hotsheet 0.15.4 → 0.16.0

package/dist/cli.js

@@ -15053,7 +15053,8 @@ function buildLogWhereClause(filters) {
   }
   if (filters?.search !== void 0 && filters.search !== "") {
     conditions.push(`(summary ILIKE $${paramIdx} OR detail ILIKE $${paramIdx})`);
-    params.push(`%${filters.search}%`);
+    const escaped = filters.search.replace(/[%_\\]/g, "\\$&");
+    params.push(`%${escaped}%`);
     paramIdx++;
   }
   const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
@@ -15337,6 +15338,9 @@ var init_tags = __esm({
 });
 
 // src/db/tickets.ts
+function escapeIlike(value) {
+  return value.replace(/[%_\\]/g, "\\$&");
+}
 async function nextTicketNumber(prefix = "HS") {
   const db = await getDb();
   const result = await db.query("SELECT nextval('ticket_seq')");
@@ -15482,7 +15486,7 @@ function buildTicketWhereClause(filters) {
   }
   if (filters.search !== void 0 && filters.search !== "") {
     conditions.push(`(title ILIKE $${paramIdx} OR details ILIKE $${paramIdx} OR ticket_number ILIKE $${paramIdx} OR tags ILIKE $${paramIdx})`);
-    values.push(`%${filters.search}%`);
+    values.push(`%${escapeIlike(filters.search)}%`);
     paramIdx++;
   }
   const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
@@ -15625,12 +15629,12 @@ async function queryTickets(logic, conditions, sortBy, sortDir, requiredTag, inc
         break;
       case "contains":
         userWhere.push(`${field} ILIKE $${paramIdx}`);
-        values.push(`%${cond.value}%`);
+        values.push(`%${escapeIlike(cond.value)}%`);
         paramIdx++;
         break;
       case "not_contains":
         userWhere.push(`${field} NOT ILIKE $${paramIdx}`);
-        values.push(`%${cond.value}%`);
+        values.push(`%${escapeIlike(cond.value)}%`);
         paramIdx++;
         break;
     }
@@ -16340,7 +16344,7 @@ var init_skills = __esm({
     "use strict";
     init_file_settings();
     init_types();
-    SKILL_VERSION = 7;
+    SKILL_VERSION = 8;
     skillCategories = DEFAULT_CATEGORIES;
     HOTSHEET_ALLOW_PATTERNS = [
       "Bash(curl * http://localhost:417*/api/*)",
@@ -16534,13 +16538,15 @@ async function buildWorkflowInstructions(port, secretHeader) {
   sections.push("");
   sections.push("## Requesting User Feedback");
   sections.push("");
-  sections.push("When you need input from the user before continuing, add a note with a special prefix:");
+  sections.push("When you need input from the user before continuing, add a note where the **entire note text begins** with one of these exact prefixes:");
   sections.push("");
-  sections.push("- **Standard feedback**: Add a note starting with `FEEDBACK NEEDED:` followed by your question");
+  sections.push("- **Standard feedback**: `FEEDBACK NEEDED: Your question here`");
   sections.push(`  \`curl -s -X PATCH http://localhost:${port}/api/tickets/{id} -H "Content-Type: application/json"${secretHeader} -d '{"notes": "FEEDBACK NEEDED: Your question here"}'\``);
-  sections.push("- **Urgent feedback** (auto-selects the ticket in the UI): Use `IMMEDIATE FEEDBACK NEEDED:` instead");
+  sections.push("- **Urgent feedback** (auto-selects the ticket in the UI): `IMMEDIATE FEEDBACK NEEDED: Your question here`");
   sections.push(`  \`curl -s -X PATCH http://localhost:${port}/api/tickets/{id} -H "Content-Type: application/json"${secretHeader} -d '{"notes": "IMMEDIATE FEEDBACK NEEDED: Your urgent question"}'\``);
   sections.push("");
+  sections.push('**IMPORTANT:** The prefix must be the very first characters of the note \u2014 do not add any text before it. The note text sent in the `"notes"` field must start with `FEEDBACK NEEDED:` or `IMMEDIATE FEEDBACK NEEDED:` exactly.');
+  sections.push("");
   sections.push("After adding a feedback note, signal done and wait to be re-triggered. The user will see a dialog prompting them to respond. When they submit feedback, you will be re-triggered with a message indicating the ticket was updated.");
   sections.push("");
   sections.push('Only the most recent note is checked for feedback prefixes. Once the user responds (or clicks "No Response Needed"), the feedback state clears automatically.');
@@ -18121,6 +18127,150 @@ var init_notify = __esm({
   }
 });
 
+// src/routes/validation.ts
+function parseBody(schema, data) {
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    const messages = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).filter((m) => m !== ": ");
+    return { success: false, error: messages.join("; ") || "Invalid request body" };
+  }
+  return { success: true, data: result.data };
+}
+var TicketPrioritySchema, TicketStatusSchema, SortBySchema, SortDirSchema, CreateTicketSchema, UpdateTicketSchema, BatchActionSchema, DuplicateSchema, NotesEditSchema, NotesBulkSchema, QueryTicketsSchema, UpdateSettingsSchema, BackupTierSchema, CreateBackupSchema, RestoreBackupSchema, ShellExecSchema, ShellKillSchema, ChannelTriggerSchema, PermissionRespondSchema, RegisterProjectSchema, ReorderProjectsSchema, CategoryDefSchema, UpdateCategoriesSchema, PrintSchema, GlobalConfigSchema, PluginActionSchema, PluginValidateSchema, PluginSyncScheduleSchema, PluginConflictResolveSchema, PluginInstallSchema, PluginGlobalConfigSchema, ChannelHeartbeatSchema;
+var init_validation = __esm({
+  "src/routes/validation.ts"() {
+    "use strict";
+    init_zod();
+    TicketPrioritySchema = external_exports.enum(["highest", "high", "default", "low", "lowest"]);
+    TicketStatusSchema = external_exports.enum(["not_started", "started", "completed", "verified", "backlog", "archive", "deleted"]);
+    SortBySchema = external_exports.enum(["created", "priority", "category", "status"]);
+    SortDirSchema = external_exports.enum(["asc", "desc"]);
+    CreateTicketSchema = external_exports.object({
+      title: external_exports.string().optional().default(""),
+      defaults: external_exports.object({
+        category: external_exports.string().optional(),
+        priority: TicketPrioritySchema.or(external_exports.literal("")).optional(),
+        status: TicketStatusSchema.or(external_exports.literal("")).optional(),
+        up_next: external_exports.boolean().optional(),
+        details: external_exports.string().optional(),
+        tags: external_exports.string().optional()
+      }).optional()
+    });
+    UpdateTicketSchema = external_exports.object({
+      title: external_exports.string().optional(),
+      details: external_exports.string().optional(),
+      notes: external_exports.string().optional(),
+      tags: external_exports.string().optional(),
+      category: external_exports.string().optional(),
+      priority: TicketPrioritySchema.optional(),
+      status: TicketStatusSchema.optional(),
+      up_next: external_exports.boolean().optional(),
+      last_read_at: external_exports.string().nullable().optional()
+    });
+    BatchActionSchema = external_exports.object({
+      ids: external_exports.array(external_exports.number().int()),
+      action: external_exports.enum(["delete", "restore", "category", "priority", "status", "up_next", "mark_read", "mark_unread"]),
+      value: external_exports.union([external_exports.string(), external_exports.boolean()]).optional()
+    });
+    DuplicateSchema = external_exports.object({
+      ids: external_exports.array(external_exports.number().int())
+    });
+    NotesEditSchema = external_exports.object({
+      text: external_exports.string()
+    });
+    NotesBulkSchema = external_exports.object({
+      notes: external_exports.string()
+    });
+    QueryTicketsSchema = external_exports.object({
+      logic: external_exports.enum(["all", "any"]),
+      conditions: external_exports.array(external_exports.object({
+        field: external_exports.enum(["category", "priority", "status", "title", "details", "up_next", "tags"]),
+        operator: external_exports.enum(["equals", "not_equals", "contains", "not_contains", "lt", "lte", "gt", "gte"]),
+        value: external_exports.string()
+      })),
+      sort_by: external_exports.string().optional(),
+      sort_dir: SortDirSchema.optional(),
+      required_tag: external_exports.string().optional(),
+      include_archived: external_exports.boolean().optional()
+    });
+    UpdateSettingsSchema = external_exports.record(external_exports.string(), external_exports.string());
+    BackupTierSchema = external_exports.enum(["5min", "hourly", "daily"]);
+    CreateBackupSchema = external_exports.object({
