@repo-os/repoos 0.5.54 → 0.5.56

package/README.md

@@ -298,21 +298,22 @@ no API tokens leave your machine unless you configure them.
 
 ## RepoOS Hub for macOS
 
-A native Mac app (macOS 13+; sessions persist across relaunches on macOS 14+)
-that keeps tabs on all your RepoOS servers from
-one window: pin tasks across servers, see live attention counts in the sidebar
-and Dock badge, and jump between servers and tasks with Cmd-K. Each server
-loads in its own isolated WebKit session — sessions are never shared between
-servers, and server pages get no bridge into your files or Keychain. Local
-loopback servers need zero setup; remote servers use short-lived, revocable
-capability tokens (created over HTTPS on the server, stored in the Keychain)
-for their attention and search endpoints.
+A native Mac companion app (macOS 13+; sessions persist across relaunches on
+macOS 14+) that connects to the RepoOS servers you run locally or remotely.
+From one window, pin tasks across servers, see live attention counts in the
+sidebar and Dock badge, and jump between servers and tasks with Cmd-K. Each
+server loads in its own isolated WebKit session — sessions are never shared
+between servers, and server pages get no bridge into your files or Keychain.
+Local loopback servers need zero setup; remote servers use short-lived,
+revocable capability tokens (created over HTTPS on the server, stored in the
+Keychain) for their attention and search endpoints.
 
 Download the latest [RepoOS Hub DMG](https://github.com/repo-os/repoos/releases/latest/download/RepoOSHub.dmg),
 or browse [GitHub Releases](https://github.com/repo-os/repoos/releases). Setup,
 pairing, and limitation details are in the [Hub guide](https://docs.repoos.org/macos-hub).
-Current builds are ad-hoc signed, so macOS requires Control-click **Open** once;
-the guide has the exact steps. Developer ID signing and notarization are planned.
+Current builds are ad-hoc signed and not notarized. After a first blocked launch,
+use **System Settings → Privacy & Security → Open Anyway**; the guide has the
+exact steps. Developer ID signing and notarization are planned.
 
 ## Roadmap
 

package/dist/.build-info.json

@@ -1,4 +1,4 @@
 {
-  "hash": "c59ba0faf030004be937d5bd9fb28afc6fdd9156857ae68454cba1c959f0f979",
-  "version": "0.5.54"
+  "hash": "f30fcce6f5c1d53000699830d693eabb1921532ae40f9462a44af88519527c92",
+  "version": "0.5.56"
 }

package/dist/.build-stamp.json

@@ -1,3 +1,3 @@
 {
-  "generatedAt": "2026-09-23T11:41:25.327Z"
+  "generatedAt": "2026-09-26T09:59:53.699Z"
 }

