oasis_test_v2 2.2.105 → 2.2.107

package/dist/index.js

@@ -388,9 +388,14 @@ var init_org_model = __esm({
 });
 
 // ../contract/src/company.ts
+function profileNameLength(value2) {
+  return Array.from(value2.trim()).length;
+}
+var PROFILE_NAME_MAX;
 var init_company = __esm({
   "../contract/src/company.ts"() {
     "use strict";
+    PROFILE_NAME_MAX = 30;
   }
 });
 
@@ -492,6 +497,7 @@ function inboxItemTargetPath(item) {
   return null;
 }
 function notificationTargetPath(r) {
+  if (r.category === "todo") return r.chatSessionId ? chatPath(r.chatSessionId) : null;
   if (r.category !== "action") return r.workorderId ? taskPath(r.workorderId) : null;
   const viaItem = r.item ? inboxItemTargetPath(r.item) : null;
   const wid = r.workorderId ?? r.item?.workspace;
@@ -1350,6 +1356,137 @@ var init_variable_name = __esm({
   }
 });
 
+// ../contract/src/time-zone.ts
+function canonicalTimeZone(name) {
+  if (typeof name !== "string") return null;
+  const trimmed = name.trim();
+  if (!trimmed || /^[+-]/.test(trimmed)) return null;
+  try {
+    return new Intl.DateTimeFormat("en-US", { timeZone: trimmed }).resolvedOptions().timeZone;
+  } catch {
+    return null;
+  }
+}
+function isValidTimeZone(name) {
+  return canonicalTimeZone(name) !== null;
+}
+function effectiveTimeZone(company, deploymentDefault) {
+  return company?.timeZone || deploymentDefault;
+}
+function zoneOffsetMs(ms, timeZone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  }).formatToParts(new Date(ms));
+  const get = (type) => Number(parts.find((p2) => p2.type === type)?.value ?? "0");
+  const asIfUtc = Date.UTC(get("year"), get("month") - 1, get("day"), get("hour") % 24, get("minute"), get("second"));
+  return asIfUtc - (ms - (ms % 1e3 + 1e3) % 1e3);
+}
+function zonedDateOf(ms, timeZone) {
+  const d = new Date(ms + zoneOffsetMs(ms, timeZone));
+  return {
+    date: `${d.getUTCFullYear()}-${pad2(d.getUTCMonth() + 1)}-${pad2(d.getUTCDate())}`,
+    weekday: d.getUTCDay()
+  };
+}
+function zonedToday(timeZone, nowMs = Date.now()) {
+  return zonedDateOf(nowMs, timeZone);
+}
+function isValidDay(day) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(day)) return false;
+  const t = Date.parse(`${day}T00:00:00Z`);
+  return !Number.isNaN(t) && new Date(t).toISOString().slice(0, 10) === day;
+}
+function zonedDateTimeToUtcMs(day, time3, timeZone) {
+  if (!isValidDay(day)) throw new RangeError(`\u4E0D\u662F\u6709\u6548\u65E5\u671F\uFF08\u987B\u4E3A YYYY-MM-DD\uFF09\uFF1A${day}`);
+  const m2 = /^(\d{2}):(\d{2})$/.exec(time3);
+  if (!m2 || Number(m2[1]) > 23 || Number(m2[2]) > 59) throw new RangeError(`\u4E0D\u662F\u6709\u6548\u65F6\u523B\uFF08\u987B\u4E3A HH:mm\uFF09\uFF1A${time3}`);
+  const local = Date.parse(`${day}T${time3}:00Z`);
+  const before = local - zoneOffsetMs(local - DAY_MS, timeZone);
+  const after = local - zoneOffsetMs(local + DAY_MS, timeZone);
+  const fits = (t) => t + zoneOffsetMs(t, timeZone) === local;
+  const okBefore = fits(before);
+  const okAfter = fits(after);
+  if (okBefore && okAfter) return Math.min(before, after);
+  if (okBefore) return before;
+  if (okAfter) return after;
+  return before;
+}
+function zonedStartOfDayMs(day, timeZone) {
+  return zonedDateTimeToUtcMs(day, "00:00", timeZone);
+}
+var DEFAULT_TIME_ZONE, DAY_MS, pad2;
+var init_time_zone = __esm({
+  "../contract/src/time-zone.ts"() {
+    "use strict";
+    DEFAULT_TIME_ZONE = "Asia/Shanghai";
+    DAY_MS = 24 * 60 * 60 * 1e3;
+    pad2 = (n) => String(n).padStart(2, "0");
+  }
+});
+
+// ../contract/src/todos.ts
+function todoAssignees(todo) {
