@hasna/todos 0.9.18 → 0.9.20

package/dist/cli/index.js

@@ -4,6 +4,7 @@ var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __toESM = (mod, isNodeMode, target) => {
   target = mod != null ? __create(__getProtoOf(mod)) : {};
@@ -16,6 +17,20 @@ var __toESM = (mod, isNodeMode, target) => {
       });
   return to;
 };
+var __moduleCache = /* @__PURE__ */ new WeakMap;
+var __toCommonJS = (from) => {
+  var entry = __moduleCache.get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function")
+    __getOwnPropNames(from).map((key) => !__hasOwnProp.call(entry, key) && __defProp(entry, key, {
+      get: () => from[key],
+      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+    }));
+  __moduleCache.set(from, entry);
+  return entry;
+};
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __export = (target, all) => {
   for (var name in all)
@@ -2138,29 +2153,20 @@ function runMigrations(db) {
     const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
     const currentLevel = result?.max_id ?? 0;
     for (let i = currentLevel;i < MIGRATIONS.length; i++) {
-      db.exec(MIGRATIONS[i]);
+      try {
+        db.exec(MIGRATIONS[i]);
+      } catch {}
     }
   } catch {
     for (const migration of MIGRATIONS) {
-      db.exec(migration);
+      try {
+        db.exec(migration);
+      } catch {}
     }
   }
-  ensureTableMigrations(db);
+  ensureSchema(db);
 }
-function ensureTableMigrations(db) {
-  try {
-    const hasAgents = db.query("SELECT name FROM sqlite_master WHERE type='table' AND name='agents'").get();
-    if (!hasAgents) {
-      db.exec(MIGRATIONS[4]);
-    }
-  } catch {}
-  try {
-    db.query("SELECT task_prefix FROM projects LIMIT 0").get();
-  } catch {
-    try {
-      db.exec(MIGRATIONS[5]);
-    } catch {}
-  }
+function ensureSchema(db) {
   const ensureColumn = (table, column, type) => {
     try {
       db.query(`SELECT ${column} FROM ${table} LIMIT 0`).get();
@@ -2170,6 +2176,76 @@ function ensureTableMigrations(db) {
       } catch {}
     }
   };
+  const ensureTable = (name, sql) => {
+    try {
+      const exists = db.query("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(name);
+      if (!exists)
+        db.exec(sql);
+    } catch {}
+  };
+  const ensureIndex = (sql) => {
+    try {
+      db.exec(sql);
+    } catch {}
+  };
+  ensureTable("agents", `
+    CREATE TABLE agents (
+      id TEXT PRIMARY KEY, name TEXT NOT NULL UNIQUE, description TEXT,
+      role TEXT DEFAULT 'agent', permissions TEXT DEFAULT '["*"]',
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      last_seen_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureTable("task_lists", `
+    CREATE TABLE task_lists (
+      id TEXT PRIMARY KEY, project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      slug TEXT NOT NULL, name TEXT NOT NULL, description TEXT,
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+      UNIQUE(project_id, slug)
+    )`);
+  ensureTable("plans", `
+    CREATE TABLE plans (
+      id TEXT PRIMARY KEY, project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+      task_list_id TEXT, agent_id TEXT,
+      name TEXT NOT NULL, description TEXT,
+      status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active', 'completed', 'archived')),
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureTable("task_tags", `
+    CREATE TABLE task_tags (
+      task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      tag TEXT NOT NULL, PRIMARY KEY (task_id, tag)
+    )`);
+  ensureTable("task_history", `
+    CREATE TABLE task_history (
+      id TEXT PRIMARY KEY, task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+      action TEXT NOT NULL, field TEXT, old_value TEXT, new_value TEXT, agent_id TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureTable("webhooks", `
+    CREATE TABLE webhooks (
+      id TEXT PRIMARY KEY, url TEXT NOT NULL, events TEXT NOT NULL DEFAULT '[]',
+      secret TEXT, active INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureTable("task_templates", `
+    CREATE TABLE task_templates (
+      id TEXT PRIMARY KEY, name TEXT NOT NULL, title_pattern TEXT NOT NULL,
+      description TEXT, priority TEXT DEFAULT 'medium', tags TEXT DEFAULT '[]',
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      plan_id TEXT REFERENCES plans(id) ON DELETE SET NULL,
+      metadata TEXT DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )`);
+  ensureColumn("projects", "task_list_id", "TEXT");
+  ensureColumn("projects", "task_prefix", "TEXT");
+  ensureColumn("projects", "task_counter", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn("tasks", "plan_id", "TEXT REFERENCES plans(id) ON DELETE SET NULL");