package/dist/commands/check.js

@@ -499,6 +499,22 @@ function resolveVar(value, map, depth = 0) {
     const next = map[`--${m[1]}`];
     return next !== undefined ? resolveVar(next, map, depth + 1) : value;
 }
+// KNOWN LIMITATION (fix tracked in #0504, found while registering the gruvbox
+// theme in #0503): the rgb()/rgba() branches below tolerate no whitespace between
+// components, but oxfmt writes `rgba(110, 157, 106, 0.22)` with spaces, so every
+// spaced literal fails to parse and returns null. A pair whose fg or bg yields no
+// candidates is SKIPPED rather than failed, so a `[check] contrastPairs` bg token
+// written as a spaced `rgba()` is silently never checked — as are the spaced
+// `rgba()` stops inside a gradient, which drop out of `colorCandidates`. Measured
+// on this repo's own stylesheet: 425 spaced literals, leaving 4-6 of the 9
+// configured pairs unchecked in every theme. A whitespace-tolerant regex (`\s*`
+// after each separator) was measured to produce ZERO new offenders across all five
+// themes, so the fix is a one-liner that only strengthens the gate. It is its own
+// task rather than folded into a theme change because it alters the guard's
+// behaviour repo-wide and for every project that configures
+// `[check] contrastPairs`. Until it lands, do not rely on this guard to catch a
+// contrast problem in a token written as `rgba(r, g, b, a)`; gruvbox deliberately
+// uses 8-digit hex for its checked alpha tokens to stay verifiable.
 function parseColor(v) {
     const s = v.trim().toLowerCase();
     if (!s || s === "none")
@@ -521,7 +537,7 @@ function parseColor(v) {
         }
         return null;
     }
-    const m = s.match(/^rgba?\(([\d.]+),([\d.]+),([\d.]+)(?:,([\d.]+))?\)$/);
+    const m = s.match(/^rgba?\(\s*([\d.]+)\s*,\s*([\d.]+)\s*,\s*([\d.]+)(?:\s*,\s*([\d.]+))?\s*\)$/);
     if (m) {
         return {
             r: parseInt(m[1], 10),
@@ -556,7 +572,7 @@ function colorCandidates(raw, map, bg) {
     const resolved = resolveVar(raw, map);
     const out = [];
     if (resolved.includes("gradient(")) {
-        const re = /#[0-9a-fA-F]{3,8}|rgba?\([^)]*\)|transparent/g;
+        const re = /#[0-9a-fA-F]{3,8}|rgba?\(\s*[\d.]+\s*,\s*[\d.]+\s*,\s*[\d.]+(?:\s*,\s*[\d.]+)?\s*\)|transparent/g;
         let m;
         while ((m = re.exec(resolved))) {
             const c = parseColor(m[0]);

package/dist/commands/init.js

@@ -101,8 +101,9 @@ ${description
    architecture note. Keep them specific to this project.
 4. Break the result into a handful of concrete tasks with
    \`repoos new "<title>"\`, and move the ones that are ready into \`ready\`.
-5. Record the docs you wrote here, then move this task to \`review\` (or
-   \`done\` if there is genuinely nothing left to capture).
+5. Record the docs you wrote here, then hand this task off with
+   \`repoos mv <id> review\` and stop — RepoOS runs the checks and moves the
+   status (or \`done\` if there is genuinely nothing left to capture).
 
 ## Notes for AI
 
@@ -140,8 +141,9 @@ then turn what's missing into work.
    conventions anyone working here must follow.
 3. Draft a small starter backlog of real tasks with \`repoos new "<title>"\`,
    each concrete enough to work on its own.
-4. Record what you wrote here, then move this task to \`review\` (or \`done\` if
-   there is nothing left to capture).
+4. Record what you wrote here, then hand this task off with
+   \`repoos mv <id> review\` and stop — RepoOS runs the checks and moves the
+   status (or \`done\` if there is nothing left to capture).
 
 ## Notes for AI
 
@@ -160,14 +162,24 @@ repo itself is the source of truth. This file tells AI agents how to operate.
 2. Pick a task from \`${workDir}/\` whose \`status: ready\`.
 3. Set its \`status: active\` (edit the frontmatter; do not move the file).
 4. Create a worktree on the branch named in the task's \`branch:\` field, or set one.
-5. Implement → test → if the repo has a git remote, open an MR/PR against main.
-6. Set \`status: review\` when ready for human sign-off. **Leave the worktree open; do NOT merge its branch.**
+5. Run \`repoos check\` and confirm it passes, then implement → test → if the repo
+   has a git remote, open an MR/PR against main.
+6. When ready for human sign-off, run \`repoos mv <id> review\` and stop. **That
+   records a handoff request; it does not set the status.** RepoOS re-runs the
+   check, commits the branch and moves the task to \`review\`. The task stays
+   \`active\` until then, and stays \`active\` with the failure shown if the check
+   fails. **Leave the worktree open; do NOT merge its branch.**
 
 ## Review and sign-off
 
 A \`review\` task stays in its open worktree until a human (or another AI) signs
 off; the implementer never merges to \`main\` at \`review\` time.
 
