@hasna/todos 0.16.0 → 0.17.0

package/dist/cli/index.js

@@ -2123,7 +2123,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.16.0",
+    version: "0.17.0",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -2236,7 +2236,7 @@ var init_package = __esm(() => {
       url: "https://github.com/hasna/apps.git",
       directory: "apps/todos"
     },
-    homepage: "https://github.com/hasna/apps",
+    homepage: "https://github.com/hasna/apps/tree/main/apps/todos#readme",
     bugs: {
       url: "https://github.com/hasna/apps/issues"
     },
@@ -2566,7 +2566,7 @@ var init_types = __esm(() => {
 // src/lib/paths.ts
 import { existsSync } from "fs";
 import { homedir } from "os";
-import { join, resolve } from "path";
+import { isAbsolute, join, resolve } from "path";
 import { homedir as pathsResolverHomedir } from "os";
 import { join as pathsResolverJoin } from "path";
 function pathsResolverAssertApp(app) {
@@ -2623,8 +2623,14 @@ function dataDir(options) {
 function effectiveHome(env = process.env) {
   return env.HOME || env.USERPROFILE || homedir();
 }
+function hasnaHomeRoot(env = process.env) {
+  const override = env["HASNA_HOME"]?.trim();
+  if (override && isAbsolute(override))
+    return override;
+  return join(effectiveHome(env), ".hasna");
+}
 function legacyHomeDir(env = process.env) {
-  return join(effectiveHome(env), ".hasna", "todos");
+  return join(hasnaHomeRoot(env), "todos");
 }
 function resolverHome(env = process.env) {
   return dataDir({ app: "todos", home: effectiveHome(env), env });
@@ -5881,6 +5887,12 @@ import {
 function isTodosLocalOptIn(env = process.env) {
   return TODOS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() !== "");
 }
+function todosLocalModeNotice(reason = "local-opt-in") {
+  if (reason === "local-only-command") {
+    return "todos: LOCAL mode \u2014 this command only ever runs against the on-box SQLite store, so this run " + "does not reach the hosted fleet even though a Todos authority is configured.";
+  }
+  return "todos: LOCAL mode \u2014 using the on-box SQLite store, not the hosted fleet " + "(HASNA_TODOS_LOCAL is set). Unset it, and provide a credential via the Keychain item " + "hasna.credentials.todos.api-key, ~/.hasna/todos/config/credentials, or HASNA_TODOS_API_KEY, " + "to work against https://api.hasna.com/todos.";
+}
 function todosAuthorityEnvKeys() {
   const keys = clientTransportEnvKeys("todos");
   return [
@@ -6036,6 +6048,10 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env, options = {}) {
   };
 }
 function classifyRemoteRequestError(baseUrl, route, error) {
+  const errorName = error instanceof Error ? error.name : "";
+  if (errorName === "CredentialResolutionError" || errorName === "CredentialFileUnsafeError") {
+    rethrowAuthorityFailure(error);
+  }
   const status = error && typeof error === "object" ? error.status : undefined;
   if (status === 401) {
     throw new Error(`REMOTE_API_UNAUTHORIZED: configured Todos authority ${baseUrl} rejected HASNA_TODOS_API_KEY for ${route}; ` + "local SQLite fallback is disabled", { cause: error });
@@ -6359,6 +6375,10 @@ function toListQuery(filter = {}) {
     query["parent_id"] = filter.parent_id ?? "";
   if (filter.include_subtasks !== undefined)
     query["include_subtasks"] = filter.include_subtasks ? "true" : "false";
+  if (filter.include_archived !== undefined)
+    query["include_archived"] = filter.include_archived ? "true" : "false";
+  if (filter.archived_only !== undefined)
+    query["archived_only"] = filter.archived_only ? "true" : "false";
   if (filter.plan_id)
     query["plan_id"] = filter.plan_id;
   if (filter.task_list_id)
@@ -6559,6 +6579,143 @@ async function cloudListTasks(client, filter = {}) {
   union.sort(compareCloudTaskOrder);
   return union.slice(start, windowEnd);
 }
+async function cloudListArchivedTasksPage(client, options = {}) {
+  const limit = options.limit ?? 50;
+  const offset = options.offset ?? 0;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) {
+    throw new Error("archived task limit must be an integer from 1 to 200");
+  }
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset > 1e4) {
+    throw new Error("archived task offset must be an integer from 0 to 10000");
+  }
+  const page = await requestRawCloudTaskPage(client, {
+    include_archived: true,
+    archived_only: true,
+    include_subtasks: true,
+    ...options.project_id ? { project_id: options.project_id } : {},
+    limit,
+    offset
+  });
+  if (page.total === undefined || page.tasks.length > limit || offset + page.tasks.length > page.total) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: archived-only task page lacks a consistent authoritative total");
+  }
+  const seen = new Set;
+  for (const task of page.tasks) {
+    if (!task || typeof task.id !== "string" || !task.id || !task.archived_at || seen.has(task.id) || options.project_id !== undefined && task.project_id !== options.project_id) {
+      throw new Error("REMOTE_API_INCOMPATIBLE: archived-only task page returned a malformed, repeated, or out-of-scope row");
+    }
+    seen.add(task.id);
+  }
+  const hasMore = offset + page.tasks.length < page.total;
+  if (hasMore && page.tasks.length === 0) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: archived-only task pagination stalled before its authoritative total");
+  }
+  return {
+    tasks: page.tasks,
+    total: page.total,
+    limit,
+    offset,
+    has_more: hasMore,
+    next_offset: hasMore ? offset + page.tasks.length : null
+  };
+}
+async function cloudListTasksCompleteBounded(client, filter, maxTasks = 1e4) {
+  if (!Number.isSafeInteger(maxTasks) || maxTasks < 1 || maxTasks > 1e4) {
+    throw new Error("maxTasks must be an integer from 1 to 10000");
+  }
+  if ((filter.offset ?? 0) !== 0)
+    throw new Error("complete bounded task reads require offset zero");
+  if (Array.isArray(filter.status)) {
+    if (filter.status.length === 0) {
+      const { status: _status2, ...unfiltered } = filter;
+      return cloudListTasksCompleteBounded(client, unfiltered, maxTasks);
+    }
+    const combined = [];
+    const ids2 = new Set;
+    const { status: _status, ...baseFilter } = filter;
+    for (const status of filter.status) {
+      const remaining = maxTasks - combined.length;
+      if (remaining < 1)
+        throw new Error(`REMOTE_RESULT_TOO_LARGE: /v1/tasks exceeds the bounded limit ${maxTasks}`);
+      const rows = await cloudListTasksCompleteBounded(client, { ...baseFilter, status }, remaining);
+      for (const task of rows) {
+        if (ids2.has(task.id)) {
+          throw new Error("REMOTE_API_INCOMPATIBLE: scalar status pages repeated a task across disjoint statuses");
+        }
+        ids2.add(task.id);
+        combined.push(task);
+      }
+    }
+    combined.sort(compareCloudTaskOrder);
+    return combined;
+  }
+  const pageSize = Math.min(500, maxTasks);
+  const base = { ...filter, offset: undefined, limit: undefined };
+  const first = await requestRawCloudTaskPage(client, { ...base, limit: pageSize, offset: 0 });
+  if (first.total === undefined) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: complete bounded task reads require an authoritative total");
+  }
+  const total = first.total;
+  if (!Number.isSafeInteger(total) || total < 0 || total > maxTasks) {
+    throw new Error(`REMOTE_RESULT_TOO_LARGE: /v1/tasks reports ${String(total)} rows above the bounded limit ${maxTasks}`);
+  }
+  const tasks = [];
+  const ids = new Set;
+  const statuses = filter.status === undefined ? null : new Set(Array.isArray(filter.status) ? filter.status : [filter.status]);
+  const priorities = filter.priority === undefined ? null : new Set(Array.isArray(filter.priority) ? filter.priority : [filter.priority]);
+  const matchesSelection = (task) => {
+    if (statuses && !statuses.has(task.status))
+      return false;
+    if (priorities && !priorities.has(task.priority))
+      return false;
+    if (filter.project_id !== undefined && task.project_id !== filter.project_id)
+      return false;
+    if (filter.parent_id !== undefined && (task.parent_id ?? null) !== filter.parent_id)
+      return false;
+    if (filter.plan_id !== undefined && task.plan_id !== filter.plan_id)
+      return false;
+    if (filter.task_list_id !== undefined && task.task_list_id !== filter.task_list_id)
+      return false;
+    if (filter.assigned_to !== undefined && task.assigned_to !== filter.assigned_to)
+      return false;
+    if (filter.agent_id !== undefined && task.agent_id !== filter.agent_id)
+      return false;
+    if (filter.archived_only === true && !task.archived_at)
+      return false;
+    if (filter.include_archived === false && task.archived_at)
+      return false;
+    if (filter.include_subtasks !== true && filter.parent_id === undefined && task.parent_id)
+      return false;
+    return true;
+  };
+  const append = (page) => {
+    for (const task of page) {
+      if (!task || typeof task.id !== "string" || !task.id || ids.has(task.id)) {
+        throw new Error("REMOTE_API_INCOMPATIBLE: /v1/tasks returned a malformed or repeated task page");
+      }
+      if (!matchesSelection(task)) {
+        throw new Error("REMOTE_API_INCOMPATIBLE: /v1/tasks returned a row outside the requested bounded selection");
+      }
+      ids.add(task.id);
+      tasks.push(task);
+    }
+  };
+  append(first.tasks);
+  if (tasks.length > total)
+    throw new Error("REMOTE_API_INCOMPATIBLE: /v1/tasks returned more rows than its total");
+  while (tasks.length < total) {
+    const page = await requestRawCloudTaskPage(client, {
+      ...base,
+      limit: Math.min(pageSize, total - tasks.length),
+      offset: tasks.length
+    });
+    if (page.total !== total || page.tasks.length === 0 || tasks.length + page.tasks.length > total) {
+      throw new Error("REMOTE_API_INCOMPATIBLE: /v1/tasks pagination changed or stopped before the authoritative total");
+    }
+    append(page.tasks);
+  }
+  return tasks;
+}
 async function cloudResolveTaskRef(client, ref) {
   const input = ref.trim().toLowerCase();
   if (!input)
@@ -6592,6 +6749,10 @@ async function cloudGetTask(client, id) {
 async function cloudCreateTask(client, input, verification = {}) {
   const expectedParentId = typeof input["parent_id"] === "string" ? input["parent_id"] : null;
   const expectedPlanId = typeof input["plan_id"] === "string" ? input["plan_id"] : null;
+  const expectedTaskListId = typeof input["task_list_id"] === "string" ? input["task_list_id"] : null;
+  const expectedAssignedTo = typeof input["assigned_to"] === "string" ? input["assigned_to"] : null;
+  const verifyTaskListId = expectedTaskListId !== null;
+  const verifyAssignedTo = expectedAssignedTo !== null;
   const expectedCreatedBy = typeof verification.expectedCreatedBy === "string" && verification.expectedCreatedBy.trim() ? verification.expectedCreatedBy : null;
   if (expectedCreatedBy !== null) {
     await requireTaskCreatorCapability(client);
@@ -6604,15 +6765,35 @@ async function cloudCreateTask(client, input, verification = {}) {
     throw new Error(`REMOTE_API_INCOMPATIBLE: configured Todos authority ${remoteAuthorityBase(client)} returned a task create ` + "response without a stored task id; no success row or local SQLite fallback is permitted");
   }
   const persisted = await cloudGetTask(client, created.id);
-  if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== expectedParentId || (persisted.plan_id ?? null) !== expectedPlanId || expectedCreatedBy !== null && persisted.created_by !== expectedCreatedBy) {
+  if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== expectedParentId || (persisted.plan_id ?? null) !== expectedPlanId || verifyTaskListId && (persisted.task_list_id ?? null) !== expectedTaskListId || verifyAssignedTo && (persisted.assigned_to ?? null) !== expectedAssignedTo || expectedCreatedBy !== null && persisted.created_by !== expectedCreatedBy) {
     const creatorDetail = expectedCreatedBy === null ? "" : ` and explicit created_by=${JSON.stringify(expectedCreatedBy)} ` + `(readback ${JSON.stringify(persisted?.created_by ?? null)})`;
-    throw new Error(`TASK_CREATE_PERSISTENCE_UNVERIFIED: configured Todos authority ${remoteAuthorityBase(client)} accepted ` + `POST /v1/tasks but authoritative GET /v1/tasks/${encodeURIComponent(created.id)} did not return the same ` + `stored task id, parent_id, and plan_id ` + `(requested plan_id=${JSON.stringify(expectedPlanId)}, readback=${JSON.stringify(persisted?.plan_id ?? null)})` + `${creatorDetail}; no success row or local SQLite fallback is permitted`);
+    throw new Error(`TASK_CREATE_PERSISTENCE_UNVERIFIED: configured Todos authority ${remoteAuthorityBase(client)} accepted ` + `POST /v1/tasks but authoritative GET /v1/tasks/${encodeURIComponent(created.id)} did not return the same ` + `stored task id, parent_id, plan_id, and every explicitly requested routing field ` + `(requested plan_id=${JSON.stringify(expectedPlanId)}, readback=${JSON.stringify(persisted?.plan_id ?? null)}; ` + `${verifyTaskListId ? `requested task_list_id=${JSON.stringify(expectedTaskListId)}, readback=${JSON.stringify(persisted?.task_list_id ?? null)}; ` : ""}` + `${verifyAssignedTo ? `requested assigned_to=${JSON.stringify(expectedAssignedTo)}, readback=${JSON.stringify(persisted?.assigned_to ?? null)}` : ""})` + `${creatorDetail}; no success row or local SQLite fallback is permitted`);
   }
   return persisted;
 }
 async function cloudUpdateTask(client, id, patch) {
   return unwrapTask(await client.transport.patch(`/tasks/${encodeURIComponent(id)}`, patch));
 }
+async function cloudUpdateTaskVerified(client, id, patch) {
+  const task = await cloudUpdateTask(client, id, patch);
+  if (!task || typeof task !== "object" || typeof task.id !== "string" || task.id !== id) {
+    throw new Error(`REMOTE_API_INCOMPATIBLE: PATCH /v1/tasks/${encodeURIComponent(id)} returned a mismatched task`);
+  }
+  const row = task;
+  if (typeof row["title"] !== "string" || !TASK_STATUSES.includes(row["status"]) || !TASK_PRIORITIES.includes(row["priority"]) || !Number.isSafeInteger(row["version"]) || typeof row["created_at"] !== "string" || typeof row["updated_at"] !== "string" || !Array.isArray(row["tags"]) || !row["metadata"] || typeof row["metadata"] !== "object" || Array.isArray(row["metadata"])) {
+    throw new Error(`REMOTE_API_INCOMPATIBLE: PATCH /v1/tasks/${encodeURIComponent(id)} returned an incomplete task record`);
+  }
+  for (const [field, expected] of Object.entries(patch)) {
+    if (field === "version")
+      continue;
+    const actual = row[field] ?? null;
+    const normalizedExpected = expected ?? null;
+    if (JSON.stringify(actual) !== JSON.stringify(normalizedExpected)) {
+      throw new Error(`REMOTE_API_INCOMPATIBLE: PATCH /v1/tasks/${encodeURIComponent(id)} did not preserve requested field ${field}`);
+    }
+  }
+  return task;
+}
 async function cloudDeleteTask(client, id) {
   try {
     await client.transport.del(`/tasks/${encodeURIComponent(id)}`);
@@ -6623,6 +6804,129 @@ async function cloudDeleteTask(client, id) {
     throw error;
   }
 }
+function bulkReceiptError(route, detail) {
+  return new Error(`REMOTE_API_INCOMPATIBLE: ${route} ${detail}; refusing to report a partial or ambiguous bulk mutation`);
+}
+async function cloudBulkCreateTasks(client, tasks) {
+  const tempIds = new Set(tasks.flatMap((task) => task.temp_id ? [task.temp_id] : []));
+  const normalizedTasks = [];
+  for (const task of tasks) {
+    const dependsOn = [];
+    for (const reference of task.depends_on ?? []) {
+      dependsOn.push(tempIds.has(reference) ? reference : await cloudResolveTaskRef(client, reference));
+    }
+    if (new Set(dependsOn).size !== dependsOn.length) {
+      throw new Error("BULK_CREATE_DUPLICATE_DEPENDENCY: multiple references resolve to the same dependency; no request was sent");
+    }
+    normalizedTasks.push({ ...task, ...dependsOn.length ? { depends_on: dependsOn } : { depends_on: undefined } });
+  }
+  const raw = await requiredRemoteRoute(client, "/v1/tasks/bulk-create", () => client.transport.post("/tasks/bulk-create", { schema_version: 1, tasks: normalizedTasks }, { retry: false }));
+  const receipt = raw && typeof raw === "object" ? raw["receipt"] : null;
+  if (!receipt || typeof receipt !== "object" || Array.isArray(receipt)) {
+    throw bulkReceiptError("/v1/tasks/bulk-create", "did not return a receipt object");
+  }
+  const value = receipt;
+  if (value["schema_version"] !== 1 || value["atomic"] !== true) {
+    throw bulkReceiptError("/v1/tasks/bulk-create", "did not attest schema_version=1 and atomic=true");
+  }
+  const created = value["created"];
+  const dependencies = value["dependencies"];
+  if (!Array.isArray(created) || created.length !== normalizedTasks.length || !Array.isArray(dependencies)) {
+    throw bulkReceiptError("/v1/tasks/bulk-create", "returned incomplete created/dependency collections");
+  }
+  const createdIds = new Set;
+  const parsedCreated = created.map((item, index) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw bulkReceiptError("/v1/tasks/bulk-create", `created[${index}] is malformed`);
+    }
+    const row = item;
+    const expectedTemp = normalizedTasks[index].temp_id ?? null;
+    if (row["temp_id"] !== expectedTemp || typeof row["id"] !== "string" || !UUID_RE.test(row["id"]) || typeof row["title"] !== "string" || row["title"] !== normalizedTasks[index].title || row["short_id"] !== null && typeof row["short_id"] !== "string") {
+      throw bulkReceiptError("/v1/tasks/bulk-create", `created[${index}] does not match the requested task`);
+    }
+    if (createdIds.has(row["id"]))
+      throw bulkReceiptError("/v1/tasks/bulk-create", "returned duplicate task ids");
+    createdIds.add(row["id"]);
+    return {
+      temp_id: expectedTemp,
+      id: row["id"],
+      short_id: row["short_id"],
+      title: row["title"]
+    };
+  });
+  const idByTemp = new Map;
+  normalizedTasks.forEach((task, index) => {
+    if (task.temp_id)
+      idByTemp.set(task.temp_id, parsedCreated[index].id);
+  });
+  const expectedEdges = normalizedTasks.flatMap((task, index) => (task.depends_on ?? []).map((reference) => ({
+    task_id: parsedCreated[index].id,
+    depends_on: idByTemp.get(reference) ?? reference
+  })));
+  if (dependencies.length !== expectedEdges.length) {
+    throw bulkReceiptError("/v1/tasks/bulk-create", "returned the wrong dependency-edge count");
+  }
+  const seenEdges = new Set;
+  const parsedDependencies = dependencies.map((item, index) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw bulkReceiptError("/v1/tasks/bulk-create", `dependencies[${index}] is malformed`);
+    }
+    const row = item;
+    if (typeof row["task_id"] !== "string" || !createdIds.has(row["task_id"]) || typeof row["depends_on"] !== "string" || !row["depends_on"]) {
+      throw bulkReceiptError("/v1/tasks/bulk-create", `dependencies[${index}] is not bound to this batch`);
+    }
+    const key = `${row["task_id"]}\x00${row["depends_on"]}`;
+    if (seenEdges.has(key))
+      throw bulkReceiptError("/v1/tasks/bulk-create", "returned duplicate dependency edges");
+    seenEdges.add(key);
+    return { task_id: row["task_id"], depends_on: row["depends_on"] };
+  });
+  const expectedKeys = expectedEdges.map((edge) => `${edge.task_id}\x00${edge.depends_on}`).sort();
+  const receivedKeys = parsedDependencies.map((edge) => `${edge.task_id}\x00${edge.depends_on}`).sort();
+  if (JSON.stringify(receivedKeys) !== JSON.stringify(expectedKeys)) {
+    throw bulkReceiptError("/v1/tasks/bulk-create", "returned dependency edges that do not match the request");
+  }
+  return { schema_version: 1, atomic: true, created: parsedCreated, dependencies: parsedDependencies };
+}
+async function cloudBulkDeleteTasks(client, taskIds, force) {
+  const raw = await requiredRemoteRoute(client, "/v1/tasks/bulk-delete", () => client.transport.post("/tasks/bulk-delete", { schema_version: 1, task_ids: taskIds, force }, { retry: false }));
+  const receipt = raw && typeof raw === "object" ? raw["receipt"] : null;
+  if (!receipt || typeof receipt !== "object" || Array.isArray(receipt)) {
+    throw bulkReceiptError("/v1/tasks/bulk-delete", "did not return a receipt object");
+  }
+  const value = receipt;
+  if (value["schema_version"] !== 1 || value["atomic"] !== true || value["force"] !== force || !Array.isArray(value["results"])) {
+    throw bulkReceiptError("/v1/tasks/bulk-delete", "did not return the requested atomic force receipt");
+  }
+  if (value["results"].length !== taskIds.length) {
+    throw bulkReceiptError("/v1/tasks/bulk-delete", "returned an incomplete result set");
+  }
+  const seenTaskIds = new Set;
+  const results = value["results"].map((item, index) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw bulkReceiptError("/v1/tasks/bulk-delete", `results[${index}] is malformed`);
+    }
+    const row = item;
+    const outcome = row["outcome"];
+    const taskId = row["task_id"];
+    const reason = row["reason"];
+    if (row["requested_id"] !== taskIds[index] || !["deleted", "skipped", "missing"].includes(String(outcome)) || taskId !== null && (typeof taskId !== "string" || !UUID_RE.test(taskId)) || UUID_RE.test(taskIds[index]) && taskId !== null && taskId.toLowerCase() !== taskIds[index].toLowerCase() || outcome === "deleted" && (typeof taskId !== "string" || reason !== null) || outcome === "skipped" && (typeof taskId !== "string" || reason !== "has_children") || outcome === "missing" && (taskId !== null || reason !== "not_found")) {
+      throw bulkReceiptError("/v1/tasks/bulk-delete", `results[${index}] contradicts the request`);
+    }
+    if (typeof taskId === "string") {
+      if (seenTaskIds.has(taskId))
+        throw bulkReceiptError("/v1/tasks/bulk-delete", "returned duplicate resolved task ids");
+      seenTaskIds.add(taskId);
+    }
+    return {
+      requested_id: taskIds[index],
+      task_id: taskId,
+      outcome,
+      reason
+    };
+  });
+  return { schema_version: 1, atomic: true, force, results };
+}
 function unwrapTemplate(raw) {
   if (raw && typeof raw === "object" && "template" in raw) {
     return raw.template;
@@ -6864,10 +7168,66 @@ async function cloudScanTaskRows(client, options = {}) {
   }
   return { complete: reason === undefined, ...reason ? { reason } : {}, scanned: rows.length, total, pages, rows };
 }
-async function cloudListAgents(client) {
-  const res = await client.list("agents");
-  const envelope = res.raw;
-  return Array.isArray(envelope?.agents) ? envelope.agents : res.items;
+async function cloudListAgents(client, options = {}) {
+  const maxAgents = options.max_agents ?? 1e4;
+  if (!Number.isSafeInteger(maxAgents) || maxAgents < 1 || maxAgents > 1e4) {
+    throw new Error("max_agents must be an integer from 1 to 10000");
+  }
+  const pageSize = Math.min(500, maxAgents);
+  const agents = [];
+  const seen = new Set;
+  let total = null;
+  while (total === null || agents.length < total) {
+    const offset = agents.length;
+    const requestedLimit = Math.min(pageSize, maxAgents - offset);
+    if (requestedLimit < 1) {
+      throw new Error(`REMOTE_RESULT_TOO_LARGE: /v1/agents exceeds the bounded limit ${maxAgents}`);
+    }
+    const raw = await requiredRemoteRoute(client, "/v1/agents", () => client.transport.get("/agents", {
+      query: { limit: requestedLimit, offset, include_archived: options.include_archived === true }
+    }));
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new Error("REMOTE_API_INCOMPATIBLE: /v1/agents did not return a bounded roster envelope");
+    }
+    const envelope = raw;
+    const page = envelope["agents"];
+    const pageTotal = envelope["total"];
+    if (!Array.isArray(page) || !Number.isSafeInteger(pageTotal) || pageTotal < 0 || envelope["count"] !== page.length || envelope["limit"] !== requestedLimit || envelope["offset"] !== offset || page.length > requestedLimit || offset + page.length > pageTotal) {
+      throw new Error("REMOTE_API_INCOMPATIBLE: /v1/agents returned a contradictory bounded page");
+    }
+    if (pageTotal > maxAgents) {
+      throw new Error(`REMOTE_RESULT_TOO_LARGE: /v1/agents reports ${String(pageTotal)} rows above the bounded limit ${maxAgents}`);
+    }
+    if (total !== null && pageTotal !== total) {
+      throw new Error("REMOTE_API_INCOMPATIBLE: /v1/agents total changed during pagination");
+    }
+    total = pageTotal;
+    const hasMore = offset + page.length < total;
