@hasna/todos 0.15.4 → 0.15.5

package/dist/cli/index.js

@@ -2123,7 +2123,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.4",
+    version: "0.15.5",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -6646,6 +6646,7 @@ var init_stage_a = __esm(() => {
     "count",
     "dashboard",
     "dedupe",
+    "delegate",
     "delete",
     "deps",
     "dispatch",
@@ -6832,6 +6833,7 @@ var init_stage_a = __esm(() => {
     "claim",
     "comment",
     "count",
+    "delegate",
     "delete",
     "deps",
     "doctor",
@@ -16243,6 +16245,18 @@ function updateTask(id, input, db) {
     sets.push("assigned_to = ?");
     params.push(input.assigned_to);
   }
+  if (input.assigned_by !== undefined) {
+    sets.push("assigned_by = ?");
+    params.push(input.assigned_by);
+  }
+  if (input.delegated_from !== undefined) {
+    sets.push("delegated_from = ?");
+    params.push(input.delegated_from);
+  }
+  if (input.delegation_depth !== undefined) {
+    sets.push("delegation_depth = ?");
+    params.push(input.delegation_depth);
+  }
   if (input.working_dir !== undefined) {
     sets.push("working_dir = ?");
     params.push(input.working_dir);
@@ -72729,16 +72743,425 @@ var init_dispatch3 = __esm(() => {
   init_helpers();
 });
 
+// src/lib/delegation-brief.ts
+import { createHash as createHash17 } from "crypto";
+function resolveDelegationBrief(input, sources) {
+  const hasPath = typeof input.briefPath === "string" && input.briefPath.length > 0;
+  const hasText = typeof input.briefText === "string" && input.briefText.length > 0;
+  if (hasPath && hasText) {
+    return {
+      ok: false,
+      reason: "conflict",
+      message: "Pass either --brief <path> or --brief-text <text>, not both. " + "Two briefs means the worker is told two things and the [DISPATCH] record can only name one."
+    };
+  }
+  if (!hasPath && !hasText) {
+    return {
+      ok: false,
+      reason: "missing",
+      message: "A delegation needs a brief: pass --brief <path> (or --brief - to read stdin), or --brief-text <text>. " + "A dispatched worker sees no announcement, no channel and no rule published after it starts, " + "so anything it is not told in the brief it will never learn."
+    };
+  }
+  let text2;
+  let source3;
+  if (hasPath) {
+    const path = input.briefPath;
+    if (path === STDIN_SENTINEL) {
+      try {
+        text2 = sources.readStdin();
+      } catch (error2) {
+        return {
+          ok: false,
+          reason: "unreadable",
+          message: `Could not read the brief from stdin: ${error2 instanceof Error ? error2.message : String(error2)}`
+        };
+      }
+      source3 = "(stdin)";
+    } else {
+      try {
+        text2 = sources.readFile(path);
+      } catch (error2) {
+        return {
+          ok: false,
+          reason: "unreadable",
+          message: `Could not read the brief at ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`
+        };
+      }
+      source3 = path;
+    }
+  } else {
+    text2 = input.briefText;
+    source3 = "(--brief-text)";
+  }
+  if (text2.trim().length === 0) {
+    return {
+      ok: false,
+      reason: "empty",
+      message: `The brief at ${source3} is empty (it contains only whitespace). ` + "An empty brief is worse than no brief, because the dispatch record would claim the worker was briefed."
+    };
+  }
+  return {
+    ok: true,
+    text: text2,
+    source: source3,
+    sha256: createHash17("sha256").update(text2, "utf8").digest("hex"),
+    bytes: Buffer.byteLength(text2, "utf8")
+  };
+}
+var STDIN_SENTINEL = "-";
+var init_delegation_brief = () => {};
+
+// src/lib/delegation-policy.ts
+import { readFileSync as readFileSync20 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join28 } from "path";
+function defaultDelegationEmbargoPath() {
+  return process.env["TODOS_DELEGATION_EMBARGO_PATH"] || join28(homedir4(), ".hasna", "identities", "delegation-embargo.json");
+}
+function loadDelegationEmbargo(path = defaultDelegationEmbargoPath()) {
+  try {
+    const parsed = JSON.parse(readFileSync20(path, "utf8"));
+    const entries = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.embargoed) ? parsed.embargoed : [];
+    const names = new Set;
+    for (const entry2 of entries) {
+      const raw = typeof entry2 === "string" ? entry2 : entry2?.slug;
+      if (typeof raw === "string" && raw.trim())
+        names.add(normalizeAgentNameInput(raw));
+    }
+    return names;
+  } catch {
+    return new Set;
+  }
+}
+function resolveDelegationDepthThreshold(flagValue) {
+  const fromFlag = coerceThreshold(flagValue);
+  if (fromFlag !== null)
+    return { value: fromFlag, source: "flag" };
+  const fromEnv = coerceThreshold(process.env["TODOS_DELEGATION_DEPTH_THRESHOLD"]);
+  if (fromEnv !== null)
+    return { value: fromEnv, source: "env" };
+  return { value: null, source: "unset" };
+}
+function coerceThreshold(value) {
+  if (value === undefined || value === null || value === "")
+    return null;
+  const parsed = typeof value === "number" ? value : Number.parseInt(String(value).trim(), 10);
+  if (!Number.isSafeInteger(parsed) || parsed < 0)
+    return null;
+  return parsed;
+}
+var DEFAULT_CLAIM_WINDOW_MINUTES = 30;
+var init_delegation_policy = () => {};
+
+// src/lib/delegation-record.ts
+function formatDispatchComment(input) {
+  const lines = [];
+  lines.push(`${DISPATCH_COMMENT_MARKER} ${input.worker} <- ${input.dispatcher} @ ${input.dispatchedAt}`);
+  lines.push(`runtime: ${input.runtime ?? "unspecified"}`);
+  lines.push(`brief: ${input.briefSource} (${input.briefBytes} bytes, sha256 ${input.briefSha256})`);
+  lines.push(`lineage: delegated_from=${input.dispatcher} delegation_depth=${input.depth} reports_to=${input.reportsTo}`);
+  lines.push(`identity: ${input.identityOutcome}`);
+  lines.push(`seat ${input.seatSlug}: ${input.seatOpenTasks} open, threshold ${input.depthThreshold === null ? "unset" : input.depthThreshold}${input.override ? `, OVERRIDE ${input.override}` : ""}`);
+  lines.push(`claim deadline: ${input.claimDeadline}`);
+  lines.push("started_at is deliberately NOT set: the worker claims with `todos start`.");
+  return lines.join(`
+`);
+}
+function formatDispatchNotice(input) {
+  const shortId = input.taskId.slice(0, 8);
+  const override = input.override ? ` [${input.override}]` : "";
+  return `${DISPATCH_COMMENT_MARKER} ${shortId} -> ${input.worker} ` + `(by ${input.dispatcher}, depth ${input.depth}, claim by ${input.claimDeadline})${override}`;
+}
+function claimDeadlineFrom(dispatchedAt, windowMinutes) {
+  return new Date(dispatchedAt.getTime() + windowMinutes * 60000).toISOString();
+}
+var DISPATCH_COMMENT_MARKER = "[DISPATCH]";
+
+// src/lib/delegation-verify.ts
+function missingDelegationLineage(persisted, expected) {
+  const missing = [];
+  if (!sameName(persisted.assigned_to, expected.assignedTo))
+    missing.push("assigned_to");
+  if (!sameName(persisted.assigned_by, expected.assignedBy))
+    missing.push("assigned_by");
+  if (!sameName(persisted.delegated_from, expected.delegatedFrom))
+    missing.push("delegated_from");
+  if (persisted.delegation_depth !== expected.depth)
+    missing.push("delegation_depth");
+  return missing;
+}
+function sameName(actual, wanted) {
+  return typeof actual === "string" && actual.trim().toLowerCase() === wanted.trim().toLowerCase();
+}
+function partialDelegationMessage(missing, taskId) {
+  return `The delegation was only PARTIALLY recorded on task ${taskId}: the authority accepted the update but did not ` + `persist ${missing.join(", ")}. ` + "The row may now be assigned without its handover lineage, so it is NOT safe to treat this as delegated. " + "This is an authority-version problem, not a connectivity, credential or storage-mode problem: the /v1 server " + "must be running a build that writes assigned_by, delegated_from and delegation_depth. " + "Re-run this exact command once it is, and the row will be completed in place.";
+}
+
+// src/cli/commands/delegate.ts
+var exports_delegate = {};
+__export(exports_delegate, {
+  registerDelegateCommands: () => registerDelegateCommands
+});
+import chalk12 from "chalk";
+import { readFileSync as readFileSync21 } from "fs";
+function registerDelegateCommands(program2) {
+  program2.command("delegate <task> <worker>").description("Hand a filed task to a worker in one call: brief, depth, lineage, assignment, record and notice").option("--brief <path>", "Path to the self-sufficient brief; `-` reads stdin").option("--brief-text <text>", "Inline brief, as an alternative to --brief").option("--depth-threshold <n>", "Open-task count above which this delegation parks").option("--despite-depth", "Proceed past an armed depth threshold; recorded in the [DISPATCH] comment").option("--owner-directive", "Mark as an owner-directive dispatch: depth warns and never parks").option("--seat <slug>", "Seat whose open count is read (default: the lineage parent)").option("--runtime <name>", "Worker runtime label recorded in the comment (e.g. claude-code-subagent)").option("--reports-to <agent>", "Lineage parent for the worker identity (default: the dispatcher)").option("--reuse-identity", "Skip registration and reuse an existing worker identity").option("--depth <n>", "Explicit delegation_depth (default: the task's current depth + 1)").option("--channel <name>", "Channel for the one-line notice (default: $TODOS_DELEGATE_NOTICE_CHANNEL)").option("--no-post", "Skip the channel notice").option("--claim-window <minutes>", `Minutes before the claim deadline (default: ${DEFAULT_CLAIM_WINDOW_MINUTES})`).option("--assign-seat", "Allow <worker> to name a durable seat (a seat queue has no session watching it)").option("--dry-run", "Report all seven effects and perform none").option("-j, --json", "Output as JSON").action(async (taskRef, workerInput, opts) => {
+    const globalOpts = program2.opts();
+    const useJson = Boolean(opts.json || globalOpts.json);
+    try {
+      const brief = resolveDelegationBrief({ briefPath: opts.brief, briefText: opts.briefText }, {
+        readFile: (path) => readFileSync21(path, "utf8"),
+        readStdin: () => readFileSync21(0, "utf8")
+      });
+      if (!brief.ok)
+        handleError(new Error(brief.message));
+      const dispatcherIdentity = resolveWritableIdentity(globalOpts.agent);
+      if (!dispatcherIdentity.agent_id) {
+        handleError(new Error("Cannot delegate without a dispatcher identity: this verb records WHO handed the row over, " + "and a handover from nobody is not a handover. " + "Set TODOS_AGENT_ID=<name> for this session, or pass --agent <name>. " + "An identity persisted by `todos init` is deliberately not used \u2014 it is keyed on $HOME and names the station, not this session."));
+      }
+      const dispatcher = dispatcherIdentity.agent_id;
+      const worker = await resolveValidatedAssignee(workerInput, Boolean(opts.assignSeat), (v) => `${taskRef} ${v} --assign-seat`);
+      const embargo = loadDelegationEmbargo();