+  return [todo.assigneeActorId];
+}
+function isTodoParty(todo, actorId) {
+  return todo.creatorActorId === actorId || todoAssignees(todo).includes(actorId);
+}
+function isValidTodoTime(time3) {
+  const m2 = /^(\d{2}):(\d{2})$/.exec(time3);
+  return !!m2 && Number(m2[1]) <= 23 && Number(m2[2]) <= 59;
+}
+function weekdayOfDay(day) {
+  return (/* @__PURE__ */ new Date(`${day}T00:00:00Z`)).getUTCDay();
+}
+function isTodoStartBeforeDue(t) {
+  if (!t.startDate) return true;
+  if (t.startDate !== t.dueDate) return t.startDate < t.dueDate;
+  return !(t.startTime && t.dueTime) || t.startTime <= t.dueTime;
+}
+function formatTodoDue(day, time3) {
+  const [, m2, d] = day.split("-");
+  return `${Number(m2)} \u6708 ${Number(d)} \u65E5\uFF08${WEEKDAY_LABEL[weekdayOfDay(day)]}\uFF09${time3 ? ` ${time3}` : ""}`;
+}
+function formatTodoSpan(t) {
+  const due = formatTodoDue(t.dueDate, t.dueTime);
+  if (!t.startDate) return `\u622A\u6B62 ${due}`;
+  const join48 = (text7, time3) => `${text7}${time3 ? " " : ""}`;
+  return `${join48(formatTodoDue(t.startDate, t.startTime), t.startTime)}\u5F00\u59CB \u2192 ${join48(due, t.dueTime)}\u622A\u6B62`;
+}
+function todoToday(timeZone, nowMs = Date.now()) {
+  return { ...zonedToday(timeZone, nowMs), timeZone };
+}
+function formatTodayLine(today) {
+  return `\u4ECA\u5929\uFF1A${today.date} ${WEEKDAY_LABEL[today.weekday]}\uFF08${today.timeZone}\uFF09`;
+}
+function shiftDay(day, n) {
+  const t = Date.parse(`${day}T00:00:00Z`) + n * 864e5;
+  return new Date(t).toISOString().slice(0, 10);
+}
+function compareTodos(a, b2) {
+  if (a.dueDate !== b2.dueDate) return a.dueDate < b2.dueDate ? -1 : 1;
+  const ta = a.dueTime ?? "99:99";
+  const tb = b2.dueTime ?? "99:99";
+  if (ta !== tb) return ta < tb ? -1 : 1;
+  if (a.createdAt !== b2.createdAt) return a.createdAt < b2.createdAt ? -1 : 1;
+  return a.id < b2.id ? -1 : a.id > b2.id ? 1 : 0;
+}
+var WEEKDAY_LABEL;
+var init_todos = __esm({
+  "../contract/src/todos.ts"() {
+    "use strict";
+    init_time_zone();
+    WEEKDAY_LABEL = ["\u5468\u65E5", "\u5468\u4E00", "\u5468\u4E8C", "\u5468\u4E09", "\u5468\u56DB", "\u5468\u4E94", "\u5468\u516D"];
+  }
+});
+
 // ../contract/src/credential-gap.ts
 function buildCredentialGapDescription(opts) {
   const { key: key2, scope: scope2, project, desc } = opts;
@@ -2236,9 +2373,9 @@ function firstSentenceSummary(text7, max = CARD_SUMMARY_MAX) {
   const raw = (text7 ?? "").trim();
   if (!raw) return "";
   const cut = raw.split(/[。！？\n]|——/u)[0].trim() || raw.trim();
-  const clean2 = stripInternalIds(cut).trim();
-  const cps = [...clean2];
-  return cps.length > max ? `${cps.slice(0, max).join("")}\u2026` : clean2;
+  const clean3 = stripInternalIds(cut).trim();
+  const cps = [...clean3];
+  return cps.length > max ? `${cps.slice(0, max).join("")}\u2026` : clean3;
 }
 function requoteStepTitle(text7, title) {
   const t = title?.trim();
@@ -2415,6 +2552,8 @@ var init_src = __esm({
     init_skill_market();
     init_credential_ref();
     init_variable_name();
+    init_time_zone();
+    init_todos();
     init_credential_gap();
     init_views();
     init_telemetry();
@@ -20258,10 +20397,10 @@ var init_chat_item_ledger = __esm({
       }
       insert(input) {
         const prepared = this.prepareInsert(input);
-        const create = prepared.create;
-        if (!create) return prepared.id;
+        const create2 = prepared.create;
+        if (!create2) return prepared.id;
         this.enqueue(async () => {
-          prepared.persisted(await this.deps.items.createItem(create));
+          prepared.persisted(await this.deps.items.createItem(create2));
