@hasna/todos 0.9.6 → 0.9.9

package/dist/cli/index.js

@@ -2374,12 +2374,17 @@ var init_database = __esm(() => {
   CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_short_id ON tasks(short_id) WHERE short_id IS NOT NULL;
 
   INSERT OR IGNORE INTO _migrations (id) VALUES (6);
+  `,
+    `
+  ALTER TABLE tasks ADD COLUMN due_at TEXT;
+  CREATE INDEX IF NOT EXISTS idx_tasks_due_at ON tasks(due_at);
+  INSERT OR IGNORE INTO _migrations (id) VALUES (7);
   `
   ];
 });
 
 // src/types/index.ts
-var VersionConflictError, TaskNotFoundError, ProjectNotFoundError, PlanNotFoundError, LockError, TaskListNotFoundError, DependencyCycleError;
+var VersionConflictError, TaskNotFoundError, ProjectNotFoundError, PlanNotFoundError, LockError, TaskListNotFoundError, DependencyCycleError, CompletionGuardError;
 var init_types = __esm(() => {
   VersionConflictError = class VersionConflictError extends Error {
     taskId;
@@ -2445,9 +2450,31 @@ var init_types = __esm(() => {
       this.name = "DependencyCycleError";
     }
   };
+  CompletionGuardError = class CompletionGuardError extends Error {
+    reason;
+    retryAfterSeconds;
+    constructor(reason, retryAfterSeconds) {
+      super(reason);
+      this.reason = reason;
+      this.retryAfterSeconds = retryAfterSeconds;
+      this.name = "CompletionGuardError";
+    }
+  };
 });
 
 // src/db/projects.ts
+var exports_projects = {};
+__export(exports_projects, {
+  updateProject: () => updateProject,
+  slugify: () => slugify,
+  nextTaskShortId: () => nextTaskShortId,
+  listProjects: () => listProjects,
+  getProjectByPath: () => getProjectByPath,
+  getProject: () => getProject,
+  ensureProject: () => ensureProject,
+  deleteProject: () => deleteProject,
+  createProject: () => createProject
+});
 function slugify(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
@@ -2518,6 +2545,11 @@ function updateProject(id, input, db) {
   d.run(`UPDATE projects SET ${sets.join(", ")} WHERE id = ?`, params);
   return getProject(id, d);
 }
+function deleteProject(id, db) {
+  const d = db || getDatabase();
+  const result = d.run("DELETE FROM projects WHERE id = ?", [id]);
+  return result.changes > 0;
+}
 function nextTaskShortId(projectId, db) {
   const d = db || getDatabase();
   const project = getProject(projectId, d);
@@ -2546,6 +2578,173 @@ var init_projects = __esm(() => {
   init_database();
 });
 
+// src/lib/sync-utils.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
+import { join as join2 } from "path";
+function ensureDir2(dir) {
+  if (!existsSync2(dir))
+    mkdirSync2(dir, { recursive: true });
+}
+function listJsonFiles(dir) {
+  if (!existsSync2(dir))
+    return [];
+  return readdirSync(dir).filter((f) => f.endsWith(".json"));
+}
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeJsonFile(path, data) {
+  writeFileSync(path, JSON.stringify(data, null, 2) + `
+`);
+}
+function readHighWaterMark(dir) {
+  const path = join2(dir, ".highwatermark");
+  if (!existsSync2(path))
+    return 1;
+  const val = parseInt(readFileSync(path, "utf-8").trim(), 10);
+  return isNaN(val) ? 1 : val;
+}
+function writeHighWaterMark(dir, value) {
+  writeFileSync(join2(dir, ".highwatermark"), String(value));
+}
+function getFileMtimeMs(path) {
+  try {
+    return statSync(path).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function parseTimestamp(value) {
+  if (typeof value !== "string")
+    return null;
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+function appendSyncConflict(metadata, conflict, limit = 5) {
+  const current = Array.isArray(metadata["sync_conflicts"]) ? metadata["sync_conflicts"] : [];
+  const next = [conflict, ...current].slice(0, limit);
+  return { ...metadata, sync_conflicts: next };
+}
+var HOME;
+var init_sync_utils = __esm(() => {
+  HOME = process.env["HOME"] || process.env["USERPROFILE"] || "~";
+});
+
+// src/lib/config.ts
+import { existsSync as existsSync3 } from "fs";
+import { join as join3 } from "path";
+function normalizeAgent(agent) {
+  return agent.trim().toLowerCase();
+}
+function loadConfig() {
+  if (cached)
+    return cached;
+  if (!existsSync3(CONFIG_PATH)) {
+    cached = {};
+    return cached;
+  }
+  const config = readJsonFile(CONFIG_PATH) || {};
+  if (typeof config.sync_agents === "string") {
+    config.sync_agents = config.sync_agents.split(",").map((a) => a.trim()).filter(Boolean);
+  }
+  cached = config;
+  return cached;
+}
+function getSyncAgentsFromConfig() {
+  const config = loadConfig();
+  const agents = config.sync_agents;
+  if (Array.isArray(agents) && agents.length > 0)
+    return agents.map(normalizeAgent);
