@inteeka/task-cli 0.1.0 → 0.1.1

package/dist/cli.js

@@ -635,15 +635,15 @@ function registerLogin(program2) {
       noBrowser: !opts.browser,
       silent: cfg.silent
     });
-    const access = await apiCall("GET", "/api/v1/cli/access");
-    if (!access.ok || !access.data) {
+    const access2 = await apiCall("GET", "/api/v1/cli/access");
+    if (!access2.ok || !access2.data) {
       await clearCredentials();
       throw new CliError(
         CLI_EXIT_CODES.UNAUTHORISED,
         "Authentication succeeded but /cli/access did not return a result"
       );
     }
-    if (!access.data.has_access) {
+    if (!access2.data.has_access) {
       await clearCredentials();
       throw new CliError(
         CLI_EXIT_CODES.UNAUTHORISED,
@@ -655,14 +655,14 @@ function registerLogin(program2) {
     if (stored) {
       await writeCredentials({
         ...stored,
-        email: access.data.email
+        email: access2.data.email
       });
     }
-    process.stdout.write(`${c.ok("\u2713")} Signed in as ${c.bold(access.data.email)}
+    process.stdout.write(`${c.ok("\u2713")} Signed in as ${c.bold(access2.data.email)}
 `);
     process.stdout.write(`  Session: ${c.dim(result.sessionId)}
 `);
-    const projectCount = access.data.projects.length;
+    const projectCount = access2.data.projects.length;
     process.stdout.write(
       `  ${projectCount} project${projectCount === 1 ? "" : "s"} authorised. Run ${c.cyan("task projects")} to list them.
 `
@@ -700,8 +700,8 @@ function registerWhoami(program2) {
 `);
       return;
     }
-    const access = await apiCallOrThrow("GET", "/api/v1/cli/access");
-    process.stdout.write(`${c.bold(access.email || creds.email || access.user_id)}
+    const access2 = await apiCallOrThrow("GET", "/api/v1/cli/access");
+    process.stdout.write(`${c.bold(access2.email || creds.email || access2.user_id)}
 `);
     process.stdout.write(`  API:        ${creds.api_url}
 `);
@@ -711,9 +711,9 @@ function registerWhoami(program2) {
 `);
     process.stdout.write(`  Refresh expires: ${creds.refresh_expires_at}
 `);
-    process.stdout.write(`  Projects:   ${access.projects.length} authorised
+    process.stdout.write(`  Projects:   ${access2.projects.length} authorised
 `);
-    for (const p of access.projects) {
+    for (const p of access2.projects) {
       process.stdout.write(
         `    \u2022 ${c.bold(p.name)} ${c.dim(`(${p.organisation_slug}/${p.slug})`)} \u2014 ${p.cli_eligible_count} eligible
 `
@@ -734,6 +734,9 @@ function registerAuthRefresh(program2) {
 }
 
 // src/commands/link.ts
+import { readFile as readFile4, writeFile as writeFile4, appendFile, access } from "fs/promises";
+import { constants as fsConstants } from "fs";
+import { join as join4 } from "path";
 import inquirer from "inquirer";
 
 // src/config/project.ts
@@ -777,7 +780,7 @@ async function clearProjectConfig(repoRoot) {
 