+      tier: BackupTierSchema
+    });
+    RestoreBackupSchema = external_exports.object({
+      tier: external_exports.string().min(1),
+      filename: external_exports.string().min(1)
+    });
+    ShellExecSchema = external_exports.object({
+      command: external_exports.string().min(1, "Command cannot be empty"),
+      name: external_exports.string().optional()
+    });
+    ShellKillSchema = external_exports.object({
+      id: external_exports.number().int()
+    });
+    ChannelTriggerSchema = external_exports.object({
+      message: external_exports.string().optional()
+    });
+    PermissionRespondSchema = external_exports.object({
+      request_id: external_exports.string(),
+      behavior: external_exports.enum(["allow", "deny"]),
+      tool_name: external_exports.string().optional()
+    });
+    RegisterProjectSchema = external_exports.object({
+      dataDir: external_exports.string().min(1, "dataDir is required")
+    });
+    ReorderProjectsSchema = external_exports.object({
+      secrets: external_exports.array(external_exports.string())
+    });
+    CategoryDefSchema = external_exports.object({
+      id: external_exports.string().min(1),
+      label: external_exports.string().min(1),
+      shortLabel: external_exports.string().min(1),
+      color: external_exports.string().min(1),
+      shortcutKey: external_exports.string(),
+      description: external_exports.string()
+    }).loose();
+    UpdateCategoriesSchema = external_exports.array(CategoryDefSchema).min(1);
+    PrintSchema = external_exports.object({
+      html: external_exports.string()
+    });
+    GlobalConfigSchema = external_exports.object({
+      channelEnabled: external_exports.boolean().optional(),
+      shareTotalSeconds: external_exports.number().optional(),
+      shareLastPrompted: external_exports.string().optional(),
+      shareAccepted: external_exports.boolean().optional()
+    }).strict();
+    PluginActionSchema = external_exports.object({
+      actionId: external_exports.string(),
+      ticketIds: external_exports.array(external_exports.number().int()).optional(),
+      value: external_exports.unknown().optional()
+    });
+    PluginValidateSchema = external_exports.object({
+      key: external_exports.string(),
+      value: external_exports.string()
+    });
+    PluginSyncScheduleSchema = external_exports.object({
+      interval_minutes: external_exports.number().nullable()
+    });
+    PluginConflictResolveSchema = external_exports.object({
+      plugin_id: external_exports.string().min(1, "plugin_id is required"),
+      resolution: external_exports.enum(["keep_local", "keep_remote"])
+    });
+    PluginInstallSchema = external_exports.object({
+      path: external_exports.string().min(1, "path is required")
+    });
+    PluginGlobalConfigSchema = external_exports.object({
+      key: external_exports.string().min(1, "key is required"),
+      value: external_exports.string()
+    });
+    ChannelHeartbeatSchema = external_exports.object({
+      projectDir: external_exports.string().optional(),
+      state: external_exports.enum(["busy", "idle", "heartbeat"]).optional()
+    });
+  }
+});
+
 // src/channel-config.ts
 var channel_config_exports = {};
 __export(channel_config_exports, {
@@ -18339,6 +18489,129 @@ var init_global_config = __esm({
   }
 });
 
+// src/claude-hooks.ts
+var claude_hooks_exports = {};
+__export(claude_hooks_exports, {
+  installHeartbeatHook: () => installHeartbeatHook,
+  isHeartbeatHookInstalled: () => isHeartbeatHookInstalled,
+  removeHeartbeatHook: () => removeHeartbeatHook
+});
+import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join13 } from "path";
+function getClaudeSettingsPath() {
+  return join13(homedir4(), ".claude", "settings.json");
+}
+function readClaudeSettings() {
+  const path = getClaudeSettingsPath();
+  if (!existsSync11(path)) return {};
+  try {
+    return JSON.parse(readFileSync10(path, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeClaudeSettings(settings) {
+  const path = getClaudeSettingsPath();
+  mkdirSync8(join13(homedir4(), ".claude"), { recursive: true });
+  if (existsSync11(path)) {
+    copyFileSync(path, path + ".bak");
+  }
+  writeFileSync10(path, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+}
+function isHeartbeatHookInstalled() {
+  const settings = readClaudeSettings();
+  if (!settings.hooks) return false;
+  for (const groups of Object.values(settings.hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      if (group.hooks.some((h) => h.command.includes(HOOK_MARKER))) return true;
+    }
+  }
+  return false;
+}
+function makeCommand(port, state) {
+  return `curl -s -X POST http://localhost:${port}/api/channel/heartbeat -H "Content-Type: application/json" -d '{"projectDir":"'$CLAUDE_PROJECT_DIR'","state":"${state}"}' >/dev/null 2>&1 & # ${HOOK_MARKER}`;
+}
+function installHeartbeatHook(port) {
+  if (isHeartbeatHookInstalled()) {
+    updateHeartbeatHookPort(port);
+    return;
+  }
+  const settings = readClaudeSettings();
+  if (!settings.hooks) settings.hooks = {};
+  const hookDefs = [
+    { event: "PostToolUse", state: "heartbeat" },
+    { event: "UserPromptSubmit", state: "busy" },
+    { event: "Stop", state: "idle" }
+  ];
+  for (const def of hookDefs) {
+    if (!Array.isArray(settings.hooks[def.event])) settings.hooks[def.event] = [];
+    settings.hooks[def.event].push({
+      hooks: [{ "//": "Hot Sheet", type: "command", command: makeCommand(port, def.state), timeout: 5 }]
+    });
+  }
+  writeClaudeSettings(settings);
+  console.log("[hooks] Installed Claude Code hooks (PostToolUse, UserPromptSubmit, Stop)");
+}
+function updateHeartbeatHookPort(port) {
+  const settings = readClaudeSettings();
+  if (!settings.hooks) return;
+  let changed = false;
+  for (const groups of Object.values(settings.hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      for (const hook of group.hooks) {
+        if (hook.command.includes(HOOK_MARKER)) {
+          const updated = hook.command.replace(/localhost:\d+/, `localhost:${port}`);
+          if (updated !== hook.command) {
+            hook.command = updated;
+            changed = true;
+          }
+          if (hook["//"] === void 0) {
+            hook["//"] = "Hot Sheet";
+            changed = true;
+          }
+        }
+      }
+    }
+  }
+  if (changed) {
+    writeClaudeSettings(settings);
+    console.log(`[hooks] Updated heartbeat hook port to ${port}`);
+  }
+}
+function removeHeartbeatHook() {
+  const settings = readClaudeSettings();
+  if (!settings.hooks) return;
+  let changed = false;
+  for (const [event, groups] of Object.entries(settings.hooks)) {
+    if (!Array.isArray(groups)) continue;
+    const filtered = groups.filter(
+      (group) => !group.hooks.some((h) => h.command.includes(HOOK_MARKER))
+    );
+    if (filtered.length !== groups.length) {
+      changed = true;
+      if (filtered.length === 0) {
+        Reflect.deleteProperty(settings.hooks, event);
+      } else {
+        settings.hooks[event] = filtered;
+      }
+    }
+  }
+  if (!changed) return;
+  if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
+  writeClaudeSettings(settings);
+  console.log("[hooks] Removed Claude Code heartbeat hooks");
+}
+var HOOK_MARKER;
+var init_claude_hooks = __esm({
+  "src/claude-hooks.ts"() {
+    "use strict";
+    HOOK_MARKER = "hotsheet-heartbeat";
+  }
+});
+
 // src/db/sync.ts
 async function getSyncRecord(ticketId, pluginId) {
   const db = await getDb();
@@ -18629,6 +18902,7 @@ var init_keychain = __esm({
 // src/plugins/loader.ts
 var loader_exports = {};
 __export(loader_exports, {
+  compareSemver: () => compareSemver,
   disablePlugin: () => disablePlugin,
   discoverPlugins: () => discoverPlugins,
   dismissBundledPlugin: () => dismissBundledPlugin,
@@ -18651,10 +18925,19 @@ __export(loader_exports, {
   unloadAllPlugins: () => unloadAllPlugins,
   unregisterPlugin: () => unregisterPlugin
 });
-import { cpSync, existsSync as existsSync12, mkdirSync as mkdirSync8, readdirSync as readdirSync3, readFileSync as readFileSync10, rmSync as rmSync7, statSync as statSync2, writeFileSync as writeFileSync11 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname3, join as join14 } from "path";
