@xopcai/xopc 0.0.197 → 0.0.199

package/dist/src/gateway/hono/routes/tasks.js

@@ -1,10 +1,12 @@
+import { runSqliteWriteTransaction } from "../../../storage/sqlite/transaction.js";
 import { TaskRepository } from "../../../tasks/task-repository.js";
 import { TaskRunRepository } from "../../../tasks/task-run-repository.js";
 import { TaskReadModelProjector } from "../../../tasks/task-read-model-projector.js";
 import { TaskPhaseSchema } from "../../../../packages/gateway-contract/src/task-lifecycle.js";
-import { TaskCommandRequestSchema, TaskContextInputSchema, TaskCreateRequestSchema, TaskDependencyUpdateRequestSchema, TaskPatchRequestSchema } from "../../../../packages/gateway-contract/src/tasks.js";
+import { TaskBoardPositionRequestSchema, TaskCommandRequestSchema, TaskContextInputSchema, TaskCreateRequestSchema, TaskDependencyUpdateRequestSchema, TaskPatchRequestSchema } from "../../../../packages/gateway-contract/src/tasks.js";
 import { ProjectMonitoringUpdateSchema } from "../../../../packages/gateway-contract/src/project-monitoring.js";
 import { TaskContextRepository } from "../../../tasks/task-context-repository.js";
+import { enqueueTaskChangedEvent } from "../../../tasks/task-change-events.js";
 import { TaskDependencyError, TaskDependencyService } from "../../../tasks/task-dependency-service.js";
 import { TaskApplicationService } from "../../../tasks/task-application-service.js";
 import { ProjectMonitoringService } from "../../../tasks/project-monitoring-service.js";
@@ -13,6 +15,7 @@ import { TaskValueMetricsService } from "../../../tasks/task-value-metrics-servi
 import { TaskSignalService } from "../../../tasks/task-signal-service.js";
 //#region src/gateway/hono/routes/tasks.ts
 function registerTaskRoutes(authenticated, deps) {
+	const taskRateLimit = deps.taskRateLimitMiddleware ?? deps.strictRateLimitMiddleware;
 	const application = new TaskApplicationService();
 	const operatingViews = new ProjectOperatingViewService(deps.service.projects);
 	const monitoring = new ProjectMonitoringService();
@@ -42,7 +45,7 @@ function registerTaskRoutes(authenticated, deps) {
 			})
 		});
 	});
-	authenticated.post("/api/tasks", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/tasks", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const parsed = TaskCreateRequestSchema.safeParse(body);
 		if (!parsed.success) return c.json({
@@ -57,6 +60,7 @@ function registerTaskRoutes(authenticated, deps) {
 				error: created.reason
 			}, 409);
 			if (created.runId) deps.service.dispatchTaskRuns();
+			else deps.service.dispatchTaskEvents();
 			return c.json({
 				ok: true,
 				task: created.model.task,
@@ -97,33 +101,57 @@ function registerTaskRoutes(authenticated, deps) {
 			allowedCommands: model.allowedCommands
 		});
 	});
-	authenticated.patch("/api/tasks/:id", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.patch("/api/tasks/:id", taskRateLimit, async (c) => {
 		const parsed = TaskPatchRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
 			error: "Invalid task patch"
 		}, 400);
-		const updated = tasks.update(c.req.param("id"), parsed.data);
+		const updated = runSqliteWriteTransaction((db) => {
+			const task = tasks.update(c.req.param("id"), parsed.data);
+			if (!task) return void 0;
+			const changedFields = Object.keys(parsed.data).filter((field) => field !== "expectedVersion");
+			enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields,
+				actor: { kind: "user" }
+			});
+			return task;
+		});
 		if (!updated) return c.json({
 			ok: false,
 			error: "Task changed or was not found"
 		}, 409);
+		deps.service.dispatchTaskEvents();
 		return c.json({
 			ok: true,
 			task: updated
 		});
 	});
-	authenticated.put("/api/tasks/:id/dependencies", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.put("/api/tasks/:id/dependencies", taskRateLimit, async (c) => {
 		const parsed = TaskDependencyUpdateRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
 			error: "Invalid task dependencies"
 		}, 400);
 		try {
-			const task = dependencies.replace({
-				taskId: c.req.param("id"),
-				...parsed.data
+			const task = runSqliteWriteTransaction((db) => {
+				const changed = dependencies.replace({
+					taskId: c.req.param("id"),
+					...parsed.data
+				});
+				enqueueTaskChangedEvent(db, {
+					taskId: changed.id,
+					projectId: changed.projectId,
+					version: changed.version,
+					changedFields: ["dependencies"],
+					actor: { kind: "user" }
+				});
+				return changed;
 			});
+			deps.service.dispatchTaskEvents();
 			return c.json({
 				ok: true,
 				task,
@@ -140,7 +168,45 @@ function registerTaskRoutes(authenticated, deps) {
 			}, status);
 		}
 	});
-	authenticated.post("/api/tasks/:id/commands", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.put("/api/tasks/:id/board-position", taskRateLimit, async (c) => {