+      const embargoedForm = [workerInput, worker].find((candidate) => embargo.has(normalizeAgentNameInput(candidate)));
+      if (embargoedForm !== undefined) {
+        handleError(new Error(`'${embargoedForm}' is under a delegation embargo and must not receive dispatched work. ` + "The embargo list is a file, not a constant \u2014 see TODOS_DELEGATION_EMBARGO_PATH."));
+      }
+      try {
+        validateAgentName(worker);
+      } catch (error2) {
+        handleError(new Error(`Cannot delegate to '${worker}': ${error2 instanceof Error ? error2.message : String(error2)} ` + "Nothing was written \u2014 the task is unchanged and still unassigned."));
+      }
+      const reportsTo = (opts.reportsTo ?? dispatcher).trim();
+      const seatSlug = (opts.seat ?? reportsTo).trim();
+      const cloud = getTodosCloudClient();
+      const taskId = await resolveTaskIdForCommand(taskRef, cloud);
+      const db = cloud ? null : getDatabase();
+      const task2 = cloud ? await cloudGetTask(cloud, taskId) : getTask(taskId, db);
+      if (!task2)
+        handleError(new Error(`Task not found: ${taskRef}`));
+      const threshold = resolveDelegationDepthThreshold(opts.depthThreshold);
+      const seatOpenTasks = cloud ? await cloudCountTasks(cloud, { assigned_to: seatSlug, status: "pending" }) : countTasks({ assigned_to: seatSlug, status: "pending" }, db);
+      const override = opts.ownerDirective ? "owner-directive" : opts.despiteDepth ? "despite-depth" : null;
+      const overThreshold = threshold.value !== null && seatOpenTasks > threshold.value;
+      const parked = overThreshold && override === null;
+      if (overThreshold && override === "owner-directive") {
+        console.error(chalk12.yellow(`Warning: seat ${seatSlug} carries ${seatOpenTasks} open tasks (threshold ${threshold.value}); ` + "proceeding because this is an owner-directive dispatch."));
+      }
+      if (parked) {
+        handleError(new Error(`Seat ${seatSlug} carries ${seatOpenTasks} open tasks, above the armed threshold of ${threshold.value} ` + `(from ${threshold.source}). Re-run with --despite-depth to proceed and have the override recorded, ` + "or --owner-directive if this row is an owner directive."));
+      }
+      const currentDepth = typeof task2.delegation_depth === "number" ? task2.delegation_depth : 0;
+      const depth = opts.depth !== undefined ? Number.parseInt(opts.depth, 10) : currentDepth + 1;
+      if (!Number.isSafeInteger(depth) || depth < 0) {
+        handleError(new Error(`--depth must be a non-negative integer; got ${JSON.stringify(opts.depth)}`));
+      }
+      const dispatchedAtDate = new Date;
+      const dispatchedAt = dispatchedAtDate.toISOString();
+      const claimWindowMinutes = opts.claimWindow !== undefined ? Number.parseInt(opts.claimWindow, 10) : DEFAULT_CLAIM_WINDOW_MINUTES;
+      if (!Number.isSafeInteger(claimWindowMinutes) || claimWindowMinutes <= 0) {
+        handleError(new Error(`--claim-window must be a positive integer; got ${JSON.stringify(opts.claimWindow)}`));
+      }
+      const claimDeadline = claimDeadlineFrom(dispatchedAtDate, claimWindowMinutes);
+      const record = {
+        taskId: task2.id,
+        worker,
+        dispatcher,
+        runtime: opts.runtime ?? null,
+        briefSource: brief.source,
+        briefSha256: brief.sha256,
+        briefBytes: brief.bytes,
+        depth,
+        reportsTo,
+        seatSlug,
+        seatOpenTasks,
+        depthThreshold: threshold.value,
+        override,
+        identityOutcome: opts.reuseIdentity ? "skipped" : "created",
+        dispatchedAt,
+        claimDeadline
+      };
+      if (opts.dryRun) {
+        const previewChannel = opts.channel ?? process.env["TODOS_DELEGATE_NOTICE_CHANNEL"] ?? null;
+        const preview = {
+          dry_run: true,
+          task: { id: task2.id, short_id: task2.short_id, title: task2.title },
+          delegation: summarize4(record, {
+            identityOutcome: opts.reuseIdentity ? "skipped" : "created",
+            commentId: null,
+            notice: { posted: false, channel: previewChannel, error: null }
+          }),
+          would: [
+            "1. brief accepted (already validated)",
+            `2. seat ${seatSlug}: ${seatOpenTasks} open, threshold ${threshold.value ?? "unset"}`,
+            opts.reuseIdentity ? `3. registration SKIPPED (--reuse-identity); reusing ${worker}` : `3. register ${worker} with reports_to=${reportsTo}`,
+            `4. assign to ${worker}; assigned_by=${dispatcher}, delegated_from=${dispatcher}, delegation_depth=${depth}`,
+            "5. append the [DISPATCH] comment",
+            opts.post === false ? "6. channel notice SKIPPED (--no-post)" : `6. post one notice to ${previewChannel ?? "(no channel resolved \u2014 set --channel or TODOS_DELEGATE_NOTICE_CHANNEL)"}`,
+            `7. claim deadline ${claimDeadline}`
+          ]
+        };
+        if (useJson) {
+          output(preview, true);
+          return;
+        }
+        console.log(chalk12.dim("[dry-run] no writes performed"));
+        for (const line of preview.would)
+          console.log(`  ${line}`);
+        return;
+      }
+      let identityOutcome = "skipped";
+      if (!opts.reuseIdentity) {
+        identityOutcome = await registerWorkerIdentity(worker, reportsTo, cloud, db);
+      }
+      record.identityOutcome = identityOutcome;
+      const mergedMetadata = {
+        ...task2.metadata && typeof task2.metadata === "object" ? task2.metadata : {},
+        delegation: {
+          worker,
+          dispatcher,
+          runtime: opts.runtime ?? null,
+          brief_source: brief.source,
+          brief_sha256: brief.sha256,
+          dispatched_at: dispatchedAt,
+          claim_deadline: claimDeadline,
+          claim_window_minutes: claimWindowMinutes,
+          depth,
+          override
+        }
+      };
+      const patch = {
+        assigned_to: worker,
+        assigned_by: dispatcher,
+        delegated_from: dispatcher,
+        delegation_depth: depth,
+        metadata: mergedMetadata
+      };
+      const updated = cloud ? await cloudUpdateTask(cloud, task2.id, patch) : updateTask(task2.id, { ...patch, version: task2.version }, db);
+      const missing = missingDelegationLineage(updated, {
+        assignedTo: worker,
+        assignedBy: dispatcher,
+        delegatedFrom: dispatcher,
+        depth
+      });
+      if (missing.length > 0) {
+        handleError(new Error(partialDelegationMessage(missing, task2.id)));
+      }
+      const commentBody = formatDispatchComment(record);
+      const comment = cloud ? await cloudAddComment(cloud, task2.id, { content: commentBody, agent_id: dispatcher }) : addComment({ task_id: task2.id, agent_id: dispatcher, content: commentBody }, db);
+      const notice = opts.post === false ? { posted: false, channel: opts.channel ?? null, error: null } : postNotice(formatDispatchNotice(record), opts.channel ?? null);
+      const payload = {
+        task: updated,
+        delegation: summarize4(record, {
+          identityOutcome,
+          commentId: comment.id,
+          notice
+        })
+      };
+      if (useJson) {
+        output(payload, true);
+        return;
+      }
+      console.log(chalk12.green(`Delegated ${updated.short_id ?? updated.id.slice(0, 8)} to ${worker}`));
+      console.log(chalk12.dim(`  by ${dispatcher}, depth ${depth}, seat ${seatSlug} has ${seatOpenTasks} open`));
+      console.log(chalk12.dim(`  brief ${brief.source} (sha256 ${brief.sha256.slice(0, 12)}\u2026)`));
+      console.log(chalk12.dim(`  claim by ${claimDeadline}; the worker claims with \`todos start\``));
+      if (!notice.posted && opts.post !== false) {
+        console.error(chalk12.yellow(`Warning: the channel notice was not posted: ${notice.error ?? "unknown reason"}`));
+      }
+    } catch (e) {
+      handleError(e);
+    }
+  });
+}
+function summarize4(record, extra) {
+  return {
+    worker: record.worker,
+    dispatcher: record.dispatcher,
+    runtime: record.runtime,
+    depth: record.depth,
+    reports_to: record.reportsTo,
+    brief: { source: record.briefSource, sha256: record.briefSha256, bytes: record.briefBytes },
+    seat: {
+      slug: record.seatSlug,
+      open_tasks: record.seatOpenTasks,
+      threshold: record.depthThreshold,
+      parked: false,
+      override: record.override
+    },
+    identity: { name: record.worker, reports_to: record.reportsTo, outcome: extra.identityOutcome },
+    comment_id: extra.commentId,
+    dispatched_at: record.dispatchedAt,
+    claim_deadline: record.claimDeadline,
+    notice: extra.notice,
+    started_at_written: false
+  };
+}
+async function registerWorkerIdentity(worker, reportsTo, cloud, db) {
+  if (cloud) {
+    const existing = (await cloudListAgents(cloud)).find((a) => normalizeAgentNameInput(a.name) === normalizeAgentNameInput(worker));
+    if (existing)
+      return "reused";
+    try {
+      await cloudRegisterAgent(cloud, { name: worker, reports_to: reportsTo });
+      return "created";
+    } catch (error2) {
+      const status = error2 && typeof error2 === "object" ? error2.status : undefined;
+      if (status === 409)
+        return "reused";
+      throw error2;
+    }
+  }
+  if (getAgentByName(worker, db))
+    return "reused";
+  const result = registerAgent({ name: worker, reports_to: reportsTo }, db);
+  return isAgentConflict(result) ? "reused" : "created";
+}
+function postNotice(line, channel) {
+  const resolved = channel || process.env["TODOS_DELEGATE_NOTICE_CHANNEL"] || null;
+  if (!resolved) {
+    return {
+      posted: false,
+      channel: null,
+      error: "no channel resolved: pass --channel <name>, set TODOS_DELEGATE_NOTICE_CHANNEL, " + "or pass --no-post to skip the notice deliberately"
+    };
+  }
+  channel = resolved;
+  const bin = process.env["TODOS_DELEGATE_NOTIFY_BIN"] || "conversations";
+  try {
+    const proc = Bun.spawnSync([bin, "send", "--channel", channel, line], { stdout: "pipe", stderr: "pipe" });
+    if (proc.exitCode !== 0) {
+      const stderr = new TextDecoder().decode(proc.stderr).trim();
+      return { posted: false, channel, error: stderr || `${bin} exited ${proc.exitCode}` };
+    }
+    return { posted: true, channel, error: null };
+  } catch (error2) {
+    return { posted: false, channel, error: error2 instanceof Error ? error2.message : String(error2) };
+  }
+}
+var init_delegate = __esm(() => {
+  init_cloud_router();
+  init_database();
+  init_tasks();
+  init_comments();
+  init_agents();
+  init_agent_names();
+  init_creator_identity();
+  init_delegation_brief();
+  init_delegation_policy();
+  init_assignee_guard();
+  init_helpers();
+});
+
 // src/cli/commands/machines.tsx
 var exports_machines = {};
 __export(exports_machines, {
   registerMachineCommands: () => registerMachineCommands
 });
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync20, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "fs";
+import { readFileSync as readFileSync22, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 function getOrCreateLocalMachineName() {
