@hasna/todos 0.15.50 → 0.15.52

package/dist/server/index.js

@@ -70,7 +70,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.50",
+    version: "0.15.52",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -129,6 +129,7 @@ var init_package = __esm(() => {
     files: [
       "dist",
       "dashboard/dist",
+      "postinstall.js",
       "LICENSE",
       "README.md"
     ],
@@ -155,7 +156,7 @@ var init_package = __esm(() => {
       "test:attested-container-compatibility-vector": "bun test scripts/attested-container-compatibility-vector.test.ts",
       "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
       prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
-      postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
+      postinstall: "node postinstall.js"
     },
     keywords: [
       "todos",
@@ -189,13 +190,15 @@ var init_package = __esm(() => {
     author: "Andrei Hasna <andrei@hasna.com>",
     license: "Apache-2.0",
     dependencies: {
-      "@hasna/contracts": "0.14.0",
+      "@hasna/contracts": "0.14.2",
       "@hasna/events": "^0.1.11",
+      "@hasna/paths": "0.1.0",
       "@modelcontextprotocol/sdk": "^1.12.1",
       chalk: "^5.4.1",
       commander: "^13.1.0",
       ink: "^5.2.0",
       react: "^18.3.1",
+      "signal-exit": "3.0.7",
       zod: "3.25.76"
     },
     overrides: {
@@ -204,7 +207,7 @@ var init_package = __esm(() => {
       zod: "3.25.76"
     },
     devDependencies: {
-      "@types/bun": "^1.2.4",
+      "@types/bun": "1.3.14",
       "@types/react": "^18.3.18",
       "bun-types": "1.3.9",
       "hasna-deployment-contracts": "npm:@hasna/contracts@0.10.4",
@@ -225,7 +228,7 @@ var init_package_version = __esm(() => {
   init_package();
 });
 
-// node_modules/.bun/@hasna+contracts@0.14.0+619f74e7b30eeaf4/node_modules/@hasna/contracts/dist/auth/index.js
+// node_modules/.bun/@hasna+contracts@0.14.2+a5fb9613d5af3331/node_modules/@hasna/contracts/dist/auth/index.js
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 function isValidTenantId(value) {
   return typeof value === "string" && TENANT_ID_PATTERN.test(value);
@@ -1308,18 +1311,112 @@ function normalizeAgentNameInput(name) {
   return name.trim().toLowerCase();
 }
 
-// src/lib/sync-utils.ts
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
+// node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
 import { homedir } from "os";
 import { join } from "path";
+function assertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function envOf(options) {
+  return options.env ?? process.env;
+}
+function envValue(options, kind) {
+  const value = envOf(options)[KIND_ENV[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS(platform) {
+  return platform === "darwin";
+}
+function baseDir(kind, options) {
+  const override = envValue(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join(home, ".config", "hasna");
+    case "data":
+      return join(home, ".local", "share", "hasna");
+    case "state":
+      return join(home, ".local", "state", "hasna");
+    case "cache":
+      return join(home, ".cache", "hasna");
+  }
+}
+function resolvePath(kind, options) {
+  assertApp(options.app);
+  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
+  return join(baseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return resolvePath("data", options);
+}
+var KIND_ENV, APP_SLUG_RE;
+var init_dist = __esm(() => {
+  KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+});
+
+// src/lib/paths.ts
+import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2, resolve } from "path";
+function effectiveHome(env = process.env) {
+  return env.HOME || env.USERPROFILE || homedir2();
+}
+function legacyHomeDir(env = process.env) {
+  return join2(effectiveHome(env), ".hasna", "todos");
+}
+function resolverHome(env = process.env) {
+  return dataDir({ app: "todos", home: effectiveHome(env), env });
+}
+function adoptResolverHome(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join2(resolved, "todos.db")) || existsSync(join2(resolved, "config.json"));
+}
+function getTodosDir(env = process.env) {
+  const resolved = resolverHome(env);
+  return resolve(adoptResolverHome(resolved, env) ? resolved : legacyHomeDir(env));
+}
+var init_paths = __esm(() => {
+  init_dist();
+});
+
+// src/lib/sync-utils.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
+import { homedir as homedir3 } from "os";
 function getHomeDir() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir();
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir3();
 }
 function getTodosGlobalDir() {
-  return join(getHomeDir(), ".hasna", "todos");
+  return getTodosDir();
 }
 function ensureDir(dir) {
-  if (!existsSync(dir))
+  if (!existsSync2(dir))
     mkdirSync(dir, { recursive: true });
 }
 function readJsonFile(path) {
@@ -1340,18 +1437,19 @@ function appendSyncConflict(metadata, conflict, limit = 5) {
 }
 var HOME;
 var init_sync_utils = __esm(() => {
+  init_paths();
   HOME = getHomeDir();
 });
 
 // src/lib/creator-identity.ts
-import { existsSync as existsSync2, rmSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, rmSync } from "fs";
+import { join as join3 } from "path";
 function identityFilePath() {
-  return join2(getTodosGlobalDir(), "identity.json");
+  return join3(getTodosGlobalDir(), "identity.json");
 }
 function readPersistedIdentity() {
   const path = identityFilePath();
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return null;
   const parsed = readJsonFile(path);
   if (!parsed || typeof parsed.agent_id !== "string" || !parsed.agent_id.trim())
@@ -1499,15 +1597,15 @@ var init_plan_project_link_contract = __esm(() => {
 });
 
 // src/lib/config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join4 } from "path";
 function getConfigPath() {
-  return join3(getTodosGlobalDir(), "config.json");
+  return join4(getTodosGlobalDir(), "config.json");
 }
 function loadConfig() {
   if (cached)
     return cached;
-  if (!existsSync3(getConfigPath())) {
+  if (!existsSync4(getConfigPath())) {
     cached = {};
     return cached;
   }
@@ -5357,7 +5455,7 @@ async function retryOnTransientPostgresError(fn, attempts = 2, delayMs = 150) {
       lastError = error;
       if (!isTransientPostgresError(error) || attempt === attempts)
         throw error;
-      await new Promise((resolve) => setTimeout(resolve, delayMs * attempt));
+      await new Promise((resolve2) => setTimeout(resolve2, delayMs * attempt));
     }
   }
   throw lastError;
@@ -11134,9 +11232,9 @@ var init_schema = __esm(() => {
 });
 
