@hasna/todos 0.13.1 → 0.13.3

package/dist/storage.js

@@ -43,15 +43,18 @@ var __require = import.meta.require;
 var exports_config = {};
 __export(exports_config, {
   parseStorageMode: () => parseStorageMode,
+  parseStorageBackend: () => parseStorageBackend,
   loadTodosStorageConfig: () => loadTodosStorageConfig,
   loadStorageConfig: () => loadStorageConfig,
   isTodosShadowEnabled: () => isTodosShadowEnabled,
   isTodosRemoteStorageEnabled: () => isTodosRemoteStorageEnabled,
+  isTodosPostgresBackend: () => isTodosPostgresBackend,
   getTodosStorageShadowEnvName: () => getTodosStorageShadowEnvName,
   getTodosStorageMode: () => getTodosStorageMode,
   getTodosStorageEnvName: () => getTodosStorageEnvName,
   getTodosStorageDatabaseUrl: () => getTodosStorageDatabaseUrl,
   getTodosStorageDatabaseEnv: () => getTodosStorageDatabaseEnv,
+  getTodosStorageBackend: () => getTodosStorageBackend,
   getStorageMode: () => getStorageMode,
   getStorageDatabaseUrl: () => getStorageDatabaseUrl,
   getStorageDatabaseEnv: () => getStorageDatabaseEnv,
@@ -76,7 +79,7 @@ function getCanonicalTodosRdsConfig(env = process.env) {
   };
 }
 function loadTodosStorageConfig(env = process.env) {
-  const mode = getTodosStorageMode(env);
+  const mode = getTodosStorageBackend(env);
   const databaseUrl = getTodosStorageDatabaseUrl(env);
   const bucket = readStorageEnv(env, "s3Bucket").value;
   const prefix = readStorageEnv(env, "s3Prefix").value ?? "todos/";
@@ -113,29 +116,41 @@ function loadTodosStorageConfig(env = process.env) {
 function loadStorageConfig(env = process.env) {
   return loadTodosStorageConfig(env);
 }
+function isTodosPostgresBackend(config) {
+  return config.mode === "postgres";
+}
 function isTodosRemoteStorageEnabled(config) {
-  return config.mode === "remote" || config.mode === "hybrid";
+  return isTodosPostgresBackend(config);
 }
 function assertTodosRemoteStorageConfig(config) {
-  if (!isTodosRemoteStorageEnabled(config))
+  if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
     throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
   }
 }
-function parseStorageMode(value) {
+function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
-    return "local";
-  if (normalized === "local" || normalized === "remote" || normalized === "hybrid")
+    return "sqlite";
+  if (normalized === "sqlite" || normalized === "postgres")
     return normalized;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be local, remote, or hybrid`);
+  const legacy = LEGACY_BACKEND_TOKENS[normalized];
+  if (legacy)
+    return legacy;
+  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+}
+function parseStorageMode(value) {
+  return parseStorageBackend(value);
+}
+function getTodosStorageBackend(env = process.env) {
+  return parseStorageBackend(readStorageEnv(env, "mode").value);
 }
 function getTodosStorageMode(env = process.env) {
-  return parseStorageMode(readStorageEnv(env, "mode").value);
+  return getTodosStorageBackend(env);
 }
 function getStorageMode(env = process.env) {
-  return getTodosStorageMode(env);
+  return getTodosStorageBackend(env);
 }
 function isTodosShadowEnabled(env = process.env) {
   return parseBoolean(readStorageEnv(env, "shadow").value, false);
@@ -146,8 +161,8 @@ function getTodosStorageShadowEnvName(env = process.env) {
 function assertTodosShadowConfig(config, env = process.env) {
   if (!isTodosShadowEnabled(env))
     return;
-  if (config.mode !== "local") {
-    throw new Error(`${readStorageEnv(env, "shadow").name} shadow mirror requires ${TODOS_STORAGE_ENV.mode}=local (got ${config.mode})`);
+  if (config.mode !== "sqlite") {
+    throw new Error(`${readStorageEnv(env, "shadow").name} shadow mirror requires the sqlite backend (got ${config.mode})`);
   }
   if (!config.database?.url) {
     throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${readStorageEnv(env, "shadow").name} is enabled`);
@@ -203,7 +218,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
 var init_config = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -244,6 +259,187 @@ var init_config = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
+  LEGACY_BACKEND_TOKENS = {
+    local: "sqlite",
+    remote: "postgres",
+    postgresql: "postgres",
+    hybrid: "postgres",
+    self_hosted: "postgres",
+    cloud: "postgres"
+  };
+});
+
+// src/types/index.ts
+function isBlockingDependencyStatus(status) {
+  return status !== "completed" && status !== "cancelled";
+}
+var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, TaskReferenceAmbiguousError, ProjectNotFoundError, ResourceConflictError, PlanNotFoundError, LockError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError;
+var init_types = __esm(() => {
+  TASK_STATUSES = [
+    "pending",
+    "in_progress",
+    "completed",
+    "failed",
+    "cancelled"
+  ];
+  TASK_PRIORITIES = [
+    "low",
+    "medium",
+    "high",
+    "critical"
+  ];
+  PLAN_STATUSES = ["active", "completed", "archived"];
+  VersionConflictError = class VersionConflictError extends Error {
+    taskId;
+    expectedVersion;
+    actualVersion;
+    static code = "VERSION_CONFLICT";
+    static suggestion = "Fetch the task with get_task to get the current version before updating.";
+    constructor(taskId, expectedVersion, actualVersion) {
+      super(`Version conflict for task ${taskId}: expected ${expectedVersion}, got ${actualVersion}`);
+      this.taskId = taskId;
+      this.expectedVersion = expectedVersion;
+      this.actualVersion = actualVersion;
+      this.name = "VersionConflictError";
+    }
+  };
+  TaskNotFoundError = class TaskNotFoundError extends Error {
+    taskId;
+    static code = "TASK_NOT_FOUND";
+    static suggestion = "Verify the task ID. Use list_tasks or search_tasks to find the correct ID.";
+    constructor(taskId) {
+      super(`Task not found: ${taskId}`);
+      this.taskId = taskId;
+      this.name = "TaskNotFoundError";
+    }
+  };
+  TaskReferenceAmbiguousError = class TaskReferenceAmbiguousError extends Error {
+    reference;
+    static code = "TASK_REFERENCE_AMBIGUOUS";
+    candidateTaskIds;
+    candidateProjectIds;
