commandmate 0.15.0 → 0.17.0

package/dist/server/src/lib/auto-yes-state.js

@@ -11,7 +11,7 @@
  * auto-yes-poller.ts -> auto-yes-state.ts -> path-validator.ts
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.THINKING_CHECK_LINE_COUNT = exports.MAX_CONCURRENT_POLLERS = exports.MAX_CONSECUTIVE_ERRORS = exports.MAX_BACKOFF_MS = exports.DUPLICATE_RETRY_EXPIRY_MS = exports.COOLDOWN_INTERVAL_MS = exports.POLLING_INTERVAL_MS = exports.COMPOSITE_KEY_SEPARATOR = void 0;
+exports.THINKING_CHECK_LINE_COUNT = exports.MAX_CONCURRENT_POLLERS = exports.MAX_CONSECUTIVE_ERRORS = exports.MAX_BACKOFF_MS = exports.DUPLICATE_RETRY_EXPIRY_MS = exports.COOLDOWN_INTERVAL_MS = exports.POLLING_INTERVAL_MS = exports.executeRegexWithTimeout = exports.COMPOSITE_KEY_SEPARATOR = void 0;
 exports.buildCompositeKey = buildCompositeKey;
 exports.extractWorktreeId = extractWorktreeId;
 exports.extractCliToolId = extractCliToolId;
@@ -21,7 +21,6 @@ exports.getAutoYesState = getAutoYesState;
 exports.setAutoYesEnabled = setAutoYesEnabled;
 exports.disableAutoYes = disableAutoYes;
 exports.clearAllAutoYesStates = clearAllAutoYesStates;
-exports.executeRegexWithTimeout = executeRegexWithTimeout;
 exports.checkStopCondition = checkStopCondition;
 exports.deleteAutoYesState = deleteAutoYesState;
 exports.getAutoYesStateCompositeKeys = getAutoYesStateCompositeKeys;
@@ -230,23 +229,11 @@ function clearAllAutoYesStates() {
 // Stop Condition (Issue #314)
 // =============================================================================
 /**
- * Execute a regex test with timeout protection.
- * Uses synchronous execution with safe-regex2 pre-validation as the primary defense.
- *
- * @internal Exported for testing purposes only.
- * @param regex - Pre-compiled RegExp to test
- * @param text - Text to test against
- * @param _timeoutMs - Reserved for future timeout implementation (default: 100ms)
- * @returns true/false for match result, null if execution failed
+ * Re-exported from the shared auto-yes config (Issue #1547 moved it there so the
+ * client-safe auto-yes resolver can share the same guarded execution path).
  */
-function executeRegexWithTimeout(regex, text, _timeoutMs = 100) {
-    try {
-        return regex.test(text);
-    }
-    catch {
-        return null;
-    }
-}
+var auto_yes_config_2 = require("../config/auto-yes-config");
+Object.defineProperty(exports, "executeRegexWithTimeout", { enumerable: true, get: function () { return auto_yes_config_2.executeRegexWithTimeout; } });
 /**
  * Check if the terminal output matches the stop condition pattern.
  * If matched, disables auto-yes for the worktree/agent.