   return process.env["TODOS_MACHINE_NAME"] || __require("os").hostname() || "unknown";
 }
@@ -72776,11 +73199,11 @@ function remoteTempPath(sshAddress) {
 }
 function readRemoteBridgeBundle(sshAddress) {
   const remotePath = remoteTempPath(sshAddress);
-  const localPath = join28(tmpdir5(), `todos-bridge-pull-${uuid()}.json`);
+  const localPath = join29(tmpdir5(), `todos-bridge-pull-${uuid()}.json`);
   try {
     runSsh(sshAddress, `todos export --format bridge --allow-plaintext-sensitive --output ${shellQuote(remotePath)}`, 120000);
     scpFromRemote(sshAddress, remotePath, localPath);
-    return JSON.parse(readFileSync20(localPath, "utf-8"));
+    return JSON.parse(readFileSync22(localPath, "utf-8"));
   } finally {
     try {
       runSsh(sshAddress, `rm -f ${shellQuote(remotePath)}`, 1e4);
@@ -72791,7 +73214,7 @@ function readRemoteBridgeBundle(sshAddress) {
   }
 }
 function writeLocalBridgeBundle() {
-  const localPath = join28(tmpdir5(), `todos-bridge-push-${uuid()}.json`);
+  const localPath = join29(tmpdir5(), `todos-bridge-push-${uuid()}.json`);
   writeFileSync14(localPath, JSON.stringify(createLocalBridgeBundle(), null, 2));
   return localPath;
 }
@@ -72828,17 +73251,17 @@ function registerMachineCommands(program2) {
     const db = getDatabase();
     const machines = listMachines(db, opts.all);
     if (machines.length === 0) {
-      console.log(chalk12.yellow("No machines registered."));
-      console.log(chalk12.dim("Use `todos machines register` to add one."));
+      console.log(chalk13.yellow("No machines registered."));
+      console.log(chalk13.dim("Use `todos machines register` to add one."));
       return;
     }
     for (const m of machines) {
-      const primaryTag = m.is_primary ? chalk12.bold(" [PRIMARY]") : "";
-      const archivedTag = m.archived_at ? chalk12.dim(" [ARCHIVED]") : "";
-      console.log(`${chalk12.cyan(m.name)} (${m.id.slice(0, 8)})${primaryTag}${archivedTag}`);
-      console.log(chalk12.dim(`  Host: ${m.hostname ?? "unknown"} | Platform: ${m.platform ?? "unknown"}`));
-      console.log(chalk12.dim(`  SSH: ${m.ssh_address ?? "(not set)"}`));
-      console.log(chalk12.dim(`  Last seen: ${m.last_seen_at}`));
+      const primaryTag = m.is_primary ? chalk13.bold(" [PRIMARY]") : "";
+      const archivedTag = m.archived_at ? chalk13.dim(" [ARCHIVED]") : "";
+      console.log(`${chalk13.cyan(m.name)} (${m.id.slice(0, 8)})${primaryTag}${archivedTag}`);
+      console.log(chalk13.dim(`  Host: ${m.hostname ?? "unknown"} | Platform: ${m.platform ?? "unknown"}`));
+      console.log(chalk13.dim(`  SSH: ${m.ssh_address ?? "(not set)"}`));
+      console.log(chalk13.dim(`  Last seen: ${m.last_seen_at}`));
     }
   });
   machinesCmd.command("register").description("Register a machine").argument("<name>", "Machine name").option("--hostname <host>", "OS hostname").option("--platform <platform>", "OS platform").option("--ssh <address>", "SSH address (e.g. user@host)").option("--arch <arch>", "Architecture (e.g. linux-arm64)").option("--tailscale-name <name>", "User-provided Tailscale/MagicDNS name").option("--tailscale-ip <ip>", "User-provided Tailscale IP").option("--lan-address <address>", "User-provided LAN address").option("--workspace <path>", "Local workspace path for this machine").option("--git-root <path>", "Local git root for this machine").option("--primary", "Set as primary machine").option("-j, --json", "Output as JSON").action((name, opts) => {
@@ -72860,17 +73283,17 @@ function registerMachineCommands(program2) {
         console.log(JSON.stringify(machine));
         return;
       }
-      console.log(chalk12.green(`Machine registered: ${machine.name} (${machine.id.slice(0, 8)})`));
-      console.log(chalk12.dim(`  Host: ${machine.hostname} | Platform: ${machine.platform}`));
-      console.log(chalk12.dim(`  Primary: ${machine.is_primary}`));
+      console.log(chalk13.green(`Machine registered: ${machine.name} (${machine.id.slice(0, 8)})`));
+      console.log(chalk13.dim(`  Host: ${machine.hostname} | Platform: ${machine.platform}`));
+      console.log(chalk13.dim(`  Primary: ${machine.is_primary}`));
       if (machine.ssh_address)
-        console.log(chalk12.dim(`  SSH: ${machine.ssh_address}`));
+        console.log(chalk13.dim(`  SSH: ${machine.ssh_address}`));
       if (machine.metadata["tailscale_name"])
-        console.log(chalk12.dim(`  Tailscale: ${machine.metadata["tailscale_name"]}`));
+        console.log(chalk13.dim(`  Tailscale: ${machine.metadata["tailscale_name"]}`));
       if (machine.metadata["lan_address"])
-        console.log(chalk12.dim(`  LAN: ${machine.metadata["lan_address"]}`));
+        console.log(chalk13.dim(`  LAN: ${machine.metadata["lan_address"]}`));
     } catch (err) {
-      console.error(chalk12.red(err instanceof Error ? err.message : String(err)));
+      console.error(chalk13.red(err instanceof Error ? err.message : String(err)));
       process.exit(1);
     }
   });
@@ -72892,10 +73315,10 @@ function registerMachineCommands(program2) {
         console.log(JSON.stringify(machine));
         return;
       }
-      console.log(chalk12.green(`Heartbeat recorded: ${machine.name} (${machine.id.slice(0, 8)})`));
-      console.log(chalk12.dim(`  Last seen: ${machine.last_seen_at}`));
+      console.log(chalk13.green(`Heartbeat recorded: ${machine.name} (${machine.id.slice(0, 8)})`));
+      console.log(chalk13.dim(`  Last seen: ${machine.last_seen_at}`));
     } catch (err) {
-      console.error(chalk12.red(err instanceof Error ? err.message : String(err)));
+      console.error(chalk13.red(err instanceof Error ? err.message : String(err)));
       process.exit(1);
     }
   });
@@ -72903,9 +73326,9 @@ function registerMachineCommands(program2) {
     try {
       const db = getDatabase();
       const machine = setPrimaryMachine(name, db);
-      console.log(chalk12.green(`Primary machine set to: ${machine.name} (${machine.id.slice(0, 8)})`));
+      console.log(chalk13.green(`Primary machine set to: ${machine.name} (${machine.id.slice(0, 8)})`));
     } catch (err) {
-      console.error(chalk12.red(err instanceof Error ? err.message : String(err)));
+      console.error(chalk13.red(err instanceof Error ? err.message : String(err)));
       process.exit(1);
     }
   });
@@ -72914,13 +73337,13 @@ function registerMachineCommands(program2) {
       const db = getDatabase();
       const machine = getMachineByName(name, db);
       if (!machine) {
-        console.error(chalk12.red(`Machine '${name}' not found`));
+        console.error(chalk13.red(`Machine '${name}' not found`));
         process.exit(1);
       }
       archiveMachine(machine.id, db);
-      console.log(chalk12.green(`Machine '${name}' archived`));
+      console.log(chalk13.green(`Machine '${name}' archived`));
     } catch (err) {
-      console.error(chalk12.red(err instanceof Error ? err.message : String(err)));
+      console.error(chalk13.red(err instanceof Error ? err.message : String(err)));
       process.exit(1);
     }
   });
@@ -72929,13 +73352,13 @@ function registerMachineCommands(program2) {
       const db = getDatabase();
       const machine = getMachineByName(name, db);
       if (!machine) {
-        console.error(chalk12.red(`Machine '${name}' not found`));
+        console.error(chalk13.red(`Machine '${name}' not found`));
         process.exit(1);
       }
       unarchiveMachine(machine.id, db);
-      console.log(chalk12.green(`Machine '${name}' unarchived`));
+      console.log(chalk13.green(`Machine '${name}' unarchived`));
     } catch (err) {
-      console.error(chalk12.red(err instanceof Error ? err.message : String(err)));
+      console.error(chalk13.red(err instanceof Error ? err.message : String(err)));
       process.exit(1);
     }
   });
@@ -72944,13 +73367,13 @@ function registerMachineCommands(program2) {
       const db = getDatabase();
       const machine = getMachineByName(name, db);
       if (!machine) {
-        console.error(chalk12.red(`Machine '${name}' not found`));
+        console.error(chalk13.red(`Machine '${name}' not found`));
         process.exit(1);
       }
       deleteMachine(machine.id, db);
-      console.log(chalk12.green(`Machine '${name}' deleted`));
+      console.log(chalk13.green(`Machine '${name}' deleted`));
     } catch (err) {
-      console.error(chalk12.red(err instanceof Error ? err.message : String(err)));
+      console.error(chalk13.red(err instanceof Error ? err.message : String(err)));
       process.exit(1);
     }
   });
@@ -72959,39 +73382,39 @@ function registerMachineCommands(program2) {
     const machines = listMachines(db);
     const primary = getPrimaryMachine(db);
     if (machines.length === 0) {
-      console.log(chalk12.yellow("No machines registered."));
+      console.log(chalk13.yellow("No machines registered."));
       return;
     }
-    console.log(chalk12.bold(`
+    console.log(chalk13.bold(`
 Machine Health`));
-    console.log(chalk12.dim("\u2500".repeat(60)));
+    console.log(chalk13.dim("\u2500".repeat(60)));
     for (const m of machines) {
-      const primaryTag = m.is_primary ? chalk12.bold(" [PRIMARY]") : "";
+      const primaryTag = m.is_primary ? chalk13.bold(" [PRIMARY]") : "";
       const lastSeen = new Date(m.last_seen_at);
       const nowDate = new Date;
       const diffMs = nowDate.getTime() - lastSeen.getTime();
       const diffMin = Math.round(diffMs / 60000);
       let status;
       if (diffMin < 5) {
-        status = chalk12.green("online");
+        status = chalk13.green("online");
       } else if (diffMin < 60) {
-        status = chalk12.yellow("stale");
+        status = chalk13.yellow("stale");
       } else {
-        status = chalk12.red("offline");
+        status = chalk13.red("offline");
       }
-      console.log(`${chalk12.cyan(m.name)}${primaryTag}  ${status}  last: ${diffMin}m ago`);
+      console.log(`${chalk13.cyan(m.name)}${primaryTag}  ${status}  last: ${diffMin}m ago`);
     }
     if (!primary) {
-      console.log(chalk12.yellow(`
+      console.log(chalk13.yellow(`
 Warning: No primary machine set.`));
-      console.log(chalk12.dim("Use `todos machines set-primary <name>` to set one."));
+      console.log(chalk13.dim("Use `todos machines set-primary <name>` to set one."));
     }
   });
   machinesCmd.command("topology").description("Show local machine topology diagnostics").option("--stale-minutes <n>", "Minutes before a machine is considered stale", "30").option("--include-archived", "Include archived machines").option("-j, --json", "Output as JSON").action((opts) => {
     try {
       const staleMinutes = Number.parseInt(opts.staleMinutes, 10);
       if (!Number.isFinite(staleMinutes) || staleMinutes < 1) {
-        console.error(chalk12.red("Invalid --stale-minutes value. Must be a positive integer."));
+        console.error(chalk13.red("Invalid --stale-minutes value. Must be a positive integer."));
         process.exit(1);
       }
       const diagnostics = getMachineTopologyDiagnostics({