         }, `create:${input.kind}`);
         return prepared.id;
       }
@@ -20303,7 +20442,7 @@ var init_chat_item_ledger = __esm({
         const messageId = row.messageId;
         const payload2 = input.payload ?? this.payloadOf(row);
         const metadata = input.metadata ?? { [CHAT_ITEM_META_LEGACY_CONTENT]: input.inContent };
-        const create = {
+        const create2 = {
           id,
           sessionId: this.deps.sessionId,
           messageId,
@@ -20344,7 +20483,7 @@ var init_chat_item_ledger = __esm({
             }
           }
         };
-        return { id, create, persisted };
+        return { id, create: create2, persisted };
       }
       /**
        * 追加合并：**排队期间到达的片段合进同一次 `append_text`**，一串片段一次往返。
@@ -31305,10 +31444,10 @@ var require_abort = __commonJS({
   "../../node_modules/.pnpm/asynckit@0.4.0/node_modules/asynckit/lib/abort.js"(exports2, module2) {
     module2.exports = abort;
     function abort(state) {
-      Object.keys(state.jobs).forEach(clean2.bind(state));
+      Object.keys(state.jobs).forEach(clean3.bind(state));
       state.jobs = {};
     }
-    function clean2(key2) {
+    function clean3(key2) {
       if (typeof this.jobs[key2] == "function") {
         this.jobs[key2]();
       }
@@ -35639,29 +35778,29 @@ var require_axios = __commonJS({
             }
           }
         }
-        let pad2 = 0;
+        let pad3 = 0;
         let idx = len - 1;
         const tailIsPct3D = (j) => j >= 2 && body2.charCodeAt(j - 2) === 37 && // '%'
         body2.charCodeAt(j - 1) === 51 && // '3'
         (body2.charCodeAt(j) === 68 || body2.charCodeAt(j) === 100);
         if (idx >= 0) {
           if (body2.charCodeAt(idx) === 61) {
-            pad2++;
+            pad3++;
             idx--;
           } else if (tailIsPct3D(idx)) {
-            pad2++;
+            pad3++;
             idx -= 3;
           }
         }
-        if (pad2 === 1 && idx >= 0) {
+        if (pad3 === 1 && idx >= 0) {
           if (body2.charCodeAt(idx) === 61) {
-            pad2++;
+            pad3++;
           } else if (tailIsPct3D(idx)) {
-            pad2++;
+            pad3++;
           }
         }
         const groups = Math.floor(effectiveLen / 4);
-        const bytes2 = groups * 3 - (pad2 || 0);
+        const bytes2 = groups * 3 - (pad3 || 0);
         return bytes2 > 0 ? bytes2 : 0;
       }
       return Buffer.byteLength(body2, "utf8");
@@ -37520,7 +37659,7 @@ var require_axios = __commonJS({
       const instance = bind(Axios$1.prototype.request, context2);
       utils$1.extend(instance, Axios$1.prototype, context2, { allOwnKeys: true });
       utils$1.extend(instance, context2, null, { allOwnKeys: true });
-      instance.create = function create(instanceConfig) {
+      instance.create = function create2(instanceConfig) {
         return createInstance(mergeConfig2(defaultConfig, instanceConfig));
       };
       return instance;
@@ -43137,7 +43276,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes16, createHash: createHash46 } = require("crypto");
+    var { randomBytes: randomBytes17, createHash: createHash47 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -43675,7 +43814,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key2 = randomBytes16(16).toString("base64");
+      const key2 = randomBytes17(16).toString("base64");
       const request2 = isSecure ? https.request : http2.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -43805,7 +43944,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash46("sha1").update(key2 + GUID).digest("base64");