+  ensureColumn("tasks", "task_list_id", "TEXT REFERENCES task_lists(id) ON DELETE SET NULL");
+  ensureColumn("tasks", "short_id", "TEXT");
   ensureColumn("tasks", "due_at", "TEXT");
   ensureColumn("tasks", "estimated_minutes", "INTEGER");
   ensureColumn("tasks", "requires_approval", "INTEGER NOT NULL DEFAULT 0");
@@ -2179,6 +2255,21 @@ function ensureTableMigrations(db) {
   ensureColumn("agents", "permissions", `TEXT DEFAULT '["*"]'`);
   ensureColumn("plans", "task_list_id", "TEXT");
   ensureColumn("plans", "agent_id", "TEXT");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_tasks_plan ON tasks(plan_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_tasks_task_list ON tasks(task_list_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_tasks_due_at ON tasks(due_at)");
+  ensureIndex("CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_short_id ON tasks(short_id) WHERE short_id IS NOT NULL");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_agents_name ON agents(name)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_lists_project ON task_lists(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_lists_slug ON task_lists(slug)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_tags_tag ON task_tags(tag)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_tags_task ON task_tags(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_project ON plans(project_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_status ON plans(status)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_task_list ON plans(task_list_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_plans_agent ON plans(agent_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_history_task ON task_history(task_id)");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_task_history_agent ON task_history(agent_id)");
 }
 function backfillTaskTags(db) {
   try {
@@ -2819,6 +2910,33 @@ var init_completion_guard = __esm(() => {
   init_projects();
 });
 
+// src/db/audit.ts
+var exports_audit = {};
+__export(exports_audit, {
+  logTaskChange: () => logTaskChange,
+  getTaskHistory: () => getTaskHistory,
+  getRecentActivity: () => getRecentActivity
+});
+function logTaskChange(taskId, action, field, oldValue, newValue, agentId, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const timestamp = now();
+  d.run(`INSERT INTO task_history (id, task_id, action, field, old_value, new_value, agent_id, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [id, taskId, action, field || null, oldValue ?? null, newValue ?? null, agentId || null, timestamp]);
+  return { id, task_id: taskId, action, field: field || null, old_value: oldValue ?? null, new_value: newValue ?? null, agent_id: agentId || null, created_at: timestamp };
+}
+function getTaskHistory(taskId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM task_history WHERE task_id = ? ORDER BY created_at DESC").all(taskId);
+}
+function getRecentActivity(limit = 50, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM task_history ORDER BY created_at DESC LIMIT ?").all(limit);
+}
+var init_audit = __esm(() => {
+  init_database();
+});
+
 // src/db/tasks.ts
 function rowToTask(row) {
   return {
@@ -3069,6 +3187,17 @@ function updateTask(id, input, db) {
   if (input.tags !== undefined) {
     replaceTaskTags(id, input.tags, d);
   }
+  const agentId = task.assigned_to || task.agent_id || null;
+  if (input.status !== undefined && input.status !== task.status)
+    logTaskChange(id, "update", "status", task.status, input.status, agentId, d);
+  if (input.priority !== undefined && input.priority !== task.priority)
+    logTaskChange(id, "update", "priority", task.priority, input.priority, agentId, d);
+  if (input.title !== undefined && input.title !== task.title)
+    logTaskChange(id, "update", "title", task.title, input.title, agentId, d);
+  if (input.assigned_to !== undefined && input.assigned_to !== task.assigned_to)
+    logTaskChange(id, "update", "assigned_to", task.assigned_to, input.assigned_to, agentId, d);
+  if (input.approved_by !== undefined)
+    logTaskChange(id, "approve", "approved_by", null, input.approved_by, agentId, d);
   return getTask(id, d);
 }
 function deleteTask(id, db) {
@@ -3090,6 +3219,7 @@ function startTask(id, agentId, db) {
       throw new LockError(id, current.locked_by);
     }
   }
+  logTaskChange(id, "start", "status", "pending", "in_progress", agentId, d);
   return getTask(id, d);
 }
 function completeTask(id, agentId, db) {
@@ -3104,6 +3234,7 @@ function completeTask(id, agentId, db) {
   const timestamp = now();
   d.run(`UPDATE tasks SET status = 'completed', locked_by = NULL, locked_at = NULL, completed_at = ?, version = version + 1, updated_at = ?