+    constructor(reference, candidates) {
+      const candidateTaskIds = [...new Set(candidates.map((candidate) => candidate.task_id))].sort();
+      const candidateProjectIds = [...new Set(candidates.map((candidate) => candidate.project_id).filter((projectId) => typeof projectId === "string" && projectId.length > 0))].sort();
+      const projectList = candidateProjectIds.length > 0 ? candidateProjectIds.join(", ") : "(unscoped)";
+      super(`Task reference is ambiguous: "${reference}". Candidate project IDs: ${projectList}. ` + "Use a full task UUID.");
+      this.reference = reference;
+      this.name = "TaskReferenceAmbiguousError";
+      this.candidateTaskIds = candidateTaskIds;
+      this.candidateProjectIds = candidateProjectIds;
+    }
+  };
+  ProjectNotFoundError = class ProjectNotFoundError extends Error {
+    projectId;
+    static code = "PROJECT_NOT_FOUND";
+    static suggestion = "Use list_projects to see available projects.";
+    constructor(projectId) {
+      super(`Project not found: ${projectId}`);
+      this.projectId = projectId;
+      this.name = "ProjectNotFoundError";
+    }
+  };
+  ResourceConflictError = class ResourceConflictError extends Error {
+    code;
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+      this.name = "ResourceConflictError";
+    }
+  };
+  PlanNotFoundError = class PlanNotFoundError extends Error {
+    planId;
+    static code = "PLAN_NOT_FOUND";
+    static suggestion = "Use list_plans to see available plans.";
+    constructor(planId) {
+      super(`Plan not found: ${planId}`);
+      this.planId = planId;
+      this.name = "PlanNotFoundError";
+    }
+  };
+  LockError = class LockError extends Error {
+    taskId;
+    lockedBy;
+    static code = "LOCK_ERROR";
+    static suggestion = "Wait for the lock to expire (30 min) or contact the lock holder.";
+    constructor(taskId, lockedBy) {
+      super(`Task ${taskId} is locked by ${lockedBy}`);
+      this.taskId = taskId;
+      this.lockedBy = lockedBy;
+      this.name = "LockError";
+    }
+  };
+  AgentNotFoundError = class AgentNotFoundError extends Error {
+    agentId;
+    static code = "AGENT_NOT_FOUND";
+    static suggestion = "Use register_agent to create the agent first, or list_agents to find existing ones.";
+    constructor(agentId) {
+      super(`Agent not found: ${agentId}`);
+      this.agentId = agentId;
+      this.name = "AgentNotFoundError";
+    }
+  };
+  IdentityAliasAmbiguousError = class IdentityAliasAmbiguousError extends Error {
+    code = "IDENTITY_ALIAS_AMBIGUOUS";
+    candidates;
+    constructor(subject, candidates = []) {
+      super(`Identity alias or source is ambiguous: ${subject}`);
+      this.name = "IdentityAliasAmbiguousError";
+      this.candidates = [...new Set(candidates)].sort();
+    }
+  };
+  IdentityIdImmutableError = class IdentityIdImmutableError extends Error {
+    code = "IDENTITY_ID_IMMUTABLE";
+    constructor(agentId) {
+      super(`IDENTITY_ID_IMMUTABLE: canonical identity for agent ${agentId} cannot be replaced`);
+      this.name = "IdentityIdImmutableError";
+    }
+  };
+  TaskListNotFoundError = class TaskListNotFoundError extends Error {
+    taskListId;
+    static code = "TASK_LIST_NOT_FOUND";
+    static suggestion = "Use list_task_lists to see available lists.";
+    constructor(taskListId) {
+      super(`Task list not found: ${taskListId}`);
+      this.taskListId = taskListId;
+      this.name = "TaskListNotFoundError";
+    }
+  };
+  DependencyCycleError = class DependencyCycleError extends Error {
+    taskId;
+    dependsOn;
+    static code = "DEPENDENCY_CYCLE";
+    static suggestion = "Check the dependency chain with get_task to avoid circular references.";
+    constructor(taskId, dependsOn) {
+      super(`Adding dependency ${taskId} -> ${dependsOn} would create a cycle`);
+      this.taskId = taskId;
+      this.dependsOn = dependsOn;
+      this.name = "DependencyCycleError";
+    }
+  };
+  CompletionGuardError = class CompletionGuardError extends Error {
+    reason;
+    retryAfterSeconds;
+    static code = "COMPLETION_BLOCKED";
+    static suggestion = "Wait for the cooldown period, then retry.";
+    constructor(reason, retryAfterSeconds) {
+      super(reason);
+      this.reason = reason;
+      this.retryAfterSeconds = retryAfterSeconds;
+      this.name = "CompletionGuardError";
+    }
+  };
+  DISPATCH_STATUSES = ["pending", "sent", "failed", "cancelled"];
+  DispatchNotFoundError = class DispatchNotFoundError extends Error {
+    dispatchId;
+    static code = "DISPATCH_NOT_FOUND";
+    static suggestion = "Check the dispatch ID with list_dispatches.";
+    constructor(dispatchId) {
+      super(`Dispatch not found: ${dispatchId}`);
+      this.dispatchId = dispatchId;
+      this.name = "DispatchNotFoundError";
+    }
+  };
 });
 
 // src/db/migrations.ts
@@ -3630,160 +3826,6 @@ var init_machines = __esm(() => {
   ];
 });
 
-// src/types/index.ts
-var TASK_STATUSES, TASK_PRIORITIES, PLAN_STATUSES, VersionConflictError, TaskNotFoundError, ProjectNotFoundError, ResourceConflictError, PlanNotFoundError, LockError, AgentNotFoundError, IdentityAliasAmbiguousError, IdentityIdImmutableError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError, DISPATCH_STATUSES, DispatchNotFoundError;
-var init_types = __esm(() => {
-  TASK_STATUSES = [
-    "pending",
-    "in_progress",
-    "completed",
-    "failed",
-    "cancelled"
-  ];
-  TASK_PRIORITIES = [
-    "low",
-    "medium",
-    "high",
-    "critical"
-  ];
-  PLAN_STATUSES = ["active", "completed", "archived"];
-  VersionConflictError = class VersionConflictError extends Error {
-    taskId;
-    expectedVersion;
-    actualVersion;
-    static code = "VERSION_CONFLICT";
-    static suggestion = "Fetch the task with get_task to get the current version before updating.";
-    constructor(taskId, expectedVersion, actualVersion) {
-      super(`Version conflict for task ${taskId}: expected ${expectedVersion}, got ${actualVersion}`);
-      this.taskId = taskId;
-      this.expectedVersion = expectedVersion;
-      this.actualVersion = actualVersion;