+Every route into \`review\` — the Review button, a board drag, a
+\`PATCH status: review\`, \`repoos mv\`, or an agent's handoff signal — runs the
+same finalization: scoped \`repoos check\`, then the commit guard, then
+\`review\`. Nothing reaches \`review\` on the commit guard alone.
+
 - No git remote: on approval, the reviewer says **"move task <id> to done"**. The
   implementer then sets \`status: done\` (commit \`docs(<id>): set status done\`),
   fast-forward merges the branch to \`main\`, removes the worktree, and deletes
@@ -177,7 +189,7 @@ off; the implementer never merges to \`main\` at \`review\` time.
   <id> to done"), then remote + local branches are deleted and \`status\` is set
   to \`done\`.
 - Requested changes are fixed on the same worktree, tests re-run, and the task
-  re-set to \`review\`.
+  handed off again.
 - If the \`reviewer\` agent is enabled on the Agents page, RepoOS reviews the
   task automatically when it lands in \`review\` and shows a short report (bugs,
   edge cases, suggestions) in the task drawer. It is advisory: the human still

package/dist/commands/tasks.d.ts

@@ -2,41 +2,61 @@
 export declare function cmdList(statusArg?: string): void;
 /** `repoos show <id>` — full task detail. */
 export declare function cmdShow(id?: string): void;
+/**
+ * True when this process is a managed agent working on `id` — the runner
+ * injects `REPOOS_AGENT=1` into every managed agent process, and
+ * `REPOOS_TASK_ID` / `REPOOS_RUN_ID` into a task turn (agents.ts). Both must
+ * match: without the run id the recorded request could not be tied to a live
+ * turn, and without the task id this would hijack `repoos mv` calls an agent
+ * makes about some OTHER task. A human in their own shell has neither, so they
+ * keep the plain status edit (which the server still runs through the same
+ * finalization via the file-watch route).
+ */
+export declare function isRunnerSessionForTask(id: string): boolean;
 /**
  * `repoos mv <id> <status>` — change status (frontmatter edit).
  *
- * Deliberately does NOT run this transition through `guardReviewTransition`
- * (#0263), even for a move into `review`. That gate lives in the HTTP PATCH
- * path because it operates on the task's OWN branch worktree — staging and
- * committing pending implementation changes there and rejecting a vacuous
- * (zero-source-change) transition — which is an agent-handoff guarantee, not
- * a board-write guarantee. `repoos mv` is the low-level, generic "edit this
- * frontmatter field" tool (a human or script can move ANY task to ANY status,
- * with or without a branch or worktree at all); forcing every review move
- * through worktree resolution would turn a one-line status edit into a hard
- * dependency on handoff plumbing that plenty of legitimate `mv` calls don't
- * have. The bug this task fixes is narrower and applies to every status
- * change here regardless of target: `updateStatus` (via `rewrite()` in
- * core/repoos.ts) now always commits the task file in the main checkout, so
- * the write itself is never left as an untrusted dirty file. Agents that want
- * the full handoff guarantee (implementation committed + non-vacuous) should
- * go through the trusted handoff/PATCH path, not this CLI shortcut.
+ * Two transitions are special-cased, because both are ones this command
+ * cannot perform on its own.
+ *
+ * **`review` from inside the runner session for that same task (#0507)** does
+ * NOT flip `status:`. It records a handoff request in the board's cache dir
+ * (`.repoos/handoff-requests/<id>.json`) and exits 0; the runner picks that up
+ * exactly like the `::repoos-handoff-ready::` signal and finalizes when the
+ * turn ends — scoped `repoos check`, then the commit/vacuity gate, then
+ * `review`. This is the single most-used route in practice: engineers reach for
+ * it because the CTO nudge says "hand off to review" and the operating loop
+ * says "set `status: review`". A bare frontmatter write is not a handoff — it
+ * skips the check, and because the task leaves `active` the server stops the
+ * very agent that asked, which `cleanup()` then books as a dev error (#0505,
+ * #0499: "needs input" next to "waiting for human" on a task that passed
+ * review). Detection is the runner's own marker — `REPOOS_AGENT=1` plus a
+ * `REPOOS_TASK_ID` equal to the id being moved — so a human running the same
+ * command in their own shell still gets a plain status edit, picked up by the
+ * server and run through the same finalization via the file-watch route.
+ *
+ * `done` gets a narrow guard for the mirror-image reason (confirmed live,
+ * 2026-09-17 — see #0399 and the #0185/#0389 incidents in this session):
+ * unlike every other status, `done` claims the task's code is actually on
+ * `main`. The server's own HTTP PATCH route already refuses a bare
+ * `status: "done"` for exactly this reason (routes/tasks.ts) and forces callers
+ * through `POST /api/tasks/:id/done`, the real close-out pipeline — but this CLI
+ * command never went through that route to begin with, so it silently flips the
+ * flag with zero merge awareness. If the task has a `branch` that still exists
+ * locally and is NOT an ancestor of main, that branch's code has not landed;
+ * refuse rather than mark it done from under the user. This intentionally fails
+ * OPEN (allows the move) whenever it can't tell for sure — no branch recorded,
+ * the branch was already deleted (the normal post-merge cleanup), or git can't
+ * answer the ancestry question — so it never blocks the many legitimate `mv`
+ * calls that have nothing to do with code at all.
  *
- * `done` gets one narrow exception to the "generic, no side checks" rule
- * above (confirmed live, 2026-09-17 — see #0399 and the #0185/#0389 incidents
- * in this session): unlike every other status, `done` claims the task's code
- * is actually on `main`. The server's own HTTP PATCH route already refuses a
- * bare `status: "done"` for exactly this reason (routes/tasks.ts) and forces
- * callers through `POST /api/tasks/:id/done`, the real close-out pipeline —
- * but this CLI command never went through that route to begin with, so it
- * silently flips the flag with zero merge awareness. If the task has a
- * `branch` that still exists locally and is NOT an ancestor of main, that
- * branch's code has not landed; refuse rather than mark it done from under
- * the user. This intentionally fails OPEN (allows the move) whenever it
- * can't tell for sure — no branch recorded, the branch was already deleted
- * (the normal post-merge cleanup), or git can't answer the ancestry question
- * — so it never blocks the many legitimate `mv` calls that have nothing to
- * do with code at all.
+ * Every other status is a plain frontmatter edit. `updateStatus` (via
+ * `rewrite()` in core/repoos.ts) always commits the task file in the main
+ * checkout, so the write itself is never left as an untrusted dirty file. Note
+ * that a move into `review` from OUTSIDE a runner session still goes through
+ * the full server-side finalization — the server intercepts the file write and
+ * runs the same check the handoff signal does, keeping the task `active` until
+ * it passes.
  */
 export declare function cmdMv(id?: string, status?: string, note?: string, opts?: {
     force?: boolean;