@@ -279,7 +266,7 @@ function checkStopCondition(compositeKey, cleanOutput, onStopMatched) {
     }
     try {
         const regex = new RegExp(autoYesState.stopPattern);
-        const matched = executeRegexWithTimeout(regex, cleanOutput);
+        const matched = (0, auto_yes_config_1.executeRegexWithTimeout)(regex, cleanOutput);
         if (matched === null) {
             // Execution failed - disable to prevent future errors
             logger.warn('stop-condition-check', { detail: String({ compositeKey }) });

package/dist/server/src/lib/db/db.js

@@ -12,7 +12,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.removeAgentInstance = exports.addAgentInstance = exports.setAgentInstances = exports.countAgentInstances = exports.getAgentInstance = exports.getAgentInstances = exports.deleteSessionState = exports.clearInProgressMessageId = exports.setInProgressMessageId = exports.updateSessionState = exports.getSessionState = exports.getMessagesByDateRange = exports.ACTIVE_FILTER = exports.markPendingPromptsAsAnswered = exports.updatePromptData = exports.getMessageById = exports.recomputeLastUserMessage = exports.clearLastUserMessage = exports.updateLastUserMessage = exports.deleteMessagesByInstance = exports.deleteMessagesByCliTool = exports.deleteMessageById = exports.deleteAllMessages = exports.getLastMessage = exports.getLastUserMessage = exports.getMessages = exports.updateMessageContent = exports.createMessage = exports.getLastAssistantMessageAt = exports.deleteWorktreesByIds = exports.deleteRepositoryWorktrees = exports.migrateWorktreeIdPreservingChildren = exports.getWorktreesByRepository = exports.getWorktreeIdsByRepository = exports.getInitialBranch = exports.saveInitialBranch = exports.updateVibeLocalContextWindow = exports.updateVibeLocalModel = exports.updateSelectedAgents = exports.updateCliToolId = exports.updateStatus = exports.updateFavorite = exports.updateLastViewedAt = exports.updateWorktreeLink = exports.updateWorktreeDescription = exports.upsertWorktree = exports.getWorktreeById = exports.getRepositories = exports.getWorktrees = exports.initDatabase = void 0;
 exports.getAssistantExecutionById = exports.updateAssistantExecution = exports.createAssistantExecution = exports.archiveAssistantMessagesFrom = exports.archiveAllAssistantMessages = exports.getAssistantMessageById = exports.getAssistantMessages = exports.updateAssistantMessageStatus = exports.createAssistantMessage = exports.updateAssistantConversation = exports.createAssistantConversation = exports.getAssistantConversationByRepositoryAndCliTool = exports.getAssistantConversationById = exports.updateDailyReportContent = exports.saveDailyReport = exports.getDailyReport = exports.recoverStuckSendingTimers = exports.clearTimerHistory = exports.cleanupOldTimers = exports.getPendingTimerCountByWorktree = exports.cancelTimersByWorktree = exports.cancelTimer = exports.updateTimerStatus = exports.getPendingTimers = exports.getTimerById = exports.getTimersByWorktree = exports.createTimer = exports.WORKTREE_TODO_STATUSES = exports.isWorktreeTodoStatus = exports.reorderWorktreeTodos = exports.deleteWorktreeTodo = exports.updateWorktreeTodo = exports.createWorktreeTodo = exports.getWorktreeTodoById = exports.getTodosByWorktreeId = exports.deleteTodo = exports.updateTodo = exports.createTodo = exports.getTodoById = exports.getAllTodos = exports.getTodosByRepositoryId = exports.MemoDbError = exports.reorderMemos = exports.deleteMemo = exports.updateMemo = exports.createMemo = exports.getMemoById = exports.getMemosByWorktreeId = exports.InvalidAgentInstanceError = exports.AgentInstanceLimitError = void 0;
-exports.deletePushSubscriptionByEndpoint = exports.updatePushSubscriptionPreferences = exports.getPushSubscriptionsForKind = exports.getAllPushSubscriptions = exports.getPushSubscriptionByEndpoint = exports.upsertPushSubscription = exports.deleteAssistantSessionState = exports.updateAssistantSessionState = exports.getAssistantSessionState = exports.listRunningAssistantExecutions = exports.getRunningAssistantExecutionByConversation = exports.getLatestAssistantExecutionByConversation = void 0;
+exports.listTaskEvents = exports.ACTIVE_TASK_STATUSES = exports.TERMINAL_TASK_STATUSES = exports.TASK_STATUSES = exports.isTerminalTaskStatus = exports.getActiveTaskForInstance = exports.getActiveTask = exports.listTasks = exports.getTask = exports.createTask = exports.VERIFICATION_TRIGGERS = exports.MAX_RUN_HISTORY_DAYS = exports.MAX_RUN_HISTORY_LIMIT = exports.DEFAULT_RUN_HISTORY_LIMIT = exports.listVerificationRunsForPeriod = exports.listRunningVerificationRuns = exports.getRunningVerificationRun = exports.listVerificationRuns = exports.getVerificationRun = exports.finishGateResult = exports.createGateResult = exports.finishVerificationRun = exports.createVerificationRun = exports.deletePushSubscriptionByEndpoint = exports.updatePushSubscriptionPreferences = exports.getPushSubscriptionsForKind = exports.getAllPushSubscriptions = exports.getPushSubscriptionByEndpoint = exports.upsertPushSubscription = exports.deleteAssistantSessionState = exports.updateAssistantSessionState = exports.getAssistantSessionState = exports.listRunningAssistantExecutions = exports.getRunningAssistantExecutionByConversation = exports.getLatestAssistantExecutionByConversation = void 0;