      WHERE id = ?`, [timestamp, timestamp, id]);
+  logTaskChange(id, "complete", "status", task.status, "completed", agentId || null, d);
   return getTask(id, d);
 }
 function lockTask(id, agentId, db) {
@@ -3184,6 +3315,7 @@ var init_tasks = __esm(() => {
   init_database();
   init_projects();
   init_completion_guard();
+  init_audit();
 });
 
 // src/db/agents.ts
@@ -4020,6 +4152,73 @@ var init_sync = __esm(() => {
   init_config();
 });
 
+// src/db/templates.ts
+var exports_templates = {};
+__export(exports_templates, {
+  taskFromTemplate: () => taskFromTemplate,
+  listTemplates: () => listTemplates,
+  getTemplate: () => getTemplate,
+  deleteTemplate: () => deleteTemplate,
+  createTemplate: () => createTemplate
+});
+function rowToTemplate(row) {
+  return {
+    ...row,
+    tags: JSON.parse(row.tags || "[]"),
+    metadata: JSON.parse(row.metadata || "{}"),
+    priority: row.priority || "medium"
+  };
+}
+function createTemplate(input, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  d.run(`INSERT INTO task_templates (id, name, title_pattern, description, priority, tags, project_id, plan_id, metadata, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+    id,
+    input.name,
+    input.title_pattern,
+    input.description || null,
+    input.priority || "medium",
+    JSON.stringify(input.tags || []),
+    input.project_id || null,
+    input.plan_id || null,
+    JSON.stringify(input.metadata || {}),
+    now()
+  ]);
+  return getTemplate(id, d);
+}
+function getTemplate(id, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM task_templates WHERE id = ?").get(id);
+  return row ? rowToTemplate(row) : null;
+}
+function listTemplates(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM task_templates ORDER BY name").all().map(rowToTemplate);
+}
+function deleteTemplate(id, db) {
+  const d = db || getDatabase();
+  return d.run("DELETE FROM task_templates WHERE id = ?", [id]).changes > 0;
+}
+function taskFromTemplate(templateId, overrides = {}, db) {
+  const t = getTemplate(templateId, db);
+  if (!t)
+    throw new Error(`Template not found: ${templateId}`);
+  return {
+    title: overrides.title || t.title_pattern,
+    description: overrides.description ?? t.description ?? undefined,
+    priority: overrides.priority ?? t.priority,
+    tags: overrides.tags ?? t.tags,
+    project_id: overrides.project_id ?? t.project_id ?? undefined,
+    plan_id: overrides.plan_id ?? t.plan_id ?? undefined,
+    metadata: overrides.metadata ?? t.metadata,
+    ...overrides
+  };
+}
+var init_templates = __esm(() => {
+  init_database();
+});
+
 // node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
@@ -7986,6 +8185,57 @@ var init_zod = __esm(() => {
   init_external();
 });
 
+// src/db/webhooks.ts
+var exports_webhooks = {};
+__export(exports_webhooks, {
+  listWebhooks: () => listWebhooks,
+  getWebhook: () => getWebhook,
+  dispatchWebhook: () => dispatchWebhook,
+  deleteWebhook: () => deleteWebhook,
+  createWebhook: () => createWebhook
+});
+function rowToWebhook(row) {
+  return { ...row, events: JSON.parse(row.events || "[]"), active: !!row.active };
+}
+function createWebhook(input, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  d.run(`INSERT INTO webhooks (id, url, events, secret, created_at) VALUES (?, ?, ?, ?, ?)`, [id, input.url, JSON.stringify(input.events || []), input.secret || null, now()]);
+  return getWebhook(id, d);
+}
+function getWebhook(id, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM webhooks WHERE id = ?").get(id);
+  return row ? rowToWebhook(row) : null;
+}
+function listWebhooks(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM webhooks ORDER BY created_at DESC").all().map(rowToWebhook);
+}
+function deleteWebhook(id, db) {
+  const d = db || getDatabase();
+  return d.run("DELETE FROM webhooks WHERE id = ?", [id]).changes > 0;
+}
+async function dispatchWebhook(event, payload, db) {
+  const webhooks = listWebhooks(db).filter((w) => w.active && (w.events.length === 0 || w.events.includes(event)));
+  for (const wh of webhooks) {
+    try {
+      const body = JSON.stringify({ event, payload, timestamp: now() });
+      const headers = { "Content-Type": "application/json" };
+      if (wh.secret) {
+        const encoder = new TextEncoder;
+        const key = await crypto.subtle.importKey("raw", encoder.encode(wh.secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
+        headers["X-Webhook-Signature"] = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+      }