+		const parsed = TaskBoardPositionRequestSchema.safeParse(await c.req.json().catch(() => ({})));
+		if (!parsed.success) return c.json({
+			ok: false,
+			error: "Invalid task board position"
+		}, 400);
+		try {
+			const task = runSqliteWriteTransaction((db) => {
+				const reordered = tasks.reorder({
+					taskId: c.req.param("id"),
+					...parsed.data
+				});
+				if (!reordered) return void 0;
+				enqueueTaskChangedEvent(db, {
+					taskId: reordered.id,
+					projectId: reordered.projectId,
+					version: reordered.version,
+					changedFields: ["boardRank"],
+					actor: { kind: "user" }
+				});
+				return reordered;
+			});
+			if (!task) return c.json({
+				ok: false,
+				error: "Task changed or was not found"
+			}, 409);
+			deps.service.dispatchTaskEvents();
+			return c.json({
+				ok: true,
+				task
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			}, 400);
+		}
+	});
+	authenticated.post("/api/tasks/:id/commands", taskRateLimit, async (c) => {
 		const parsed = TaskCommandRequestSchema.safeParse(await c.req.json().catch(() => ({})));
 		if (!parsed.success) return c.json({
 			ok: false,
@@ -165,6 +231,7 @@ function registerTaskRoutes(authenticated, deps) {
 			}, 409);
 		}
 		if (result.runId || parsed.data.command?.type === "resolve_wait") deps.service.dispatchTaskRuns();
+		else deps.service.dispatchTaskEvents();
 		if (parsed.data.command?.type === "close" && parsed.data.command.resolution === "done") signals.dependencyClosed(c.req.param("id"));
 		return c.json({
 			ok: true,
@@ -172,7 +239,7 @@ function registerTaskRoutes(authenticated, deps) {
 			...result.runId ? { run: runs.get(result.runId) } : {}
 		});
 	});
-	authenticated.post("/api/tasks/:id/context", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/tasks/:id/context", taskRateLimit, async (c) => {
 		const task = tasks.get(c.req.param("id"));
 		if (!task) return c.json({
 			ok: false,
@@ -183,17 +250,42 @@ function registerTaskRoutes(authenticated, deps) {
 			ok: false,
 			error: "Invalid task context edge"
 		}, 400);
-		return c.json({
-			ok: true,
-			edge: context.add({
+		const edge = runSqliteWriteTransaction((db) => {
+			const created = context.add({
 				taskId: task.id,
 				...parsed.data,
 				createdBy: { kind: "user" }
-			})
+			});
+			enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields: ["context"],
+				actor: { kind: "user" }
+			});
+			return created;
+		});
+		deps.service.dispatchTaskEvents();
+		return c.json({
+			ok: true,
+			edge
 		}, 201);
 	});
-	authenticated.delete("/api/tasks/:id/context/:edgeId", deps.strictRateLimitMiddleware, (c) => {
-		return context.remove(c.req.param("id"), c.req.param("edgeId")) ? c.json({ ok: true }) : c.json({
+	authenticated.delete("/api/tasks/:id/context/:edgeId", taskRateLimit, (c) => {
+		const task = tasks.get(c.req.param("id"));
+		const removed = task ? runSqliteWriteTransaction((db) => {
+			const didRemove = context.remove(task.id, c.req.param("edgeId"));
+			if (didRemove) enqueueTaskChangedEvent(db, {
+				taskId: task.id,
+				projectId: task.projectId,
+				version: task.version,
+				changedFields: ["context"],
+				actor: { kind: "user" }
+			});
+			return didRemove;
+		}) : false;
+		if (removed) deps.service.dispatchTaskEvents();
+		return removed ? c.json({ ok: true }) : c.json({
 			ok: false,
 			error: "Task context edge not found"
 		}, 404);
@@ -219,7 +311,7 @@ function registerTaskRoutes(authenticated, deps) {
 			error: "TaskRun not found"
 		}, 404);
 	});
-	authenticated.post("/api/task-runs/:runId/cancel", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/task-runs/:runId/cancel", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		const run = runs.get(c.req.param("runId"));
 		if (!run) return c.json({
@@ -256,13 +348,14 @@ function registerTaskRoutes(authenticated, deps) {
 			ok: false,
 			error: result.reason
 		}, 409);
+		deps.service.dispatchTaskEvents();
 		return c.json({
 			ok: true,
 			run: runs.get(run.id),
 			receipt: runs.getReceipt(run.id)
 		});
 	});
-	authenticated.post("/api/task-runs/:runId/feedback", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.post("/api/task-runs/:runId/feedback", taskRateLimit, async (c) => {
 		const body = await c.req.json().catch(() => ({}));
 		if (body.rating !== "helpful" && body.rating !== "not_helpful") return c.json({
 			ok: false,
@@ -306,7 +399,7 @@ function registerTaskRoutes(authenticated, deps) {
 			policy: monitoring.get(projectId)
 		});
 	});
-	authenticated.patch("/api/projects/:projectId/monitoring", deps.strictRateLimitMiddleware, async (c) => {
+	authenticated.patch("/api/projects/:projectId/monitoring", taskRateLimit, async (c) => {
 		const projectId = c.req.param("projectId");
 		if (!deps.service.projects.get(projectId)) return c.json({
 			ok: false,