+    if (envelope["has_more"] !== hasMore || envelope["next_offset"] !== (hasMore ? offset + page.length : null) || hasMore && page.length === 0) {
+      throw new Error("REMOTE_API_INCOMPATIBLE: /v1/agents returned a stalled or contradictory page receipt");
+    }
+    for (const item of page) {
+      const agent = item;
+      if (!agent || typeof agent !== "object" || typeof agent.id !== "string" || !agent.id || typeof agent.name !== "string" || !agent.name || seen.has(agent.id)) {
+        throw new Error("REMOTE_API_INCOMPATIBLE: /v1/agents returned a malformed or repeated agent");
+      }
+      seen.add(agent.id);
+      agents.push(agent);
+    }
+  }
+  return agents;
+}
+async function cloudResolveAgentRef(client, ref) {
+  const normalized = ref.trim().toLowerCase();
+  if (!normalized)
+    throw new Error("Agent reference must not be empty");
+  const matches = (await cloudListAgents(client)).filter((agent) => agent.id.toLowerCase() === normalized || agent.name.toLowerCase() === normalized);
+  if (matches.length === 0)
+    throw new Error(`Agent not found: ${ref}`);
+  if (matches.length > 1 && new Set(matches.map((agent) => agent.id)).size > 1) {
+    throw new Error(`Agent reference is ambiguous: ${ref}`);
+  }
+  return matches[0].id;
 }
 async function cloudListProjects(client) {
   const res = await requiredRemoteRoute(client, "/v1/projects", () => client.list("projects"));
@@ -7191,12 +7551,66 @@ function normalizePlanComment(value) {
 function redactComment(comment) {
   return { ...comment, content: redactEvidenceText(comment.content) };
 }
+function assertTaskHistoryRows(raw, route) {
+  if (!Array.isArray(raw)) {
+    throw new Error(`REMOTE_API_INCOMPATIBLE: ${route} did not return a task-history array`);
+  }
+  for (let index = 0;index < raw.length; index++) {
+    const entry = raw[index];
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error(`REMOTE_API_INCOMPATIBLE: ${route} entry ${index} is malformed`);
+    }
+    const row = entry;
+    if (typeof row["id"] !== "string" || !row["id"] || typeof row["task_id"] !== "string" || !row["task_id"] || typeof row["action"] !== "string" || !row["action"] || typeof row["created_at"] !== "string" || !row["created_at"]) {
+      throw new Error(`REMOTE_API_INCOMPATIBLE: ${route} entry ${index} is incomplete`);
+    }
+  }
+  return raw;
+}
 async function cloudTaskHistory(client, taskId) {
   const raw = await client.transport.get(`/tasks/${encodeURIComponent(taskId)}/history`);
-  const envelope = raw ?? {};
-  if (Array.isArray(envelope.history))
-    return envelope.history;
-  return Array.isArray(raw) ? raw : [];
+  if (Array.isArray(raw))
+    return assertTaskHistoryRows(raw, "/v1/tasks/:id/history");
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: /v1/tasks/:id/history did not return an object");
+  }
+  const envelope = raw;
+  const history = assertTaskHistoryRows(envelope["history"], "/v1/tasks/:id/history");
+  if (envelope["count"] !== undefined && envelope["count"] !== history.length) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: /v1/tasks/:id/history count contradicts its rows");
+  }
+  if (history.some((entry) => entry.task_id !== taskId)) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: /v1/tasks/:id/history returned an entry for another task");
+  }
+  return history;
+}
+async function cloudTaskHistoryPage(client, taskId, options) {
+  const raw = await requiredRemoteRoute(client, "/v1/tasks/:id/history pagination", () => client.transport.get(`/tasks/${encodeURIComponent(taskId)}/history`, { query: options }));
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: paginated task history did not return an object");
+  }
+  const envelope = raw;
+  const history = assertTaskHistoryRows(envelope["history"], "/v1/tasks/:id/history");
+  const count = envelope["count"];
+  const total = envelope["total"];
+  const limit = envelope["limit"];
+  const offset = envelope["offset"];
+  const order = envelope["order"];
+  const hasMore = envelope["has_more"];
+  const nextOffset = envelope["next_offset"];
+  if (count !== history.length || total === undefined || !Number.isSafeInteger(total) || total < 0 || limit !== options.limit || offset !== options.offset || order !== options.order || typeof hasMore !== "boolean" || nextOffset !== null && (!Number.isSafeInteger(nextOffset) || nextOffset < 0) || history.length > options.limit || history.length > 0 && (options.offset >= total || history.length > total - options.offset) || (hasMore ? nextOffset !== options.offset + history.length : nextOffset !== null) || hasMore !== options.offset + history.length < total || history.some((entry) => entry.task_id !== taskId)) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: paginated task history returned contradictory metadata");
+  }
+  return {
+    history,
+    count: history.length,
+    total,
+    limit: options.limit,
+    offset: options.offset,
+    order: options.order,
+    has_more: hasMore,
+    next_offset: nextOffset
+  };
 }
 async function cloudUpsertTaskByFingerprint(client, input) {
   const raw = await requiredRemoteRoute(client, "/v1/tasks/upsert", () => client.transport.post("/tasks/upsert", input));
@@ -7217,6 +7631,43 @@ async function cloudCountTasks(client, filter = {}) {
   const tasks = await cloudListTasks(client, rest);
   return tasks.length;
 }
+function isCloudAgentRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isNullableString(value) {
+  return value === null || typeof value === "string";
+}
+function assertCloudAgentEnvelope(raw, expectedId) {
+  if (!isCloudAgentRecord(raw) || !Object.prototype.hasOwnProperty.call(raw, "agent")) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: GET /v1/agents/:id did not return the required { agent } envelope");
+  }
+  const agent = raw["agent"];
+  if (!isCloudAgentRecord(agent)) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: GET /v1/agents/:id returned a malformed agent object");
+  }
+  if (agent["id"] !== expectedId) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: GET /v1/agents/:id returned an agent with a different immutable ID");
+  }
+  if (typeof agent["name"] !== "string" || !agent["name"] || !isNullableString(agent["description"]) || !isNullableString(agent["role"]) || !isNullableString(agent["title"]) || !isNullableString(agent["level"]) || !Array.isArray(agent["permissions"]) || agent["permissions"].some((value) => typeof value !== "string") || !isNullableString(agent["reports_to"]) || !isNullableString(agent["org_id"]) || !Array.isArray(agent["capabilities"]) || agent["capabilities"].some((value) => typeof value !== "string") || !["active", "archived"].includes(String(agent["status"])) || !isCloudAgentRecord(agent["metadata"]) || typeof agent["created_at"] !== "string" || !agent["created_at"] || typeof agent["last_seen_at"] !== "string" || !agent["last_seen_at"] || !isNullableString(agent["session_id"]) || !isNullableString(agent["working_dir"]) || !isNullableString(agent["active_project_id"])) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: GET /v1/agents/:id returned an incomplete agent record");
+  }
+  for (const optionalString of ["identity_id", "project_id", "runtime_instance_id", "machine_id", "synced_at"]) {
+    if (agent[optionalString] !== undefined && !isNullableString(agent[optionalString])) {
+      throw new Error("REMOTE_API_INCOMPATIBLE: GET /v1/agents/:id returned invalid optional agent fields");
+    }
+  }
+  return agent;
+}
+async function cloudGetAgent(client, id) {
+  try {
+    const raw = await client.transport.get(`/agents/${encodeURIComponent(id)}`);
+    return assertCloudAgentEnvelope(raw, id);
+  } catch (error) {
+    if (error && typeof error === "object" && error.status === 404)
+      return null;
+    throw error;
+  }
+}
 async function cloudRegisterAgent(client, input) {
   const raw = await client.transport.post("/agents", input);
   if (raw && typeof raw === "object" && "agent" in raw) {
@@ -7243,6 +7694,20 @@ async function cloudLinkCommit(client, taskId, input) {
   }
   return raw;
 }
+async function cloudListTaskCommits(client, taskId) {
+  const route = `/v1/tasks/${encodeURIComponent(taskId)}/commits`;
+  const raw = await requiredRemoteRoute(client, route, () => client.transport.get(`/tasks/${encodeURIComponent(taskId)}/commits`));
+  const envelope = raw ?? {};
+  if (!Array.isArray(envelope.commits)) {
+    if (Array.isArray(raw))
+      return raw;
+    throw new Error(`REMOTE_API_INCOMPATIBLE: ${route} did not return a commits array; refusing an incomplete commit trail`);
+  }
+  if (typeof envelope.count === "number" && envelope.count !== envelope.commits.length) {
+    throw new Error(`REMOTE_API_INCOMPATIBLE: ${route} reported ${envelope.count} commits but returned ${envelope.commits.length}; refusing a partial commit trail`);
+  }
+  return envelope.commits;
+}
 async function cloudFindCommit(client, sha) {
   const raw = await client.transport.get(`/commits/${encodeURIComponent(sha)}`);
   const env = raw ?? {};
@@ -7631,13 +8096,26 @@ async function cloudTaskStats(client, filter = {}) {
   };
 }
 async function cloudRecentActivity(client, limit = 50) {
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e4) {
+    throw new Error("activity limit must be an integer from 1 to 10000");
+  }
   const raw = await client.transport.get("/activity", { query: { limit } });
-  const envelope = raw ?? {};
-  if (Array.isArray(envelope.activity))
-    return envelope.activity;
-  if (Array.isArray(envelope.entries))
-    return envelope.entries;
-  return Array.isArray(raw) ? raw : [];
+  if (Array.isArray(raw)) {
+    const legacy = assertTaskHistoryRows(raw, "/v1/activity");
+    if (legacy.length > limit)
+      throw new Error("REMOTE_API_INCOMPATIBLE: /v1/activity exceeded its requested bound");
+    return legacy;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: /v1/activity did not return an object");
+  }
+  const envelope = raw;
+  const rows = envelope["activity"] ?? envelope["entries"];
+  const activity = assertTaskHistoryRows(rows, "/v1/activity");
+  if (activity.length > limit || envelope["count"] !== activity.length || envelope["limit"] !== undefined && envelope["limit"] !== limit) {
+    throw new Error("REMOTE_API_INCOMPATIBLE: /v1/activity count or limit contradicts its rows");
+  }
+  return activity;
 }
 async function cloudListTaskLists(client, projectId) {
   const query = projectId ? { project_id: projectId } : {};
@@ -7768,12 +8246,78 @@ async function cloudClaimNext(client, agentId) {
   const task = unwrapTask(raw);
   return task && task.id ? task : null;
 }
+function dependencyEnvelopeError(detail) {
+  return new Error(`REMOTE_API_INCOMPATIBLE: /v1/dependencies ${detail}; refusing incomplete dependency analytics`);
+}
 async function cloudAllDependencies(client) {
-  const raw = await client.transport.get("/dependencies");
-  const envelope = raw ?? {};
-  if (Array.isArray(envelope.dependencies))
-    return envelope.dependencies;
-  return Array.isArray(raw) ? raw : [];
+  const edges = [];
+  const seen = new Set;
+  let offset = 0;
+  let expectedTotal = null;
+  while (true) {
+    const raw = await requiredRemoteRoute(client, "/v1/dependencies", () => client.transport.get("/dependencies", {
+      query: { limit: CLOUD_DEPENDENCY_PAGE_SIZE, offset }
+    }));
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      throw dependencyEnvelopeError("did not return an object envelope");
+    }
+    const envelope = raw;
+    const page = envelope["dependencies"];
+    const count = envelope["count"];
+    const total = envelope["total"];
+    const returnedLimit = envelope["limit"];
+    const returnedOffset = envelope["offset"];
+    const hasMore = envelope["has_more"];
+    const nextOffset = envelope["next_offset"];
+    if (!Array.isArray(page))
+      throw dependencyEnvelopeError("did not return a dependencies array");
+    if (!Number.isSafeInteger(count) || count !== page.length) {
+      throw dependencyEnvelopeError("returned a count that does not match the page");
+    }
+    if (!Number.isSafeInteger(total) || total < 0) {
+      throw dependencyEnvelopeError("did not return a non-negative total");
+    }
+    if (total > CLOUD_DEPENDENCY_LIMIT) {
+      throw new Error(`REMOTE_RESULT_TOO_LARGE: /v1/dependencies reports ${total} edges, above the ` + `${CLOUD_DEPENDENCY_LIMIT}-edge analytics limit; narrow the operation or use a server aggregate`);
+    }
+    if (returnedLimit !== CLOUD_DEPENDENCY_PAGE_SIZE || returnedOffset !== offset) {
+      throw dependencyEnvelopeError("did not honor the requested bounded page");
+    }
+    const computedHasMore = offset + page.length < total;
+    if (typeof hasMore !== "boolean" || hasMore !== computedHasMore) {
+      throw dependencyEnvelopeError("returned inconsistent has_more evidence");
+    }
+    if (hasMore ? nextOffset !== offset + page.length : nextOffset !== null) {
+      throw dependencyEnvelopeError("returned an invalid next_offset");
+    }
+    if (expectedTotal === null)
+      expectedTotal = total;
+    else if (expectedTotal !== total)
+      throw dependencyEnvelopeError("changed total during pagination");
+    if (hasMore && page.length === 0)
+      throw dependencyEnvelopeError("made no pagination progress");
+    for (const value of page) {
+      if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw dependencyEnvelopeError("returned a non-object edge");
+      }
+      const edge = value;
+      if (typeof edge["task_id"] !== "string" || !edge["task_id"] || typeof edge["depends_on"] !== "string" || !edge["depends_on"]) {
+        throw dependencyEnvelopeError("returned an edge without task_id and depends_on");
+      }
+      const key = `${edge["task_id"]}\x00${edge["depends_on"]}`;
+      if (seen.has(key))
+        throw dependencyEnvelopeError("repeated an edge across pages");
+      seen.add(key);
+      edges.push(value);
+    }
+    if (!hasMore) {
+      if (edges.length !== expectedTotal) {
+        throw dependencyEnvelopeError(`returned ${edges.length} edges for total ${expectedTotal}`);
+      }
+      return edges;
+    }
+    offset = nextOffset;
+  }
 }
 async function cloudGetTasksByIds(client, ids) {
   const unique2 = Array.from(new Set(ids));
@@ -7879,7 +8423,7 @@ async function cloudTimeline(client, options = {}) {
   const limit = options.limit ?? 50;
   return { entries: entries.slice(offset, offset + limit), total, limit, offset };
 }
-var UUID_RE, COMPLETION_EVIDENCE_FIELDS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, REMOTE_REQUEST_TIMEOUT_MS = 1e4, PRIORITY_RANK, listTagsCapabilityCache, PLAN_COMPLETION_PROTECTED_FIELDS, RELATION_HYDRATION_CONCURRENCY = 6;
+var UUID_RE, COMPLETION_EVIDENCE_FIELDS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, REMOTE_REQUEST_TIMEOUT_MS = 1e4, PRIORITY_RANK, listTagsCapabilityCache, PLAN_COMPLETION_PROTECTED_FIELDS, RELATION_HYDRATION_CONCURRENCY = 6, CLOUD_DEPENDENCY_LIMIT = 1e4, CLOUD_DEPENDENCY_PAGE_SIZE = 500;
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
@@ -7920,12 +8464,6 @@ var init_cloud_router = __esm(() => {
 });
 
 // src/cli/stage-a.ts
-function todosLocalModeNotice(reason = "local-opt-in") {
-  if (reason === "local-only-command") {
-    return "todos: LOCAL mode \u2014 this command only ever runs against the on-box SQLite store, so this run " + "does not reach the hosted fleet even though a Todos authority is configured.";
-  }
-  return "todos: LOCAL mode \u2014 using the on-box SQLite store, not the hosted fleet " + "(HASNA_TODOS_LOCAL is set). Unset it, and provide a credential via the Keychain item " + "hasna.credentials.todos.api-key, ~/.hasna/todos/config/credentials, or HASNA_TODOS_API_KEY, " + "to work against https://api.hasna.com/todos.";
-}
 function announceTodosCliLocalMode(authority, write = (line) => process.stderr.write(`${line}
 `)) {
   if (authority.route !== "local")
@@ -8266,6 +8804,7 @@ var REGISTERED_CANONICAL_COMMANDS, TODOS_CLI_COMMAND_ALIASES, BUNDLED_STATIC_COM
 var init_stage_a = __esm(() => {
   init_esm();
   init_cloud_router();
+  init_local_opt_in();
   REGISTERED_CANONICAL_COMMANDS = [
     "active",
     "add",
@@ -12403,20 +12942,17 @@ function ensureAgentIdentitySchema(db) {
         SELECT RAISE(ABORT, 'IDENTITY_SOURCE_LINEAGE_IMMUTABLE');
       END;
 
+      -- Drop first so an older definition is replaced rather than silently
+      -- retained (the upgrade path). AGENT_IDENTITY_HISTORY_TRIGGER_DDL then
+      -- re-creates them with CREATE TRIGGER IF NOT EXISTS. The two statements
+      -- do different jobs and both are kept: the DROP is what refreshes a
+      -- stale definition, and the IF NOT EXISTS is what keeps the CREATE safe
+      -- on its own \u2014 so a caller that reaches it without a preceding DROP, in
+      -- its own connection or transaction, gets a no-op instead of
+      -- "trigger ... already exists".
       DROP TRIGGER IF EXISTS trg_agent_identity_mapping_history_immutable;
-      CREATE TRIGGER trg_agent_identity_mapping_history_immutable
-      BEFORE UPDATE OF local_agent_id, observed_label, evidence, mapping_basis, status, revision, created_at
-        ON agent_identity_source_mappings
-      BEGIN
-        SELECT RAISE(ABORT, 'IDENTITY_MAPPING_HISTORY_IMMUTABLE');
-      END;
-
       DROP TRIGGER IF EXISTS trg_agent_identity_mapping_history_append_only;
-      CREATE TRIGGER trg_agent_identity_mapping_history_append_only
-      BEFORE DELETE ON agent_identity_source_mappings
-      BEGIN
-        SELECT RAISE(ABORT, 'IDENTITY_MAPPING_HISTORY_IMMUTABLE');
-      END;
+      ${AGENT_IDENTITY_HISTORY_TRIGGER_DDL}
     `);
     db.run("INSERT OR IGNORE INTO _migrations (id) VALUES (?)", [IDENTITY_MIGRATION_ID]);
   });
@@ -12456,7 +12992,20 @@ function storeAgentAlias(agentId, label, aliasKind, status, db) {
 function recordAgentAlias(agentId, label, db) {
   return storeAgentAlias(agentId, label, "historical", "active", db);
 }
-var IDENTITY_PROJECTION_CONTRACT, IDENTITY_MIGRATION_ID = 65;
+var IDENTITY_PROJECTION_CONTRACT, IDENTITY_MIGRATION_ID = 65, AGENT_IDENTITY_HISTORY_TRIGGER_DDL = `
+  CREATE TRIGGER IF NOT EXISTS trg_agent_identity_mapping_history_immutable
+  BEFORE UPDATE OF local_agent_id, observed_label, evidence, mapping_basis, status, revision, created_at
+    ON agent_identity_source_mappings
+  BEGIN
+    SELECT RAISE(ABORT, 'IDENTITY_MAPPING_HISTORY_IMMUTABLE');
+  END;
+
+  CREATE TRIGGER IF NOT EXISTS trg_agent_identity_mapping_history_append_only
+  BEFORE DELETE ON agent_identity_source_mappings
+  BEGIN
+    SELECT RAISE(ABORT, 'IDENTITY_MAPPING_HISTORY_IMMUTABLE');
+  END;
+`;
 var init_identity_mapping = __esm(() => {
   init_types();
   init_types();
@@ -12773,15 +13322,18 @@ __export(exports_database, {
   resolvePartialId: () => resolvePartialId,
   resolveAssignedToAliases: () => resolveAssignedToAliases,
   resetDatabase: () => resetDatabase,
+  refuseLocalStore: () => refuseLocalStore,
   now: () => now,
   lowerInClause: () => lowerInClause,
   lockExpiryCutoff: () => lockExpiryCutoff,
   isLockExpired: () => isLockExpired,
+  isLocalStoreRefused: () => isLocalStoreRefused,
   getDatabasePath: () => getDatabasePath,
   getDatabase: () => getDatabase,
   closeDatabase: () => closeDatabase,
   clearExpiredLocks: () => clearExpiredLocks,
   assignedToAliasSet: () => assignedToAliasSet,
+  allowLocalStore: () => allowLocalStore,
   LOCK_EXPIRY_MINUTES: () => LOCK_EXPIRY_MINUTES
 });
 import { Database } from "bun:sqlite";
@@ -12898,7 +13450,18 @@ function maybeInstallShadowCapture(db) {
     console.error(`[todos] shadow capture install failed: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
+function refuseLocalStore(message) {
+  localStoreRefusal = message;
+}
+function allowLocalStore() {
+  localStoreRefusal = null;
+}
+function isLocalStoreRefused() {
+  return localStoreRefusal !== null;
+}
 function getDatabase(dbPath) {
+  if (localStoreRefusal !== null)
+    throw new Error(localStoreRefusal);
   if (dbPath === undefined && !selectsTodosLocalStore()) {
     throw new Error("API_DATABASE_FALLBACK_FORBIDDEN: this operation must use the shared Todos API; implicit SQLite access is unavailable");
   }
@@ -13039,7 +13602,7 @@ function lowerInClause(column, values, params) {
   params.push(...values.map((v) => v.toLowerCase()));
   return `LOWER(${column}) IN (${values.map(() => "?").join(",")})`;
 }
-var LOCK_EXPIRY_MINUTES = 30, _db = null, _dbPath = null, ALLOWED_TABLES;
+var LOCK_EXPIRY_MINUTES = 30, _db = null, _dbPath = null, localStoreRefusal = null, ALLOWED_TABLES;
 var init_database = __esm(() => {
   init_local_opt_in();
   init_schema();
@@ -19142,7 +19705,9 @@ function listTasks(filter = {}, db) {
       params.push(decoded.p, decoded.p, decoded.c, decoded.p, decoded.c, decoded.i);
     } catch {}
   }
-  if (!filter.include_archived) {
+  if (filter.archived_only) {
+    conditions.push("archived_at IS NOT NULL");
+  } else if (!filter.include_archived) {
     conditions.push("archived_at IS NULL");
   }
   const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
@@ -19155,7 +19720,8 @@ function listTasks(filter = {}, db) {
       params.push(filter.offset);
     }
   }
-  const rows = d.query(`SELECT * FROM tasks ${where} ORDER BY ${PRIORITY_RANK2}, created_at DESC, id ASC${limitClause}`).all(...params);
+  const orderBy = filter.archived_only ? "archived_at DESC, id DESC" : `${PRIORITY_RANK2}, created_at DESC, id ASC`;
+  const rows = d.query(`SELECT * FROM tasks ${where} ORDER BY ${orderBy}${limitClause}`).all(...params);
   return rows.map(rowToTask);
 }
 function getTaskByFingerprint(fingerprint, db) {
@@ -19298,7 +19864,9 @@ function countTasks(filter = {}, db) {
     }
   }
   addMetadataConditions(filter.metadata, conditions, params);
-  if (!filter.include_archived) {
+  if (filter.archived_only) {
+    conditions.push("archived_at IS NOT NULL");
+  } else if (!filter.include_archived) {
     conditions.push("archived_at IS NULL");
   }
   const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
@@ -19435,6 +20003,10 @@ function updateTaskStored(id, input, db) {
     sets.push("completed_at = ?");
     params.push(input.completed_at);
   }
+  if (input.archived_at !== undefined) {
+    sets.push("archived_at = ?");
+    params.push(input.archived_at);
+  }
   if (input.confidence !== undefined) {
     sets.push("confidence = ?");
     params.push(input.confidence);
@@ -19498,6 +20070,8 @@ function updateTaskStored(id, input, db) {
     logTaskChange(id, "update", "parent_id", task.parent_id, input.parent_id, agentId, d);
   if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to)
     logTaskChange(id, "update", "assigned_to", task.assigned_to, input.assigned_to, agentId, d);
+  if (input.archived_at !== undefined && input.archived_at !== task.archived_at)
+    logTaskChange(id, "update", "archived_at", task.archived_at, input.archived_at, agentId, d);
   if (input.working_dir !== undefined && input.working_dir !== task.working_dir)
     logTaskChange(id, "update", "working_dir", task.working_dir, input.working_dir, agentId, d);
   if (input.approved_by !== undefined)
@@ -23102,6 +23676,7 @@ __export(exports_agents, {
   registerAgent: () => registerAgent,
   normalizeGeneratedAgentNames: () => normalizeGeneratedAgentNames,
   matchCapabilities: () => matchCapabilities,
+  listAgentsPage: () => listAgentsPage,
   listAgents: () => listAgents,
   isAgentConflict: () => isAgentConflict,
   getOrgChart: () => getOrgChart,
@@ -23322,6 +23897,19 @@ function listAgents(opts, db) {
   }
   return d.query("SELECT * FROM agents WHERE status = 'active' ORDER BY name").all().map(rowToAgent);
 }
+function listAgentsPage(options, db) {
+  if (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 500) {
+    throw new Error("Agent page limit must be an integer from 1 to 500");
+  }
+  if (!Number.isSafeInteger(options.offset) || options.offset < 0) {
+    throw new Error("Agent page offset must be a non-negative integer");
+  }
+  const d = db || getDatabase();
+  const where = options.include_archived ? "" : "WHERE status = 'active'";
+  const total = d.query(`SELECT COUNT(*) AS total FROM agents ${where}`).get().total;
+  const agents = d.query(`SELECT * FROM agents ${where} ORDER BY LOWER(name), id LIMIT ? OFFSET ?`).all(options.limit, options.offset).map(rowToAgent);
+  return { agents, total };
+}
 function updateAgentActivity(id, db) {
   const d = db || getDatabase();
   d.run("UPDATE agents SET last_seen_at = ? WHERE id = ?", [now(), id]);