 // src/commands/link.ts
 function registerLink(program2) {
-  program2.command("link").description("Link the current repo to a project").option("--org <slug>", "Org slug").option("--project <slug>", "Project slug").action(async (opts) => {
+  program2.command("link").description("Link the current repo to a project").option("--org <slug>", "Org slug \u2014 must be combined with --project").option("--project <slug>", "Project slug \u2014 must be combined with --org").action(async (opts) => {
     const creds = await readCredentials();
     if (!creds) {
       throw new CliError(
@@ -786,40 +789,15 @@ function registerLink(program2) {
         "Run 'task login' first."
       );
     }
-    const access = await apiCallOrThrow("GET", "/api/v1/cli/access");
-    if (access.projects.length === 0) {
+    const accessResp = await apiCallOrThrow("GET", "/api/v1/cli/access");
+    if (accessResp.projects.length === 0) {
       throw new CliError(
         CLI_EXIT_CODES.UNAUTHORISED,
         "No projects authorised for your account",
         "Ask an admin to grant CLI access on the Agentic CLI page."
       );
     }
-    let chosen = access.projects.find(
-      (p) => (opts.org ? p.organisation_slug === opts.org : true) && (opts.project ? p.slug === opts.project : true)
-    );
-    if (!chosen) {
-      if (opts.org || opts.project) {
-        throw new CliError(
-          CLI_EXIT_CODES.GENERIC_ERROR,
-          "No matching project found among your authorised projects"
-        );
-      }
-      const answer = await inquirer.prompt([
-        {
-          type: "list",
-          name: "projectId",
-          message: "Select a project to link this repo to:",
-          choices: access.projects.map((p) => ({
-            name: `${p.name} (${p.organisation_slug}/${p.slug}) \u2014 ${p.cli_eligible_count} eligible tickets`,
-            value: p.id
-          }))
-        }
-      ]);
-      chosen = access.projects.find((p) => p.id === answer.projectId);
-    }
-    if (!chosen) {
-      throw new CliError(CLI_EXIT_CODES.GENERIC_ERROR, "No project selected");
-    }
+    const chosen = await resolveProject(accessResp.projects, opts);
     const repoRoot = findRepoRoot();
     await writeProjectConfig(
       {
@@ -833,12 +811,77 @@ function registerLink(program2) {
       },
       repoRoot
     );
+    const gitignoreOutcome = await ensureGitignored(repoRoot);
     process.stdout.write(
       `${c.ok("\u2713")} Linked ${c.bold(repoRoot)} \u2192 ${c.bold(`${chosen.organisation_slug}/${chosen.slug}`)}
 `
     );
+    if (gitignoreOutcome === "added") {
+      process.stdout.write(`${c.dim("  Added")} ${c.cyan(".task/")} ${c.dim("to .gitignore")}
+`);
+    } else if (gitignoreOutcome === "created") {
+      process.stdout.write(
+        `${c.dim("  Created")} ${c.cyan(".gitignore")} ${c.dim("with")} ${c.cyan(".task/")}
+`
+      );
+    }
   });
 }
+async function resolveProject(projects, opts) {
+  if (opts.org && !opts.project || !opts.org && opts.project) {
+    throw new CliError(
+      CLI_EXIT_CODES.MISCONFIGURATION,
+      "--org and --project must be supplied together",
+      "Either pass both flags or run `task link` with no flags to pick interactively."
+    );
+  }
+  if (opts.org && opts.project) {
+    const match = projects.find((p) => p.organisation_slug === opts.org && p.slug === opts.project);
+    if (!match) {
+      throw new CliError(
+        CLI_EXIT_CODES.GENERIC_ERROR,
+        `No project ${opts.org}/${opts.project} among your authorised projects`,
+        "Run `task projects` to see what you have access to."
+      );
+    }
+    return match;
+  }
+  const answer = await inquirer.prompt([
+    {
+      type: "list",
+      name: "projectId",
+      message: "Select a project to link this repo to:",
+      choices: projects.map((p) => ({
+        name: `${p.name} (${p.organisation_slug}/${p.slug}) \u2014 ${p.cli_eligible_count} eligible tickets`,
+        value: p.id
+      }))
+    }
+  ]);
+  const picked = projects.find((p) => p.id === answer.projectId);
+  if (!picked) {
+    throw new CliError(CLI_EXIT_CODES.GENERIC_ERROR, "No project selected");
+  }
+  return picked;
+}
+async function ensureGitignored(repoRoot) {
+  const gitignorePath = join4(repoRoot, ".gitignore");
+  let existing = null;
+  try {
+    await access(gitignorePath, fsConstants.F_OK);
+    existing = await readFile4(gitignorePath, "utf8");
+  } catch {
+  }
+  const PATTERNS = [".task/", ".task", "/.task/", "/.task"];
+  if (existing !== null) {
+    const lines = existing.split("\n").map((l) => l.trim());
+    if (lines.some((l) => PATTERNS.includes(l))) return "noop";
+    const block = (existing.endsWith("\n") ? "" : "\n") + "\n# task CLI link config\n.task/\n";
+    await appendFile(gitignorePath, block);
+    return "added";
+  }
+  await writeFile4(gitignorePath, "# task CLI link config\n.task/\n");
+  return "created";
+}
 
 // src/commands/unlink.ts
 function registerUnlink(program2) {
@@ -853,14 +896,14 @@ function registerUnlink(program2) {
 // src/commands/projects.ts
 function registerProjects(program2) {
   program2.command("projects").description("List projects the CLI is authorised for").action(async () => {
-    const access = await apiCallOrThrow("GET", "/api/v1/cli/access");
-    if (access.projects.length === 0) {
+    const access2 = await apiCallOrThrow("GET", "/api/v1/cli/access");
+    if (access2.projects.length === 0) {
       process.stdout.write(`${c.dim("No projects authorised.")}
 `);
       return;
     }
     const headers = ["NAME", "ORG", "SLUG", "ELIGIBLE", "PROTECTED"];
-    const rows = access.projects.map((p) => [
+    const rows = access2.projects.map((p) => [
       p.name,
       p.organisation_slug,
       p.slug,
@@ -1065,9 +1108,9 @@ import inquirer2 from "inquirer";
 