package/dist/src/gateway/host.d.ts

@@ -6,6 +6,13 @@ export declare function isAllInterfacesHost(host: string | undefined): boolean;
 export declare const GATEWAY_DEV_CONSOLE_ORIGINS: readonly ["http://localhost:3000", "http://127.0.0.1:3000"];
 /** Expo / React Native web dev server (Metro defaults to port 8081). */
 export declare const GATEWAY_EXPO_DEV_ORIGINS: readonly ["http://localhost:8081", "http://127.0.0.1:8081"];
+export type LanGatewayCandidate = {
+    url: string;
+    address: string;
+    interfaceName: string;
+};
+/** Non-internal IPv4 addresses that can serve this gateway on the local network. */
+export declare function enumerateLanGatewayCandidates(port: number): LanGatewayCandidate[];
 /** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
 export declare function resolveEffectiveGatewayPort(config: {
     gateway?: {
@@ -27,7 +34,8 @@ export declare function buildDefaultCorsOrigins(params: {
 }): string[];
 /**
  * Effective browser origins for CORS and CSRF checks.
- * Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.
+ * Configured origins extend the gateway's own browser origins instead of replacing them.
+ * This keeps the bundled console reachable while allowing explicit external frontends.
  */
 export declare function resolveGatewayCorsOrigins(params: {
     configuredOrigins?: string[];