 // init-db
 var init_db_1 = require("./init-db");
 Object.defineProperty(exports, "initDatabase", { enumerable: true, get: function () { return init_db_1.initDatabase; } });
@@ -150,3 +150,36 @@ Object.defineProperty(exports, "getAllPushSubscriptions", { enumerable: true, ge
 Object.defineProperty(exports, "getPushSubscriptionsForKind", { enumerable: true, get: function () { return push_subscriptions_db_1.getPushSubscriptionsForKind; } });
 Object.defineProperty(exports, "updatePushSubscriptionPreferences", { enumerable: true, get: function () { return push_subscriptions_db_1.updatePushSubscriptionPreferences; } });
 Object.defineProperty(exports, "deletePushSubscriptionByEndpoint", { enumerable: true, get: function () { return push_subscriptions_db_1.deletePushSubscriptionByEndpoint; } });
+// verification-db (verification gate runs, Issue #1542)
+var verification_db_1 = require("./verification-db");
+Object.defineProperty(exports, "createVerificationRun", { enumerable: true, get: function () { return verification_db_1.createVerificationRun; } });
+Object.defineProperty(exports, "finishVerificationRun", { enumerable: true, get: function () { return verification_db_1.finishVerificationRun; } });
+Object.defineProperty(exports, "createGateResult", { enumerable: true, get: function () { return verification_db_1.createGateResult; } });
+Object.defineProperty(exports, "finishGateResult", { enumerable: true, get: function () { return verification_db_1.finishGateResult; } });
+Object.defineProperty(exports, "getVerificationRun", { enumerable: true, get: function () { return verification_db_1.getVerificationRun; } });
+Object.defineProperty(exports, "listVerificationRuns", { enumerable: true, get: function () { return verification_db_1.listVerificationRuns; } });
+Object.defineProperty(exports, "getRunningVerificationRun", { enumerable: true, get: function () { return verification_db_1.getRunningVerificationRun; } });
+Object.defineProperty(exports, "listRunningVerificationRuns", { enumerable: true, get: function () { return verification_db_1.listRunningVerificationRuns; } });
+Object.defineProperty(exports, "listVerificationRunsForPeriod", { enumerable: true, get: function () { return verification_db_1.listVerificationRunsForPeriod; } });
+Object.defineProperty(exports, "DEFAULT_RUN_HISTORY_LIMIT", { enumerable: true, get: function () { return verification_db_1.DEFAULT_RUN_HISTORY_LIMIT; } });
+Object.defineProperty(exports, "MAX_RUN_HISTORY_LIMIT", { enumerable: true, get: function () { return verification_db_1.MAX_RUN_HISTORY_LIMIT; } });
+Object.defineProperty(exports, "MAX_RUN_HISTORY_DAYS", { enumerable: true, get: function () { return verification_db_1.MAX_RUN_HISTORY_DAYS; } });
+Object.defineProperty(exports, "VERIFICATION_TRIGGERS", { enumerable: true, get: function () { return verification_db_1.VERIFICATION_TRIGGERS; } });
+// tasks-db (execution contracts, Issue #1545)
+var tasks_db_1 = require("./tasks-db");
+Object.defineProperty(exports, "createTask", { enumerable: true, get: function () { return tasks_db_1.createTask; } });
+Object.defineProperty(exports, "getTask", { enumerable: true, get: function () { return tasks_db_1.getTask; } });
+Object.defineProperty(exports, "listTasks", { enumerable: true, get: function () { return tasks_db_1.listTasks; } });
+Object.defineProperty(exports, "getActiveTask", { enumerable: true, get: function () { return tasks_db_1.getActiveTask; } });
+Object.defineProperty(exports, "getActiveTaskForInstance", { enumerable: true, get: function () { return tasks_db_1.getActiveTaskForInstance; } });
+Object.defineProperty(exports, "isTerminalTaskStatus", { enumerable: true, get: function () { return tasks_db_1.isTerminalTaskStatus; } });
+Object.defineProperty(exports, "TASK_STATUSES", { enumerable: true, get: function () { return tasks_db_1.TASK_STATUSES; } });
+Object.defineProperty(exports, "TERMINAL_TASK_STATUSES", { enumerable: true, get: function () { return tasks_db_1.TERMINAL_TASK_STATUSES; } });
+Object.defineProperty(exports, "ACTIVE_TASK_STATUSES", { enumerable: true, get: function () { return tasks_db_1.ACTIVE_TASK_STATUSES; } });
+// task-events-db (task state machine log, Issue #1548).