@@ -26271,6 +26859,234 @@ async function updateSharedTemplate(client, id, patch) {
   return raw.template;
 }
 
+// src/cli/template-remote.ts
+function requireTemplateClient() {
+  assertTemplateApiEnvironment(process.env);
+  const client = getTodosCloudClient();
+  if (!client)
+    throw new Error("Templates require HASNA_TODOS_API_URL and HASNA_TODOS_API_KEY, or saved account credentials");
+  return client;
+}
+async function resolveRemoteTemplate(client, ref) {
+  if (!ref.trim())
+    throw new Error("Blank template ID prefix");
+  const direct = await cloudGetTemplate(client, ref);
+  if (direct?.id === ref)
+    return direct;
+  const rows = await listSharedTemplates(client);
+  const exact = rows.find((row) => row.id === ref);
+  const matches = exact ? [exact] : rows.filter((row) => row.id.startsWith(ref));
+  if (!ref.trim() || matches.length > 1)
+    throw new Error("Ambiguous or blank template ID prefix");
+  return matches[0] ? cloudGetTemplate(client, matches[0].id) : null;
+}
+async function preflightTemplate(client, template, variables, seen = new Set) {
+  if (seen.has(template.id) || seen.size >= 32)
+    throw new Error("Circular or excessively deep template include graph");
+  seen.add(template.id);
+  try {
+    const resolved = resolveTemplateVariables(template.variables ?? [], variables);
+    for (const step of template.tasks) {
+      if (step.include_template_id) {
+        const included = await resolveRemoteTemplate(client, step.include_template_id);
+        if (!included)
+          throw new Error("Included template not found");
+        await preflightTemplate(client, included, resolved, seen);
+      } else if (step.condition)
+        evaluateTemplateCondition(step.condition, resolved);
+    }
+  } finally {
+    seen.delete(template.id);
+  }
+}
+function normalizeTemplateDescription(value) {
+  return value || null;
+}
+function previewRemoteTemplate(template, variables) {
+  const resolved = resolveTemplateVariables(template.variables ?? [], variables);
+  const renderDescription = (value) => {
+    if (!value)
+      return null;
+    return substituteTemplateVariables(value, resolved) || null;
+  };
+  if (template.tasks.length === 0) {
+    return {
+      template_id: template.id,
+      template_name: template.name,
+      description: normalizeTemplateDescription(template.description),
+      variables: template.variables,
+      resolved_variables: resolved,
+      tasks: [
+        {
+          position: 0,
+          title: substituteTemplateVariables(template.title_pattern, resolved),
+          description: renderDescription(template.description),
+          priority: template.priority,
+          tags: template.tags,
+          task_type: null,
+          depends_on_positions: []
+        }
+      ]
+    };
+  }
+  return {
+    template_id: template.id,
+    template_name: template.name,
+    description: normalizeTemplateDescription(template.description),
+    variables: template.variables,
+    resolved_variables: resolved,
+    tasks: template.tasks.filter((step) => !step.condition || evaluateTemplateCondition(step.condition, resolved)).map((step) => ({
+      position: step.position,
+      title: substituteTemplateVariables(step.title_pattern, resolved),
+      description: renderDescription(step.description),
+      priority: step.priority,
+      tags: step.tags,
+      task_type: step.task_type,
+      depends_on_positions: step.depends_on_positions
+    }))
+  };
+}
+function exportRemoteTemplate(template) {
+  return {
+    name: template.name,
+    title_pattern: template.title_pattern,
+    description: normalizeTemplateDescription(template.description),
+    priority: template.priority,
+    tags: template.tags,
+    variables: template.variables,
+    project_id: template.project_id,
+    plan_id: template.plan_id,
+    metadata: template.metadata,
+    tasks: template.tasks.map((step) => ({
+      position: step.position,
+      title_pattern: step.title_pattern,
+      description: normalizeTemplateDescription(step.description),
+      priority: step.priority,
+      tags: step.tags,
+      task_type: step.task_type,
+      condition: step.condition,
+      include_template_id: step.include_template_id,
+      depends_on_positions: step.depends_on_positions,
+      metadata: step.metadata
+    }))
+  };
+}
+async function createRemoteTemplateTasks(cloud, template, projectId, variables, options = {}, visited = new Set, progress = {
+  tasks: [],
+  dependencies: [],
+  pending: null
+}) {
+  if (visited.size === 0)
+    await preflightTemplate(cloud, template, variables);
+  const { actorAgentId, assignedTo, taskListId, overrides } = options;
+  if (visited.has(template.id)) {
+    throw new Error(`Circular template reference detected: ${template.id}`);
+  }
+  visited.add(template.id);
+  try {
+    const resolved = resolveTemplateVariables(template.variables ?? [], variables);
+    const render = (value) => value === null || value === undefined ? value : substituteTemplateVariables(value, resolved);
+    if (template.tasks.length === 0) {
+      progress.pending = "task-create";
+      const task = await cloudCreateTask(cloud, {
+        title: render(overrides?.title || template.title_pattern),
+        ...render(overrides?.description ?? template.description) ? {
+          description: render(overrides?.description ?? template.description)
+        } : {},
+        priority: overrides?.priority ?? template.priority,
+        tags: template.tags,
+        ...projectId ? { project_id: projectId } : {},
+        ...taskListId ? { task_list_id: taskListId } : {},
+        ...template.plan_id ? { plan_id: template.plan_id } : {},
+        ...actorAgentId ? { agent_id: actorAgentId } : {},
+        ...assignedTo ? { assigned_to: assignedTo } : {},
+        ...Object.keys(template.metadata ?? {}).length > 0 ? { metadata: template.metadata } : {}
+      });
+      progress.tasks.push(task);
+      progress.pending = null;
+      return { tasks: [task] };
+    }
+    const created = [];
+    const positionToTaskId = new Map;
+    const skippedPositions = new Set;
+    for (const step of template.tasks) {
+      if (step.include_template_id) {
+        const included = await resolveRemoteTemplate(cloud, step.include_template_id);
+        if (!included)
+          throw new Error(`Included template not found: ${step.include_template_id}`);
+        const result = await createRemoteTemplateTasks(cloud, included, projectId, resolved, { ...options, overrides: undefined }, visited, progress);
+        created.push(...result.tasks);
+        if (result.tasks.length > 0)
+          positionToTaskId.set(step.position, result.tasks[0].id);
+        else
+          skippedPositions.add(step.position);
+        continue;
+      }
+      if (step.condition && !evaluateTemplateCondition(step.condition, resolved)) {
+        skippedPositions.add(step.position);
+        continue;
+      }
+      progress.pending = "task-create";
+      const task = await cloudCreateTask(cloud, {
+        title: render(step.title_pattern),
+        ...render(step.description) ? { description: render(step.description) } : {},
+        priority: step.priority,
+        tags: step.tags,
+        ...step.task_type ? { task_type: step.task_type } : {},
+        ...projectId ? { project_id: projectId } : {},
+        ...taskListId ? { task_list_id: taskListId } : {},
+        ...template.plan_id ? { plan_id: template.plan_id } : {},
+        ...actorAgentId ? { agent_id: actorAgentId } : {},
+        ...assignedTo ? { assigned_to: assignedTo } : {},
+        ...Object.keys(step.metadata ?? {}).length > 0 ? { metadata: step.metadata } : {}
+      });
+      progress.tasks.push(task);
+      progress.pending = null;
+      created.push(task);
+      positionToTaskId.set(step.position, task.id);
+    }
+    for (const step of template.tasks) {
+      if (skippedPositions.has(step.position) || step.include_template_id)
+        continue;
+      const taskId = positionToTaskId.get(step.position);
+      if (!taskId)
+        continue;
+      for (const dependencyPosition of step.depends_on_positions) {
+        if (skippedPositions.has(dependencyPosition))
+          continue;
+        const dependencyId = positionToTaskId.get(dependencyPosition);
+        if (dependencyId) {
+          progress.pending = "dependency-add";
+          await cloudAddDependency(cloud, taskId, dependencyId);
+          progress.dependencies.push({
+            task_id: taskId,
+            depends_on: dependencyId
+          });
+          progress.pending = null;
+        }
+      }
+    }
+    return { tasks: created };
+  } catch (error) {
+    if (error instanceof TemplateApplyError)
+      throw error;
+    throw new TemplateApplyError(progress);
+  } finally {
+    visited.delete(template.id);
+  }
+}
+var TemplateApplyError;
+var init_template_remote = __esm(() => {
+  init_cloud_router();
+  TemplateApplyError = class TemplateApplyError extends Error {
+    progress;
+    constructor(progress) {
+      super("Template application did not finish; inspect confirmed tasks before retrying");
+      this.progress = progress;
+    }
+  };
+});
+
 // src/lib/builtin-template-library.ts
 var exports_builtin_template_library = {};
 __export(exports_builtin_template_library, {
@@ -27098,26 +27914,6 @@ var init_builtin_template_library = __esm(() => {
 
 // src/cli/commands/template-commands.ts
 import chalk4 from "chalk";
-function requireTemplateClient() {
-  assertTemplateApiEnvironment(process.env);
-  const client = getTodosCloudClient();
-  if (!client)
-    throw new Error("Templates require HASNA_TODOS_API_URL and HASNA_TODOS_API_KEY, or saved account credentials");
-  return client;
-}
-async function cloudGetTemplate2(client, ref) {
-  if (!ref.trim())
-    throw new Error("Blank template ID prefix");
-  const direct = await cloudGetTemplate(client, ref);
-  if (direct?.id === ref)
-    return direct;
-  const rows = await listSharedTemplates(client);
-  const exact = rows.find((row) => row.id === ref);
-  const matches = exact ? [exact] : rows.filter((row) => row.id.startsWith(ref));
-  if (!ref.trim() || matches.length > 1)
-    throw new Error("Ambiguous or blank template ID prefix");
-  return matches[0] ? cloudGetTemplate(client, matches[0].id) : null;
-}
 function reportTemplateError(error, jsonMode) {
   if (!(error instanceof TemplateApplyError)) {
     handleError(error);
@@ -27133,196 +27929,6 @@ function reportTemplateError(error, jsonMode) {
   }, jsonMode);
   process.exitCode = 1;
 }
-async function preflightTemplate(client, template, variables, seen = new Set) {
-  if (seen.has(template.id) || seen.size >= 32)
-    throw new Error("Circular or excessively deep template include graph");
-  seen.add(template.id);
-  try {
-    const resolved = resolveTemplateVariables(template.variables ?? [], variables);
-    for (const step of template.tasks) {
-      if (step.include_template_id) {
-        const included = await cloudGetTemplate2(client, step.include_template_id);
-        if (!included)
-          throw new Error("Included template not found");
-        await preflightTemplate(client, included, resolved, seen);
-      } else if (step.condition)
-        evaluateTemplateCondition(step.condition, resolved);
-    }
-  } finally {
-    seen.delete(template.id);
-  }
-}
-function normalizeTemplateDescription(value) {
-  return value || null;
-}
-function previewRemoteTemplate(template, variables) {
-  const resolved = resolveTemplateVariables(template.variables ?? [], variables);
-  const renderDescription = (value) => {
-    if (!value)
-      return null;
-    return substituteTemplateVariables(value, resolved) || null;
-  };
-  if (template.tasks.length === 0) {
-    return {
-      template_id: template.id,
-      template_name: template.name,
-      description: normalizeTemplateDescription(template.description),
-      variables: template.variables,
-      resolved_variables: resolved,
-      tasks: [
-        {
-          position: 0,
-          title: substituteTemplateVariables(template.title_pattern, resolved),
-          description: renderDescription(template.description),
-          priority: template.priority,
-          tags: template.tags,
-          task_type: null,
-          depends_on_positions: []
-        }
-      ]
-    };
-  }
-  return {
-    template_id: template.id,
-    template_name: template.name,
-    description: normalizeTemplateDescription(template.description),
-    variables: template.variables,
-    resolved_variables: resolved,
-    tasks: template.tasks.filter((step) => !step.condition || evaluateTemplateCondition(step.condition, resolved)).map((step) => ({
-      position: step.position,
-      title: substituteTemplateVariables(step.title_pattern, resolved),
-      description: renderDescription(step.description),
-      priority: step.priority,
-      tags: step.tags,
-      task_type: step.task_type,
-      depends_on_positions: step.depends_on_positions
-    }))
-  };
-}
-function exportRemoteTemplate(template) {
-  return {
-    name: template.name,
-    title_pattern: template.title_pattern,
-    description: normalizeTemplateDescription(template.description),
-    priority: template.priority,
-    tags: template.tags,
-    variables: template.variables,
-    project_id: template.project_id,
-    plan_id: template.plan_id,
-    metadata: template.metadata,
-    tasks: template.tasks.map((step) => ({
-      position: step.position,
-      title_pattern: step.title_pattern,
-      description: normalizeTemplateDescription(step.description),
-      priority: step.priority,
-      tags: step.tags,
-      task_type: step.task_type,
-      condition: step.condition,
-      include_template_id: step.include_template_id,
-      depends_on_positions: step.depends_on_positions,
-      metadata: step.metadata
-    }))
-  };
-}
-async function createRemoteTemplateTasks(cloud, template, projectId, variables, agentId, overrides, visited = new Set, progress = {
-  tasks: [],
-  dependencies: [],
-  pending: null
-}) {
-  if (visited.size === 0)
-    await preflightTemplate(cloud, template, variables);
-  if (visited.has(template.id)) {
-    throw new Error(`Circular template reference detected: ${template.id}`);
-  }
-  visited.add(template.id);
-  try {
-    const resolved = resolveTemplateVariables(template.variables ?? [], variables);
-    const render = (value) => value === null || value === undefined ? value : substituteTemplateVariables(value, resolved);
-    if (template.tasks.length === 0) {
-      progress.pending = "task-create";
-      const task = await cloudCreateTask(cloud, {
-        title: render(overrides?.title || template.title_pattern),
-        ...render(overrides?.description ?? template.description) ? {
-          description: render(overrides?.description ?? template.description)
-        } : {},
-        priority: overrides?.priority ?? template.priority,
-        tags: template.tags,
-        ...projectId ? { project_id: projectId } : {},
-        ...template.plan_id ? { plan_id: template.plan_id } : {},
-        ...agentId ? { agent_id: agentId } : {},
-        ...Object.keys(template.metadata ?? {}).length > 0 ? { metadata: template.metadata } : {}
-      });
-      progress.tasks.push(task);
-      progress.pending = null;
-      return { tasks: [task] };
-    }
-    const created = [];
-    const positionToTaskId = new Map;
-    const skippedPositions = new Set;
-    for (const step of template.tasks) {
-      if (step.include_template_id) {
-        const included = await cloudGetTemplate2(cloud, step.include_template_id);
-        if (!included)
-          throw new Error(`Included template not found: ${step.include_template_id}`);
-        const result = await createRemoteTemplateTasks(cloud, included, projectId, resolved, agentId, undefined, visited, progress);
-        created.push(...result.tasks);
-        if (result.tasks.length > 0)
-          positionToTaskId.set(step.position, result.tasks[0].id);
-        else
-          skippedPositions.add(step.position);
-        continue;
-      }
-      if (step.condition && !evaluateTemplateCondition(step.condition, resolved)) {
-        skippedPositions.add(step.position);
-        continue;
-      }
-      progress.pending = "task-create";
-      const task = await cloudCreateTask(cloud, {
-        title: render(step.title_pattern),
-        ...render(step.description) ? { description: render(step.description) } : {},
-        priority: step.priority,
-        tags: step.tags,
-        ...step.task_type ? { task_type: step.task_type } : {},
-        ...projectId ? { project_id: projectId } : {},
-        ...template.plan_id ? { plan_id: template.plan_id } : {},
-        ...agentId ? { agent_id: agentId } : {},
-        ...Object.keys(step.metadata ?? {}).length > 0 ? { metadata: step.metadata } : {}
-      });
-      progress.tasks.push(task);
-      progress.pending = null;
-      created.push(task);
-      positionToTaskId.set(step.position, task.id);
-    }
-    for (const step of template.tasks) {
-      if (skippedPositions.has(step.position) || step.include_template_id)
-        continue;
-      const taskId = positionToTaskId.get(step.position);
-      if (!taskId)
-        continue;
-      for (const dependencyPosition of step.depends_on_positions) {
-        if (skippedPositions.has(dependencyPosition))
-          continue;
-        const dependencyId = positionToTaskId.get(dependencyPosition);
-        if (dependencyId) {
-          progress.pending = "dependency-add";
-          await cloudAddDependency(cloud, taskId, dependencyId);
-          progress.dependencies.push({
-            task_id: taskId,
-            depends_on: dependencyId
-          });
-          progress.pending = null;
-        }
-      }
-    }
-    return { tasks: created };
-  } catch (error) {
-    if (error instanceof TemplateApplyError)
-      throw error;
-    throw new TemplateApplyError(progress);
-  } finally {
-    visited.delete(template.id);
-  }
-}
 function registerTemplateCommands(program2) {
   program2.command("templates").description("List and manage task templates").option("--add <name>", "Create a template").option("--title <pattern>", "Title pattern (with --add)").option("-d, --description <text>", "Default description").option("-p, --priority <level>", "Default priority").option("-t, --tags <tags>", "Default tags (comma-separated)").option("--delete <id>", "Delete a template").option("--update <id>", "Update a template").option("--use <id>", "Create a task from a template").option("--var <vars...>", "Variable substitutions: key=value (e.g. --var feature=login)").action(async (opts) => {
     const globalOpts = program2.opts();
@@ -27350,7 +27956,7 @@ function registerTemplateCommands(program2) {
           return;
         }
         if (opts.delete) {
-          const prior = await cloudGetTemplate2(cloud, opts.delete);
+          const prior = await resolveRemoteTemplate(cloud, opts.delete);
           const deleted = prior ? await cloudDeleteTemplate(cloud, prior.id) : false;
           if (globalOpts.json) {
             output({ deleted }, true);
@@ -27374,7 +27980,7 @@ function registerTemplateCommands(program2) {
           if (Object.keys(updates).length === 0) {
             handleError(new Error("Provide --title, --description, --priority, or --tags with --update"));
           }
-          const prior = await cloudGetTemplate2(cloud, opts.update);
+          const prior = await resolveRemoteTemplate(cloud, opts.update);
           if (!prior)
             handleError(new Error("Template not found."));
           const updated = await updateSharedTemplate(cloud, prior.id, {
@@ -27400,15 +28006,18 @@ function registerTemplateCommands(program2) {
             }
             variables[value.slice(0, separator)] = value.slice(separator + 1);
           }
-          const template = await cloudGetTemplate2(cloud, opts.use);
+          const template = await resolveRemoteTemplate(cloud, opts.use);
           if (!template) {
             handleError(new Error("Template not found."));
           }
           const targetProjectId = template.project_id ?? projectId;
-          const { tasks: created } = await createRemoteTemplateTasks(cloud, template, targetProjectId, variables, globalOpts.agent, {
-            title: opts.title,
-            description: opts.description,
-            priority: opts.priority
+          const { tasks: created } = await createRemoteTemplateTasks(cloud, template, targetProjectId, variables, {
+            actorAgentId: globalOpts.agent,
+            overrides: {
+              title: opts.title,
+              description: opts.description,
+              priority: opts.priority
+            }
           });
           if (globalOpts.json) {
             output(created, true);
@@ -27515,7 +28124,7 @@ function registerTemplateCommands(program2) {
       const cloud = requireTemplateClient();
       let result;
       if (cloud) {
-        const template = await cloudGetTemplate2(cloud, id);
+        const template = await resolveRemoteTemplate(cloud, id);
         if (!template) {
           handleError(new Error("Template not found."));
         }
@@ -27548,7 +28157,7 @@ function registerTemplateCommands(program2) {
   program2.command("template-export <id>").alias("templates-export").description("Export a template as JSON to stdout").action(async (id) => {
     try {
       const cloud = requireTemplateClient();
-      const template = cloud ? await cloudGetTemplate2(cloud, id) : null;
+      const template = cloud ? await resolveRemoteTemplate(cloud, id) : null;
       if (cloud && !template) {
         handleError(new Error("Template not found."));
       }
@@ -27583,7 +28192,7 @@ function registerTemplateCommands(program2) {
     const globalOpts = program2.opts();
     const cloud = requireTemplateClient();
     try {
-      const template = await cloudGetTemplate2(cloud, id);
+      const template = await resolveRemoteTemplate(cloud, id);
       if (!template) {
         handleError(new Error("Template not found."));
       }
@@ -27614,17 +28223,10 @@ function registerTemplateCommands(program2) {
     }
   });
 }
-var TemplateApplyError;
 var init_template_commands = __esm(() => {
   init_helpers();
   init_cloud_router();
-  TemplateApplyError = class TemplateApplyError extends Error {
-    progress;
-    constructor(progress) {
-      super("Template application did not finish; inspect confirmed tasks before retrying");
-      this.progress = progress;
-    }
-  };
+  init_template_remote();
 });
 
 // src/cli/commands/plan-template-commands.ts
@@ -30075,6 +30677,102 @@ var init_sqlite_snapshot = __esm(() => {
 });
 
 // src/storage/local-sqlite.ts
+var exports_local_sqlite = {};
+__export(exports_local_sqlite, {
+  createLocalSqliteTodosStorageAdapter: () => createLocalSqliteTodosStorageAdapter
+});
+function bulkCreateAtomicSqlite(db, inputs) {
+  return db.transaction(() => {
+    const tempIds = new Map;
+    const created = [];
+    const dependencies = [];
+    for (const input of inputs) {
+      const { temp_id, depends_on: _dependsOn, ...taskInput } = input;
+      const task = createTask(taskInput, db);
+      if (temp_id)
+        tempIds.set(temp_id, task.id);
+      created.push({ temp_id: temp_id ?? null, id: task.id, short_id: task.short_id, title: task.title });
+    }
+    for (let index = 0;index < inputs.length; index++) {
+      const input = inputs[index];
+      const taskId = created[index].id;
+      const seenDependencies = new Set;
+      for (const reference of input.depends_on ?? []) {
+        const dependencyId = tempIds.get(reference) ?? resolveTaskRefLocal(db, reference)?.id;
+        if (!dependencyId)
+          throw new TaskNotFoundError(reference);
+        if (seenDependencies.has(dependencyId)) {
+          throw new ResourceConflictError("BULK_CREATE_DUPLICATE_DEPENDENCY", `Multiple references resolve to dependency ${dependencyId}`);
+        }
+        seenDependencies.add(dependencyId);
+        addDependency(taskId, dependencyId, db);
+        dependencies.push({ task_id: taskId, depends_on: dependencyId });
+      }
+    }
+    return { schema_version: 1, atomic: true, created, dependencies };
+  })();
+}
+function deleteTaskHierarchySqlite(db, rootId) {
+  const rows = db.query(`WITH RECURSIVE tree(id, depth) AS (
+    SELECT id, 0 FROM tasks WHERE id = ?