+  return null;
+}
+function getAgentTaskListId(agent) {
+  const config = loadConfig();
+  const key = normalizeAgent(agent);
+  return config.agents?.[key]?.task_list_id || config.task_list_id || null;
+}
+function getAgentTasksDir(agent) {
+  const config = loadConfig();
+  const key = normalizeAgent(agent);
+  return config.agents?.[key]?.tasks_dir || config.agent_tasks_dir || null;
+}
+function getTaskPrefixConfig() {
+  const config = loadConfig();
+  return config.task_prefix || null;
+}
+function getCompletionGuardConfig(projectPath) {
+  const config = loadConfig();
+  const global = { ...GUARD_DEFAULTS, ...config.completion_guard };
+  if (projectPath && config.project_overrides?.[projectPath]?.completion_guard) {
+    return { ...global, ...config.project_overrides[projectPath].completion_guard };
+  }
+  return global;
+}
+var CONFIG_PATH, cached = null, GUARD_DEFAULTS;
+var init_config = __esm(() => {
+  init_sync_utils();
+  CONFIG_PATH = join3(HOME, ".todos", "config.json");
+  GUARD_DEFAULTS = {
+    enabled: false,
+    min_work_seconds: 30,
+    max_completions_per_window: 5,
+    window_minutes: 10,
+    cooldown_seconds: 60
+  };
+});
+
+// src/lib/completion-guard.ts
+function checkCompletionGuard(task, agentId, db, configOverride) {
+  let config;
+  if (configOverride) {
+    config = configOverride;
+  } else {
+    const projectPath = task.project_id ? getProject(task.project_id, db)?.path : null;
+    config = getCompletionGuardConfig(projectPath);
+  }
+  if (!config.enabled)
+    return;
+  if (task.status !== "in_progress") {
+    throw new CompletionGuardError(`Task must be in 'in_progress' status before completing (current: '${task.status}'). Use start_task first.`);
+  }
+  const agent = agentId || task.assigned_to || task.agent_id;
+  if (config.min_work_seconds && task.locked_at) {
+    const startedAt = new Date(task.locked_at).getTime();
+    const elapsedSeconds = (Date.now() - startedAt) / 1000;
+    if (elapsedSeconds < config.min_work_seconds) {
+      const remaining = Math.ceil(config.min_work_seconds - elapsedSeconds);
+      throw new CompletionGuardError(`Too fast: task was started ${Math.floor(elapsedSeconds)}s ago. Minimum work duration is ${config.min_work_seconds}s. Wait ${remaining}s.`, remaining);
+    }
+  }
+  if (agent && config.max_completions_per_window && config.window_minutes) {
+    const windowStart = new Date(Date.now() - config.window_minutes * 60 * 1000).toISOString();
+    const result = db.query(`SELECT COUNT(*) as count FROM tasks
+         WHERE completed_at > ? AND (assigned_to = ? OR agent_id = ?)`).get(windowStart, agent, agent);
+    if (result.count >= config.max_completions_per_window) {
+      throw new CompletionGuardError(`Rate limit: ${result.count} tasks completed in the last ${config.window_minutes} minutes (max ${config.max_completions_per_window}). Slow down.`);
+    }
+  }
+  if (agent && config.cooldown_seconds) {
+    const result = db.query(`SELECT MAX(completed_at) as last_completed FROM tasks
+         WHERE completed_at IS NOT NULL AND (assigned_to = ? OR agent_id = ?) AND id != ?`).get(agent, agent, task.id);
+    if (result.last_completed) {
+      const elapsedSeconds = (Date.now() - new Date(result.last_completed).getTime()) / 1000;
+      if (elapsedSeconds < config.cooldown_seconds) {
+        const remaining = Math.ceil(config.cooldown_seconds - elapsedSeconds);
+        throw new CompletionGuardError(`Cooldown: last completion was ${Math.floor(elapsedSeconds)}s ago. Wait ${remaining}s between completions.`, remaining);
+      }
+    }
+  }
+}
+var init_completion_guard = __esm(() => {
+  init_types();
+  init_config();
+  init_projects();
+});
+
 // src/db/tasks.ts
 function rowToTask(row) {
   return {
@@ -2576,8 +2775,8 @@ function createTask(input, db) {
   const tags = input.tags || [];
   const shortId = input.project_id ? nextTaskShortId(input.project_id, d) : null;
   const title = shortId ? `${shortId}: ${input.title}` : input.title;
-  d.run(`INSERT INTO tasks (id, short_id, project_id, parent_id, plan_id, task_list_id, title, description, status, priority, agent_id, assigned_to, session_id, working_dir, tags, metadata, version, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?)`, [
+  d.run(`INSERT INTO tasks (id, short_id, project_id, parent_id, plan_id, task_list_id, title, description, status, priority, agent_id, assigned_to, session_id, working_dir, tags, metadata, version, created_at, updated_at, due_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?)`, [
     id,
     shortId,
     input.project_id || null,