+// `updateTaskStatus` and `insertTaskEvent` are intentionally absent from this
+// barrel: `applyTaskEvent` (@/lib/tasks/task-transition-service) is the only
+// writer of either, and reaching around it would put a status in the table with
+// no event explaining it.
+var task_events_db_1 = require("./task-events-db");
+Object.defineProperty(exports, "listTaskEvents", { enumerable: true, get: function () { return task_events_db_1.listTaskEvents; } });

package/dist/server/src/lib/db/migrations/index.js

@@ -31,6 +31,10 @@ const v44_skill_operations_1 = require("./v44-skill-operations");
 const v45_skill_installations_1 = require("./v45-skill-installations");
 const v46_skill_installations_cascade_1 = require("./v46-skill-installations-cascade");
 const v47_skill_installations_roots_1 = require("./v47-skill-installations-roots");
+const v48_skill_operations_audit_index_1 = require("./v48-skill-operations-audit-index");
+const v49_verification_runs_1 = require("./v49-verification-runs");
+const v50_tasks_1 = require("./v50-tasks");
+const v51_task_events_1 = require("./v51-task-events");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -65,4 +69,8 @@ exports.migrations = [
     ...v45_skill_installations_1.v45_migrations,
     ...v46_skill_installations_cascade_1.v46_migrations,
     ...v47_skill_installations_roots_1.v47_migrations,
+    ...v48_skill_operations_audit_index_1.v48_migrations,
+    ...v49_verification_runs_1.v49_migrations,
+    ...v50_tasks_1.v50_migrations,
+    ...v51_task_events_1.v51_migrations,
 ];

package/dist/server/src/lib/db/migrations/runner.js

@@ -17,7 +17,7 @@ const path_1 = __importDefault(require("path"));
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 47;
+exports.CURRENT_SCHEMA_VERSION = 51;
 /**
  * Get current schema version from database
  */

package/dist/server/src/lib/db/migrations/v48-skill-operations-audit-index.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Migration v48: audit version transition and feed indexes (Issue #1248).
+ *
+ * Two things the applied-state dashboard needs that v44 does not provide.
+ *
+ * **`from_version` / `to_version`.** v44 records a single `skill_version`, which
+ * answers "what version was this operation about" but not "what replaced what".
+ * An update is exactly a transition, and reading one out of two adjacent audit
+ * rows is guesswork the log should not require. Both columns are nullable
+ * because the ends of the timeline are genuinely open: an install onto an empty
+ * target has no `from`, an uninstall has no `to`.
+ *
+ * **Feed indexes.** The existing `idx_skill_operations_target` leads with
+ * `worktree_id`, so it cannot serve the dashboard's cross-worktree "newest
+ * first" query, and the "show me only the failures" filter has no index at all.
+ * Both are added here rather than left to a full scan that grows with history —
+ * the table is append-only, so it only ever gets longer.
+ *
+ * `ALTER TABLE ... ADD COLUMN` is DDL and does not fire the v44 append-only
+ * triggers, so existing rows are preserved and read back with NULL transitions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v48_migrations = void 0;
+exports.v48_migrations = [
+    {
+        version: 48,
+        name: 'add-skill-operations-audit-index',
+        up: (db) => {
+            db.exec('ALTER TABLE skill_operations ADD COLUMN from_version TEXT;');
+            db.exec('ALTER TABLE skill_operations ADD COLUMN to_version TEXT;');
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_operations_recent
+          ON skill_operations(recorded_at DESC, id DESC);
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_operations_result
+          ON skill_operations(result, recorded_at DESC);
+      `);
+        },
+        down: (db) => {
+            db.exec('DROP INDEX IF EXISTS idx_skill_operations_result;');
+            db.exec('DROP INDEX IF EXISTS idx_skill_operations_recent;');
+            // SQLite < 3.35 cannot DROP COLUMN; rebuild without the two columns. The
+            // append-only triggers are recreated afterwards: DROP TABLE removes the
+            // triggers bound to the old table, and a log without them is not the log.