+    UNION ALL
+    SELECT child.id, tree.depth + 1 FROM tasks child JOIN tree ON child.parent_id = tree.id
+  ) SELECT id FROM tree ORDER BY depth DESC, id`).all(rootId);
+  if (rows.length === 0)
+    throw new TaskNotFoundError(rootId);
+  for (const row of rows) {
+    if (!deleteTask(row.id, db))
+      throw new Error(`Atomic hierarchy delete lost task ${row.id}`);
+  }
+}
+function bulkDeleteAtomicSqlite(db, ids, force) {
+  return db.transaction(() => {
+    const resolved = ids.map((reference) => ({ reference, task: resolveTaskRefLocal(db, reference) }));
+    const seen = new Set;
+    for (const item of resolved) {
+      if (!item.task)
+        continue;
+      if (seen.has(item.task.id)) {
+        throw new ResourceConflictError("BULK_DELETE_DUPLICATE_TASK", `Multiple references resolve to task ${item.task.id}`);
+      }
+      seen.add(item.task.id);
+    }
+    const childState = new Map;
+    for (const item of resolved) {
+      if (!item.task)
+        continue;
+      childState.set(item.task.id, Boolean(db.query("SELECT id FROM tasks WHERE parent_id = ? LIMIT 1").get(item.task.id)));
+    }
+    const planned = resolved.filter((item) => item.task && (force || !childState.get(item.task.id)));
+    const plannedIds = new Set(planned.map((item) => item.task.id));
+    const roots = planned.filter((item) => {
+      if (!force)
+        return true;
+      let parentId = item.task.parent_id;
+      while (parentId) {
+        if (plannedIds.has(parentId))
+          return false;
+        parentId = getTask(parentId, db)?.parent_id ?? null;
+      }
+      return true;
+    });
+    for (const item of roots)
+      deleteTaskHierarchySqlite(db, item.task.id);
+    return {
+      schema_version: 1,
+      atomic: true,
+      force,
+      results: resolved.map((item) => {
+        if (!item.task)
+          return { requested_id: item.reference, task_id: null, outcome: "missing", reason: "not_found" };
+        if (!force && childState.get(item.task.id)) {
+          return { requested_id: item.reference, task_id: item.task.id, outcome: "skipped", reason: "has_children" };
+        }
+        return { requested_id: item.reference, task_id: item.task.id, outcome: "deleted", reason: null };
+      })
+    };
+  })();
+}
 function resolveTaskRefLocal(db, ref) {
   const raw = ref.trim().toLowerCase();
   if (!raw)
@@ -30170,6 +30868,8 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       },
       handoffStaleLock: (input) => handoffStaleTaskLock(input, database()),
       delete: (id) => deleteTask(id, database()),
+      bulkCreateAtomic: (inputs, _context) => bulkCreateAtomicSqlite(database(), inputs),
+      bulkDeleteAtomic: (ids, force, _context) => bulkDeleteAtomicSqlite(database(), ids, force),
       start: (id, agentId) => startTask(id, agentId, database()),
       complete: (id, agentId, options2) => completeTask(id, agentId, database(), options2),
       fail: (id, agentId, reason, options2) => failTask(id, agentId, reason, options2, database()),
@@ -30178,6 +30878,30 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       getActiveWork: (filters) => getActiveWork(filters, database()),
       getChangedSince: (since, filters) => getTasksChangedSince(since, filters, database())
     },
+    dependencies: {
+      add: (taskId, dependsOn) => {
+        addDependency(taskId, dependsOn, database());
+        return { task_id: taskId, depends_on: dependsOn };
+      },
+      remove: (taskId, dependsOn) => removeDependency(taskId, dependsOn, database()),
+      list: (taskId) => {
+        const dependencies = getTaskDependencies(taskId, database());
+        const blocks = getTaskDependents(taskId, database());
+        return { dependencies, blocks, blocked_by: blocks };
+      },
+      listPage: ({ limit, offset }) => {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+          throw new Error("SQLite dependency page limit must be an integer from 1 to 500");
+        }
+        if (!Number.isSafeInteger(offset) || offset < 0) {
+          throw new Error("SQLite dependency page offset must be a non-negative integer");
+        }
+        const totalRow = database().query("SELECT COUNT(*) AS total FROM task_dependencies").get();
+        const dependencies = database().query("SELECT task_id, depends_on FROM task_dependencies ORDER BY task_id, depends_on LIMIT ? OFFSET ?").all(limit, offset);
+        return { dependencies, total: totalRow.total };
+      },
+      listAll: () => database().query("SELECT task_id, depends_on FROM task_dependencies ORDER BY task_id, depends_on").all()
+    },
     projects: {
       create: (input) => createProject(input, database()),
       get: (id) => getProject(id, database()),
@@ -30221,6 +30945,7 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       get: (id) => getAgent(id, database()),
       getByName: (name) => getAgentByName(name, database()),
       list: (options2) => listAgents(options2, database()),
+      listPage: (options2) => listAgentsPage(options2, database()),
       update: (id, input) => updateAgent(id, input, database())
     },
     taskLists: {
@@ -30259,6 +30984,29 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
         return comments;
       },
       getTaskHistory: (taskId) => getTaskHistory(taskId, database()),
+      getTaskHistoryPage: (taskId, options2) => {
+        if (!Number.isSafeInteger(options2.limit) || options2.limit < 1 || options2.limit > 500) {
+          throw new Error("Task history limit must be an integer from 1 to 500");
+        }
+        if (!Number.isSafeInteger(options2.offset) || options2.offset < 0) {
+          throw new Error("Task history offset must be a non-negative integer");
+        }
+        const conditions = ["task_id = ?"];
+        const values = [taskId];
+        if (options2.since) {
+          conditions.push("created_at >= ?");
+          values.push(options2.since);
+        }
+        if (options2.until) {
+          conditions.push("created_at <= ?");
+          values.push(options2.until);
+        }
+        const where = conditions.join(" AND ");
+        const total = database().query(`SELECT COUNT(*) AS total FROM task_history WHERE ${where}`).get(...values).total;
+        const direction = options2.order === "asc" ? "ASC" : "DESC";
+        const history = database().query(`SELECT * FROM task_history WHERE ${where} ORDER BY created_at ${direction}, id ${direction} LIMIT ? OFFSET ?`).all(...values, options2.limit, options2.offset);
+        return { history, total };
+      },
       getRecentActivity: (limit) => getRecentActivity(limit, database())
     },
     sync: {
@@ -30281,6 +31029,7 @@ var init_local_sqlite = __esm(() => {
   init_types();
   init_search();
   init_tasks();
+  init_task_graph();
   init_projects();
   init_plans();
   init_plan_comments();
@@ -34755,6 +35504,8 @@ function createPostgresTodosStorageAdapter(options) {
       count: (filter = {}) => store.countTasks(filter),
       update: (id, input, context) => updateTask2(id, input, store, context),
       delete: (id, context) => store.deleteTaskHierarchy(id, context),
+      bulkCreateAtomic: (inputs, context) => bulkCreateTasksAtomic(inputs, store, context),
+      bulkDeleteAtomic: (ids, force, context) => bulkDeleteTasksAtomic(ids, force, store, context),
       start: (id, agentId) => startTask2(id, agentId, store),
       complete: (id, agentId, options2) => completeTask2(id, agentId, options2, store),
       fail: (id, agentId, reason, options2) => failTask2(id, agentId, reason, options2, store),
@@ -34771,6 +35522,7 @@ function createPostgresTodosStorageAdapter(options) {
       add: (taskId, dependsOn, context) => addDependency2(taskId, dependsOn, store, context),
       remove: (taskId, dependsOn) => removeDependency2(taskId, dependsOn, store),
       list: (taskId) => listDependencies(taskId, store),
+      listPage: (page) => store.listDependencyPage(page),
       listAll: () => store.list("dependencies")
     },
     verifications: {
@@ -34836,6 +35588,7 @@ function createPostgresTodosStorageAdapter(options) {
       get: (id) => store.get("agents", id),
       getByName: async (name) => matchAgentByName(await store.list("agents"), name),
       list: async (options2) => (await store.list("agents")).filter((agent) => options2?.include_archived || agent.status !== "archived").sort((a, b) => a.name.localeCompare(b.name)),
+      listPage: (options2) => store.listAgentPage(options2),
       update: (id, input) => updateAgent2(id, input, store),
       heartbeat: (idOrName, context) => heartbeatAgent(idOrName, store, context),
       release: (idOrName, sessionId, context) => releaseAgent2(idOrName, sessionId, store, context)
@@ -34893,8 +35646,9 @@ function createPostgresTodosStorageAdapter(options) {
       getCommentsPage: async (taskId, options2) => {
         return (await store.listComments(taskId, options2)).map(redactComment2).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
       },
-      getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
-      getRecentActivity: async (limit = 20) => (await store.list("audit_history")).sort((a, b) => b.created_at.localeCompare(a.created_at)).slice(0, limit)
+      getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id.localeCompare(a.id)),
+      getTaskHistoryPage: (taskId, options2) => store.listTaskHistoryPage(taskId, options2),
+      getRecentActivity: (limit = 20) => store.listRecentActivity(limit)
     },
     machines: createPostgresMachineRegistry(options.client, options.service ?? "todos", options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE, () => store.ensureSchema()),
     atomicProjectMigration: createAtomicProjectMigration({ client: options.client, table: options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE, service: options.service ?? "todos", ensureSchema: () => store.ensureSchema() }),
@@ -34931,6 +35685,8 @@ class PostgresJsonRecordStore {
   }
   async withDependencyGraphTransaction(fn) {
     await this.ensureSchema();
+    if (this.projectIntegrityLocked)
+      return fn(this);
     return this.withTaskParentIntegrityTransaction(async (client) => {
       const scoped = new PostgresJsonRecordStore({ ...this.options, client });
       scoped.schemaReady = Promise.resolve();
@@ -35077,6 +35833,128 @@ class PostgresJsonRecordStore {
   async list(type) {
     return (await this.listRecords(type)).map((record) => record.payload);
   }
+  async listAgentPage(options) {
+    const { limit, offset } = options;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+      throw new Error("Postgres agent page limit must be an integer from 1 to 500");
+    }
+    if (!Number.isSafeInteger(offset) || offset < 0) {
+      throw new Error("Postgres agent page offset must be a non-negative integer");
+    }
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:list-agent-page */ WITH filtered AS (
+         SELECT object_id, payload
+         FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'agents' AND deleted_at IS NULL
+           AND ($2::boolean OR COALESCE(payload->>'status', 'active') <> 'archived')
+       ), page AS (
+         SELECT object_id, payload FROM filtered
+         ORDER BY LOWER(payload->>'name'), object_id
+         LIMIT $3 OFFSET $4
+       )
+       SELECT (SELECT count(*) FROM filtered) AS total,
+              COALESCE((SELECT jsonb_agg(payload ORDER BY LOWER(payload->>'name'), object_id) FROM page), '[]'::jsonb) AS agents`, [this.service, options.include_archived === true, limit, offset]);
+    const row = result.rows[0];
+    const total = Number(row?.total);
+    if (!Number.isSafeInteger(total) || total < 0 || !Array.isArray(row?.agents)) {
+      throw new Error("Postgres agent page returned invalid count or agents");
+    }
+    if (row.agents.length > limit || row.agents.length > 0 && offset + row.agents.length > total) {
+      throw new Error("Postgres agent page exceeded its requested bounds");
+    }
+    return { agents: row.agents.map((value) => payloadRecord2(value)), total };
+  }
+  async listRecentActivity(limit) {
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e4) {
+      throw new Error("Postgres recent activity limit must be an integer from 1 to 10000");
+    }
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:list-recent-activity */ SELECT payload
+       FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'audit_history' AND deleted_at IS NULL
+       ORDER BY payload->>'created_at' DESC, object_id DESC
+       LIMIT $2`, [this.service, limit]);
+    return result.rows.map((row) => payloadRecord2(row.payload));
+  }
+  async listTaskHistoryPage(taskId, options) {
+    const { limit, offset } = options;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+      throw new Error("Postgres task history limit must be an integer from 1 to 500");
+    }
+    if (!Number.isSafeInteger(offset) || offset < 0) {
+      throw new Error("Postgres task history offset must be a non-negative integer");
+    }
+    await this.ensureSchema();
+    const direction = options.order === "asc" ? "ASC" : "DESC";
+    const result = await this.options.client.query(`/* todos:list-task-history-page */ WITH filtered AS (
+         SELECT object_id, payload, payload->>'created_at' AS created_at
+         FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'audit_history' AND deleted_at IS NULL
+           AND payload->>'task_id' = $2
+           AND ($3::text IS NULL OR payload->>'created_at' >= $3)
+           AND ($4::text IS NULL OR payload->>'created_at' <= $4)
+       ), page AS (
+         SELECT object_id, payload, created_at FROM filtered
+         ORDER BY created_at ${direction}, object_id ${direction}
+         LIMIT $5 OFFSET $6
+       )
+       SELECT (SELECT count(*) FROM filtered) AS total,
+              COALESCE((SELECT jsonb_agg(payload ORDER BY created_at ${direction}, object_id ${direction}) FROM page), '[]'::jsonb) AS history`, [this.service, taskId, options.since ?? null, options.until ?? null, limit, offset]);
+    const row = result.rows[0];
+    const total = Number(row?.total);
+    if (!Number.isSafeInteger(total) || total < 0 || !Array.isArray(row?.history)) {
+      throw new Error("Postgres task history page returned invalid count or history");
+    }
+    if (row.history.length > limit || row.history.length > 0 && offset + row.history.length > total) {
+      throw new Error("Postgres task history page exceeded its requested bounds");
+    }
+    return { history: row.history.map((value) => payloadRecord2(value)), total };
+  }
+  async listDependencyPage(options) {
+    const { limit, offset } = options;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+      throw new Error("Postgres dependency page limit must be an integer from 1 to 500");
+    }
+    if (!Number.isSafeInteger(offset) || offset < 0) {
+      throw new Error("Postgres dependency page offset must be a non-negative integer");
+    }
+    await this.ensureSchema();
+    const result = await this.options.client.query(`/* todos:list-dependencies-page */ WITH page AS (
+         SELECT payload, updated_at, object_id
+         FROM ${this.tableName}
+         WHERE service = $1 AND object_type = 'dependencies' AND deleted_at IS NULL
+         ORDER BY updated_at ASC, object_id ASC
+         LIMIT $2 OFFSET $3
+       )
+       SELECT
+         (SELECT COUNT(*)::text FROM ${this.tableName}
+          WHERE service = $1 AND object_type = 'dependencies' AND deleted_at IS NULL) AS total,
+         COALESCE(
+           jsonb_agg(page.payload ORDER BY page.updated_at ASC, page.object_id ASC)
+             FILTER (WHERE page.payload IS NOT NULL),
+           '[]'::jsonb
+         ) AS dependencies
+       FROM page`, [this.service, limit, offset]);
+    const row = result.rows[0];
+    const totalText = typeof row?.total === "string" ? row.total : typeof row?.total === "number" && Number.isSafeInteger(row.total) ? String(row.total) : null;
+    if (totalText === null || !/^\d+$/.test(totalText)) {
+      throw new Error("Postgres dependency page returned an invalid total");
+    }
+    const total = Number(totalText);
+    if (!Number.isSafeInteger(total)) {
+      throw new Error("Postgres dependency page total exceeds the safe integer range");
+    }
+    if (!Array.isArray(row?.dependencies)) {
+      throw new Error("Postgres dependency page returned an invalid dependencies array");
+    }
+    if (row.dependencies.length > limit || offset + row.dependencies.length > total) {
+      throw new Error("Postgres dependency page returned rows outside the requested bound");
+    }
+    return {
+      dependencies: row.dependencies.map((value) => payloadRecord2(value)),
+      total
+    };
+  }
   async listComments(taskId, options = {}) {
     await this.ensureSchema();
     const limit = options.limit ?? 100;
@@ -35152,7 +36030,9 @@ class PostgresJsonRecordStore {
         return "1=0";
       return `${column} IN (${values.map((v) => p(v)).join(", ")})`;
     };
-    if (filter.include_archived === false)
+    if (filter.archived_only === true)
+      conds.push(`(payload->>'archived_at' IS NOT NULL)`);
+    else if (filter.include_archived === false)
       conds.push(`(payload->>'archived_at' IS NULL)`);
     if (filter.ids)
       conds.push(inClause("payload->>'id'", filter.ids));
@@ -35209,7 +36089,7 @@ class PostgresJsonRecordStore {
   async listTasks(filter) {
     await this.ensureSchema();
     const { where, params, queryRef } = await this.buildTaskFilterSql(filter);
-    const orderBy = queryRef ? `ORDER BY ts_rank_cd(task_search_tsv, websearch_to_tsquery('simple', todos_immutable_unaccent(${queryRef}))) DESC, ${TASK_ORDER_TIEBREAK}` : TASK_ORDER_BY;
+    const orderBy = filter.archived_only ? `ORDER BY payload->>'archived_at' DESC, object_id DESC` : queryRef ? `ORDER BY ts_rank_cd(task_search_tsv, websearch_to_tsquery('simple', todos_immutable_unaccent(${queryRef}))) DESC, ${TASK_ORDER_TIEBREAK}` : TASK_ORDER_BY;
     let sql = `/* todos:list-tasks */ SELECT payload FROM ${this.tableName} WHERE ${where} ${orderBy}`;
     if (filter.limit !== undefined) {
       params.push(filter.limit);
@@ -35429,6 +36309,8 @@ class PostgresJsonRecordStore {
     if (planIds.length === 0 && !parentGuard)
       return this.upsert("tasks", value, context);
     await this.ensureSchema();
+    if (!queryClient && this.projectIntegrityLocked)
+      queryClient = this.options.client;
     if (!queryClient) {
       return this.withTaskParentIntegrityTransaction((client2) => this.upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context, parentGuard, client2));
     }
@@ -35966,9 +36848,11 @@ class PostgresJsonRecordStore {
   }
   async deleteTaskHierarchy(id, context = {}) {
     await this.ensureSchema();
-    return this.withTaskParentIntegrityTransaction(async (client) => {
-      const timestamp2 = new Date().toISOString();
-      const result = await client.query(`/* todos:task-parent-integrity-delete */ WITH RECURSIVE
+    if (!this.projectIntegrityLocked) {
+      return this.withDependencyGraphTransaction((scoped) => scoped.deleteTaskHierarchy(id, context));
+    }
+    const timestamp2 = new Date().toISOString();
+    const result = await this.options.client.query(`/* todos:task-parent-integrity-delete */ WITH RECURSIVE
        task_tree(object_id, path, cycle) AS (
          SELECT task.object_id, ARRAY[task.object_id], false
          FROM ${this.tableName} AS task
@@ -36030,13 +36914,12 @@ class PostgresJsonRecordStore {
        SELECT EXISTS (SELECT 1 FROM task_tree WHERE object_id = $2) AS found,
               (SELECT count(*) FROM tombstoned) AS deleted_count,
               (SELECT count(*) FROM tombstoned_related) AS related_deleted_count`, [
-        this.service,
-        id,
-        timestamp2,
-        context.requestId ?? this.sourceMachineId ?? null
-      ]);
-      return Boolean(result.rows[0]?.found);
-    });
+      this.service,
+      id,
+      timestamp2,
+      context.requestId ?? this.sourceMachineId ?? null
+    ]);
+    return Boolean(result.rows[0]?.found);
   }
   async getPlanProjectLinkReceipt(receiptId2) {
     const value = await this.get("plan_project_link_receipts", receiptId2);
@@ -36492,6 +37375,102 @@ class PostgresJsonRecordStore {
          updated_at = EXCLUDED.updated_at`, [this.service, name, value]);
   }
 }
+async function bulkCreateTasksAtomic(inputs, store, context) {
+  return store.withDependencyGraphTransaction(async (scoped) => {
+    const tempIds = new Map;
+    const created = [];
+    const dependencies = [];
+    for (const input of inputs) {
+      const { temp_id, depends_on: _dependsOn, ...taskInput } = input;
+      const task = await createTask2(taskInput, scoped, context);
+      if (temp_id)
+        tempIds.set(temp_id, task.id);
+      created.push({ temp_id: temp_id ?? null, id: task.id, short_id: task.short_id, title: task.title });
+    }
+    for (let index = 0;index < inputs.length; index++) {
+      const input = inputs[index];
+      const taskId = created[index].id;
+      const seenDependencies = new Set;
+      for (const reference of input.depends_on ?? []) {
+        const exact = tempIds.get(reference) ?? (await scoped.get("tasks", reference))?.id;
+        const dependencyId = exact ?? (await scoped.resolveTaskRef(reference))?.id;
+        if (!dependencyId)
+          throw new TaskNotFoundError(reference);
+        if (seenDependencies.has(dependencyId)) {
+          throw new ResourceConflictError("BULK_CREATE_DUPLICATE_DEPENDENCY", `Multiple references resolve to dependency ${dependencyId}`);
+        }
+        seenDependencies.add(dependencyId);
+        dependencies.push(await addDependency2(taskId, dependencyId, scoped, context));
+      }
+    }
+    return { schema_version: 1, atomic: true, created, dependencies };
+  });
+}
+async function bulkDeleteTasksAtomic(ids, force, store, context) {
+  return store.withDependencyGraphTransaction(async (scoped) => {
+    const resolved = [];
+    for (const reference of ids) {
+      resolved.push({
+        reference,
+        task: await scoped.get("tasks", reference) ?? await scoped.resolveTaskRef(reference)
+      });
+    }
+    const seen = new Set;
+    for (const item of resolved) {
+      if (!item.task)
+        continue;
+      if (seen.has(item.task.id)) {
+        throw new ResourceConflictError("BULK_DELETE_DUPLICATE_TASK", `Multiple references resolve to task ${item.task.id}`);
+      }
+      seen.add(item.task.id);
+    }
+    const childState = new Map;
+    for (const item of resolved) {
+      if (!item.task)
+        continue;
+      const children = await scoped.listTasks({ parent_id: item.task.id, include_subtasks: true, limit: 1 });
+      childState.set(item.task.id, children.length > 0);
+    }
+    const planned = resolved.filter((item) => item.task && (force || !childState.get(item.task.id)));
+    const plannedIds = new Set(planned.map((item) => item.task.id));
+    const roots = [];
+    for (const item of planned) {
+      if (!force) {
+        roots.push(item);
+        continue;
+      }
+      let parentId = item.task.parent_id;
+      let covered = false;
+      while (parentId) {
+        if (plannedIds.has(parentId)) {
+          covered = true;
+          break;
+        }
+        parentId = (await scoped.get("tasks", parentId))?.parent_id ?? null;
+      }
+      if (!covered)
+        roots.push(item);
+    }
+    for (const item of roots) {
+      if (!await scoped.deleteTaskHierarchy(item.task.id, context)) {
+        throw new Error(`Atomic bulk delete lost task ${item.task.id}`);
+      }
+    }
+    return {
+      schema_version: 1,
+      atomic: true,
+      force,
+      results: resolved.map((item) => {
+        if (!item.task)
+          return { requested_id: item.reference, task_id: null, outcome: "missing", reason: "not_found" };
+        if (!force && childState.get(item.task.id)) {
+          return { requested_id: item.reference, task_id: item.task.id, outcome: "skipped", reason: "has_children" };
+        }
+        return { requested_id: item.reference, task_id: item.task.id, outcome: "deleted", reason: null };
+      })
+    };
+  });
+}
 async function createTask2(input, store, context) {
   const timestamp2 = new Date().toISOString();
   const taskId = randomUUID6();
@@ -36582,12 +37561,16 @@ async function updateTask2(id, input, store, context) {
       }
     }
   }
+  const patchTouchesPlacement = input.project_id !== undefined || input.task_list_id !== undefined;
+  const effectiveProjectIdForShortId = input.project_id !== undefined ? input.project_id : existing.project_id;
+  const backfilledShortId = existing.short_id === null && patchTouchesPlacement && effectiveProjectIdForShortId ? await nextTaskShortId2(effectiveProjectIdForShortId, store, context) : null;
   const reopened = existing.status === "completed" && input.status !== undefined && input.status !== "completed" && input.completed_at === undefined;
   const terminalNow = input.status !== undefined && isTerminalStatus(input.status);
   const task = {
     ...existing,
     ...definedPatch(input),
     ...terminalNow ? { locked_by: null, locked_at: null } : {},
+    short_id: backfilledShortId ?? existing.short_id,
     version: existing.version + 1,
     updated_at: new Date().toISOString(),
     tags: input.tags ?? existing.tags,
@@ -44847,7 +45830,7 @@ var init_token_utils = __esm(() => {
       "machines_topology",
       "machines_unarchive"
     ],
-    maintenance: ["extract_todos", "get_sla_breaches", "notify_upcoming_deadlines", "run_doctor", "score_task", "watch_source_todos"]
+    maintenance: ["get_sla_breaches", "notify_upcoming_deadlines", "run_doctor", "score_task"]
   };
   MCP_PROFILE_GROUPS = {
     minimal: ["core", "loops"],
@@ -56620,6 +57603,19 @@ var init_client_ip = __esm(() => {
   TRUST_TRUE_VALUES = new Set(["1", "true", "yes", "on"]);
 });
 
+// src/server/rate-limit-config.ts
+function resolveRateLimitMax(raw) {
+  const value = raw?.trim();
+  if (!value)
+    return DEFAULT_RATE_LIMIT_MAX;
+  const maximum = Number(value);
+  if (!/^\d+$/.test(value) || !Number.isSafeInteger(maximum) || maximum < 1 || maximum > MAX_RATE_LIMIT_MAX) {
+    throw new Error(`HASNA_TODOS_RATE_LIMIT_MAX (legacy TODOS_RATE_LIMIT_MAX) must be an integer from 1 to ${MAX_RATE_LIMIT_MAX}.`);
+  }
+  return maximum;
+}
+var DEFAULT_RATE_LIMIT_MAX = 12000, MAX_RATE_LIMIT_MAX = 1e6;
+
 // src/storage/shadow-outbox.ts
 class TodosShadowOutbox {
   db;
@@ -57008,6 +58004,11 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
           archived_at: { type: ["string", "null"] }
         } },
         Task: taskSchema,
+        TaskDependency: taskDependencySchema,
+        DependencyPage: dependencyPageSchema,
+        BulkCreateTaskInput: bulkCreateTaskInputSchema,
+        BulkCreateReceipt: bulkCreateReceiptSchema,
+        BulkDeleteReceipt: bulkDeleteReceiptSchema,
         Project: projectSchema,
         TaskManifestBounds: taskManifestBoundsSchema,
         TaskManifestCapability: taskManifestCapabilitySchema,
@@ -57088,6 +58089,7 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
             parent_id: { type: "string", nullable: true },
             plan_id: { type: "string", nullable: true },
             task_list_id: { type: "string", nullable: true },
+            archived_at: { type: "string", format: "date-time", nullable: true },
             version: { type: "number" }
           }
         },
@@ -58732,6 +59734,7 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
             { name: "parent_id", in: "query", schema: { type: "string", nullable: true } },
             { name: "include_subtasks", in: "query", schema: { type: "boolean" } },
             { name: "include_archived", in: "query", schema: { type: "boolean" }, description: "Explicit archive selection; false excludes archived rows" },
+            { name: "archived_only", in: "query", schema: { type: "boolean" }, description: "Select only rows carrying archived_at; applied before bounded LIMIT/OFFSET and implies include_archived" },
             { name: "plan_read_contract", in: "query", schema: { type: "string", enum: ["1"] }, description: "Requires plan_id and explicit include_subtasks=true/include_archived; returns a versioned selection receipt" },
             { name: "plan_id", in: "query", schema: { type: "string" } },
             { name: "task_list_id", in: "query", schema: { type: "string" } },
@@ -58784,6 +59787,66 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
           }
         }
       },
+      "/v1/tasks/bulk-create": {
+        post: {
+          operationId: "bulkCreateTasks",
+          summary: "Atomically create a bounded task batch and its dependency edges",
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["schema_version", "tasks"],
+                  properties: {
+                    schema_version: { type: "integer", enum: [1] },
+                    tasks: { type: "array", minItems: 1, maxItems: 50, items: { $ref: "#/components/schemas/BulkCreateTaskInput" } }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "201": { content: { "application/json": { schema: { type: "object", required: ["receipt"], properties: { receipt: { $ref: "#/components/schemas/BulkCreateReceipt" } } } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "413": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "501": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
+      "/v1/tasks/bulk-delete": {
+        post: {
+          operationId: "bulkDeleteTasks",
+          summary: "Atomically delete a bounded task set using authoritative child checks",
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["schema_version", "task_ids"],
+                  properties: {
+                    schema_version: { type: "integer", enum: [1] },
+                    task_ids: { type: "array", minItems: 1, maxItems: 100, uniqueItems: true, items: { type: "string", minLength: 1, maxLength: 200 } },
+                    force: { type: "boolean", default: false, description: "Requires todos:* scope when true" }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", required: ["receipt"], properties: { receipt: { $ref: "#/components/schemas/BulkDeleteReceipt" } } } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "403": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "409": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "501": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
       "/v1/tasks/{id}": {
         get: {
           operationId: "getTask",
@@ -58832,6 +59895,42 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
           }
         }
       },
+      "/v1/tasks/{id}/history": {
+        get: {
+          operationId: "listTaskHistory",
+          summary: "List a storage-bounded page of one task's audit history",
+          description: "The storage adapter applies task scope, time filters, deterministic order, LIMIT, and OFFSET before materializing rows. Omission uses a bounded 500-row compatibility window and returns 426 when incomplete.",
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            { name: "limit", in: "query", required: false, schema: { type: "integer", minimum: 1, maximum: 500, default: 500 } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer", minimum: 0, default: 0 } },
+            { name: "since", in: "query", schema: { type: "string", format: "date-time" } },
+            { name: "until", in: "query", schema: { type: "string", format: "date-time" } },
+            { name: "order", in: "query", schema: { type: "string", enum: ["asc", "desc"], default: "desc" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: {
+              type: "object",
+              additionalProperties: false,
+              required: ["history", "count", "total", "limit", "offset", "order", "has_more", "next_offset"],
+              properties: {
+                history: { type: "array", maxItems: 500, items: { type: "object", additionalProperties: true } },
+                count: { type: "integer", minimum: 0, maximum: 500 },
+                total: { type: "integer", minimum: 0 },
+                limit: { type: "integer", minimum: 1, maximum: 500 },
+                offset: { type: "integer", minimum: 0 },
+                order: { type: "string", enum: ["asc", "desc"] },
+                has_more: { type: "boolean" },
+                next_offset: { type: "integer", minimum: 0, nullable: true }
+              }
+            } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "404": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "426": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "501": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
       "/v1/tasks/{id}/comments": {
         get: {
           operationId: "listTaskComments",
@@ -59890,6 +60989,95 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
           }
         }
       },
+      "/v1/agents": {
+        get: {
+          operationId: "listAgents",
+          summary: "List the shared agent roster with storage-bounded pagination",
+          description: "The authority applies a maximum 500-row LIMIT/OFFSET before materializing agents. Omitting pagination uses a 500-row legacy window and returns 426 when the roster is larger.",
+          parameters: [