 // src/db/machines.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { hostname as osHostname, platform as osPlatform, arch as osArch } from "os";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 import { spawnSync } from "child_process";
 function parseMetadata(value) {
   if (!value)
@@ -11167,7 +11265,7 @@ function discoverGitRoot(workspacePath) {
 }
 function topologyMetadata(input, existing = {}) {
   const next = { ...existing };
-  const workspacePath = input.workspace_path ? resolve(input.workspace_path) : undefined;
+  const workspacePath = input.workspace_path ? resolve2(input.workspace_path) : undefined;
   const entries = {
     tailscale_name: input.tailscale_name,
     tailscale_ip: input.tailscale_ip,
@@ -11341,7 +11439,7 @@ function getMachineTopologyDiagnostics(opts = {}, db, at = new Date) {
         message: `${project.name} has ${distinctPaths.length} different machine-local paths`
       });
     }
-    if (localRow && !existsSync4(localRow.path)) {
+    if (localRow && !existsSync5(localRow.path)) {
       pathIssues.push({
         type: "path_missing",
         project_id: project.id,
@@ -11352,7 +11450,7 @@ function getMachineTopologyDiagnostics(opts = {}, db, at = new Date) {
         message: `Local path does not exist on this machine: ${localRow.path}`
       });
     }
-    if (!localRow && project.path && machineById.has(localMachine.id) && !existsSync4(project.path)) {
+    if (!localRow && project.path && machineById.has(localMachine.id) && !existsSync5(project.path)) {
       pathIssues.push({
         type: "path_missing",
         project_id: project.id,
@@ -11729,18 +11827,18 @@ __export(exports_database, {
   LOCK_EXPIRY_MINUTES: () => LOCK_EXPIRY_MINUTES
 });
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname2, join as join4, resolve as resolve2 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
 function isInMemoryDb(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
 function findNearestProjectDb(startDir) {
   const gitRoot = findGitRoot(startDir);
-  const stopAt = gitRoot ? resolve2(gitRoot) : resolve2(startDir);
-  let dir = resolve2(startDir);
+  const stopAt = gitRoot ? resolve3(gitRoot) : resolve3(startDir);
+  let dir = resolve3(startDir);
   while (true) {
-    const candidate = join4(dir, ".hasna", "todos", "todos.db");
-    if (existsSync5(candidate))
+    const candidate = join5(dir, ".hasna", "todos", "todos.db");
+    if (existsSync6(candidate))
       return candidate;
     if (dir === stopAt)
       break;
@@ -11752,9 +11850,9 @@ function findNearestProjectDb(startDir) {
   return null;
 }
 function findGitRoot(startDir) {
-  let dir = resolve2(startDir);
+  let dir = resolve3(startDir);
   while (true) {
-    if (existsSync5(join4(dir, ".git")))
+    if (existsSync6(join5(dir, ".git")))
       return dir;
     const parent = dirname2(dir);
     if (parent === dir)
@@ -11764,7 +11862,7 @@ function findGitRoot(startDir) {
   return null;
 }
 function getGlobalDbPath() {
-  return join4(getHomeDir(), ".hasna", "todos", "todos.db");
+  return join5(getTodosGlobalDir(), "todos.db");
 }
 function hasExplicitProjectArg(args = process.argv.slice(2)) {
   return args.some((arg) => arg === "--project" || arg.startsWith("--project="));
@@ -11802,7 +11900,7 @@ function getDbPath() {
   if (process.env["TODOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot && canCreateScopedProjectDb()) {
-      return join4(gitRoot, ".hasna", "todos", "todos.db");
+      return join5(gitRoot, ".hasna", "todos", "todos.db");
     }
   }
   return getGlobalDbPath();
@@ -11813,8 +11911,8 @@ function getDatabasePath() {
 function ensureDir2(filePath) {
   if (isInMemoryDb(filePath))
     return;
-  const dir = dirname2(resolve2(filePath));
-  if (!existsSync5(dir)) {
+  const dir = dirname2(resolve3(filePath));
+  if (!existsSync6(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
 }
@@ -12653,14 +12751,14 @@ var init_completion_guard = __esm(() => {
 
 // src/lib/event-emission-safety.ts
 import { tmpdir } from "os";
-import { resolve as resolve3, sep } from "path";
+import { resolve as resolve4, sep } from "path";
 function envFlag(name) {
   const value = process.env[name]?.trim().toLowerCase();
   return value === "1" || value === "true" || value === "yes" || value === "on";
 }
 function isUnder(parent, child) {
-  const normalizedParent = resolve3(parent);
-  const normalizedChild = resolve3(child);
+  const normalizedParent = resolve4(parent);
+  const normalizedChild = resolve4(child);
   return normalizedChild === normalizedParent || normalizedChild.startsWith(`${normalizedParent}${sep}`);
 }
 function databasePathFromDatabase(db) {
@@ -12703,9 +12801,9 @@ var init_event_emission_safety = __esm(() => {
 });
 
 // src/lib/workspace-trust.ts
-import { relative, resolve as resolve4 } from "path";
+import { relative, resolve as resolve5 } from "path";
 function normalizePath(path) {
-  return resolve4(path);
+  return resolve5(path);
 }
 function unique2(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -12887,9 +12985,9 @@ var init_workspace_trust = __esm(() => {
 });
 
 // src/lib/runner-sandbox.ts
-import { relative as relative2, resolve as resolve5 } from "path";
+import { relative as relative2, resolve as resolve6 } from "path";
 function normalizePath2(path) {
-  return resolve5(path);
+  return resolve6(path);
 }
 function unique3(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -13079,7 +13177,7 @@ var init_runner_sandbox = __esm(() => {
 // src/lib/event-hooks.ts
 import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
-import { dirname as dirname3, resolve as resolve6 } from "path";
+import { dirname as dirname3, resolve as resolve7 } from "path";
 import { createConnection } from "net";
 function safeName(name) {
   const trimmed = name.trim();
@@ -13217,7 +13315,7 @@ async function deliverHook(hook, envelope) {
       if (hook.target === "stdout") {
         output = line.trim();
       } else if (hook.target === "file") {
-        const filePath = resolve6(hook.file_path);
+        const filePath = resolve7(hook.file_path);
         mkdirSync3(dirname3(filePath), { recursive: true });
         appendFileSync(filePath, line);
       } else if (hook.target === "socket") {
@@ -13338,9 +13436,9 @@ var init_event_hooks = __esm(() => {
 // node_modules/.bun/@hasna+events@0.1.16/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
-import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join6 } from "path";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { randomUUID as randomUUID3 } from "crypto";
 import { spawn } from "child_process";
@@ -13441,7 +13539,7 @@ function channelMatchesEvent(channel, event) {
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join5(homedir2(), ".hasna", "events");
+  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join6(homedir4(), ".hasna", "events");
 }
 
 class JsonEventsStore {
@@ -13450,12 +13548,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir = getEventsDataDir()) {
-    this.dataDir = dataDir;
-    this.runtime = localJsonRuntime(dataDir);
-    this.channelsPath = join5(dataDir, "channels.json");
-    this.eventsPath = join5(dataDir, "events.json");
-    this.deliveriesPath = join5(dataDir, "deliveries.json");
+  constructor(dataDir2 = getEventsDataDir()) {
+    this.dataDir = dataDir2;
+    this.runtime = localJsonRuntime(dataDir2);
+    this.channelsPath = join6(dataDir2, "channels.json");
+    this.eventsPath = join6(dataDir2, "events.json");
+    this.deliveriesPath = join6(dataDir2, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -13572,7 +13670,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync6(path)) {
+    if (!existsSync7(path)) {
       await writeFile(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -13602,7 +13700,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir = getEventsDataDir()) {
+function localJsonRuntime(dataDir2 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -13615,7 +13713,7 @@ function localJsonRuntime(dataDir = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir2}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -13794,7 +13892,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -13812,7 +13910,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve7({
+      resolve8({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -13825,7 +13923,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve7({
+      resolve8({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -14167,7 +14265,7 @@ function normalizeRetryPolicy(policy) {
   };
 }
 var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
-var init_dist = __esm(() => {
+var init_dist2 = __esm(() => {
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
   EventValidationError = class EventValidationError extends Error {
     eventType;
@@ -14587,7 +14685,7 @@ function emitSharedTaskEventQuiet(input) {
 }
 var SOURCE = "todos";
 var init_shared_events = __esm(() => {
-  init_dist();
+  init_dist2();
   init_database();
   init_projects();
   init_task_lists();
@@ -16449,17 +16547,17 @@ function sanitizeCreateTaskInput(input) {
   return {
     ...input,
     title: sanitizePreWriteText(input.title, "task.title"),
-    description: input.description !== undefined ? sanitizePreWriteText(input.description, "task.description") : undefined,
+    description: input.description == null ? input.description : sanitizePreWriteText(input.description, "task.description"),
     tags: input.tags !== undefined ? sanitizePreWriteValue(input.tags, "task.tags") : undefined,
     metadata: input.metadata !== undefined ? sanitizePreWriteValue(input.metadata, "task.metadata") : undefined,
-    reason: input.reason !== undefined ? sanitizePreWriteText(input.reason, "task.reason") : undefined
+    reason: input.reason == null ? input.reason : sanitizePreWriteText(input.reason, "task.reason")
   };
 }
 function sanitizeUpdateTaskInput(input) {
   return {
     ...input,
     title: input.title !== undefined ? sanitizePreWriteText(input.title, "task.title") : undefined,
-    description: input.description !== undefined ? sanitizePreWriteText(input.description, "task.description") : undefined,
+    description: input.description == null ? input.description : sanitizePreWriteText(input.description, "task.description"),
     tags: input.tags !== undefined ? sanitizePreWriteValue(input.tags, "task.tags") : undefined,
     metadata: input.metadata !== undefined ? sanitizePreWriteValue(input.metadata, "task.metadata") : undefined
   };
@@ -18456,28 +18554,28 @@ var init_boards = __esm(() => {
 