@@ -73002,26 +73425,26 @@ Warning: No primary machine set.`));
         console.log(JSON.stringify(diagnostics));
         return;
       }
-      console.log(chalk12.bold(`
+      console.log(chalk13.bold(`
 Machine Topology`));
-      console.log(chalk12.dim("\u2500".repeat(60)));
+      console.log(chalk13.dim("\u2500".repeat(60)));
       for (const machine of diagnostics.machines) {
-        const stale = machine.stale ? chalk12.red(` stale ${machine.stale_minutes}m`) : chalk12.green(" fresh");
+        const stale = machine.stale ? chalk13.red(` stale ${machine.stale_minutes}m`) : chalk13.green(" fresh");
         const ts = machine.topology.tailscale_ip ? ` ts:${machine.topology.tailscale_ip}` : "";
         const lan = machine.topology.lan_address ? ` lan:${machine.topology.lan_address}` : "";
         const workspace = machine.topology.workspace_path ? `
   workspace: ${machine.topology.workspace_path}` : "";
-        console.log(`${chalk12.cyan(machine.name)}${stale}${chalk12.dim(ts + lan)}${chalk12.dim(workspace)}`);
+        console.log(`${chalk13.cyan(machine.name)}${stale}${chalk13.dim(ts + lan)}${chalk13.dim(workspace)}`);
       }
       if (diagnostics.path_issues.length > 0) {
-        console.log(chalk12.yellow(`
+        console.log(chalk13.yellow(`
 Path diagnostics (${diagnostics.path_issues.length})`));
         for (const issue of diagnostics.path_issues) {
-          console.log(chalk12.yellow(`  ${issue.type}: ${issue.message}`));
+          console.log(chalk13.yellow(`  ${issue.type}: ${issue.message}`));
         }
       }
     } catch (err) {
-      console.error(chalk12.red(err instanceof Error ? err.message : String(err)));
+      console.error(chalk13.red(err instanceof Error ? err.message : String(err)));
       process.exit(1);
     }
   });
@@ -73049,7 +73472,7 @@ Path diagnostics (${diagnostics.path_issues.length})`));
         }, null, 2));
         return;
       }
-      console.log(chalk12.dim(opts.machine ? `No remote SSH target found for machine '${opts.machine}'.` : "No remote machines with SSH addresses to sync."));
+      console.log(chalk13.dim(opts.machine ? `No remote SSH target found for machine '${opts.machine}'.` : "No remote machines with SSH addresses to sync."));
       return;
     }
     const results = [];
@@ -73064,14 +73487,14 @@ Path diagnostics (${diagnostics.path_issues.length})`));
         const record = { machine: target.name, pull };
         if (!wantsJson(program2, opts)) {
           const mode = opts.dryRun ? "would pull" : "pulled";
-          console.log(chalk12.green(`  ${target.name}: ${mode} ${formatBridgeImportSummary(pull)}`));
+          console.log(chalk13.green(`  ${target.name}: ${mode} ${formatBridgeImportSummary(pull)}`));
         }
         if (opts.push) {
           const push = pushLocalBridgeBundle(ssh, Boolean(opts.dryRun));
           record.push = push;
           if (!wantsJson(program2, opts)) {
             const mode = opts.dryRun ? "would push" : "pushed";
-            console.log(chalk12.green(`  ${target.name}: ${mode} ${formatBridgeImportSummary(push)}`));
+            console.log(chalk13.green(`  ${target.name}: ${mode} ${formatBridgeImportSummary(push)}`));
           }
         }
         results.push(record);
@@ -73079,7 +73502,7 @@ Path diagnostics (${diagnostics.path_issues.length})`));
         const message = error2 instanceof Error ? error2.message : String(error2);
         results.push({ machine: target.name, error: message });
         if (!wantsJson(program2, opts))
-          console.log(chalk12.yellow(`  ${target.name}: sync failed: ${message}`));
+          console.log(chalk13.yellow(`  ${target.name}: sync failed: ${message}`));
       }
     }
     if (wantsJson(program2, opts)) {
@@ -73090,19 +73513,19 @@ Path diagnostics (${diagnostics.path_issues.length})`));
       }, null, 2));
       return;
     }
-    console.log(chalk12.bold(`
+    console.log(chalk13.bold(`
 Sync ${opts.dryRun ? "dry-run" : "complete"}: ${results.length} machine(s) checked.`));
   });
   machinesCmd.command("tasks").description("List tasks from a remote machine via SSH").argument("<machine-name>", "Machine name (must have SSH address)").option("--status <status>", "Filter by status").action((machineName, opts) => {
     const db = getDatabase();
     const machine = getMachineByName(machineName, db);
     if (!machine) {
-      console.error(chalk12.red(`Machine '${machineName}' not found`));
+      console.error(chalk13.red(`Machine '${machineName}' not found`));
       process.exit(1);
     }
     const sshAddress = resolveMachineSshAddress(machine, getOrCreateLocalMachineName());
     if (!sshAddress) {
-      console.error(chalk12.red(`Machine '${machineName}' has no SSH address`));
+      console.error(chalk13.red(`Machine '${machineName}' has no SSH address`));
       process.exit(1);
     }
     try {
@@ -73110,19 +73533,19 @@ Sync ${opts.dryRun ? "dry-run" : "complete"}: ${results.length} machine(s) check
       const tasks = bundle.data.tasks;
       const filtered = opts.status ? tasks.filter((t) => t.status === opts.status) : tasks;
       if (filtered.length === 0) {
-        console.log(chalk12.dim(`No tasks on ${machineName}`));
+        console.log(chalk13.dim(`No tasks on ${machineName}`));
         return;
       }
-      console.log(chalk12.bold(`${filtered.length} task(s) on ${machineName}:
+      console.log(chalk13.bold(`${filtered.length} task(s) on ${machineName}:
 `));
       for (const t of filtered) {
         const check = t.status === "completed" ? "x" : " ";
-        const prio = t.priority ? chalk12.yellow(`[${t.priority}]`) : "";
+        const prio = t.priority ? chalk13.yellow(`[${t.priority}]`) : "";
         console.log(`  [${check}] ${t.short_id || t.id.slice(0, 8)} ${prio} ${t.title}`);
       }
     } catch (error2) {
       const message = error2 instanceof Error ? error2.message : String(error2);
-      console.error(chalk12.red(`Could not read tasks from ${sshAddress}: ${message}`));
+      console.error(chalk13.red(`Could not read tasks from ${sshAddress}: ${message}`));
       process.exit(1);
     }
   });
@@ -73138,7 +73561,7 @@ var exports_api_key_commands = {};
 __export(exports_api_key_commands, {
   registerApiKeyCommands: () => registerApiKeyCommands
 });
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 function registerApiKeyCommands(program2) {
   const apiKeys = program2.command("api-keys").alias("api-key").description("Generate, list, and revoke API keys for secured app/API access");
   apiKeys.command("create <name>").alias("generate").description("Generate a new API key. The plaintext key is shown once.").option("--expires-at <iso>", "Optional ISO timestamp when this key expires").option("--permissions <list>", "Comma-separated permissions (default: *)").action((name, opts) => {
@@ -73150,12 +73573,12 @@ function registerApiKeyCommands(program2) {
         output(created, true);
         return;
       }
-      console.log(chalk13.green("API key generated:"));
-      console.log(`  ${chalk13.dim("ID:")}     ${created.record.id}`);
-      console.log(`  ${chalk13.dim("Name:")}   ${created.record.name}`);
-      console.log(`  ${chalk13.dim("Prefix:")} ${created.record.prefix}`);
+      console.log(chalk14.green("API key generated:"));
+      console.log(`  ${chalk14.dim("ID:")}     ${created.record.id}`);
+      console.log(`  ${chalk14.dim("Name:")}   ${created.record.name}`);
+      console.log(`  ${chalk14.dim("Prefix:")} ${created.record.prefix}`);
       console.log();
-      console.log(chalk13.yellow("Copy this key now. It will not be shown again:"));
+      console.log(chalk14.yellow("Copy this key now. It will not be shown again:"));
       console.log(created.key);
     } catch (e) {
       handleError(e);
@@ -73170,16 +73593,16 @@ function registerApiKeyCommands(program2) {
         return;
       }
       if (keys.length === 0) {
-        console.log(chalk13.dim("No API keys found."));
+        console.log(chalk14.dim("No API keys found."));
         return;
       }
       for (const key of keys) {
-        const state = key.revoked_at ? chalk13.red("revoked") : key.expires_at && key.expires_at < new Date().toISOString() ? chalk13.yellow("expired") : chalk13.green("active");
-        console.log(`${chalk13.cyan(key.id)} ${chalk13.bold(key.name)} ${chalk13.dim(key.prefix)} ${state}`);
+        const state = key.revoked_at ? chalk14.red("revoked") : key.expires_at && key.expires_at < new Date().toISOString() ? chalk14.yellow("expired") : chalk14.green("active");
+        console.log(`${chalk14.cyan(key.id)} ${chalk14.bold(key.name)} ${chalk14.dim(key.prefix)} ${state}`);
         if (key.last_used_at)
-          console.log(chalk13.dim(`  last used: ${key.last_used_at}`));
+          console.log(chalk14.dim(`  last used: ${key.last_used_at}`));
         if (key.expires_at)
-          console.log(chalk13.dim(`  expires:   ${key.expires_at}`));
+          console.log(chalk14.dim(`  expires:   ${key.expires_at}`));
       }
     } catch (e) {
       handleError(e);
@@ -73196,7 +73619,7 @@ function registerApiKeyCommands(program2) {
         output(revoked, true);
         return;
       }
-      console.log(chalk13.green(`Revoked API key: ${revoked.name} (${revoked.prefix})`));
+      console.log(chalk14.green(`Revoked API key: ${revoked.name} (${revoked.prefix})`));
     } catch (e) {
       handleError(e);
     }
@@ -73212,7 +73635,7 @@ function registerApiKeyCommands(program2) {
       if (!record) {
         handleError(new Error("API key is invalid, revoked, or expired."));
       }
-      console.log(chalk13.green(`API key valid: ${record.name} (${record.prefix})`));
+      console.log(chalk14.green(`API key valid: ${record.name} (${record.prefix})`));
     } catch (e) {
       handleError(e);
     }
@@ -73228,7 +73651,7 @@ var exports_environment_snapshots2 = {};
 __export(exports_environment_snapshots2, {
   registerEnvironmentSnapshotCommands: () => registerEnvironmentSnapshotCommands
 });
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 function printJson2(value) {
   console.log(JSON.stringify(value, null, 2));
 }
@@ -73250,7 +73673,7 @@ function registerEnvironmentSnapshotCommands(program2) {
         printJson2(result);
         return;
       }
-      console.log(chalk14.green("Captured") + ` ${result.snapshot.id}`);
+      console.log(chalk15.green("Captured") + ` ${result.snapshot.id}`);
       console.log(`path: ${result.output_path}`);
       console.log(`root: ${result.snapshot.root}`);
       console.log(`git: ${result.snapshot.git.commit || "none"}${result.snapshot.git.is_dirty ? " dirty" : ""}`);
@@ -73260,13 +73683,13 @@ function registerEnvironmentSnapshotCommands(program2) {
       if (result.task_verification_id)
         console.log(`task verification: ${result.task_verification_id}`);
       for (const warning of result.snapshot.warnings)
-        console.log(chalk14.yellow(`warning: ${warning}`));
+        console.log(chalk15.yellow(`warning: ${warning}`));