+            { name: "limit", in: "query", required: false, schema: { type: "integer", minimum: 1, maximum: 500, default: 500 } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer", minimum: 0, default: 0 } },
+            { name: "include_archived", in: "query", required: false, schema: { type: "boolean", default: false } }
+          ],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    required: ["agents", "count", "total", "limit", "offset", "has_more", "next_offset"],
+                    properties: {
+                      agents: { type: "array", items: { type: "object" } },
+                      count: { type: "integer", minimum: 0 },
+                      total: { type: "integer", minimum: 0 },
+                      limit: { type: "integer", minimum: 1, maximum: 500 },
+                      offset: { type: "integer", minimum: 0 },
+                      has_more: { type: "boolean" },
+                      next_offset: { anyOf: [{ type: "integer", minimum: 0 }, { type: "null" }] }
+                    }
+                  }
+                }
+              }
+            },
+            "426": { description: "Legacy unpaged request exceeded the bounded roster window" }
+          }
+        }
+      },
+      "/v1/activity": {
+        get: {
+          operationId: "listRecentActivity",
+          summary: "List a bounded recent task-history window",
+          parameters: [
+            { name: "limit", in: "query", required: false, schema: { type: "integer", minimum: 1, maximum: 1e4, default: 50 } }
+          ],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    required: ["activity", "count", "limit"],
+                    properties: {
+                      activity: { type: "array", items: { type: "object" } },
+                      count: { type: "integer", minimum: 0 },
+                      limit: { type: "integer", minimum: 1, maximum: 1e4 }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/v1/dependencies": {
+        get: {
+          operationId: "listDependencies",
+          summary: "List dependency edges with storage-bounded pagination",
+          description: "The authority always applies a maximum 500-row LIMIT/OFFSET before materializing edges. Omitting both parameters uses limit=500 and offset=0 only when that window is complete; a larger graph returns 426 so an old client cannot mistake a partial page for the whole graph.",
+          parameters: [
+            {
+              name: "limit",
+              in: "query",
+              required: false,
+              description: "Maximum edges to materialize. Omission defaults to the bounded 500-row legacy window.",
+              schema: { type: "integer", minimum: 1, maximum: 500, default: 500 }
+            },
+            {
+              name: "offset",
+              in: "query",
+              required: false,
+              description: "Zero-based dependency-edge offset in stable storage order.",
+              schema: { type: "integer", minimum: 0, default: 0 }
+            }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/DependencyPage" } } } },
+            "400": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "426": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } },
+            "501": { content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } } }
+          }
+        }
+      },
       "/v1/task-lists": {
         get: {
           operationId: "listTaskLists",
@@ -60137,7 +61325,7 @@ function buildV1OpenApiDocument(version2 = getPackageVersion()) {
     }
   });
 }
-var atomicMigrationAuthoritySchema, atomicMigrationReceiptSchema, taskSchema, taskManifestBoundsSchema, taskManifestCapabilitySchema, taskManifestCapabilityResponseSchema, projectSchema, taskManifestBindingLookupRequestSchema, taskManifestBindingLookupResultSchema, taskManifestSchema, taskManifestReceiptSchema, taskManifestApplyResultSchema, taskManifestApplyResponseSchema, taskSubtreeTransferExpectedTaskSchema, taskSubtreeTransferSharedPlanSplitSchema, taskSubtreeTransferInspectRequestSchema, taskSubtreeTransferInspectionSchema, taskSubtreeTransferApplyRequestSchema, taskSubtreeTransferTaskImageSchema, taskSubtreeTransferPlanImageSchema, taskSubtreeTransferImageSchema, taskSubtreeTransferReceiptSchema, taskSubtreeTransferResultSchema, taskSubtreeTransferCapabilitySchema, taskSubtreeTransferRollbackRequestSchema, taskSubtreeTransferReadExactRequestSchema, taskManifestCompensateRequestSchema, taskManifestCompensationResultSchema, taskManifestCompensateResponseSchema, taskManifestReadExactRequestSchema, taskManifestBindingLookupResponseSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, staleLockHandoffInputSchema, staleLockHandoffReceiptSchema, taskGitRefSchema, planSchema, planProjectLinkReceiptSchema, planProjectLinkResultSchema, planProjectLinkRollbackResultSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema, projectRegistrationBoundsProperties, projectRegistrationReceiptSchema, projectRegistrationCapabilitySchema, projectRegistrationRequestSchema, projectRegistrationLookupRequestSchema, priorRegistrationAdoptionValidationSchema, projectResourceSchema, projectResourcePageSchema;
+var atomicMigrationAuthoritySchema, atomicMigrationReceiptSchema, taskSchema, taskDependencySchema, bulkCreateTaskInputSchema, bulkCreateReceiptSchema, bulkDeleteReceiptSchema, dependencyPageSchema, taskManifestBoundsSchema, taskManifestCapabilitySchema, taskManifestCapabilityResponseSchema, projectSchema, taskManifestBindingLookupRequestSchema, taskManifestBindingLookupResultSchema, taskManifestSchema, taskManifestReceiptSchema, taskManifestApplyResultSchema, taskManifestApplyResponseSchema, taskSubtreeTransferExpectedTaskSchema, taskSubtreeTransferSharedPlanSplitSchema, taskSubtreeTransferInspectRequestSchema, taskSubtreeTransferInspectionSchema, taskSubtreeTransferApplyRequestSchema, taskSubtreeTransferTaskImageSchema, taskSubtreeTransferPlanImageSchema, taskSubtreeTransferImageSchema, taskSubtreeTransferReceiptSchema, taskSubtreeTransferResultSchema, taskSubtreeTransferCapabilitySchema, taskSubtreeTransferRollbackRequestSchema, taskSubtreeTransferReadExactRequestSchema, taskManifestCompensateRequestSchema, taskManifestCompensationResultSchema, taskManifestCompensateResponseSchema, taskManifestReadExactRequestSchema, taskManifestBindingLookupResponseSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, staleLockHandoffInputSchema, staleLockHandoffReceiptSchema, taskGitRefSchema, planSchema, planProjectLinkReceiptSchema, planProjectLinkResultSchema, planProjectLinkRollbackResultSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema, projectRegistrationBoundsProperties, projectRegistrationReceiptSchema, projectRegistrationCapabilitySchema, projectRegistrationRequestSchema, projectRegistrationLookupRequestSchema, priorRegistrationAdoptionValidationSchema, projectResourceSchema, projectResourcePageSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   init_types();
@@ -60165,6 +61353,103 @@ var init_openapi = __esm(() => {
       updated_at: { type: "string" }
     }
   };
+  taskDependencySchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["task_id", "depends_on"],
+    properties: {
+      task_id: { type: "string", minLength: 1 },
+      depends_on: { type: "string", minLength: 1 },
+      external_project_id: { type: "string", nullable: true },
+      external_task_id: { type: "string", nullable: true }
+    }
+  };
+  bulkCreateTaskInputSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["title"],
+    properties: {
+      temp_id: { type: "string", minLength: 1, maxLength: 100 },
+      depends_on: { type: "array", maxItems: 100, items: { type: "string", minLength: 1, maxLength: 200 } },
+      title: { type: "string", minLength: 1, maxLength: 20000 },
+      description: { type: "string", nullable: true, maxLength: 1e5 },
+      status: { type: "string", enum: [...TASK_STATUSES] },
+      priority: { type: "string", enum: [...TASK_PRIORITIES] },
+      project_id: { type: "string", minLength: 1, maxLength: 200 },
+      parent_id: { type: "string" },
+      plan_id: { type: "string" },
+      task_list_id: { type: "string", minLength: 1, maxLength: 200 },
+      assigned_to: { type: "string", minLength: 1, maxLength: 200 },
+      agent_id: { type: "string" },
+      created_by: { type: "string" },
+      tags: { type: "array", maxItems: 100, items: { type: "string", minLength: 1, maxLength: 100 } },
+      estimated_minutes: { type: "number", minimum: 0 }
+    }
+  };
+  bulkCreateReceiptSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["schema_version", "atomic", "created", "dependencies"],
+    properties: {
+      schema_version: { type: "integer", enum: [1] },
+      atomic: { type: "boolean", enum: [true] },
+      created: {
+        type: "array",
+        maxItems: 100,
+        items: {
+          type: "object",
+          additionalProperties: false,
+          required: ["temp_id", "id", "short_id", "title"],
+          properties: {
+            temp_id: { type: "string", nullable: true },
+            id: { type: "string" },
+            short_id: { type: "string", nullable: true },
+            title: { type: "string" }
+          }
+        }
+      },
+      dependencies: { type: "array", maxItems: 100, items: { $ref: "#/components/schemas/TaskDependency" } }
+    }
+  };
+  bulkDeleteReceiptSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["schema_version", "atomic", "force", "results"],
+    properties: {
+      schema_version: { type: "integer", enum: [1] },
+      atomic: { type: "boolean", enum: [true] },
+      force: { type: "boolean" },
+      results: {
+        type: "array",
+        maxItems: 100,
+        items: {
+          type: "object",
+          additionalProperties: false,
+          required: ["requested_id", "task_id", "outcome", "reason"],
+          properties: {
+            requested_id: { type: "string" },
+            task_id: { type: "string", nullable: true },
+            outcome: { type: "string", enum: ["deleted", "skipped", "missing"] },
+            reason: { oneOf: [{ type: "string", enum: ["has_children", "not_found"] }, { type: "null" }] }
+          }
+        }
+      }
+    }
+  };
+  dependencyPageSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["dependencies", "count", "total", "limit", "offset", "has_more", "next_offset"],
+    properties: {
+      dependencies: { type: "array", items: { $ref: "#/components/schemas/TaskDependency" } },
+      count: { type: "integer", minimum: 0 },
+      total: { type: "integer", minimum: 0 },
+      limit: { type: "integer", minimum: 0 },
+      offset: { type: "integer", minimum: 0 },
+      has_more: { type: "boolean" },
+      next_offset: { type: "integer", minimum: 0, nullable: true }
+    }
+  };
   taskManifestBoundsSchema = {
     type: "object",
     additionalProperties: false,
@@ -61690,6 +62975,9 @@ function validateTaskPatchVocabulary(value) {
     if (!parsed.ok)
       return { ok: false, message: parsed.message };
   }
+  if (body2.archived_at !== undefined && body2.archived_at !== null && (typeof body2.archived_at !== "string" || !body2.archived_at.trim())) {
+    return { ok: false, message: "archived_at must be a non-empty timestamp string or null" };
+  }
   if (body2.parent_id !== undefined && body2.parent_id !== null && (typeof body2.parent_id !== "string" || !body2.parent_id.trim())) {
     return { ok: false, message: "parent_id must be a non-empty task id or null" };
   }
@@ -61939,6 +63227,147 @@ function validateTemplatePatch(value) {
     ...body2.plan_id === null ? { plan_id: null } : {}
   } };
 }
+function validateBulkCreateRequest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { ok: false, message: "bulk create body must be an object" };
+  }
+  const body2 = value;
+  const allowedTop = new Set(["schema_version", "tasks"]);
+  const unknownTop = Object.keys(body2).find((key3) => !allowedTop.has(key3));
+  if (unknownTop)
+    return { ok: false, message: `unknown bulk create field: ${unknownTop}` };
+  if (body2.schema_version !== 1)
+    return { ok: false, message: "schema_version must be 1" };
+  if (!Array.isArray(body2.tasks) || body2.tasks.length < 1 || body2.tasks.length > MAX_BULK_CREATE_TASKS) {
+    return { ok: false, message: `tasks must contain between 1 and ${MAX_BULK_CREATE_TASKS} items` };
+  }
+  const allowedTask = new Set([
+    "temp_id",
+    "depends_on",
+    "title",
+    "description",
+    "status",
+    "priority",
+    "project_id",
+    "parent_id",
+    "plan_id",
+    "task_list_id",
+    "agent_id",
+    "created_by",
+    "assigned_to",
+    "tags",
+    "estimated_minutes"
+  ]);
+  const tempIds = new Set;
+  const tasks = [];
+  let dependencyCount = 0;
+  for (let index = 0;index < body2.tasks.length; index++) {
+    const raw = body2.tasks[index];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+      return { ok: false, message: `tasks[${index}] must be an object` };
+    }
+    const task2 = raw;
+    const unknown = Object.keys(task2).find((key3) => !allowedTask.has(key3));
+    if (unknown)
+      return { ok: false, message: `unknown tasks[${index}] field: ${unknown}` };
+    if (typeof task2.title !== "string" || !task2.title.trim() || task2.title.length > 20000) {
+      return { ok: false, message: `tasks[${index}].title must be a non-empty string of at most 20000 characters` };
+    }
+    if (task2.description !== undefined && task2.description !== null && (typeof task2.description !== "string" || task2.description.length > 1e5)) {
+      return { ok: false, message: `tasks[${index}].description must be a string or null of at most 100000 characters` };
+    }
+    if (task2.status !== undefined && (typeof task2.status !== "string" || !TASK_STATUSES.includes(task2.status))) {
+      return { ok: false, message: `tasks[${index}].status is invalid` };
+    }
+    if (task2.priority !== undefined && (typeof task2.priority !== "string" || !TASK_PRIORITIES.includes(task2.priority))) {
+      return { ok: false, message: `tasks[${index}].priority is invalid` };
+    }
+    for (const field of ["project_id", "parent_id", "plan_id", "task_list_id", "agent_id", "created_by", "assigned_to"]) {
+      const candidate = task2[field];
+      if (candidate !== undefined && (typeof candidate !== "string" || !candidate.trim() || candidate.length > 200)) {
+        return { ok: false, message: `tasks[${index}].${field} must be a non-empty string of at most 200 characters` };
+      }
+    }
+    if (task2.tags !== undefined && (!Array.isArray(task2.tags) || task2.tags.length > 100 || task2.tags.some((tag) => typeof tag !== "string" || !tag.trim() || tag.length > 100))) {
+      return { ok: false, message: `tasks[${index}].tags must be an array of at most 100 non-empty strings` };
+    }
+    if (task2.estimated_minutes !== undefined && (typeof task2.estimated_minutes !== "number" || !Number.isFinite(task2.estimated_minutes) || task2.estimated_minutes < 0)) {
+      return { ok: false, message: `tasks[${index}].estimated_minutes must be a finite non-negative number` };
+    }
+    if (task2.temp_id !== undefined) {
+      if (typeof task2.temp_id !== "string" || !task2.temp_id.trim() || task2.temp_id.length > 100) {
+        return { ok: false, message: `tasks[${index}].temp_id must be a non-empty string of at most 100 characters` };
+      }
+      if (tempIds.has(task2.temp_id))
+        return { ok: false, message: `duplicate temp_id: ${task2.temp_id}` };
+      tempIds.add(task2.temp_id);
+    }
+    if (task2.depends_on !== undefined && (!Array.isArray(task2.depends_on) || task2.depends_on.length > MAX_BULK_DEPENDENCIES || task2.depends_on.some((ref) => typeof ref !== "string" || !ref.trim() || ref.length > 200))) {
+      return { ok: false, message: `tasks[${index}].depends_on must be an array of at most ${MAX_BULK_DEPENDENCIES} non-empty task references` };
+    }
+    if (Array.isArray(task2.depends_on) && new Set(task2.depends_on).size !== task2.depends_on.length) {
+      return { ok: false, message: `tasks[${index}].depends_on must not contain duplicates` };
+    }
+    dependencyCount += Array.isArray(task2.depends_on) ? task2.depends_on.length : 0;
+    if (dependencyCount > MAX_BULK_DEPENDENCIES) {
+      return { ok: false, message: `bulk create supports at most ${MAX_BULK_DEPENDENCIES} dependency edges` };
+    }
+    tasks.push(task2);
+  }
+  return { ok: true, tasks };
+}
+function validateBulkDeleteRequest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { ok: false, message: "bulk delete body must be an object" };
+  }
+  const body2 = value;
+  const allowed = new Set(["schema_version", "task_ids", "force"]);
+  const unknown = Object.keys(body2).find((key3) => !allowed.has(key3));
+  if (unknown)
+    return { ok: false, message: `unknown bulk delete field: ${unknown}` };
+  if (body2.schema_version !== 1)
+    return { ok: false, message: "schema_version must be 1" };
+  if (!Array.isArray(body2.task_ids) || body2.task_ids.length < 1 || body2.task_ids.length > MAX_BULK_DELETE_TASKS) {
+    return { ok: false, message: `task_ids must contain between 1 and ${MAX_BULK_DELETE_TASKS} items` };
+  }
+  if (body2.task_ids.some((id) => typeof id !== "string" || !id.trim() || id.length > 200)) {
+    return { ok: false, message: "task_ids must contain non-empty task references of at most 200 characters" };
+  }
+  if (new Set(body2.task_ids).size !== body2.task_ids.length) {
+    return { ok: false, message: "task_ids must not contain duplicates" };
+  }
+  if (body2.force !== undefined && typeof body2.force !== "boolean") {
+    return { ok: false, message: "force must be a boolean" };
+  }
+  return { ok: true, taskIds: body2.task_ids, force: body2.force === true };
+}
+async function readBoundedJson(req, maxBytes) {
+  const reader = req.body?.getReader();
+  if (!reader)
+    return { ok: false, status: 400, message: "missing JSON body" };
+  let size = 0;
+  const chunks = [];
+  try {
+    while (true) {
+      const part = await reader.read();
+      if (part.done)
+        break;
+      size += part.value.byteLength;
+      if (size > maxBytes) {
+        await reader.cancel();
+        return { ok: false, status: 413, message: `request exceeds the ${maxBytes}-byte limit` };
+      }
+      chunks.push(part.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  try {
+    return { ok: true, value: JSON.parse(Buffer.concat(chunks).toString("utf8")) };
+  } catch {
+    return { ok: false, status: 400, message: "invalid JSON body" };
+  }
+}
 async function readJson3(req) {
   try {
     const text = await req.text();
@@ -62174,6 +63603,50 @@ async function handleV1Request(req, url, dependencies = {}) {
       return error(405, "Use GET or POST /v1/machines");
     }
     if (resource === "tasks") {
+      if (id === "bulk-create" && !action) {
+        if (method !== "POST")
+          return error(405, "bulk task creation requires POST");
+        if (typeof store.tasks.bulkCreateAtomic !== "function") {
+          return error(501, "Upgrade the Todos backend: atomic bulk task creation is unavailable");
+        }
+        const body2 = await readBoundedJson(req, 2 * 1024 * 1024);
+        if (!body2.ok)
+          return error(body2.status, body2.message);
+        const parsed = validateBulkCreateRequest(body2.value);
+        if (!parsed.ok)
+          return error(400, parsed.message);
+        const normalizedTasks = [];
+        for (const task2 of parsed.tasks) {
+          if (!task2.assigned_to) {
+            normalizedTasks.push(task2);
+            continue;
+          }
+          const assigned = await store.agents.get(task2.assigned_to) ?? await store.agents.getByName(task2.assigned_to);
+          if (!assigned)
+            return error(404, `assigned agent not found: ${task2.assigned_to}`);
+          normalizedTasks.push({ ...task2, assigned_to: assigned.id });
+        }
+        const receipt = await store.tasks.bulkCreateAtomic(normalizedTasks, contextFromPrincipal(principal));
+        return json6({ receipt }, 201);
+      }
+      if (id === "bulk-delete" && !action) {
+        if (method !== "POST")
+          return error(405, "bulk task deletion requires POST");
+        if (typeof store.tasks.bulkDeleteAtomic !== "function") {
+          return error(501, "Upgrade the Todos backend: atomic bulk task deletion is unavailable");
+        }
+        const body2 = await readBoundedJson(req, 64 * 1024);
+        if (!body2.ok)
+          return error(body2.status, body2.message);
+        const parsed = validateBulkDeleteRequest(body2.value);
+        if (!parsed.ok)
+          return error(400, parsed.message);
+        if (parsed.force && !principal.scopes.includes("todos:*")) {
+          return error(403, "force bulk deletion requires todos:* scope");
+        }
+        const receipt = await store.tasks.bulkDeleteAtomic(parsed.taskIds, parsed.force, contextFromPrincipal(principal));
+        return json6({ receipt });
+      }
       if (id === "exists" && !action) {
         if (method !== "POST")
           return error(405, `method ${method} not allowed on /v1/tasks/exists`);
@@ -62259,6 +63732,13 @@ async function handleV1Request(req, url, dependencies = {}) {
           if (includeArchived !== null && includeArchived !== "true" && includeArchived !== "false") {
             return error(400, "include_archived must be true or false");
           }
+          const archivedOnly = url.searchParams.get("archived_only");
+          if (archivedOnly !== null && archivedOnly !== "true" && archivedOnly !== "false") {
+            return error(400, "archived_only must be true or false");
+          }
+          if (archivedOnly === "true" && includeArchived === "false") {
+            return error(400, "archived_only=true is incompatible with include_archived=false");
+          }
           const planRead = url.searchParams.get("plan_read_contract");
           if (planRead !== null) {
             const keys = [...url.searchParams.keys()];
@@ -62297,6 +63777,7 @@ async function handleV1Request(req, url, dependencies = {}) {
             return offsetParam.response;
           const filter = {
             ...includeArchived !== null ? { include_archived: includeArchived === "true" } : {},
+            ...archivedOnly === "true" ? { archived_only: true, include_archived: true } : {},
             ...updatedAfter !== null && updatedAfter.ok ? { updated_after: updatedAfter.value } : {},
             ...url.searchParams.get("q") ? { query: url.searchParams.get("q") } : {},
             ...statusParam.value !== undefined ? { status: statusParam.value } : {},
@@ -62468,8 +63949,48 @@ async function handleV1Request(req, url, dependencies = {}) {
             return error(405, `method ${method} not allowed on /v1/tasks/:id/history`);
           if (!await store.tasks.get(id))
             return error(404, "task not found");
-          const history = await store.audit.getTaskHistory(id);
-          return json6({ history, count: history.length });
+          if (typeof store.audit.getTaskHistoryPage !== "function") {
+            return error(501, "bounded task history is not supported by this storage backend");
+          }
+          const rawLimit = url.searchParams.get("limit");
+          const rawOffset = url.searchParams.get("offset");
+          const requestedPage = rawLimit !== null || rawOffset !== null || url.searchParams.has("order") || url.searchParams.has("since") || url.searchParams.has("until");
+          const limitParam = paginationQueryParam(url, "limit");
+          if (!limitParam.ok)
+            return limitParam.response;
+          const offsetParam = paginationQueryParam(url, "offset");
+          if (!offsetParam.ok)
+            return offsetParam.response;
+          const limit = limitParam.value ?? 500;
+          const offset = offsetParam.value ?? 0;
+          if (limit > 500)
+            return error(400, "history limit must be at most 500");
+          const order = url.searchParams.get("order") ?? "desc";
+          if (order !== "asc" && order !== "desc")
+            return error(400, "history order must be asc or desc");
+          const since = url.searchParams.get("since") ?? undefined;
+          const until = url.searchParams.get("until") ?? undefined;
+          const result = await store.audit.getTaskHistoryPage(id, { limit, offset, order, ...since ? { since } : {}, ...until ? { until } : {} }, contextFromPrincipal(principal));
+          if (!result || !Array.isArray(result.history) || !Number.isSafeInteger(result.total) || result.total < 0 || result.history.length > limit || result.history.length > 0 && offset + result.history.length > result.total) {
+            return error(500, "TASK_HISTORY_PAGE_INVALID: storage returned contradictory pagination");
+          }
+          const hasMore = offset + result.history.length < result.total;
+          if (!requestedPage && hasMore) {
+            return error(426, "task history exceeds the bounded legacy window; send limit, offset, and order with an upgraded client");
+          }
+          if (hasMore && result.history.length === 0) {
+            return error(500, "TASK_HISTORY_PAGE_STALLED: storage returned no progress before total");
+          }
+          return json6({
+            history: result.history,
+            count: result.history.length,
+            total: result.total,
+            limit,
+            offset,
+            order,
+            has_more: hasMore,
+            next_offset: hasMore ? offset + result.history.length : null
+          });
         }
         if (action === "lock" || action === "unlock") {
           if (method !== "POST")
@@ -63111,8 +64632,48 @@ async function handleV1Request(req, url, dependencies = {}) {
     }
     if (resource === "agents") {
       if (!id && method === "GET") {
-        const agents = await store.agents.list();
-        return json6({ agents, count: agents.length });
+        if (typeof store.agents.listPage !== "function") {
+          return error(501, "bounded agent pagination is not supported by this storage backend");
+        }
+        const rawLimit = url.searchParams.get("limit");
+        const rawOffset = url.searchParams.get("offset");
+        const requestedPage = rawLimit !== null || rawOffset !== null || url.searchParams.has("include_archived");
+        const limit = rawLimit === null ? 500 : Number(rawLimit);
+        const offset = rawOffset === null ? 0 : Number(rawOffset);
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+          return error(400, "agent limit must be an integer from 1 to 500");
+        }
+        if (!Number.isSafeInteger(offset) || offset < 0) {
+          return error(400, "agent offset must be a non-negative integer");
+        }
+        const includeArchivedParam = url.searchParams.get("include_archived");
+        if (includeArchivedParam !== null && includeArchivedParam !== "true" && includeArchivedParam !== "false") {
+          return error(400, "include_archived must be true or false");
+        }
+        const page = await store.agents.listPage({
+          limit,
+          offset,
+          include_archived: includeArchivedParam === "true"
+        }, contextFromPrincipal(principal));
+        if (!page || !Array.isArray(page.agents) || !Number.isSafeInteger(page.total) || page.total < 0 || page.agents.length > limit || page.agents.length > 0 && offset + page.agents.length > page.total) {
+          return error(500, "agent storage returned an invalid bounded page");
+        }
+        const hasMore = offset + page.agents.length < page.total;
+        if (!requestedPage && hasMore) {
+          return error(426, "agent roster exceeds the bounded legacy window; send limit and offset with an upgraded client");
+        }
+        if (hasMore && page.agents.length === 0) {
+          return error(500, "agent storage returned a stalled bounded page");
+        }
+        return json6({
+          agents: page.agents,
+          count: page.agents.length,
+          total: page.total,
+          limit,
+          offset,
+          has_more: hasMore,
+          next_offset: hasMore ? offset + page.agents.length : null
+        });
       }
       if (!id && method === "POST") {
         const body2 = await readJson3(req);
@@ -63157,9 +64718,15 @@ async function handleV1Request(req, url, dependencies = {}) {
       if (method !== "GET")
         return error(405, `method ${method} not allowed on /v1/activity`);
       const limitParam = url.searchParams.get("limit");
-      const limit = limitParam ? Math.max(1, Math.min(1e4, Number(limitParam) || 50)) : 50;
-      const activity = await store.audit.getRecentActivity(limit);
-      return json6({ activity, count: activity.length });
+      const limit = limitParam === null ? 50 : Number(limitParam);
+      if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e4) {
+        return error(400, "activity limit must be an integer from 1 to 10000");
+      }
+      const activity = await store.audit.getRecentActivity(limit, contextFromPrincipal(principal));
+      if (!Array.isArray(activity) || activity.length > limit) {
+        return error(500, "activity storage returned an invalid bounded result");
+      }
+      return json6({ activity, count: activity.length, limit });
     }
     if (resource === "task-lists") {
       if (!id && method === "GET") {
@@ -63253,11 +64820,40 @@ async function handleV1Request(req, url, dependencies = {}) {
     if (resource === "dependencies" && !id) {
       if (method !== "GET")
         return error(405, `method ${method} not allowed on /v1/dependencies`);
-      if (typeof store.dependencies?.listAll !== "function") {
-        return error(501, "dependency edge listing is not supported by this storage backend");
-      }
-      const dependencies2 = await store.dependencies.listAll();
-      return json6({ dependencies: dependencies2, count: dependencies2.length });
+      const limitParam = url.searchParams.get("limit");
+      const offsetParam = url.searchParams.get("offset");
+      const requestedPage = limitParam !== null || offsetParam !== null;
+      const limit = limitParam === null ? 500 : Number(limitParam);
+      const offset = offsetParam === null ? 0 : Number(offsetParam);
+      if (!Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+        return error(400, "dependency limit must be an integer from 1 to 500");
+      }
+      if (!Number.isSafeInteger(offset) || offset < 0) {
+        return error(400, "dependency offset must be a non-negative integer");
+      }
+      if (typeof store.dependencies?.listPage !== "function") {
+        return error(501, "bounded dependency pagination is not supported by this storage backend");
+      }
+      const page = await store.dependencies.listPage({ limit, offset }, contextFromPrincipal(principal));
+      if (!page || !Array.isArray(page.dependencies) || !Number.isSafeInteger(page.total) || page.total < 0 || page.dependencies.length > limit || offset + page.dependencies.length > page.total) {
+        return error(500, "dependency storage returned an invalid bounded page");
+      }
+      const hasMore = offset + page.dependencies.length < page.total;
+      if (!requestedPage && hasMore) {
+        return error(426, "dependency graph exceeds the bounded legacy window; send limit and offset with an upgraded client");
+      }
+      if (hasMore && page.dependencies.length === 0) {
+        return error(500, "dependency storage returned a stalled bounded page");
+      }
+      return json6({
+        dependencies: page.dependencies,
+        count: page.dependencies.length,
+        total: page.total,
+        limit,
+        offset,
+        has_more: hasMore,
+        next_offset: hasMore ? offset + page.dependencies.length : null
+      });
     }
     if (resource === "commits" && id) {
       if (method !== "GET")
@@ -63447,7 +65043,7 @@ async function handleV1Request(req, url, dependencies = {}) {
     return error(500, e.message || "internal error");
   }
 }
-var JSON_HEADERS5, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500, RFC3339_DATE_TIME;
+var JSON_HEADERS5, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500, MAX_BULK_CREATE_TASKS = 50, MAX_BULK_DELETE_TASKS = 100, MAX_BULK_DEPENDENCIES = 100, RFC3339_DATE_TIME;
 var init_v1 = __esm(() => {
   init_atomic_project_migration();
   init_machine_registry();
@@ -64176,6 +65772,15 @@ function registerTaskCrudTools(server, ctx) {
         if (assigned_to) {
           resolved.assigned_to = resolveAssignee(await validateMcpAssignee(assigned_to, Boolean(params.allow_seat)));
         }
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          if (project_id)
+            resolved.project_id = await cloudResolveProjectRef(cloud, project_id);
+          if (task_list_id)
+            resolved.task_list_id = await cloudResolveTaskListRef(cloud, task_list_id);
+          const remote = await cloudUpsertTaskByFingerprint(cloud, resolved);
+          return { content: [{ type: "text", text: compactJson({ created: remote.created, task: JSON.parse(mutationTaskResponse(remote.task)) }) }] };
+        }
         if (project_id)
           resolved.project_id = resolveId(project_id, "projects");