+import { cpSync, existsSync as existsSync13, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync11, rmSync as rmSync7, statSync as statSync2, writeFileSync as writeFileSync12 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname3, join as join15 } from "path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
+function compareSemver(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) < (pb[i] || 0)) return -1;
+    if ((pa[i] || 0) > (pb[i] || 0)) return 1;
+  }
+  return 0;
+}
 function getConfigLabelOverride(pluginId, labelId) {
   return configLabelOverrides.get(`${pluginId}:${labelId}`);
 }
@@ -18686,15 +18969,15 @@ function getAllBackends() {
   return getLoadedPlugins().filter((p) => p.backend !== null && p.enabled).map((p) => p.backend);
 }
 function getPluginDir() {
-  return join14(homedir5(), ".hotsheet", "plugins");
+  return join15(homedir6(), ".hotsheet", "plugins");
 }
 function discoverPlugins() {
   const pluginDir = getPluginDir();
-  if (!existsSync12(pluginDir)) return [];
+  if (!existsSync13(pluginDir)) return [];
   const results = [];
   for (const entry of readdirSync3(pluginDir, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-    const pluginPath = join14(pluginDir, entry.name);
+    const pluginPath = join15(pluginDir, entry.name);
     if (entry.isSymbolicLink()) {
       try {
         if (!statSync2(pluginPath).isDirectory()) continue;
@@ -18708,20 +18991,20 @@ function discoverPlugins() {
   return results;
 }
 function readManifest(pluginPath) {
-  const manifestPath = join14(pluginPath, "manifest.json");
-  if (existsSync12(manifestPath)) {
+  const manifestPath = join15(pluginPath, "manifest.json");
+  if (existsSync13(manifestPath)) {
     try {
-      const raw = JSON.parse(readFileSync10(manifestPath, "utf-8"));
+      const raw = JSON.parse(readFileSync11(manifestPath, "utf-8"));
       return validateManifest(raw);
     } catch (e) {
       console.warn(`[plugins] Invalid manifest.json in ${pluginPath}: ${getErrorMessage(e)}`);
       return null;
     }
   }
-  const pkgPath = join14(pluginPath, "package.json");
-  if (existsSync12(pkgPath)) {
+  const pkgPath = join15(pluginPath, "package.json");
+  if (existsSync13(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
       const hotsheet = pkg.hotsheet;
       if (hotsheet != null) {
         const author = pkg.author;
@@ -18747,13 +19030,13 @@ function validateManifest(raw) {
   return result.data;
 }
 function getDismissedPluginsPath() {
-  return join14(homedir5(), ".hotsheet", "dismissed-plugins.json");
+  return join15(homedir6(), ".hotsheet", "dismissed-plugins.json");
 }
 function getDismissedPlugins() {
   const path = getDismissedPluginsPath();
-  if (!existsSync12(path)) return /* @__PURE__ */ new Set();
+  if (!existsSync13(path)) return /* @__PURE__ */ new Set();
   try {
-    const result = external_exports.array(external_exports.string()).safeParse(JSON.parse(readFileSync10(path, "utf-8")));
+    const result = external_exports.array(external_exports.string()).safeParse(JSON.parse(readFileSync11(path, "utf-8")));
     return result.success ? new Set(result.data) : /* @__PURE__ */ new Set();
   } catch {
     return /* @__PURE__ */ new Set();
@@ -18763,19 +19046,19 @@ function dismissBundledPlugin(pluginId) {
   const dismissed = getDismissedPlugins();
   dismissed.add(pluginId);
   const path = getDismissedPluginsPath();
-  mkdirSync8(dirname3(path), { recursive: true });
-  writeFileSync11(path, JSON.stringify([...dismissed]));
+  mkdirSync9(dirname3(path), { recursive: true });
+  writeFileSync12(path, JSON.stringify([...dismissed]));
 }
 function undismissBundledPlugin(pluginId) {
   const dismissed = getDismissedPlugins();
   dismissed.delete(pluginId);
-  writeFileSync11(getDismissedPluginsPath(), JSON.stringify([...dismissed]));
+  writeFileSync12(getDismissedPluginsPath(), JSON.stringify([...dismissed]));
 }
 function getBundledDir() {
   const selfDir = dirname3(fileURLToPath2(import.meta.url));
-  let bundledDir = join14(selfDir, "plugins");
-  if (!existsSync12(bundledDir)) bundledDir = join14(process.cwd(), "dist", "plugins");
-  return existsSync12(bundledDir) ? bundledDir : null;
+  let bundledDir = join15(selfDir, "plugins");
+  if (!existsSync13(bundledDir)) bundledDir = join15(process.cwd(), "dist", "plugins");
+  return existsSync13(bundledDir) ? bundledDir : null;
 }
 function listBundledPlugins() {
   const bundledDir = getBundledDir();
@@ -18784,7 +19067,7 @@ function listBundledPlugins() {
   const results = [];
   for (const entry of readdirSync3(bundledDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const manifest = readManifest(join14(bundledDir, entry.name));
+    const manifest = readManifest(join15(bundledDir, entry.name));
     if (!manifest) continue;
     results.push({
       manifest,
@@ -18798,15 +19081,15 @@ function installBundledPlugin(pluginId) {
   const bundledDir = getBundledDir();
   if (bundledDir == null) return false;
   const pluginDir = getPluginDir();
-  mkdirSync8(pluginDir, { recursive: true });
+  mkdirSync9(pluginDir, { recursive: true });
   for (const entry of readdirSync3(bundledDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const manifest = readManifest(join14(bundledDir, entry.name));
+    const manifest = readManifest(join15(bundledDir, entry.name));
     if (!manifest || manifest.id !== pluginId) continue;
-    const targetPath = join14(pluginDir, entry.name);
+    const targetPath = join15(pluginDir, entry.name);
     try {
-      if (existsSync12(targetPath)) rmSync7(targetPath, { recursive: true, force: true });
-      cpSync(join14(bundledDir, entry.name), targetPath, { recursive: true, force: true });
+      if (existsSync13(targetPath)) rmSync7(targetPath, { recursive: true, force: true });
+      cpSync(join15(bundledDir, entry.name), targetPath, { recursive: true, force: true });
       undismissBundledPlugin(pluginId);
       console.log(`[plugins] Installed bundled plugin: ${manifest.name}`);
       return true;
@@ -18821,21 +19104,21 @@ function installBundledPlugins() {
   const bundledDir = getBundledDir();
   if (bundledDir == null) return;
   const pluginDir = getPluginDir();
-  mkdirSync8(pluginDir, { recursive: true });
+  mkdirSync9(pluginDir, { recursive: true });
   const dismissed = getDismissedPlugins();
   for (const entry of readdirSync3(bundledDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const bundledManifestCheck = readManifest(join14(bundledDir, entry.name));
+    const bundledManifestCheck = readManifest(join15(bundledDir, entry.name));
     if (bundledManifestCheck && dismissed.has(bundledManifestCheck.id)) continue;
-    const targetPath = join14(pluginDir, entry.name);
-    const sourcePath = join14(bundledDir, entry.name);
-    if (existsSync12(targetPath)) {
+    const targetPath = join15(pluginDir, entry.name);
+    const sourcePath = join15(bundledDir, entry.name);
+    if (existsSync13(targetPath)) {
       const installedManifest = readManifest(targetPath);
       const bundledManifest = readManifest(sourcePath);
       if (installedManifest && bundledManifest) {
         const entryFile = installedManifest.entry ?? "index.js";
-        const entryExists = existsSync12(join14(targetPath, entryFile));
-        if (entryExists && installedManifest.version >= bundledManifest.version) {
+        const entryExists = existsSync13(join15(targetPath, entryFile));
+        if (entryExists && compareSemver(installedManifest.version, bundledManifest.version) >= 0) {
           continue;
         }
       }
@@ -18864,8 +19147,8 @@ async function loadAllPlugins(enabledPlugins) {
 }
 async function loadPlugin(pluginPath, manifest, enabled) {
   const entry = manifest.entry ?? "index.js";
-  const entryPath = join14(pluginPath, entry);
-  if (!existsSync12(entryPath)) {
+  const entryPath = join15(pluginPath, entry);
+  if (!existsSync13(entryPath)) {
     console.warn(`[plugins] Plugin ${manifest.id}: entry point ${entry} not found`);
     loadedPlugins.set(manifest.id, {
       manifest,
@@ -18916,13 +19199,13 @@ async function loadPlugin(pluginPath, manifest, enabled) {
   }
 }
 function getGlobalConfigPath() {
-  return join14(homedir5(), ".hotsheet", "plugin-config.json");
+  return join15(homedir6(), ".hotsheet", "plugin-config.json");
 }
 function readGlobalConfig2() {
   const configPath = getGlobalConfigPath();
-  if (!existsSync12(configPath)) return {};
+  if (!existsSync13(configPath)) return {};
   try {