-      this.name = "VersionConflictError";
-    }
-  };
-  TaskNotFoundError = class TaskNotFoundError extends Error {
-    taskId;
-    static code = "TASK_NOT_FOUND";
-    static suggestion = "Verify the task ID. Use list_tasks or search_tasks to find the correct ID.";
-    constructor(taskId) {
-      super(`Task not found: ${taskId}`);
-      this.taskId = taskId;
-      this.name = "TaskNotFoundError";
-    }
-  };
-  ProjectNotFoundError = class ProjectNotFoundError extends Error {
-    projectId;
-    static code = "PROJECT_NOT_FOUND";
-    static suggestion = "Use list_projects to see available projects.";
-    constructor(projectId) {
-      super(`Project not found: ${projectId}`);
-      this.projectId = projectId;
-      this.name = "ProjectNotFoundError";
-    }
-  };
-  ResourceConflictError = class ResourceConflictError extends Error {
-    code;
-    constructor(code, message) {
-      super(message);
-      this.code = code;
-      this.name = "ResourceConflictError";
-    }
-  };
-  PlanNotFoundError = class PlanNotFoundError extends Error {
-    planId;
-    static code = "PLAN_NOT_FOUND";
-    static suggestion = "Use list_plans to see available plans.";
-    constructor(planId) {
-      super(`Plan not found: ${planId}`);
-      this.planId = planId;
-      this.name = "PlanNotFoundError";
-    }
-  };
-  LockError = class LockError extends Error {
-    taskId;
-    lockedBy;
-    static code = "LOCK_ERROR";
-    static suggestion = "Wait for the lock to expire (30 min) or contact the lock holder.";
-    constructor(taskId, lockedBy) {
-      super(`Task ${taskId} is locked by ${lockedBy}`);
-      this.taskId = taskId;
-      this.lockedBy = lockedBy;
-      this.name = "LockError";
-    }
-  };
-  AgentNotFoundError = class AgentNotFoundError extends Error {
-    agentId;
-    static code = "AGENT_NOT_FOUND";
-    static suggestion = "Use register_agent to create the agent first, or list_agents to find existing ones.";
-    constructor(agentId) {
-      super(`Agent not found: ${agentId}`);
-      this.agentId = agentId;
-      this.name = "AgentNotFoundError";
-    }
-  };
-  IdentityAliasAmbiguousError = class IdentityAliasAmbiguousError extends Error {
-    code = "IDENTITY_ALIAS_AMBIGUOUS";
-    candidates;
-    constructor(subject, candidates = []) {
-      super(`Identity alias or source is ambiguous: ${subject}`);
-      this.name = "IdentityAliasAmbiguousError";
-      this.candidates = [...new Set(candidates)].sort();
-    }
-  };
-  IdentityIdImmutableError = class IdentityIdImmutableError extends Error {
-    code = "IDENTITY_ID_IMMUTABLE";
-    constructor(agentId) {
-      super(`IDENTITY_ID_IMMUTABLE: canonical identity for agent ${agentId} cannot be replaced`);
-      this.name = "IdentityIdImmutableError";
-    }
-  };
-  TaskListNotFoundError = class TaskListNotFoundError extends Error {
-    taskListId;
-    static code = "TASK_LIST_NOT_FOUND";
-    static suggestion = "Use list_task_lists to see available lists.";
-    constructor(taskListId) {
-      super(`Task list not found: ${taskListId}`);
-      this.taskListId = taskListId;
-      this.name = "TaskListNotFoundError";
-    }
-  };
-  DependencyCycleError = class DependencyCycleError extends Error {
-    taskId;
-    dependsOn;
-    static code = "DEPENDENCY_CYCLE";
-    static suggestion = "Check the dependency chain with get_task to avoid circular references.";
-    constructor(taskId, dependsOn) {
-      super(`Adding dependency ${taskId} -> ${dependsOn} would create a cycle`);
-      this.taskId = taskId;
-      this.dependsOn = dependsOn;
-      this.name = "DependencyCycleError";
-    }
-  };
-  CompletionGuardError = class CompletionGuardError extends Error {
-    reason;
-    retryAfterSeconds;
-    static code = "COMPLETION_BLOCKED";
-    static suggestion = "Wait for the cooldown period, then retry.";
-    constructor(reason, retryAfterSeconds) {
-      super(reason);
-      this.reason = reason;
-      this.retryAfterSeconds = retryAfterSeconds;
-      this.name = "CompletionGuardError";
-    }
-  };
-  DISPATCH_STATUSES = ["pending", "sent", "failed", "cancelled"];
-  DispatchNotFoundError = class DispatchNotFoundError extends Error {
-    dispatchId;
-    static code = "DISPATCH_NOT_FOUND";
-    static suggestion = "Check the dispatch ID with list_dispatches.";
-    constructor(dispatchId) {
-      super(`Dispatch not found: ${dispatchId}`);
-      this.dispatchId = dispatchId;
-      this.name = "DispatchNotFoundError";
-    }
-  };
-});
-
 // src/db/identity-mapping.ts
 function timestamp() {
   return new Date().toISOString();
@@ -4089,6 +4131,30 @@ function findGitRoot(startDir) {
   }
   return null;
 }
+function getGlobalDbPath() {
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
+  return join(home, ".hasna", "todos", "todos.db");
+}
+function hasExplicitProjectArg(args = process.argv.slice(2)) {
+  return args.some((arg) => arg === "--project" || arg.startsWith("--project="));
+}
+function getCliCommand(args = process.argv.slice(2)) {
+  const globalOptionsWithValues = new Set(["--project", "--agent", "--session"]);
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (globalOptionsWithValues.has(arg)) {
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-"))
+      continue;
+    return arg;
+  }
+  return null;
+}
+function canCreateScopedProjectDb(args = process.argv.slice(2)) {
+  return getCliCommand(args) === "project-bootstrap" && !args.some((arg) => arg === "--dry-run" || arg.startsWith("--dry-run="));
+}
 function getDbPath() {
   if (process.env["HASNA_TODOS_DB_PATH"]) {
     return process.env["HASNA_TODOS_DB_PATH"];
@@ -4096,18 +4162,19 @@ function getDbPath() {
   if (process.env["TODOS_DB_PATH"]) {
     return process.env["TODOS_DB_PATH"];
   }
+  if (hasExplicitProjectArg())
+    return getGlobalDbPath();
   const cwd = process.cwd();
   const nearest = findNearestProjectDb(cwd);
   if (nearest)
     return nearest;
   if (process.env["TODOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
-    if (gitRoot) {
+    if (gitRoot && canCreateScopedProjectDb()) {