+      fetch(wh.url, { method: "POST", headers, body }).catch(() => {});
+    } catch {}
+  }
+}
+var init_webhooks = __esm(() => {
+  init_database();
+});
+
 // src/mcp/index.ts
 var exports_mcp = {};
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -8094,7 +8344,9 @@ var init_mcp = __esm(() => {
     plan_id: exports_external.string().optional().describe("Plan ID to assign task to"),
     task_list_id: exports_external.string().optional().describe("Task list ID to assign task to"),
     tags: exports_external.array(exports_external.string()).optional().describe("Task tags"),
-    metadata: exports_external.record(exports_external.unknown()).optional().describe("Arbitrary metadata")
+    metadata: exports_external.record(exports_external.unknown()).optional().describe("Arbitrary metadata"),
+    estimated_minutes: exports_external.number().optional().describe("Estimated time in minutes"),
+    requires_approval: exports_external.boolean().optional().describe("Require approval before completion")
   }, async (params) => {
     try {
       const resolved = { ...params };
@@ -8376,12 +8628,16 @@ ${text}` }] };
     name: exports_external.string().describe("Plan name"),
     project_id: exports_external.string().optional().describe("Project ID"),
     description: exports_external.string().optional().describe("Plan description"),
-    status: exports_external.enum(["active", "completed", "archived"]).optional().describe("Plan status")
+    status: exports_external.enum(["active", "completed", "archived"]).optional().describe("Plan status"),
+    task_list_id: exports_external.string().optional().describe("Task list ID"),
+    agent_id: exports_external.string().optional().describe("Owner agent ID")
   }, async (params) => {
     try {
       const resolved = { ...params };
       if (resolved.project_id)
         resolved.project_id = resolveId(resolved.project_id, "projects");
+      if (resolved.task_list_id)
+        resolved.task_list_id = resolveId(resolved.task_list_id, "task_lists");
       const plan = createPlan(resolved);
       return {
         content: [{
@@ -8442,11 +8698,16 @@ ${text}` }] };
     id: exports_external.string().describe("Plan ID (full or partial)"),
     name: exports_external.string().optional().describe("New name"),
     description: exports_external.string().optional().describe("New description"),
-    status: exports_external.enum(["active", "completed", "archived"]).optional().describe("New status")
+    status: exports_external.enum(["active", "completed", "archived"]).optional().describe("New status"),
+    task_list_id: exports_external.string().optional().describe("Task list ID"),
+    agent_id: exports_external.string().optional().describe("Owner agent ID")
   }, async ({ id, ...rest }) => {
     try {
       const resolvedId = resolveId(id, "plans");
-      const plan = updatePlan(resolvedId, rest);
+      const resolved = { ...rest };
+      if (resolved.task_list_id)
+        resolved.task_list_id = resolveId(resolved.task_list_id, "task_lists");
+      const plan = updatePlan(resolvedId, resolved);
       return {
         content: [{
           type: "text",
@@ -8717,6 +8978,160 @@ Slug: ${list.slug}`
       return { content: [{ type: "text", text: formatError(e) }], isError: true };
     }
   });
+  server.tool("get_task_history", "Get change history for a task (audit log)", {
+    task_id: exports_external.string().describe("Task ID (full or partial)")
+  }, async ({ task_id }) => {
+    try {
+      const resolvedId = resolveId(task_id);
+      const { getTaskHistory: getTaskHistory2 } = await Promise.resolve().then(() => (init_audit(), exports_audit));
+      const history = getTaskHistory2(resolvedId);
+      if (history.length === 0)
+        return { content: [{ type: "text", text: "No history for this task." }] };
+      const text = history.map((h) => `${h.created_at} | ${h.action}${h.field ? ` ${h.field}` : ""}${h.old_value ? ` from "${h.old_value}"` : ""}${h.new_value ? ` to "${h.new_value}"` : ""}${h.agent_id ? ` by ${h.agent_id}` : ""}`).join(`
+`);
+      return { content: [{ type: "text", text: `${history.length} change(s):
+${text}` }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("get_recent_activity", "Get recent task changes across all tasks (audit log)", {
+    limit: exports_external.number().optional().describe("Max entries (default 50)")
+  }, async ({ limit }) => {
+    try {