@@ -2595,7 +2794,8 @@ function createTask(input, db) {
     JSON.stringify(tags),
     JSON.stringify(input.metadata || {}),
     timestamp,
-    timestamp
+    timestamp,
+    input.due_at || null
   ]);
   if (tags.length > 0) {
     insertTaskTags(id, tags, d);
@@ -2696,12 +2896,18 @@ function listTasks(filter = {}, db) {
     params.push(filter.task_list_id);
   }
   const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-  const limitVal = filter.limit || 100;
-  const offsetVal = filter.offset || 0;
-  params.push(limitVal, offsetVal);
+  let limitClause = "";
+  if (filter.limit) {
+    limitClause = " LIMIT ?";
+    params.push(filter.limit);
+    if (filter.offset) {
+      limitClause += " OFFSET ?";
+      params.push(filter.offset);
+    }
+  }
   const rows = d.query(`SELECT * FROM tasks ${where} ORDER BY
        CASE priority WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 END,
-       created_at DESC LIMIT ? OFFSET ?`).all(...params);
+       created_at DESC${limitClause}`).all(...params);
   return rows.map(rowToTask);
 }
 function updateTask(id, input, db) {
@@ -2723,6 +2929,9 @@ function updateTask(id, input, db) {
     params.push(input.description);
   }
   if (input.status !== undefined) {
+    if (input.status === "completed") {
+      checkCompletionGuard(task, task.assigned_to || task.agent_id || null, d);
+    }
     sets.push("status = ?");
     params.push(input.status);
     if (input.status === "completed") {
@@ -2754,6 +2963,10 @@ function updateTask(id, input, db) {
     sets.push("task_list_id = ?");
     params.push(input.task_list_id);
   }
+  if (input.due_at !== undefined) {
+    sets.push("due_at = ?");
+    params.push(input.due_at);
+  }
   params.push(id, input.version);
   const result = d.run(`UPDATE tasks SET ${sets.join(", ")} WHERE id = ? AND version = ?`, params);
   if (result.changes === 0) {
@@ -2794,6 +3007,7 @@ function completeTask(id, agentId, db) {
   if (agentId && task.locked_by && task.locked_by !== agentId && !isLockExpired(task.locked_at)) {
     throw new LockError(id, task.locked_by);
   }
+  checkCompletionGuard(task, agentId || null, d);
   const timestamp = now();
   d.run(`UPDATE tasks SET status = 'completed', locked_by = NULL, locked_at = NULL, completed_at = ?, version = version + 1, updated_at = ?
      WHERE id = ?`, [timestamp, timestamp, id]);
@@ -2876,9 +3090,19 @@ var init_tasks = __esm(() => {
   init_types();
   init_database();
   init_projects();
+  init_completion_guard();
 });
 
 // src/db/agents.ts
+var exports_agents = {};
+__export(exports_agents, {
+  updateAgentActivity: () => updateAgentActivity,
+  registerAgent: () => registerAgent,
+  listAgents: () => listAgents,
+  getAgentByName: () => getAgentByName,
+  getAgent: () => getAgent,
+  deleteAgent: () => deleteAgent
+});
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
 }
@@ -2915,6 +3139,14 @@ function listAgents(db) {
   const d = db || getDatabase();
   return d.query("SELECT * FROM agents ORDER BY name").all().map(rowToAgent);
 }
+function updateAgentActivity(id, db) {
+  const d = db || getDatabase();
+  d.run("UPDATE agents SET last_seen_at = ? WHERE id = ?", [now(), id]);
+}
+function deleteAgent(id, db) {
+  const d = db || getDatabase();
+  return d.run("DELETE FROM agents WHERE id = ?", [id]).changes > 0;
+}
 var init_agents = __esm(() => {
   init_database();
 });
@@ -3111,109 +3343,6 @@ var init_search = __esm(() => {
   init_database();
 });
 
-// src/lib/sync-utils.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
-import { join as join2 } from "path";
-function ensureDir2(dir) {
-  if (!existsSync2(dir))
-    mkdirSync2(dir, { recursive: true });
-}
-function listJsonFiles(dir) {
-  if (!existsSync2(dir))
-    return [];
-  return readdirSync(dir).filter((f) => f.endsWith(".json"));
-}
-function readJsonFile(path) {
-  try {
-    return JSON.parse(readFileSync(path, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function writeJsonFile(path, data) {
-  writeFileSync(path, JSON.stringify(data, null, 2) + `
-`);
-}
-function readHighWaterMark(dir) {
-  const path = join2(dir, ".highwatermark");
-  if (!existsSync2(path))
-    return 1;
-  const val = parseInt(readFileSync(path, "utf-8").trim(), 10);
-  return isNaN(val) ? 1 : val;
-}
-function writeHighWaterMark(dir, value) {
-  writeFileSync(join2(dir, ".highwatermark"), String(value));
-}
-function getFileMtimeMs(path) {
-  try {
-    return statSync(path).mtimeMs;
-  } catch {
-    return null;
-  }
-}
-function parseTimestamp(value) {
-  if (typeof value !== "string")
-    return null;
-  const parsed = Date.parse(value);