package/dist/src/gateway/host.js

@@ -1,4 +1,5 @@
 import "../daemon/constants.js";
+import { networkInterfaces } from "node:os";
 //#region src/gateway/host.ts
 /** True when the bind address is local-only (127.x, localhost, ::1). */
 function isLoopbackHost(host) {
@@ -17,6 +18,21 @@ const GATEWAY_DEV_CONSOLE_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:
 /** Expo / React Native web dev server (Metro defaults to port 8081). */
 const GATEWAY_EXPO_DEV_ORIGINS = ["http://localhost:8081", "http://127.0.0.1:8081"];
 const GATEWAY_LOOPBACK_DEV_ORIGINS = [...GATEWAY_DEV_CONSOLE_ORIGINS, ...GATEWAY_EXPO_DEV_ORIGINS];
+/** Non-internal IPv4 addresses that can serve this gateway on the local network. */
+function enumerateLanGatewayCandidates(port) {
+	const seen = /* @__PURE__ */ new Set();
+	const candidates = [];
+	for (const [interfaceName, addresses] of Object.entries(networkInterfaces())) for (const address of addresses ?? []) {
+		if (address.family !== "IPv4" || address.internal || seen.has(address.address)) continue;
+		seen.add(address.address);
+		candidates.push({
+			address: address.address,
+			interfaceName,
+			url: `http://${address.address}:${port}`
+		});
+	}
+	return candidates;
+}
 /** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
 function resolveEffectiveGatewayPort(config, listenPortOverride) {
 	if (typeof listenPortOverride === "number" && Number.isFinite(listenPortOverride)) return listenPortOverride;
@@ -35,19 +51,20 @@ function buildDefaultCorsOrigins(params) {
 	]);
 	const bindHost = params.bindHost?.trim();
 	if (bindHost && !isLoopbackHost(bindHost) && !isAllInterfacesHost(bindHost)) origins.add(`http://${bindHost}:${params.port}`);
+	if (isAllInterfacesHost(bindHost)) for (const candidate of enumerateLanGatewayCandidates(params.port)) origins.add(candidate.url);
 	return [...origins];
 }
 /**
 * Effective browser origins for CORS and CSRF checks.
-* Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.
+* Configured origins extend the gateway's own browser origins instead of replacing them.
+* This keeps the bundled console reachable while allowing explicit external frontends.
 */
 function resolveGatewayCorsOrigins(params) {
 	const configured = (params.configuredOrigins ?? []).map((origin) => origin.trim()).filter(Boolean);
-	if (configured.length === 0) return buildDefaultCorsOrigins({
+	return [...new Set([...configured, ...buildDefaultCorsOrigins({
 		port: params.port,
 		bindHost: params.bindHost
-	});
-	return [...new Set([...configured, ...GATEWAY_LOOPBACK_DEV_ORIGINS])];
+	})])];
 }
 /** Browser origin (`https://host`) from a gateway public/tunnel root URL. */
 function originFromGatewayPublicUrl(publicUrl) {
@@ -73,4 +90,4 @@ function resolveAllowedBrowserOrigins(params) {
 	return origins;
 }
 //#endregion
-export { GATEWAY_DEV_CONSOLE_ORIGINS, GATEWAY_EXPO_DEV_ORIGINS, buildDefaultCorsOrigins, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };
+export { GATEWAY_DEV_CONSOLE_ORIGINS, GATEWAY_EXPO_DEV_ORIGINS, buildDefaultCorsOrigins, enumerateLanGatewayCandidates, isAllInterfacesHost, isLoopbackHost, originFromGatewayPublicUrl, resolveAllowedBrowserOrigins, resolveEffectiveGatewayPort, resolveGatewayCorsOrigins, resolveGatewayServiceListenPort };

package/dist/src/gateway/rate-limit/buckets.d.ts

@@ -36,6 +36,7 @@ declare class BucketRegistry {
     private authFailureSignature?;
     private strictApiLimiter?;
     private chatApiLimiter?;
+    private taskApiLimiter?;
     private xopcCloudPollLimiter?;
     private channelApiLimiter?;
     private tunnelMutateLimiter?;
@@ -52,6 +53,8 @@ declare class BucketRegistry {
     strictApi(): RateLimiter;
     /** Interactive chat actions — 180 req / 60 s per client IP. */
     chatApi(): RateLimiter;
+    /** Interactive task and board mutations — 300 req / 60 s per client IP. */
+    taskApi(): RateLimiter;
     /** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
     xopcCloudPoll(): RateLimiter;
     /** Channel mutation/action endpoints — 20 req / 60 s per client IP. */