+      const { getRecentActivity: getRecentActivity2 } = await Promise.resolve().then(() => (init_audit(), exports_audit));
+      const activity = getRecentActivity2(limit || 50);
+      if (activity.length === 0)
+        return { content: [{ type: "text", text: "No recent activity." }] };
+      const text = activity.map((h) => `${h.created_at} | ${h.task_id.slice(0, 8)} | ${h.action}${h.field ? ` ${h.field}` : ""}${h.agent_id ? ` by ${h.agent_id}` : ""}`).join(`
+`);
+      return { content: [{ type: "text", text: `${activity.length} recent change(s):
+${text}` }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("create_webhook", "Register a webhook URL to receive task change notifications", {
+    url: exports_external.string().describe("Webhook URL"),
+    events: exports_external.array(exports_external.string()).optional().describe("Event types to subscribe to (empty = all)"),
+    secret: exports_external.string().optional().describe("HMAC secret for signature verification")
+  }, async (params) => {
+    try {
+      const { createWebhook: createWebhook2 } = await Promise.resolve().then(() => (init_webhooks(), exports_webhooks));
+      const wh = createWebhook2(params);
+      return { content: [{ type: "text", text: `Webhook created: ${wh.id.slice(0, 8)} | ${wh.url} | events: ${wh.events.length === 0 ? "all" : wh.events.join(",")}` }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("list_webhooks", "List all registered webhooks", {}, async () => {
+    try {
+      const { listWebhooks: listWebhooks2 } = await Promise.resolve().then(() => (init_webhooks(), exports_webhooks));
+      const webhooks = listWebhooks2();
+      if (webhooks.length === 0)
+        return { content: [{ type: "text", text: "No webhooks registered." }] };
+      const text = webhooks.map((w) => `${w.id.slice(0, 8)} | ${w.active ? "active" : "inactive"} | ${w.url} | events: ${w.events.length === 0 ? "all" : w.events.join(",")}`).join(`
+`);
+      return { content: [{ type: "text", text: `${webhooks.length} webhook(s):
+${text}` }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("delete_webhook", "Delete a webhook", {
+    id: exports_external.string().describe("Webhook ID")
+  }, async ({ id }) => {
+    try {
+      const { deleteWebhook: deleteWebhook2 } = await Promise.resolve().then(() => (init_webhooks(), exports_webhooks));
+      const deleted = deleteWebhook2(id);
+      return { content: [{ type: "text", text: deleted ? "Webhook deleted." : "Webhook not found." }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("create_template", "Create a reusable task template", {
+    name: exports_external.string().describe("Template name"),
+    title_pattern: exports_external.string().describe("Title pattern for tasks created from this template"),
+    description: exports_external.string().optional().describe("Default description"),
+    priority: exports_external.enum(["low", "medium", "high", "critical"]).optional().describe("Default priority"),
+    tags: exports_external.array(exports_external.string()).optional().describe("Default tags"),
+    project_id: exports_external.string().optional().describe("Default project"),
+    plan_id: exports_external.string().optional().describe("Default plan")
+  }, async (params) => {
+    try {
+      const { createTemplate: createTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
+      const t = createTemplate2(params);
+      return { content: [{ type: "text", text: `Template created: ${t.id.slice(0, 8)} | ${t.name} | "${t.title_pattern}"` }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("list_templates", "List all task templates", {}, async () => {
+    try {
+      const { listTemplates: listTemplates2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
+      const templates = listTemplates2();
+      if (templates.length === 0)
+        return { content: [{ type: "text", text: "No templates." }] };
+      const text = templates.map((t) => `${t.id.slice(0, 8)} | ${t.name} | "${t.title_pattern}" | ${t.priority}`).join(`
+`);
+      return { content: [{ type: "text", text: `${templates.length} template(s):
+${text}` }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("create_task_from_template", "Create a task from a template with optional overrides", {
+    template_id: exports_external.string().describe("Template ID"),
+    title: exports_external.string().optional().describe("Override title"),
+    description: exports_external.string().optional().describe("Override description"),