package/dist/commands/tasks.js

@@ -13,6 +13,7 @@ import { boardRoot, loadConfig, resolveColumnLabels } from "../core/config.js";
 import { STATUSES } from "../core/types.js";
 import { c, statusColor, priorityColor } from "../cli/colors.js";
 import { patchTaskFile } from "../server/write.js";
+import { writeHandoffRequest } from "../server/handoff-request.js";
 import { isAncestor } from "../core/git.js";
 /**
  * RepoOS facade rooted at the LIVE BOARD's checkout (the main checkout), even
@@ -136,41 +137,98 @@ function detectMainBranch(root) {
     }
     return null;
 }
+/**
+ * True when this process is a managed agent working on `id` — the runner
+ * injects `REPOOS_AGENT=1` into every managed agent process, and
+ * `REPOOS_TASK_ID` / `REPOOS_RUN_ID` into a task turn (agents.ts). Both must
+ * match: without the run id the recorded request could not be tied to a live
+ * turn, and without the task id this would hijack `repoos mv` calls an agent
+ * makes about some OTHER task. A human in their own shell has neither, so they
+ * keep the plain status edit (which the server still runs through the same
+ * finalization via the file-watch route).
+ */
+export function isRunnerSessionForTask(id) {
+    return (process.env.REPOOS_AGENT === "1" &&
+        Boolean(process.env.REPOOS_RUN_ID) &&
+        process.env.REPOOS_TASK_ID === id);
+}
+/**
+ * #0507: record a handoff request instead of flipping `status: review`, when
+ * the task's own agent is the one asking. Returns true when the request was
+ * recorded and `cmdMv` must stop there. On failure it returns false so the
+ * caller falls through to the ordinary status edit — worse, but never a dead
+ * end for the agent mid-turn.
+ */
+function handoffRequestFromRunner(id) {
+    if (!isRunnerSessionForTask(id))
+        return false;
+    const { root } = boardRoot();
+    const request = {
+        taskId: id,
+        runId: process.env.REPOOS_RUN_ID,
+        at: new Date().toISOString(),
+        source: "repoos-mv",
+    };
+    if (!writeHandoffRequest(root, loadConfig(root).cacheDir, request)) {
+        console.error(c.red(`  Could not record a handoff request for #${id} — `) +
+            c.dim("RepoOS could not write its handoff-request file."));
+        console.error(c.dim("  Falling back to a plain status edit, which SKIPS the checks and stops this " +
+            "agent mid-turn. Prefer ending your turn and letting the reviewer pick it up."));
+        return false;
+    }
+    console.log("  " +
+        c.green("handoff requested ") +
+        c.dim("#" + id) +
+        c.dim(" —") +
+        "\n" +
+        c.dim("  RepoOS will run `repoos check`, pass the commit gate, and move this to review."));
+    console.log(c.dim("  `status:` was left alone — end your turn now; finalization runs on exit."));
+    return true;
+}
 /**
  * `repoos mv <id> <status>` — change status (frontmatter edit).
  *
- * Deliberately does NOT run this transition through `guardReviewTransition`
- * (#0263), even for a move into `review`. That gate lives in the HTTP PATCH
- * path because it operates on the task's OWN branch worktree — staging and
- * committing pending implementation changes there and rejecting a vacuous
- * (zero-source-change) transition — which is an agent-handoff guarantee, not
- * a board-write guarantee. `repoos mv` is the low-level, generic "edit this
- * frontmatter field" tool (a human or script can move ANY task to ANY status,
- * with or without a branch or worktree at all); forcing every review move
- * through worktree resolution would turn a one-line status edit into a hard
- * dependency on handoff plumbing that plenty of legitimate `mv` calls don't
- * have. The bug this task fixes is narrower and applies to every status
- * change here regardless of target: `updateStatus` (via `rewrite()` in
- * core/repoos.ts) now always commits the task file in the main checkout, so
- * the write itself is never left as an untrusted dirty file. Agents that want
- * the full handoff guarantee (implementation committed + non-vacuous) should
- * go through the trusted handoff/PATCH path, not this CLI shortcut.
+ * Two transitions are special-cased, because both are ones this command
+ * cannot perform on its own.
+ *
+ * **`review` from inside the runner session for that same task (#0507)** does