     } catch (error2) {
       const message = error2 instanceof Error ? error2.message : String(error2);
       if (globalOpts.json)
         printJson2({ error: message });
       else
-        console.error(chalk14.red(`Error: ${message}`));
+        console.error(chalk15.red(`Error: ${message}`));
       process.exit(1);
     }
   });
@@ -73292,7 +73715,7 @@ function registerEnvironmentSnapshotCommands(program2) {
       if (globalOpts.json)
         printJson2({ error: message });
       else
-        console.error(chalk14.red(`Error: ${message}`));
+        console.error(chalk15.red(`Error: ${message}`));
       process.exit(1);
     }
   });
@@ -73306,7 +73729,7 @@ var exports_knowledge_commands = {};
 __export(exports_knowledge_commands, {
   registerKnowledgeCommands: () => registerKnowledgeCommands
 });
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 function parseRecordType(value) {
   if (RECORD_TYPES.includes(value))
     return value;
@@ -73342,13 +73765,13 @@ function commonFilters(opts) {
   };
 }
 function printRecord(record) {
-  console.log(`${chalk15.cyan(record.id.slice(0, 8))} ${chalk15.yellow(record.record_type)} ${record.title}`);
+  console.log(`${chalk16.cyan(record.id.slice(0, 8))} ${chalk16.yellow(record.record_type)} ${record.title}`);
   if (record.task_id)
-    console.log(chalk15.dim(`  task: ${record.task_id}`));
+    console.log(chalk16.dim(`  task: ${record.task_id}`));
   if (record.project_id)
-    console.log(chalk15.dim(`  project: ${record.project_id}`));
+    console.log(chalk16.dim(`  project: ${record.project_id}`));
   if (record.tags.length > 0)
-    console.log(chalk15.dim(`  tags: ${record.tags.join(", ")}`));
+    console.log(chalk16.dim(`  tags: ${record.tags.join(", ")}`));
   if (record.decision)
     console.log(`  decision: ${record.decision}`);
   else if (record.content)
@@ -73401,7 +73824,7 @@ function registerKnowledgeCommands(program2) {
       if (opts.json || globalOpts.json)
         output(result, true);
       else {
-        console.log(chalk15.green(`Snapshot ${result.snapshot_id.slice(0, 8)} saved.`));
+        console.log(chalk16.green(`Snapshot ${result.snapshot_id.slice(0, 8)} saved.`));
         printRecord(result.record);
       }
     } catch (error2) {
@@ -73475,7 +73898,7 @@ var exports_risk_commands = {};
 __export(exports_risk_commands, {
   registerRiskCommands: () => registerRiskCommands
 });
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 function parseChoice(value, choices, label) {
   if (choices.includes(value))
     return value;
@@ -73514,16 +73937,16 @@ function commonFilters2(opts) {
   };
 }
 function printRisk(risk) {
-  const color = risk.severity === "critical" ? chalk16.red : risk.severity === "high" ? chalk16.yellow : chalk16.white;
-  console.log(`${chalk16.cyan(risk.id.slice(0, 8))} ${color(risk.severity)} ${chalk16.bold(risk.status)} ${risk.title}`);
+  const color = risk.severity === "critical" ? chalk17.red : risk.severity === "high" ? chalk17.yellow : chalk17.white;
+  console.log(`${chalk17.cyan(risk.id.slice(0, 8))} ${color(risk.severity)} ${chalk17.bold(risk.status)} ${risk.title}`);
   if (risk.owner)
-    console.log(chalk16.dim(`  owner: ${risk.owner}`));
+    console.log(chalk17.dim(`  owner: ${risk.owner}`));
   if (risk.due_at)
-    console.log(chalk16.dim(`  due: ${risk.due_at}`));
+    console.log(chalk17.dim(`  due: ${risk.due_at}`));
   if (risk.plan_id)
-    console.log(chalk16.dim(`  plan: ${risk.plan_id}`));
+    console.log(chalk17.dim(`  plan: ${risk.plan_id}`));
   if (risk.project_id)
-    console.log(chalk16.dim(`  project: ${risk.project_id}`));
+    console.log(chalk17.dim(`  project: ${risk.project_id}`));
   if (risk.mitigation)
     console.log(`  mitigation: ${risk.mitigation}`);
 }
@@ -73631,8 +74054,8 @@ function registerRiskCommands(program2) {
       if (opts.json || globalOpts.json)
         output(report, true);
       else {
-        console.log(`${chalk16.bold("Health")} ${report.status} (${report.score}/100)`);
-        console.log(chalk16.dim(`${report.components.total_tasks} tasks \xB7 ${report.components.blocked_tasks} blocked \xB7 ${report.components.overdue_tasks} overdue \xB7 ${report.components.open_risks} open risks`));
+        console.log(`${chalk17.bold("Health")} ${report.status} (${report.score}/100)`);
+        console.log(chalk17.dim(`${report.components.total_tasks} tasks \xB7 ${report.components.blocked_tasks} blocked \xB7 ${report.components.overdue_tasks} overdue \xB7 ${report.components.open_risks} open risks`));
         for (const recommendation of report.recommendations)
           console.log(`- ${recommendation}`);
       }
@@ -73670,7 +74093,7 @@ var exports_retrospective_commands = {};
 __export(exports_retrospective_commands, {
   registerRetrospectiveCommands: () => registerRetrospectiveCommands
 });
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 function commonFilters3(opts) {
   return {
     project_id: opts.project,
@@ -73681,8 +74104,8 @@ function commonFilters3(opts) {
 }
 function printRetrospective(record) {
   const report = record.report;
-  console.log(`${chalk17.cyan(record.id.slice(0, 8))} ${chalk17.bold(record.title)} ${chalk17.dim(`${record.scope}:${report.scope_id.slice(0, 8)}`)}`);
-  console.log(chalk17.dim(`  tasks: ${report.summary.completed_tasks}/${report.summary.total_tasks} completed \xB7 missed: ${report.summary.missed_estimates} \xB7 blockers: ${report.summary.recurring_blockers} \xB7 failed checks: ${report.summary.failed_verifications}`));
+  console.log(`${chalk18.cyan(record.id.slice(0, 8))} ${chalk18.bold(record.title)} ${chalk18.dim(`${record.scope}:${report.scope_id.slice(0, 8)}`)}`);
+  console.log(chalk18.dim(`  tasks: ${report.summary.completed_tasks}/${report.summary.total_tasks} completed \xB7 missed: ${report.summary.missed_estimates} \xB7 blockers: ${report.summary.recurring_blockers} \xB7 failed checks: ${report.summary.failed_verifications}`));
   for (const lesson of report.lessons.slice(0, 3))
     console.log(`  - ${lesson}`);
 }
@@ -73760,7 +74183,7 @@ var exports_agent_reliability_commands = {};
 __export(exports_agent_reliability_commands, {
   registerAgentReliabilityCommands: () => registerAgentReliabilityCommands
 });
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 function parseNumber(value, fallback) {
   if (!value)
     return fallback;
@@ -73775,9 +74198,9 @@ function commonOptions(opts) {
   };
 }
 function printScorecard(scorecard) {
-  const color = scorecard.grade === "at_risk" ? chalk18.red : scorecard.grade === "watch" ? chalk18.yellow : scorecard.grade === "excellent" ? chalk18.green : chalk18.white;
-  console.log(`${chalk18.cyan(scorecard.agent_id.slice(0, 8))} ${color(`${scorecard.score}/100`)} ${chalk18.bold(scorecard.agent_name)} ${chalk18.dim(scorecard.grade)}`);
-  console.log(chalk18.dim(`  completed: ${scorecard.signals.tasks_completed} \xB7 failed: ${scorecard.signals.tasks_failed} \xB7 failed checks: ${scorecard.signals.failed_verifications} \xB7 failed runs: ${scorecard.signals.runs_failed} \xB7 stale locks: ${scorecard.signals.stale_task_locks + scorecard.signals.stale_resource_locks}`));
+  const color = scorecard.grade === "at_risk" ? chalk19.red : scorecard.grade === "watch" ? chalk19.yellow : scorecard.grade === "excellent" ? chalk19.green : chalk19.white;
+  console.log(`${chalk19.cyan(scorecard.agent_id.slice(0, 8))} ${color(`${scorecard.score}/100`)} ${chalk19.bold(scorecard.agent_name)} ${chalk19.dim(scorecard.grade)}`);
+  console.log(chalk19.dim(`  completed: ${scorecard.signals.tasks_completed} \xB7 failed: ${scorecard.signals.tasks_failed} \xB7 failed checks: ${scorecard.signals.failed_verifications} \xB7 failed runs: ${scorecard.signals.runs_failed} \xB7 stale locks: ${scorecard.signals.stale_task_locks + scorecard.signals.stale_resource_locks}`));
   for (const recommendation of scorecard.recommendations.slice(0, 3))
     console.log(`  - ${recommendation}`);
 }
@@ -73849,7 +74272,7 @@ var exports_onboarding_commands = {};
 __export(exports_onboarding_commands, {
   registerOnboardingCommands: () => registerOnboardingCommands
 });
-import chalk19 from "chalk";
+import chalk20 from "chalk";
 import { resolve as resolve23 } from "path";
 function registerOnboardingCommands(program2) {
   program2.command("onboarding").alias("demo-fixtures").description("List, show, write, or import bundled local onboarding fixtures").option("--show <name>", "Show one fixture bridge bundle as JSON").option("--write <dir>", "Write all bundled fixture bridge bundles to a directory").option("--import <name>", "Dry-run or apply an onboarding fixture import").option("--apply", "Apply an onboarding fixture import. Defaults to dry-run.").option("--resolve-conflicts", "Safely merge existing local tasks while preserving divergent fields").action(async (opts) => {
@@ -73871,9 +74294,9 @@ function registerOnboardingCommands(program2) {
           output(result, true);
           return;
         }
-        console.log(chalk19.green(`Wrote ${result.written} onboarding fixture file(s) to ${result.directory}`));
+        console.log(chalk20.green(`Wrote ${result.written} onboarding fixture file(s) to ${result.directory}`));
         for (const file of result.files)
-          console.log(chalk19.dim(`  ${file}`));
+          console.log(chalk20.dim(`  ${file}`));
         return;
       }
       if (opts.import) {
@@ -73887,7 +74310,7 @@ function registerOnboardingCommands(program2) {
           return;
         }
         const mode = result.dry_run ? "Dry-run" : "Import";
-        console.log(chalk19.bold(`${mode} ${result.ok ? "ready" : "has issues"}`));
+        console.log(chalk20.bold(`${mode} ${result.ok ? "ready" : "has issues"}`));
         for (const [key, count2] of Object.entries(result.inserted)) {
           if (count2 > 0)
             console.log(`  ${key}: ${count2}`);
@@ -73897,9 +74320,9 @@ function registerOnboardingCommands(program2) {
             console.log(`  ${key} merged: ${count2}`);
         }
         if (result.conflicts.length > 0)
-          console.log(chalk19.yellow(`  conflicts: ${result.conflicts.length}`));
+          console.log(chalk20.yellow(`  conflicts: ${result.conflicts.length}`));
         for (const issue of result.issues)
-          console.error(chalk19.red(`  ${issue}`));
+          console.error(chalk20.red(`  ${issue}`));
         return;
       }
       const fixtures = listOnboardingFixtures2();
@@ -73907,11 +74330,11 @@ function registerOnboardingCommands(program2) {
         output(fixtures, true);
         return;
       }
-      console.log(chalk19.bold(`${fixtures.length} bundled onboarding fixture(s):
+      console.log(chalk20.bold(`${fixtures.length} bundled onboarding fixture(s):
 `));
       for (const fixture of fixtures) {
-        console.log(`  ${chalk19.bold(fixture.name)} ${chalk19.dim(`[${fixture.version}]`)} ${chalk19.yellow(`${fixture.stats.tasks} tasks`)}`);
-        console.log(chalk19.dim(`    ${fixture.description}`));
