slug: opts.slug, description: opts.description, project_id: projectId };
+        const list = cloud ? await cloudCreateTaskList(cloud, input) : createTaskList(input);
         if (globalOpts.json) {
           output(list, true);
           return;
@@ -33640,6 +33792,14 @@ ${isOnline ? chalk5.green("\u25CF") : chalk5.dim("\u25CB")} ${chalk5.bold(agent.
         return;
       }
       if (opts.delete) {
+        if (cloud) {
+          const resolved2 = await cloudResolveTaskListRef(cloud, opts.delete, projectId ?? undefined);
+          if (!resolved2)
+            throw new Error(`Task list not found or ambiguous: ${opts.delete}`);
+          await cloudDeleteTaskList(cloud, resolved2);
+          console.log(chalk5.green("Task list deleted."));
+          return;
+        }
         const db = getDatabase();
         const resolved = resolvePartialId(db, "task_lists", opts.delete);
         if (!resolved) {
@@ -33650,7 +33810,6 @@ ${isOnline ? chalk5.green("\u25CF") : chalk5.dim("\u25CB")} ${chalk5.bold(agent.
         console.log(chalk5.green("Task list deleted."));
         return;
       }
-      const cloud = getTodosCloudClient();
       const lists = cloud ? await cloudListTaskLists(cloud, projectId ?? undefined) : listTaskLists(projectId);
       if (globalOpts.json) {
         output(lists, true);
@@ -35065,7 +35224,7 @@ function renderExtensionSummary(record) {
 }
 var BUILTIN_CLI_COMMANDS;
 var init_local_extensions = __esm(() => {
-  init_config2();
+  init_config();
   init_mcp();
   init_package_version();
   init_redaction();
@@ -35497,7 +35656,7 @@ var init_policy_packs = __esm(() => {
   init_database();
   init_tasks();
   init_task_runs();
-  init_config2();
+  init_config();
 });
 
 // src/db/checkpoints.ts
@@ -36020,7 +36179,7 @@ function describeTerminalNotificationRule(rule) {
 }
 var SEVERITY_ORDER, EVENT_SEVERITY, VALID_SEVERITIES, VALID_FORMATS;
 var init_terminal_notifications = __esm(() => {
-  init_config2();
+  init_config();
   init_event_hooks();
   init_redaction();
   SEVERITY_ORDER = {
@@ -37523,7 +37682,7 @@ function createTodosCloudQueryClientFromEnv(env = process.env, options = {}) {
   return createTodosCloudQueryClient(url, options);
 }
 var init_cloud_client = __esm(() => {
-  init_config();
+  init_config2();
 });
 
 // src/storage/sqlite-snapshot.ts
@@ -37905,6 +38064,10 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       list: (filter = {}) => listTasks(filter, database()),
       count: (filter = {}) => countTasks(filter, database()),
       update: (id, input) => updateTask(id, input, database()),
+      unlock: (id, agentId) => {
+        unlockTask(id, agentId, database());
+        return true;
+      },
       delete: (id) => deleteTask(id, database()),
       start: (id, agentId) => startTask(id, agentId, database()),
       complete: (id, agentId, options2) => completeTask(id, agentId, database(), options2),
@@ -37956,6 +38119,20 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       logTaskChange: (taskId, action, field, oldValue, newValue, agentId) => logTaskChange(taskId, action, field, oldValue, newValue, agentId, database()),
       addComment: (input) => addComment(input, database()),
       getComments: (taskId) => listComments(taskId, database()),
+      getCommentsPage: (taskId, options2) => {
+        if (options2?.limit !== undefined && (!Number.isSafeInteger(options2.limit) || options2.limit < 1 || options2.limit > 1001)) {
+          throw new Error("Comment limit must be an integer between 1 and 1001");
+        }
+        let comments = listComments(taskId, database());
+        comments = comments.sort((left, right) => left.created_at.localeCompare(right.created_at) || left.id.localeCompare(right.id));
+        if (options2?.before) {
+          const before = options2.before;
+          comments = comments.filter((comment) => comment.created_at < before.created_at || comment.created_at === before.created_at && comment.id < before.id);
+        }
+        if (options2?.limit !== undefined)
+          comments = comments.slice(-options2.limit);
+        return comments;
+      },
       getTaskHistory: (taskId) => getTaskHistory(taskId, database()),
       getRecentActivity: (limit) => getRecentActivity(limit, database())
     },
@@ -38013,6 +38190,12 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
     )`
   ];
 }
+function postgresTodosCommentCursorIndexSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  assertSafeIdentifier(tableName);