 // src/lib/artifact-store.ts
 import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname4, join as join6, resolve as resolve7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname as dirname4, join as join7, resolve as resolve8 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function isInMemoryDb2(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
 function artifactStoreRoot() {
   if (process.env["HASNA_TODOS_ARTIFACTS_DIR"])
-    return resolve7(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
+    return resolve8(process.env["HASNA_TODOS_ARTIFACTS_DIR"]);
   if (process.env["TODOS_ARTIFACTS_DIR"])
-    return resolve7(process.env["TODOS_ARTIFACTS_DIR"]);
+    return resolve8(process.env["TODOS_ARTIFACTS_DIR"]);
   const dbPath = getDatabasePath();
   if (isInMemoryDb2(dbPath))
-    return join6(tmpdir2(), "hasna-todos-artifacts");
-  return join6(dirname4(resolve7(dbPath)), "artifacts");
+    return join7(tmpdir2(), "hasna-todos-artifacts");
+  return join7(dirname4(resolve8(dbPath)), "artifacts");
 }
 function artifactStorePath(relativePath) {
   const normalized = relativePath.replace(/\\/g, "/");
   if (normalized.includes("..") || normalized.startsWith("/") || normalized.length === 0) {
     throw new Error("Invalid artifact store path");
   }
-  return join6(artifactStoreRoot(), normalized);
+  return join7(artifactStoreRoot(), normalized);
 }
 function sha2562(buffer) {
   return createHash6("sha256").update(buffer).digest("hex");
@@ -18517,8 +18615,8 @@ function mediaTypeFor(path, textLike) {
   return "application/octet-stream";
 }
 function storeArtifactContent(input) {
-  const sourcePath = resolve7(input.path);
-  if (!existsSync7(sourcePath))
+  const sourcePath = resolve8(input.path);
+  if (!existsSync8(sourcePath))
     return null;
   const sourceStat = statSync2(sourcePath);
   if (!sourceStat.isFile())
@@ -18535,9 +18633,9 @@ function storeArtifactContent(input) {
       redactionStatus = "redacted";
   }
   const storedSha = sha2562(storedBuffer);
-  const relativePath = join6("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
+  const relativePath = join7("sha256", storedSha.slice(0, 2), storedSha).replace(/\\/g, "/");
   const destination = artifactStorePath(relativePath);
-  if (!existsSync7(destination)) {
+  if (!existsSync8(destination)) {
     mkdirSync4(dirname4(destination), { recursive: true });
     writeFileSync2(destination, storedBuffer);
   }
@@ -18597,7 +18695,7 @@ function verifyStoredArtifact(input) {
     };
   }
   const storedPath = artifactStorePath(store.relative_path);
-  if (!existsSync7(storedPath)) {
+  if (!existsSync8(storedPath)) {
     return {
       id: input.id,
       path: input.path,
@@ -31161,8 +31259,8 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runTodosDoctor: () => runTodosDoctor
 });
-import { chmodSync, copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync5, statSync as statSync3 } from "fs";
-import { basename as basename2, dirname as dirname5, join as join7 } from "path";
+import { chmodSync, copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync5, statSync as statSync3 } from "fs";
+import { basename as basename2, dirname as dirname5, join as join8 } from "path";
 function tableExists2(db, table) {
   return Boolean(db.query("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(table));
 }
@@ -31256,7 +31354,7 @@ function findMissingProjectRoots(db) {
       continue;
     if (!row.path.startsWith("/"))
       continue;
-    if (!existsSync8(row.path))
+    if (!existsSync9(row.path))
       missing++;
   }
   return missing;
@@ -31316,16 +31414,16 @@ function databasePermissionsAreUnsafe(dbPath) {
 function createBackup(dbPath) {
   if (dbPath === ":memory:" || dbPath.startsWith("file::memory:"))
     return;
-  if (!existsSync8(dbPath))
+  if (!existsSync9(dbPath))
     return;
   const stamp = now().replace(/[:.]/g, "-");
-  const backupDir = join7(dirname5(dbPath), `${basename2(dbPath)}.backup-${stamp}`);
+  const backupDir = join8(dirname5(dbPath), `${basename2(dbPath)}.backup-${stamp}`);
   const files = [];
   mkdirSync5(backupDir, { recursive: true });
   for (const source of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
-    if (!existsSync8(source))
+    if (!existsSync9(source))
       continue;
-    const target = join7(backupDir, basename2(source));
+    const target = join8(backupDir, basename2(source));
     copyFileSync(source, target);
     files.push(target);
   }
@@ -31584,7 +31682,7 @@ var init_doctor = __esm(() => {
 });
 
 // src/server/routes.ts
-import { join as join8, resolve as resolve8, sep as sep2 } from "path";
+import { join as join9, resolve as resolve9, sep as sep2 } from "path";
 function parseFieldsParam(url) {
   const fieldsParam = url.searchParams.get("fields");
   return fieldsParam ? fieldsParam.split(",").map((f) => f.trim()).filter(Boolean) : undefined;
@@ -32421,9 +32519,9 @@ function handleStaticFiles(path, method, ctx, json5, serveStaticFile2) {
   if (!ctx.dashboardExists || method !== "GET" && method !== "HEAD")
     return null;
   if (path !== "/") {
-    const filePath = join8(ctx.dashboardDir, path);
-    const resolvedFile = resolve8(filePath);
-    const resolvedBase = resolve8(ctx.dashboardDir);
+    const filePath = join9(ctx.dashboardDir, path);
+    const resolvedFile = resolve9(filePath);
+    const resolvedBase = resolve9(ctx.dashboardDir);
     if (!resolvedFile.startsWith(resolvedBase + sep2) && resolvedFile !== resolvedBase) {
       return json5({ error: "Forbidden" }, 403);
     }
@@ -32431,7 +32529,7 @@ function handleStaticFiles(path, method, ctx, json5, serveStaticFile2) {
     if (res2)
       return res2;
   }
-  const indexPath = join8(ctx.dashboardDir, "index.html");
+  const indexPath = join9(ctx.dashboardDir, "index.html");
   const res = serveStaticFile2(indexPath);
   if (res)
     return res;
@@ -32538,7 +32636,7 @@ class TodosShadowOutbox {
         const remaining = deadline - Date.now();
         if (remaining <= 0)
           break;
-        await new Promise((resolve9) => setTimeout(resolve9, Math.min(200, remaining)));
+        await new Promise((resolve10) => setTimeout(resolve10, Math.min(200, remaining)));
       }
     }
     return this.getStats();
@@ -44573,9 +44671,9 @@ data:
       const initRequest = messages.find((m) => isInitializeRequest(m));
       const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
       if (this._enableJsonResponse) {
-        return new Promise((resolve9) => {
+        return new Promise((resolve10) => {
           this._streamMapping.set(streamId, {
-            resolveJson: resolve9,
+            resolveJson: resolve10,
             cleanup: () => {
               this._streamMapping.delete(streamId);
             }
@@ -47002,7 +47100,7 @@ class Protocol {
           return;
         }
         const pollInterval = task3.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1000;
-        await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
+        await new Promise((resolve10) => setTimeout(resolve10, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error3) {
@@ -47014,7 +47112,7 @@ class Protocol {
   }
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task: task2, relatedTask } = options ?? {};
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       const earlyReject = (error3) => {
         reject(error3);
       };
@@ -47092,7 +47190,7 @@ class Protocol {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve9(parseResult.data);
+            resolve10(parseResult.data);
           }
         } catch (error3) {
           reject(error3);
@@ -47283,12 +47381,12 @@ class Protocol {
         interval = task2.pollInterval;
       }
     } catch {}
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve9, interval);
+      const timeoutId = setTimeout(resolve10, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -50273,7 +50371,7 @@ var require_compile = __commonJS((exports) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve9.call(this, root, ref);
+    let _sch = resolve10.call(this, root, ref);
     if (_sch === undefined) {
       const schema2 = (_a = root.localRefs) === null || _a === undefined ? undefined : _a[ref];
       const { schemaId } = this.opts;
@@ -50300,7 +50398,7 @@ var require_compile = __commonJS((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve9(root, ref) {
+  function resolve10(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -50886,7 +50984,7 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     return uri;
   }
-  function resolve9(baseURI, relativeURI, options) {
+  function resolve10(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse6(baseURI, schemelessOptions), parse6(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -51145,7 +51243,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   var fastUri = {
     SCHEMES,
     normalize: normalize2,
-    resolve: resolve9,
+    resolve: resolve10,
     resolveComponent,
     equal,
     serialize,
@@ -54716,7 +54814,7 @@ class McpServer {
     let task2 = createTaskResult.task;
     const pollInterval = task2.pollInterval ?? 5000;
     while (task2.status !== "completed" && task2.status !== "failed" && task2.status !== "cancelled") {
-      await new Promise((resolve9) => setTimeout(resolve9, pollInterval));
+      await new Promise((resolve10) => setTimeout(resolve10, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -55361,12 +55459,12 @@ class StdioServerTransport {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve9) => {
+    return new Promise((resolve10) => {
       const json7 = serializeMessage(message);
       if (this._stdout.write(json7)) {
-        resolve9();
+        resolve10();
       } else {
-        this._stdout.once("drain", resolve9);
+        this._stdout.once("drain", resolve10);
       }
     });
   }
@@ -56515,10 +56613,10 @@ var init_token_utils = __esm(() => {
 