+        console.log(`  ${chalk20.bold(fixture.name)} ${chalk20.dim(`[${fixture.version}]`)} ${chalk20.yellow(`${fixture.stats.tasks} tasks`)}`);
+        console.log(chalk20.dim(`    ${fixture.description}`));
       }
     } catch (e) {
       handleError(e);
@@ -73927,7 +74350,7 @@ var exports_local_snapshot_commands = {};
 __export(exports_local_snapshot_commands, {
   registerLocalSnapshotCommands: () => registerLocalSnapshotCommands
 });
-import chalk20 from "chalk";
+import chalk21 from "chalk";
 function splitTypes(value) {
   if (!value)
     return;
@@ -73961,9 +74384,9 @@ function registerLocalSnapshotCommands(program2) {
           output(result, true);
           return;
         }
-        console.log(chalk20.bold(`Changed snapshots: ${result.snapshots.length}`));
+        console.log(chalk21.bold(`Changed snapshots: ${result.snapshots.length}`));
         for (const snapshot of result.snapshots) {
-          console.log(`  ${snapshot.type} ${chalk20.dim(snapshot.cursor)} ${snapshot.fingerprint.slice(0, 12)}`);
+          console.log(`  ${snapshot.type} ${chalk21.dim(snapshot.cursor)} ${snapshot.fingerprint.slice(0, 12)}`);
         }
         return;
       }
@@ -73982,7 +74405,7 @@ function registerLocalSnapshotCommands(program2) {
           output(snapshot, true);
           return;
         }
-        console.log(chalk20.bold(`${snapshot.type} snapshot`));
+        console.log(chalk21.bold(`${snapshot.type} snapshot`));
         console.log(`  count: ${snapshot.count}`);
         console.log(`  cursor: ${snapshot.cursor}`);
         console.log(`  fingerprint: ${snapshot.fingerprint}`);
@@ -73993,11 +74416,11 @@ function registerLocalSnapshotCommands(program2) {
         output(resources, true);
         return;
       }
-      console.log(chalk20.bold(`${resources.length} local snapshot resources:
+      console.log(chalk21.bold(`${resources.length} local snapshot resources:
 `));
       for (const resource of resources) {
-        console.log(`  ${chalk20.bold(resource.type)} ${chalk20.dim(resource.uri)}`);
-        console.log(chalk20.dim(`    ${resource.description}`));
+        console.log(`  ${chalk21.bold(resource.type)} ${chalk21.dim(resource.uri)}`);
+        console.log(chalk21.dim(`    ${resource.description}`));
       }
     } catch (e) {
       handleError(e);
@@ -77366,7 +77789,7 @@ __export(exports_sdk_integration_fixtures, {
   TODOS_SDK_INTEGRATION_FIXTURE_GENERATED_AT: () => TODOS_SDK_INTEGRATION_FIXTURE_GENERATED_AT
 });
 import { mkdirSync as mkdirSync15, writeFileSync as writeFileSync15 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 function source5(version) {
   return {
     packageName: "@hasna/todos",
@@ -77473,7 +77896,7 @@ function writeSdkIntegrationFixtures(directory, options = {}) {
   ];
   const written = [];
   for (const [name, payload] of files) {
-    const file = join29(directory, name);
+    const file = join30(directory, name);
     writeFileSync15(file, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
     written.push(file);
@@ -77496,7 +77919,7 @@ var exports_sdk_fixture_commands = {};
 __export(exports_sdk_fixture_commands, {
   registerSdkFixtureCommands: () => registerSdkFixtureCommands
 });
-import chalk21 from "chalk";
+import chalk22 from "chalk";
 import { resolve as resolve24 } from "path";
 function registerSdkFixtureCommands(program2) {
   program2.command("sdk-fixtures").description("List, show, or write local SDK integration fixtures").option("--show", "Print the full fixture pack JSON").option("--write <dir>", "Write fixture pack, bridge fixture, contract snapshots, and example index to a directory").action(async (opts) => {
@@ -77513,9 +77936,9 @@ function registerSdkFixtureCommands(program2) {
           console.log(JSON.stringify(result));
           return;
         }
-        console.log(chalk21.green(`Wrote ${result.files.length} SDK integration fixture file(s) to ${result.directory}`));
+        console.log(chalk22.green(`Wrote ${result.files.length} SDK integration fixture file(s) to ${result.directory}`));
         for (const file of result.files)
-          console.log(chalk21.dim(`  ${file}`));
+          console.log(chalk22.dim(`  ${file}`));
         return;
       }
       if (opts.show) {
@@ -77527,11 +77950,11 @@ function registerSdkFixtureCommands(program2) {
         output(examples, true);
         return;
       }
-      console.log(chalk21.bold(`${examples.length} local SDK integration example(s):
+      console.log(chalk22.bold(`${examples.length} local SDK integration example(s):
 `));
       for (const example of examples) {
-        console.log(`  ${chalk21.bold(example.id)} ${chalk21.dim(`[${example.surface}]`)}`);
-        console.log(chalk21.dim(`    ${example.command}`));
+        console.log(`  ${chalk22.bold(example.id)} ${chalk22.dim(`[${example.surface}]`)}`);
+        console.log(chalk22.dim(`    ${example.command}`));
       }
     } catch (e) {
       handleError(e);
@@ -77547,7 +77970,7 @@ var exports_review_queue_commands = {};
 __export(exports_review_queue_commands, {
   registerReviewQueueCommands: () => registerReviewQueueCommands
 });
-import chalk22 from "chalk";
+import chalk23 from "chalk";
 function splitList2(value) {
   return value?.split(";").flatMap((part) => part.split(",")).map((item) => item.trim()).filter(Boolean);
 }
@@ -77578,12 +78001,12 @@ function registerReviewQueueCommands(program2) {
         return;
       }
       if (items.length === 0) {
-        console.log(chalk22.dim("Review queue is empty."));
+        console.log(chalk23.dim("Review queue is empty."));
         return;
       }
       for (const item of items) {
         const assignee = item.claimed_by || item.reviewer || "(unclaimed)";
-        console.log(`${chalk22.dim(item.task_id.slice(0, 8))} ${item.state.padEnd(17)} ${item.queue.padEnd(12)} ${assignee.padEnd(12)} ${item.title}`);
+        console.log(`${chalk23.dim(item.task_id.slice(0, 8))} ${item.state.padEnd(17)} ${item.queue.padEnd(12)} ${assignee.padEnd(12)} ${item.title}`);
       }
     } catch (e) {
       handleError(e);
@@ -77605,7 +78028,7 @@ function registerReviewQueueCommands(program2) {
         output(item, true);
         return;
       }
-      console.log(chalk22.green(`Review requested: ${item.task_id.slice(0, 8)} -> ${item.queue}`));
+      console.log(chalk23.green(`Review requested: ${item.task_id.slice(0, 8)} -> ${item.queue}`));
     } catch (e) {
       handleError(e);
     }
@@ -77619,7 +78042,7 @@ function registerReviewQueueCommands(program2) {
         output(item, true);
         return;
       }
-      console.log(chalk22.green(`Review claimed: ${item.task_id.slice(0, 8)} by ${item.claimed_by}`));
+      console.log(chalk23.green(`Review claimed: ${item.task_id.slice(0, 8)} by ${item.claimed_by}`));
     } catch (e) {
       handleError(e);
     }
@@ -77633,7 +78056,7 @@ function registerReviewQueueCommands(program2) {
         output(item, true);
         return;
       }
-      console.log(chalk22.green(`Review approved: ${item.task_id.slice(0, 8)} by ${item.reviewer}`));
+      console.log(chalk23.green(`Review approved: ${item.task_id.slice(0, 8)} by ${item.reviewer}`));
     } catch (e) {
       handleError(e);
     }
@@ -77652,7 +78075,7 @@ function registerReviewQueueCommands(program2) {
         output(item, true);
         return;
       }
-      console.log(chalk22.yellow(`Review returned: ${item.task_id.slice(0, 8)} with ${item.changes_requested.length} requested change(s)`));
+      console.log(chalk23.yellow(`Review returned: ${item.task_id.slice(0, 8)} with ${item.changes_requested.length} requested change(s)`));
     } catch (e) {
       handleError(e);
     }
@@ -77666,7 +78089,7 @@ function registerReviewQueueCommands(program2) {
         output(item, true);
         return;
       }
-      console.log(chalk22.yellow(`Review reopened: ${item.task_id.slice(0, 8)}`));
+      console.log(chalk23.yellow(`Review reopened: ${item.task_id.slice(0, 8)}`));
     } catch (e) {
       handleError(e);
     }
@@ -77682,11 +78105,11 @@ function registerReviewQueueCommands(program2) {
         return;
       }
       if (items.length === 0) {
-        console.log(chalk22.dim("No review routing rules configured."));
+        console.log(chalk23.dim("No review routing rules configured."));
         return;
       }
       for (const rule of items) {
-        console.log(`${rule.enabled ? chalk22.green("on ") : chalk22.gray("off")} ${rule.name.padEnd(16)} ${rule.queue.padEnd(12)} ${rule.reviewers.join(",") || "(no reviewers)"}`);
+        console.log(`${rule.enabled ? chalk23.green("on ") : chalk23.gray("off")} ${rule.name.padEnd(16)} ${rule.queue.padEnd(12)} ${rule.reviewers.join(",") || "(no reviewers)"}`);
       }
     } catch (e) {
       handleError(e);
@@ -77709,7 +78132,7 @@ function registerReviewQueueCommands(program2) {
         output(rule, true);
         return;
       }
-      console.log(chalk22.green(`Review routing rule saved: ${rule.name}`));
+      console.log(chalk23.green(`Review routing rule saved: ${rule.name}`));
     } catch (e) {
       handleError(e);
     }
@@ -77723,7 +78146,7 @@ function registerReviewQueueCommands(program2) {
         output({ removed }, true);
         return;
       }
-      console.log(removed ? chalk22.green("Review routing rule removed.") : chalk22.dim("No review routing rule matched."));
+      console.log(removed ? chalk23.green("Review routing rule removed.") : chalk23.dim("No review routing rule matched."));
     } catch (e) {
       handleError(e);
     }
@@ -77738,8 +78161,8 @@ var exports_roadmap_commands = {};
 __export(exports_roadmap_commands, {
   registerRoadmapCommands: () => registerRoadmapCommands
 });
-import { readFileSync as readFileSync21, writeFileSync as writeFileSync16 } from "fs";
-import chalk23 from "chalk";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync16 } from "fs";
+import chalk24 from "chalk";
 function splitList3(value) {
   return value?.split(";").flatMap((part) => part.split(",")).map((item) => item.trim()).filter(Boolean);
 }
@@ -77786,7 +78209,7 @@ function registerRoadmapCommands(program2) {
         output(roadmap, true);
         return;
       }
-      console.log(chalk23.green(`Roadmap created: ${roadmap.id.slice(0, 8)} ${roadmap.name}`));
+      console.log(chalk24.green(`Roadmap created: ${roadmap.id.slice(0, 8)} ${roadmap.name}`));
     } catch (e) {
       handleError(e);
     }
@@ -77801,11 +78224,11 @@ function registerRoadmapCommands(program2) {
         return;
       }
       if (items.length === 0) {
-        console.log(chalk23.dim("No roadmaps configured."));
+        console.log(chalk24.dim("No roadmaps configured."));
         return;
       }
       for (const item of items)
-        console.log(`${chalk23.dim(item.id.slice(0, 8))} ${item.status.padEnd(9)} ${item.name}`);
+        console.log(`${chalk24.dim(item.id.slice(0, 8))} ${item.status.padEnd(9)} ${item.name}`);
     } catch (e) {
       handleError(e);
     }