-    const result = external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.string()).optional()).safeParse(JSON.parse(readFileSync10(configPath, "utf-8")));
+    const result = external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.string()).optional()).safeParse(JSON.parse(readFileSync11(configPath, "utf-8")));
     return result.success ? result.data : {};
   } catch {
     return {};
@@ -18930,8 +19213,8 @@ function readGlobalConfig2() {
 }
 function writeGlobalConfig2(config2) {
   const configPath = getGlobalConfigPath();
-  mkdirSync8(dirname3(configPath), { recursive: true });
-  writeFileSync11(configPath, JSON.stringify(config2, null, 2));
+  mkdirSync9(dirname3(configPath), { recursive: true });
+  writeFileSync12(configPath, JSON.stringify(config2, null, 2));
 }
 function getGlobalPluginSetting(pluginId, key) {
   const config2 = readGlobalConfig2();
@@ -19401,29 +19684,11 @@ async function syncSingleTicketContent(backend, ticketId, remoteId) {
     }
   }
 }
-async function syncTicketComments(backend, ticketId, remoteId) {
-  if (!backend.getComments) return;
-  const ticket = await getTicket(ticketId);
-  if (!ticket) return;
-  const localNotes = parseNotes(ticket.notes);
-  let remoteComments;
-  try {
-    remoteComments = await backend.getComments(remoteId);
-  } catch (e) {
-    const msg = getErrorMessage(e);
-    if (msg.includes("404") || msg.includes("410") || msg.includes("Not Found")) {
-      throw e;
-    }
-    return;
-  }
-  const mappings = await getNoteSyncRecords(ticketId, backend.id);
-  const noteIdToMapping = new Map(mappings.map((m) => [m.note_id, m]));
-  const isAttMapping = (noteId2) => noteId2.startsWith("att_");
-  let changed = false;
-  const localNoteById = new Map(localNotes.map((n) => [n.id, n]));
-  const remoteCommentById = new Map(remoteComments.map((c) => [c.id, c]));
+async function reconcileExistingMappings(ctx) {
+  const { backend, ticketId, remoteId, localNotes, localNoteById, mappings } = ctx;
+  const remoteCommentById = new Map(ctx.remoteComments.map((c) => [c.id, c]));
   for (const mapping of mappings) {
-    if (isAttMapping(mapping.note_id)) continue;
+    if (mapping.note_id.startsWith("att_")) continue;
     const localNote = localNoteById.get(mapping.note_id);
     const remoteComment = remoteCommentById.get(mapping.remote_comment_id);
     const base = mapping.last_synced_text ?? null;
@@ -19447,7 +19712,7 @@ async function syncTicketComments(backend, ticketId, remoteId) {
         }
       } else if (remoteChanged && !localChanged) {
         localNote.text = remoteText;
-        changed = true;
+        ctx.changed = true;
         await upsertNoteSyncRecord(ticketId, mapping.note_id, backend.id, mapping.remote_comment_id, remoteText);
       } else if (localChanged && remoteChanged) {
         if (backend.updateComment) {
@@ -19479,21 +19744,22 @@ async function syncTicketComments(backend, ticketId, remoteId) {
       if (idx >= 0) {
         localNotes.splice(idx, 1);
         localNoteById.delete(mapping.note_id);
-        changed = true;
+        ctx.changed = true;
       }
       await deleteNoteSyncRecord(ticketId, mapping.note_id, backend.id);
       continue;
     }
     await deleteNoteSyncRecord(ticketId, mapping.note_id, backend.id);
   }
+}
+async function pullNewRemoteComments(ctx) {
+  const { backend, ticketId, localNotes, localNoteById, remoteComments, mappings, noteIdToMapping } = ctx;
   const mappedRemoteIds = new Set(mappings.map((m) => m.remote_comment_id));
   const localTexts = new Set(localNotes.map((n) => n.text.trim()));
   for (const comment of remoteComments) {
     if (mappedRemoteIds.has(comment.id)) continue;
     if (localTexts.has(comment.text.trim())) {
-      const existing = localNotes.find(
-        (n) => n.text.trim() === comment.text.trim() && !noteIdToMapping.has(n.id)
-      );
+      const existing = localNotes.find((n) => n.text.trim() === comment.text.trim() && !noteIdToMapping.has(n.id));
       if (existing) {
         await upsertNoteSyncRecord(ticketId, existing.id, backend.id, comment.id, existing.text);
         noteIdToMapping.set(existing.id, {
@@ -19513,21 +19779,22 @@ async function syncTicketComments(backend, ticketId, remoteId) {
     localNoteById.set(noteId2, localNotes[localNotes.length - 1]);
     await upsertNoteSyncRecord(ticketId, noteId2, backend.id, comment.id, comment.text);
     localTexts.add(comment.text.trim());
-    changed = true;
+    ctx.changed = true;
   }
+}
+async function pushNewLocalNotes(ctx) {
+  const { backend, ticketId, remoteId, localNotes, remoteComments, mappings, noteIdToMapping } = ctx;
   const remoteTexts = new Set(remoteComments.map((c) => c.text.trim()));
   const mappedRemoteIdsAfterPull = /* @__PURE__ */ new Set([
-    ...mappedRemoteIds,
+    ...mappings.map((m) => m.remote_comment_id),
     ...Array.from(noteIdToMapping.values()).map((m) => m.remote_comment_id)
   ]);
   for (const note of localNotes) {
-    if (isAttMapping(note.id)) continue;
+    if (note.id.startsWith("att_")) continue;
     if (noteIdToMapping.has(note.id)) continue;
     if (!backend.createComment) continue;
     if (remoteTexts.has(note.text.trim())) {
-      const existing = remoteComments.find(
-        (c) => c.text.trim() === note.text.trim() && !mappedRemoteIdsAfterPull.has(c.id)
-      );
+      const existing = remoteComments.find((c) => c.text.trim() === note.text.trim() && !mappedRemoteIdsAfterPull.has(c.id));
       if (existing) {
         await upsertNoteSyncRecord(ticketId, note.id, backend.id, existing.id, note.text);
         mappedRemoteIdsAfterPull.add(existing.id);
@@ -19543,7 +19810,36 @@ async function syncTicketComments(backend, ticketId, remoteId) {
       console.warn(`[sync] Failed to push note ${note.id} for ticket ${ticketId}: ${getErrorMessage(e)}`);
     }
   }
-  if (changed) {
+}
+async function syncTicketComments(backend, ticketId, remoteId) {
+  if (!backend.getComments) return;
+  const ticket = await getTicket(ticketId);
+  if (!ticket) return;
+  const localNotes = parseNotes(ticket.notes);
+  let remoteComments;
+  try {
+    remoteComments = await backend.getComments(remoteId);
+  } catch (e) {
+    const msg = getErrorMessage(e);
+    if (msg.includes("404") || msg.includes("410") || msg.includes("Not Found")) throw e;
+    return;
+  }
+  const mappings = await getNoteSyncRecords(ticketId, backend.id);
+  const ctx = {
+    backend,
+    ticketId,
+    remoteId,
+    localNotes,
+    remoteComments,
+    mappings,
+    localNoteById: new Map(localNotes.map((n) => [n.id, n])),
+    noteIdToMapping: new Map(mappings.map((m) => [m.note_id, m])),
+    changed: false
+  };
+  await reconcileExistingMappings(ctx);
+  await pullNewRemoteComments(ctx);
+  await pushNewLocalNotes(ctx);
+  if (ctx.changed) {
     const { getDb: getDbForNotes } = await Promise.resolve().then(() => (init_connection(), connection_exports));
     const db = await getDbForNotes();
     await db.query("UPDATE tickets SET notes = $1 WHERE id = $2", [JSON.stringify(localNotes), ticketId]);
@@ -19585,8 +19881,8 @@ async function syncTicketAttachments(backend, ticketId, remoteId) {
     const attSyncId = `att_${att.id}`;
     if (syncedAttIds.has(attSyncId)) continue;
     try {
-      const { readFileSync: readFileSync14 } = await import("fs");
-      const content = readFileSync14(att.stored_path);
+      const { readFileSync: readFileSync15 } = await import("fs");
+      const content = readFileSync15(att.stored_path);
       const ext = att.original_filename.split(".").pop()?.toLowerCase() ?? "";
       const { getMimeType: getMimeType2 } = await Promise.resolve().then(() => (init_mime_types(), mime_types_exports));
       const mimeType = getMimeType2(ext);
@@ -19649,10 +19945,10 @@ __export(plugins_exports, {
   isPluginEnabledForProject: () => isPluginEnabledForProject,
   pluginRoutes: () => pluginRoutes
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync11, rmSync as rmSync8, symlinkSync } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync10, readFileSync as readFileSync12, rmSync as rmSync8, symlinkSync } from "fs";
 import { Hono as Hono5 } from "hono";
-import { homedir as homedir6 } from "os";
-import { basename as basename2, join as join15 } from "path";
+import { homedir as homedir7 } from "os";
+import { basename as basename2, join as join16 } from "path";
 async function getActivatedBackend(pluginId) {
   await reactivatePlugin(pluginId);