 // src/lib/assignee-validation.ts
 import { readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join10 } from "path";
 function defaultSeatRosterPath() {
-  return process.env["TODOS_SEAT_ROSTER_PATH"] || join9(homedir3(), ".hasna", "identities", "hasna-seats.roster.json");
+  return process.env["TODOS_SEAT_ROSTER_PATH"] || join10(homedir5(), ".hasna", "identities", "hasna-seats.roster.json");
 }
 function loadSeatSlugs(path = defaultSeatRosterPath()) {
   try {
@@ -56608,10 +56706,11 @@ var init_assignee_context = __esm(() => {
   init_assignee_validation();
 });
 
-// node_modules/.bun/@hasna+contracts@0.14.0+619f74e7b30eeaf4/node_modules/@hasna/contracts/dist/client/storage.js
+// node_modules/.bun/@hasna+contracts@0.14.2+a5fb9613d5af3331/node_modules/@hasna/contracts/dist/client/storage.js
 import { isIP } from "net";
 import { readFileSync as readFileSync5, statSync as statSync4 } from "fs";
-import { join as join10 } from "path";
+import { createRequire } from "module";
+import { join as join11 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -56625,24 +56724,48 @@ function clientTransportEnvKeys(name) {
 function credentialOverrideEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
-function credentialDiskSources(name, env) {
-  return profileDiskSources(name, env, null);
-}
-function profileDiskSources(name, env, profile) {
+function credentialDiskSourceList(name, env, profile = null) {
   const home = homeDir(env);
   if (!home || !SAFE_APP_SLUG.test(name))
     return [];
   const stem = profile ? `${name}.${profile}` : name;
   const configStem = profile ? `${name}-${profile}` : name;
   return [
-    join10(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
-    join10(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+    {
+      path: join11(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+      tier: "fleet-env",
+      deprecated: false
+    },
+    {
+      path: join11(home, HASNA_STATE_DIR, LEGACY_CLOUD_DIR, `${stem}.env`),
+      tier: "legacy-cloud",
+      deprecated: true
+    },
+    {
+      path: join11(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}.env`),
+      tier: "config",
+      deprecated: false
+    },
+    {
+      path: join11(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`),
+      tier: "config-legacy",
+      deprecated: true
+    }
   ];
 }
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
 function parseEnvFile(text) {
   const values = new Map;
   for (const rawLine of text.split(/\r?\n/)) {
@@ -56709,6 +56832,9 @@ function appConfigDiskValue(name, env, keys) {
   return null;
 }
 function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
   if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
@@ -56730,6 +56856,14 @@ function sealCredential(fields) {
     writable: false,
     configurable: false
   });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
   Object.defineProperty(sealed, INSPECT_CUSTOM, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
@@ -56781,7 +56915,8 @@ function validateAndSealResolvedCredential(appName, credential) {
     deliberate: credential.deliberate,
     deprecated: credential.deprecated,
     diskCandidates: credential.diskCandidates,
-    warning: credential.warning
+    warning: credential.warning,
+    ...credential.pointerVaultKey !== undefined ? { pointerVaultKey: credential.pointerVaultKey } : {}
   });
 }
 function firstEnvValue(env, keys) {
@@ -56841,6 +56976,27 @@ function resolveCredential(name, env, options = {}) {
       warning: null
     });
   }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = env[pointerKeyName];
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
   const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
   if (profile) {
     const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
@@ -56865,26 +57021,42 @@ function resolveCredential(name, env, options = {}) {
     }
     throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
-  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.path, winner.value);
+    assertUsableCredential(name, winner.src.path, winner.value);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
       ...(() => {
         const legacyHit = firstEnvValue(env, apiKeyKeys);
         return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
       })()
     ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    let deprecated = winner.src.deprecated;
+    let finalWarning = warning;
+    if (winner.src.deprecated) {
+      deprecated = true;
+      const sink = options.onDeprecation ?? defaultDeprecationSink;
+      const notified = deprecationNotified();
+      const noticeKey = `${name}:${winner.src.path}`;
+      if (!notified.has(noticeKey)) {
+        notified.add(noticeKey);
+        const target = diskSourceList[0]?.path ?? "<none>";
+        const message = `[${name}] DEPRECATED: the API key came from ${winner.src.path} \u2014 a legacy credential location. ` + `The primary location is ${target} (~/.hasna/fleet-env/<app>.env). The legacy 'cloud' tiers are ` + `removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}. Migrate the key to the primary location.`;
+        sink(message);
+      }
+      finalWarning = [warning, `Legacy credential source: ${winner.src.path}. Removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}.`].filter(Boolean).join(" ") || null;
+    }
     return sealCredential({
       apiKey: winner.value,
-      tier: "disk",
-      source: winner.path,
+      tier: winner.src.tier,
+      source: winner.src.path,
       deliberate: false,
-      deprecated: false,
+      deprecated,
       diskCandidates: diskPaths,
-      warning
+      warning: finalWarning
     });
   }
   const legacy = firstEnvValue(env, apiKeyKeys);
@@ -56910,6 +57082,45 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    secretsSdk = requireSecretsSdk(SECRETS_PACKAGE_SPECIFIER);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    client = secretsSdk.createSecretsClientFromEnv(env);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: true,
+    deprecated: false,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
 function isValidDnsDomain(value) {
   if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN.test(value) || /[^\x00-\x7f]/.test(value)) {
     return false;
@@ -57133,6 +57344,13 @@ function currentCredential(name, apiKey) {
   }
   return explicitCredential(name, apiKey);
 }
+async function resolveRequestCredential(name, apiKey, env = process.env) {
+  const resolved = currentCredential(name, apiKey);
+  if (resolved.tier === "pointer") {
+    return completePointerCredential(name, resolved, env);
+  }
+  return resolved;
+}
 function authFailureGuidance(credential) {
   const origin = `The API key for this request came from ${credential.source}`;
   if (credential.deliberate) {
@@ -57278,7 +57496,7 @@ function createHasnaHttpTransport(options) {
     const retry = resolveRetry(opts.retry);
     const methodRetryable = IDEMPOTENT_METHODS.has(upper) || Boolean(opts.idempotencyKey);
     const maxAttempts = retry && methodRetryable ? retry.retries + 1 : 1;
-    const credential = currentCredential(options.name, options.apiKey);
+    const credential = await resolveRequestCredential(options.name, options.apiKey);
     let last = null;
     for (let attempt = 1;attempt <= maxAttempts; attempt++) {
       const result = await once(upper, rel, url, body2, opts, credential);
@@ -57441,7 +57659,7 @@ function resolveStorageClient(name, env = process.env, overrides) {
   }
   return { transport: "sqlite", client: null };
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider", DEPRECATION_REGISTRY, ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, HasnaHttpError, DEFAULT_RETRY_STATUSES, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS, defaultSleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "fleet-env", LEGACY_CLOUD_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", LEGACY_CLOUD_REMOVAL_DEADLINE = "2026-10-01", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider", DEPRECATION_REGISTRY, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, HasnaHttpError, DEFAULT_RETRY_STATUSES, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS, defaultSleep = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
 var init_storage = __esm(() => {
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
@@ -57457,10 +57675,13 @@ var init_storage = __esm(() => {
   SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
   ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
   CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
   INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
   CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
   DEPRECATION_REGISTRY = Symbol.for("hasna:contracts:credentialDeprecationNotices");
+  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+  requireSecretsSdk = createRequire(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   HasnaHttpError = class HasnaHttpError extends Error {
@@ -58339,7 +58560,7 @@ var init_page_validation = __esm(() => {
 