       return join(gitRoot, ".hasna", "todos", "todos.db");
     }
   }
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  return join(home, ".hasna", "todos", "todos.db");
+  return getGlobalDbPath();
 }
 function getDatabasePath() {
   return getDbPath();
@@ -4123,8 +4190,8 @@ function ensureDir(filePath) {
 function openDatabase(path) {
   ensureDir(path);
   const db = new Database(path);
-  db.run("PRAGMA journal_mode = WAL");
   db.run("PRAGMA busy_timeout = 5000");
+  db.run("PRAGMA journal_mode = WAL");
   db.run("PRAGMA foreign_keys = ON");
   runMigrations(db);
   ensureAgentIdentitySchema(db);
@@ -4210,10 +4277,13 @@ function resolvePartialId(db, table, partialId) {
     return null;
   }
   if (table === "tasks") {
-    const shortIdRows = db.query("SELECT id FROM tasks WHERE short_id = ?").all(partialId);
+    const shortIdRows = db.query("SELECT id, project_id FROM tasks WHERE LOWER(short_id) = LOWER(?) ORDER BY project_id, id").all(partialId);
     if (shortIdRows.length === 1) {
       return shortIdRows[0].id;
     }
+    if (shortIdRows.length > 1) {
+      throw new TaskReferenceAmbiguousError(partialId, shortIdRows.map((row) => ({ task_id: row.id, project_id: row.project_id })));
+    }
   }
   if (table === "task_lists") {
     const slugRow = db.query("SELECT id FROM task_lists WHERE slug = ?").get(partialId);
@@ -4955,11 +5025,15 @@ function secretPatterns() {
   return [...customPatterns(), ...DEFAULT_SECRET_PATTERNS];
 }
 function isRedactionPlaceholderMatch(match) {
-  const placeholder = String.raw`\[REDACTED(?:_[A-Z_]+)?\]`;
   const trimmed = match.trim();
-  return new RegExp(`^${placeholder}$`).test(trimmed) || new RegExp(`=\\s*['"]?${placeholder}['"]?$`).test(trimmed);
+  return new RegExp(`^${REDACTION_PLACEHOLDER}$`).test(trimmed) || new RegExp(`=\\s*['"]?${REDACTION_PLACEHOLDER}['"]?$`).test(trimmed);
+}
+function isRedactionPlaceholderKey(key) {
+  return new RegExp(`^${REDACTION_PLACEHOLDER}$`).test(key.trim());
 }
 function isSecretKey(key) {
+  if (isRedactionPlaceholderKey(key))
+    return false;
   if (NON_SECRET_USAGE_KEYS.has(key.toLowerCase()))
     return false;
   if (DEFAULT_SECRET_KEY_PATTERN.test(key))
@@ -5020,7 +5094,7 @@ function upsertSecretSafetyConfig(input) {
   saveConfig({ ...config, secret_safety: next });
   return next;
 }
-var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS;
+var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS, REDACTION_PLACEHOLDER;
 var init_redaction = __esm(() => {
   init_config2();
   DEFAULT_SECRET_PATTERNS = [
@@ -5044,6 +5118,7 @@ var init_redaction = __esm(() => {
     "completion_tokens",
     "cost_tokens"
   ]);
+  REDACTION_PLACEHOLDER = String.raw`\[REDACTED(?:_[A-Z_]+)?\]`;
 });
 
 // src/lib/workspace-trust.ts
@@ -6683,7 +6758,7 @@ function scanTextForSecrets(text, options = {}) {
   };
 }
 function redactText(text, options = {}) {
-  const placeholder = options.placeholder ?? REDACTION_PLACEHOLDER;
+  const placeholder = options.placeholder ?? REDACTION_PLACEHOLDER2;
   let out = text;
   for (const { pattern, allowlist_ok } of DEFAULT_PATTERNS) {
     out = out.replace(new RegExp(pattern.source, pattern.flags), (match) => {
@@ -6744,7 +6819,7 @@ function redactExportRecord(record) {
 function getDefaultSecretPatterns() {
   return DEFAULT_PATTERNS.map((p) => ({ name: p.name, source: p.pattern.source }));
 }
-var SECRET_REDACTION_SCHEMA, REDACTION_PLACEHOLDER = "[REDACTED]", DEFAULT_PATTERNS, DEFAULT_ALLOWLIST, customRedactors;
+var SECRET_REDACTION_SCHEMA, REDACTION_PLACEHOLDER2 = "[REDACTED]", DEFAULT_PATTERNS, DEFAULT_ALLOWLIST, customRedactors;
 var init_secret_redaction = __esm(() => {
   init_redaction();
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
@@ -8801,10 +8876,11 @@ function getTaskWithRelations(id, db) {
        JOIN task_dependencies td ON td.depends_on = t.id
        WHERE td.task_id = ?`).all(id);
   const dependencies = depRows.map(rowToTask2);
-  const blockedByRows = d.query(`SELECT t.* FROM tasks t
+  const blocked_by = dependencies.filter((dep) => isBlockingDependencyStatus(dep.status));
+  const blocksRows = d.query(`SELECT t.* FROM tasks t
        JOIN task_dependencies td ON td.task_id = t.id
        WHERE td.depends_on = ?`).all(id);
-  const blocked_by = blockedByRows.map(rowToTask2);
+  const blocks = blocksRows.map(rowToTask2);
   const comments = d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at").all(id);
   const parent = task.parent_id ? getTask(task.parent_id, d) : null;
   const checklist = getChecklist(id, d);
@@ -8813,6 +8889,7 @@ function getTaskWithRelations(id, db) {
     subtasks,
     dependencies,
     blocked_by,
+    blocks,
     comments,
     parent,
     checklist
@@ -11824,6 +11901,9 @@ var init_tasks = __esm(() => {
 // src/storage/index.ts
 init_config();
 
+// src/storage/local-sqlite.ts
+init_types();
+
 // src/lib/search.ts
 init_database();
 function rowToTask(row) {
@@ -12640,6 +12720,267 @@ init_audit();
 init_comments();
 init_database();
 
+// src/db/integrity.ts
+init_database();
+
+// src/lib/integrity.ts
+init_types();
+var TODOS_INTEGRITY_SCHEMA_VERSION = "todos.integrity.v1";
+var TERMINAL_TASK_STATUSES = ["completed", "failed", "cancelled"];
+var OPEN_TASK_STATUSES = TASK_STATUSES.filter((status) => !TERMINAL_TASK_STATUSES.includes(status));
+var INTEGRITY_CONDITIONS = [
+  {
+    id: "tasks_without_project",
+    entity: "task",
+    field: "project_id",
+    target: "project",
+    kind: "missing",
+    base_severity: "warn",
+    escalate_when_open: true,
+    impact: "invisible to every project-scoped read (list, status, next, claim)"
+  },
+  {
+    id: "tasks_without_task_list",
+    entity: "task",
+    field: "task_list_id",
+    target: "task_list",
+    kind: "missing",
+    base_severity: "warn",
+    escalate_when_open: true,
+    impact: "invisible to every task-list read \u2014 the list reports zero open work"
+  },
+  {
+    id: "tasks_with_unregistered_project",
+    entity: "task",
+    field: "project_id",
+    target: "project",
+    kind: "dangling",
+    base_severity: "error",
+    escalate_when_open: false,