   const plugin = getPluginById(pluginId);
@@ -19746,6 +20042,7 @@ var init_plugins = __esm({
     init_errorMessage();
     init_helpers();
     init_notify();
+    init_validation();
     pluginRoutes = new Hono5();
     pluginRoutes.get("/plugins", async (c) => {
       const loaded = getLoadedPlugins();
@@ -19784,7 +20081,10 @@ var init_plugins = __esm({
       let plugin = getPluginById(pluginId);
       if (!plugin) return c.json({ error: "Plugin not found" }, 404);
       if (!plugin.instance.onAction) return c.json({ error: "Plugin does not handle actions" }, 400);
-      const body = await c.req.json();
+      const raw = await c.req.json();
+      const parsed = parseBody(PluginActionSchema, raw);
+      if (!parsed.success) return c.json({ error: parsed.error }, 400);
+      const body = parsed.data;
       await reactivatePlugin(pluginId);
       plugin = getPluginById(pluginId);
       if (!plugin.instance.onAction) return c.json({ error: "Plugin does not handle actions" }, 400);
@@ -19802,7 +20102,10 @@ var init_plugins = __esm({
     pluginRoutes.post("/plugins/validate/:id", async (c) => {
       const plugin = getPluginById(c.req.param("id"));
       if (!plugin?.instance.validateField) return c.json(null);
-      const body = await c.req.json();
+      const raw = await c.req.json();
+      const parsed = parseBody(PluginValidateSchema, raw);
+      if (!parsed.success) return c.json({ error: parsed.error }, 400);
+      const body = parsed.data;
       try {
         const result = await plugin.instance.validateField(body.key, body.value);
         return c.json(result);
@@ -19976,7 +20279,10 @@ var init_plugins = __esm({
       const pluginId = c.req.param("id");
       const plugin = getPluginById(pluginId);
       if (!plugin) return c.json({ error: "Plugin not found" }, 404);
-      const body = await c.req.json();
+      const raw = await c.req.json();
+      const parsed = parseBody(PluginSyncScheduleSchema, raw);
+      if (!parsed.success) return c.json({ error: parsed.error }, 400);
+      const body = parsed.data;
       if (body.interval_minutes === null || body.interval_minutes === 0) {
         stopScheduledSync(pluginId);
         return c.json({ ok: true, scheduled: false });
@@ -20019,26 +20325,27 @@ var init_plugins = __esm({
     pluginRoutes.post("/sync/conflicts/:ticketId/resolve", async (c) => {
       const ticketId = parseIntParam(c, "ticketId");
       if (ticketId === null) return c.json({ error: "Invalid ticket ID" }, 400);
-      const body = await c.req.json();
-      if (body.plugin_id == null || body.plugin_id === "" || body.resolution == null) {
-        return c.json({ error: "plugin_id and resolution required" }, 400);
-      }
-      await resolveConflict(ticketId, body.plugin_id, body.resolution);
+      const raw = await c.req.json();
+      const parsed = parseBody(PluginConflictResolveSchema, raw);
+      if (!parsed.success) return c.json({ error: parsed.error }, 400);
+      await resolveConflict(ticketId, parsed.data.plugin_id, parsed.data.resolution);
       return c.json({ ok: true });
     });
     pluginRoutes.post("/plugins/install", async (c) => {
-      const body = await c.req.json();
-      if (body.path == null || body.path === "") return c.json({ error: "path is required" }, 400);
+      const raw = await c.req.json();
+      const parsed = parseBody(PluginInstallSchema, raw);
+      if (!parsed.success) return c.json({ error: parsed.error }, 400);
+      const body = parsed.data;
       const sourcePath = body.path;
-      if (!existsSync13(sourcePath)) {
+      if (!existsSync14(sourcePath)) {
         return c.json({ error: `Path does not exist: ${sourcePath}` }, 400);
       }
-      const hasManifest = existsSync13(join15(sourcePath, "manifest.json"));
+      const hasManifest = existsSync14(join16(sourcePath, "manifest.json"));
       const hasPkgHotsheet = (() => {
-        const pkgPath = join15(sourcePath, "package.json");
-        if (!existsSync13(pkgPath)) return false;
+        const pkgPath = join16(sourcePath, "package.json");
+        if (!existsSync14(pkgPath)) return false;
         try {
-          const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
+          const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
           return pkg.hotsheet !== void 0;
         } catch {
           return false;
@@ -20047,11 +20354,11 @@ var init_plugins = __esm({
       if (!hasManifest && !hasPkgHotsheet) {
         return c.json({ error: "Directory must contain manifest.json or package.json with hotsheet field" }, 400);
       }
-      const pluginsDir = join15(homedir6(), ".hotsheet", "plugins");
-      mkdirSync9(pluginsDir, { recursive: true });
+      const pluginsDir = join16(homedir7(), ".hotsheet", "plugins");
+      mkdirSync10(pluginsDir, { recursive: true });
       const linkName = basename2(sourcePath);
-      const linkPath = join15(pluginsDir, linkName);
-      if (existsSync13(linkPath)) {
+      const linkPath = join16(pluginsDir, linkName);
+      if (existsSync14(linkPath)) {
         return c.json({ error: `Plugin already exists at ${linkPath}` }, 400);
       }
       try {
@@ -20069,14 +20376,14 @@ var init_plugins = __esm({
       if (plugin?.enabled === true) {
         await disablePlugin(pluginId);
       }
-      const pluginsDir = join15(homedir6(), ".hotsheet", "plugins");
+      const pluginsDir = join16(homedir7(), ".hotsheet", "plugins");
       const candidates = [
         plugin?.path,
-        join15(pluginsDir, pluginId)
+        join16(pluginsDir, pluginId)
       ].filter((p) => p !== void 0);
       let removed = false;
       for (const candidate of candidates) {
-        if (existsSync13(candidate)) {
+        if (existsSync14(candidate)) {
           try {
             rmSync8(candidate, { recursive: true, force: true });
             removed = true;
@@ -20108,8 +20415,10 @@ var init_plugins = __esm({
     });
     pluginRoutes.post("/plugins/:id/global-config", async (c) => {
       const pluginId = c.req.param("id");
-      const body = await c.req.json();
-      if (body.key == null || body.key === "") return c.json({ error: "key is required" }, 400);
+      const raw = await c.req.json();
+      const parsed = parseBody(PluginGlobalConfigSchema, raw);
+      if (!parsed.success) return c.json({ error: parsed.error }, 400);
+      const body = parsed.data;
       const plugin = getPluginById(pluginId);
       const isSecret = plugin?.manifest.preferences?.find((p) => p.key === body.key)?.secret === true;
       if (isSecret) {
@@ -20178,9 +20487,9 @@ var init_plugins = __esm({
 // src/cli.ts
 init_backup();
 import { execFile as execFile3 } from "child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync12 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join18, resolve as resolve8 } from "path";
+import { join as join19, resolve as resolve8 } from "path";
 
 // src/cleanup.ts
 init_queries();
@@ -20338,9 +20647,9 @@ init_mime_types();
 init_projects();
 import { serve } from "@hono/node-server";
 import { execFile as execFile2 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync13 } from "fs";
 import { Hono as Hono13 } from "hono";
-import { basename as basename3, dirname as dirname4, join as join16 } from "path";
+import { basename as basename3, dirname as dirname4, join as join17 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/routes/api.ts
@@ -20375,8 +20684,8 @@ attachmentRoutes.post("/tickets/:id/attachments", async (c) => {
   mkdirSync6(attachDir, { recursive: true });
   const storedPath = join10(attachDir, storedName);
   const buffer = Buffer.from(await file2.arrayBuffer());
-  const { writeFileSync: writeFileSync13 } = await import("fs");
-  writeFileSync13(storedPath, buffer);
+  const { writeFileSync: writeFileSync14 } = await import("fs");
+  writeFileSync14(storedPath, buffer);
   const attachment = await addAttachment(id, originalName, storedPath);
   notifyMutation(c.get("dataDir"));
   return c.json(attachment, 201);
@@ -20413,8 +20722,8 @@ attachmentRoutes.get("/attachments/file/*", async (c) => {
   if (!existsSync8(fullPath)) {
     return c.json({ error: "File not found" }, 404);
   }
-  const { readFileSync: readFileSync14 } = await import("fs");
-  const content = readFileSync14(fullPath);
+  const { readFileSync: readFileSync15 } = await import("fs");
+  const content = readFileSync15(fullPath);
   const ext = extname(fullPath).toLowerCase();