 // src/agent/agent-service.ts
 import { spawn } from "child_process";
-import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir4, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/agent/allowed-tools.ts
 var ALLOWED_TOOLS = CLI_ALLOWED_TOOLS;
@@ -1124,10 +1167,10 @@ async function runAgent(args) {
   let outputLogPath = null;
   let logHandle = null;
   if (args.silent) {
-    const dir = join4(homedir3(), ".cache", "task", "runs");
+    const dir = join5(homedir3(), ".cache", "task", "runs");
     await mkdir4(dir, { recursive: true });
-    outputLogPath = join4(dir, `${args.runId}.log`);
-    await writeFile4(outputLogPath, "");
+    outputLogPath = join5(dir, `${args.runId}.log`);
+    await writeFile5(outputLogPath, "");
     const { createWriteStream } = await import("fs");
     logHandle = createWriteStream(outputLogPath, { flags: "a" });
   }
@@ -1316,7 +1359,11 @@ async function runWork(ticketId, opts) {
     const targetId = nextTicketId ?? (opts.auto || opts.next ? await pickNextEligible(project.project_id) : await promptForTicket(project.project_id));
     if (!targetId) {
       if (processed === 0 && !silent) {
-        process.stdout.write(c.dim("No eligible tickets found.\n"));
+        process.stdout.write(c.dim("No CLI-eligible tickets in this project.\n"));
+        process.stdout.write(
+          `${c.dim("  Toggle")} ${c.bold("Allow the agentic CLI to work on this ticket")} ${c.dim("on a ticket from the dashboard, then run")} ${c.cyan("task scan")} ${c.dim("to seed AI fix prompts the agent can act on.")}
+`
+        );
       }
       return;
     }
@@ -1499,17 +1546,534 @@ async function promptForTicket(projectId) {
   return answer.ticketId;
 }
 