+    impact: "points at a project id that does not exist; the reference can never resolve"
+  },
+  {
+    id: "tasks_with_unregistered_task_list",
+    entity: "task",
+    field: "task_list_id",
+    target: "task_list",
+    kind: "dangling",
+    base_severity: "error",
+    escalate_when_open: false,
+    impact: "points at a task-list id that does not exist; the reference can never resolve"
+  },
+  {
+    id: "task_lists_without_project",
+    entity: "task_list",
+    field: "project_id",
+    target: "project",
+    kind: "missing",
+    base_severity: "warn",
+    escalate_when_open: false,
+    impact: "unbound list \u2014 unreachable from any project, so its tasks are unroutable"
+  },
+  {
+    id: "task_lists_with_unregistered_project",
+    entity: "task_list",
+    field: "project_id",
+    target: "project",
+    kind: "dangling",
+    base_severity: "error",
+    escalate_when_open: false,
+    impact: "points at a project id that does not exist; the list can never be reached"
+  }
+];
+function integrityCondition(id) {
+  const spec = INTEGRITY_CONDITIONS.find((condition) => condition.id === id);
+  if (!spec)
+    throw new Error(`unknown integrity condition: ${id}`);
+  return spec;
+}
+function resolveIntegritySeverity(spec, measurement) {
+  if (spec.kind === "dangling")
+    return "error";
+  if (spec.escalate_when_open && (measurement.open_count ?? 0) > 0)
+    return "error";
+  return spec.base_severity;
+}
+var ENTITY_LABEL = {
+  task: ["task", "tasks"],
+  task_list: ["task list", "task lists"]
+};
+function plural(entity, count) {
+  const [one, many] = ENTITY_LABEL[entity];
+  return count === 1 ? one : many;
+}
+function formatIntegrityMessage(spec, measurement) {
+  const noun = plural(spec.entity, measurement.count);
+  const verb = measurement.count === 1 ? ["has", "references"] : ["have", "reference"];
+  const open = measurement.open_count === null || measurement.open_count === 0 ? "" : ` (${measurement.open_count} still open)`;
+  return spec.kind === "missing" ? `${measurement.count} ${noun} ${verb[0]} no ${spec.field}${open}` : `${measurement.count} ${noun} ${verb[1]} a ${spec.target.replace("_", " ")} that is not registered${open}`;
+}
+function measuredCondition(spec, measurement, source) {
+  return {
+    id: spec.id,
+    entity: spec.entity,
+    field: spec.field,
+    kind: spec.kind,
+    count: measurement.count,
+    open_count: measurement.open_count,
+    severity: measurement.count > 0 ? resolveIntegritySeverity(spec, measurement) : null,
+    verified: true,
+    source,
+    message: formatIntegrityMessage(spec, measurement),
+    impact: spec.impact
+  };
+}
+function unverifiedCondition(spec, reason) {
+  return {
+    id: spec.id,
+    entity: spec.entity,
+    field: spec.field,
+    kind: spec.kind,
+    count: null,
+    open_count: null,
+    severity: null,
+    verified: false,
+    source: "unverified",
+    unverified_reason: reason,
+    message: `${spec.id}: NOT CHECKED \u2014 ${reason}`,
+    impact: spec.impact
+  };
+}
+function summarizeIntegrity(conditions) {
+  const measured = conditions.filter((condition) => condition.verified && condition.count !== null);
+  const findings = measured.filter((condition) => (condition.count ?? 0) > 0);
+  const unverified = conditions.length - measured.length;
+  return {
+    ok: unverified === 0 && findings.length === 0,
+    findings: findings.length,
+    rows: findings.reduce((total, condition) => total + (condition.count ?? 0), 0),
+    errors: findings.filter((condition) => condition.severity === "error").length,
+    warnings: findings.filter((condition) => condition.severity === "warn").length,
+    unverified,
+    complete: unverified === 0
+  };
+}
+function buildIntegrityReport(conditions, generatedAt) {
+  const measuredSources = [...new Set(conditions.map((condition) => condition.source))].filter((source) => source !== "unverified");
+  return {
+    schema_version: TODOS_INTEGRITY_SCHEMA_VERSION,
+    generated_at: generatedAt,
+    source: measuredSources.length === 0 ? "unverified" : measuredSources.length === 1 ? measuredSources[0] : "remote-derived",
+    conditions,
+    summary: summarizeIntegrity(conditions)
+  };
+}
+function adoptRemoteIntegrityReport(raw, fallbackGeneratedAt) {
+  const received = new Map;
+  if (Array.isArray(raw.conditions)) {
+    for (const entry of raw.conditions) {
+      if (entry && typeof entry["id"] === "string")
+        received.set(entry["id"], entry);
+    }
+  }
+  const conditions = INTEGRITY_CONDITIONS.map((spec) => {
+    const entry = received.get(spec.id);
+    const count = entry?.["count"];
+    const verified = entry?.["verified"];
+    if (!entry || verified === false || typeof count !== "number" || !Number.isFinite(count)) {
+      return unverifiedCondition(spec, entry ? typeof entry["unverified_reason"] === "string" ? String(entry["unverified_reason"]) : "authority reported this condition without a usable count" : "authority did not report this condition");
+    }
+    const openRaw = entry["open_count"];
+    return measuredCondition(spec, {
+      count,
+      open_count: spec.entity === "task" ? typeof openRaw === "number" && Number.isFinite(openRaw) ? openRaw : 0 : null
+    }, typeof raw.source === "string" && raw.source === "postgres" ? "postgres" : "remote-authority");
+  });
+  const report = buildIntegrityReport(conditions, typeof raw.generated_at === "string" ? raw.generated_at : fallbackGeneratedAt);
+  return typeof raw.source === "string" && (raw.source === "sqlite" || raw.source === "postgres") ? { ...report, source: raw.source } : report;
+}
+var SQLITE_TABLE = {
+  task: "tasks",
+  task_list: "task_lists",
+  project: "projects"
+};
+function sqliteOpenStatusList() {
+  return OPEN_TASK_STATUSES.map((status) => `'${status}'`).join(", ");
+}
+function buildSqliteIntegritySql(spec) {
+  const table = SQLITE_TABLE[spec.entity];
+  const target = SQLITE_TABLE[spec.target];
+  const column = `t."${spec.field}"`;
+  const predicate = spec.kind === "missing" ? `(${column} IS NULL OR ${column} = '')` : `${column} IS NOT NULL AND ${column} <> '' ` + `AND NOT EXISTS (SELECT 1 FROM "${target}" r WHERE r."id" = ${column})`;