+    priority: exports_external.enum(["low", "medium", "high", "critical"]).optional().describe("Override priority"),
+    assigned_to: exports_external.string().optional().describe("Assign to agent"),
+    project_id: exports_external.string().optional().describe("Override project")
+  }, async (params) => {
+    try {
+      const { taskFromTemplate: taskFromTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
+      const input = taskFromTemplate2(params.template_id, {
+        title: params.title,
+        description: params.description,
+        priority: params.priority,
+        assigned_to: params.assigned_to,
+        project_id: params.project_id
+      });
+      const task = createTask(input);
+      return { content: [{ type: "text", text: `Task created from template:
+${task.id.slice(0, 8)} | ${task.priority} | ${task.title}` }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("delete_template", "Delete a task template", { id: exports_external.string().describe("Template ID") }, async ({ id }) => {
+    try {
+      const { deleteTemplate: deleteTemplate2 } = await Promise.resolve().then(() => (init_templates(), exports_templates));
+      const deleted = deleteTemplate2(id);
+      return { content: [{ type: "text", text: deleted ? "Template deleted." : "Template not found." }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
+  server.tool("approve_task", "Approve a task that requires approval before completion", {
+    id: exports_external.string().describe("Task ID (full or partial)"),
+    agent_id: exports_external.string().optional().describe("Agent approving the task")
+  }, async ({ id, agent_id }) => {
+    try {
+      const resolvedId = resolveId(id);
+      const task = getTaskWithRelations(resolvedId);
+      if (!task)
+        return { content: [{ type: "text", text: `Task not found: ${id}` }], isError: true };
+      if (!task.requires_approval)
+        return { content: [{ type: "text", text: `Task ${id} does not require approval.` }] };
+      if (task.approved_by)
+        return { content: [{ type: "text", text: `Task already approved by ${task.approved_by}.` }] };
+      const updated = updateTask(resolvedId, { approved_by: agent_id || "system", version: task.version });
+      return { content: [{ type: "text", text: `Task approved by ${agent_id || "system"}: ${updated.id.slice(0, 8)} | ${updated.title}` }] };
+    } catch (e) {
+      return { content: [{ type: "text", text: formatError(e) }], isError: true };
+    }
+  });
   server.resource("tasks", "todos://tasks", { description: "All active tasks", mimeType: "application/json" }, async () => {
     const tasks = listTasks({ status: ["pending", "in_progress"] });
     return { contents: [{ uri: "todos://tasks", text: JSON.stringify(tasks, null, 2), mimeType: "application/json" }] };
@@ -10372,7 +10787,7 @@ function formatTaskLine(t) {
   return `${chalk.dim(t.id.slice(0, 8))} ${statusFn(t.status.padEnd(11))} ${priorityFn(t.priority.padEnd(8))} ${t.title}${assigned}${lock}${tags}${plan}`;
 }
 program2.name("todos").description("Universal task management for AI coding agents").version(getPackageVersion()).option("--project <path>", "Project path").option("--json", "Output as JSON").option("--agent <name>", "Agent name").option("--session <id>", "Session ID");
-program2.command("add <title>").description("Create a new task").option("-d, --description <text>", "Task description").option("-p, --priority <level>", "Priority: low, medium, high, critical").option("--parent <id>", "Parent task ID").option("-t, --tags <tags>", "Comma-separated tags").option("--tag <tags>", "Comma-separated tags (alias for --tags)").option("--plan <id>", "Assign to a plan").option("--assign <agent>", "Assign to agent").option("--status <status>", "Initial status").option("--list <id>", "Task list ID").option("--task-list <id>", "Task list ID (alias for --list)").action((title, opts) => {
+program2.command("add <title>").description("Create a new task").option("-d, --description <text>", "Task description").option("-p, --priority <level>", "Priority: low, medium, high, critical").option("--parent <id>", "Parent task ID").option("-t, --tags <tags>", "Comma-separated tags").option("--tag <tags>", "Comma-separated tags (alias for --tags)").option("--plan <id>", "Assign to a plan").option("--assign <agent>", "Assign to agent").option("--status <status>", "Initial status").option("--list <id>", "Task list ID").option("--task-list <id>", "Task list ID (alias for --list)").option("--estimated <minutes>", "Estimated time in minutes").option("--approval", "Require approval before completion").action((title, opts) => {