   const contentType = getMimeType(ext);
   return new Response(content, {
@@ -20426,120 +20735,8 @@ attachmentRoutes.get("/attachments/file/*", async (c) => {
 init_commandLog();
 init_settings();
 init_notify();
+init_validation();
 import { Hono as Hono2 } from "hono";
-
-// src/routes/validation.ts
-init_zod();
-var TicketPrioritySchema = external_exports.enum(["highest", "high", "default", "low", "lowest"]);
-var TicketStatusSchema = external_exports.enum(["not_started", "started", "completed", "verified", "backlog", "archive", "deleted"]);
-var SortBySchema = external_exports.enum(["created", "priority", "category", "status"]);
-var SortDirSchema = external_exports.enum(["asc", "desc"]);
-var CreateTicketSchema = external_exports.object({
-  title: external_exports.string().optional().default(""),
-  defaults: external_exports.object({
-    category: external_exports.string().optional(),
-    priority: TicketPrioritySchema.or(external_exports.literal("")).optional(),
-    status: TicketStatusSchema.or(external_exports.literal("")).optional(),
-    up_next: external_exports.boolean().optional(),
-    details: external_exports.string().optional(),
-    tags: external_exports.string().optional()
-  }).optional()
-});
-var UpdateTicketSchema = external_exports.object({
-  title: external_exports.string().optional(),
-  details: external_exports.string().optional(),
-  notes: external_exports.string().optional(),
-  tags: external_exports.string().optional(),
-  category: external_exports.string().optional(),
-  priority: TicketPrioritySchema.optional(),
-  status: TicketStatusSchema.optional(),
-  up_next: external_exports.boolean().optional(),
-  last_read_at: external_exports.string().nullable().optional()
-});
-var BatchActionSchema = external_exports.object({
-  ids: external_exports.array(external_exports.number().int()),
-  action: external_exports.enum(["delete", "restore", "category", "priority", "status", "up_next", "mark_read", "mark_unread"]),
-  value: external_exports.union([external_exports.string(), external_exports.boolean()]).optional()
-});
-var DuplicateSchema = external_exports.object({
-  ids: external_exports.array(external_exports.number().int())
-});
-var NotesEditSchema = external_exports.object({
-  text: external_exports.string()
-});
-var NotesBulkSchema = external_exports.object({
-  notes: external_exports.string()
-});
-var QueryTicketsSchema = external_exports.object({
-  logic: external_exports.enum(["all", "any"]),
-  conditions: external_exports.array(external_exports.object({
-    field: external_exports.enum(["category", "priority", "status", "title", "details", "up_next", "tags"]),
-    operator: external_exports.enum(["equals", "not_equals", "contains", "not_contains", "lt", "lte", "gt", "gte"]),
-    value: external_exports.string()
-  })),
-  sort_by: external_exports.string().optional(),
-  sort_dir: SortDirSchema.optional(),
-  required_tag: external_exports.string().optional(),
-  include_archived: external_exports.boolean().optional()
-});
-var UpdateSettingsSchema = external_exports.record(external_exports.string(), external_exports.string());
-var BackupTierSchema = external_exports.enum(["5min", "hourly", "daily"]);
-var CreateBackupSchema = external_exports.object({
-  tier: BackupTierSchema
-});
-var RestoreBackupSchema = external_exports.object({
-  tier: external_exports.string().min(1),
-  filename: external_exports.string().min(1)
-});
-var ShellExecSchema = external_exports.object({
-  command: external_exports.string().min(1, "Command cannot be empty"),
-  name: external_exports.string().optional()
-});
-var ShellKillSchema = external_exports.object({
-  id: external_exports.number().int()
-});
-var ChannelTriggerSchema = external_exports.object({
-  message: external_exports.string().optional()
-});
-var PermissionRespondSchema = external_exports.object({
-  request_id: external_exports.string(),
-  behavior: external_exports.enum(["allow", "deny"]),
-  tool_name: external_exports.string().optional()
-});
-var RegisterProjectSchema = external_exports.object({
-  dataDir: external_exports.string().min(1, "dataDir is required")
-});
-var ReorderProjectsSchema = external_exports.object({
-  secrets: external_exports.array(external_exports.string())
-});
-var CategoryDefSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  label: external_exports.string().min(1),
-  shortLabel: external_exports.string().min(1),
-  color: external_exports.string().min(1),
-  shortcutKey: external_exports.string(),
-  description: external_exports.string()
-}).loose();
-var UpdateCategoriesSchema = external_exports.array(CategoryDefSchema).min(1);
-var PrintSchema = external_exports.object({
-  html: external_exports.string()
-});
-var GlobalConfigSchema = external_exports.object({
-  channelEnabled: external_exports.boolean().optional(),
-  shareTotalSeconds: external_exports.number().optional(),
-  shareLastPrompted: external_exports.string().optional(),
-  shareAccepted: external_exports.boolean().optional()
-}).strict();
-function parseBody(schema, data) {
-  const result = schema.safeParse(data);
-  if (!result.success) {
-    const messages = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).filter((m) => m !== ": ");
-    return { success: false, error: messages.join("; ") || "Invalid request body" };
-  }
-  return { success: true, data: result.data };
-}
-
-// src/routes/channel.ts
 var channelRoutes = new Hono2();
 var channelDoneFlags = /* @__PURE__ */ new Map();
 var loggedPermissionRequests = /* @__PURE__ */ new Map();
@@ -20690,6 +20887,7 @@ channelRoutes.post("/channel/enable", async (c) => {
   const { writeGlobalConfig: writeGlobalConfig3 } = await Promise.resolve().then(() => (init_global_config(), global_config_exports));
   const dataDir = c.get("dataDir");
   writeGlobalConfig3({ channelEnabled: true });
+  const serverPort = parseInt(new URL(c.req.url).port || "4174", 10);
   try {
     const { getAllProjects: getAllProjects2 } = await Promise.resolve().then(() => (init_projects(), projects_exports));
     const { ensureSkillsForDir: ensureSkillsForDir2 } = await Promise.resolve().then(() => (init_skills(), skills_exports));
@@ -20701,6 +20899,8 @@ channelRoutes.post("/channel/enable", async (c) => {
   } catch {
     registerChannel2(dataDir);
   }
+  const { installHeartbeatHook: installHeartbeatHook2 } = await Promise.resolve().then(() => (init_claude_hooks(), claude_hooks_exports));
+  installHeartbeatHook2(serverPort);
   notifyChange();
   return c.json({ ok: true });
 });
@@ -20720,9 +20920,35 @@ channelRoutes.post("/channel/disable", async (c) => {
     unregisterChannel2(dataDir);
     await shutdownChannel2(dataDir);
   }
+  const { removeHeartbeatHook: removeHeartbeatHook2 } = await Promise.resolve().then(() => (init_claude_hooks(), claude_hooks_exports));
+  removeHeartbeatHook2();
   notifyChange();
   return c.json({ ok: true });
 });
+channelRoutes.post("/channel/heartbeat", async (c) => {
+  const { getAllProjects: getAllProjects2 } = await Promise.resolve().then(() => (init_projects(), projects_exports));
+  const raw = await c.req.json().catch(() => ({}));
+  const parsed = parseBody(ChannelHeartbeatSchema, raw);
+  if (!parsed.success) return c.json({ ok: false });
+  const projectDir = parsed.data.projectDir;
+  const hookState = parsed.data.state ?? "heartbeat";
+  if (projectDir === void 0 || projectDir === "") return c.json({ ok: false });
+  const projects2 = getAllProjects2();
+  const match = projects2.find((p) => {
+    const rootDir = p.dataDir.replace(/\/.hotsheet\/?$/, "");
+    return rootDir === projectDir || projectDir.startsWith(rootDir + "/");
+  });
+  if (!match) return c.json({ ok: false });
+  heartbeatUpdates.push({ secret: match.secret, state: hookState });
+  notifyChange();
+  return c.json({ ok: true, project: match.name });
+});
+var heartbeatUpdates = [];
+channelRoutes.get("/channel/heartbeat-status", (c) => {
+  const updates = [...heartbeatUpdates];
+  heartbeatUpdates.length = 0;
+  return c.json({ updates });
+});
 channelRoutes.post("/channel/notify", (c) => {
   notifyChange();
   return c.json({ ok: true });
@@ -20763,10 +20989,11 @@ init_open_in_file_manager();
 init_projects();
 init_skills();
 init_notify();
-import { existsSync as existsSync11, readdirSync as readdirSync2, writeFileSync as writeFileSync10 } from "fs";
+init_validation();