+ * NOT flip `status:`. It records a handoff request in the board's cache dir
+ * (`.repoos/handoff-requests/<id>.json`) and exits 0; the runner picks that up
+ * exactly like the `::repoos-handoff-ready::` signal and finalizes when the
+ * turn ends — scoped `repoos check`, then the commit/vacuity gate, then
+ * `review`. This is the single most-used route in practice: engineers reach for
+ * it because the CTO nudge says "hand off to review" and the operating loop
+ * says "set `status: review`". A bare frontmatter write is not a handoff — it
+ * skips the check, and because the task leaves `active` the server stops the
+ * very agent that asked, which `cleanup()` then books as a dev error (#0505,
+ * #0499: "needs input" next to "waiting for human" on a task that passed
+ * review). Detection is the runner's own marker — `REPOOS_AGENT=1` plus a
+ * `REPOOS_TASK_ID` equal to the id being moved — so a human running the same
+ * command in their own shell still gets a plain status edit, picked up by the
+ * server and run through the same finalization via the file-watch route.
  *
- * `done` gets one narrow exception to the "generic, no side checks" rule
- * above (confirmed live, 2026-09-17 — see #0399 and the #0185/#0389 incidents
- * in this session): unlike every other status, `done` claims the task's code
- * is actually on `main`. The server's own HTTP PATCH route already refuses a
- * bare `status: "done"` for exactly this reason (routes/tasks.ts) and forces
- * callers through `POST /api/tasks/:id/done`, the real close-out pipeline —
- * but this CLI command never went through that route to begin with, so it
- * silently flips the flag with zero merge awareness. If the task has a
- * `branch` that still exists locally and is NOT an ancestor of main, that
- * branch's code has not landed; refuse rather than mark it done from under
- * the user. This intentionally fails OPEN (allows the move) whenever it
- * can't tell for sure — no branch recorded, the branch was already deleted
- * (the normal post-merge cleanup), or git can't answer the ancestry question
- * — so it never blocks the many legitimate `mv` calls that have nothing to
- * do with code at all.
+ * `done` gets a narrow guard for the mirror-image reason (confirmed live,
+ * 2026-09-17 — see #0399 and the #0185/#0389 incidents in this session):
+ * unlike every other status, `done` claims the task's code is actually on
+ * `main`. The server's own HTTP PATCH route already refuses a bare
+ * `status: "done"` for exactly this reason (routes/tasks.ts) and forces callers
+ * through `POST /api/tasks/:id/done`, the real close-out pipeline — but this CLI
+ * command never went through that route to begin with, so it silently flips the
+ * flag with zero merge awareness. If the task has a `branch` that still exists
+ * locally and is NOT an ancestor of main, that branch's code has not landed;
+ * refuse rather than mark it done from under the user. This intentionally fails
+ * OPEN (allows the move) whenever it can't tell for sure — no branch recorded,
+ * the branch was already deleted (the normal post-merge cleanup), or git can't
+ * answer the ancestry question — so it never blocks the many legitimate `mv`
+ * calls that have nothing to do with code at all.
+ *
+ * Every other status is a plain frontmatter edit. `updateStatus` (via
+ * `rewrite()` in core/repoos.ts) always commits the task file in the main
+ * checkout, so the write itself is never left as an untrusted dirty file. Note
+ * that a move into `review` from OUTSIDE a runner session still goes through
+ * the full server-side finalization — the server intercepts the file write and
+ * runs the same check the handoff signal does, keeping the task `active` until
+ * it passes.
  */
 export function cmdMv(id, status, note, opts = {}) {
     if (!id || !status) {
@@ -186,6 +244,8 @@ export function cmdMv(id, status, note, opts = {}) {
     // .git) is a silent no-op from the board's perspective.
     const repoos = boardRepoOS();
     try {
+        if (status === "review" && handoffRequestFromRunner(id))
+            return;
         if (status === "done" && !opts.force) {
             const existing = repoos.getTask(id);
             if (existing && existing.status !== "done" && existing.branch) {