+  return `CREATE INDEX CONCURRENTLY IF NOT EXISTS ${tableName}_comment_task_created_idx
+    ON ${tableName} (service, (payload->>'task_id'), (payload->>'created_at'), object_id)
+    WHERE object_type = 'comments' AND deleted_at IS NULL`;
+}
 
 class PostgresTodosSyncStore {
   client;
@@ -38538,7 +38721,7 @@ function __resetRuntimeShadowForTests() {
 }
 var _capturedDb = null, _outbox = null, _cloud = null, _exitRegistered = false;
 var init_shadow_runtime = __esm(() => {
-  init_config();
+  init_config2();
   init_cloud_client();
   init_shadow_outbox();
 });
@@ -38994,7 +39177,24 @@ function createPostgresTodosStorageAdapter(options) {
     audit: {
       logTaskChange: (taskId, action, field, oldValue, newValue, agentId, context) => logTaskChange2(taskId, action, field, oldValue, newValue, agentId, store, context),
       addComment: (input, context) => addComment2(input, store, context),
-      getComments: async (taskId) => (await store.list("comments")).filter((comment) => comment.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
+      getComments: async (taskId) => {
+        const pages = [];
+        let before;
+        while (true) {
+          const page = await store.listComments(taskId, { limit: 1000, ...before ? { before } : {} });
+          if (page.length === 0)
+            break;
+          pages.unshift(page);
+          if (page.length < 1000)
+            break;
+          const oldest = page[0];
+          before = { created_at: oldest.created_at, id: oldest.id };
+        }
+        return pages.flat().map(redactComment2).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
+      getCommentsPage: async (taskId, options2) => {
+        return (await store.listComments(taskId, options2)).map(redactComment2).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
       getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
       getRecentActivity: async (limit = 20) => (await store.list("audit_history")).sort((a, b) => b.created_at.localeCompare(a.created_at)).slice(0, limit)
     },
@@ -39044,6 +39244,27 @@ class PostgresJsonRecordStore {
   async list(type) {
     return (await this.listRecords(type)).map((record) => record.payload);
   }
+  async listComments(taskId, options = {}) {
+    await this.ensureSchema();
+    const limit = options.limit ?? 100;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1001) {
+      throw new Error("Postgres comment limit must be an integer between 1 and 1001");
+    }
+    const params = [this.service, taskId];
+    let cursorPredicate = "";
+    if (options.before) {
+      params.push(options.before.created_at, options.before.id);
+      cursorPredicate = `AND (payload->>'created_at', object_id) < ($3, $4)`;
+    }
+    params.push(limit);
+    const result = await this.options.client.query(`/* todos:list-comments */ SELECT payload FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'comments' AND deleted_at IS NULL
+         AND payload->>'task_id' = $2
+         ${cursorPredicate}
+       ORDER BY payload->>'created_at' DESC, object_id DESC
+       LIMIT $${params.length}`, params);
+    return result.rows.map((row) => payloadRecord2(row.payload)).reverse();
+  }
   async listRecords(type) {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at
@@ -39437,7 +39658,7 @@ async function lockTask2(id, agentId, store) {
 async function unlockTask2(id, agentId, store) {
   const task = await requireRecord("tasks", id, store);
   if (agentId && task.locked_by && task.locked_by !== agentId) {
-    throw new Error(`Task ${id} is locked by ${task.locked_by}, not ${agentId}`);
+    throw new LockError(id, task.locked_by);
   }
   await patchTask(task, { locked_by: null, locked_at: null }, store);
   return true;
@@ -39802,13 +40023,16 @@ async function addComment2(input, store, context) {
     task_id: input.task_id,
     agent_id: input.agent_id ?? context?.agentId ?? null,
     session_id: input.session_id ?? context?.sessionId ?? null,
-    content: input.content,
+    content: redactEvidenceText(input.content),
     type: input.type ?? "comment",
     progress_pct: input.progress_pct ?? null,
     created_at: new Date().toISOString()
   };
   return store.upsert("comments", comment, context);
 }
+function redactComment2(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
+}
 async function exportSnapshot(store) {
   return {
     exportedAt: new Date().toISOString(),
@@ -39954,7 +40178,109 @@ function numberValue2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