         if (task_list_id)
@@ -64744,7 +66349,7 @@ __export(exports_mention_resolver, {
   resolveMentions: () => resolveMentions
 });
 import { existsSync as existsSync20, readdirSync as readdirSync4, readFileSync as readFileSync14, statSync as statSync10 } from "fs";
-import { basename as basename8, isAbsolute, join as join19, relative as relative5, resolve as resolve19, sep as sep4 } from "path";
+import { basename as basename8, isAbsolute as isAbsolute2, join as join19, relative as relative5, resolve as resolve19, sep as sep4 } from "path";
 function blankResolution(parsed) {
   return {
     input: parsed.input,
@@ -64771,7 +66376,7 @@ function normalizeWorkspace(workspace) {
 }
 function isInside(root, absolutePath) {
   const rel = relative5(root, absolutePath);
-  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep4}`) && !isAbsolute(rel);
+  return rel === "" || !rel.startsWith("..") && !rel.includes(`..${sep4}`) && !isAbsolute2(rel);
 }
 function normalizeRelativePath(value) {
   const normalized2 = value.trim().replace(/^\.?\//, "").replace(/\\/g, "/");
@@ -68834,6 +70439,12 @@ function registerTaskProjectTools(server, ctx) {
       version: exports_external.number().optional().describe("Expected version for optimistic locking")
     }, async ({ task_id, deadline, version: version2 }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remoteTaskId = await cloudResolveTaskRef(cloud, task_id);
+          const rescheduled = await cloudUpdateTaskVerified(cloud, remoteTaskId, version2 !== undefined ? { due_at: deadline, version: version2 } : { due_at: deadline });
+          return { content: [{ type: "text", text: formatTask(rescheduled) }] };
+        }
         const resolvedId = resolveId(task_id);
         const task2 = updateWithOptionalVersion(resolvedId, { due_at: deadline }, version2);
         return { content: [{ type: "text", text: formatTask(task2) }] };
@@ -68921,12 +70532,36 @@ function registerTaskProjectTools(server, ctx) {
   }
   if (shouldRegisterTool("bulk_update_tasks")) {
     server.tool("bulk_update_tasks", "Update multiple tasks at once. All tasks must pass the dependency check.", {
-      task_ids: exports_external.array(exports_external.string()).describe("Array of task IDs to update"),
+      task_ids: exports_external.array(exports_external.string().min(1).max(200)).min(1).max(100).describe("Array of task IDs to update"),
       status: exports_external.enum(["pending", "in_progress", "completed", "failed", "cancelled"]).optional(),
       priority: exports_external.enum(["low", "medium", "high", "critical"]).optional(),
       assigned_to: exports_external.string().nullable().optional().describe("Agent ID or name, null to unassign")
     }, async ({ task_ids, status: status3, priority, assigned_to }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const resolvedIds = [];
+          for (const reference of task_ids)
+            resolvedIds.push(await cloudResolveTaskRef(cloud, reference));
+          const patch = {};
+          if (status3 !== undefined)
+            patch.status = status3;
+          if (priority !== undefined)
+            patch.priority = priority;
+          if (assigned_to !== undefined)
+            patch.assigned_to = assigned_to === null ? null : await cloudResolveAgentRef(cloud, assigned_to);
+          let updated = 0;
+          const failed = [];
+          for (let index = 0;index < resolvedIds.length; index++) {
+            try {
+              await cloudUpdateTaskVerified(cloud, resolvedIds[index], patch);
+              updated++;
+            } catch {
+              failed.push(task_ids[index]);
+            }
+          }
+          return { content: [{ type: "text", text: `${updated} task(s) updated, ${failed.length} failed.${failed.length ? ` Failed: ${failed.map((f) => f.slice(0, 8)).join(", ")}` : ""}` }] };
+        }
         const { bulkUpdateTasks: bulkUpdateTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolved = task_ids.map(resolveId);
         let resolvedAssignee = assigned_to;
@@ -68942,6 +70577,7 @@ function registerTaskProjectTools(server, ctx) {
   if (shouldRegisterTool("bulk_create_tasks")) {
     server.tool("bulk_create_tasks", "Create multiple tasks at once from an array of task objects.", {
       tasks: exports_external.array(exports_external.object({
+        temp_id: exports_external.string().min(1).max(100).optional().describe("Caller-local handle for sibling dependencies in this batch"),
         title: exports_external.string(),
         description: exports_external.string().optional(),
         status: exports_external.enum(["pending", "in_progress", "completed", "failed", "cancelled"]).optional(),
@@ -68949,28 +70585,44 @@ function registerTaskProjectTools(server, ctx) {
         project_id: exports_external.string().optional(),
         task_list_id: exports_external.string().optional(),
         assigned_to: exports_external.string().optional(),
-        depends_on: exports_external.array(exports_external.string()).optional(),
-        short_id: exports_external.string().nullable().optional(),
+        depends_on: exports_external.array(exports_external.string().min(1).max(200)).max(100).optional(),
         tags: exports_external.array(exports_external.string()).optional(),
         estimate: exports_external.number().optional()
-      })).describe("Array of task objects")
+      })).min(1).max(50).describe("Array of task objects")
     }, async ({ tasks }) => {
       try {
-        const { bulkCreateTasks: bulkCreateTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
-        const resolved = tasks.map((t) => {
-          const r = { ...t };
-          if (r.project_id)
-            r.project_id = resolveId(r.project_id, "projects");
-          if (r.task_list_id)
-            r.task_list_id = resolveId(r.task_list_id, "task_lists");
-          if (r.assigned_to)
-            r.assigned_to = resolveId(r.assigned_to, "agents");
-          if (r.depends_on)
-            r.depends_on = r.depends_on.map((id) => resolveId(id));
-          return r;
-        });
-        const result = bulkCreateTasks2(resolved);
-        return { content: [{ type: "text", text: `${result.created.length} task(s) created.` }] };
+        const router = resolveWritableIdentity();
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remoteAgentId = router.agent_id ? await cloudResolveAgentRef(cloud, router.agent_id) : undefined;
+          const remote = [];
+          for (const t of tasks) {
+            const { estimate, project_id, task_list_id, ...rest } = t;
+            const assignedTo = t.assigned_to ? await cloudResolveAgentRef(cloud, t.assigned_to) : undefined;
+            remote.push({
+              ...rest,
+              ...remoteAgentId ? { agent_id: remoteAgentId, created_by: remoteAgentId } : {},
+              ...assignedTo ? { assigned_to: assignedTo } : {},
+              ...estimate !== undefined ? { estimated_minutes: estimate } : {},
+              ...project_id ? { project_id: await cloudResolveProjectRef(cloud, project_id) } : {},
+              ...task_list_id ? { task_list_id: await cloudResolveTaskListRef(cloud, task_list_id) } : {}
+            });
+          }
+          const receipt2 = await cloudBulkCreateTasks(cloud, remote);
+          return { content: [{ type: "text", text: JSON.stringify(receipt2) }] };
+        }
+        const { createLocalSqliteTodosStorageAdapter: createLocalSqliteTodosStorageAdapter2 } = (init_local_sqlite(), __toCommonJS(exports_local_sqlite));
+        const resolved = tasks.map((task2) => ({
+          ...task2,
+          ...router.agent_id ? { agent_id: router.agent_id, created_by: router.agent_id } : {},
+          ...task2.project_id ? { project_id: resolveId(task2.project_id, "projects") } : {},
+          ...task2.task_list_id ? { task_list_id: resolveId(task2.task_list_id, "task_lists") } : {},
+          ...task2.assigned_to ? { assigned_to: resolveId(task2.assigned_to, "agents") } : {},
+          ...task2.estimate !== undefined ? { estimated_minutes: task2.estimate } : {}
+        }));
+        const local = createLocalSqliteTodosStorageAdapter2({ db: getDatabase() });
+        const receipt = await local.tasks.bulkCreateAtomic(resolved);
+        return { content: [{ type: "text", text: `${receipt.created.length} task(s) created.` }] };
       } catch (e) {
         return { content: [{ type: "text", text: formatError(e) }], isError: true };
       }
@@ -68978,14 +70630,21 @@ function registerTaskProjectTools(server, ctx) {
   }
   if (shouldRegisterTool("bulk_delete_tasks")) {
     server.tool("bulk_delete_tasks", "Delete multiple tasks at once. Tasks with active children are skipped.", {
-      task_ids: exports_external.array(exports_external.string()).describe("Array of task IDs"),
+      task_ids: exports_external.array(exports_external.string().min(1).max(200)).min(1).max(100).describe("Array of unique task IDs or refs"),
       force: exports_external.boolean().optional().describe("Skip child check for all tasks (dangerous)")
     }, async ({ task_ids, force }) => {
       try {
-        const { bulkDeleteTasks: bulkDeleteTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
-        const resolved = task_ids.map(resolveId);
-        const result = bulkDeleteTasks2(resolved, force);
-        return { content: [{ type: "text", text: `${result.deleted} task(s) deleted, ${result.skipped} skipped (has children).` }] };
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const receipt2 = await cloudBulkDeleteTasks(cloud, task_ids, force === true);
+          return { content: [{ type: "text", text: JSON.stringify(receipt2) }] };
+        }
+        const { createLocalSqliteTodosStorageAdapter: createLocalSqliteTodosStorageAdapter2 } = (init_local_sqlite(), __toCommonJS(exports_local_sqlite));
+        const local = createLocalSqliteTodosStorageAdapter2({ db: getDatabase() });
+        const receipt = await local.tasks.bulkDeleteAtomic(task_ids, force === true);
+        const deleted = receipt.results.filter((result) => result.outcome === "deleted").length;
+        const skipped = receipt.results.filter((result) => result.outcome === "skipped").length;
+        return { content: [{ type: "text", text: `${deleted} task(s) deleted, ${skipped} skipped (has children).` }] };
       } catch (e) {
         return { content: [{ type: "text", text: formatError(e) }], isError: true };
       }
@@ -69921,6 +71580,20 @@ Tasks:` : null,
       task_id: exports_external.string().describe("Task ID")
     }, async ({ task_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remoteTaskId = await cloudResolveTaskRef(cloud, task_id);
+          const page = await cloudListComments(cloud, remoteTaskId, { limit: 100 });
+          if (page.comments.length === 0)
+            return { content: [{ type: "text", text: "No comments." }] };
+          const remoteLines = page.comments.map((c) => `[${c.agent_id || "unknown"}] ${c.created_at?.slice(0, 16)}:
+  ${c.content}`);
+          if (page.has_more)
+            remoteLines.push(`(older comments available; showing the ${page.comments.length} most recent)`);
+          return { content: [{ type: "text", text: remoteLines.join(`
+
+`) }] };
+        }
         const resolvedId = resolveId(task_id);
         const comments = listComments(resolvedId);
         if (comments.length === 0)
@@ -69939,13 +71612,50 @@ Tasks:` : null,
     server.tool("get_activity_timeline", "Get a unified local activity timeline across comments, task history, and run evidence.", {
       entity_type: exports_external.enum(["all", "task", "project", "plan", "run"]).optional().describe("Scope type. Defaults to all."),
       entity_id: exports_external.string().optional().describe("ID for task/project/plan/run scope."),
-      limit: exports_external.number().optional().describe("Max entries, default 50."),
-      offset: exports_external.number().optional().describe("Entries to skip for pagination."),
+      limit: exports_external.number().int().min(1).max(200).optional().describe("Max entries, default 50, maximum 200."),
+      offset: exports_external.number().int().min(0).max(1e4).optional().describe("Entries to skip for pagination, maximum 10000."),
       order: exports_external.enum(["asc", "desc"]).optional().describe("Sort order, default desc."),
       since: exports_external.string().optional().describe("Only entries at or after this ISO timestamp."),
       until: exports_external.string().optional().describe("Only entries at or before this ISO timestamp.")
     }, async (input) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const limit = input.limit ?? 50;
+          const offset = input.offset ?? 0;
+          const scopeType = input.entity_type ?? "all";
+          if (scopeType !== "all" && scopeType !== "task") {
+            throw new Error(`REMOTE_API_INCOMPATIBLE: hosted activity does not yet support ${scopeType}-scoped timelines`);
+          }
+          const entityId2 = scopeType === "task" ? input.entity_id ? await cloudResolveTaskRef(cloud, input.entity_id) : null : null;
+          const historyPage = entityId2 ? await cloudTaskHistoryPage(cloud, entityId2, {
+            limit,
+            offset,
+            order: input.order ?? "desc",
+            ...input.since ? { since: input.since } : {},
+            ...input.until ? { until: input.until } : {}
+          }) : null;
+          let entries = historyPage ? historyPage.history : await cloudRecentActivity(cloud, Math.min(1e4, limit + offset));
+          if (!historyPage) {
+            if (input.since)
+              entries = entries.filter((entry2) => (entry2.created_at ?? "") >= input.since);
+            if (input.until)
+              entries = entries.filter((entry2) => (entry2.created_at ?? "") <= input.until);
+          }
+          if (!historyPage && input.order === "asc")
+            entries = [...entries].reverse();
+          const page = historyPage ? entries : entries.slice(offset, offset + limit);
+          return { content: [{ type: "text", text: JSON.stringify({
+            source: "cloud",
+            scope: { entity_type: scopeType, entity_id: entityId2 },
+            entries: page,
+            count: page.length,
+            complete: historyPage ? offset === 0 && !historyPage.has_more : false,
+            ...historyPage ? { total: historyPage.total, has_more: historyPage.has_more, next_offset: historyPage.next_offset } : {},
+            omitted_sources: entityId2 ? ["comments", "run_evidence"] : ["comments", "run_evidence", "older_task_history"],
+            omitted_reason: entityId2 ? "the hosted task-history route does not include comments or run evidence" : "the hosted recent-activity route is bounded and does not include comments or run evidence"
+          }) }] };
+        }
         let entityId = input.entity_id;
         if (input.entity_type === "task" && entityId)
           entityId = resolveId(entityId);
@@ -70163,9 +71873,25 @@ Tasks:` : null,
       query: exports_external.string().describe("Search query"),
       project_id: exports_external.string().optional().describe("Filter by project"),
       status: exports_external.enum(["pending", "in_progress", "completed", "failed", "cancelled"]).optional(),
-      limit: exports_external.number().optional().describe("Max results (default: 20)")
+      limit: exports_external.number().int().min(1).max(100).optional().describe("Max results (default: 20, maximum: 100)")
     }, async ({ query, project_id, status: status3, limit }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remoteProjectId = project_id ? await cloudResolveProjectRef(cloud, project_id) : undefined;
+          const remote = await cloudListTasks(cloud, {
+            query,
+            ...remoteProjectId ? { project_id: remoteProjectId } : {},
+            ...status3 ? { status: status3 } : {},
+            limit: limit || 20
+          });
+          if (remote.length === 0)
+            return { content: [{ type: "text", text: `No results for: ${query}` }] };
+          const remoteLines = remote.map((t) => `${t.short_id || t.id.slice(0, 8)} [${t.status}] ${t.title}`);
+          return { content: [{ type: "text", text: `${remote.length} result(s) for "${query}":
+${remoteLines.join(`
+`)}` }] };
+        }
         const { searchTasks: searchTasks2 } = (init_search(), __toCommonJS(exports_search));
         const resolved = { query, limit };
         if (project_id)
@@ -70266,6 +71992,8 @@ var init_task_project_tools = __esm(() => {
   init_comments();
   init_task_runs();
   init_project_bootstrap();
+  init_database();
+  init_creator_identity();
   init_labels();
   init_tags();
   init_redaction();
@@ -71068,6 +72796,29 @@ function registerTaskAutoTools(server, ctx) {
       project_id: exports_external.string().optional().describe("Scope to a project")
     }, async ({ days = 7, project_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const cutoff = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
+          const stampedAt = new Date().toISOString();
+          const remoteProjectId = project_id ? await cloudResolveProjectRef(cloud, project_id) : undefined;
+          const selection = await cloudListTasksCompleteBounded(cloud, {
+            status: "completed",
+            include_archived: false,
+            ...remoteProjectId ? { project_id: remoteProjectId } : {}
+          });
+          for (const task2 of selection) {
+            if (typeof task2.updated_at !== "string" || !task2.updated_at || !Number.isSafeInteger(task2.version)) {
+              throw new Error("REMOTE_API_INCOMPATIBLE: archive selection contains a task without updated_at and version");
+            }
+          }
+          const candidates = selection.filter((task2) => task2.updated_at < cutoff);
+          let archived = 0;
+          for (const t of candidates) {
+            await cloudUpdateTaskVerified(cloud, t.id, { archived_at: stampedAt, version: t.version });
+            archived++;
+          }
+          return { content: [{ type: "text", text: `Archived ${archived} completed task(s) older than ${days} days.` }] };
+        }
         const { archiveCompletedTasks: archiveCompletedTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedProjectId = project_id ? resolveId(project_id, "projects") : undefined;
         const count = archiveCompletedTasks2(days, resolvedProjectId);
@@ -71082,6 +72833,14 @@ function registerTaskAutoTools(server, ctx) {
       task_id: exports_external.string().describe("Task ID")
     }, async ({ task_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const current = await cloudGetTask(cloud, task_id);
+          if (!current)
+            throw new Error(`Task not found: ${task_id}`);
+          await cloudUpdateTaskVerified(cloud, current.id, { archived_at: null, version: current.version });
+          return { content: [{ type: "text", text: `Task ${task_id.slice(0, 8)} restored from archive.` }] };
+        }
         const { unarchiveTask: unarchiveTask2 } = (init_tasks(), __toCommonJS(exports_tasks));
         unarchiveTask2(resolveId(task_id));
         return { content: [{ type: "text", text: `Task ${task_id.slice(0, 8)} restored from archive.` }] };
@@ -71093,12 +72852,36 @@ function registerTaskAutoTools(server, ctx) {
   if (shouldRegisterTool("get_archived_tasks")) {
     server.tool("get_archived_tasks", "List archived tasks.", {
       project_id: exports_external.string().optional().describe("Filter by project"),
-      limit: exports_external.number().optional().describe("Max results (default: 50)")
-    }, async ({ project_id, limit }) => {
+      limit: exports_external.number().int().min(1).max(200).optional().describe("Max results (default: 50, maximum: 200)"),
+      offset: exports_external.number().int().min(0).max(1e4).optional().describe("Archived rows to skip (default: 0, maximum: 10000)")
+    }, async ({ project_id, limit, offset }) => {
       try {
-        const { getArchivedTasks: getArchivedTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remoteProjectId = project_id ? await cloudResolveProjectRef(cloud, project_id) : undefined;
+          const page = await cloudListArchivedTasksPage(cloud, {
+            ...remoteProjectId ? { project_id: remoteProjectId } : {},
+            limit: limit ?? 50,
+            offset: offset ?? 0
+          });
+          if (page.tasks.length === 0)
+            return { content: [{ type: "text", text: "No archived tasks." }] };
+          const remoteLines = page.tasks.map((t) => `${t.short_id || t.id.slice(0, 8)} ${t.title} archived ${t.archived_at}`);
+          if (page.has_more)
+            remoteLines.push(`(${page.total - (page.offset + page.tasks.length)} more archived task(s); next offset ${page.next_offset})`);
+          return { content: [{ type: "text", text: remoteLines.join(`
+`) }] };
+        }
+        const { listTasks: listTasks3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedProjectId = project_id ? resolveId(project_id, "projects") : undefined;
-        const tasks = getArchivedTasks2({ project_id: resolvedProjectId, limit: limit || 50 });
+        const tasks = listTasks3({
+          ...resolvedProjectId ? { project_id: resolvedProjectId } : {},
+          include_archived: true,
+          archived_only: true,
+          include_subtasks: true,
+          limit: limit ?? 50,
+          offset: offset ?? 0
+        });
         if (tasks.length === 0)
           return { content: [{ type: "text", text: "No archived tasks." }] };
         const lines = tasks.map((t) => `${t.short_id || t.id.slice(0, 8)} ${t.title} archived ${t.archived_at}`);
@@ -71131,12 +72914,29 @@ function registerTaskAutoTools(server, ctx) {
       agent_id: exports_external.string().optional().describe("Agent ID (defaults to context agent)")
     }, async ({ agent_id }) => {
       try {
-        const { listTasks: listTasks3, getBlockedTasks: getBlockedTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const focus = ctx.getAgentFocus(agent_id || "");
         const effectiveAgentId = focus ? focus.agent_id : agent_id || "";
         if (!effectiveAgentId) {
           return { content: [{ type: "text", text: "No agent_id provided and no agent focus is active." }], isError: true };
         }
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remoteAssigned = await cloudListTasks(cloud, { assigned_to: effectiveAgentId, limit: 500 });
+          const remoteNow = Date.now();
+          const remoteDueSoon = remoteNow + 24 * 60 * 60 * 1000;
+          const remoteBlocked = await cloudBlockingDepsMap(cloud, remoteAssigned.filter((t) => !["completed", "cancelled", "failed"].includes(t.status)));
+          const remoteLines = [
+            `Agent: ${effectiveAgentId}`,
+            `In Progress: ${remoteAssigned.filter((t) => t.status === "in_progress").length}`,
+            `Pending: ${remoteAssigned.filter((t) => t.status === "pending").length}`,
+            `Completed (recent): ${remoteAssigned.filter((t) => t.status === "completed" && t.completed_at && remoteNow - new Date(t.completed_at).getTime() <= 7 * 24 * 60 * 60 * 1000).length}`,
+            `Due Soon: ${remoteAssigned.filter((t) => t.due_at && new Date(t.due_at).getTime() <= remoteDueSoon && new Date(t.due_at).getTime() >= remoteNow && !["completed", "cancelled", "failed"].includes(t.status)).length}`,
+            `Blocked: ${remoteBlocked.size}`
+          ];
+          return { content: [{ type: "text", text: remoteLines.join(`
+`) }] };
+        }
+        const { listTasks: listTasks3, getBlockedTasks: getBlockedTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const assigned = listTasks3({ assigned_to: effectiveAgentId, limit: 500 }, undefined);
         const now4 = Date.now();
         const dueSoonCutoff = now4 + 24 * 60 * 60 * 1000;
@@ -71170,6 +72970,60 @@ function registerTaskAutoTools(server, ctx) {
       max_per_agent: exports_external.number().optional().describe("Max tasks per agent (default: 5)")
     }, async ({ project_id, max_per_agent }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const cap = max_per_agent || 5;
+          const remoteProjectId = project_id ? await cloudResolveProjectRef(cloud, project_id) : undefined;
+          const roster = (await cloudListAgents(cloud)).filter((a) => a.status !== "archived");
+          if (roster.length === 0)
+            return { content: [{ type: "text", text: "No active agents available for rebalancing." }] };
+          const active = await cloudListTasksCompleteBounded(cloud, {
+            status: ["pending", "in_progress"],
+            ...remoteProjectId ? { project_id: remoteProjectId } : {}
+          });
+          for (const task2 of active) {
+            if (!Number.isSafeInteger(task2.version) || typeof task2.status !== "string") {
+              throw new Error("REMOTE_API_INCOMPATIBLE: rebalance selection contains an incomplete task");
+            }
+          }
+          const keyByAlias = new Map;
+          const ambiguous = new Set;
+          const index = (alias2, agentId) => {
+            if (!alias2)
+              return;
+            const key3 = alias2.toLowerCase();
+            if (ambiguous.has(key3))
+              return;
+            const seen = keyByAlias.get(key3);
+            if (seen !== undefined && seen !== agentId) {
+              keyByAlias.delete(key3);
+              ambiguous.add(key3);
+              return;
+            }
+            keyByAlias.set(key3, agentId);
+          };
+          for (const agent of roster) {
+            index(agent.id, agent.id);
+            index(agent.name, agent.id);
+          }
+          const keyOf = (assignedTo) => assignedTo ? keyByAlias.get(assignedTo.toLowerCase()) : undefined;
+          const load2 = new Map(roster.map((a) => [a.id, active.filter((t) => keyOf(t.assigned_to) === a.id).length]));
+          let moved2 = 0;
+          let skipped2 = 0;
+          for (const t of active.filter((t2) => t2.status === "pending" && keyOf(t2.assigned_to) && (load2.get(keyOf(t2.assigned_to)) ?? 0) > cap)) {
+            const from = keyOf(t.assigned_to);
+            const target = roster.filter((a) => a.id !== from).sort((a, b) => (load2.get(a.id) ?? 0) - (load2.get(b.id) ?? 0))[0];
+            if (!target || (load2.get(target.id) ?? 0) >= cap) {
+              skipped2++;
+              continue;
+            }
+            await cloudUpdateTaskVerified(cloud, t.id, { assigned_to: target.id, version: t.version });
+            load2.set(from, (load2.get(from) ?? 1) - 1);
+            load2.set(target.id, (load2.get(target.id) ?? 0) + 1);
+            moved2++;
+          }
+          return { content: [{ type: "text", text: `Rebalanced: moved ${moved2} task(s), ${skipped2} skipped.` }] };
+        }
         const { listAgents: listAgents2 } = (init_agents(), __toCommonJS(exports_agents));
         const { listTasks: listTasks3, updateTask: updateTask3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedProjectId = project_id ? resolveId(project_id, "projects") : undefined;
@@ -71226,6 +73080,20 @@ function registerTaskAutoTools(server, ctx) {
       agent_id: exports_external.string().optional().describe("Filter by assignee")
     }, async ({ hours = 24, project_id, agent_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const horizon = Date.now() + hours * 60 * 60 * 1000;
+          const remote = (await cloudListTasks(cloud, {
+            ...project_id ? { project_id } : {},
+            ...agent_id ? { assigned_to: agent_id } : {}
+          })).filter((t) => t.due_at && !["completed", "cancelled", "failed"].includes(t.status) && new Date(t.due_at).getTime() <= horizon && new Date(t.due_at).getTime() >= Date.now()).sort((a, b) => (a.due_at ?? "").localeCompare(b.due_at ?? ""));
+          if (remote.length === 0)
+            return { content: [{ type: "text", text: "No deadlines approaching." }] };
+          const remoteLines = remote.map((t) => `${t.short_id || t.id.slice(0, 8)} ${t.title} due ${t.due_at}`);
+          return { content: [{ type: "text", text: `${remote.length} task(s) due within ${hours}h:
+${remoteLines.join(`
+`)}` }] };
+        }
         const { notifyUpcomingDeadlines: notifyUpcomingDeadlines2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedProjectId = project_id ? resolveId(project_id, "projects") : undefined;
         const resolvedAgentId = agent_id ? resolveId(agent_id, "agents") : undefined;
@@ -71248,6 +73116,16 @@ ${lines.join(`
       limit: exports_external.number().optional().describe("Max results (default: 50)")
     }, async ({ project_id, agent_id, limit }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remote = (await cloudEscalatedTasks(cloud, { project_id, agent_id })).slice(0, limit || 50);
+          if (remote.length === 0)
+            return { content: [{ type: "text", text: "No SLA breaches or overdue tasks." }] };
+          const remoteLines = remote.map((item) => `${item.task.short_id || item.task.id.slice(0, 8)} ${item.task.title} ${item.reasons.join(",")} breached ${item.breached_at}`);
+          return { content: [{ type: "text", text: `${remote.length} escalation(s):
+${remoteLines.join(`
+`)}` }] };
+        }
         const { getEscalatedTasks: getEscalatedTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedProjectId = project_id ? resolveId(project_id, "projects") : undefined;
         const resolvedAgentId = agent_id ? resolveId(agent_id, "agents") : undefined;
@@ -71273,6 +73151,16 @@ ${lines.join(`
       project_id: exports_external.string().optional().describe("Filter by project")
     }, async ({ hours = 48, minutes: minutes2, project_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remote = await cloudStaleTasks(cloud, minutes2 ?? hours * 60, project_id ? { project_id } : {});
+          if (remote.length === 0)
+            return { content: [{ type: "text", text: "No stale tasks." }] };
+          const remoteLines = remote.map((t) => `${t.short_id || t.id.slice(0, 8)} [${t.status}] ${t.title} \u2014 last updated ${t.updated_at}`);
+          return { content: [{ type: "text", text: `${remote.length} stale task(s):
+${remoteLines.join(`
+`)}` }] };
+        }
         const { getStaleTasks: getStaleTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedProjectId = project_id ? resolveId(project_id, "projects") : undefined;
         const tasks = getStaleTasks2({ hours, minutes: minutes2, project_id: resolvedProjectId });
@@ -71292,6 +73180,18 @@ ${lines.join(`
       project_id: exports_external.string().optional().describe("Filter by project")
     }, async ({ project_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const candidates = (await cloudListTasks(cloud, project_id ? { project_id } : {})).filter((t) => !["completed", "cancelled"].includes(t.status));
+          const blocking = await cloudBlockingDepsMap(cloud, candidates);
+          const remote = candidates.filter((t) => blocking.has(t.id));
+          if (remote.length === 0)
+            return { content: [{ type: "text", text: "No blocked tasks." }] };
+          const remoteLines = remote.map((t) => `${t.short_id || t.id.slice(0, 8)} [${t.status}] ${t.title} \u2014 blocked by ${(blocking.get(t.id) ?? []).map((b) => b.id.slice(0, 8)).join(", ")}`);
+          return { content: [{ type: "text", text: `${remote.length} blocked task(s):
+${remoteLines.join(`
+`)}` }] };
+        }
         const { getBlockedTasks: getBlockedTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedProjectId = project_id ? resolveId(project_id, "projects") : undefined;
         const tasks = getBlockedTasks2(resolvedProjectId);
@@ -71311,6 +73211,24 @@ ${lines.join(`
       project_id: exports_external.string().optional().describe("Filter by project")
     }, async ({ project_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const edges = await cloudAllDependencies(cloud);
+          const dependentCount = new Map;
+          for (const edge of edges) {
+            if (!edge.task_id || !edge.depends_on)
+              continue;
+            dependentCount.set(edge.depends_on, (dependentCount.get(edge.depends_on) ?? 0) + 1);
+          }
+          const blockers = await cloudGetTasksByIds(cloud, [...dependentCount.keys()]);
+          const remote = [...blockers.values()].filter((t) => !["completed", "cancelled"].includes(t.status)).filter((t) => !project_id || t.project_id === project_id).sort((a, b) => (dependentCount.get(b.id) ?? 0) - (dependentCount.get(a.id) ?? 0));
+          if (remote.length === 0)
+            return { content: [{ type: "text", text: "No tasks blocking others." }] };
+          const remoteLines = remote.map((t) => `${t.short_id || t.id.slice(0, 8)} [${t.status}] ${t.title} \u2014 blocking ${dependentCount.get(t.id) ?? 0} task(s)`);
+          return { content: [{ type: "text", text: `${remote.length} blocking task(s):
+${remoteLines.join(`
+`)}` }] };
+        }
         const { getBlockingTasks: getBlockingTasks2 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedProjectId = project_id ? resolveId(project_id, "projects") : undefined;
         const tasks = getBlockingTasks2(resolvedProjectId);
@@ -71376,6 +73294,16 @@ ${lines.join(`
       apply: exports_external.boolean().optional().describe("Apply safe repairs. Defaults to false/dry-run.")