-  return Number.isNaN(parsed) ? null : parsed;
-}
-function appendSyncConflict(metadata, conflict, limit = 5) {
-  const current = Array.isArray(metadata["sync_conflicts"]) ? metadata["sync_conflicts"] : [];
-  const next = [conflict, ...current].slice(0, limit);
-  return { ...metadata, sync_conflicts: next };
-}
-var HOME;
-var init_sync_utils = __esm(() => {
-  HOME = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-});
-
-// src/lib/config.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
-function normalizeAgent(agent) {
-  return agent.trim().toLowerCase();
-}
-function loadConfig() {
-  if (cached)
-    return cached;
-  if (!existsSync3(CONFIG_PATH)) {
-    cached = {};
-    return cached;
-  }
-  const config = readJsonFile(CONFIG_PATH) || {};
-  if (typeof config.sync_agents === "string") {
-    config.sync_agents = config.sync_agents.split(",").map((a) => a.trim()).filter(Boolean);
-  }
-  cached = config;
-  return cached;
-}
-function getSyncAgentsFromConfig() {
-  const config = loadConfig();
-  const agents = config.sync_agents;
-  if (Array.isArray(agents) && agents.length > 0)
-    return agents.map(normalizeAgent);
-  return null;
-}
-function getAgentTaskListId(agent) {
-  const config = loadConfig();
-  const key = normalizeAgent(agent);
-  return config.agents?.[key]?.task_list_id || config.task_list_id || null;
-}
-function getAgentTasksDir(agent) {
-  const config = loadConfig();
-  const key = normalizeAgent(agent);
-  return config.agents?.[key]?.tasks_dir || config.agent_tasks_dir || null;
-}
-function getTaskPrefixConfig() {
-  const config = loadConfig();
-  return config.task_prefix || null;
-}
-var CONFIG_PATH, cached = null;
-var init_config = __esm(() => {
-  init_sync_utils();
-  CONFIG_PATH = join3(HOME, ".todos", "config.json");
-});
-
 // src/lib/claude-tasks.ts
 import { existsSync as existsSync4, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join4 } from "path";
@@ -7729,6 +7858,10 @@ function formatError(error) {
     return `Lock error: ${error.message}`;
   if (error instanceof DependencyCycleError)
     return `Dependency cycle: ${error.message}`;
+  if (error instanceof CompletionGuardError) {
+    const retry = error.retryAfterSeconds ? ` (retry after ${error.retryAfterSeconds}s)` : "";
+    return `Completion blocked: ${error.reason}${retry}`;
+  }
   if (error instanceof Error)
     return error.message;
   return String(error);
@@ -8461,6 +8594,391 @@ Slug: ${list.slug}`
   });
 });
 
+// src/server/serve.ts
+var exports_serve = {};
+__export(exports_serve, {
+  startServer: () => startServer
+});
+import { existsSync as existsSync6 } from "fs";
+import { join as join6, dirname as dirname2, extname } from "path";
+import { fileURLToPath } from "url";
+function resolveDashboardDir() {
+  const candidates = [];
+  try {
+    const scriptDir = dirname2(fileURLToPath(import.meta.url));
+    candidates.push(join6(scriptDir, "..", "dashboard", "dist"));
+    candidates.push(join6(scriptDir, "..", "..", "dashboard", "dist"));
+  } catch {}
+  if (process.argv[1]) {
+    const mainDir = dirname2(process.argv[1]);
+    candidates.push(join6(mainDir, "..", "dashboard", "dist"));
+    candidates.push(join6(mainDir, "..", "..", "dashboard", "dist"));
+  }
+  candidates.push(join6(process.cwd(), "dashboard", "dist"));
+  for (const candidate of candidates) {
+    if (existsSync6(candidate))
+      return candidate;
+  }
+  return join6(process.cwd(), "dashboard", "dist");
+}
+function json(data, status = 200, port) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      "Access-Control-Allow-Origin": port ? `http://localhost:${port}` : "*",
+      ...SECURITY_HEADERS
+    }
+  });
+}
+function serveStaticFile(filePath) {
+  if (!existsSync6(filePath))
+    return null;
+  const ext = extname(filePath);
+  const contentType = MIME_TYPES[ext] || "application/octet-stream";
+  return new Response(Bun.file(filePath), {
+    headers: { "Content-Type": contentType }
+  });
+}
+function taskToSummary(task) {
+  return {
+    id: task.id,
+    short_id: task.short_id,
+    title: task.title,
+    description: task.description,
+    status: task.status,
+    priority: task.priority,
+    project_id: task.project_id,
+    plan_id: task.plan_id,
+    task_list_id: task.task_list_id,
+    agent_id: task.agent_id,
+    assigned_to: task.assigned_to,
+    locked_by: task.locked_by,
+    tags: task.tags,
+    version: task.version,
+    created_at: task.created_at,
+    updated_at: task.updated_at,
+    completed_at: task.completed_at,
+    due_at: task.due_at
+  };
+}
+async function startServer(port, options) {