 var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_BY = "ORDER BY CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC";
-var init_postgres_adapter = () => {};
+var init_postgres_adapter = __esm(() => {
+  init_types();
+  init_redaction();
+});
+
+// src/storage/comment-redaction-backfill.ts
+function assertSafeIdentifier2(value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`Unsafe Postgres identifier: ${value}`);
+  }
+}
+function payloadObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  if (typeof value !== "string")
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function backfillPostgresCommentRedaction(client, options = {}) {
+  const apply = options.apply === true;
+  if (apply && options.confirmation !== COMMENT_REDACTION_BACKFILL_CONFIRMATION) {
+    throw new Error(`Applying the comment redaction backfill requires confirmation ${COMMENT_REDACTION_BACKFILL_CONFIRMATION}`);
+  }
+  const tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
+  assertSafeIdentifier2(tableName);
+  const service = options.service ?? "todos";
+  const batchSize = options.batchSize ?? 100;
+  if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 500) {
+    throw new Error("Comment redaction backfill batchSize must be an integer between 1 and 500");
+  }
+  const result = {
+    dry_run: !apply,
+    scanned: 0,
+    candidates: 0,
+    updated: 0,
+    conflicts: 0,
+    batches: 0,
+    remaining_candidates: 0
+  };
+  let afterId = "";
+  while (true) {
+    const page = await client.query(`/* todos:comment-redaction-backfill-scan */
+       SELECT object_id, payload
+       FROM ${tableName}
+       WHERE service = $1 AND object_type = 'comments'
+         AND object_id > $2
+       ORDER BY object_id ASC
+       LIMIT $3`, [service, afterId, batchSize]);
+    if (page.rows.length === 0)
+      break;
+    result.batches += 1;
+    for (const row of page.rows) {
+      afterId = row.object_id;
+      result.scanned += 1;
+      const payload = payloadObject(row.payload);
+      const original = payload?.["content"];
+      if (typeof original !== "string")
+        continue;
+      const redacted = redactEvidenceText(original);
+      if (redacted === original)
+        continue;
+      result.candidates += 1;
+      if (!apply)
+        continue;
+      const nextPayload = { ...payload, content: redacted };
+      const update = await client.query(`/* todos:comment-redaction-backfill-apply */
+         UPDATE ${tableName}
+         SET payload = $3::jsonb
+         WHERE service = $1 AND object_type = 'comments' AND object_id = $2
+           AND payload = $4::jsonb
+         RETURNING object_id`, [service, row.object_id, nextPayload, row.payload]);
+      if (update.rows.length === 1)
+        result.updated += 1;
+      else
+        result.conflicts += 1;
+    }
+    if (page.rows.length < batchSize)
+      break;
+  }
+  if (!apply) {
+    result.remaining_candidates = result.candidates;
+    return result;
+  }
+  const verification = await backfillPostgresCommentRedaction(client, {
+    ...options,
+    apply: false,
+    confirmation: undefined
+  });
+  result.remaining_candidates = verification.candidates;
+  return result;
+}
+function isCommentRedactionBackfillComplete(result) {
+  return !result.dry_run && result.conflicts === 0 && result.remaining_candidates === 0;
+}
+var COMMENT_REDACTION_BACKFILL_CONFIRMATION = "REDACT_STORED_TODOS_COMMENTS";
+var init_comment_redaction_backfill = __esm(() => {
+  init_redaction();
+});
 
 // src/server/cloud.ts
 var exports_cloud = {};
@@ -39968,7 +40294,9 @@ __export(exports_cloud, {
   getCloudStorageAdapter: () => getCloudStorageAdapter,
   getApiKeyStore: () => getApiKeyStore,
   ensureCloudSchema: () => ensureCloudSchema,
+  ensureCloudCommentCursorIndex: () => ensureCloudCommentCursorIndex,
   closeCloud: () => closeCloud,
+  backfillCloudCommentRedaction: () => backfillCloudCommentRedaction,
   TODOS_APP_SLUG: () => TODOS_APP_SLUG
 });
 function resolveCloudDatabaseUrl(env = process.env) {
@@ -40046,6 +40374,9 @@ async function ensureCloudSchema() {
   })();
   return schemaEnsured;
 }
+async function ensureCloudCommentCursorIndex() {
+  await getClient().query(postgresTodosCommentCursorIndexSql());
+}
 async function normalizeCloudPayloads() {
   const client = getClient();
   const res = await client.query(`UPDATE todos_sync_records
@@ -40054,6 +40385,9 @@ async function normalizeCloudPayloads() {