-// src/commands/scheduled-task.ts
+// src/commands/scan.ts
 import { randomUUID as randomUUID2 } from "crypto";
+import ora2 from "ora";
+
+// src/scan/api.ts
+import { request as request4 } from "undici";
+async function jsonRequest(url, init) {
+  const res = await request4(url, {
+    method: init.method,
+    headers: init.headers,
+    body: init.body !== void 0 ? JSON.stringify(init.body) : void 0,
+    bodyTimeout: 6e4,
+    headersTimeout: 6e4
+  });
+  let body;
+  try {
+    body = await res.body.json();
+  } catch {
+    body = void 0;
+  }
+  const nonce = res.headers["x-prepare-nonce"];
+  const nonceStr = typeof nonce === "string" ? nonce : Array.isArray(nonce) ? nonce[0] ?? null : null;
+  if (res.statusCode >= 200 && res.statusCode < 300) {
+    const env = body;
+    return { ok: true, status: res.statusCode, data: env?.data ?? body, nonce: nonceStr };
+  }
+  const errBody = body;
+  return {
+    ok: false,
+    status: res.statusCode,
+    code: errBody?.error?.code ?? `HTTP_${res.statusCode}`,
+    message: errBody?.error?.message ?? `Request failed with status ${res.statusCode}`
+  };
+}
+var AutopilotApi = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  adminHeaders() {
+    return {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${this.opts.apiKey}`,
+      "X-Actor-Email": this.opts.actorEmail,
+      "User-Agent": "task-cli/scan"
+    };
+  }
+  skillHeaders(skillToken, extra = {}) {
+    return {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${skillToken}`,
+      "User-Agent": "task-cli/scan",
+      ...extra
+    };
+  }
+  async listEligibleProjects() {
+    const url = `${this.opts.apiUrl}/api/v1/cli/projects`;
+    const result = await jsonRequest(url, {
+      method: "GET",
+      headers: this.adminHeaders()
+    });
+    if (!result.ok) {
+      throw new CliError(
+        autopilotExitCode(result.code, result.status),
+        `${result.code}: ${result.message}`
+      );
+    }
+    return result.data ?? [];
+  }
+  async issueSkillToken(args) {
+    const url = `${this.opts.apiUrl}/api/v1/cli/issue-skill-token`;
+    const result = await jsonRequest(url, {
+      method: "POST",
+      headers: this.adminHeaders(),
+      body: {
+        project_id: args.project_id,
+        scope: "fix_prompt_sync",
+        max_submits: args.max_submits,
+        ttl_minutes: args.ttl_minutes ?? 30
+      }
+    });
+    if (!result.ok) {
+      throw new CliError(
+        autopilotExitCode(result.code, result.status),
+        `${result.code}: ${result.message}`
+      );
+    }
+    return result.data;
+  }
+  async prepare(skillToken, batchSize, idempotencyKey) {
+    const url = `${this.opts.apiUrl}/api/v1/cli/fix-prompt-sync/prepare`;
+    const result = await jsonRequest(url, {
+      method: "POST",
+      headers: this.skillHeaders(skillToken, { "Idempotency-Key": idempotencyKey }),
+      body: { batch_size: batchSize }
+    });
+    if (!result.ok) {
+      throw new CliError(
+        autopilotExitCode(result.code, result.status),
+        `${result.code}: ${result.message}`
+      );
+    }
+    if (!result.data.prepare_nonce && result.nonce) {
+      result.data.prepare_nonce = result.nonce;
+    }
+    return result.data;
+  }
+  async submit(args) {
+    const url = `${this.opts.apiUrl}/api/v1/cli/fix-prompt-sync/submit`;
+    const result = await jsonRequest(url, {
+      method: "POST",
+      headers: this.skillHeaders(args.skillToken, { "X-Prepare-Nonce": args.nonce }),
+      body: {
+        ticket_id: args.ticketId,
+        structured: args.structured,
+        input_tokens: args.inputTokens,
+        output_tokens: args.outputTokens,
+        model: args.model
+      }
+    });
+    if (result.ok) {
+      const status = result.data.ai_fix_status === "needs_review" ? "needs_review" : "ready";
+      return { status, denylistHit: result.data.denylist_hit === true };
+    }
+    if (result.code === "CLAIM_MISMATCH" || result.code === "BAD_STATUS" || result.code === "WRONG_SCOPE" || result.code === "OUTPUT_VALIDATION_FAILED") {
+      return { status: "skip", reason: result.code };
+    }
+    throw new CliError(
+      autopilotExitCode(result.code, result.status),
+      `${result.code}: ${result.message}`
+    );
+  }
+  async abort(skillToken, ticketIds) {
+    if (ticketIds.length === 0) return;
+    const url = `${this.opts.apiUrl}/api/v1/cli/fix-prompt-sync/abort`;
+    await jsonRequest(url, {
+      method: "POST",
+      headers: this.skillHeaders(skillToken),
+      body: { ticket_ids: ticketIds }
+    }).catch(() => void 0);
+  }
+  async runSummary(skillToken, summary) {
+    const url = `${this.opts.apiUrl}/api/v1/cli/fix-prompt-sync/run-summary`;
+    await jsonRequest(url, {
+      method: "POST",
+      headers: this.skillHeaders(skillToken),
+      body: summary
+    }).catch(() => void 0);
+  }
+};
+function autopilotExitCode(code, status) {
+  if (status === 401 || status === 403) return CLI_EXIT_CODES.UNAUTHORISED;
+  if (code === "TIER_LIMIT_EXCEEDED" || code === "NO_GIT_INTEGRATION") {
+    return CLI_EXIT_CODES.MISCONFIGURATION;
+  }
+  if (status >= 500) return CLI_EXIT_CODES.NETWORK_UNREACHABLE;
+  return CLI_EXIT_CODES.GENERIC_ERROR;
+}
+
+// src/scan/llm.ts
+import { spawn as spawn2 } from "child_process";
+var LlmGenerationError = class extends Error {
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+};
+async function generateFixPromptJson(args) {
+  const claude = args.claudePath ?? "claude";
+  const userPrompt = [
+    args.repoOverviewBlock,
+    "",
+    args.ticketBlock,
+    "",
+    `Return JSON only, matching this shape: ${args.outputSchemaHint}`,