+  const shouldOpen = options?.open ?? true;
+  getDatabase();
+  const dashboardDir = resolveDashboardDir();
+  const dashboardExists = existsSync6(dashboardDir);
+  if (!dashboardExists) {
+    console.error(`
+Dashboard not found at: ${dashboardDir}`);
+    console.error(`Run this to build it:
+`);
+    console.error(`  cd dashboard && bun install && bun run build
+`);
+  }
+  const server2 = Bun.serve({
+    port,
+    async fetch(req) {
+      const url = new URL(req.url);
+      const path = url.pathname;
+      const method = req.method;
+      if (method === "OPTIONS") {
+        return new Response(null, {
+          headers: {
+            "Access-Control-Allow-Origin": `http://localhost:${port}`,
+            "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type"
+          }
+        });
+      }
+      if (path === "/api/stats" && method === "GET") {
+        const all = listTasks({ limit: 1e4 });
+        const projects = listProjects();
+        const agents = listAgents();
+        return json({
+          total_tasks: all.length,
+          pending: all.filter((t) => t.status === "pending").length,
+          in_progress: all.filter((t) => t.status === "in_progress").length,
+          completed: all.filter((t) => t.status === "completed").length,
+          failed: all.filter((t) => t.status === "failed").length,
+          cancelled: all.filter((t) => t.status === "cancelled").length,
+          projects: projects.length,
+          agents: agents.length
+        }, 200, port);
+      }
+      if (path === "/api/tasks" && method === "GET") {
+        const status = url.searchParams.get("status") || undefined;
+        const projectId = url.searchParams.get("project_id") || undefined;
+        const limitParam = url.searchParams.get("limit");
+        const tasks = listTasks({
+          status,
+          project_id: projectId,
+          limit: limitParam ? parseInt(limitParam, 10) : undefined
+        });
+        return json(tasks.map(taskToSummary), 200, port);
+      }
+      if (path === "/api/tasks" && method === "POST") {
+        try {
+          const body = await req.json();
+          if (!body.title)
+            return json({ error: "Missing 'title'" }, 400, port);
+          const task = createTask({
+            title: body.title,
+            description: body.description,
+            priority: body.priority,
+            project_id: body.project_id
+          });
+          return json(taskToSummary(task), 201, port);
+        } catch (e) {
+          return json({ error: e instanceof Error ? e.message : "Failed to create task" }, 500, port);
+        }
+      }
+      if (path === "/api/tasks/export" && method === "GET") {
+        const format = url.searchParams.get("format") || "json";
+        const status = url.searchParams.get("status") || undefined;
+        const projectId = url.searchParams.get("project_id") || undefined;
+        const tasks = listTasks({ status, project_id: projectId, limit: 1e4 });
+        const summaries = tasks.map(taskToSummary);
+        if (format === "csv") {
+          const headers = ["id", "short_id", "title", "status", "priority", "project_id", "assigned_to", "agent_id", "created_at", "updated_at", "completed_at", "due_at"];
+          const rows = summaries.map((t) => headers.map((h) => {
+            const val = t[h];
+            if (val === null || val === undefined)
+              return "";
+            const str = String(val);
+            return str.includes(",") || str.includes('"') || str.includes(`
+`) ? `"${str.replace(/"/g, '""')}"` : str;
+          }).join(","));
+          const csv = [headers.join(","), ...rows].join(`
+`);
+          return new Response(csv, {
+            headers: {
+              "Content-Type": "text/csv",
+              "Content-Disposition": "attachment; filename=tasks.csv",
+              ...SECURITY_HEADERS
+            }
+          });
+        }
+        return new Response(JSON.stringify(summaries, null, 2), {
+          headers: {
+            "Content-Type": "application/json",
+            "Content-Disposition": "attachment; filename=tasks.json",
+            ...SECURITY_HEADERS
+          }
+        });
+      }
+      if (path === "/api/tasks/bulk" && method === "POST") {
+        try {
+          const body = await req.json();
+          if (!body.ids?.length || !body.action)
+            return json({ error: "Missing ids or action" }, 400, port);
+          const results = [];
+          for (const id of body.ids) {
+            try {
+              if (body.action === "delete") {
+                deleteTask(id);