      RETURNING object_id AS id`);
   return res.rows.length;
 }
+function backfillCloudCommentRedaction(options = {}) {
+  return backfillPostgresCommentRedaction(getClient(), { ...options, service: TODOS_APP_SLUG });
+}
 async function pingCloud() {
   const client = getClient();
   const res = await client.query("select 1 as ok");
@@ -40074,6 +40408,7 @@ var init_cloud = __esm(() => {
   init_auth();
   init_cloud_client();
   init_postgres_adapter();
+  init_comment_redaction_backfill();
 });
 
 // src/server/openapi.ts
@@ -40097,6 +40432,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
       schemas: {
         Task: taskSchema,
         Project: projectSchema,
+        TaskComment: taskCommentSchema,
         CreateTaskInput: {
           type: "object",
           required: ["title"],
@@ -40131,6 +40467,17 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             description: { type: "string" },
             task_prefix: { type: "string" }
           }
+        },
+        CreateTaskCommentInput: {
+          type: "object",
+          required: ["content"],
+          properties: {
+            content: { type: "string", minLength: 1 },
+            agent_id: { type: "string" },
+            session_id: { type: "string" },
+            type: { type: "string", enum: ["comment", "progress", "note"] },
+            progress_pct: { type: "number" }
+          }
         }
       }
     },
@@ -40229,6 +40576,61 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           }
         }
       },
+      "/v1/tasks/{id}/comments": {
+        get: {
+          operationId: "listTaskComments",
+          summary: "List a bounded page of task comments",
+          description: "Returns the newest page in oldest-to-newest display order. Use next_cursor to request older pages; count is the page size, not a total. Pagination-aware clients must send limit during the mixed-version rollout.",
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            { name: "limit", in: "query", required: true, schema: { type: "integer", minimum: 1, maximum: 500, default: 100 } },
+            { name: "cursor", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    required: ["comments", "count", "has_more", "next_cursor"],
+                    properties: {
+                      comments: { type: "array", maxItems: 500, items: { $ref: "#/components/schemas/TaskComment" } },
+                      count: { type: "integer", minimum: 0, maximum: 500 },
+                      has_more: { type: "boolean" },
+                      next_cursor: { type: "string", nullable: true }
+                    }
+                  }
+                }
+              }
+            },
+            "426": {
+              description: "Upgrade required: a predecessor client omitted limit and the complete legacy history exceeds 500 comments, or the configured storage adapter lacks cursor pagination support."
+            }
+          }
+        },
+        post: {
+          operationId: "createTaskComment",
+          summary: "Create a task comment",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/CreateTaskCommentInput" } } }
+          },
+          responses: {
+            "201": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    required: ["comment"],
+                    properties: { comment: { $ref: "#/components/schemas/TaskComment" } }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
       "/v1/tasks/{id}/start": {
         post: {
           operationId: "startTask",
@@ -40347,7 +40749,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     }
   };
 }
-var taskSchema, projectSchema;
+var taskSchema, projectSchema, taskCommentSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   taskSchema = {
@@ -40378,6 +40780,20 @@ var init_openapi = __esm(() => {
       updated_at: { type: "string" }
     }
   };
+  taskCommentSchema = {
+    type: "object",
+    required: ["id", "task_id", "agent_id", "session_id", "content", "type", "progress_pct", "created_at"],
+    properties: {
+      id: { type: "string" },
+      task_id: { type: "string" },
+      agent_id: { type: "string", nullable: true },
+      session_id: { type: "string", nullable: true },
+      content: { type: "string" },
+      type: { type: "string", enum: ["comment", "progress", "note"] },
+      progress_pct: { type: "number", nullable: true },
+      created_at: { type: "string", format: "date-time" }
+    }
+  };
 });
 
 // src/server/v1.ts