 // src/cli/cloud-router.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { resolve as resolvePath } from "path";
+import { resolve as resolvePath2 } from "path";
 function emitTodosLocalFallbackNotice(env) {
   if (todosLocalFallbackNoticeEmitted)
     return;
@@ -58399,15 +58620,23 @@ function normalizeRemoteAuthorityUrl(value) {
   if (url.search || url.hash) {
     throw new Error("REMOTE_API_URL_INVALID: HASNA_TODOS_API_URL must not contain a query or fragment; local SQLite fallback is disabled");
   }
-  if (url.pathname !== "/" && url.pathname !== "/v1" && url.pathname !== "/v1/") {
-    throw new Error("REMOTE_API_URL_INVALID: HASNA_TODOS_API_URL must be an authority root or end in /v1, not /api/v1 or another path; " + "local SQLite fallback is disabled");
+  const path = url.pathname.replace(/\/+$/, "");
+  const segments = path.split("/").filter(Boolean);
+  const reservedGatewaySegments = new Set(["api", "v1"]);
+  const isRoot = path === "";
+  const isV1Root = segments.length === 1 && segments[0] === "v1";
+  const isAppRoot = segments.length === 1 && !reservedGatewaySegments.has(segments[0].toLowerCase());
+  const isAppV1Root = segments.length === 2 && segments[1] === "v1" && !reservedGatewaySegments.has(segments[0].toLowerCase());
+  if (!isRoot && !isV1Root && !isAppRoot && !isAppV1Root) {
+    throw new Error("REMOTE_API_URL_INVALID: HASNA_TODOS_API_URL must be an authority root, /v1, or <app>[/v1], not /api/v1 or another path; " + "local SQLite fallback is disabled");
   }
   const hostname3 = url.hostname.toLowerCase();
   const loopback = hostname3 === "localhost" || hostname3 === "::1" || hostname3 === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname3);
   if (url.protocol === "http:" && !loopback) {
     throw new Error("REMOTE_API_URL_INVALID: plaintext HTTP is allowed only for loopback Todos authorities; local SQLite fallback is disabled");
   }
-  return url.origin;
+  const rootPath = isV1Root || isAppV1Root ? path.slice(0, -"/v1".length) : path;
+  return rootPath ? `${url.origin}${rootPath}` : url.origin;
 }
 function getTodosRemoteAuthorityConfigStatus(env = process.env) {
   let resolution;
@@ -58905,11 +59134,11 @@ function resolveCloudProjectRef(projects, ref) {
   const input = ref.trim();
   const normalizedRef = input.toLowerCase();
   const pathLike = input.startsWith(".") || input.includes("/") || input.includes("\\");
-  const normalizedPath = pathLike ? resolvePath(input) : undefined;
+  const normalizedPath = pathLike ? resolvePath2(input) : undefined;
   const slug = cloudProjectSlug(pathLike ? cloudProjectPathBasename(input) : input);
   const matchGroups = [
     uniqueProjectMatches(projects, (project) => project.id.toLowerCase() === normalizedRef),
-    uniqueProjectMatches(projects, (project) => project.path === input || normalizedPath !== undefined && resolvePath(project.path) === normalizedPath),
+    uniqueProjectMatches(projects, (project) => project.path === input || normalizedPath !== undefined && resolvePath2(project.path) === normalizedPath),
     uniqueProjectMatches(projects, (project) => project.name.toLowerCase() === normalizedRef),
     uniqueProjectMatches(projects, (project) => project.task_list_id === input || cloudProjectSlug(project.name) === slug || cloudProjectSlug(cloudProjectPathBasename(project.path)) === slug),
     uniqueProjectMatches(projects, (project) => project.id.toLowerCase().startsWith(normalizedRef))
@@ -59493,8 +59722,8 @@ var init_task_crud2 = __esm(() => {
 });
 
 // src/lib/project-bootstrap.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6, statSync as statSync5 } from "fs";
-import { basename as basename3, dirname as dirname6, resolve as resolve9 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync6, statSync as statSync5 } from "fs";
+import { basename as basename3, dirname as dirname6, resolve as resolve10 } from "path";
 function safeStat(path) {
   try {
     return statSync5(path);
@@ -59503,7 +59732,7 @@ function safeStat(path) {
   }
 }
 function canonicalPath(input) {
-  const resolved = resolve9(input);
+  const resolved = resolve10(input);
   const stats = safeStat(resolved);
   if (stats?.isFile())
     return dirname6(resolved);
@@ -59512,7 +59741,7 @@ function canonicalPath(input) {
 function findUp(start, marker) {
   let current = canonicalPath(start);
   while (true) {
-    if (existsSync9(resolve9(current, marker)))
+    if (existsSync10(resolve10(current, marker)))
       return current;
     const parent = dirname6(current);
     if (parent === current)
@@ -59523,8 +59752,8 @@ function findUp(start, marker) {
 function readPackageJson(path) {
   if (!path)
     return null;
-  const file = resolve9(path, "package.json");
-  if (!existsSync9(file))
+  const file = resolve10(path, "package.json");
+  if (!existsSync10(file))
     return null;
   try {
     const parsed = JSON.parse(readFileSync6(file, "utf-8"));
@@ -59546,7 +59775,7 @@ function workspaceMarker(root, rootPackage) {
   if (rootPackage?.workspaces)
     markers.push("package.json#workspaces");
   for (const marker of ["pnpm-workspace.yaml", "turbo.json", "nx.json", "lerna.json", "rush.json", "bun.lock", "bun.lockb"]) {
-    if (existsSync9(resolve9(root, marker)))
+    if (existsSync10(resolve10(root, marker)))
       markers.push(marker);
   }
   const kind = markers.find((marker) => marker !== "bun.lock" && marker !== "bun.lockb") ?? null;
@@ -59859,7 +60088,7 @@ var init_tags = __esm(() => {
 });
 
 // src/lib/retention-cleanup.ts
-import { existsSync as existsSync10, unlinkSync } from "fs";
+import { existsSync as existsSync11, unlinkSync } from "fs";
 function normalizeScopes(scopes) {
   if (!scopes || scopes.length === 0)
     return [...ALL_SCOPES];
@@ -60062,7 +60291,7 @@ function applyRetentionCleanup(input, db) {
   for (const artifact of report.candidates.artifact_files) {
     try {
       const path = artifactStorePath(artifact.relative_path);
-      if (!existsSync10(path)) {
+      if (!existsSync11(path)) {
         report.warnings.push(`stored artifact already missing: ${artifact.relative_path}`);
         continue;
       }
@@ -60089,8 +60318,8 @@ var init_retention_cleanup = __esm(() => {
 });
 