package/dist/src/gateway/rate-limit/buckets.js

@@ -48,6 +48,7 @@ var BucketRegistry = class {
 	authFailureSignature;
 	strictApiLimiter;
 	chatApiLimiter;
+	taskApiLimiter;
 	xopcCloudPollLimiter;
 	channelApiLimiter;
 	tunnelMutateLimiter;
@@ -89,6 +90,14 @@ var BucketRegistry = class {
 		});
 		return this.chatApiLimiter;
 	}
+	/** Interactive task and board mutations — 300 req / 60 s per client IP. */
+	taskApi() {
+		if (!this.taskApiLimiter) this.taskApiLimiter = new RateLimiter({
+			maxRequests: 300,
+			windowMs: 6e4
+		});
+		return this.taskApiLimiter;
+	}
 	/** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
 	xopcCloudPoll() {
 		if (!this.xopcCloudPollLimiter) this.xopcCloudPollLimiter = new RateLimiter({
@@ -142,6 +151,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.destroy();
 		this.strictApiLimiter?.destroy();
 		this.chatApiLimiter?.destroy();
+		this.taskApiLimiter?.destroy();
 		this.xopcCloudPollLimiter?.destroy();
 		this.channelApiLimiter?.destroy();
 		this.tunnelMutateLimiter?.destroy();
@@ -151,6 +161,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter = void 0;
 		this.strictApiLimiter = void 0;
 		this.chatApiLimiter = void 0;
+		this.taskApiLimiter = void 0;
 		this.xopcCloudPollLimiter = void 0;
 		this.channelApiLimiter = void 0;
 		this.tunnelMutateLimiter = void 0;
@@ -164,6 +175,7 @@ var BucketRegistry = class {
 		this.authFailureLimiter?.resetForTests();
 		this.strictApiLimiter?.resetForTests();
 		this.chatApiLimiter?.resetForTests();
+		this.taskApiLimiter?.resetForTests();
 		this.xopcCloudPollLimiter?.resetForTests();
 		this.channelApiLimiter?.resetForTests();
 		this.tunnelMutateLimiter?.resetForTests();

package/dist/src/gateway/runtime-config.js

@@ -1,12 +1,9 @@
-import { isAllInterfacesHost, isLoopbackHost } from "./host.js";
+import { isAllInterfacesHost, isLoopbackHost, resolveGatewayCorsOrigins } from "./host.js";
 import { isAuthRateLimitGloballyDisabled, isGatewayStrictSecurityEnabled } from "./rate-limit/env-flags.js";
 import "./rate-limit/index.js";
 import { resolveGatewayListenPlan } from "./listen.js";
 import { assertTailscaleExposureCompatible } from "./tailscale-lifecycle.js";
 //#region src/gateway/runtime-config.ts
-function normalizeCorsOrigins(cfg) {
-	return (cfg.gateway?.corsOrigins ?? []).map((value) => value.trim()).filter(Boolean);
-}
 function hasSharedSecret(auth) {
 	if (auth.mode === "trusted-proxy") return true;
 	if (auth.mode === "token") return typeof auth.token === "string" && auth.token.trim().length > 0;
@@ -23,7 +20,11 @@ function assertGatewayRuntimeConfig(params) {
 		bindOverride: params.bindOverride
 	});
 	const loopback = isLoopbackHost(bindHost);
-	const corsOrigins = normalizeCorsOrigins(params.cfg);
+	const corsOrigins = resolveGatewayCorsOrigins({
+		configuredOrigins: params.cfg.gateway?.corsOrigins,
+		port: params.port,
+		bindHost
+	});
 	const dangerouslyAllowHostHeaderOriginFallback = params.cfg.gateway?.dangerouslyAllowHostHeaderOriginFallback === true;
 	if (bindMode === "loopback" && !loopback) throw new Error(`gateway bind=loopback resolved to non-loopback host ${bindHost}; refusing fallback to a network bind`);
 	if (bindMode === "custom") {