@@ -40407,6 +40823,29 @@ function contextFromPrincipal(principal, body) {
   const agentId = body?.agent_id || principal.agent || undefined;
   return agentId ? { agentId } : {};
 }
+function redactComment3(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
+}
+function encodeCommentCursor(comment) {
+  return Buffer.from(JSON.stringify({ created_at: comment.created_at, id: comment.id }), "utf8").toString("base64url");
+}
+function decodeCommentCursor(value) {
+  if (value.length > 1024)
+    throw new Error("invalid comment cursor");
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    throw new Error("invalid comment cursor");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("invalid comment cursor");
+  const cursor = parsed;
+  if (typeof cursor["created_at"] !== "string" || cursor["created_at"].length > 64 || !Number.isFinite(Date.parse(cursor["created_at"])) || typeof cursor["id"] !== "string" || !cursor["id"] || cursor["id"].length > 256) {
+    throw new Error("invalid comment cursor");
+  }
+  return { created_at: cursor["created_at"], id: cursor["id"] };
+}
 function normalizeImportSnapshot(raw) {
   const body = raw && typeof raw === "object" ? raw : {};
   const arr = (v) => Array.isArray(v) ? v : [];
@@ -40427,7 +40866,7 @@ function normalizeImportSnapshot(raw) {
 function countSnapshotRecords(s) {
   return s.tasks.length + s.projects.length + (s.projectMachinePaths?.length ?? 0) + s.plans.length + s.agents.length + s.taskLists.length + s.templates.length + s.auditHistory.length + (s.tombstones?.length ?? 0);
 }
-async function handleV1Request(req, url) {
+async function handleV1Request(req, url, dependencies = {}) {
   const path = url.pathname;
   if (path !== "/v1" && !path.startsWith("/v1/"))
     return null;
@@ -40436,7 +40875,7 @@ async function handleV1Request(req, url) {
   const requiredScopes = [isWrite ? "todos:write" : "todos:read"];
   let verifier;
   try {
-    verifier = getCloudVerifier();
+    verifier = (dependencies.getVerifier ?? getCloudVerifier)();
   } catch (e) {
     return error(503, e.message);
   }
@@ -40445,8 +40884,8 @@ async function handleV1Request(req, url) {
     return error(decision.status, decision.message, { reason: decision.reason });
   }
   const principal = decision.principal;
-  await ensureCloudSchema();
-  const store = getCloudStorageAdapter();
+  await (dependencies.ensureSchema ?? ensureCloudSchema)();
+  const store = (dependencies.getStorageAdapter ?? getCloudStorageAdapter)();
   const segments = path.split("/").filter(Boolean);
   const resource = segments[1];
   const id = segments[2];
@@ -40532,10 +40971,16 @@ async function handleV1Request(req, url) {
       if (!id) {
         if (method === "GET") {
           const filter = {
-            ...url.searchParams.get("status") ? { status: url.searchParams.get("status") } : {},
-            ...url.searchParams.get("priority") ? { priority: url.searchParams.get("priority") } : {},
+            ...url.searchParams.get("status") ? {
+              status: url.searchParams.get("status").includes(",") ? url.searchParams.get("status").split(",") : url.searchParams.get("status")
+            } : {},
+            ...url.searchParams.get("priority") ? {
+              priority: url.searchParams.get("priority").includes(",") ? url.searchParams.get("priority").split(",") : url.searchParams.get("priority")
+            } : {},
             ...url.searchParams.get("project_id") ? { project_id: url.searchParams.get("project_id") } : {},
+            ...url.searchParams.has("parent_id") ? { parent_id: url.searchParams.get("parent_id") || null, include_subtasks: true } : {},
             ...url.searchParams.get("plan_id") ? { plan_id: url.searchParams.get("plan_id") } : {},
+            ...url.searchParams.get("task_list_id") ? { task_list_id: url.searchParams.get("task_list_id") } : {},
             ...url.searchParams.get("assigned_to") ? { assigned_to: url.searchParams.get("assigned_to") } : {},
             ...url.searchParams.get("agent_id") ? { agent_id: url.searchParams.get("agent_id") } : {},
             ...url.searchParams.get("limit") ? { limit: Number(url.searchParams.get("limit")) } : {},
@@ -40559,8 +41004,47 @@ async function handleV1Request(req, url) {
       if (action) {
         if (action === "comments") {
           if (method === "GET") {
-            const comments = await store.audit.getComments(id);
-            return json2({ comments, count: comments.length });