   const globalOpts = program2.opts();
   const projectId = autoProject(globalOpts);
   opts.tags = opts.tags || opts.tag;
@@ -10407,7 +10822,9 @@ program2.command("add <title>").description("Create a new task").option("-d, --d
     agent_id: globalOpts.agent,
     session_id: globalOpts.session,
     project_id: projectId,
-    working_dir: process.cwd()
+    working_dir: process.cwd(),
+    estimated_minutes: opts.estimated ? parseInt(opts.estimated, 10) : undefined,
+    requires_approval: opts.approval || false
   });
   if (globalOpts.json) {
     output(task, true);
@@ -10535,6 +10952,12 @@ program2.command("show <id>").description("Show full task details").action((id)
     console.log(`  ${chalk.dim("Session:")}  ${task.session_id}`);
   if (task.locked_by)
     console.log(`  ${chalk.dim("Locked:")}   ${task.locked_by} (at ${task.locked_at})`);
+  if (task.requires_approval) {
+    const approvalStatus = task.approved_by ? chalk.green(`approved by ${task.approved_by}`) : chalk.yellow("pending approval");
+    console.log(`  ${chalk.dim("Approval:")} ${approvalStatus}`);
+  }
+  if (task.estimated_minutes)
+    console.log(`  ${chalk.dim("Estimate:")} ${task.estimated_minutes} minutes`);
   if (task.project_id)
     console.log(`  ${chalk.dim("Project:")}  ${task.project_id}`);
   if (task.plan_id)
@@ -10579,7 +11002,29 @@ program2.command("show <id>").description("Show full task details").action((id)
     }
   }
 });
-program2.command("update <id>").description("Update a task").option("--title <text>", "New title").option("-d, --description <text>", "New description").option("-s, --status <status>", "New status").option("-p, --priority <priority>", "New priority").option("--assign <agent>", "Assign to agent").option("--tags <tags>", "New tags (comma-separated)").option("--tag <tags>", "New tags (alias for --tags)").option("--list <id>", "Move to a task list").option("--task-list <id>", "Move to a task list (alias for --list)").action((id, opts) => {
+program2.command("history <id>").description("Show change history for a task (audit log)").action((id) => {
+  const globalOpts = program2.opts();
+  const resolvedId = resolveTaskId(id);
+  const { getTaskHistory: getTaskHistory2 } = (init_audit(), __toCommonJS(exports_audit));
+  const history = getTaskHistory2(resolvedId);
+  if (globalOpts.json) {
+    output(history, true);
+    return;
+  }
+  if (history.length === 0) {
+    console.log(chalk.dim("No history for this task."));
+    return;
+  }
+  console.log(chalk.bold(`${history.length} change(s):
+`));
+  for (const h of history) {
+    const agent = h.agent_id ? chalk.cyan(` by ${h.agent_id}`) : "";
+    const field = h.field ? chalk.yellow(` ${h.field}`) : "";
+    const change = h.old_value && h.new_value ? ` ${chalk.red(h.old_value)} \u2192 ${chalk.green(h.new_value)}` : h.new_value ? ` \u2192 ${chalk.green(h.new_value)}` : "";
+    console.log(`  ${chalk.dim(h.created_at)} ${chalk.bold(h.action)}${field}${change}${agent}`);
+  }
+});
+program2.command("update <id>").description("Update a task").option("--title <text>", "New title").option("-d, --description <text>", "New description").option("-s, --status <status>", "New status").option("-p, --priority <priority>", "New priority").option("--assign <agent>", "Assign to agent").option("--tags <tags>", "New tags (comma-separated)").option("--tag <tags>", "New tags (alias for --tags)").option("--list <id>", "Move to a task list").option("--task-list <id>", "Move to a task list (alias for --list)").option("--estimated <minutes>", "Estimated time in minutes").option("--approval", "Require approval before completion").action((id, opts) => {
   const globalOpts = program2.opts();
   opts.tags = opts.tags || opts.tag;
   opts.list = opts.list || opts.taskList;
@@ -10608,7 +11053,9 @@ program2.command("update <id>").description("Update a task").option("--title <te
       priority: opts.priority,
       assigned_to: opts.assign,
       tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : undefined,
-      task_list_id: taskListId
+      task_list_id: taskListId,
+      estimated_minutes: opts.estimated !== undefined ? parseInt(opts.estimated, 10) : undefined,
+      requires_approval: opts.approval !== undefined ? true : undefined
     });