+                results.push({ id, success: true });
+              } else if (body.action === "start") {
+                startTask(id, "dashboard");
+                results.push({ id, success: true });
+              } else if (body.action === "complete") {
+                completeTask(id, "dashboard");
+                results.push({ id, success: true });
+              }
+            } catch (e) {
+              results.push({ id, success: false, error: e instanceof Error ? e.message : "Failed" });
+            }
+          }
+          return json({ results, succeeded: results.filter((r) => r.success).length, failed: results.filter((r) => !r.success).length }, 200, port);
+        } catch (e) {
+          return json({ error: e instanceof Error ? e.message : "Failed" }, 500, port);
+        }
+      }
+      const taskMatch = path.match(/^\/api\/tasks\/([^/]+)$/);
+      if (taskMatch) {
+        const id = taskMatch[1];
+        if (method === "GET") {
+          const task = getTask(id);
+          if (!task)
+            return json({ error: "Task not found" }, 404, port);
+          return json(taskToSummary(task), 200, port);
+        }
+        if (method === "PATCH") {
+          try {
+            const body = await req.json();
+            const task = getTask(id);
+            if (!task)
+              return json({ error: "Task not found" }, 404, port);
+            const updated = updateTask(id, {
+              ...body,
+              version: task.version
+            });
+            return json(taskToSummary(updated), 200, port);
+          } catch (e) {
+            return json({ error: e instanceof Error ? e.message : "Failed to update task" }, 500, port);
+          }
+        }
+        if (method === "DELETE") {
+          const deleted = deleteTask(id);
+          if (!deleted)
+            return json({ error: "Task not found" }, 404, port);
+          return json({ success: true }, 200, port);
+        }
+      }
+      const startMatch = path.match(/^\/api\/tasks\/([^/]+)\/start$/);
+      if (startMatch && method === "POST") {
+        const id = startMatch[1];
+        try {
+          const task = startTask(id, "dashboard");
+          return json(taskToSummary(task), 200, port);
+        } catch (e) {
+          return json({ error: e instanceof Error ? e.message : "Failed to start task" }, 500, port);
+        }
+      }
+      const completeMatch = path.match(/^\/api\/tasks\/([^/]+)\/complete$/);
+      if (completeMatch && method === "POST") {
+        const id = completeMatch[1];
+        try {
+          const task = completeTask(id, "dashboard");
+          return json(taskToSummary(task), 200, port);
+        } catch (e) {
+          return json({ error: e instanceof Error ? e.message : "Failed to complete task" }, 500, port);
+        }
+      }
+      if (path === "/api/projects" && method === "GET") {
+        return json(listProjects(), 200, port);
+      }
+      if (path === "/api/agents" && method === "GET") {
+        return json(listAgents(), 200, port);
+      }
+      if (path === "/api/projects" && method === "POST") {
+        try {
+          const body = await req.json();
+          if (!body.name || !body.path)
+            return json({ error: "Missing name or path" }, 400, port);
+          const { createProject: createProject2 } = await Promise.resolve().then(() => (init_projects(), exports_projects));
+          const project = createProject2({ name: body.name, path: body.path, description: body.description });
+          return json(project, 201, port);
+        } catch (e) {
+          return json({ error: e instanceof Error ? e.message : "Failed to create project" }, 500, port);
+        }
+      }
+      const projectDeleteMatch = path.match(/^\/api\/projects\/([^/]+)$/);
+      if (projectDeleteMatch && method === "DELETE") {
+        const id = projectDeleteMatch[1];
+        const { deleteProject: deleteProject2 } = await Promise.resolve().then(() => (init_projects(), exports_projects));
+        const deleted = deleteProject2(id);
+        if (!deleted)
+          return json({ error: "Project not found" }, 404, port);
+        return json({ success: true }, 200, port);
+      }
+      if (path === "/api/agents" && method === "POST") {
+        try {
+          const body = await req.json();
+          if (!body.name)
+            return json({ error: "Missing name" }, 400, port);
+          const { registerAgent: registerAgent2 } = await Promise.resolve().then(() => (init_agents(), exports_agents));
+          const agent = registerAgent2({ name: body.name, description: body.description });