+            if (!await store.tasks.get(id))
+              return error(404, "task not found");
+            const rawLimit = url.searchParams.get("limit");
+            const cursor = url.searchParams.get("cursor");
+            if (rawLimit === null && cursor === null) {
+              const storageContext = contextFromPrincipal(principal);
+              const legacyPage = (await (store.audit.getCommentsPage ? store.audit.getCommentsPage(id, { limit: LEGACY_COMMENT_RESPONSE_LIMIT + 1 }, storageContext) : store.audit.getComments(id, storageContext))).map(redactComment3);
+              if (legacyPage.length > LEGACY_COMMENT_RESPONSE_LIMIT) {
+                return error(426, "task has too many comments for this client; upgrade @hasna/todos to use cursor pagination");
+              }
+              return json2({
+                comments: legacyPage,
+                count: legacyPage.length,
+                has_more: false,
+                next_cursor: null
+              });
+            }
+            const limit = rawLimit === null ? DEFAULT_COMMENT_PAGE_SIZE : Number(rawLimit);
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_COMMENT_PAGE_SIZE) {
+              return error(400, `limit must be an integer between 1 and ${MAX_COMMENT_PAGE_SIZE}`);
+            }
+            let before;
+            if (cursor) {
+              try {
+                before = decodeCommentCursor(cursor);
+              } catch {
+                return error(400, "invalid comment cursor");
+              }
+            }
+            if (!store.audit.getCommentsPage) {
+              return error(426, "storage adapter must be upgraded to support cursor-paginated comments");
+            }
+            const page = (await store.audit.getCommentsPage(id, { limit: limit + 1, ...before ? { before } : {} }, contextFromPrincipal(principal))).map(redactComment3);
+            const hasMore = page.length > limit;
+            const comments = hasMore ? page.slice(1) : page;
+            return json2({
+              comments,
+              count: comments.length,
+              has_more: hasMore,
+              next_cursor: hasMore && comments[0] ? encodeCommentCursor(comments[0]) : null
+            });
           }
           if (method === "POST") {
             const body2 = await readJson(req) ?? {};
@@ -40578,7 +41062,7 @@ async function handleV1Request(req, url) {
               type: body2.type,
               progress_pct: body2.progress_pct
             }, contextFromPrincipal(principal, body2));
-            return json2({ comment }, 201);
+            return json2({ comment: redactComment3(comment) }, 201);
           }
           return error(405, `method ${method} not allowed on /v1/tasks/:id/comments`);
         }
@@ -40593,17 +41077,30 @@ async function handleV1Request(req, url) {
         if (action === "lock" || action === "unlock") {
           if (method !== "POST")
             return error(405, `method ${method} not allowed on /v1/tasks/:id/${action}`);
-          if (typeof store.tasks.lock !== "function" || typeof store.tasks.unlock !== "function") {
-            return error(501, "task locking is not supported by this storage backend");
-          }
           const body2 = await readJson(req) ?? {};
           if (!await store.tasks.get(id))
             return error(404, "task not found");
           if (action === "lock") {
-            const agentId2 = body2.agent_id || principal.agent || "todos-serve";
-            return json2({ result: await store.tasks.lock(id, agentId2) });
+            if (typeof store.tasks.lock !== "function")
+              return error(501, "task locking is not supported by this storage backend");
+            const agentId3 = body2.agent_id || principal.agent || "todos-serve";
+            return json2({ result: await store.tasks.lock(id, agentId3) });
           }
-          const released = await store.tasks.unlock(id, body2.agent_id || principal.agent || undefined);
+          if (typeof store.tasks.unlock !== "function")
+            return error(501, "task unlocking is not supported by this storage backend");
+          if (body2.force === true) {
+            if (!principal.scopes.includes("todos:*"))
+              return error(403, "force unlock requires todos:* scope");
+            const released2 = await store.tasks.unlock(id);
+            return json2({ success: released2 });
+          }
+          if (body2.agent_id && principal.agent && body2.agent_id !== principal.agent && !principal.scopes.includes("todos:*")) {