   } catch (e) {
     handleError(e);
@@ -10636,6 +11083,34 @@ program2.command("done <id>").description("Mark a task as completed").action((id
     console.log(formatTaskLine(task));
   }
 });
+program2.command("approve <id>").description("Approve a task that requires approval").action((id) => {
+  const globalOpts = program2.opts();
+  const resolvedId = resolveTaskId(id);
+  const task = getTask(resolvedId);
+  if (!task) {
+    console.error(chalk.red(`Task not found: ${id}`));
+    process.exit(1);
+  }
+  if (!task.requires_approval) {
+    console.log(chalk.yellow("This task does not require approval."));
+    return;
+  }
+  if (task.approved_by) {
+    console.log(chalk.yellow(`Already approved by ${task.approved_by}.`));
+    return;
+  }
+  try {
+    const updated = updateTask(resolvedId, { approved_by: globalOpts.agent || "cli", version: task.version });
+    if (globalOpts.json) {
+      output(updated, true);
+    } else {
+      console.log(chalk.green(`Task approved by ${globalOpts.agent || "cli"}:`));
+      console.log(formatTaskLine(updated));
+    }
+  } catch (e) {
+    handleError(e);
+  }
+});
 program2.command("start <id>").description("Claim, lock, and start a task").action((id) => {
   const globalOpts = program2.opts();
   const agentId = globalOpts.agent || "cli";
@@ -10843,6 +11318,76 @@ program2.command("plans").description("List and manage plans").option("--add <na
     console.log(`${chalk.dim(p.id.slice(0, 8))} ${chalk.bold(p.name)} ${chalk.cyan(`[${p.status}]`)}${desc}`);
   }
 });
+program2.command("templates").description("List and manage task templates").option("--add <name>", "Create a template").option("--title <pattern>", "Title pattern (with --add)").option("-d, --description <text>", "Default description").option("-p, --priority <level>", "Default priority").option("-t, --tags <tags>", "Default tags (comma-separated)").option("--delete <id>", "Delete a template").option("--use <id>", "Create a task from a template").action((opts) => {
+  const globalOpts = program2.opts();
+  const { createTemplate: createTemplate2, listTemplates: listTemplates2, deleteTemplate: deleteTemplate2, taskFromTemplate: taskFromTemplate2 } = (init_templates(), __toCommonJS(exports_templates));
+  if (opts.add) {
+    if (!opts.title) {
+      console.error(chalk.red("--title is required with --add"));
+      process.exit(1);
+    }
+    const projectId = autoProject(globalOpts);
+    const template = createTemplate2({
+      name: opts.add,
+      title_pattern: opts.title,
+      description: opts.description,
+      priority: opts.priority || "medium",
+      tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : [],
+      project_id: projectId
+    });
+    if (globalOpts.json) {
+      output(template, true);
+    } else {
+      console.log(chalk.green(`Template created: ${template.id.slice(0, 8)} | ${template.name} | "${template.title_pattern}"`));
+    }
+    return;
+  }
+  if (opts.delete) {
+    const deleted = deleteTemplate2(opts.delete);
+    if (globalOpts.json) {
+      output({ deleted }, true);
+    } else if (deleted) {
+      console.log(chalk.green("Template deleted."));
+    } else {
+      console.error(chalk.red("Template not found."));
+      process.exit(1);
+    }
+    return;
+  }
+  if (opts.use) {
+    try {
+      const input = taskFromTemplate2(opts.use, {
+        title: opts.title,
+        description: opts.description,
+        priority: opts.priority
+      });
+      const task = createTask({ ...input, project_id: input.project_id || autoProject(globalOpts) });
+      if (globalOpts.json) {
+        output(task, true);
+      } else {
+        console.log(chalk.green("Task created from template:"));
+        console.log(formatTaskLine(task));
+      }
+    } catch (e) {
+      handleError(e);
+    }
+    return;
+  }
+  const templates = listTemplates2();
+  if (globalOpts.json) {
+    output(templates, true);
+    return;
+  }
+  if (templates.length === 0) {
+    console.log(chalk.dim("No templates."));
+    return;
+  }
+  console.log(chalk.bold(`${templates.length} template(s):
+`));
+  for (const t of templates) {
+    console.log(`  ${chalk.dim(t.id.slice(0, 8))} ${chalk.bold(t.name)} ${chalk.cyan(`"${t.title_pattern}"`)} ${chalk.yellow(t.priority)}`);
+  }
+});
 program2.command("comment <id> <text>").description("Add a comment to a task").action((id, text) => {
   const globalOpts = program2.opts();
   const resolvedId = resolveTaskId(id);