+          return json(agent, 201, port);
+        } catch (e) {
+          return json({ error: e instanceof Error ? e.message : "Failed to register agent" }, 500, port);
+        }
+      }
+      const agentDeleteMatch = path.match(/^\/api\/agents\/([^/]+)$/);
+      if (agentDeleteMatch && method === "DELETE") {
+        const id = agentDeleteMatch[1];
+        const { deleteAgent: deleteAgent2 } = await Promise.resolve().then(() => (init_agents(), exports_agents));
+        const deleted = deleteAgent2(id);
+        if (!deleted)
+          return json({ error: "Agent not found" }, 404, port);
+        return json({ success: true }, 200, port);
+      }
+      if (path === "/api/agents/bulk" && method === "POST") {
+        try {
+          const body = await req.json();
+          if (!body.ids?.length || body.action !== "delete")
+            return json({ error: "Missing ids or invalid action" }, 400, port);
+          const { deleteAgent: deleteAgent2 } = await Promise.resolve().then(() => (init_agents(), exports_agents));
+          let succeeded = 0;
+          for (const id of body.ids) {
+            if (deleteAgent2(id))
+              succeeded++;
+          }
+          return json({ succeeded, failed: body.ids.length - succeeded }, 200, port);
+        } catch (e) {
+          return json({ error: e instanceof Error ? e.message : "Failed" }, 500, port);
+        }
+      }
+      if (path === "/api/projects/bulk" && method === "POST") {
+        try {
+          const body = await req.json();
+          if (!body.ids?.length || body.action !== "delete")
+            return json({ error: "Missing ids or invalid action" }, 400, port);
+          const { deleteProject: deleteProject2 } = await Promise.resolve().then(() => (init_projects(), exports_projects));
+          let succeeded = 0;
+          for (const id of body.ids) {
+            if (deleteProject2(id))
+              succeeded++;
+          }
+          return json({ succeeded, failed: body.ids.length - succeeded }, 200, port);
+        } catch (e) {
+          return json({ error: e instanceof Error ? e.message : "Failed" }, 500, port);
+        }
+      }
+      if (dashboardExists && (method === "GET" || method === "HEAD")) {
+        if (path !== "/") {
+          const filePath = join6(dashboardDir, path);
+          const res2 = serveStaticFile(filePath);
+          if (res2)
+            return res2;
+        }
+        const indexPath = join6(dashboardDir, "index.html");
+        const res = serveStaticFile(indexPath);
+        if (res)
+          return res;
+      }
+      return json({ error: "Not found" }, 404, port);
+    }
+  });
+  const shutdown = () => {
+    server2.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  const serverUrl = `http://localhost:${port}`;
+  console.log(`Todos Dashboard running at ${serverUrl}`);
+  if (shouldOpen) {
+    try {
+      const { exec } = await import("child_process");
+      const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+      exec(`${openCmd} ${serverUrl}`);
+    } catch {}
+  }
+}
+var MIME_TYPES, SECURITY_HEADERS;
+var init_serve = __esm(() => {
+  init_tasks();
+  init_projects();
+  init_agents();
+  init_database();
+  MIME_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "application/javascript",
+    ".css": "text/css",
+    ".json": "application/json",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".svg": "image/svg+xml",
+    ".ico": "image/x-icon",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2"
+  };
+  SECURITY_HEADERS = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY"
+  };
+});
+
 // src/cli/components/Header.tsx
 import { Box, Text } from "ink";
 import { jsxDEV, Fragment } from "react/jsx-dev-runtime";
@@ -9547,12 +10065,12 @@ init_sync();
 init_config();
 import chalk from "chalk";
 import { execSync } from "child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { basename, dirname as dirname2, join as join6, resolve as resolve2 } from "path";
-import { fileURLToPath } from "url";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { basename, dirname as dirname3, join as join7, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function getPackageVersion() {
   try {
-    const pkgPath = join6(dirname2(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+    const pkgPath = join7(dirname3(fileURLToPath2(import.meta.url)), "..", "..", "package.json");
     return JSON.parse(readFileSync3(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -10204,8 +10722,8 @@ hooks.command("install").description("Install Claude Code hooks for auto-sync").