+            db.exec('DROP TRIGGER IF EXISTS skill_operations_no_delete;');
+            db.exec('DROP TRIGGER IF EXISTS skill_operations_no_update;');
+            db.exec(`
+        CREATE TABLE skill_operations__v47 (
+          id TEXT PRIMARY KEY,
+          operation_id TEXT NOT NULL,
+          idempotency_key TEXT NOT NULL,
+          binding_hash TEXT NOT NULL,
+          operation TEXT NOT NULL,
+          state TEXT NOT NULL,
+          result TEXT NOT NULL,
+          actor_type TEXT NOT NULL,
+          actor_id TEXT,
+          worktree_id TEXT NOT NULL,
+          skill_id TEXT NOT NULL,
+          skill_version TEXT,
+          source_origin TEXT,
+          source_repository TEXT,
+          source_ref TEXT,
+          source_commit TEXT,
+          artifact_sha256 TEXT,
+          error_code TEXT,
+          error_message TEXT,
+          recorded_at INTEGER NOT NULL
+        );
+      `);
+            db.exec(`
+        INSERT INTO skill_operations__v47 (
+          id, operation_id, idempotency_key, binding_hash, operation, state, result,
+          actor_type, actor_id, worktree_id, skill_id, skill_version,
+          source_origin, source_repository, source_ref, source_commit, artifact_sha256,
+          error_code, error_message, recorded_at
+        )
+        SELECT
+          id, operation_id, idempotency_key, binding_hash, operation, state, result,
+          actor_type, actor_id, worktree_id, skill_id, skill_version,
+          source_origin, source_repository, source_ref, source_commit, artifact_sha256,
+          error_code, error_message, recorded_at
+        FROM skill_operations;
+      `);
+            db.exec('DROP TABLE skill_operations;');
+            db.exec('ALTER TABLE skill_operations__v47 RENAME TO skill_operations;');
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_operations_operation_id
+          ON skill_operations(operation_id);
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_operations_idempotency_key
+          ON skill_operations(idempotency_key);
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_operations_target
+          ON skill_operations(worktree_id, skill_id, recorded_at);
+      `);
+            db.exec(`
+        CREATE TRIGGER IF NOT EXISTS skill_operations_no_update
+        BEFORE UPDATE ON skill_operations
+        BEGIN
+          SELECT RAISE(ABORT, 'skill_operations is append-only');
+        END;
+      `);
+            db.exec(`
+        CREATE TRIGGER IF NOT EXISTS skill_operations_no_delete
+        BEFORE DELETE ON skill_operations
+        BEGIN
+          SELECT RAISE(ABORT, 'skill_operations is append-only');
+        END;
+      `);
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v49-verification-runs.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * Migration v49: verification_runs / verification_gate_results (Issue #1542).
+ *
+ * The first place an *interactive* agent's work gets a recorded verdict.
+ * `execution_logs` already stores status + exit_code + result, but only for
+ * scheduled executions; interactive sessions leave nothing behind but
+ * `chat_messages`, so "the agent finished" has never been distinguishable from
+ * "the agent produced something that passes".
+ *
+ * One run per verification attempt, one gate result per command inside it.
+ * Gate results cascade with their run: a run is the only thing that gives a
+ * gate result meaning, so an orphan row is not a record, it is noise.
+ *
+ * Both status vocabularies are CHECK-constrained rather than validated in the
+ * writer alone. The distinctions they encode are the point of the table and a
+ * typo that lands as a new status value would silently create a bucket nothing
+ * queries:
+ *   run.not_started — the work-evidence gate failed (no commits, no diff);
+ *                     distinct from `failed`, which means the work was judged.
+ *   run.error       — the runner broke before any gate ran (bad config, spawn
+ *                     failure); no verdict was reached about the work at all.
+ *   gate.skipped    — deliberately not run (e.g. skipInPrimaryCheckout); the
+ *                     reason belongs in log_tail so a skip is never mistaken
+ *                     for a pass.
+ *
+ * `task_id` is a free column, not a foreign key: the `tasks` table arrives in
+ * Phase 2 (#1545). Declaring a REFERENCES clause against a table that does not
+ * exist yet would make every insert fail once foreign_keys is ON.