+  const openExpr = spec.entity === "task" ? `SUM(CASE WHEN t."status" IN (${sqliteOpenStatusList()}) THEN 1 ELSE 0 END)` : "NULL";
+  return `SELECT COUNT(*) AS count, ${openExpr} AS open_count FROM "${table}" t WHERE ${predicate}`;
+}
+var RECORD_TYPE = {
+  task: "tasks",
+  task_list: "task_lists",
+  project: "projects"
+};
+function buildPostgresIntegritySql(spec, options) {
+  const params = [options.service, RECORD_TYPE[spec.entity]];
+  const p = (value) => {
+    params.push(value);
+    return `$${params.length}`;
+  };
+  const column = `t.payload->>'${spec.field}'`;
+  const predicate = spec.kind === "missing" ? `(${column} IS NULL OR ${column} = '')` : `${column} IS NOT NULL AND ${column} <> '' AND NOT EXISTS (` + `SELECT 1 FROM ${options.table} r WHERE r.service = $1 AND r.object_type = ${p(RECORD_TYPE[spec.target])} ` + `AND r.deleted_at IS NULL AND r.object_id = ${column})`;
+  const openExpr = spec.entity === "task" ? `COUNT(*) FILTER (WHERE t.payload->>'status' IN (${OPEN_TASK_STATUSES.map((status) => p(status)).join(", ")}))::int` : "NULL::int";
+  const sql = `/* todos:integrity-${spec.id} */ SELECT COUNT(*)::int AS count, ${openExpr} AS open_count ` + `FROM ${options.table} t WHERE t.service = $1 AND t.object_type = $2 AND t.deleted_at IS NULL AND ${predicate}`;
+  return { sql, params };
+}
+function referenceOf(row, field) {
+  const raw = row[field];
+  if (typeof raw !== "string")
+    return null;
+  const trimmed = raw.trim();
+  return trimmed === "" ? null : trimmed;
+}
+function measureIntegrityRows(spec, sets) {
+  const rows = spec.entity === "task" ? sets.tasks : sets.taskLists;
+  if (!rows)
+    return null;
+  const registered = spec.kind === "dangling" ? spec.target === "project" ? sets.projectIds : sets.taskListIds : undefined;
+  if (spec.kind === "dangling" && !registered)
+    return null;
+  let count = 0;
+  let open = 0;
+  for (const row of rows) {
+    const reference = referenceOf(row, spec.field);
+    const matches = spec.kind === "missing" ? reference === null : reference !== null && !registered.has(reference);
+    if (!matches)
+      continue;
+    count++;
+    if (spec.entity === "task") {
+      const status = row.status;
+      if (typeof status === "string" && OPEN_TASK_STATUSES.includes(status))
+        open++;
+    }
+  }
+  return { count, open_count: spec.entity === "task" ? open : null };
+}
+
+// src/db/integrity.ts
+var REQUIRED_TABLES = { tasks: true, task_lists: true, projects: true };
+function tableExists(db, table) {
+  return Boolean(db.query("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(table));
+}
+function scanSqliteIntegrity(db = getDatabase()) {
+  const missing = Object.keys(REQUIRED_TABLES).filter((table) => !tableExists(db, table));
+  const conditions = INTEGRITY_CONDITIONS.map((spec) => {
+    if (missing.length > 0) {
+      return unverifiedCondition(spec, `local schema is missing table(s): ${missing.join(", ")}`);
+    }
+    try {
+      const row = db.query(buildSqliteIntegritySql(spec)).get();
+      return measuredCondition(spec, { count: Number(row?.count ?? 0), open_count: spec.entity === "task" ? Number(row?.open_count ?? 0) : null }, "sqlite");
+    } catch (error) {
+      return unverifiedCondition(spec, error instanceof Error ? error.message : String(error));
+    }
+  });
+  return buildIntegrityReport(conditions, now());
+}
+
 // src/storage/sqlite-snapshot.ts
 init_database();
 init_audit();
@@ -13031,15 +13372,15 @@ function resolveTaskRefLocal(db, ref) {
     return null;
   if (TASK_UUID_RE.test(raw))
     return getTask(raw, db);
-  const prefixRows = db.query("SELECT id FROM tasks WHERE LOWER(id) LIKE ? ESCAPE '\\' LIMIT 2").all(`${raw.replace(/[\\%_]/g, (c) => `\\${c}`)}%`);
+  const prefixRows = db.query("SELECT id, project_id FROM tasks WHERE LOWER(id) LIKE ? ESCAPE '\\' ORDER BY project_id, id LIMIT 2").all(`${raw.replace(/[\\%_]/g, (c) => `\\${c}`)}%`);
   if (prefixRows.length > 1) {
-    throw new Error(`Task reference is ambiguous: "${ref}"`);
+    throw new TaskReferenceAmbiguousError(ref, prefixRows.map((row) => ({ task_id: row.id, project_id: row.project_id })));
   }
   if (prefixRows.length === 1)
     return getTask(prefixRows[0].id, db);
-  const shortIdRows = db.query("SELECT id FROM tasks WHERE LOWER(short_id) = ? LIMIT 2").all(raw);
+  const shortIdRows = db.query("SELECT id, project_id FROM tasks WHERE LOWER(short_id) = ? ORDER BY project_id, id LIMIT 2").all(raw);
   if (shortIdRows.length > 1) {
-    throw new Error(`Task reference is ambiguous: "${ref}"`);
+    throw new TaskReferenceAmbiguousError(ref, shortIdRows.map((row) => ({ task_id: row.id, project_id: row.project_id })));
   }
   if (shortIdRows.length === 1)
     return getTask(shortIdRows[0].id, db);
@@ -13188,6 +13529,9 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       exportSnapshot: () => exportSqliteTodosStorageSnapshot(database()),
       importSnapshot: (snapshot) => importSqliteTodosStorageSnapshot(snapshot, database())
     },
+    integrity: {
+      report: () => scanSqliteIntegrity(database())
+    },
     transaction: (fn) => {
       const tx = database().transaction(() => fn(adapter));
       return tx();
@@ -13196,6 +13540,10 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
   return adapter;
 }
 
+// src/storage/postgres-adapter.ts
+init_types();
+import { randomUUID as randomUUID3 } from "crypto";
+
 // src/storage/postgres-sync.ts
 var DEFAULT_TODOS_POSTGRES_SYNC_TABLE = "todos_sync_records";
 var DEFAULT_TODOS_POSTGRES_CURSOR_TABLE = "todos_sync_cursors";
@@ -13585,54 +13933,7 @@ function assertSafeIdentifier(value) {
     throw new Error(`Unsafe Postgres identifier: ${value}`);
 }
 
-// src/storage/hybrid.ts
-function createHybridTodosStorageAdapter(options) {
-  const local = options.localAdapter ?? createLocalSqliteTodosStorageAdapter(options.local);
-  const syncStore = options.syncStore ?? (options.postgresClient ? createPostgresTodosSyncStore(options.postgresClient, { sourceMachineId: options.sourceMachineId }) : null);
-  if (!syncStore)