+            return error(403, "unlock agent_id must match the authenticated agent");
+          }
+          const agentId2 = principal.agent || body2.agent_id;
+          if (!agentId2)
+            return error(403, "unlock requires an agent-bound key or force=true");
+          const released = await store.tasks.unlock(id, agentId2);
           return json2({ success: released });
         }
         if (action === "dependencies") {
@@ -40886,12 +41383,28 @@ async function handleV1Request(req, url) {
       const activity = await store.audit.getRecentActivity(limit);
       return json2({ activity, count: activity.length });
     }
-    if (resource === "task-lists" && !id) {
-      if (method !== "GET")
-        return error(405, `method ${method} not allowed on /v1/task-lists`);
-      const projectId = url.searchParams.get("project_id") ?? undefined;
-      const taskLists = await store.taskLists.list(projectId);
-      return json2({ task_lists: taskLists, count: taskLists.length });
+    if (resource === "task-lists") {
+      if (!id && method === "GET") {
+        const projectId = url.searchParams.get("project_id") ?? undefined;
+        const taskLists = await store.taskLists.list(projectId);
+        return json2({ task_lists: taskLists, count: taskLists.length });
+      }
+      if (!id && method === "POST") {
+        const body = await readJson(req);
+        if (!body || typeof body.name !== "string" || !body.name.trim())
+          return error(400, "name is required");
+        const taskList = await store.taskLists.create(body, contextFromPrincipal(principal));
+        return json2({ task_list: taskList }, 201);
+      }
+      if (id && method === "GET") {
+        const taskList = await store.taskLists.get(id);
+        return taskList ? json2({ task_list: taskList }) : error(404, "task list not found");
+      }
+      if (id && method === "DELETE") {
+        const deleted = await store.taskLists.delete(id, contextFromPrincipal(principal));
+        return deleted ? json2({ deleted: true, id }) : error(404, "task list not found");
+      }
+      return error(405, `method ${method} not allowed on /v1/task-lists${id ? "/:id" : ""}`);
     }
     if (resource === "dependencies" && !id) {
       if (method !== "GET")
@@ -40899,8 +41412,8 @@ async function handleV1Request(req, url) {
       if (typeof store.dependencies?.listAll !== "function") {
         return error(501, "dependency edge listing is not supported by this storage backend");
       }
-      const dependencies = await store.dependencies.listAll();
-      return json2({ dependencies, count: dependencies.length });
+      const dependencies2 = await store.dependencies.listAll();
+      return json2({ dependencies: dependencies2, count: dependencies2.length });
     }
     if (resource === "commits" && id) {
       if (method !== "GET")
@@ -40957,12 +41470,16 @@ async function handleV1Request(req, url) {
     }
     return error(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
+    if (e instanceof LockError)
+      return error(409, e.message, { code: LockError.code });
     return error(500, e.message || "internal error");
   }
 }
-var JSON_HEADERS;
+var JSON_HEADERS, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500;
 var init_v1 = __esm(() => {
+  init_types();
   init_cloud();
+  init_redaction();
   JSON_HEADERS = { "Content-Type": "application/json" };
 });
 
@@ -47197,7 +47714,7 @@ var init_workflow_states = __esm(() => {
   init_tasks();
   init_types();
   init_database();
-  init_config2();
+  init_config();
   init_local_fields();
   DEFAULT_WORKFLOW_STATES = [
     { name: "pending", canonical_status: "pending", aliases: ["todo", "backlog"], transitions: null, terminal: false },
@@ -48362,7 +48879,7 @@ var init_roadmaps = __esm(() => {
   init_tasks();
   init_plans();
   init_task_runs();
-  init_config2();
+  init_config();
 });
 
 // src/lib/capacity-forecasts.ts
@@ -48587,7 +49104,7 @@ var LOCAL_CAPACITY_SCHEMA_VERSION = 1;
 var init_capacity_forecasts = __esm(() => {
   init_tasks();
   init_task_relations();
-  init_config2();
+  init_config();
 });
 
 // src/lib/audit-ledger.ts
@@ -48879,7 +49396,7 @@ var LOCAL_AUDIT_LEDGER_SCHEMA_VERSION = 1, LOCAL_AUDIT_LEDGER_HASH_ALGORITHM = "
 var init_audit_ledger = __esm(() => {
   init_database();
   init_task_runs();
-  init_config2();
+  init_config();
   init_redaction();
   LOCAL_AUDIT_LEDGER_INITIAL_HASH = "0".repeat(64);