+ *
+ * Timestamps are epoch milliseconds (INTEGER), matching v44 onward.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v49_migrations = void 0;
+exports.v49_migrations = [
+    {
+        version: 49,
+        name: 'add-verification-runs',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS verification_runs (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          worktree_id TEXT NOT NULL,
+          instance_id TEXT,
+          task_id TEXT,
+          trigger TEXT NOT NULL CHECK (trigger IN ('manual','wait','api','task')),
+          status TEXT NOT NULL CHECK (status IN ('running','passed','failed','not_started','error','cancelled')),
+          base_ref TEXT,
+          started_at INTEGER NOT NULL,
+          finished_at INTEGER
+        );
+      `);
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS verification_gate_results (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          run_id INTEGER NOT NULL REFERENCES verification_runs(id) ON DELETE CASCADE,
+          gate_id TEXT NOT NULL,
+          command TEXT NOT NULL,
+          status TEXT NOT NULL CHECK (status IN ('running','passed','failed','timeout','skipped','error')),
+          exit_code INTEGER,
+          duration_ms INTEGER,
+          log_tail TEXT,
+          started_at INTEGER NOT NULL,
+          finished_at INTEGER
+        );
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_verification_runs_worktree
+          ON verification_runs(worktree_id, started_at DESC);
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_verification_gate_results_run
+          ON verification_gate_results(run_id);
+      `);
+        },
+        down: (db) => {
+            // Child first, mirroring the dependency direction. Under
+            // PRAGMA foreign_keys = ON (how db-instance.ts opens the database) the
+            // reverse order also works today, but only because the cascade absorbs
+            // the parent's implicit DELETE — that is a property of the cascade, not
+            // of DROP TABLE.
+            db.exec('DROP TABLE IF EXISTS verification_gate_results;');
+            db.exec('DROP TABLE IF EXISTS verification_runs;');
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v50-tasks.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * Migration v50: tasks (Issue #1545, Phase 2-1).
+ *
+ * The table the execution contract lands in. Until now a message sent to an
+ * agent left only a `chat_messages` row: what the agent was *supposed* to do,
+ * which paths it was allowed to touch, and what would count as done existed
+ * nowhere the system could read back. A task row is that record.
+ *
+ * `contract_json` is a parsed snapshot, not a path to re-read. A contract file
+ * edited after the send must not retroactively change what the running task
+ * agreed to — otherwise "did it meet the contract?" has no fixed answer.
+ * `contract_path` is kept alongside it for provenance only.
+ *
+ * The `status` vocabulary is CHECK-constrained because the distinctions are the
+ * point of the table and a typo landing as a new value would create a bucket
+ * nothing queries:
+ *   pending       — row exists, message not sent yet
+ *   running       — sent; the agent is working
+ *   waiting_input — blocked on a prompt (used by the Phase 3-1 state machine)
+ *   verifying     — a verification run is in flight for this task
+ *   succeeded     — that run came back `passed`
+ *   failed        — the run came back `failed`, or no verdict was reachable
+ *   not_started   — the run came back `not_started` (no work evidence at all)
+ *   cancelled     — abandoned explicitly
+ *
+ * `last_verification_run_id` deliberately carries no REFERENCES clause, for the
+ * same reason `verification_runs.task_id` (v49) does not point here: the two
+ * tables reference each other, so a foreign key in either direction would order
+ * the migrations against themselves. Application code keeps them consistent.
+ *
+ * Timestamps are epoch milliseconds (INTEGER), matching v44 onward.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v50_migrations = void 0;
+exports.v50_migrations = [
+    {
+        version: 50,
+        name: 'add-tasks',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS tasks (
+          id TEXT PRIMARY KEY,
+          worktree_id TEXT NOT NULL,
+          cli_tool_id TEXT NOT NULL,
+          instance_id TEXT,
+          title TEXT NOT NULL,
+          goal TEXT NOT NULL,
+          contract_path TEXT,
+          contract_json TEXT NOT NULL,
+          status TEXT NOT NULL CHECK (status IN ('pending','running','waiting_input','verifying','succeeded','failed','not_started','cancelled')),
+          last_verification_run_id INTEGER,
+          created_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL,
+          started_at INTEGER,
+          finished_at INTEGER
+        );
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_tasks_worktree
+          ON tasks(worktree_id, created_at DESC);
+      `);
+        },
+        down: (db) => {
+            db.exec('DROP TABLE IF EXISTS tasks;');
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v51-task-events.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Migration v51: task_events (Issue #1548, Phase 3-1).