 // src/lib/mention-resolver.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync6 } from "fs";
-import { basename as basename4, isAbsolute, join as join11, relative as relative3, resolve as resolve10, sep as sep3 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync6 } from "fs";
+import { basename as basename4, isAbsolute, join as join12, relative as relative3, resolve as resolve11, sep as sep3 } from "path";
 function blankResolution(parsed) {
   return {
     input: parsed.input,
@@ -60113,7 +60342,7 @@ function backlink(kind, key2, label, target = key2) {
   return { kind, key: key2, label, target };
 }
 function normalizeWorkspace(workspace) {
-  return resolve10(workspace || process.cwd());
+  return resolve11(workspace || process.cwd());
 }
 function isInside(root, absolutePath) {
   const rel = relative3(root, absolutePath);
@@ -60181,14 +60410,14 @@ function resolveFile(parsed, workspace) {
     resolution.warnings.push("path is empty or escapes the workspace");
     return resolution;
   }
-  const absolutePath = resolve10(workspace, relPath);
+  const absolutePath = resolve11(workspace, relPath);
   if (!isInside(workspace, absolutePath)) {
     resolution.path = relPath;
     resolution.warnings.push("path escapes the workspace");
     return resolution;
   }
   resolution.path = relPath;
-  if (!existsSync11(absolutePath)) {
+  if (!existsSync12(absolutePath)) {
     resolution.warnings.push("file does not exist in the local workspace");
     return resolution;
   }
@@ -60221,7 +60450,7 @@ function walkSourceFiles(root, current = root, files = []) {
       if (SKIP_DIRS.has(entry2.name))
         continue;
     }
-    const absolutePath = join11(current, entry2.name);
+    const absolutePath = join12(current, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIP_DIRS.has(entry2.name))
         walkSourceFiles(root, absolutePath, files);
@@ -60526,9 +60755,9 @@ var init_mention_resolver = __esm(() => {
 });
 
 // src/lib/policy-packs.ts
-import { relative as relative4, resolve as resolve11 } from "path";
+import { relative as relative4, resolve as resolve12 } from "path";
 function normalizePath3(path) {
-  return resolve11(path);
+  return resolve12(path);
 }
 function unique4(values) {
   return Array.from(new Set((values || []).map((value) => value.trim()).filter(Boolean)));
@@ -60583,7 +60812,7 @@ function commandMatches(commands, pattern) {
 }
 function pathMatches(paths, pattern, root) {
   return paths.filter((path) => {
-    const candidate = path.startsWith("/") ? path : resolve11(root, path);
+    const candidate = path.startsWith("/") ? path : resolve12(root, path);
     if (!isPathInside3(root, candidate))
       return matchesPattern3(path, pattern);
     return matchesPattern3(path, pattern) || matchesPattern3(relative4(root, candidate), pattern);
@@ -63962,7 +64191,7 @@ var init_audit_ledger = __esm(() => {
 
 // src/lib/release-compatibility.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { join as join12, resolve as resolve12 } from "path";
+import { join as join13, resolve as resolve13 } from "path";
 import { Database as Database2 } from "bun:sqlite";
 function pass(id, message, details) {
   return { id, status: "passed", message, details };
@@ -63974,7 +64203,7 @@ function warn(id, message, details) {
   return { id, status: "warning", message, details };
 }
 function readPackageJson2(root) {
-  return JSON.parse(readFileSync8(join12(root, "package.json"), "utf8"));
+  return JSON.parse(readFileSync8(join13(root, "package.json"), "utf8"));
 }
 function sortedKeys(value) {
   return Object.keys(value ?? {}).sort((left, right) => left.localeCompare(right));
@@ -64070,7 +64299,7 @@ function checkChangelog() {
   ];
 }
 function createReleaseCompatibilityReport(options = {}) {
-  const root = resolve12(options.root ?? process.cwd());
+  const root = resolve13(options.root ?? process.cwd());
   const packageJson = readPackageJson2(root);
   const simulatedLevels = options.simulated_levels ?? defaultSimulationLevels();
   const checks4 = [
@@ -91181,7 +91410,7 @@ var require_protocol = __commonJS((exports) => {
             return;
           }
           const pollInterval = task3.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1000;
-          await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+          await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
           options?.signal?.throwIfAborted();
         }
       } catch (error3) {
@@ -91193,7 +91422,7 @@ var require_protocol = __commonJS((exports) => {
     }
     request(request, resultSchema, options) {
       const { relatedRequestId, resumptionToken, onresumptiontoken, task: task2, relatedTask } = options ?? {};
-      return new Promise((resolve13, reject) => {
+      return new Promise((resolve14, reject) => {
         const earlyReject = (error3) => {
           reject(error3);
         };
@@ -91271,7 +91500,7 @@ var require_protocol = __commonJS((exports) => {
             if (!parseResult.success) {
               reject(parseResult.error);
             } else {
-              resolve13(parseResult.data);
+              resolve14(parseResult.data);
             }
           } catch (error3) {
             reject(error3);
@@ -91462,12 +91691,12 @@ var require_protocol = __commonJS((exports) => {
           interval = task2.pollInterval;
         }
       } catch {}
-      return new Promise((resolve13, reject) => {
+      return new Promise((resolve14, reject) => {
         if (signal.aborted) {
           reject(new types_js_1.McpError(types_js_1.ErrorCode.InvalidRequest, "Request cancelled"));
           return;
         }
-        const timeoutId = setTimeout(resolve13, interval);
+        const timeoutId = setTimeout(resolve14, interval);
         signal.addEventListener("abort", () => {
           clearTimeout(timeoutId);
           reject(new types_js_1.McpError(types_js_1.ErrorCode.InvalidRequest, "Request cancelled"));
@@ -92661,7 +92890,7 @@ var require_mcp = __commonJS((exports) => {
       let task2 = createTaskResult.task;
       const pollInterval = task2.pollInterval ?? 5000;
       while (task2.status !== "completed" && task2.status !== "failed" && task2.status !== "cancelled") {
-        await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+        await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
         const updatedTask = await extra.taskStore.getTask(taskId);
         if (!updatedTask) {
           throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -93980,7 +94209,7 @@ var init_agent_run_dispatcher = __esm(() => {
 });
 