@@ -77845,7 +78268,7 @@ function registerRoadmapCommands(program2) {
         output(updated, true);
         return;
       }
-      console.log(chalk23.green(`Roadmap updated: ${updated.id.slice(0, 8)} ${updated.name}`));
+      console.log(chalk24.green(`Roadmap updated: ${updated.id.slice(0, 8)} ${updated.name}`));
     } catch (e) {
       handleError(e);
     }
@@ -77859,7 +78282,7 @@ function registerRoadmapCommands(program2) {
         output({ deleted }, true);
         return;
       }
-      console.log(deleted ? chalk23.green("Roadmap deleted.") : chalk23.dim("No roadmap matched."));
+      console.log(deleted ? chalk24.green("Roadmap deleted.") : chalk24.dim("No roadmap matched."));
     } catch (e) {
       handleError(e);
     }
@@ -77887,7 +78310,7 @@ function registerRoadmapCommands(program2) {
         output(milestone, true);
         return;
       }
-      console.log(chalk23.green(`Milestone added: ${milestone.id.slice(0, 8)} ${milestone.title}`));
+      console.log(chalk24.green(`Milestone added: ${milestone.id.slice(0, 8)} ${milestone.title}`));
     } catch (e) {
       handleError(e);
     }
@@ -77913,7 +78336,7 @@ function registerRoadmapCommands(program2) {
         output(updated, true);
         return;
       }
-      console.log(chalk23.green(`Milestone updated: ${updated.id.slice(0, 8)} ${updated.title}`));
+      console.log(chalk24.green(`Milestone updated: ${updated.id.slice(0, 8)} ${updated.title}`));
     } catch (e) {
       handleError(e);
     }
@@ -77938,7 +78361,7 @@ function registerRoadmapCommands(program2) {
         output(release, true);
         return;
       }
-      console.log(chalk23.green(`Release group saved: ${release.name}`));
+      console.log(chalk24.green(`Release group saved: ${release.name}`));
     } catch (e) {
       handleError(e);
     }
@@ -77951,7 +78374,7 @@ function registerRoadmapCommands(program2) {
       if (opts.out) {
         writeFileSync16(opts.out, content);
         if (!globalOpts.json)
-          console.log(chalk23.green(`Wrote roadmap export to ${opts.out}`));
+          console.log(chalk24.green(`Wrote roadmap export to ${opts.out}`));
       }
       if (globalOpts.json) {
         output(opts.format === "markdown" ? { content } : JSON.parse(content), true);
@@ -77967,13 +78390,13 @@ function registerRoadmapCommands(program2) {
     const globalOpts = globalOptions(program2);
     try {
       const { importRoadmapBundle: importRoadmapBundle2 } = await Promise.resolve().then(() => (init_roadmaps(), exports_roadmaps));
-      const bundle = JSON.parse(readFileSync21(path, "utf8"));
+      const bundle = JSON.parse(readFileSync23(path, "utf8"));
       const result = importRoadmapBundle2(bundle, { apply: Boolean(opts.apply) });
       if (globalOpts.json) {
         output(result, true);
         return;
       }
-      console.log(result.applied ? chalk23.green(`Imported roadmap ${result.roadmap_id}`) : chalk23.dim(`Preview: ${result.milestones} milestones, ${result.releases} releases`));
+      console.log(result.applied ? chalk24.green(`Imported roadmap ${result.roadmap_id}`) : chalk24.dim(`Preview: ${result.milestones} milestones, ${result.releases} releases`));
     } catch (e) {
       handleError(e);
     }
@@ -77989,7 +78412,7 @@ var exports_capacity_commands = {};
 __export(exports_capacity_commands, {
   registerCapacityCommands: () => registerCapacityCommands
 });
-import chalk24 from "chalk";
+import chalk25 from "chalk";
 function splitDays(value) {
   return value?.split(",").map((item) => Number(item.trim())).filter((item) => Number.isFinite(item));
 }
@@ -78022,7 +78445,7 @@ function registerCapacityCommands(program2) {
         output(profile, true);
         return;
       }
-      console.log(chalk24.green(`Capacity saved: ${profile.agent_id} ${profile.minutes_per_day}m/day`));
+      console.log(chalk25.green(`Capacity saved: ${profile.agent_id} ${profile.minutes_per_day}m/day`));
     } catch (e) {
       handleError(e);
     }
@@ -78040,7 +78463,7 @@ function registerCapacityCommands(program2) {
         return;
       }
       if (profiles.length === 0) {
-        console.log(chalk24.dim("No capacity profiles."));
+        console.log(chalk25.dim("No capacity profiles."));
         return;
       }
       for (const profile of profiles) {
@@ -78059,7 +78482,7 @@ function registerCapacityCommands(program2) {
         output({ removed }, true);
         return;
       }
-      console.log(removed ? chalk24.green("Capacity profile removed.") : chalk24.dim("No capacity profile matched."));
+      console.log(removed ? chalk25.green("Capacity profile removed.") : chalk25.dim("No capacity profile matched."));
     } catch (e) {
       handleError(e);
     }
@@ -78098,7 +78521,7 @@ var exports_audit_ledger_commands = {};
 __export(exports_audit_ledger_commands, {
   registerAuditLedgerCommands: () => registerAuditLedgerCommands
 });
-import chalk25 from "chalk";
+import chalk26 from "chalk";
 function globalOptions3(program2) {
   const command = program2;
   return command.optsWithGlobals?.() ?? program2.opts();
@@ -78154,7 +78577,7 @@ function registerAuditLedgerCommands(program2) {
         output(checkpoint, true);
         return;
       }
-      console.log(chalk25.green(`Audit checkpoint sealed: ${checkpoint.name} ${checkpoint.root_hash}`));
+      console.log(chalk26.green(`Audit checkpoint sealed: ${checkpoint.name} ${checkpoint.root_hash}`));
     } catch (e) {
       handleError(e);
     }
@@ -78169,7 +78592,7 @@ function registerAuditLedgerCommands(program2) {
         return;
       }
       if (checkpoints.length === 0) {
-        console.log(chalk25.dim("No audit ledger checkpoints."));
+        console.log(chalk26.dim("No audit ledger checkpoints."));
         return;
       }
       for (const checkpoint of checkpoints) {
@@ -78192,7 +78615,7 @@ function registerAuditLedgerCommands(program2) {
         output(result, true);
         return;
       }
-      console.log(result.ok ? chalk25.green("Audit ledger verified.") : chalk25.red(`Audit ledger failed: ${result.issues.join("; ")}`));
+      console.log(result.ok ? chalk26.green("Audit ledger verified.") : chalk26.red(`Audit ledger failed: ${result.issues.join("; ")}`));
       if (!result.ok)
         process.exitCode = 1;
     } catch (e) {
@@ -78211,7 +78634,7 @@ var exports_release_compatibility_commands = {};
 __export(exports_release_compatibility_commands, {
   registerReleaseCompatibilityCommands: () => registerReleaseCompatibilityCommands
 });
-import chalk26 from "chalk";
+import chalk27 from "chalk";
 function globalOptions4(program2) {
   const command = program2;
   return command.optsWithGlobals?.() ?? program2.opts();
@@ -78243,7 +78666,7 @@ function registerReleaseCompatibilityCommands(program2) {
           process.exitCode = 1;
         return;
       }
-      console.log(report.ok ? chalk26.green("Release compatibility passed.") : chalk26.red("Release compatibility failed."));
+      console.log(report.ok ? chalk27.green("Release compatibility passed.") : chalk27.red("Release compatibility failed."));
       if (!report.ok)
         process.exitCode = 1;
     } catch (error2) {
@@ -78326,14 +78749,14 @@ var exports_local_backup_commands = {};
 __export(exports_local_backup_commands, {
   registerLocalBackupCommands: () => registerLocalBackupCommands
 });
-import chalk27 from "chalk";
+import chalk28 from "chalk";
 import { resolve as resolve25 } from "path";
 function globalOptions6(program2) {
   const command = program2;
   return command.optsWithGlobals?.() ?? program2.opts();
 }
 function printCreateSummary(result) {
-  console.log(chalk27.bold("todos local backup"));
+  console.log(chalk28.bold("todos local backup"));
   if (result.output_path)
     console.log(`File: ${result.output_path}`);
   console.log(`Checksum: ${result.backup.checksum}`);
@@ -78373,13 +78796,13 @@ function registerLocalBackupCommands(program2) {
         output(verification, true);
         return;
       }
-      console.log(chalk27.bold(`Backup ${verification.ok ? "verified" : "has issues"}`));
+      console.log(chalk28.bold(`Backup ${verification.ok ? "verified" : "has issues"}`));
       console.log(`Checksum: ${verification.checksum.ok ? "ok" : "mismatch"}`);
       console.log(`Bridge: ${verification.bridge_checksum.ok ? "ok" : "mismatch"}`);
       for (const issue of verification.issues)
-        console.error(chalk27.red(`  ${issue}`));
+        console.error(chalk28.red(`  ${issue}`));
       for (const warning of verification.warnings)
-        console.error(chalk27.yellow(`  ${warning}`));
+        console.error(chalk28.yellow(`  ${warning}`));
     } catch (error2) {
       handleError(error2);
     }
@@ -78396,18 +78819,18 @@ function registerLocalBackupCommands(program2) {
         output(result, true);
         return;
       }
-      console.log(chalk27.bold(`${result.dry_run ? "Restore dry-run" : "Restore"} ${result.ok ? "ready" : "has issues"}`));
+      console.log(chalk28.bold(`${result.dry_run ? "Restore dry-run" : "Restore"} ${result.ok ? "ready" : "has issues"}`));
       if (result.import_result) {
         for (const [key, count2] of Object.entries(result.import_result.inserted)) {
           if (count2 > 0)
             console.log(`  ${key}: ${count2}`);
         }
         if (result.import_result.conflicts.length > 0) {
-          console.log(chalk27.yellow(`  conflicts: ${result.import_result.conflicts.length}`));
+          console.log(chalk28.yellow(`  conflicts: ${result.import_result.conflicts.length}`));
         }
       }
       for (const issue of result.issues)
-        console.error(chalk27.red(`  ${issue}`));
+        console.error(chalk28.red(`  ${issue}`));
     } catch (error2) {
       handleError(error2);
     }
@@ -78423,14 +78846,14 @@ function registerLocalBackupCommands(program2) {
         output(report, true);
         return;
       }
-      console.log(chalk27.bold(`Local integrity ${report.ok ? "ok" : "needs attention"}`));
+      console.log(chalk28.bold(`Local integrity ${report.ok ? "ok" : "needs attention"}`));
       console.log(`Quick check: ${report.sqlite.quick_check}`);
       console.log(`Foreign key violations: ${report.sqlite.foreign_key_violations}`);
       console.log(`Tasks: ${report.counts.tasks}`);
       for (const issue of report.issues)
-        console.error(chalk27.red(`  ${issue}`));
+        console.error(chalk28.red(`  ${issue}`));
       for (const warning of report.warnings)
-        console.error(chalk27.yellow(`  ${warning}`));
+        console.error(chalk28.yellow(`  ${warning}`));
     } catch (error2) {
       handleError(error2);
     }
@@ -78924,7 +79347,7 @@ var init_hybrid = __esm(() => {
 });
 
 // src/storage/s3-artifacts.ts
-import { createHash as createHash17, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash18, createHmac as createHmac2 } from "crypto";
 function createTodosS3ArtifactStore(options) {
   const requestFetch = options.fetch ?? fetch;
   const now4 = options.now ?? (() => new Date);