+    "Do not include explanatory prose, markdown fences, or code commentary \u2014 just the JSON object."
+  ].join("\n");
+  const cliArgs = [
+    "--print",
+    "--allowedTools",
+    "",
+    "--system-prompt",
+    args.systemPrompt,
+    "--model",
+    args.modelId,
+    "--max-turns",
+    "1"
+  ];
+  return new Promise((resolve2, reject) => {
+    let child;
+    try {
+      child = spawn2(claude, cliArgs, {
+        stdio: ["pipe", "pipe", "pipe"],
+        signal: args.signal
+      });
+    } catch (err) {
+      reject(
+        new LlmGenerationError(
+          "spawn_failed",
+          `Could not invoke claude: ${err.message}`
+        )
+      );
+      return;
+    }
+    let stdoutBuf = "";
+    let stderrBuf = "";
+    child.stdout?.on("data", (c2) => stdoutBuf += c2.toString("utf8"));
+    child.stderr?.on("data", (c2) => stderrBuf += c2.toString("utf8"));
+    child.on("error", (err) => {
+      reject(new LlmGenerationError("spawn_failed", err.message));
+    });
+    child.on("close", (code, signal) => {
+      if (signal === "SIGTERM" || signal === "SIGKILL") {
+        reject(new LlmGenerationError("aborted", "claude was aborted"));
+        return;
+      }
+      if (code !== 0) {
+        reject(
+          new LlmGenerationError(
+            "non_zero_exit",
+            `claude exited with code ${code}: ${stderrBuf.trim().slice(0, 1e3)}`
+          )
+        );
+        return;
+      }
+      const parsed = parseStructuredJson(stdoutBuf);
+      if (!parsed) {
+        reject(new LlmGenerationError("no_json", "No JSON object found in claude output"));
+        return;
+      }
+      const tokens = estimateTokens(userPrompt, stdoutBuf);
+      resolve2({
+        structured: parsed,
+        rawText: stdoutBuf,
+        inputTokens: tokens.input,
+        outputTokens: tokens.output
+      });
+    });
+    child.stdin?.write(userPrompt);
+    child.stdin?.end();
+  });
+}
+function parseStructuredJson(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  try {
+    const direct = JSON.parse(trimmed);
+    if (direct && typeof direct === "object") return direct;
+  } catch {
+  }
+  const fenced = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
+  if (fenced && fenced[1]) {
+    try {
+      const obj = JSON.parse(fenced[1].trim());
+      if (obj && typeof obj === "object") return obj;
+    } catch {
+    }
+  }
+  const start = trimmed.indexOf("{");
+  if (start === -1) return null;
+  let depth = 0;
+  let inString = false;
+  let escape = false;
+  for (let i = start; i < trimmed.length; i++) {
+    const ch = trimmed[i];
+    if (inString) {
+      if (escape) {
+        escape = false;
+      } else if (ch === "\\") {
+        escape = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      continue;
+    }
+    if (ch === "{") depth += 1;
+    else if (ch === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        const slice = trimmed.slice(start, i + 1);
+        try {
+          const obj = JSON.parse(slice);
+          if (obj && typeof obj === "object") return obj;
+        } catch {
+          return null;
+        }
+      }
+    }
+  }
+  return null;
+}
+function estimateTokens(input, output) {
+  return {
+    input: Math.max(1, Math.round(input.length / 4)),
+    output: Math.max(1, Math.round(output.length / 4))
+  };
+}
+
+// src/commands/scan.ts
+function registerScan(program2) {
+  program2.command("scan").description(
+    "Drive the AI fix-prompt autopilot loop locally \u2014 same flow as the /task-autopilot skill, run by the CLI binary"
+  ).option("--project <slugOrId>", "Restrict to one project (default: every visible project)").option("--max <n>", "Max submissions per project token", "50").option("--batch <n>", "Tickets per /prepare batch (1-10)", "5").option("--api-url <url>", "Override TASK_API_URL").option("--silent", "Suppress per-ticket progress chrome").action(async (opts) => {
+    await runScan(opts);
+  });
+}
+async function runScan(opts) {
+  const apiKey = process.env["TASK_API_KEY"];
+  if (!apiKey || apiKey.length < 32) {
+    throw new CliError(
+      CLI_EXIT_CODES.MISCONFIGURATION,
+      "TASK_API_KEY is missing or shorter than 32 chars",
+      "Set TASK_API_KEY in your environment. The autopilot loop authenticates with the shared admin secret, not the per-user CLI bearer."
+    );
+  }
+  const actorEmail = process.env["TASK_API_KEY_OWNER_EMAIL"];
+  if (!actorEmail || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(actorEmail)) {
+    throw new CliError(
+      CLI_EXIT_CODES.MISCONFIGURATION,
+      "TASK_API_KEY_OWNER_EMAIL is not set or not a valid email",
+      "Set TASK_API_KEY_OWNER_EMAIL=<you@example.com>. The server records this on every audit row."
+    );
+  }
+  const localCfg = await readLocalConfig();
+  const apiUrl = (opts.apiUrl ?? process.env["TASK_API_URL"] ?? localCfg.api_url ?? "http://localhost:3400").replace(/\/$/, "");
+  const max = clampInt(opts.max, 1, 500, 50);
+  const batchSize = clampInt(opts.batch, 1, 10, 5);
+  const silent = !!opts.silent || localCfg.silent;
+  const api = new AutopilotApi({ apiUrl, apiKey, actorEmail });
+  if (!silent) process.stdout.write(`${c.dim("Discovering eligible projects\u2026")}
+`);
+  const all = await api.listEligibleProjects();
+  if (all.length === 0) {
+    process.stdout.write(c.dim("No CLI-eligible tickets across any visible project.\n"));
+    return;
+  }
+  const projects = opts.project ? all.filter(
+    (p) => p.project_id === opts.project || p.project_slug === opts.project || `${p.organisation_slug}/${p.project_slug}` === opts.project
+  ) : all;
+  if (projects.length === 0) {
+    throw new CliError(
+      CLI_EXIT_CODES.GENERIC_ERROR,