package/dist/src/gateway/security/audit.js

@@ -110,13 +110,6 @@ function collectGatewayConfigFindings(params) {
 		title: "Large number of CORS origins configured",
 		detail: `${params.corsOrigins.length} CORS origins configured. Review whether all are necessary.`
 	});
-	if (!loopback && (!params.corsOrigins || params.corsOrigins.length === 0) && params.dangerouslyAllowHostHeaderOriginFallback !== true) findings.push({
-		checkId: "gateway.cors.no_explicit_origins",
-		severity: "info",
-		title: "No custom CORS origins — loopback browsers only",
-		detail: "Gateway listens on a network address with empty gateway.corsOrigins. localhost and 127.0.0.1 on the gateway port are allowed by default; LAN or remote browser URLs must be added explicitly.",
-		remediation: "Add gateway.corsOrigins entries (e.g. http://192.168.x.x:<port>) for non-loopback browser access, or enable gateway.dangerouslyAllowHostHeaderOriginFallback only if you understand the CSRF risk."
-	});
 	if (!loopback && params.auth.mode !== "none" && params.auth.mode !== "trusted-proxy" && params.rateLimitEnabled === false) findings.push({
 		checkId: "gateway.auth.no_rate_limit",
 		severity: "warn",

package/dist/src/gateway/server.js

@@ -51,7 +51,10 @@ var GatewayServer = class {
 		});
 		const { configureTunnelFromGatewayConfig } = await import("../tunnel/gateway-lifecycle.js");
 		await configureTunnelFromGatewayConfig(this.service.currentConfig, { deferWellKnownFetch: true });
-		const app = createHonoApp({ service: this.service });
+		const app = createHonoApp({
+			service: this.service,
+			listenHost: bindHost
+		});
 		const primaryHost = listenHosts[0] ?? bindHost;
 		const attachUpgrade = (server) => {
 			server.on("upgrade", (req, socket, head) => {

package/dist/src/gateway/service.d.ts

@@ -120,6 +120,7 @@ export declare class GatewayService {
     private createTaskRunDispatcher;
     private createMobileNotificationService;
     dispatchTaskRuns(): void;
+    dispatchTaskEvents(): void;
     runAgent(...args: Parameters<GatewayAgentRunner['runAgent']>): ReturnType<GatewayAgentRunner['runAgent']>;
     submitSessionInput(...args: Parameters<GatewayAgentRunner['submitSessionInput']>): Promise<{
         ok: true;

package/dist/src/gateway/service.js

@@ -460,6 +460,7 @@ var GatewayService = class {
 			getNotesService: () => this.notesService,
 			getProjectService: () => this.projects,
 			getLocalAppService: () => this.localApps,
+			dispatchTaskEvents: () => this.dispatchTaskEvents(),
 			dispatchTaskRuns: () => this.dispatchTaskRuns(),
 			getWorkflowRunService: () => this.createWorkflowRunService(),
 			sourceContextResolver: async (binding) => {
@@ -593,10 +594,13 @@ var GatewayService = class {
 	}
 	dispatchTaskRuns() {
 		new TaskSignalService().tick();
-		new TaskOutboxDispatcher(publishAutomationProductEvent).drain();
+		this.dispatchTaskEvents();
 		this.createTaskRunDispatcher().dispatch();
 		this.createWorkflowRunService().dispatchTaskRuns();
 	}
+	dispatchTaskEvents() {
+		new TaskOutboxDispatcher(publishAutomationProductEvent).drain();
+	}
 	runAgent(...args) {
 		return this.agentRunner.runAgent(...args);
 	}

package/dist/src/proactive/actions/service.d.ts

@@ -0,0 +1,2 @@
+export declare function executePendingProactiveActions(now?: Date): number;
+export declare function resolveProactiveActionDecision(inboxItemId: string, choice: string, now?: Date): void;