+ *
+ * An append-only log of every attempt to move a task's status. v50 recorded
+ * where a task *is*; this records how it got there — which is what "how many
+ * times did a human have to intervene" and "how many re-instruction loops did
+ * this take" are computed from (Phase 4 Eval). Neither question is answerable
+ * from a status column that only ever holds the latest value.
+ *
+ * `to_status` is nullable on purpose: a rejected transition is written with
+ * `to_status = NULL`. An event the state machine refused is evidence that some
+ * caller believed a transition was possible when it was not, and silently
+ * dropping it would hide exactly the wiring bug worth finding.
+ *
+ * No CHECK constraint on `event`, unlike `tasks.status` in v50. The status
+ * vocabulary is written by many callers and read by queries that branch on it;
+ * events have a single writer (`applyTaskEvent`) whose input is a closed
+ * TypeScript union, so a CHECK here would only add a migration to the cost of
+ * adding an event without closing a hole the type system leaves open.
+ *
+ * No foreign key to `tasks` for the same reason v50's
+ * `last_verification_run_id` has none: this table is history, and history that
+ * disappears when its subject is deleted cannot be audited afterwards.
+ *
+ * Timestamps are epoch milliseconds (INTEGER), matching v44 onward.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v51_migrations = void 0;
+exports.v51_migrations = [
+    {
+        version: 51,
+        name: 'add-task-events',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS task_events (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          task_id TEXT NOT NULL,
+          event TEXT NOT NULL,
+          from_status TEXT NOT NULL,
+          to_status TEXT,
+          payload_json TEXT,
+          created_at INTEGER NOT NULL
+        );
+      `);
+            // (task_id, created_at) is the only read pattern: one task's history in
+            // order. id breaks ties, because same-millisecond events are ordinary —
+            // a rejected transition and its retry can land in the same tick.
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_task_events_task
+          ON task_events(task_id, created_at);
+      `);
+        },
+        down: (db) => {
+            db.exec('DROP TABLE IF EXISTS task_events;');
+        },
+    },
+];

package/dist/server/src/lib/db/task-events-db.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * task_events row I/O (Issue #1548, migration v51).
+ *
+ * `insertTaskEvent` is deliberately NOT re-exported from the `@/lib/db` barrel.
+ * The log is only meaningful if every row was produced by a real state-machine
+ * decision, so the sole writer is `applyTaskEvent`
+ * (`@/lib/tasks/task-transition-service`), which imports this module directly.
+ * A caller reaching for the barrel gets the reader and nothing else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.insertTaskEvent = insertTaskEvent;
+exports.listTaskEvents = listTaskEvents;
+function mapRow(row) {
+    return {
+        id: row.id,
+        taskId: row.task_id,
+        event: row.event,
+        fromStatus: row.from_status,
+        toStatus: row.to_status,
+        payload: row.payload_json === null ? null : JSON.parse(row.payload_json),
+        createdAt: new Date(row.created_at),
+    };
+}
+/** Append one event. See the module comment for why this is not barrel-exported. */
+function insertTaskEvent(db, input) {
+    // An empty payload is stored as NULL rather than '{}': "nothing was attached"
+    // and "an empty object was attached" are the same fact, and one of them makes
+    // the column readable at a glance.
+    const payloadJson = input.payload === undefined || Object.keys(input.payload).length === 0
+        ? null
+        : JSON.stringify(input.payload);
+    const info = db
+        .prepare(`
+      INSERT INTO task_events (task_id, event, from_status, to_status, payload_json, created_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `)
+        .run(input.taskId, input.event, input.fromStatus, input.toStatus, payloadJson, input.createdAt);
+    return Number(info.lastInsertRowid);
+}
+/**
+ * One task's history, oldest first.
+ *
+ * `id ASC` breaks ties rather than leaving same-millisecond rows in an arbitrary
+ * order — a rejected transition and the retry that followed it routinely share a
+ * timestamp, and reading them out of order inverts the story they tell.
+ */
+function listTaskEvents(db, taskId, limit = 200) {
+    const rows = db
+        .prepare(`
+      SELECT id, task_id, event, from_status, to_status, payload_json, created_at
+      FROM task_events
+      WHERE task_id = ?
+      ORDER BY created_at ASC, id ASC
+      LIMIT ?
+    `)
+        .all(taskId, limit);
+    return rows.map(mapRow);
+}