 // src/lib/verification-providers.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
 function normalizeName5(name) {
   const normalized = name.trim().toLowerCase();
   if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(normalized)) {
@@ -94077,7 +94306,7 @@ function classifyLog(text) {
 async function sleep2(ms) {
   if (ms <= 0)
     return;
-  await new Promise((resolve13) => setTimeout(resolve13, ms));
+  await new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 async function runCommandProvider(provider, input) {
   const commandTemplate = input.command || provider.command;
@@ -94132,7 +94361,7 @@ Timed out after ${provider.timeout_ms}ms`);
   };
 }
 function runCiLogProvider(input) {
-  const text = input.log_text ?? (input.log_path && existsSync12(input.log_path) ? readFileSync9(input.log_path, "utf-8") : "");
+  const text = input.log_text ?? (input.log_path && existsSync13(input.log_path) ? readFileSync9(input.log_path, "utf-8") : "");
   return {
     status: classifyLog(text),
     attempts: 1,
@@ -94144,7 +94373,7 @@ function runBrowserProvider(input) {
   if (!input.artifact_path) {
     return { status: "unknown", attempts: 1, exit_code: null, output_summary: "browser provider needs a screenshot or artifact path" };
   }
-  if (!existsSync12(input.artifact_path)) {
+  if (!existsSync13(input.artifact_path)) {
     return { status: "failed", attempts: 1, exit_code: null, output_summary: `artifact not found: ${input.artifact_path}` };
   }
   return {
@@ -96874,7 +97103,7 @@ var init_local_bridge = __esm(() => {
 // src/lib/local-backups.ts
 import { createHash as createHash12 } from "crypto";
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname7, resolve as resolve13 } from "path";
+import { dirname as dirname7, resolve as resolve14 } from "path";
 import { mkdirSync as mkdirSync6 } from "fs";
 function stableJson2(value) {
   if (value === null || typeof value !== "object")
@@ -96976,14 +97205,14 @@ function createLocalBackup(options = {}, db) {
   return backup;
 }
 function writeLocalBackupFile(backup, outputPath) {
-  const path = resolve13(outputPath);
+  const path = resolve14(outputPath);
   mkdirSync6(dirname7(path), { recursive: true });
   writeFileSync3(path, `${JSON.stringify(backup, null, 2)}
 `);
   return path;
 }
 function readLocalBackupFile(path) {
-  return JSON.parse(readFileSync10(resolve13(path), "utf-8"));
+  return JSON.parse(readFileSync10(resolve14(path), "utf-8"));
 }
 function verifyLocalBackup(value, options = {}, db) {
   const verifiedAt = options.verified_at ?? now();
@@ -98435,8 +98664,8 @@ __export(exports_local_extensions, {
   discoverLocalExtensions: () => discoverLocalExtensions
 });
 import { createHash as createHash15, createVerify } from "crypto";
-import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync7 } from "fs";
-import { basename as basename5, join as join13, resolve as resolve14 } from "path";
+import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync7 } from "fs";
+import { basename as basename5, join as join14, resolve as resolve15 } from "path";
 function isObject3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -98694,11 +98923,11 @@ function verifyExtensionSignature(input) {
   return verifier.verify(input.public_key, decodeSignature(input.signature));
 }
 function inspectExtensionSource(source3) {
-  const resolved = resolve14(source3);
-  if (!existsSync13(resolved))
+  const resolved = resolve15(source3);
+  if (!existsSync14(resolved))
     throw new Error(`extension source not found: ${source3}`);
   const stat = statSync7(resolved);
-  const manifestPath = stat.isDirectory() ? [join13(resolved, "todos.extension.json"), join13(resolved, "extension.json")].find(existsSync13) : resolved;
+  const manifestPath = stat.isDirectory() ? [join14(resolved, "todos.extension.json"), join14(resolved, "extension.json")].find(existsSync14) : resolved;
   if (!manifestPath)
     throw new Error(`extension directory ${source3} is missing todos.extension.json`);
   const raw = readFileSync11(manifestPath);
@@ -98792,26 +99021,26 @@ function testExtensionCompatibility(sourceOrManifest) {
 function projectExtensionSources(projectPath) {
   if (!projectPath)
     return [];
-  const root = resolve14(projectPath);
+  const root = resolve15(projectPath);
   const candidates = [
-    join13(root, "todos.extension.json"),
-    join13(root, ".todos", "todos.extension.json")
+    join14(root, "todos.extension.json"),
+    join14(root, ".todos", "todos.extension.json")
   ];
-  const extensionDir = join13(root, ".todos", "extensions");
-  if (existsSync13(extensionDir)) {
+  const extensionDir = join14(root, ".todos", "extensions");
+  if (existsSync14(extensionDir)) {
     for (const entry2 of readdirSync3(extensionDir)) {
       if (entry2.startsWith("."))
         continue;
-      const full = join13(extensionDir, entry2);
+      const full = join14(extensionDir, entry2);
       if (statSync7(full).isDirectory() || entry2.endsWith(".json"))
         candidates.push(full);
     }
   }
-  return candidates.filter(existsSync13);
+  return candidates.filter(existsSync14);
 }
 function discoverLocalExtensions(options = {}) {
   const config2 = loadConfig();
-  const projectPath = options.project_path ? resolve14(options.project_path) : null;
+  const projectPath = options.project_path ? resolve15(options.project_path) : null;
   const configuredSources = [
     ...config2.extension_sources || [],
     ...projectPath ? config2.project_overrides?.[projectPath]?.extension_sources || [] : []
@@ -98819,7 +99048,7 @@ function discoverLocalExtensions(options = {}) {
   const sources = Array.from(new Set([
     ...configuredSources,
     ...projectExtensionSources(projectPath || undefined)
-  ])).map((source3) => projectPath && !source3.startsWith("/") ? resolve14(projectPath, source3) : resolve14(source3));
+  ])).map((source3) => projectPath && !source3.startsWith("/") ? resolve15(projectPath, source3) : resolve15(source3));
   const warnings = [];
   const discovered = [];
   for (const source3 of sources) {
@@ -103214,9 +103443,9 @@ __export(exports_extract, {
   buildCodebaseIndex: () => buildCodebaseIndex,
   EXTRACT_TAGS: () => EXTRACT_TAGS
 });
-import { existsSync as existsSync14, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
 import { createHash as createHash17 } from "crypto";
-import { relative as relative5, resolve as resolve15, join as join14 } from "path";
+import { relative as relative5, resolve as resolve16, join as join15 } from "path";
 function stableHash(value) {
   return createHash17("sha256").update(value).digest("hex");
 }
@@ -103224,9 +103453,9 @@ function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function readGitignorePatterns(basePath) {
-  const root = statSync8(basePath).isFile() ? resolve15(basePath, "..") : basePath;
-  const gitignorePath = join14(root, ".gitignore");
-  if (!existsSync14(gitignorePath))
+  const root = statSync8(basePath).isFile() ? resolve16(basePath, "..") : basePath;
+  const gitignorePath = join15(root, ".gitignore");
+  if (!existsSync15(gitignorePath))
     return [];
   try {
     return readFileSync12(gitignorePath, "utf-8").split(`
@@ -103360,7 +103589,7 @@ function collectFiles(basePath, extensions, excludes, respectGitignore) {
   return files.sort();
 }
 function buildCodebaseIndex(options) {
-  const basePath = resolve15(options.path);
+  const basePath = resolve16(options.path);
   const tags = options.patterns || [...EXTRACT_TAGS];
   const extensions = options.extensions ? new Set(options.extensions.map((e) => e.startsWith(".") ? e : `.${e}`)) : DEFAULT_EXTENSIONS;
   const excludes = options.exclude || [];
@@ -103368,10 +103597,10 @@ function buildCodebaseIndex(options) {
   const files = collectFiles(basePath, extensions, excludes, respectGitignore);
   const indexed = [];
   for (const file of files) {
-    const fullPath = statSync8(basePath).isFile() ? basePath : join14(basePath, file);
+    const fullPath = statSync8(basePath).isFile() ? basePath : join15(basePath, file);
     try {
       const source3 = readFileSync12(fullPath, "utf-8");
-      const relPath = statSync8(basePath).isFile() ? relative5(resolve15(basePath, ".."), fullPath) : file;
+      const relPath = statSync8(basePath).isFile() ? relative5(resolve16(basePath, ".."), fullPath) : file;
       indexed.push({
         file: relPath,
         checksum: stableHash(source3).slice(0, 24),
@@ -103391,7 +103620,7 @@ function buildCodebaseIndex(options) {
   };
 }
 function extractTodos(options, db) {
-  const basePath = resolve15(options.path);
+  const basePath = resolve16(options.path);