package/dist/src/proactive/actions/service.js

@@ -0,0 +1,80 @@
+import { getSqliteDatabase, runSqliteWriteTransaction } from "../../storage/sqlite/transaction.js";
+import { TaskApplicationService } from "../../tasks/task-application-service.js";
+//#region src/proactive/actions/service.ts
+function projectIdFromAggregationKey(value) {
+	if (!value.startsWith("project:") || value.length === 8) throw new Error("Proactive action has no project scope");
+	return value.slice(8);
+}
+function executeClaimedAction(row, now = /* @__PURE__ */ new Date()) {
+	const action = JSON.parse(row.proposed_action_json);
+	try {
+		if (action.id !== "create_project_task") throw new Error(`Unsupported proactive action: ${action.id}`);
+		const result = new TaskApplicationService().create({
+			idempotencyKey: `proactive:${row.insight_id}:${action.id}`,
+			title: action.input.title,
+			projectId: projectIdFromAggregationKey(row.aggregation_key),
+			priority: "normal",
+			contract: {
+				objective: action.input.objective,
+				expectedOutputs: [],
+				acceptanceCriteria: [],
+				constraints: [],
+				approvalRequired: [],
+				assumptions: [],
+				risks: [],
+				acceptancePolicy: "manual",
+				outputDestinations: []
+			},
+			dependencies: [],
+			context: [],
+			authorityGrants: [],
+			activation: {
+				mode: "capture",
+				phase: "backlog"
+			}
+		}, {
+			kind: "system",
+			id: "proactive"
+		});
+		if (!result.ok) throw new Error(`Task creation failed: ${"reason" in result ? result.reason : "unknown"}`);
+		getSqliteDatabase().prepare(`UPDATE proactive_insights
+      SET action_status = 'completed', action_result_json = ?, action_error = NULL, action_updated_at = ?
+      WHERE insight_id = ? AND action_status = 'executing'`).run(JSON.stringify({ taskId: result.model.task.id }), now.toISOString(), row.insight_id);
+	} catch (error) {
+		getSqliteDatabase().prepare(`UPDATE proactive_insights
+      SET action_status = 'failed', action_error = ?, action_updated_at = ?
+      WHERE insight_id = ? AND action_status = 'executing'`).run(String(error instanceof Error ? error.message : error).slice(0, 2e3), now.toISOString(), row.insight_id);
+	}
+}
+function executePendingProactiveActions(now = /* @__PURE__ */ new Date()) {
+	const expired = (/* @__PURE__ */ new Date(now.getTime() - 5 * 6e4)).toISOString();
+	getSqliteDatabase().prepare(`UPDATE proactive_insights SET action_status = 'pending', action_updated_at = ?
+    WHERE action_status = 'executing' AND action_updated_at <= ?`).run(now.toISOString(), expired);
+	let executed = 0;
+	while (true) {
+		const row = runSqliteWriteTransaction((db) => {
+			const candidate = db.prepare(`SELECT x.insight_id, b.aggregation_key, x.proposed_action_json
+        FROM proactive_insights x
+        JOIN proactive_runs r ON r.run_id = x.run_id
+        JOIN proactive_signal_batches b ON b.batch_id = r.batch_id
+        WHERE x.action_status = 'pending' ORDER BY x.created_at LIMIT 1`).get();
+			if (!candidate) return void 0;
+			return db.prepare(`UPDATE proactive_insights SET action_status = 'executing', action_updated_at = ?
+        WHERE insight_id = ? AND action_status = 'pending'`).run(now.toISOString(), candidate.insight_id).changes === 1 ? candidate : void 0;
+		});
+		if (!row) return executed;
+		executeClaimedAction(row, now);
+		executed += 1;
+	}
+}
+function resolveProactiveActionDecision(inboxItemId, choice, now = /* @__PURE__ */ new Date()) {
+	const row = getSqliteDatabase().prepare(`SELECT x.insight_id, x.action_status
+    FROM proactive_inbox_items i JOIN proactive_insights x ON x.insight_id = i.insight_id
+    WHERE i.inbox_item_id = ?`).get(inboxItemId);
+	if (!row || row.action_status !== "approval_required") return;
+	getSqliteDatabase().prepare(`UPDATE proactive_insights SET action_status = ?, action_updated_at = ?
+    WHERE insight_id = ? AND action_status = 'approval_required'`).run(choice === "approve" ? "pending" : "rejected", now.toISOString(), row.insight_id);
+	if (choice === "approve") executePendingProactiveActions(now);
+}
+//#endregion
+export { executePendingProactiveActions, resolveProactiveActionDecision };