-    throw new Error("hybrid storage requires a Postgres sync store or query client");
-  if (!local.sync.exportSnapshot || !local.sync.importSnapshot) {
-    throw new Error("hybrid storage requires local snapshot export/import support");
-  }
-  const exportSnapshot = async (context) => await local.sync.exportSnapshot(context);
-  const importSnapshot = async (snapshot, context) => await local.sync.importSnapshot(snapshot, context);
-  const remote = {
-    ensureSchema: () => syncStore.ensureSchema(),
-    async pushSnapshot(context) {
-      const snapshot = await exportSnapshot(context);
-      return syncStore.pushSnapshot(snapshot, context);
-    },
-    async pullSnapshot(options2, context) {
-      const snapshot = await syncStore.pullSnapshot(options2);
-      return importSnapshot(snapshot, context);
-    },
-    async syncOnce(options2, context) {
-      const pulled = await remote.pullSnapshot(options2, context);
-      const pushed = await remote.pushSnapshot(context);
-      return { pulled, pushed };
-    }
-  };
-  return {
-    ...local,
-    kind: "hybrid",
-    capabilities: {
-      ...local.capabilities,
-      localPersistence: true,
-      remotePersistence: true,
-      sync: true
-    },
-    sync: {
-      ...local.sync,
-      exportSnapshot,
-      importSnapshot
-    },
-    remote
-  };
-}
-
 // src/storage/postgres-adapter.ts
-init_types();
-import { randomUUID as randomUUID3 } from "crypto";
 init_redaction();
 function createPostgresTodosStorageAdapter(options) {
   const store = new PostgresJsonRecordStore(options);
@@ -13760,6 +14061,9 @@ function createPostgresTodosStorageAdapter(options) {
       exportSnapshot: () => exportSnapshot(store),
       importSnapshot: (snapshot, context) => importSnapshot(snapshot, store, context)
     },
+    integrity: {
+      report: () => store.integrityReport()
+    },
     transaction: (fn) => fn(adapter)
   };
   return adapter;
@@ -13866,8 +14170,9 @@ class PostgresJsonRecordStore {
       conds.push(`payload->>'agent_id' = ${p(filter.agent_id)}`);
     if (filter.session_id !== undefined)
       conds.push(`payload->>'session_id' = ${p(filter.session_id)}`);
-    if (filter.tags?.length)
-      conds.push(`payload->'tags' @> ${p(filter.tags)}::jsonb`);
+    if (filter.tags?.length) {
+      conds.push(`EXISTS (SELECT 1 FROM jsonb_array_elements_text(COALESCE(payload->'tags', '[]'::jsonb)) AS task_tags(tag) ` + `WHERE ${inClause("task_tags.tag", filter.tags)})`);
+    }
     if (filter.has_recurrence !== undefined) {
       conds.push(`(COALESCE(payload->>'recurrence_rule', '') <> '') = ${p(filter.has_recurrence)}`);
     }
@@ -13928,7 +14233,8 @@ class PostgresJsonRecordStore {
             AND object_id COLLATE "C" >= $2 AND object_id COLLATE "C" < $3
           LIMIT 2`, [this.service, raw, upper]);
       if (prefixResult.rows.length > 1) {
-        throw new Error(`Task reference is ambiguous: "${ref}"`);
+        const candidates = prefixResult.rows.map((row) => payloadRecord2(row.payload));
+        throw new TaskReferenceAmbiguousError(ref, candidates.map((task) => ({ task_id: task.id, project_id: task.project_id })));
       }
       if (prefixResult.rows.length === 1) {
         return payloadRecord2(prefixResult.rows[0].payload);
@@ -13939,7 +14245,8 @@ class PostgresJsonRecordStore {
           AND LOWER(payload->>'short_id') = $2
         LIMIT 2`, [this.service, raw]);
     if (shortIdResult.rows.length > 1) {
-      throw new Error(`Task reference is ambiguous: "${ref}"`);
+      const candidates = shortIdResult.rows.map((row) => payloadRecord2(row.payload));
+      throw new TaskReferenceAmbiguousError(ref, candidates.map((task) => ({ task_id: task.id, project_id: task.project_id })));
     }
     if (shortIdResult.rows.length === 1) {
       return payloadRecord2(shortIdResult.rows[0].payload);
@@ -13953,6 +14260,24 @@ class PostgresJsonRecordStore {
     const result = await this.options.client.query(sql, params);
     return Number(result.rows[0]?.count ?? 0);
   }
+  async integrityReport() {
+    await this.ensureSchema();
+    const conditions = [];
+    for (const spec of INTEGRITY_CONDITIONS) {
+      const { sql, params } = buildPostgresIntegritySql(spec, { table: this.tableName, service: this.service });
+      try {
+        const result = await this.options.client.query(sql, params);
+        const row = result.rows[0];
+        conditions.push(measuredCondition(spec, {
+          count: Number(row?.count ?? 0),
+          open_count: spec.entity === "task" ? Number(row?.open_count ?? 0) : null
+        }, "postgres"));
+      } catch (error) {
+        conditions.push(unverifiedCondition(spec, error instanceof Error ? error.message : String(error)));
+      }
+    }
+    return buildIntegrityReport(conditions, new Date().toISOString());
+  }
   async listTombstones() {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
@@ -14428,7 +14753,7 @@ async function startTask2(id, agentId, store) {
   if (task.status !== "pending" && task.status !== "in_progress") {
     throw new Error(`Task is ${task.status} and cannot be started by ${agentId}`);
   }
-  return patchTask(task, {
+  const started = await patchTask(task, {
     status: "in_progress",
     assigned_to: task.assigned_to ?? agentId,
     agent_id: task.agent_id ?? agentId,
@@ -14436,6 +14761,8 @@ async function startTask2(id, agentId, store) {
     locked_at: new Date().toISOString(),
     started_at: task.started_at ?? new Date().toISOString()
   }, store);
+  await logTaskChange2(task.id, "start", "status", task.status, "in_progress", agentId, store);
+  return started;
 }
 async function completeTask2(id, agentId, options, store) {
   const task = await store.completeTask(id, agentId, options);
@@ -14553,9 +14880,11 @@ async function removeDependency2(taskId, dependsOn, store) {
 }
 async function listDependencies(taskId, store) {
   const edges = await store.list("dependencies");
+  const incoming = edges.filter((edge) => edge.depends_on === taskId).map((edge) => ({ task_id: edge.task_id, depends_on: edge.depends_on }));
   return {