package/dist/core/config.js

@@ -1482,12 +1482,12 @@ export function getConfigSchema() {
         // [board.columns] — display-only label overrides (#0396).
         ...STATUSES.map((status) => ({
             key: `board.columns.${status}`,
-            label: `Column label: ${status}`,
+            label: `${status.charAt(0).toUpperCase() + status.slice(1)} column`,
             type: "string",
             tier: "live",
             restartRequired: false,
             default: DEFAULT_COLUMN_LABELS[status],
-            description: `Display label for the "${status}" column (${DEFAULT_COLUMN_LABELS[status]})`,
+            description: `Display label only — the "${status}" status ID never changes (default: ${DEFAULT_COLUMN_LABELS[status]})`,
         })),
     ];
 }

package/dist/core/doctor.js

@@ -19,7 +19,7 @@
 import { accessSync, constants, existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { findRepoRoot, isLinkedWorktreeRoot, loadConfig, mainCheckoutRoot, parseFlatToml, projectDisplayName, resolveServePort, SUPPORTED_TOML_KEYS, worktreesDir, } from "./config.js";
-import { STATUSES } from "./types.js";
+import { STATUSES, UI_THEMES } from "./types.js";
 import { checkBuildForRoot } from "./build.js";
 import { detectRepoMarkers, hasBinary, installHint, missingBinaries, prereqDetail, } from "./check-runner.js";
 import { resolveCheckPlan } from "./check-plan.js";
@@ -187,7 +187,7 @@ export function findConfigValueProblems(parsed) {
     enumCheck("defaultAssignee", ["ai", "human", "unassigned"]);
     enumCheck("defaultTaskMode", ["freeform", "manual"]);
     enumCheck("theme", ["dark", "light", "system"]);
-    enumCheck("uiTheme", ["classic", "clear", "gen z", "jelly"]);
+    enumCheck("uiTheme", UI_THEMES);
     const boolCheck = (key) => {
         const v = get(key);
         if (v !== undefined && typeof v !== "boolean") {