+      `Project "${opts.project}" not found among eligible projects`
+    );
+  }
+  const aggregates = [];
+  const claudePath = localCfg.claude_path ?? void 0;
+  let interrupted = false;
+  const onSigint = () => {
+    interrupted = true;
+  };
+  process.on("SIGINT", onSigint);
+  try {
+    for (const proj of projects) {
+      if (interrupted) break;
+      const agg = await scanProject({
+        api,
+        project: proj,
+        maxSubmits: max,
+        batchSize,
+        silent,
+        claudePath,
+        isInterrupted: () => interrupted
+      });
+      aggregates.push(agg);
+    }
+  } finally {
+    process.off("SIGINT", onSigint);
+  }
+  const totals = aggregates.reduce(
+    (acc, a) => ({
+      prepared: acc.prepared + a.prepared,
+      submitted: acc.submitted + a.submitted,
+      denylist_hits: acc.denylist_hits + a.denylist_hits,
+      failed: acc.failed + a.failed,
+      skipped: acc.skipped + a.skipped
+    }),
+    { prepared: 0, submitted: 0, denylist_hits: 0, failed: 0, skipped: 0 }
+  );
+  process.stdout.write(
+    `${c.bold("\nSubmitted")} ${c.ok(String(totals.submitted))} ${c.bold("prompts")} (${c.warn(String(totals.denylist_hits))} flagged for review, ${c.err(String(totals.failed))} failed, ${c.dim(String(totals.skipped) + " skipped")}). Run summary recorded.
+`
+  );
+  if (interrupted) {
+    process.stdout.write(
+      `${c.warn("Run was interrupted")}; any claimed-but-unfinalised tickets were released.
+`
+    );
+  }
+}
+async function scanProject(args) {
+  const { api, project, maxSubmits, batchSize, silent, claudePath } = args;
+  const agg = {
+    project_id: project.project_id,
+    project_slug: project.project_slug,
+    organisation_slug: project.organisation_slug,
+    prepared: 0,
+    submitted: 0,
+    denylist_hits: 0,
+    failed: 0,
+    skipped: 0
+  };
+  const startedAt = Date.now();
+  const inFlight = /* @__PURE__ */ new Set();
+  if (!silent) {
+    process.stdout.write(
+      `
+${c.bold(`${project.organisation_slug}/${project.project_slug}`)} ${c.dim(`(${project.eligible_count} eligible)`)}
+`
+    );
+  }
+  const issued = await api.issueSkillToken({
+    project_id: project.project_id,
+    max_submits: maxSubmits
+  });
+  const skillToken = issued.token;
+  let fatal = null;
+  try {
+    while (!args.isInterrupted()) {
+      let prepared;
+      try {
+        prepared = await api.prepare(skillToken, batchSize, randomUUID2());
+      } catch (err) {
+        fatal = err;
+        break;
+      }
+      if (prepared.tickets.length === 0) break;
+      agg.prepared += prepared.tickets.length;
+      const nonce = prepared.prepare_nonce;
+      for (const ticket of prepared.tickets) {
+        if (args.isInterrupted()) break;
+        inFlight.add(ticket.ticket_id);
+        const spinner = silent ? null : ora2(`#${ticket.sequence_number} ${ticket.title.slice(0, 60)}`).start();
+        try {
+          const generated = await safeGenerate(ticket, claudePath);
+          if (!generated) {
+            agg.skipped += 1;
+            spinner?.warn(
+              `#${ticket.sequence_number} skipped (no JSON from claude) \u2014 calling abort`
+            );
+            continue;
+          }
+          const result = await api.submit({
+            skillToken,
+            nonce,
+            ticketId: ticket.ticket_id,
+            structured: generated.structured,
+            inputTokens: generated.inputTokens,
+            outputTokens: generated.outputTokens,
+            model: ticket.model_id
+          });
+          if (result.status === "skip") {
+            agg.skipped += 1;
+            spinner?.warn(`#${ticket.sequence_number} skipped (${result.reason})`);
+          } else if (result.status === "needs_review") {
+            agg.submitted += 1;
+            agg.denylist_hits += 1;
+            spinner?.warn(`#${ticket.sequence_number} flagged for review`);
+          } else {
+            agg.submitted += 1;
+            spinner?.succeed(`#${ticket.sequence_number} ready`);
+          }
+          inFlight.delete(ticket.ticket_id);
+        } catch (err) {
+          agg.failed += 1;
+          spinner?.fail(`#${ticket.sequence_number} ${err.message.slice(0, 200)}`);
+          if (err instanceof CliError && err.code === CLI_EXIT_CODES.UNAUTHORISED) {
+            fatal = err;
+            break;
+          }
+        }
+      }
+      if (fatal) break;
+    }
+  } finally {
+    const stillClaimed = Array.from(inFlight);
+    if (stillClaimed.length > 0) {
+      await api.abort(skillToken, stillClaimed).catch(() => void 0);
+    }
+    await api.runSummary(skillToken, {
+      prepared: agg.prepared,
+      submitted: agg.submitted,
+      denylist_hits: agg.denylist_hits,
+      failed: agg.failed,
+      duration_ms: Date.now() - startedAt
+    }).catch(() => void 0);
+  }
+  if (fatal) throw fatal;
+  return agg;
+}
+async function safeGenerate(ticket, claudePath) {
+  try {
+    const out = await generateFixPromptJson({
+      systemPrompt: ticket.system_prompt,
+      repoOverviewBlock: ticket.repo_overview_block,
+      ticketBlock: ticket.ticket_block,
+      outputSchemaHint: ticket.output_schema_hint,
+      modelId: ticket.model_id,
+      ...claudePath ? { claudePath } : {}
+    });
+    return out;
+  } catch (err) {
+    if (err instanceof LlmGenerationError) {
+      return null;
+    }
+    throw err;
+  }
+}
+function clampInt(raw, min, max, fallback) {
+  const v = parseInt(raw, 10);
+  if (!Number.isFinite(v) || v < min) return fallback;
+  return Math.min(v, max);
+}
+
+// src/commands/scheduled-task.ts
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/scheduler/index.ts
 import { platform as platform2 } from "os";
 