   const tags = options.patterns || [...EXTRACT_TAGS];
   const extensions = options.extensions ? new Set(options.extensions.map((e) => e.startsWith(".") ? e : `.${e}`)) : DEFAULT_EXTENSIONS;
   const excludes = options.exclude || [];
@@ -103399,10 +103628,10 @@ function extractTodos(options, db) {
   const files = collectFiles(basePath, extensions, excludes, respectGitignore);
   const allComments = [];
   for (const file of files) {
-    const fullPath = statSync8(basePath).isFile() ? basePath : join14(basePath, file);
+    const fullPath = statSync8(basePath).isFile() ? basePath : join15(basePath, file);
     try {
       const source3 = readFileSync12(fullPath, "utf-8");
-      const relPath = statSync8(basePath).isFile() ? relative5(resolve15(basePath, ".."), fullPath) : file;
+      const relPath = statSync8(basePath).isFile() ? relative5(resolve16(basePath, ".."), fullPath) : file;
       const comments = extractFromSource(source3, relPath, tags);
       allComments.push(...comments);
     } catch {}
@@ -103496,7 +103725,7 @@ async function watchSourceTodos(options, onRun) {
   const interval = Math.max(100, options.interval_ms || 2000);
   const once = options.once !== false && (!options.max_runs || options.max_runs <= 1);
   const maxRuns = options.max_runs ?? (once ? 1 : Number.POSITIVE_INFINITY);
-  const root = resolve15(options.path);
+  const root = resolve16(options.path);
   const runs = [];
   let previous = new Map;
   for (let runNumber = 1;runNumber <= maxRuns; runNumber++) {
@@ -104055,7 +104284,7 @@ Last seen: ${agent.last_seen_at}`
             `Suggested names: ${suggestions.slice(0, 8).join(", ")}`,
             allActive.length > 0 ? `Active agents (avoid these names): ${allActive.map((a) => `${a.name} (seen ${Math.round((Date.now() - new Date(a.last_seen_at).getTime()) / 60000)}m ago)`).join(", ")}` : "No active agents.",
             `
-To restrict names, configure agent_pool or project_pools in ~/.hasna/todos/config.json`
+To restrict names, configure agent_pool or project_pools in the todos data home config file (default <data home>/config.json)`
           ];
           return { content: [{ type: "text", text: lines2.join(`
 `) }] };
@@ -104358,7 +104587,7 @@ __export(exports_builtin_templates, {
   BUILTIN_TEMPLATES: () => BUILTIN_TEMPLATES
 });
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function templateMetadata(template) {
   return {
     source: BUILTIN_TEMPLATE_LIBRARY_SOURCE,
@@ -104417,7 +104646,7 @@ function writeBuiltinTemplateFiles(directory) {
   mkdirSync7(directory, { recursive: true });
   const files = [];
   for (const entry2 of exportBuiltinTemplateFiles()) {
-    const path = join15(directory, entry2.filename);
+    const path = join16(directory, entry2.filename);
     writeFileSync4(path, `${JSON.stringify(entry2.template, null, 2)}
 `, "utf-8");
     files.push(path);
@@ -104943,16 +105172,16 @@ __export(exports_environment_snapshots, {
   captureEnvironmentSnapshot: () => captureEnvironmentSnapshot
 });
 import { createHash as createHash18 } from "crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync13, statSync as statSync9 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync13, statSync as statSync9 } from "fs";
 import { hostname as hostname3, platform, arch } from "os";
-import { dirname as dirname8, join as join16, resolve as resolve16 } from "path";
+import { dirname as dirname8, join as join17, resolve as resolve17 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 function sha2567(value) {
   return createHash18("sha256").update(value).digest("hex");
 }
 function fileRecord(root, relativePath) {
-  const path = join16(root, relativePath);
-  if (!existsSync15(path))
+  const path = join17(root, relativePath);
+  if (!existsSync16(path))
     return null;
   const stat = statSync9(path);
   if (!stat.isFile())
@@ -104964,7 +105193,7 @@ function manifestRecord(root, relativePath) {
   const base = fileRecord(root, relativePath);
   if (!base)
     return null;
-  const parsed = readJsonFile(join16(root, relativePath));
+  const parsed = readJsonFile(join17(root, relativePath));
   if (!parsed)
     return { ...base, redacted: {} };
   const redacted = redactValue({
@@ -105059,15 +105288,15 @@ function commandEnv(env, includeValues) {
 function defaultSnapshotDir() {
   const dbPath = getDatabasePath();
   if (dbPath === ":memory:" || dbPath.startsWith("file::memory:"))
-    return join16(tmpdir3(), "hasna-todos", "environment-snapshots");
-  return join16(dirname8(resolve16(dbPath)), "environment-snapshots");
+    return join17(tmpdir3(), "hasna-todos", "environment-snapshots");
+  return join17(dirname8(resolve17(dbPath)), "environment-snapshots");
 }
 function snapshotWithId(snapshot) {
   const digest4 = sha2567(JSON.stringify(snapshot)).slice(0, 24);
   return { id: `env_${digest4}`, ...snapshot };
 }
 function captureEnvironmentSnapshot(input = {}) {
-  const root = resolve16(input.root || process.cwd());
+  const root = resolve17(input.root || process.cwd());
   const env = input.env || process.env;
   const warnings = [];
   const manifests = MANIFEST_FILES.map((file) => manifestRecord(root, file)).filter((file) => Boolean(file));
@@ -105107,13 +105336,13 @@ function captureEnvironmentSnapshot(input = {}) {
   });
 }
 function writeEnvironmentSnapshot(snapshot, outputPath) {
-  const path = outputPath ? resolve16(outputPath) : join16(defaultSnapshotDir(), `${snapshot.id}.json`);
+  const path = outputPath ? resolve17(outputPath) : join17(defaultSnapshotDir(), `${snapshot.id}.json`);
   ensureDir(dirname8(path));
   writeJsonFile(path, snapshot);
   return path;
 }
 function readEnvironmentSnapshot(path) {
-  const snapshot = readJsonFile(resolve16(path));
+  const snapshot = readJsonFile(resolve17(path));
   if (!snapshot || snapshot.schema_version !== 1 || typeof snapshot.id !== "string") {
     throw new Error(`Invalid environment snapshot: ${path}`);
   }
@@ -105939,8 +106168,8 @@ class SqlitePrGroupLedgerPersistence {
   async transaction(fn) {
     const previous = sqliteTransactionTails2.get(this.db) ?? Promise.resolve();
     let release;
-    const current = new Promise((resolve17) => {
-      release = resolve17;
+    const current = new Promise((resolve18) => {
+      release = resolve18;
     });
     sqliteTransactionTails2.set(this.db, current);
     await previous;
@@ -106038,27 +106267,27 @@ __export(exports_serve, {
   SECURITY_HEADERS: () => SECURITY_HEADERS,
   MIME_TYPES: () => MIME_TYPES
 });
-import { existsSync as existsSync16 } from "fs";
-import { join as join17, dirname as dirname9, extname } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { join as join18, dirname as dirname9, extname } from "path";
 import { fileURLToPath } from "url";
 function resolveDashboardDir() {
   const candidates = [];
   try {
     const scriptDir = dirname9(fileURLToPath(import.meta.url));
-    candidates.push(join17(scriptDir, "..", "dashboard", "dist"));
-    candidates.push(join17(scriptDir, "..", "..", "dashboard", "dist"));
+    candidates.push(join18(scriptDir, "..", "dashboard", "dist"));
+    candidates.push(join18(scriptDir, "..", "..", "dashboard", "dist"));
   } catch {}
   if (process.argv[1]) {
     const mainDir = dirname9(process.argv[1]);
-    candidates.push(join17(mainDir, "..", "dashboard", "dist"));
-    candidates.push(join17(mainDir, "..", "..", "dashboard", "dist"));
+    candidates.push(join18(mainDir, "..", "dashboard", "dist"));
+    candidates.push(join18(mainDir, "..", "..", "dashboard", "dist"));
   }
-  candidates.push(join17(process.cwd(), "dashboard", "dist"));
+  candidates.push(join18(process.cwd(), "dashboard", "dist"));
   for (const candidate of candidates) {
-    if (existsSync16(candidate))
+    if (existsSync17(candidate))
       return candidate;
   }
-  return join17(process.cwd(), "dashboard", "dist");
+  return join18(process.cwd(), "dashboard", "dist");
 }
 function getProvidedApiKey(req) {
   const headerKey = req.headers.get("x-api-key");
@@ -106130,7 +106359,7 @@ function json4(data, status3 = 200, headers) {
   });
 }
 function serveStaticFile(filePath) {
-  if (!existsSync16(filePath))
+  if (!existsSync17(filePath))
     return null;
   const ext = extname(filePath);
   const contentType2 = MIME_TYPES[ext] || "application/octet-stream";
@@ -106231,7 +106460,7 @@ data: ${data}
       filteredSseClients.delete(client);
   }
   const dashboardDir = resolveDashboardDir();
-  const dashboardExists = existsSync16(dashboardDir);
+  const dashboardExists = existsSync17(dashboardDir);
   if (!dashboardExists) {
     console.error(`
 Dashboard not found at: ${dashboardDir}`);