     }, async ({ apply }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          if (apply) {
+            return { content: [{ type: "text", text: "run_doctor --apply is not available on the hosted authority: repairs are server-side. Re-run without apply for the hosted integrity report." }], isError: true };
+          }
+          const report = await cloudGetIntegrityReport(cloud);
+          if (!report)
+            throw new Error("The configured Todos authority returned no integrity report");
+          return { content: [{ type: "text", text: JSON.stringify({ source: "cloud", integrity: report }, null, 2) }] };
+        }
         const { runTodosDoctor: runTodosDoctor2 } = (init_doctor(), __toCommonJS(exports_doctor));
         const result = runTodosDoctor2({ apply: Boolean(apply) });
         return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
@@ -72548,10 +74476,35 @@ ${JSON.stringify(task2.metadata, null, 2)}` : null
       project_id: exports_external.string().optional().describe("Filter by project")
     }, async ({ agent_id, project_id }) => {
       try {
-        const { listTasks: listTasks3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const focus = ctx.getAgentFocus(agent_id || "");
         const effectiveAgentId = focus ? focus.agent_id : agent_id || "";
         const effectiveProjectId = focus?.project_id || project_id;
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const recap = await cloudRecap(cloud, 24, effectiveProjectId);
+          const mine = (rows) => effectiveAgentId ? rows.filter((t) => (t.assigned_to ?? "").toLowerCase() === effectiveAgentId.toLowerCase()) : rows;
+          const remoteInProgress = mine(recap.in_progress);
+          const remoteCompleted = mine(recap.completed);
+          const remoteBlocked = mine(recap.blocked);
+          const remoteLines = [
+            `Standup for ${effectiveAgentId} (${effectiveProjectId ? `project: ${effectiveProjectId.slice(0, 8)}` : "all projects"})`,
+            remoteInProgress.length > 0 ? `
+In Progress (${remoteInProgress.length}):` : `
+No tasks in progress.`,
+            ...remoteInProgress.map((t) => `  - ${t.title} (${t.id.slice(0, 8)})`),
+            remoteCompleted.length > 0 ? `
+Completed in the last 24h (${remoteCompleted.length}):` : `
+No tasks completed in the last 24h.`,
+            ...remoteCompleted.map((t) => `  - ${t.title} (${t.id.slice(0, 8)})`),
+            remoteBlocked.length > 0 ? `
+Blocked (${remoteBlocked.length}):` : `
+No blocked tasks.`,
+            ...remoteBlocked.map((t) => `  - ${t.title} (${t.id.slice(0, 8)})`)
+          ].filter(Boolean);
+          return { content: [{ type: "text", text: remoteLines.join(`
+`) }] };
+        }
+        const { listTasks: listTasks3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const inProgress = listTasks3({
           assigned_to: effectiveAgentId,
           status: "in_progress",
@@ -72595,13 +74548,25 @@ No blocked tasks.`,
   if (shouldRegisterTool("claim_task")) {
     server.tool("claim_task", "Alias for start_task \u2014 mark a task as in_progress and assign it to the calling agent.", {
       task_id: exports_external.string().describe("Task ID"),
-      agent_id: exports_external.string().optional().describe("Agent claiming (defaults to context)")
+      agent_id: exports_external.string().describe("Exact agent ID or configured focus identity claiming the task")
     }, async ({ task_id, agent_id }) => {
       try {
+        const requestedAgent = agent_id?.trim();
+        if (!requestedAgent) {
+          return {
+            content: [{ type: "text", text: "claim_task requires agent_id; the placeholder identity 'mcp' is never substituted." }],
+            isError: true
+          };
+        }
+        const focus = ctx.getAgentFocus(requestedAgent);
+        const effectiveAgent = focus?.agent_id || requestedAgent;
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const claimed = await cloudTaskAction(cloud, task_id, "start", { agent_id: effectiveAgent });
+          return { content: [{ type: "text", text: formatTask(claimed) }] };
+        }
         const { startTask: startTask3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedId = resolveId(task_id);
-        const focus = ctx.getAgentFocus(agent_id || "");
-        const effectiveAgent = focus ? focus.agent_id : agent_id || "mcp";
         const task2 = startTask3(resolvedId, effectiveAgent);
         return { content: [{ type: "text", text: formatTask(task2) }] };
       } catch (e) {
@@ -72614,6 +74579,14 @@ No blocked tasks.`,
       task_id: exports_external.string().describe("Task ID")
     }, async ({ task_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const current2 = await cloudGetTask(cloud, task_id);
+          if (!current2)
+            throw new Error(`Task not found: ${task_id}`);
+          const released = await cloudUpdateTask(cloud, current2.id, { status: "pending", assigned_to: null, version: current2.version });
+          return { content: [{ type: "text", text: formatTask(released) }] };
+        }
         const { getTask: getTask2, updateTask: updateTask3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedId = resolveId(task_id);
         const current = getTask2(resolvedId);
@@ -72706,6 +74679,15 @@ No blocked tasks.`,
       minutes: exports_external.number().describe("Additional minutes to add to estimate")
     }, async ({ task_id, minutes: minutes2 }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const current = await cloudGetTask(cloud, task_id);
+          if (!current)
+            throw new Error(`Task not found: ${task_id}`);
+          const before = current.estimated_minutes || 0;
+          const after = await cloudUpdateTask(cloud, current.id, { estimated_minutes: before + minutes2, version: current.version });
+          return { content: [{ type: "text", text: `Estimate updated: ${before} \u2192 ${after.estimated_minutes} min (+${minutes2})` }] };
+        }
         const { getTask: getTask2, updateTask: updateTask3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const resolvedId = resolveId(task_id);
         const task2 = getTask2(resolvedId);
@@ -72748,6 +74730,18 @@ No blocked tasks.`,
       limit: exports_external.number().optional().describe("Max recent comments in compact mode (default: 20)")
     }, async ({ task_id, detail, limit }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const page = await cloudListComments(cloud, task_id, { limit: detail === "full" ? 500 : limit || 20 });
+          if (page.comments.length === 0)
+            return { content: [{ type: "text", text: "No comments." }] };
+          const remoteLines = page.comments.map((c) => `[${c.agent_id || "?"}] ${c.created_at?.slice(0, 16)}: ${detail === "full" ? c.content : truncateText(c.content, 180)}`);
+          if (page.has_more)
+            remoteLines.unshift(`Showing ${page.comments.length} comment(s); older pages available.`);
+          return { content: [{ type: "text", text: remoteLines.join(`
+
+`) }] };
+        }
         const { listComments: listComments2 } = (init_comments(), __toCommonJS(exports_comments));
         const comments = listComments2(resolveId(task_id));
         if (comments.length === 0)
@@ -72772,10 +74766,23 @@ No blocked tasks.`,
       limit: exports_external.number().optional()
     }, async ({ agent_id, status: status3, project_id, limit }) => {
       try {
-        const { listTasks: listTasks3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const focus = ctx.getAgentFocus(agent_id || "");
         const effectiveAgentId = focus ? focus.agent_id : agent_id || "";
         const effectiveProjectId = focus?.project_id || project_id;
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remote = await cloudListTasks(cloud, {
+            assigned_to: effectiveAgentId,
+            status: status3,
+            project_id: effectiveProjectId,
+            limit: limit || 50
+          });
+          if (remote.length === 0)
+            return { content: [{ type: "text", text: "No tasks found." }] };
+          return { content: [{ type: "text", text: remote.map(formatTask).join(`
+`) }] };
+        }
+        const { listTasks: listTasks3 } = (init_tasks(), __toCommonJS(exports_tasks));
         const tasks = listTasks3({
           assigned_to: effectiveAgentId,
           status: status3,
@@ -72962,7 +74969,7 @@ function registerTaskMetaTools(server, ctx) {
           bulk_create_tasks: "bulk_create_tasks \u2014 Create multiple tasks. Params: tasks[]",
           bulk_delete_tasks: "bulk_delete_tasks \u2014 Delete multiple tasks. Params: task_ids[], force",
           archive_completed: "archive_completed \u2014 Auto-archive old completed tasks. Params: days, project_id",
-          get_archived_tasks: "get_archived_tasks \u2014 List archived tasks. Params: project_id, limit",
+          get_archived_tasks: "get_archived_tasks \u2014 List archived tasks. Params: project_id, limit, offset",
           unarchive_task: "unarchive_task \u2014 Restore archived task. Params: task_id",
           auto_assign_task: "auto_assign_task \u2014 Auto-assign based on capabilities. Params: task_id",
           get_my_workload: "get_my_workload \u2014 Get agent workload stats. Params: agent_id",
@@ -72987,7 +74994,7 @@ function registerTaskMetaTools(server, ctx) {
           fail_task: "fail_task \u2014 Mark task failed. Params: task_id, reason, agent_id, version",
           register_agent: "register_agent \u2014 Register an agent. Params: name, description, role, title, capabilities, session_id, working_dir, force",
           list_agents: "list_agents \u2014 List registered agents. Params: include_archived",
-          get_agent: "get_agent \u2014 Get agent details. Params: agent_id, id, name",
+          get_agent: "get_agent \u2014 Get agent details by exact ID. Params: agent_id (or id alias)",
           update_agent: "update_agent \u2014 Update an agent. Params: agent_id, id, name, description, role, title, level, capabilities, permissions, metadata",
           delete_agent: "delete_agent \u2014 Archive an agent. Params: agent_id, id, name",
           unarchive_agent: "unarchive_agent \u2014 Restore an archived agent. Params: agent_id, id, name",
@@ -72998,9 +75005,7 @@ function registerTaskMetaTools(server, ctx) {
           unfocus: "unfocus \u2014 Clear agent focus. Params: agent_id",
           suggest_agent_name: "suggest_agent_name \u2014 Suggest available agent names. Params: working_dir",
           get_org_chart: "get_org_chart \u2014 Get global org chart. Params: format",
-          set_reports_to: "set_reports_to \u2014 Set org hierarchy. Params: agent_id, reports_to",
-          extract_todos: "extract_todos \u2014 Scan code for TODO comments. Params: path, project_id, task_list_id, patterns, tags, assigned_to, agent_id, dry_run, extensions, exclude, respect_gitignore, include_index",
-          watch_source_todos: "watch_source_todos \u2014 Run finite local source TODO watcher scans. Params: path, project_id, task_list_id, patterns, tags, assigned_to, agent_id, dry_run, extensions, exclude, respect_gitignore, interval_ms, max_runs"
+          set_reports_to: "set_reports_to \u2014 Set org hierarchy. Params: agent_id, reports_to"
         };
         if (toolDocs[tool_name]) {
           return { content: [{ type: "text", text: toolDocs[tool_name] }] };
@@ -80356,6 +82361,14 @@ ${lines.join(`
       committed_at: exports_external.string().optional().describe("ISO timestamp of commit")
     }, async ({ task_id, sha, message, author, files_changed, committed_at }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          if (committed_at !== undefined) {
+            throw new Error("HOSTED_FIELD_UNSUPPORTED: committed_at is not accepted by the current Todos /v1 commit contract; omit it rather than recording the wrong timestamp");
+          }
+          const linked = await cloudLinkCommit(cloud, task_id, { sha, message, author, files_changed });
+          return { content: [{ type: "text", text: JSON.stringify(linked, null, 2) }] };
+        }
         const resolvedId = resolveId(task_id);
         const commit = linkTaskToCommit({ task_id: resolvedId, sha, message, author, files_changed, committed_at });
         return { content: [{ type: "text", text: JSON.stringify(commit, null, 2) }] };
@@ -80367,6 +82380,14 @@ ${lines.join(`
   if (shouldRegisterTool("get_task_commits")) {
     server.tool("get_task_commits", "Get all git commits linked to a task.", { task_id: exports_external.string().describe("Task ID") }, async ({ task_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const task3 = await cloudGetTask(cloud, task_id);
+          if (!task3)
+            throw new Error(`Task not found: ${task_id}`);
+          const remote = await cloudListTaskCommits(cloud, task3.id);
+          return { content: [{ type: "text", text: JSON.stringify(remote, null, 2) }] };
+        }
         const commits = getTaskCommits(resolveId(task_id));
         return { content: [{ type: "text", text: JSON.stringify(commits, null, 2) }] };
       } catch (e) {
@@ -80377,6 +82398,13 @@ ${lines.join(`
   if (shouldRegisterTool("find_task_by_commit")) {
     server.tool("find_task_by_commit", "Find which task a git commit SHA is linked to. Supports prefix matching.", { sha: exports_external.string().describe("Git commit SHA (full or short prefix)") }, async ({ sha }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remote = await cloudFindCommit(cloud, sha);
+          if (!remote)
+            return { content: [{ type: "text", text: `No task linked to commit ${sha}` }] };
+          return { content: [{ type: "text", text: JSON.stringify(remote, null, 2) }] };
+        }
         const result = findTaskByCommit(sha);
         if (!result)
           return { content: [{ type: "text", text: `No task linked to commit ${sha}` }] };
@@ -80396,6 +82424,11 @@ ${lines.join(`
       metadata: exports_external.record(exports_external.unknown()).optional().describe("Additional local metadata")
     }, async ({ task_id, ref_type, name, url, provider, metadata }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const linked = await cloudLinkRef(cloud, task_id, { ref_type, name, url, provider, metadata });
+          return { content: [{ type: "text", text: JSON.stringify(linked, null, 2) }] };
+        }
         const resolvedId = resolveId(task_id);
         const ref = linkTaskGitRef({ task_id: resolvedId, ref_type, name, url, provider, metadata });
         return { content: [{ type: "text", text: JSON.stringify(ref, null, 2) }] };
@@ -80407,6 +82440,11 @@ ${lines.join(`
   if (shouldRegisterTool("get_task_git_refs")) {
     server.tool("get_task_git_refs", "Get branches and pull requests linked to a task.", { task_id: exports_external.string().describe("Task ID") }, async ({ task_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remote = await cloudListTaskRefs(cloud, task_id);
+          return { content: [{ type: "text", text: JSON.stringify(remote, null, 2) }] };
+        }
         const refs = getTaskGitRefs(resolveId(task_id));
         return { content: [{ type: "text", text: JSON.stringify(refs, null, 2) }] };
       } catch (e) {
@@ -80417,6 +82455,11 @@ ${lines.join(`
   if (shouldRegisterTool("find_tasks_by_git_ref")) {
     server.tool("find_tasks_by_git_ref", "Find tasks linked to a branch name, PR number, or PR URL.", { ref: exports_external.string().describe("Branch name, PR number, or PR URL substring") }, async ({ ref }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const remote = await cloudFindRefs(cloud, ref);
+          return { content: [{ type: "text", text: JSON.stringify(remote, null, 2) }] };
+        }
         const refs = findTasksByGitRef(ref);
         return { content: [{ type: "text", text: JSON.stringify(refs, null, 2) }] };
       } catch (e) {
@@ -80435,6 +82478,14 @@ ${lines.join(`
       run_at: exports_external.string().optional().describe("ISO timestamp when the command was run")
     }, async ({ task_id, command, status: status3, output_summary, artifact_path, agent_id, run_at }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          if (run_at !== undefined) {
+            throw new Error("HOSTED_FIELD_UNSUPPORTED: run_at is not accepted by the current Todos /v1 verification contract; omit it rather than recording the wrong timestamp");
+          }
+          const recorded = await cloudRecordVerification(cloud, task_id, { command, status: status3, output_summary, artifact_path, agent_id });
+          return { content: [{ type: "text", text: JSON.stringify(recorded, null, 2) }] };
+        }
         const verification2 = addTaskVerification({
           task_id: resolveId(task_id),
           command,
@@ -81148,6 +83199,7 @@ ${lines.join(`
 var init_task_resources = __esm(() => {
   init_zod();
   init_types();
+  init_cloud_router();
   init_tasks();
   init_projects();
   init_agents();
@@ -83154,92 +85206,6 @@ var init_task_rel_tools = __esm(() => {
   init_zod();
 });
 
-// src/mcp/tools/code-tools.ts
-function registerCodeTools(server, ctx) {
-  const { shouldRegisterTool, resolveId, formatError, formatTask } = ctx;
-  if (shouldRegisterTool("extract_todos")) {
-    server.tool("extract_todos", "Scan source files for TODO/FIXME/HACK/BUG/XXX/NOTE comments and create tasks from them. Deduplicates on re-runs.", {
-      path: exports_external.string().describe("Directory or file path to scan"),
-      project_id: exports_external.string().optional().describe("Project to assign tasks to"),
-      task_list_id: exports_external.string().optional().describe("Task list to add tasks to"),
-      patterns: exports_external.array(exports_external.enum(["TODO", "FIXME", "HACK", "XXX", "BUG", "NOTE"])).optional().describe("Tags to search for (default: all)"),
-      tags: exports_external.array(exports_external.string()).optional().describe("Extra tags to add to created tasks"),
-      assigned_to: exports_external.string().optional().describe("Agent to assign tasks to"),
-      agent_id: exports_external.string().optional().describe("Agent performing the extraction"),
-      dry_run: exports_external.boolean().optional().describe("If true, return found comments without creating tasks"),
-      extensions: exports_external.array(exports_external.string()).optional().describe("File extensions to scan (e.g. ['ts', 'py'])"),
-      exclude: exports_external.array(exports_external.string()).optional().describe("Gitignore-style path patterns to skip"),
-      respect_gitignore: exports_external.boolean().optional().describe("Respect .gitignore from the scanned root (default true)"),
-      include_index: exports_external.boolean().optional().describe("Include local codebase index metadata in the response")
-    }, async (params) => {
-      try {
-        const { extractTodos: extractTodos2 } = (init_extract(), __toCommonJS(exports_extract));
-        const resolved = { ...params };
-        if (resolved["project_id"])
-          resolved["project_id"] = resolveId(resolved["project_id"], "projects");
-        if (resolved["task_list_id"])
-          resolved["task_list_id"] = resolveId(resolved["task_list_id"], "task_lists");
-        const result = extractTodos2(resolved);
-        if (params.dry_run) {
-          if (params.include_index) {
-            return { content: [{ type: "text", text: JSON.stringify({ comments: result.comments, index: result.index }, null, 2) }] };
-          }
-          const lines = result.comments.map((c) => `[${c.tag}] ${c.message} \u2014 ${c.file}:${c.line}${c.symbol ? ` (${c.symbol})` : ""}`);
-          return { content: [{ type: "text", text: `Found ${result.comments.length} comment(s):
-${lines.join(`
-`)}` }] };
-        }
-        const summary = [
-          `Created ${result.tasks.length} task(s)`,
-          result.skipped > 0 ? `Skipped ${result.skipped} duplicate(s)` : null,
-          `Total comments found: ${result.comments.length}`
-        ].filter(Boolean).join(`
-`);
-        const taskLines = result.tasks.map(formatTask);
-        return { content: [{ type: "text", text: `${summary}
-
-${taskLines.join(`
-`)}` }] };
-      } catch (e) {
-        return { content: [{ type: "text", text: formatError(e) }], isError: true };
-      }
-    });
-  }
-  if (shouldRegisterTool("watch_source_todos")) {
-    server.tool("watch_source_todos", "Run finite local source TODO watcher scans. Uses polling, respects .gitignore/excludes, and can dry-run or apply extracted tasks.", {
-      path: exports_external.string().describe("Directory or file path to watch"),
-      project_id: exports_external.string().optional().describe("Project to assign tasks to"),
-      task_list_id: exports_external.string().optional().describe("Task list to add tasks to"),
-      patterns: exports_external.array(exports_external.enum(["TODO", "FIXME", "HACK", "XXX", "BUG", "NOTE"])).optional().describe("Tags to search for (default: all)"),
-      tags: exports_external.array(exports_external.string()).optional().describe("Extra tags to add to created tasks"),
-      assigned_to: exports_external.string().optional().describe("Agent to assign tasks to"),
-      agent_id: exports_external.string().optional().describe("Agent performing the watcher scan"),
-      dry_run: exports_external.boolean().optional().describe("If true, return found comments without creating tasks"),
-      extensions: exports_external.array(exports_external.string()).optional().describe("File extensions to scan"),
-      exclude: exports_external.array(exports_external.string()).optional().describe("Gitignore-style path patterns to skip"),
-      respect_gitignore: exports_external.boolean().optional().describe("Respect .gitignore from the watched root"),
-      interval_ms: exports_external.number().optional().describe("Polling interval for repeated scans"),
-      max_runs: exports_external.number().optional().describe("Maximum scans before returning; default 1")
-    }, async (params) => {
-      try {
-        const { watchSourceTodos: watchSourceTodos2 } = (init_extract(), __toCommonJS(exports_extract));
-        const resolved = { ...params, include_index: true, once: (params.max_runs || 1) <= 1 };
-        if (resolved["project_id"])
-          resolved["project_id"] = resolveId(resolved["project_id"], "projects");
-        if (resolved["task_list_id"])
-          resolved["task_list_id"] = resolveId(resolved["task_list_id"], "task_lists");
-        const result = await watchSourceTodos2(resolved);
-        return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-      } catch (e) {
-        return { content: [{ type: "text", text: formatError(e) }], isError: true };
-      }
-    });
-  }
-}
-var init_code_tools = __esm(() => {
-  init_zod();
-});
-
 // src/cli/machine-api.ts
 import { resolve as resolve22 } from "path";
 function receipt(raw) {
@@ -83702,9 +85668,11 @@ Last seen: ${agent.last_seen_at}`
       try {
         const pool = getAgentPoolForProject(working_dir);
         const cutoff = new Date(Date.now() - 30 * 60 * 1000).toISOString();
-        const allActive = listAgents().filter((a) => a.last_seen_at > cutoff);
+        const cloud = getTodosCloudClient();
+        const roster = cloud ? await cloudListAgents(cloud) : listAgents();
+        const allActive = roster.filter((a) => (a.last_seen_at ?? "") > cutoff);
         if (!pool) {
-          const suggestions = getAvailableNamesFromPool([
+          const defaultPool = [
             "caesar",
             "augustus",
             "marcus",
@@ -83724,7 +85692,8 @@ Last seen: ${agent.last_seen_at}`
             "thalia",
             "phoebe",
             "daphne"
-          ], getDatabase());
+          ];
+          const suggestions = cloud ? defaultPool.filter((name) => !roster.some((a) => a.name?.toLowerCase() === name)) : getAvailableNamesFromPool(defaultPool, getDatabase());
           const lines2 = [
             "No project pool configured. Use a distinctive one-word name; generic generated names are blocked.",
             `Suggested names: ${suggestions.slice(0, 8).join(", ")}`,
@@ -83735,8 +85704,8 @@ To restrict names, configure agent_pool or project_pools in the todos data home
           return { content: [{ type: "text", text: lines2.join(`
 `) }] };
         }
-        const available = getAvailableNamesFromPool(pool, getDatabase());
-        const activeInPool = allActive.filter((a) => pool.map((n) => n.toLowerCase()).includes(a.name));
+        const available = cloud ? pool.filter((name) => !roster.some((a) => a.name?.toLowerCase() === name.toLowerCase())) : getAvailableNamesFromPool(pool, getDatabase());
+        const activeInPool = allActive.filter((agent) => pool.map((name) => name.toLowerCase()).includes(agent.name.toLowerCase()));
         const lines = [
           `Project pool: ${pool.join(", ")}`,
           `Available now (${available.length}): ${available.length > 0 ? available.join(", ") : "none \u2014 all names in use"}`,
@@ -83758,7 +85727,7 @@ No names available. Wait for an active agent to go stale (30min timeout).`
     }, async ({ include_archived }) => {
       try {
         const cloud = getTodosCloudClient();
-        const agents = cloud ? await cloudListAgents(cloud) : listAgents({ include_archived: include_archived ?? false });
+        const agents = cloud ? await cloudListAgents(cloud, { include_archived: include_archived ?? false }) : listAgents({ include_archived: include_archived ?? false });
         if (agents.length === 0) {
           return { content: [{ type: "text", text: "No agents registered." }] };
         }
@@ -83775,19 +85744,19 @@ ${text2}` }] };
     });
   }
   if (shouldRegisterTool("get_agent")) {
-    server.tool("get_agent", "Get agent details by ID or name. Provide one of id or name.", {
-      agent_id: exports_external.string().optional(),
-      id: exports_external.string().optional(),
-      name: exports_external.string().optional()
-    }, async ({ agent_id, id, name }) => {
+    server.tool("get_agent", "Get agent details by exact immutable ID. Use list_agents to resolve a name first.", {
+      agent_id: exports_external.string().optional().describe("Exact immutable agent ID"),