+import { existsSync as existsSync12, readdirSync as readdirSync2, writeFileSync as writeFileSync11 } from "fs";
 import { Hono as Hono4 } from "hono";
-import { homedir as homedir4, tmpdir } from "os";
-import { join as join13, relative as relative2, resolve as resolve6 } from "path";
+import { homedir as homedir5, tmpdir } from "os";
+import { join as join14, relative as relative2, resolve as resolve6 } from "path";
 var dashboardRoutes = new Hono4();
 dashboardRoutes.get("/poll", async (c) => {
   const clientVersion = Math.max(0, parseInt(c.req.query("version") ?? "0", 10) || 0);
@@ -20800,7 +21027,7 @@ dashboardRoutes.get("/dashboard", async (c) => {
 dashboardRoutes.get("/worklist-info", (c) => {
   const dataDir = c.get("dataDir");
   const cwd = process.cwd();
-  const worklistRel = relative2(cwd, join13(dataDir, "worklist.md"));
+  const worklistRel = relative2(cwd, join14(dataDir, "worklist.md"));
   const prompt = `Read ${worklistRel} for current work items.`;
   for (const p of getAllProjects()) {
     ensureSkillsForDir(p.dataDir.replace(/\/.hotsheet\/?$/, ""));
@@ -20809,23 +21036,23 @@ dashboardRoutes.get("/worklist-info", (c) => {
   return c.json({ prompt, skillCreated });
 });
 dashboardRoutes.get("/browse", (c) => {
-  const requestedPath = c.req.query("path") ?? homedir4();
+  const requestedPath = c.req.query("path") ?? homedir5();
   const absPath = resolve6(requestedPath);
-  if (!existsSync11(absPath)) {
+  if (!existsSync12(absPath)) {
     return c.json({ error: "Path does not exist", path: absPath }, 404);
   }
   try {
     const entries = readdirSync2(absPath, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({
       name: e.name,
-      path: join13(absPath, e.name),
-      hasHotsheet: existsSync11(join13(absPath, e.name, ".hotsheet"))
+      path: join14(absPath, e.name),
+      hasHotsheet: existsSync12(join14(absPath, e.name, ".hotsheet"))
     }));
     const parentPath = resolve6(absPath, "..");
     return c.json({
       path: absPath,
       parent: parentPath !== absPath ? parentPath : null,
       entries,
-      hasHotsheet: existsSync11(join13(absPath, ".hotsheet"))
+      hasHotsheet: existsSync12(join14(absPath, ".hotsheet"))
     });
   } catch {
     return c.json({ error: "Cannot read directory", path: absPath }, 403);
@@ -20891,8 +21118,8 @@ dashboardRoutes.post("/print", async (c) => {
   const raw = await c.req.json();
   const parsed = parseBody(PrintSchema, raw);
   if (!parsed.success) return c.json({ error: parsed.error }, 400);
-  const tmpPath = join13(tmpdir(), `hotsheet-print-${Date.now()}.html`);
-  writeFileSync10(tmpPath, parsed.data.html, "utf-8");
+  const tmpPath = join14(tmpdir(), `hotsheet-print-${Date.now()}.html`);
+  writeFileSync11(tmpPath, parsed.data.html, "utf-8");
   await openInFileManager(tmpPath);
   return c.json({ ok: true, path: tmpPath });
 });
@@ -20904,6 +21131,7 @@ init_plugins();
 init_queries();
 init_types();
 init_notify();
+init_validation();
 import { Hono as Hono6 } from "hono";
 var settingsRoutes = new Hono6();
 settingsRoutes.get("/tags", async (c) => {
@@ -20971,6 +21199,7 @@ settingsRoutes.patch("/file-settings", async (c) => {
 
 // src/routes/shell.ts
 init_commandLog();
+init_validation();
 import { Hono as Hono7 } from "hono";
 var shellRoutes = new Hono7();
 var runningProcesses = /* @__PURE__ */ new Map();
@@ -21059,6 +21288,7 @@ init_syncEngine();
 init_helpers();
 init_notify();
 init_plugins();
+init_validation();
 import { rmSync as rmSync9 } from "fs";
 import { Hono as Hono8 } from "hono";
 var VALID_STATUS_FILTERS = /* @__PURE__ */ new Set([
@@ -21361,6 +21591,7 @@ if (PLUGINS_ENABLED) apiRoutes.route("/", pluginRoutes);
 // src/routes/backups.ts
 init_backup();
 init_markdown();
+init_validation();
 import { Hono as Hono10 } from "hono";
 var backupRoutes = new Hono10();
 backupRoutes.get("/", (c) => {
@@ -22236,13 +22467,14 @@ init_open_in_file_manager();
 init_project_list();
 init_projects();
 init_notify();
-import { existsSync as existsSync14 } from "fs";
+init_validation();
+import { existsSync as existsSync15 } from "fs";
 import { Hono as Hono12 } from "hono";
 import { resolve as resolve7 } from "path";
 var projectRoutes = new Hono12();
 projectRoutes.get("/", async (c) => {
   const projects2 = getAllProjects();
-  const stale = projects2.filter((p) => !existsSync14(p.dataDir));
+  const stale = projects2.filter((p) => !existsSync15(p.dataDir));
   for (const p of stale) {
     removeFromProjectList(p.dataDir);
     unregisterProject(p.secret);
@@ -22250,7 +22482,7 @@ projectRoutes.get("/", async (c) => {
   const persisted = readProjectList();
   const inMemoryDirs = new Set(getAllProjects().map((p) => p.dataDir));
   for (const dir of persisted) {
-    if (!inMemoryDirs.has(dir) && !existsSync14(dir)) {
+    if (!inMemoryDirs.has(dir) && !existsSync15(dir)) {
       removeFromProjectList(dir);
     }
   }
@@ -22379,7 +22611,7 @@ projectRoutes.post("/:secret/reveal", async (c) => {
   const project = getProjectBySecret(secret);
   if (!project) return c.json({ error: "Project not found" }, 404);
   const projectRoot2 = resolve7(project.dataDir, "..");
-  if (!existsSync14(projectRoot2)) return c.json({ error: "Folder not found on disk" }, 404);
+  if (!existsSync15(projectRoot2)) return c.json({ error: "Folder not found on disk" }, 404);
   await openInFileManager(projectRoot2);
   return c.json({ ok: true });
 });
@@ -22429,25 +22661,25 @@ async function startServer(port, dataDir, options) {
     await runWithDataDir(resolvedDataDir, () => next());
   });
   const selfDir = dirname4(fileURLToPath3(import.meta.url));
-  const distDir = existsSync15(join16(selfDir, "client", "styles.css")) ? join16(selfDir, "client") : join16(selfDir, "..", "dist", "client");
+  const distDir = existsSync16(join17(selfDir, "client", "styles.css")) ? join17(selfDir, "client") : join17(selfDir, "..", "dist", "client");
   app.get("/static/styles.css", (c) => {
-    const css = readFileSync12(join16(distDir, "styles.css"), "utf-8");
+    const css = readFileSync13(join17(distDir, "styles.css"), "utf-8");
     return c.text(css, 200, { "Content-Type": "text/css", "Cache-Control": "no-cache" });
   });
   app.get("/static/app.js", (c) => {
-    const js = readFileSync12(join16(distDir, "app.global.js"), "utf-8");
+    const js = readFileSync13(join17(distDir, "app.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
   app.get("/static/assets/:filename", (c) => {
     const filename = basename3(c.req.param("filename"));
-    const filePath = join16(distDir, "assets", filename);
-    if (!existsSync15(filePath)) return c.notFound();
-    const content = readFileSync12(filePath);
+    const filePath = join17(distDir, "assets", filename);
+    if (!existsSync16(filePath)) return c.notFound();
+    const content = readFileSync13(filePath);
     const ext = filename.split(".").pop() ?? "";
     return new Response(content, { headers: { "Content-Type": getMimeType(ext), "Cache-Control": "max-age=86400" } });
   });
   app.use("/api/*", async (c, next) => {
-    if (c.req.path.startsWith("/api/projects")) {
+    if (c.req.path.startsWith("/api/projects") || c.req.path === "/api/channel/heartbeat") {
       await next();
       return;
     }
@@ -22536,18 +22768,18 @@ init_skills();
 init_markdown();
 
 // src/update-check.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync13 } from "fs";
 import { get } from "https";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname5, join as join17 } from "path";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname5, join as join18 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
-var DATA_DIR = join17(homedir7(), ".hotsheet");
-var CHECK_FILE = join17(DATA_DIR, "last-update-check");
+var DATA_DIR = join18(homedir8(), ".hotsheet");
+var CHECK_FILE = join18(DATA_DIR, "last-update-check");
 var PACKAGE_NAME = "hotsheet";
 function getCurrentVersion() {
   try {
     const dir = dirname5(fileURLToPath4(import.meta.url));
-    const pkg = JSON.parse(readFileSync13(join17(dir, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync14(join18(dir, "..", "package.json"), "utf-8"));
     return pkg.version;
   } catch {
     return "0.0.0";
@@ -22555,16 +22787,16 @@ function getCurrentVersion() {
 }
 function getLastCheckDate() {
   try {
-    if (existsSync16(CHECK_FILE)) {
-      return readFileSync13(CHECK_FILE, "utf-8").trim();