+        const digest = createHash47("sha1").update(key2 + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -44174,7 +44313,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash46 } = require("crypto");
+    var { createHash: createHash47 } = require("crypto");
     var extension3 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -44481,7 +44620,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash46("sha1").update(key2 + GUID).digest("base64");
+        const digest = createHash47("sha1").update(key2 + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -46393,7 +46532,7 @@ var require_writer = __commonJS({
       this.tail = this.head;
       this.states = null;
     }
-    var create = function create2() {
+    var create2 = function create3() {
       return util2.Buffer ? function create_buffer_setup() {
         return (Writer.create = function create_buffer() {
           return new BufferWriter();
@@ -46402,7 +46541,7 @@ var require_writer = __commonJS({
         return new Writer();
       };
     };
-    Writer.create = create();
+    Writer.create = create2();
     Writer.alloc = function alloc(size) {
       return new util2.Array(size);
     };
@@ -46549,7 +46688,7 @@ var require_writer = __commonJS({
     };
     Writer._configure = function(BufferWriter_) {
       BufferWriter = BufferWriter_;
-      Writer.create = create();
+      Writer.create = create2();
       BufferWriter._configure();
     };
   }
@@ -46631,14 +46770,14 @@ var require_reader = __commonJS({
         return new Reader(buffer);
       throw Error("illegal buffer");
     };
-    var create = function create2() {
+    var create2 = function create3() {
       return util2.Buffer ? function create_buffer_setup(buffer) {
         return (Reader.create = function create_buffer(buffer2) {
           return util2.Buffer.isBuffer(buffer2) ? new BufferReader(buffer2) : create_array(buffer2);
         })(buffer);
       } : create_array;
     };
-    Reader.create = create();
+    Reader.create = create2();
     Reader.prototype._slice = util2.Array.prototype.subarray || /* istanbul ignore next */
     util2.Array.prototype.slice;
     Reader.prototype.uint32 = /* @__PURE__ */ function read_uint32_setup() {
@@ -46806,7 +46945,7 @@ var require_reader = __commonJS({
     };
     Reader._configure = function(BufferReader_) {
       BufferReader = BufferReader_;
-      Reader.create = create();
+      Reader.create = create2();
       BufferReader._configure();
       var fn = util2.Long ? "toLong" : (
         /* istanbul ignore next */
@@ -47144,15 +47283,15 @@ var require_lib2 = __commonJS({
     function buildUserAgent(source, opts) {
       let ua = `oapi-node-sdk/${getSdkVersion()}`;
       if (source) {
-        const clean2 = sanitizeSource(source);
-        if (clean2)
-          ua += ` source/${clean2}`;
+        const clean3 = sanitizeSource(source);
+        if (clean3)
+          ua += ` source/${clean3}`;
       }
       if (opts === null || opts === void 0 ? void 0 : opts.extraTags) {
         for (const t of opts.extraTags) {
-          const clean2 = sanitizeSource(t);
-          if (clean2)
-            ua += ` ${clean2}`;
+          const clean3 = sanitizeSource(t);
+          if (clean3)
+            ua += ` ${clean3}`;
         }
       }
       return ua;
@@ -129101,7 +129240,7 @@ var require_lib2 = __commonJS({
         }
         Header.prototype.key = "";
         Header.prototype.value = "";
-        Header.create = function create(properties) {
+        Header.create = function create2(properties) {
           return new Header(properties);