 });
@@ -54760,7 +55277,7 @@ var init_agent_run_dispatcher = __esm(() => {
   init_database();
   init_redaction();
   init_runner_sandbox();
-  init_config2();
+  init_config();
 });
 
 // src/lib/verification-providers.ts
@@ -55105,7 +55622,7 @@ var init_verification_providers = __esm(() => {
   init_task_commits();
   init_database();
   init_tasks();
-  init_config2();
+  init_config();
   init_redaction();
   DEFAULT_RETRY = {
     attempts: 1,
@@ -61931,7 +62448,7 @@ var init_review_queues = __esm(() => {
   init_audit();
   init_database();
   init_tasks();
-  init_config2();
+  init_config();
   init_event_emission_safety();
   init_event_hooks();
   init_task_contracts();
@@ -63818,7 +64335,7 @@ ID: ${updated.id}${taskNote}`
 var init_agents2 = __esm(() => {
   init_zod();
   init_agents();
-  init_config2();
+  init_config();
   init_database();
   init_cloud_router();
 });
@@ -64252,7 +64769,7 @@ function captureEnvironmentSnapshot(input = {}) {
 }
 function writeEnvironmentSnapshot(snapshot, outputPath) {
   const path = outputPath ? resolve20(outputPath) : join18(defaultSnapshotDir(), `${snapshot.id}.json`);
-  ensureDir2(dirname9(path));
+  ensureDir(dirname9(path));
   writeJsonFile(path, snapshot);
   return path;
 }
@@ -67895,7 +68412,7 @@ Commit Links (${commitRows.length}):`));
 var init_config_serve_commands = __esm(() => {
   init_database();
   init_tasks();
-  init_config2();
+  init_config();
   init_sync_utils();
   init_helpers();
 });
@@ -70101,7 +70618,7 @@ Findings`));
       checks.push({ name: "Migrations", ok: false, message: "Could not read migration version" });
     }
     try {
-      const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), exports_config2));
+      const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), exports_config));
       loadConfig2();
       checks.push({ name: "Config", ok: true, message: "Loaded successfully" });
     } catch (e) {
@@ -79532,7 +80049,7 @@ var init_factory = __esm(() => {
   init_postgres_adapter();
   init_shadow();
   init_cloud_client();
-  init_config();
+  init_config2();
 });
 
 // src/storage/s3-artifacts.ts
@@ -79974,6 +80491,7 @@ __export(exports_storage, {
   signAwsV4Request: () => signAwsV4Request,
   registerShadowExitFlush: () => registerShadowExitFlush,
   postgresTodosSyncSchemaSql: () => postgresTodosSyncSchemaSql,
+  postgresTodosCommentCursorIndexSql: () => postgresTodosCommentCursorIndexSql,
   planRunArtifactsS3Sync: () => planRunArtifactsS3Sync,
   parseStorageMode: () => parseStorageMode,
   maybeInstallShadowCapture: () => maybeInstallShadowCapture2,
@@ -79981,6 +80499,7 @@ __export(exports_storage, {
   loadStorageConfig: () => loadStorageConfig,
   isTodosShadowEnabled: () => isTodosShadowEnabled,
   isTodosRemoteStorageEnabled: () => isTodosRemoteStorageEnabled,
+  isCommentRedactionBackfillComplete: () => isCommentRedactionBackfillComplete,
   installShadowOutboxSchema: () => installShadowOutboxSchema,
   importSqliteTodosStorageSnapshot: () => importSqliteTodosStorageSnapshot,
   getTodosStorageShadowEnvName: () => getTodosStorageShadowEnvName,
@@ -80008,6 +80527,7 @@ __export(exports_storage, {
   closeRuntimeShadowCloud: () => closeRuntimeShadowCloud,
   buildS3ObjectUrl: () => buildS3ObjectUrl,
   buildS3ObjectKey: () => buildS3ObjectKey,
+  backfillPostgresCommentRedaction: () => backfillPostgresCommentRedaction,
   assertTodosShadowConfig: () => assertTodosShadowConfig,
   assertTodosRemoteStorageConfig: () => assertTodosRemoteStorageConfig,
   TodosShadowOutbox: () => TodosShadowOutbox,
@@ -80020,12 +80540,13 @@ __export(exports_storage, {
   PostgresTodosSyncStore: () => PostgresTodosSyncStore,
   DEFAULT_TODOS_POSTGRES_SYNC_TABLE: () => DEFAULT_TODOS_POSTGRES_SYNC_TABLE,
   DEFAULT_TODOS_POSTGRES_CURSOR_TABLE: () => DEFAULT_TODOS_POSTGRES_CURSOR_TABLE,
+  COMMENT_REDACTION_BACKFILL_CONFIRMATION: () => COMMENT_REDACTION_BACKFILL_CONFIRMATION,
   CANONICAL_TODOS_RDS_RUNTIME_PATH: () => CANONICAL_TODOS_RDS_RUNTIME_PATH,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER: () => CANONICAL_TODOS_RDS_CLUSTER
 });
 var init_storage2 = __esm(() => {
-  init_config();
+  init_config2();
   init_factory();
   init_shadow();
   init_shadow_outbox();
@@ -80034,6 +80555,7 @@ var init_storage2 = __esm(() => {
   init_hybrid();
   init_local_sqlite();
   init_sqlite_snapshot();
+  init_comment_redaction_backfill();
   init_postgres_adapter();
   init_s3_artifacts();
   init_s3_artifact_sync();