+    if (existsSync17(CHECK_FILE)) {
+      return readFileSync14(CHECK_FILE, "utf-8").trim();
     }
   } catch {
   }
   return null;
 }
 function saveCheckDate() {
-  mkdirSync10(DATA_DIR, { recursive: true });
-  writeFileSync12(CHECK_FILE, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), "utf-8");
+  mkdirSync11(DATA_DIR, { recursive: true });
+  writeFileSync13(CHECK_FILE, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), "utf-8");
 }
 function isFirstUseToday() {
   const last = getLastCheckDate();
@@ -22676,7 +22908,7 @@ Examples:
 function parseArgs(argv) {
   const args = argv.slice(2);
   let port = 4174;
-  let dataDir = join18(process.cwd(), ".hotsheet");
+  let dataDir = join19(process.cwd(), ".hotsheet");
   let demo = null;
   let forceUpdateCheck = false;
   let noOpen = false;
@@ -22824,21 +23056,28 @@ async function handleEarlyFlags(args) {
   return false;
 }
 async function initializeProject(dataDir, demo) {
-  mkdirSync11(dataDir, { recursive: true });
+  const t0 = Date.now();
+  const elapsed = () => `${Date.now() - t0}ms`;
+  mkdirSync12(dataDir, { recursive: true });
   if (demo === null) {
     acquireLock(dataDir);
     ensureGitignore(process.cwd());
   }
+  console.error(`[init-project ${elapsed()}] initializing DB...`);
   setDataDir(dataDir);
   const db = await getDb();
+  console.error(`[init-project ${elapsed()}] DB ready`);
   if (demo !== null) {
     await seedDemoData(demo);
   }
   if (demo === null) {
     const { runWithDataDir: runWithDataDir2 } = await Promise.resolve().then(() => (init_connection(), connection_exports));
+    console.error(`[init-project ${elapsed()}] migrating settings...`);
     const { migrateDbSettingsToFile: migrateDbSettingsToFile2 } = await Promise.resolve().then(() => (init_migrate_settings(), migrate_settings_exports));
     await runWithDataDir2(dataDir, () => migrateDbSettingsToFile2(dataDir));
+    console.error(`[init-project ${elapsed()}] cleaning up attachments...`);
     await runWithDataDir2(dataDir, () => cleanupAttachments());
+    console.error(`[init-project ${elapsed()}] done`);
   }
   console.log(`  Data directory: ${dataDir}`);
   return db;
@@ -22870,14 +23109,22 @@ async function startAndConfigure(port, dataDir, strictPort) {
   return { actualPort, secret };
 }
 async function postStartup(dataDir, actualPort, demo, noOpen) {
+  const t0 = Date.now();
+  const elapsed = () => `${Date.now() - t0}ms`;
   if (demo === null) {
     initBackupScheduler(dataDir);
     addToProjectList(dataDir);
+    console.error(`[post-startup ${elapsed()}] restoring previous projects...`);
     await restorePreviousProjects(dataDir, actualPort);
+    console.error(`[post-startup ${elapsed()}] migrating global config...`);
     await migrateGlobalConfig();
+    console.error(`[post-startup ${elapsed()}] cleaning up stale channels...`);
     await cleanupStaleChannels();
-    await setupSkillsAndChannels();
+    console.error(`[post-startup ${elapsed()}] setting up skills and channels...`);
+    await setupSkillsAndChannels(actualPort);
+    console.error(`[post-startup ${elapsed()}] setting up instance lifecycle...`);
     setupInstanceLifecycle(actualPort);
+    console.error(`[post-startup ${elapsed()}] done`);
   }
   if (!noOpen) {
     const url2 = `http://localhost:${actualPort}`;
@@ -22894,7 +23141,7 @@ async function restorePreviousProjects(dataDir, actualPort) {
       validProjects.push(prevDir);
       continue;
     }
-    if (!existsSync17(prevDir)) continue;
+    if (!existsSync18(prevDir)) continue;
     try {
       await registerProject(prevDir, actualPort);
       validProjects.push(prevDir);
@@ -22931,7 +23178,7 @@ async function cleanupStaleChannels() {
     await cleanupStaleChannel2(p.dataDir);
   }
 }
-async function setupSkillsAndChannels() {
+async function setupSkillsAndChannels(port) {
   const { getAllProjects: getAllProjects2 } = await Promise.resolve().then(() => (init_projects(), projects_exports));
   const { ensureSkillsForDir: ensureSkillsForDir2 } = await Promise.resolve().then(() => (init_skills(), skills_exports));
   for (const p of getAllProjects2()) {
@@ -22942,6 +23189,18 @@ async function setupSkillsAndChannels() {
   if (readGlobalConfig3().channelEnabled === true) {
     const { registerChannelForAll: registerChannelForAll2 } = await Promise.resolve().then(() => (init_channel_config(), channel_config_exports));
     registerChannelForAll2(getAllProjects2().map((p) => p.dataDir));
+    const { installHeartbeatHook: installHeartbeatHook2 } = await Promise.resolve().then(() => (init_claude_hooks(), claude_hooks_exports));
+    installHeartbeatHook2(port);
+  }
+}
+async function ensureHooksForRunningInstance(port) {
+  try {
+    const { readGlobalConfig: readGlobalConfig3 } = await Promise.resolve().then(() => (init_global_config(), global_config_exports));
+    if (readGlobalConfig3().channelEnabled === true) {
+      const { installHeartbeatHook: installHeartbeatHook2 } = await Promise.resolve().then(() => (init_claude_hooks(), claude_hooks_exports));
+      installHeartbeatHook2(port);
+    }
+  } catch {
   }
 }
 function setupInstanceLifecycle(actualPort) {
@@ -22958,6 +23217,13 @@ function setupInstanceLifecycle(actualPort) {
   });
 }
 async function main() {
+  const t0 = Date.now();
+  const elapsed = () => `${Date.now() - t0}ms`;
+  const watchdog = setTimeout(() => {
+    console.error(`[startup] WARNING: startup has taken ${elapsed()} \u2014 still not ready`);
+    console.error("[startup] This may indicate a hang in DB init, network check, or project restore.");
+    console.error("[startup] Check the timing logs above to identify the stuck phase.");
+  }, 1e4);
   const parsed = parseArgs(process.argv);
   if (!parsed) {
     printUsage();
@@ -22965,8 +23231,11 @@ async function main() {
   }
   const { port, demo, forceUpdateCheck, noOpen, strictPort } = parsed;
   let { dataDir } = parsed;
+  console.error(`[startup ${elapsed()}] parsed args`);
   await handleEarlyFlags(parsed);
+  console.error(`[startup ${elapsed()}] checking for updates...`);
   await checkForUpdates(forceUpdateCheck);
+  console.error(`[startup ${elapsed()}] update check done`);
   if (demo !== null) {
     const scenario = DEMO_SCENARIOS.find((s) => s.id === demo);
     if (!scenario) {
@@ -22977,17 +23246,22 @@ async function main() {
       }
       process.exit(1);
     }
-    dataDir = join18(tmpdir2(), `hotsheet-demo-${Date.now()}`);
+    dataDir = join19(tmpdir2(), `hotsheet-demo-${Date.now()}`);
     console.log(`
   DEMO MODE: ${scenario.label}
 `);
   }
   if (demo === null) {
+    console.error(`[startup ${elapsed()}] cleaning up stale instances...`);
     await cleanupStaleInstance();
+    console.error(`[startup ${elapsed()}] stale cleanup done`);
     const instance = readInstanceFile();
     if (instance !== null) {
+      console.error(`[startup ${elapsed()}] checking if instance on port ${instance.port} is running...`);
       const running = await isInstanceRunning(instance.port);
+      console.error(`[startup ${elapsed()}] instance check: running=${running}`);
       if (running) {
+        await ensureHooksForRunningInstance(instance.port);
         if (!noOpen) {
           await joinRunningInstance(instance.port, dataDir);
         } else {
@@ -23010,13 +23284,21 @@ async function main() {
       }
     }
   }
+  console.error(`[startup ${elapsed()}] initializing project...`);
   const db = await initializeProject(dataDir, demo);
+  console.error(`[startup ${elapsed()}] project initialized`);
   if (demo !== null) {
     writeFileSettings(dataDir, { appName: "Hot Sheet Demo" });
   }
+  console.error(`[startup ${elapsed()}] starting server...`);
   const { actualPort, secret } = await startAndConfigure(port, dataDir, strictPort);
+  console.error(`[startup ${elapsed()}] server started on port ${actualPort}`);
   registerExistingProject(dataDir, secret, db);
+  console.error(`[startup ${elapsed()}] running post-startup tasks...`);
   await postStartup(dataDir, actualPort, demo, noOpen);
+  console.error(`[startup ${elapsed()}] post-startup complete`);
+  clearTimeout(watchdog);
+  console.error(`[startup ${elapsed()}] startup finished`);
   if (demo !== null) {
     const { seedDemoExtraProjects: seedDemoExtraProjects2 } = await Promise.resolve().then(() => (init_demo(), demo_exports));
     await seedDemoExtraProjects2(demo, dataDir, actualPort);