         };
         Header.encode = function encode(message, writer) {
@@ -129213,7 +129352,7 @@ var require_lib2 = __commonJS({
         Frame.prototype.payloadType = "";
         Frame.prototype.payload = $util.newBuffer([]);
         Frame.prototype.LogIDNew = "";
-        Frame.create = function create(properties) {
+        Frame.create = function create2(properties) {
           return new Frame(properties);
         };
         Frame.encode = function encode(message, writer) {
@@ -137317,7 +137456,7 @@ var require_pg_int8 = __commonJS({
       var carry;
       var t;
       var digits;
-      var pad2;
+      var pad3;
       var l;
       var i;
       {
@@ -137329,12 +137468,12 @@ var require_pg_int8 = __commonJS({
         if (low === 0 && high === 0) {
           return sign3 + digits + result;
         }
-        pad2 = "";
+        pad3 = "";
         l = 6 - digits.length;
         for (i = 0; i < l; i++) {
-          pad2 += "0";
+          pad3 += "0";
         }
-        result = pad2 + digits + result;
+        result = pad3 + digits + result;
       }
       {
         carry = high % BASE2;
@@ -137345,12 +137484,12 @@ var require_pg_int8 = __commonJS({
         if (low === 0 && high === 0) {
           return sign3 + digits + result;
         }
-        pad2 = "";
+        pad3 = "";
         l = 6 - digits.length;
         for (i = 0; i < l; i++) {
-          pad2 += "0";
+          pad3 += "0";
         }
-        result = pad2 + digits + result;
+        result = pad3 + digits + result;
       }
       {
         carry = high % BASE2;
@@ -137361,12 +137500,12 @@ var require_pg_int8 = __commonJS({
         if (low === 0 && high === 0) {
           return sign3 + digits + result;
         }
-        pad2 = "";
+        pad3 = "";
         l = 6 - digits.length;
         for (i = 0; i < l; i++) {
-          pad2 += "0";
+          pad3 += "0";
         }
-        result = pad2 + digits + result;
+        result = pad3 + digits + result;
       }
       {
         carry = high % BASE2;
@@ -137909,7 +138048,7 @@ var require_utils3 = __commonJS({
     var nodeCrypto = require("crypto");
     module2.exports = {
       postgresMd5PasswordHash,
-      randomBytes: randomBytes16,
+      randomBytes: randomBytes17,
       deriveKey,
       sha256: sha2563,
       hashByName,
@@ -137919,7 +138058,7 @@ var require_utils3 = __commonJS({
     var webCrypto = nodeCrypto.webcrypto || globalThis.crypto;
     var subtleCrypto = webCrypto.subtle;
     var textEncoder = new TextEncoder();
-    function randomBytes16(length) {
+    function randomBytes17(length) {
       return webCrypto.getRandomValues(Buffer.alloc(length));
     }
     async function md5(string7) {
@@ -153397,14 +153536,14 @@ var init_kernel_bridge = __esm({
             fresh.add(id);
           }
         }
-        const clean2 = this.resyncRequested ? ids2.filter((id) => !fresh.has(id)) : [];
+        const clean3 = this.resyncRequested ? ids2.filter((id) => !fresh.has(id)) : [];
         this.resyncRequested = false;
-        if (clean2.length > 0) {
-          const slice = Math.min(_EngineKernel.REFRESH_RESYNC_SLICE, clean2.length);
+        if (clean3.length > 0) {
+          const slice = Math.min(_EngineKernel.REFRESH_RESYNC_SLICE, clean3.length);
           for (let i = 0; i < slice; i++) {
-            toLoad.push(clean2[(this.resyncCursor + i) % clean2.length]);
+            toLoad.push(clean3[(this.resyncCursor + i) % clean3.length]);
           }
-          this.resyncCursor = (this.resyncCursor + slice) % clean2.length;
+          this.resyncCursor = (this.resyncCursor + slice) % clean3.length;