package/dist/core/input.d.ts

@@ -47,7 +47,11 @@ export interface Input {
 export declare function ensureInputNumbers(c: RepoOSConfig): Input[];
 export declare function listInputs(c: RepoOSConfig): Input[];
 export declare function createInput(c: RepoOSConfig, body: string, type?: string, createdBy?: string): Input;
-export declare function updateInput(c: RepoOSConfig, id: string, status: InputStatus): Input;
+export type InputPatch = {
+    status?: InputStatus;
+    text?: string;
+};
+export declare function updateInput(c: RepoOSConfig, id: string, patch: InputPatch): Input;
 /**
  * Record how an input was resolved and move it to `processed`. `task` stores
  * the created task's id in `resolved_task`; `none` clears it. Both keys are

package/dist/core/input.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { parseDocument } from "./frontmatter.js";
+import { parseDocument, serializeDocument } from "./frontmatter.js";
 const q = (v) => `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 /**
  * Set a frontmatter key in a file's raw content, adding it to the block if it
@@ -12,6 +12,19 @@ function setField(content, key, value) {
     const re = new RegExp(`^${key}:.*$`, "m");
     return re.test(content) ? content.replace(re, line) : content.replace("---\n", `---\n${line}\n`);
 }
+const INPUT_KEY_ORDER = [
+    "id",
+    "number",
+    "title",
+    "status",
+    "type",
+    "area",
+    "created_by",
+    "created_at",
+    "updated_at",
+    "resolution",
+    "resolved_task",
+];
 const slug = (v) => v
     .toLowerCase()
     .replace(/[^a-z0-9]+/g, "-")
@@ -135,22 +148,35 @@ export function createInput(c, body, type = "other", createdBy = "") {
     ].join("\n"));
     return listInputs(c).find((i) => i.id === id);
 }
-export function updateInput(c, id, status) {
+export function updateInput(c, id, patch) {
+    if (patch.status === undefined && patch.text === undefined)
+        throw new Error("nothing to update");
     const item = listInputs(c).find((i) => i.id === id);
     if (!item)
         throw new Error("input not found");
     const file = join(c.root, item.path);
-    let content = readFileSync(file, "utf8")
-        .replace(/^status:.*$/m, `status: ${status}`)
-        .replace(/^updated_at:.*$/m, `updated_at: ${q(new Date().toISOString())}`);
+    const parsed = parseDocument(readFileSync(file, "utf8"));
+    const status = patch.status ?? item.status;
+    let body = parsed.body.trim();
+    let title = String(parsed.data.title ?? item.title);
+    if (patch.text !== undefined) {
+        body = patch.text.trim();
+        title = body.split(/\n/)[0].replace(/^#\s*/, "").slice(0, 100) || "Untitled input";
+    }
+    const data = {
+        ...parsed.data,
+        status,
+        title,
+        updated_at: new Date().toISOString(),
+    };
     // A manual move out of `processed` invalidates any recorded resolution —
     // leaving it behind would re-display a stale outcome if the input is later
     // marked processed again without a real resolve action.
     if (status !== "processed") {
-        content = setField(content, "resolution", "");
-        content = setField(content, "resolved_task", "");
+        data.resolution = "";
+        data.resolved_task = "";
     }
-    writeFileSync(file, content);
+    writeFileSync(file, serializeDocument(data, `${body}\n`, INPUT_KEY_ORDER));
     return listInputs(c).find((i) => i.id === id);
 }
 /**