@@ -79096,7 +79519,7 @@ function toAmzDate(date) {
   return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
 }
 function sha256Hex(value) {
-  return createHash17("sha256").update(value).digest("hex");
+  return createHash18("sha256").update(value).digest("hex");
 }
 function hmac(key, value) {
   return createHmac2("sha256", key).update(value).digest();
@@ -79703,13 +80126,13 @@ __export(exports_storage_commands, {
   s3CredentialsFromEnv: () => s3CredentialsFromEnv,
   registerStorageCommands: () => registerStorageCommands
 });
-import chalk28 from "chalk";
+import chalk29 from "chalk";
 function globalOptions7(program2) {
   const command = program2;
   return command.optsWithGlobals?.() ?? program2.opts();
 }
 function printStatus(status) {
-  console.log(chalk28.bold("todos storage"));
+  console.log(chalk29.bold("todos storage"));
   console.log(`Mode: ${status.mode}`);
   console.log(`Remote: ${status.remote_enabled ? "enabled" : "disabled"}`);
   console.log(`Canonical RDS: ${status.canonical.cluster}/${status.canonical.database}`);
@@ -79720,12 +80143,12 @@ function printStatus(status) {
   console.log(`Sync batch: ${status.sync.batch_size}`);
   console.log(`Network: not used`);
   for (const issue of status.issues)
-    console.error(chalk28.red(`  ${issue}`));
+    console.error(chalk29.red(`  ${issue}`));
   for (const warning of status.warnings)
-    console.error(chalk28.yellow(`  ${warning}`));
+    console.error(chalk29.yellow(`  ${warning}`));
 }
 function printSyncPlan(plan) {
-  console.log(chalk28.bold("todos storage sync-plan"));
+  console.log(chalk29.bold("todos storage sync-plan"));
   console.log(`Mode: ${plan.status.mode}`);
   console.log(`Dry run: yes`);
   console.log(`Database: ${plan.postgres.configured ? "configured" : "not configured"}`);
@@ -79739,17 +80162,17 @@ function printSyncPlan(plan) {
       console.log(statement);
   }
   for (const issue of plan.status.issues)
-    console.error(chalk28.red(`  ${issue}`));
+    console.error(chalk29.red(`  ${issue}`));
   for (const warning of plan.status.warnings)
-    console.error(chalk28.yellow(`  ${warning}`));
+    console.error(chalk29.yellow(`  ${warning}`));
 }
 function printShadowStatus(report, enabled, shadowEnv) {
-  console.log(chalk28.bold("todos storage shadow-status"));
+  console.log(chalk29.bold("todos storage shadow-status"));
   console.log(`Shadow mirror: ${enabled ? "enabled" : "disabled"} (${shadowEnv})`);
   console.log(`Service: ${report.service}`);
   console.log(`Cloud reachable: ${report.cloud_reachable ? "yes" : "no"}`);
   if (report.error) {
-    console.error(chalk28.red(`  ${report.error}`));
+    console.error(chalk29.red(`  ${report.error}`));
     return;
   }
   console.log(`In sync: ${report.in_sync ? "yes" : "no"}`);
@@ -79757,7 +80180,7 @@ function printShadowStatus(report, enabled, shadowEnv) {
   console.log(`Last mirror lag: ${report.last_mirror_lag_ms === null ? "n/a" : `${report.last_mirror_lag_ms}ms`}`);
   console.log("Rows (local -> cloud):");
   for (const entry2 of report.objects) {
-    const flag = entry2.diff === 0 ? "" : chalk28.yellow(`  (diff ${entry2.diff > 0 ? "+" : ""}${entry2.diff})`);
+    const flag = entry2.diff === 0 ? "" : chalk29.yellow(`  (diff ${entry2.diff > 0 ? "+" : ""}${entry2.diff})`);
     console.log(`  ${entry2.object_type.padEnd(14)} local=${String(entry2.local).padStart(6)} cloud=${String(entry2.cloud).padStart(6)} tombstones=${entry2.cloud_tombstones}${flag}`);
   }
   console.log(`  ${"TOTAL".padEnd(14)} local=${String(report.totals.local).padStart(6)} cloud=${String(report.totals.cloud).padStart(6)} diff=${report.totals.diff}`);
@@ -79777,7 +80200,7 @@ function readOutboxDepth() {
   }
 }
 function printArtifactPlan(plan) {
-  console.log(chalk28.bold(`todos storage artifacts ${plan.direction}`));
+  console.log(chalk29.bold(`todos storage artifacts ${plan.direction}`));
   console.log("Dry run: yes");
   console.log("Network: not used");
   console.log(`Total: ${plan.total}`);
@@ -79788,10 +80211,10 @@ function printArtifactPlan(plan) {
     console.log(`  ${artifact.status.padEnd(18)} ${artifact.id.slice(0, 8)} ${artifact.sha256?.slice(0, 12) ?? "no-sha"}`);
   }
   for (const error2 of plan.errors)
-    console.error(chalk28.red(`  ${error2}`));
+    console.error(chalk29.red(`  ${error2}`));
 }
 function printArtifactResult(direction, result) {
-  console.log(chalk28.bold(`todos storage artifacts ${direction}`));
+  console.log(chalk29.bold(`todos storage artifacts ${direction}`));
   console.log(`Uploaded: ${result.uploaded}`);
   console.log(`Downloaded: ${result.downloaded}`);
   console.log(`Skipped: ${result.skipped}`);
@@ -79799,7 +80222,7 @@ function printArtifactResult(direction, result) {
     console.log(`  ${artifact.id.slice(0, 8)} ${artifact.key}`);
   }
   for (const error2 of result.errors)
-    console.error(chalk28.red(`  ${error2}`));
+    console.error(chalk29.red(`  ${error2}`));
 }
 function artifactFilter(opts) {
   const limit = opts.limit ? Number.parseInt(opts.limit, 10) : undefined;
@@ -79878,7 +80301,7 @@ function registerStorageCommands(program2) {
         return;
       }
       if (remoteAuthority.selected) {
-        console.log(chalk28.bold("todos storage"));
+        console.log(chalk29.bold("todos storage"));
         console.log("Mode: http");
         console.log("Transport: authenticated HTTP /v1");
         console.log(`Authority: ${remoteAuthority.v1_base_url ?? "not configured"}`);
@@ -79886,7 +80309,7 @@ function registerStorageCommands(program2) {
         console.log("Local fallback: disabled");
         console.log("Network: not used (configuration diagnostic only)");
         for (const issue of remoteAuthority.issues)
-          console.error(chalk28.red(`  ${issue}`));
+          console.error(chalk29.red(`  ${issue}`));
         if (!status.ok)
           process.exitCode = 1;
         return;
@@ -79931,7 +80354,7 @@ function registerStorageCommands(program2) {
           output({ configured: false, message }, true);
           return;
         }
-        console.log(chalk28.yellow(message));
+        console.log(chalk29.yellow(message));
         return;
       }
       cloud = client;
@@ -79969,7 +80392,7 @@ function registerStorageCommands(program2) {
           output({ shadow_enabled: false, message }, true);
           return;
         }
-        console.log(chalk28.yellow(message));
+        console.log(chalk29.yellow(message));
         return;
       }
       const { getDatabase: getDatabase2 } = await Promise.resolve().then(() => (init_database(), exports_database));
@@ -79981,7 +80404,7 @@ function registerStorageCommands(program2) {
         output({ shadow_enabled: true, ...stats2 }, true);
         return;
       }
-      console.log(chalk28.bold("todos storage shadow-drain"));
+      console.log(chalk29.bold("todos storage shadow-drain"));
       console.log(`Mirrored: ${stats2.mirrored}`);
       console.log(`Retries: ${stats2.retries}`);
       console.log(`Pending: ${stats2.pending}`);
@@ -79989,7 +80412,7 @@ function registerStorageCommands(program2) {
       console.log(`Outbox depth: ${stats2.depth}`);
       console.log(`Last mirror: ${stats2.lastMirrorAt ?? "never"}`);
       if (stats2.lastError)
-        console.error(chalk28.yellow(`Last error: ${stats2.lastError}`));
+        console.error(chalk29.yellow(`Last error: ${stats2.lastError}`));
     } catch (error2) {
       handleError(error2);
     }
@@ -80287,7 +80710,7 @@ var exports_scale_hardening_commands = {};
 __export(exports_scale_hardening_commands, {
   registerScaleHardeningCommands: () => registerScaleHardeningCommands
 });
-import chalk29 from "chalk";
+import chalk30 from "chalk";
 function globalOptions8(program2) {
   const command = program2;
   return command.optsWithGlobals?.() ?? program2.opts();
@@ -80334,7 +80757,7 @@ function registerScaleHardeningCommands(program2) {
       }
       if (format !== "markdown")
         throw new Error("--format must be json or markdown");
-      console.log(chalk29.bold(`todos scale compaction
+      console.log(chalk30.bold(`todos scale compaction
 `));
       console.log(`Mode: ${result.dry_run ? "dry run" : "applied"}`);
       console.log(`Before: ${result.before.page_count} pages, ${result.before.freelist_count} free`);
@@ -80354,7 +80777,7 @@ var exports_pr_group_commands = {};
 __export(exports_pr_group_commands, {
   registerPrGroupCommands: () => registerPrGroupCommands
 });
-import chalk30 from "chalk";
+import chalk31 from "chalk";
 function globalOptions9(program2) {
   const command = program2;
   return command.optsWithGlobals?.() ?? program2.opts();
@@ -80381,7 +80804,7 @@ function registerPrGroupCommands(program2) {
         output(view, true);
         return;
       }
-      console.log(`${chalk30.bold(view.group.id)} ${view.group.state} revision=${view.group.revision}`);
+      console.log(`${chalk31.bold(view.group.id)} ${view.group.state} revision=${view.group.revision}`);
       console.log(`authority=${view.authority} attempts=${view.attempts.length} events=${view.diagnostics.event_count}`);
     } catch (error2) {
       handleError(error2);
@@ -80399,7 +80822,7 @@ function registerPrGroupCommands(program2) {
         output(history, true);
         return;
       }
-      console.log(`${chalk30.bold(history.group_id)} events=${history.count} authority=${history.authority}`);
+      console.log(`${chalk31.bold(history.group_id)} events=${history.count} authority=${history.authority}`);
       for (const event of history.events) {
         console.log(`${String(event.sequence).padStart(4)} ${event.event_type} ${event.state}`);
       }
@@ -80796,6 +81219,7 @@ var [
   { registerQueryCommands: registerQueryCommands2 },
   { registerMcpHooksCommands: registerMcpHooksCommands2 },
   { registerDispatchCommands: registerDispatchCommands2 },
+  { registerDelegateCommands: registerDelegateCommands2 },
   { registerMachineCommands: registerMachineCommands2 },
   { registerApiKeyCommands: registerApiKeyCommands2 },
   { registerEnvironmentSnapshotCommands: registerEnvironmentSnapshotCommands2 },
@@ -80827,6 +81251,7 @@ var [
   Promise.resolve().then(() => (init_query_commands(), exports_query_commands)),
   Promise.resolve().then(() => (init_mcp_hooks_commands(), exports_mcp_hooks_commands)),
   Promise.resolve().then(() => (init_dispatch3(), exports_dispatch2)),
+  Promise.resolve().then(() => (init_delegate(), exports_delegate)),
   Promise.resolve().then(() => (init_machines3(), exports_machines)),
   Promise.resolve().then(() => (init_api_key_commands(), exports_api_key_commands)),
   Promise.resolve().then(() => (init_environment_snapshots3(), exports_environment_snapshots2)),
@@ -80857,6 +81282,7 @@ registerConfigServeCommands2(program2);
 registerQueryCommands2(program2);
 registerMcpHooksCommands2(program2);
 registerDispatchCommands2(program2);
+registerDelegateCommands2(program2);
 registerMachineCommands2(program2);
 registerApiKeyCommands2(program2);
 registerEnvironmentSnapshotCommands2(program2);