package/dist/src/proactive/execution/insight.js

@@ -30,6 +30,23 @@ function parseDecision(value) {
 		options
 	};
 }
+function parseProposedAction(value) {
+	if (value == null) return void 0;
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Insight proposedAction is invalid");
+	const row = value;
+	if (row.id !== "create_project_task" || row.risk !== "low") throw new Error("Insight proposedAction is not supported");
+	if (!row.input || typeof row.input !== "object" || Array.isArray(row.input)) throw new Error("Insight proposedAction input is invalid");
+	const input = row.input;
+	return {
+		id: "create_project_task",
+		risk: "low",
+		rationale: boundedText(row.rationale, "proposedAction rationale", 600),
+		input: {
+			title: boundedText(input.title, "proposedAction title", 160),
+			objective: boundedText(input.objective, "proposedAction objective", 1200)
+		}
+	};
+}
 function parseInsightCandidate(raw, allowedEvidenceIds) {
 	let value;
 	try {
@@ -45,6 +62,8 @@ function parseInsightCandidate(raw, allowedEvidenceIds) {
 	const evidenceIds = [...new Set(row.evidenceIds.map(String))];
 	if (evidenceIds.some((id) => !allowedEvidenceIds.has(id))) throw new Error("Insight cites unknown evidence");
 	const decision = parseDecision(row.decision);
+	const proposedAction = parseProposedAction(row.proposedAction);
+	if (proposedAction && (!decision || decision.options.length !== 2 || decision.options[0]?.id !== "approve" || decision.options[1]?.id !== "reject")) throw new Error("Insight proposedAction requires approve and reject decision options");
 	return {
 		title: boundedText(row.title, "title", 160),
 		summary: boundedText(row.summary, "summary", 1200),
@@ -53,6 +72,7 @@ function parseInsightCandidate(raw, allowedEvidenceIds) {
 		recommendation: boundedText(row.recommendation, "recommendation", 800),
 		workDone: boundedText(row.workDone, "workDone", 800),
 		...decision ? { decision } : {},
+		...proposedAction ? { proposedAction } : {},
 		urgency: String(row.urgency),
 		confidence: row.confidence,
 		evidenceIds

package/dist/src/proactive/execution/repository.js

@@ -96,9 +96,9 @@ function finishRun(input, now = /* @__PURE__ */ new Date()) {
 			createdAt: nowIso
 		};
 		db.prepare(`INSERT INTO proactive_insights (insight_id, run_id, subscription_id, scenario_key, title, summary,
-      why_now, impact, recommendation, work_done, decision_json, urgency, confidence, value_score,
+      why_now, impact, recommendation, work_done, decision_json, proposed_action_json, urgency, confidence, value_score,
       evidence_ids_json, content_fingerprint, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(insight.id, insight.runId, insight.subscriptionId, insight.scenarioKey, insight.title, insight.summary, insight.whyNow, insight.impact, insight.recommendation, insight.workDone, insight.decision ? JSON.stringify(insight.decision) : null, insight.urgency, insight.confidence, insight.valueScore, JSON.stringify(insight.evidenceIds), fingerprint, insight.createdAt);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(insight.id, insight.runId, insight.subscriptionId, insight.scenarioKey, insight.title, insight.summary, insight.whyNow, insight.impact, insight.recommendation, insight.workDone, insight.decision ? JSON.stringify(insight.decision) : null, insight.proposedAction ? JSON.stringify(insight.proposedAction) : null, insight.urgency, insight.confidence, insight.valueScore, JSON.stringify(insight.evidenceIds), fingerprint, insight.createdAt);
 		return insight;
 	});
 }
@@ -124,9 +124,15 @@ function listInsights(limit = 50) {
 		recommendation: str(row, "recommendation"),
 		workDone: str(row, "work_done"),
 		...row.decision_json ? { decision: JSON.parse(str(row, "decision_json")) } : {},
+		...row.proposed_action_json ? { proposedAction: JSON.parse(str(row, "proposed_action_json")) } : {},
 		urgency: str(row, "urgency"),
 		confidence: Number(row.confidence),
 		valueScore: Number(row.value_score),
+		...row.disposition ? { disposition: str(row, "disposition") } : {},
+		...row.disposition_reason ? { dispositionReason: str(row, "disposition_reason") } : {},
+		...row.action_status ? { actionStatus: str(row, "action_status") } : {},
+		...row.action_result_json ? { actionResult: JSON.parse(str(row, "action_result_json")) } : {},
+		...row.action_error ? { actionError: str(row, "action_error") } : {},
 		evidenceIds: JSON.parse(str(row, "evidence_ids_json")),
 		createdAt: str(row, "created_at")
 	}));