 // src/scheduler/launchd.ts
-import { mkdir as mkdir5, readFile as readFile4, writeFile as writeFile5, unlink as unlink3, readdir } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile6, unlink as unlink3, readdir } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
-import { execFileSync as execFileSync5, spawn as spawn2 } from "child_process";
+import { join as join6 } from "path";
+import { execFileSync as execFileSync5, spawn as spawn3 } from "child_process";
 
 // src/scheduler/cron-translate.ts
 function translateToLaunchd(cron) {
@@ -1610,14 +2174,14 @@ function expandField(field, min, max) {
 }
 
 // src/scheduler/launchd.ts
-var PLIST_DIR = join5(homedir4(), "Library", "LaunchAgents");
+var PLIST_DIR = join6(homedir4(), "Library", "LaunchAgents");
 var LABEL_PREFIX = "com.inteeka.task.cli.";
 var SAFE_ID_RE = /^[0-9a-zA-Z._-]+$/;
 function plistPath(id) {
   if (!SAFE_ID_RE.test(id) || id.includes("..")) {
     throw new Error(`Refusing to compute plist path for unsafe id: ${id}`);
   }
-  return join5(PLIST_DIR, `${LABEL_PREFIX}${id}.plist`);
+  return join6(PLIST_DIR, `${LABEL_PREFIX}${id}.plist`);
 }
 function buildPlist(entry) {
   const calendars = translateToLaunchd(entry.cron);
@@ -1653,9 +2217,9 @@ ${fields}
     `    <string>/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin</string>`,
     `  </dict>`,
     `  <key>StandardOutPath</key>`,
-    `  <string>${escapeXml(join5(homedir4(), ".cache", "task", "launchd-stdout.log"))}</string>`,
+    `  <string>${escapeXml(join6(homedir4(), ".cache", "task", "launchd-stdout.log"))}</string>`,
     `  <key>StandardErrorPath</key>`,
-    `  <string>${escapeXml(join5(homedir4(), ".cache", "task", "launchd-stderr.log"))}</string>`,
+    `  <string>${escapeXml(join6(homedir4(), ".cache", "task", "launchd-stderr.log"))}</string>`,
     !entry.enabled ? `  <key>Disabled</key>
   <true/>` : "",
     "</dict>",
@@ -1675,7 +2239,7 @@ var launchdAdapter = {
   async upsert(entry) {
     await mkdir5(PLIST_DIR, { recursive: true });
     const path = plistPath(entry.id);
-    await writeFile5(path, buildPlist(entry));
+    await writeFile6(path, buildPlist(entry));
     try {
       execFileSync5("launchctl", ["bootout", bootstrapDomain(), path], { stdio: "ignore" });
     } catch {
@@ -1704,7 +2268,7 @@ var launchdAdapter = {
       for (const file of ours) {
         const id = file.slice(LABEL_PREFIX.length, -".plist".length);
         try {
-          const xml = await readFile4(join5(PLIST_DIR, file), "utf8");
+          const xml = await readFile5(join6(PLIST_DIR, file), "utf8");
           const cron = xml.match(/<key>StartCalendarInterval<\/key>[\s\S]*?<\/array>/)?.[0] ?? "";
           const command = xml.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/)?.[1] ?? "";
           const disabled = /<key>Disabled<\/key>\s*<true\/>/.test(xml);
@@ -1727,7 +2291,7 @@ var launchdAdapter = {
     return new Promise((resolve2) => {
       const args = entry.command.match(/(?:[^\s"]+|"[^"]*")+/g) ?? [entry.command];
       const cmd = args.shift() ?? entry.command;
-      const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+      const child = spawn3(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
       let stdoutTail = "";
       let stderrTail = "";
       child.stdout?.on("data", (chunk) => {
@@ -1744,13 +2308,13 @@ var launchdAdapter = {
     const path = plistPath(id);
     let xml;
     try {
-      xml = await readFile4(path, "utf8");
+      xml = await readFile5(path, "utf8");
     } catch {
       return;
     }
     if (enabled) {
       xml = xml.replace(/\s*<key>Disabled<\/key>\s*<true\/>/, "");
-      await writeFile5(path, xml);
+      await writeFile6(path, xml);
       try {
         execFileSync5("launchctl", ["bootout", bootstrapDomain(), path], { stdio: "ignore" });
       } catch {
@@ -1762,7 +2326,7 @@ var launchdAdapter = {
           "</dict>\n</plist>",
           "  <key>Disabled</key>\n  <true/>\n</dict>\n</plist>"
         );
-        await writeFile5(path, xml);
+        await writeFile6(path, xml);
       }
       try {
         execFileSync5("launchctl", ["bootout", bootstrapDomain(), path], { stdio: "ignore" });
@@ -1773,7 +2337,7 @@ var launchdAdapter = {
 };
 
 // src/scheduler/cron.ts
-import { execFileSync as execFileSync6, spawn as spawn3 } from "child_process";
+import { execFileSync as execFileSync6, spawn as spawn4 } from "child_process";
 
 // src/scheduler/safe-command.ts
 var FORBIDDEN = /[;&|`$()<>\\]/;
@@ -1834,7 +2398,7 @@ function readCrontab() {
   }
 }
 function writeCrontab(text) {
-  const child = spawn3("crontab", ["-"], { stdio: ["pipe", "inherit", "inherit"] });
+  const child = spawn4("crontab", ["-"], { stdio: ["pipe", "inherit", "inherit"] });
   child.stdin.write(text);
   child.stdin.end();
 }
@@ -1915,7 +2479,7 @@ var cronAdapter = {
       return Promise.resolve({ exitCode: 1, stdoutTail: "", stderrTail: `rejected: ${reason}` });
     }
     return new Promise((resolve2) => {
-      const child = spawn3(parsed.bin, parsed.args, { stdio: ["ignore", "pipe", "pipe"] });
+      const child = spawn4(parsed.bin, parsed.args, { stdio: ["ignore", "pipe", "pipe"] });
       let stdoutTail = "";
       let stderrTail = "";
       child.stdout?.on(
@@ -1943,7 +2507,7 @@ var cronAdapter = {
 };
 