+      id: exports_external.string().optional().describe("Compatibility alias for agent_id; exact immutable agent ID")
+    }, async ({ agent_id, id }) => {
       try {
-        const identifier2 = agent_id || id || name;
+        const identifier2 = (agent_id || id || "").trim();
         if (!identifier2) {
-          return { content: [{ type: "text", text: "Provide agent_id, id, or name." }], isError: true };
+          return { content: [{ type: "text", text: "Provide the exact agent_id. Use list_agents to resolve a name first." }], isError: true };
         }
-        const agent = getAgent(identifier2) || getAgentByName(identifier2);
+        const cloud = getTodosCloudClient();
+        const agent = cloud ? await cloudGetAgent(cloud, identifier2) : getAgent(identifier2);
         if (!agent) {
-          return { content: [{ type: "text", text: `Agent not found: ${identifier2}` }], isError: true };
+          return { content: [{ type: "text", text: `Agent not found by exact ID: ${identifier2}` }], isError: true };
         }
         const parts = [
           `ID: ${agent.id}`,
@@ -83795,7 +85764,7 @@ ${text2}` }] };
         ];
         if (agent.description)
           parts.push(`Description: ${agent.description}`);
-        if (Object.keys(agent.metadata).length > 0)
+        if (agent.metadata && Object.keys(agent.metadata).length > 0)
           parts.push(`Metadata: ${JSON.stringify(agent.metadata)}`);
         parts.push(`Created: ${agent.created_at}`);
         parts.push(`Last seen: ${agent.last_seen_at}`);
@@ -84083,6 +86052,13 @@ function registerTemplateTools(server, { shouldRegisterTool, resolveId, formatEr
       })).optional().describe("Multi-task template: ordered list of tasks to create together with dependencies")
     }, async (params) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const created = await cloudCreateTemplate(cloud, params);
+          const remoteCount = created.tasks?.length ?? 0;
+          const remoteInfo = remoteCount > 0 ? ` | ${remoteCount} task(s)` : "";
+          return { content: [{ type: "text", text: `Template created: ${created.id.slice(0, 8)} | ${created.name} | "${created.title_pattern}"${remoteInfo}` }] };
+        }
         const { createTemplate: createTemplate3, getTemplateWithTasks: getTemplateWithTasks2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const t = createTemplate3(params);
         const withTasks = getTemplateWithTasks2(t.id);
@@ -84097,8 +86073,8 @@ function registerTemplateTools(server, { shouldRegisterTool, resolveId, formatEr
   if (shouldRegisterTool("list_templates")) {
     server.tool("list_templates", "List all task templates", {}, async () => {
       try {
-        const { listTemplates: listTemplates2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
-        const templates = listTemplates2();
+        const cloud = getTodosCloudClient();
+        const templates = cloud ? await listSharedTemplates(cloud) : (await Promise.resolve().then(() => (init_templates(), exports_templates))).listTemplates();
         if (templates.length === 0)
           return { content: [{ type: "text", text: "No templates." }] };
         const text2 = templates.map((t) => {
@@ -84125,6 +86101,28 @@ ${text2}` }] };
       variables: exports_external.record(exports_external.string()).optional().describe("Variable substitution map for {name} placeholders in multi-task templates")
     }, async (params) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const template = await resolveRemoteTemplate(cloud, params.template_id);
+          if (!template)
+            return { content: [{ type: "text", text: `Template not found: ${params.template_id}` }], isError: true };
+          const projectRef = params.project_id ? await cloudResolveProjectRef(cloud, params.project_id) : undefined;
+          const effectiveProject = projectRef ?? template.project_id ?? undefined;
+          const taskListId = params.task_list_id ? await cloudResolveTaskListRef(cloud, params.task_list_id, effectiveProject) : undefined;
+          const { tasks } = await createRemoteTemplateTasks(cloud, template, effectiveProject, params.variables ?? {}, {
+            assignedTo: params.assigned_to,
+            taskListId,
+            overrides: {
+              title: params.title,
+              description: params.description,
+              priority: params.priority
+            }
+          });
+          const remoteText = tasks.map((t) => `${t.id.slice(0, 8)} | ${t.priority} | ${t.title}`).join(`
+`);
+          return { content: [{ type: "text", text: `${tasks.length} task(s) created from template:
+${remoteText}` }] };
+        }
         const { taskFromTemplate: taskFromTemplate2, getTemplateWithTasks: getTemplateWithTasks2, tasksFromTemplate: tasksFromTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const resolvedTemplateId = resolveId(params.template_id, "task_templates");
         const resolvedProjectId = params.project_id ? resolveId(params.project_id, "projects") : undefined;
@@ -84157,6 +86155,12 @@ ${task3.id.slice(0, 8)} | ${task3.priority} | ${task3.title}` }] };
   if (shouldRegisterTool("delete_template")) {
     server.tool("delete_template", "Delete a task template by ID.", { id: exports_external.string() }, async ({ id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const template = await resolveRemoteTemplate(cloud, id);
+          const removed = template ? await cloudDeleteTemplate(cloud, template.id) : false;
+          return { content: [{ type: "text", text: removed ? "Template deleted." : "Template not found." }] };
+        }
         const { deleteTemplate: deleteTemplate3 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const resolvedId = resolveId(id, "task_templates");
         const deleted = deleteTemplate3(resolvedId);
@@ -84178,6 +86182,14 @@ ${task3.id.slice(0, 8)} | ${task3.priority} | ${task3.title}` }] };
       plan_id: exports_external.string().optional()
     }, async ({ id, ...updates }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const prior = await resolveRemoteTemplate(cloud, id);
+          if (!prior)
+            return { content: [{ type: "text", text: `Template not found: ${id}` }], isError: true };
+          const patched = await updateSharedTemplate(cloud, prior.id, { ...updates, expected_version: prior.version });
+          return { content: [{ type: "text", text: `Template updated: ${patched.id.slice(0, 8)} | ${patched.name} | "${patched.title_pattern}" | ${patched.priority}` }] };
+        }
         const { updateTemplate: updateTemplate3 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const resolvedId = resolveId(id, "task_templates");
         const t = updateTemplate3(resolvedId, updates);
@@ -84192,8 +86204,8 @@ ${task3.id.slice(0, 8)} | ${task3.priority} | ${task3.title}` }] };
   if (shouldRegisterTool("init_templates")) {
     server.tool("init_templates", "Initialize the bundled local template library. Skips templates that already exist by name.", {}, async () => {
       try {
-        const { initBuiltinTemplates: initBuiltinTemplates2 } = await Promise.resolve().then(() => (init_builtin_templates(), exports_builtin_templates));
-        const result = initBuiltinTemplates2();
+        const cloud = getTodosCloudClient();
+        const result = cloud ? await initializeSharedTemplates(cloud) : (await Promise.resolve().then(() => (init_builtin_templates(), exports_builtin_templates))).initBuiltinTemplates();
         if (result.created === 0)
           return { content: [{ type: "text", text: `All ${result.skipped} built-in template(s) already exist.` }] };
         return { content: [{ type: "text", text: `Created ${result.created} template(s): ${result.names.join(", ")}. Skipped ${result.skipped} existing.` }] };
@@ -84205,8 +86217,7 @@ ${task3.id.slice(0, 8)} | ${task3.priority} | ${task3.title}` }] };
   if (shouldRegisterTool("list_template_library")) {
     server.tool("list_template_library", "List the bundled marketplace-free local template library without mutating the database.", {}, async () => {
       try {
-        const { listBuiltinTemplates: listBuiltinTemplates2 } = await Promise.resolve().then(() => (init_builtin_templates(), exports_builtin_templates));
-        const templates = listBuiltinTemplates2().map((template) => ({
+        const templates = listBuiltinTemplates().map((template) => ({
           name: template.name,
           description: template.description,
           category: template.category,
@@ -84223,8 +86234,7 @@ ${task3.id.slice(0, 8)} | ${task3.priority} | ${task3.title}` }] };
   if (shouldRegisterTool("write_template_library")) {
     server.tool("write_template_library", "Write the bundled local template library to editable JSON files for review or import.", { directory: exports_external.string() }, async ({ directory }) => {
       try {
-        const { writeBuiltinTemplateFiles: writeBuiltinTemplateFiles2 } = await Promise.resolve().then(() => (init_builtin_templates(), exports_builtin_templates));
-        return { content: [{ type: "text", text: JSON.stringify(writeBuiltinTemplateFiles2(directory), null, 2) }] };
+        return { content: [{ type: "text", text: JSON.stringify(writeBuiltinTemplateFiles(directory), null, 2) }] };
       } catch (e) {
         return { content: [{ type: "text", text: formatError(e) }], isError: true };
       }
@@ -84236,9 +86246,17 @@ ${task3.id.slice(0, 8)} | ${task3.priority} | ${task3.title}` }] };
       variables: exports_external.record(exports_external.string()).optional().describe("Variable substitution map for {name} placeholders")
     }, async (params) => {
       try {
-        const { previewTemplate: previewTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
-        const resolvedId = resolveId(params.template_id, "task_templates");
-        const preview = previewTemplate2(resolvedId, params.variables);
+        const cloud = getTodosCloudClient();
+        let preview;
+        if (cloud) {
+          const template = await resolveRemoteTemplate(cloud, params.template_id);
+          if (!template)
+            return { content: [{ type: "text", text: `Template not found: ${params.template_id}` }], isError: true };
+          preview = previewRemoteTemplate(template, params.variables);
+        } else {
+          const { previewTemplate: previewTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
+          preview = previewTemplate2(resolveId(params.template_id, "task_templates"), params.variables);
+        }
         const lines = preview.tasks.map((t) => {
           const deps = t.depends_on_positions.length > 0 ? ` (after: ${t.depends_on_positions.join(", ")})` : "";
           return `  [${t.position}] ${t.priority} | ${t.title}${deps}`;
@@ -84258,6 +86276,13 @@ ${lines.join(`
   if (shouldRegisterTool("export_template")) {
     server.tool("export_template", "Export a template as a full JSON object (template + tasks + variables). Useful for sharing or backup.", { template_id: exports_external.string() }, async ({ template_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const template = await resolveRemoteTemplate(cloud, template_id);
+          if (!template)
+            return { content: [{ type: "text", text: `Template not found: ${template_id}` }], isError: true };
+          return { content: [{ type: "text", text: JSON.stringify(exportRemoteTemplate(template), null, 2) }] };
+        }
         const { exportTemplate: exportTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const resolvedId = resolveId(template_id, "task_templates");
         const json7 = exportTemplate2(resolvedId);
@@ -84270,8 +86295,13 @@ ${lines.join(`
   if (shouldRegisterTool("import_template")) {
     server.tool("import_template", "Import a template from a JSON string (as returned by export_template). Creates new template with new IDs.", { json: exports_external.string().describe("JSON string of the template export") }, async ({ json: json7 }) => {
       try {
-        const { importTemplate: importTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const parsed = JSON.parse(json7);
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const imported = await cloudCreateTemplate(cloud, parsed);
+          return { content: [{ type: "text", text: `Template imported: ${imported.id.slice(0, 8)} | ${imported.name} | "${imported.title_pattern}"` }] };
+        }
+        const { importTemplate: importTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const t = importTemplate2(parsed);
         return { content: [{ type: "text", text: `Template imported: ${t.id.slice(0, 8)} | ${t.name} | "${t.title_pattern}"` }] };
       } catch (e) {
@@ -84282,6 +86312,22 @@ ${lines.join(`
   if (shouldRegisterTool("template_history")) {
     server.tool("template_history", "Show version history of a template. Each update creates a snapshot of the previous state.", { template_id: exports_external.string() }, async ({ template_id }) => {
       try {
+        const cloud = getTodosCloudClient();
+        if (cloud) {
+          const template2 = await resolveRemoteTemplate(cloud, template_id);
+          if (!template2)
+            return { content: [{ type: "text", text: `Template not found: ${template_id}` }], isError: true };
+          const history = await readSharedTemplateHistory(cloud, template2.id);
+          if (history.versions.length === 0)
+            return { content: [{ type: "text", text: `${template2.name} v${template2.version} \u2014 no previous versions.` }] };
+          const remoteLines = history.versions.map((v) => {
+            const snap = typeof v.snapshot === "string" ? JSON.parse(v.snapshot) : v.snapshot;
+            return `v${v.version} | ${v.created_at} | ${snap.name} | "${snap.title_pattern}"`;
+          });
+          return { content: [{ type: "text", text: `${template2.name} \u2014 current: v${template2.version}
+${remoteLines.join(`
+`)}` }] };
+        }
         const { listTemplateVersions: listTemplateVersions2, getTemplate: getTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
         const resolvedId = resolveId(template_id, "task_templates");
         const template = getTemplate2(resolvedId);
@@ -84306,6 +86352,9 @@ ${lines.join(`
 var init_templates2 = __esm(() => {
   init_zod();
   init_tasks();
+  init_cloud_router();
+  init_template_remote();
+  init_builtin_template_library();
 });
 
 // src/lib/environment-snapshots.ts
@@ -84670,11 +86719,16 @@ var init_workflow_prompts2 = __esm(() => {
 // src/mcp/index.ts
 var exports_mcp = {};
 __export(exports_mcp, {
+  resolveTodosMcpAuthority: () => resolveTodosMcpAuthority,
+  mcpHttpRefusal: () => mcpHttpRefusal,
+  hostedRouteLocalStoreRefusal: () => hostedRouteLocalStoreRefusal,
   formatTaskDetail: () => formatTaskDetail,
   formatTask: () => formatTask,
   formatError: () => formatError,
   buildServer: () => buildServer,
-  applyFocus: () => applyFocus
+  applyFocus: () => applyFocus,
+  agentFocusMap: () => agentFocusMap,
+  MCP_HTTP_REFUSED_EXIT_CODE: () => MCP_HTTP_REFUSED_EXIT_CODE
 });
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -84693,18 +86747,18 @@ function printHelp() {
 Start the @hasna/todos MCP server.
 
 Options:
-  --stdio          Use stdio transport (default)
-  --http           Use Streamable HTTP transport
-  --port <port>    Use Streamable HTTP on the given port (implies --http)
+  --stdio          Use stdio transport (the only transport this binary serves)
   -V, --version    output the version number
   -h, --help       display help for command
 
 Environment:
   MCP_STDIO=1                Force stdio transport
-  MCP_HTTP=1                 Use Streamable HTTP transport
-  MCP_HTTP_PORT=<port>       HTTP port when using HTTP transport
   TODOS_PROFILE=<profile>    Tool profile filter
-  TODOS_TOOL_GROUPS=<list>   Comma-separated tool group filter`);
+  TODOS_TOOL_GROUPS=<list>   Comma-separated tool group filter
+
+The Streamable HTTP transport (POST /mcp) is served by \`todos-serve\`, which owns
+the HTTP listener and its auth posture; \`--http\`, \`--port\` and MCP_HTTP=1 are
+refused here (exit 2).`);
 }
 function shouldRegisterTool(name) {
   return shouldRegisterToolForProfile2(name);
@@ -84713,7 +86767,7 @@ function getAgentFocus(agentId) {
   const sessionFocus = agentFocusMap.get(agentId);
   if (sessionFocus)
     return sessionFocus;
-  if (getTodosCloudClient())
+  if (isLocalStoreRefused() || hasTodosEnvAuthorityIntent(process.env) || getTodosCloudClient())
     return;
   try {
     const agent = getAgentByName(agentId) || getAgent(agentId);
@@ -84734,11 +86788,14 @@ function applyFocus(params, agentId) {
   }
 }
 function guardRefusalPayload(message) {
-  const match = /^(REMOTE_API_[A-Z_]+|API_DATABASE_FALLBACK_FORBIDDEN):\s*([\s\S]*)$/.exec(message);
+  const match = /^(REMOTE_API_[A-Z_]+|REMOTE_COMMAND_[A-Z_]+|API_DATABASE_FALLBACK_FORBIDDEN):\s*([\s\S]*)$/.exec(message);
   if (!match)
     return;
   const code = match[1];
   const detail = match[2].trim();
+  if (code.startsWith("REMOTE_COMMAND_")) {
+    return JSON.stringify({ code, message: detail || message });
+  }
   return JSON.stringify({
     code,
     message: detail || message,
@@ -84934,7 +86991,6 @@ function buildServer() {
   registerTaskMetaTools(server, toolContext);
   registerTaskResources(server, toolContext);
   registerTaskRelTools(server, toolContext);
-  registerCodeTools(server, toolContext);
   registerAgentTools(server, { ...toolContext, agentFocusMap });
   registerTemplateTools(server, toolContext);
   registerEnvironmentSnapshotTools(server, toolContext);
@@ -84943,30 +86999,57 @@ function buildServer() {
   registerDispatchTools(server, { shouldRegisterTool: shouldRegisterToolOnce, resolveId, formatError });
   return server;
 }
+function resolveTodosMcpAuthority(env2 = process.env) {
+  const resolution = resolveTodosCliTransport(env2);
+  if (resolution.transport === "sqlite") {
+    return { route: "local", notice: todosLocalModeNotice("local-opt-in") };
+  }
+  return { route: "hosted", v1_base_url: resolution.authority.baseUrl, source: resolution.source };
+}
+function hostedRouteLocalStoreRefusal(v1BaseUrl) {
+  return "REMOTE_COMMAND_UNSUPPORTED: this tool or resource is local-only \u2014 it reads the on-box SQLite " + `store, which the hosted Todos /v1 authority (${v1BaseUrl}) does not serve; local SQLite is ` + "opt-in only (HASNA_TODOS_LOCAL=1, alias TODOS_LOCAL=1) and is disabled by default. Use the hosted " + "tools on this route (list_tasks, list_projects, list_agents, get_status, ...) instead.";
+}
+function mcpHttpRefusal() {
+  return "todos-mcp: the HTTP transport is not served by this binary (stdio only). " + "Use `todos-serve` \u2014 it mounts the MCP Streamable HTTP endpoint at POST /mcp with its own auth " + 'posture (see README "REST API"). `--http`, `--port` and MCP_HTTP=1 are refused.';
+}
 async function main() {
-  const { isHttpMode, resolveHttpPort } = await Promise.resolve().then(() => (init_http4(), exports_http));
+  const { isHttpMode } = await Promise.resolve().then(() => (init_http4(), exports_http));
   const portRequested = process.argv.some((arg) => arg === "--port" || arg.startsWith("--port="));
-  if (!isHttpMode() && !portRequested) {
-    const server = buildServer();
+  if (isHttpMode() || portRequested) {
+    process.stderr.write(`${mcpHttpRefusal()}
+`);
+    process.exit(MCP_HTTP_REFUSED_EXIT_CODE);
+  }
+  let authority;
+  try {
+    authority = resolveTodosMcpAuthority();
+  } catch (error2) {
+    process.stderr.write(`${error2 instanceof Error ? error2.message : String(error2)}
+`);
+    process.exit(1);
+  }
+  if (authority.route === "hosted") {
+    refuseLocalStore(hostedRouteLocalStoreRefusal(authority.v1_base_url));
+  }
+  const server = buildServer();
+  if (authority.route === "local") {
+    process.stderr.write(`${authority.notice}
+`);
     try {
       const { startRuntimeShadowDrain: startRuntimeShadowDrain2 } = await Promise.resolve().then(() => (init_shadow_runtime(), exports_shadow_runtime));
-      if (!getTodosCloudClient())
-        startRuntimeShadowDrain2(getDatabase());
+      startRuntimeShadowDrain2(getDatabase());
     } catch {}
-    const transport = new StdioServerTransport;
-    await server.connect(transport);
-    return;
   }
-  const { startServer } = await Promise.resolve().then(() => (init_serve(), exports_serve));
-  const port = resolveHttpPort();
-  await startServer(port, { host: "127.0.0.1", allowAnonymous: true });
-  console.error(`todos MCP HTTP mounted at http://127.0.0.1:${port}/mcp`);
+  const transport = new StdioServerTransport;
+  await server.connect(transport);
 }
-var agentFocusMap, API_DATABASE_FALLBACK_FORBIDDEN_SUGGESTION, isDirectRun;
+var agentFocusMap, API_DATABASE_FALLBACK_FORBIDDEN_SUGGESTION, MCP_HTTP_REFUSED_EXIT_CODE = 2, isDirectRun;
 var init_mcp2 = __esm(() => {
   init_cloud_router();
   init_agents();
   init_database();
+  init_cloud_router();
+  init_local_opt_in();
   init_lock_display();
   init_types();
   init_local_encryption();
@@ -84979,7 +87062,6 @@ var init_mcp2 = __esm(() => {
   init_task_meta_tools();
   init_task_resources();
   init_task_rel_tools();
-  init_code_tools();
   init_machines2();
   init_agents2();
   init_templates2();
@@ -85387,7 +87469,7 @@ function resolveClientIp(req, server) {
     trustedProxies: trustedProxiesFromEnv()
   }) ?? "unknown";
 }
-function checkRateLimit(ip) {
+function checkRateLimit(ip, maximum) {
   const now4 = Date.now();
   const entry2 = rateLimitMap.get(ip);
   if (!entry2 || now4 > entry2.resetAt) {
@@ -85395,7 +87477,7 @@ function checkRateLimit(ip) {
     return { allowed: true };
   }
   entry2.count++;
-  if (entry2.count > RATE_LIMIT_MAX) {
+  if (entry2.count > maximum) {
     return { allowed: false, retryAfter: Math.ceil((entry2.resetAt - now4) / 1000) };
   }
   return { allowed: true };
@@ -85449,6 +87531,7 @@ function hasGeneratedApiKeysSafely() {
   }
 }
 async function startServer(port, options) {
+  const rateLimitMax = resolveRateLimitMax(env.rateLimitMax());
   const envServerKey = resolveServerKeyEnv();
   const cliApiKey = options?.apiKey || null;
   const apiKey = cliApiKey || envServerKey?.value || null;
@@ -85543,7 +87626,7 @@ data: ${data}
       }
       const ip = resolveClientIp(req, server2);
       const peerIp = server2.requestIP(req)?.address;
-      const rl = checkRateLimit(ip);
+      const rl = checkRateLimit(ip, rateLimitMax);
       if (!rl.allowed) {
         return new Response(JSON.stringify({ error: "Too many requests", retry_after: rl.retryAfter }), {
           status: 429,
@@ -85818,7 +87901,7 @@ data: ${data}
   const serverUrl = `http://localhost:${boundPort}`;
   console.log(`Todos HTTP server running at ${serverUrl}`);
 }
-var SECURITY_HEADERS, rateLimitMap, RATE_LIMIT_WINDOW_MS = 60000, RATE_LIMIT_MAX;
+var SECURITY_HEADERS, rateLimitMap, RATE_LIMIT_WINDOW_MS = 60000;
 var init_serve = __esm(() => {
   init_database();
   init_api_keys();
@@ -85834,7 +87917,6 @@ var init_serve = __esm(() => {
     "Permissions-Policy": "camera=, microphone=, geolocation="
   };
   rateLimitMap = new Map;
-  RATE_LIMIT_MAX = Number.parseInt(env.rateLimitMax() || "120", 10);
 });
 
 // src/cli/components/Header.tsx
@@ -88367,7 +90449,7 @@ ${tasks.length} task(s) shown`));
     });
     await new Promise(() => {});
   });
-  program2.command("stream").description("Subscribe to real-time task events via SSE (requires todos serve)").option("--agent <id>", "Filter to events for a specific agent").option("--events <list>", "Comma-separated event types (default: all)", "task.created,task.started,task.completed,task.failed,task.assigned,task.status_changed").option("--port <n>", "Server port", "3000").option("--json", "Output raw JSON events").action(async (opts) => {
+  program2.command("stream").description("Subscribe to real-time task events via SSE (requires todos serve)").option("--agent <id>", "Filter to events for a specific agent").option("--events <list>", "Comma-separated event types (default: all)", "task.created,task.started,task.completed,task.failed,task.assigned,task.status_changed").option("--port <n>", "Port of the local `todos serve` to subscribe to", String(DEFAULT_PORT)).option("--json", "Output raw JSON events").action(async (opts) => {
     const baseUrl = `http://localhost:${opts.port}`;
     const params = new URLSearchParams;
     if (opts.agent)
@@ -97185,17 +99267,23 @@ var init_cli_mcp_parity = __esm(() => {
         "todos extract",
         "todos extract-watch"
       ],
-      mcpTools: [
-        "extract_todos",
-        "watch_source_todos"
-      ],
+      mcpTools: [],
       jsonContracts: ["source_code_index", "source_todo_comment", "task", "structured_error", "api_error"],
       errorContracts: ["structured_error", "api_error"],
-      status: "matched",
-      intentionalGaps: [],
+      status: "intentional-gap",
+      intentionalGaps: [
+        {
+          cliCommand: "todos extract",
+          reason: "The source TODO index scans the local checkout the CLI runs in; the former extract_todos MCP tool read the agent host's filesystem behind a task-store tool surface and had no hosted arm, so it was removed (fleet alignment 2026-09-11)."
+        },
+        {
+          cliCommand: "todos extract-watch",
+          reason: "A polling filesystem watcher is a long-running local process, not an MCP tool call; the former watch_source_todos tool was removed with extract_todos \u2014 run `todos extract-watch` from the checkout instead."
+        }
+      ],
+      gapReason: "Source scanning and watching are local-filesystem CLI operations; no MCP tool mapping.",
       example: {
-        cli: "todos extract . --dry-run --index --json",
-        mcpTool: "extract_todos"
+        cli: "todos extract . --dry-run --index --json"
       }
     },
     {
@@ -102288,7 +104376,7 @@ function registerHelpCommands(program2, route = "local", remoteCapabilities = ne
       });
       const format = opts.json || globalOpts.json ? "json" : opts.format || "markdown";
       if (format === "json") {
-        console.log(JSON.stringify(manual));
+        printJson(manual);
         return;
       }
       if (format !== "markdown")