package/dist/core/needs-input.d.ts

@@ -0,0 +1,8 @@
+import type { Task } from "./types.js";
+/**
+ * Stale `dev-error` on a `review` task: the engineer reached review but a
+ * handoff-signal glitch left the flag set (see TaskDrawer banner note).
+ */
+export declare function needsInputSuppressedOnReview(task: Pick<Task, "status" | "needsInput" | "needsInputReason">): boolean;
+/** A successful review run clears these reviewer-episode flags (#0511). */
+export declare function needsInputClearsOnSuccessfulReview(task: Pick<Task, "status" | "needsInputReason">): boolean;

package/dist/core/needs-input.js

@@ -0,0 +1,13 @@
+/**
+ * Stale `dev-error` on a `review` task: the engineer reached review but a
+ * handoff-signal glitch left the flag set (see TaskDrawer banner note).
+ */
+export function needsInputSuppressedOnReview(task) {
+    return Boolean(task.needsInput && task.status === "review" && task.needsInputReason === "dev-error");
+}
+/** A successful review run clears these reviewer-episode flags (#0511). */
+export function needsInputClearsOnSuccessfulReview(task) {
+    if (task.needsInputReason === "review-failed")
+        return true;
+    return task.needsInputReason === "watchdog-stuck" && task.status === "review";
+}

package/dist/core/repo-log.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Read-only git history for the Context page History tab.
+ *
+ * Every git invocation is argv (never a shell string). Inputs are validated
+ * before they reach `git`. Output is a machine format with unit-separator
+ * fields and a NUL record terminator — never parsed from human `git log`
+ * pretty-print.
+ */
+import { type DiffResult } from "./git.js";
+export declare const DEFAULT_LOG_LIMIT = 50;
+export declare const MAX_LOG_LIMIT = 100;
+export interface RepoCommit {
+    sha: string;
+    shortSha: string;
+    subject: string;
+    body: string;
+    authorName: string;
+    authorEmail: string;
+    date: string;
+    refs: string[];
+    parents: string[];
+    taskId: string | null;
+}
+export interface RepoCommitFile {
+    path: string;
+    additions: number;
+    deletions: number;
+    status: "added" | "deleted" | "modified" | "binary";
+}
+export interface RepoCommitDetail extends RepoCommit {
+    files: RepoCommitFile[];
+    patch: string;
+    truncated: boolean;
+}
+export interface RepoLogPage {
+    ok: true;
+    commits: RepoCommit[];
+    nextCursor: string | null;
+    branch: string;
+    defaultBranch: string;
+}
+export interface RepoBranchList {
+    ok: true;
+    defaultBranch: string;
+    branches: string[];
+}
+export type RepoLogError = {
+    ok: false;
+    error: string;
+    code: "not-git" | "invalid" | "missing";
+};
+export declare function isValidSha(value: string): boolean;
+export declare function isValidBranch(value: string): boolean;
+/** Strip trailing slashes so `src/ui-app/` is the same filter as `src/ui-app`. */
+export declare function normalizePathFilter(value: string): string;
+export declare function isValidPathFilter(value: string): boolean;
+/** `type(NNNN): subject` — the RepoOS commit-message convention. */
+export declare function extractTaskId(subject: string): string | null;
+export declare function parseDecorations(raw: string): string[];
+/** Parse NUL-terminated `--format` records from `git log`. Exported for tests. */
+export declare function parseGitLogOutput(stdout: string): RepoCommit[];
+export declare function resolveDefaultBranch(root: string): Promise<string>;
+export declare function listRepoBranches(root: string): Promise<RepoBranchList | RepoLogError>;
+export declare function listRepoLog(root: string, opts?: {
+    branch?: string;
+    path?: string;
+    limit?: number;
+    before?: string;
+}): Promise<RepoLogPage | RepoLogError>;
+export declare function truncatePatch(stdout: string): DiffResult;
+export declare function getRepoCommit(root: string, sha: string): Promise<RepoCommitDetail | RepoLogError>;
+export declare function getCommitFileContents(root: string, sha: string, filePath: string): Promise<{
+    ok: true;
+    before: string;
+    after: string;
+    existsBefore: boolean;
+    existsAfter: boolean;
+} | RepoLogError>;