 // src/scheduler/windows.ts
-import { execFileSync as execFileSync7, spawn as spawn4 } from "child_process";
+import { execFileSync as execFileSync7, spawn as spawn5 } from "child_process";
 var TASK_PREFIX = "TaskCLI_";
 function taskName(id) {
   return `${TASK_PREFIX}${id.replace(/[^A-Za-z0-9_-]/g, "_")}`;
@@ -2056,7 +2620,7 @@ var windowsAdapter = {
       return Promise.resolve({ exitCode: 1, stdoutTail: "", stderrTail: `rejected: ${reason}` });
     }
     return new Promise((resolve2) => {
-      const child = spawn4(parsed.bin, parsed.args, { stdio: ["ignore", "pipe", "pipe"] });
+      const child = spawn5(parsed.bin, parsed.args, { stdio: ["ignore", "pipe", "pipe"] });
       let stdoutTail = "";
       let stderrTail = "";
       child.stdout?.on(
@@ -2115,10 +2679,10 @@ var unsupportedAdapter = {
 };
 
 // src/scheduler/registry.ts
-import { mkdir as mkdir6, readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile7 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname4, join as join6 } from "path";
-var REGISTRY_PATH = join6(homedir5(), ".config", "task", "schedules.json");
+import { dirname as dirname4, join as join7 } from "path";
+var REGISTRY_PATH = join7(homedir5(), ".config", "task", "schedules.json");
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function looksLikeRegistryRow(value) {
   if (!value || typeof value !== "object") return false;
@@ -2127,7 +2691,7 @@ function looksLikeRegistryRow(value) {
 }
 async function readRegistry() {
   try {
-    const raw = await readFile5(REGISTRY_PATH, "utf8");
+    const raw = await readFile6(REGISTRY_PATH, "utf8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return [];
     return parsed.filter(looksLikeRegistryRow);
@@ -2139,7 +2703,7 @@ async function readRegistry() {
 }
 async function writeRegistry(rows) {
   await mkdir6(dirname4(REGISTRY_PATH), { recursive: true });
-  await writeFile6(REGISTRY_PATH, JSON.stringify(rows, null, 2));
+  await writeFile7(REGISTRY_PATH, JSON.stringify(rows, null, 2));
 }
 async function upsertRegistry(row) {
   if (!UUID_RE.test(row.id)) {
@@ -2227,7 +2791,7 @@ function registerScheduledTask(program2) {
       const max = Math.min(100, Math.max(1, parseInt(opts.max, 10) || 5));
       const command = opts.command ?? `task work --auto --silent --max ${max}`;
       const { hostId, hostLabel } = getHostInfo();
-      const id = randomUUID2();
+      const id = randomUUID3();
       const created = await apiCall("POST", "/api/v1/cli/schedules", {
         body: {
           name,
@@ -2378,9 +2942,9 @@ function stripAnsi(s) {
 }
 
 // src/commands/runs.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function registerRuns(program2) {
   const cmd = program2.command("runs").description("Inspect agentic CLI run history");
   cmd.command("list").description("List recent runs").option("--limit <n>", "Max rows", "50").option("--ticket <id>", "Filter by ticket").option("--schedule <id>", "Filter by schedule").action(async (opts) => {
@@ -2409,9 +2973,9 @@ function registerRuns(program2) {
     process.stdout.write(JSON.stringify(row, null, 2) + "\n");
   });
   cmd.command("logs <id>").description("Show captured agent output for a run, if available").action(async (id) => {
-    const localPath = join7(homedir6(), ".cache", "task", "runs", `${id}.log`);
+    const localPath = join8(homedir6(), ".cache", "task", "runs", `${id}.log`);
     try {
-      const text = await readFile6(localPath, "utf8");
+      const text = await readFile7(localPath, "utf8");
       process.stdout.write(text);
       return;
     } catch {
@@ -2482,7 +3046,7 @@ function registerConfig(program2) {
 
 // src/commands/doctor.ts
 import { execFileSync as execFileSync8 } from "child_process";
-import { request as request4 } from "undici";
+import { request as request5 } from "undici";
 function registerDoctor(program2) {
   program2.command("doctor").description("Diagnose your CLI setup").action(async () => {
     const checks = [];
@@ -2510,7 +3074,7 @@ function registerDoctor(program2) {
     });
     const apiUrl = creds?.api_url ?? cfg.api_url;
     try {
-      const res = await request4(apiUrl, {
+      const res = await request5(apiUrl, {
         method: "GET",
         headersTimeout: 5e3,
         bodyTimeout: 5e3
@@ -2584,6 +3148,7 @@ registerStatus(program);
 registerTickets(program);
 registerTicket(program);
 registerWork(program);
+registerScan(program);
 registerScheduledTask(program);
 registerRuns(program);
 registerConfig(program);