     dependencies: edges.filter((edge) => edge.task_id === taskId).map((edge) => ({ task_id: edge.task_id, depends_on: edge.depends_on })),
-    blocked_by: edges.filter((edge) => edge.depends_on === taskId).map((edge) => ({ task_id: edge.task_id, depends_on: edge.depends_on }))
+    blocks: incoming,
+    blocked_by: incoming
   };
 }
 async function addVerification(input, store, context) {
@@ -15542,17 +15871,17 @@ function createTodosCloudQueryClientFromEnv(env = process.env, options = {}) {
 init_config();
 function createTodosStorageAdapter(options = {}) {
   const config = options.config ?? loadTodosStorageConfig(options.env);
-  if (config.mode === "local") {
+  if (config.mode === "sqlite") {
     if (isTodosShadowEnabled(options.env))
       return createShadowAdapter(options, config);
     return createLocalSqliteTodosStorageAdapter(options.local);
   }
   assertTodosRemoteStorageConfig(config);
-  const adapter = config.mode === "hybrid" ? options.hybridAdapter ?? createImplicitHybridAdapter(options) ?? options.remoteAdapter : options.remoteAdapter ?? createImplicitPostgresAdapter(options);
+  const adapter = options.remoteAdapter ?? createImplicitPostgresAdapter(options);
   if (!adapter) {
-    throw new Error(`${config.mode} storage requires a repo-native remote adapter. ` + "Pass remoteAdapter/hybridAdapter after wiring Postgres RDS and S3 support.");
+    throw new Error("postgres storage requires a repo-native Postgres adapter. " + "Pass remoteAdapter or postgresClient after wiring Postgres RDS support.");
   }
-  assertRemoteAdapterCapabilities(adapter, config.mode);
+  assertPostgresAdapterCapabilities(adapter);
   return adapter;
 }
 function createShadowAdapter(options, config) {
@@ -15566,7 +15895,7 @@ function createShadowAdapter(options, config) {
     ...options.local ? { local: options.local } : {},
     ...options.postgresSyncStore ? { syncStore: options.postgresSyncStore } : {},
     ...postgresClient ? { postgresClient } : {},
-    ...options.hybrid?.sourceMachineId ? { sourceMachineId: options.hybrid.sourceMachineId } : {}
+    ...options.sourceMachineId ? { sourceMachineId: options.sourceMachineId } : {}
   });
 }
 function createImplicitPostgresAdapter(options) {
@@ -15574,25 +15903,12 @@ function createImplicitPostgresAdapter(options) {
     return null;
   return createPostgresTodosStorageAdapter({
     client: options.postgresClient,
-    ...options.hybrid?.sourceMachineId ? { sourceMachineId: options.hybrid.sourceMachineId } : {}
-  });
-}
-function createImplicitHybridAdapter(options) {
-  if (!options.postgresClient && !options.postgresSyncStore)
-    return null;
-  return createHybridTodosStorageAdapter({
-    ...options.hybrid ?? {},
-    local: options.local,
-    postgresClient: options.postgresClient,
-    syncStore: options.postgresSyncStore
+    ...options.sourceMachineId ? { sourceMachineId: options.sourceMachineId } : {}
   });
 }
-function assertRemoteAdapterCapabilities(adapter, mode) {
+function assertPostgresAdapterCapabilities(adapter) {
   if (!adapter.capabilities.remotePersistence) {
-    throw new Error(`${mode} storage adapter must set capabilities.remotePersistence=true`);
-  }
-  if (mode === "hybrid" && !adapter.capabilities.localPersistence) {
-    throw new Error("hybrid storage adapter must also set capabilities.localPersistence=true");
+    throw new Error("postgres storage adapter must set capabilities.remotePersistence=true");
   }
 }
 // src/storage/shadow-outbox.ts
@@ -15919,6 +16235,50 @@ async function closeRuntimeShadowCloud() {
     await cloud.close().catch(() => {});
   }
 }
+// src/storage/hybrid.ts
+function createHybridTodosStorageAdapter(options) {
+  const local = options.localAdapter ?? createLocalSqliteTodosStorageAdapter(options.local);
+  const syncStore = options.syncStore ?? (options.postgresClient ? createPostgresTodosSyncStore(options.postgresClient, { sourceMachineId: options.sourceMachineId }) : null);
+  if (!syncStore)
+    throw new Error("hybrid storage requires a Postgres sync store or query client");
+  if (!local.sync.exportSnapshot || !local.sync.importSnapshot) {
+    throw new Error("hybrid storage requires local snapshot export/import support");
+  }
+  const exportSnapshot2 = async (context) => await local.sync.exportSnapshot(context);
+  const importSnapshot2 = async (snapshot, context) => await local.sync.importSnapshot(snapshot, context);
+  const remote = {
+    ensureSchema: () => syncStore.ensureSchema(),
+    async pushSnapshot(context) {
+      const snapshot = await exportSnapshot2(context);
+      return syncStore.pushSnapshot(snapshot, context);
+    },
+    async pullSnapshot(options2, context) {
+      const snapshot = await syncStore.pullSnapshot(options2);
+      return importSnapshot2(snapshot, context);
+    },
+    async syncOnce(options2, context) {
+      const pulled = await remote.pullSnapshot(options2, context);
+      const pushed = await remote.pushSnapshot(context);
+      return { pulled, pushed };
+    }
+  };
+  return {
+    ...local,
+    kind: "hybrid",
+    capabilities: {
+      ...local.capabilities,
+      localPersistence: true,
+      remotePersistence: true,
+      sync: true
+    },
+    sync: {
+      ...local.sync,
+      exportSnapshot: exportSnapshot2,
+      importSnapshot: importSnapshot2
+    },
+    remote
+  };
+}
 // src/storage/comment-redaction-backfill.ts
 init_redaction();
 var COMMENT_REDACTION_BACKFILL_CONFIRMATION = "REDACT_STORED_TODOS_COMMENTS";
@@ -16453,11 +16813,13 @@ export {
   postgresTodosCommentCursorIndexSql,
   planRunArtifactsS3Sync,
   parseStorageMode,
+  parseStorageBackend,
   maybeInstallShadowCapture2 as maybeInstallShadowCapture,
   loadTodosStorageConfig,
   loadStorageConfig,
   isTodosShadowEnabled,
   isTodosRemoteStorageEnabled,
+  isTodosPostgresBackend,
   isCommentRedactionBackfillComplete,
   installShadowOutboxSchema,
   importSqliteTodosStorageSnapshot,
@@ -16466,6 +16828,7 @@ export {
   getTodosStorageEnvName,
   getTodosStorageDatabaseUrl,
   getTodosStorageDatabaseEnv,
+  getTodosStorageBackend,
   getStorageMode,
   getStorageDatabaseUrl,
   getStorageDatabaseEnv,