     if (p)
       todosBin = p;
   } catch {}
-  const hooksDir = join6(process.cwd(), ".claude", "hooks");
-  if (!existsSync6(hooksDir))
+  const hooksDir = join7(process.cwd(), ".claude", "hooks");
+  if (!existsSync7(hooksDir))
     mkdirSync3(hooksDir, { recursive: true });
   const hookScript = `#!/usr/bin/env bash
 # Auto-generated by: todos hooks install
@@ -10230,11 +10748,11 @@ esac
 
 exit 0
 `;
-  const hookPath = join6(hooksDir, "todos-sync.sh");
+  const hookPath = join7(hooksDir, "todos-sync.sh");
   writeFileSync3(hookPath, hookScript);
   execSync(`chmod +x "${hookPath}"`);
   console.log(chalk.green(`Hook script created: ${hookPath}`));
-  const settingsPath = join6(process.cwd(), ".claude", "settings.json");
+  const settingsPath = join7(process.cwd(), ".claude", "settings.json");
   const settings = readJsonFile2(settingsPath);
   if (!settings["hooks"]) {
     settings["hooks"] = {};
@@ -10281,13 +10799,13 @@ function getMcpBinaryPath() {
     if (p)
       return p;
   } catch {}
-  const bunBin = join6(HOME2, ".bun", "bin", "todos-mcp");
-  if (existsSync6(bunBin))
+  const bunBin = join7(HOME2, ".bun", "bin", "todos-mcp");
+  if (existsSync7(bunBin))
     return bunBin;
   return "todos-mcp";
 }
 function readJsonFile2(path) {
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return {};
   try {
     return JSON.parse(readFileSync3(path, "utf-8"));
@@ -10296,25 +10814,25 @@ function readJsonFile2(path) {
   }
 }
 function writeJsonFile2(path, data) {
-  const dir = dirname2(path);
-  if (!existsSync6(dir))
+  const dir = dirname3(path);
+  if (!existsSync7(dir))
     mkdirSync3(dir, { recursive: true });
   writeFileSync3(path, JSON.stringify(data, null, 2) + `
 `);
 }
 function readTomlFile(path) {
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return "";
   return readFileSync3(path, "utf-8");
 }
 function writeTomlFile(path, content) {
-  const dir = dirname2(path);
-  if (!existsSync6(dir))
+  const dir = dirname3(path);
+  if (!existsSync7(dir))
     mkdirSync3(dir, { recursive: true });
   writeFileSync3(path, content);
 }
 function registerClaude(binPath, global) {
-  const configPath = global ? join6(HOME2, ".claude", ".mcp.json") : join6(process.cwd(), ".mcp.json");
+  const configPath = global ? join7(HOME2, ".claude", ".mcp.json") : join7(process.cwd(), ".mcp.json");
   const config = readJsonFile2(configPath);
   if (!config["mcpServers"]) {
     config["mcpServers"] = {};
@@ -10329,7 +10847,7 @@ function registerClaude(binPath, global) {
   console.log(chalk.green(`Claude Code (${scope}): registered in ${configPath}`));
 }
 function unregisterClaude(global) {
-  const configPath = global ? join6(HOME2, ".claude", ".mcp.json") : join6(process.cwd(), ".mcp.json");
+  const configPath = global ? join7(HOME2, ".claude", ".mcp.json") : join7(process.cwd(), ".mcp.json");
   const config = readJsonFile2(configPath);
   const servers = config["mcpServers"];
   if (!servers || !("todos" in servers)) {
@@ -10342,7 +10860,7 @@ function unregisterClaude(global) {
   console.log(chalk.green(`Claude Code (${scope}): unregistered from ${configPath}`));
 }
 function registerCodex(binPath) {
-  const configPath = join6(HOME2, ".codex", "config.toml");
+  const configPath = join7(HOME2, ".codex", "config.toml");
   let content = readTomlFile(configPath);
   content = removeTomlBlock(content, "mcp_servers.todos");
   const block = `
@@ -10356,7 +10874,7 @@ args = []
   console.log(chalk.green(`Codex CLI: registered in ${configPath}`));
 }
 function unregisterCodex() {
-  const configPath = join6(HOME2, ".codex", "config.toml");
+  const configPath = join7(HOME2, ".codex", "config.toml");
   let content = readTomlFile(configPath);
   if (!content.includes("[mcp_servers.todos]")) {
     console.log(chalk.dim(`Codex CLI: todos not found in ${configPath}`));
@@ -10389,7 +10907,7 @@ function removeTomlBlock(content, blockName) {
 `);
 }
 function registerGemini(binPath) {
-  const configPath = join6(HOME2, ".gemini", "settings.json");
+  const configPath = join7(HOME2, ".gemini", "settings.json");
   const config = readJsonFile2(configPath);
   if (!config["mcpServers"]) {
     config["mcpServers"] = {};
@@ -10403,7 +10921,7 @@ function registerGemini(binPath) {
   console.log(chalk.green(`Gemini CLI: registered in ${configPath}`));
 }
 function unregisterGemini() {
-  const configPath = join6(HOME2, ".gemini", "settings.json");
+  const configPath = join7(HOME2, ".gemini", "settings.json");
   const config = readJsonFile2(configPath);
   const servers = config["mcpServers"];
   if (!servers || !("todos" in servers)) {
@@ -10567,6 +11085,10 @@ Updated to ${latestVersion}!`));
     handleError(e);
   }
 });
+program2.command("serve").description("Start the web dashboard").option("--port <port>", "Port number", "19427").option("--no-open", "Don't open browser automatically").action(async (opts) => {
+  const { startServer: startServer2 } = await Promise.resolve().then(() => (init_serve(), exports_serve));
+  await startServer2(parseInt(opts.port, 10), { open: opts.open !== false });
+});
 program2.command("interactive").description("Launch interactive TUI").action(async () => {
   const { renderApp: renderApp2 } = await Promise.resolve().then(() => (init_App(), exports_App));
   const globalOpts = program2.opts();