         }
         const claimed = toLoad.filter((id) => this.dirtyWorkorders.delete(id));
         let loaded;
@@ -175535,7 +175674,11 @@ var init_assistants = __esm({
         return p2?.autoAssignAssistant !== false;
       }
       /* ---------- 懒创建（原子 + 幂等 + 探针 + opt-out） ---------- */
-      async ensureFor(humanId, by = humanId) {
+      /**
+       * @param preferred 调用方（入职向导「我的助理」）指定的那台运行时。只是**偏好**：在本公司在线运行时里
+       *   找得到就用它建，找不到（下线了 / 不是本公司的 / 乱填）就当没给，照常按负载挑——见 {@link pickAssistantRuntime}。
+       */
+      async ensureFor(humanId, by = humanId, preferred) {
         const pre = await this.opts.bindStore.getByHuman(humanId);
         if (pre) return { agentId: pre.agentActorId, created: false, source: "existing" };
         if (!await this.isAutoAssignOn(humanId)) {
@@ -175563,7 +175706,7 @@ var init_assistants = __esm({
               return { agentId: restored.agentActorId, created: false, source: "existing" };
             }
           }
-          const agentId = await this._createLocked(humanId, by, "lazy-create");
+          const agentId = await this._createLocked(humanId, by, "lazy-create", preferred);
           return { agentId, created: true, source: "lazy-created" };
         });
       }
@@ -175817,11 +175960,11 @@ var init_assistants = __esm({
         }
       }
       /* ---------- 私有：创建流水线（不加锁；调用方须已持 withHumanLock） ---------- */
-      async _createLocked(humanId, by, origin) {
+      async _createLocked(humanId, by, origin, preferred) {
         const human = await this.opts.registry.getActor(humanId);
         if (!human) throw new AssistantLazyCreateError("human-not-found");
         if (human.kind !== "human" || human.status !== "active") throw new AssistantLazyCreateError("human-inactive");
-        const runtime = await this.pickAssistantRuntime();
+        const runtime = await this.pickAssistantRuntime(preferred);
         if (!runtime) throw new AssistantLazyCreateError("no-runtime");
         const agentId = `actor:agent:asst-${slug4(human.name)}-${short6()}`;
         await this.opts.actors.upsertActor({ id: agentId, kind: "agent", name: `${human.name}\u7684\u52A9\u7406`, status: "active", roles: ["assistant"] }, by);
@@ -175860,7 +176003,18 @@ var init_assistants = __esm({
         return companyId ? { companyId } : void 0;
       }
       /* ---------- runtime 挑选（ADR §3.3.a）：负载均衡 + 幂等 tie-break ---------- */
-      async pickAssistantRuntime() {
+      /**
+       * 挑一台给助理用的运行时。优先级：
+       *  ① 调用方指定的那台（入职向导里用户在「我的助理」下拉选的），且它**在本公司在线**；
+       *  ② 公司默认 kind（`runtime_configs.default_assistant_runtime_kind`，缺省 claude-code）里按负载挑；
+       *  ③ 默认 kind 一台在线的都没有 → 退回本公司任意在线运行时，同样按负载挑。
+       * 本公司一台在线的都没有才返回 null（→ 503 no-runtime）。
+       *
+       * ①③ 是 Bug 0308（2026-10-06）补的：此前只认默认 kind，团队只接了 codex / hermes 等机器时
+       * 懒建助理 100% `no-runtime`——入职向导里用户明明选了 codex，助理照样建不出来，进团队后
+       * 「没有可用的 Agent」。用户选了哪台就该用哪台；没选时有机器也不该因为 kind 不是默认值就一个不给。
+       */
+      async pickAssistantRuntime(preferred) {
         const runtimes = (await this.opts.listRuntimes(void 0, this.scope())).filter((r) => r.status === "online");
         if (runtimes.length === 0) return null;
         let defaultKind = DEFAULT_ASSISTANT_RUNTIME_KIND;
@@ -175871,8 +176025,12 @@ var init_assistants = __esm({
             break;
           }
         }
-        const candidates = runtimes.filter((r) => r.kind === defaultKind);
-        if (candidates.length === 0) return null;
+        if (preferred) {
+          const hit = runtimes.find((r) => r.nodeId === preferred.nodeId && r.kind === preferred.runtimeKind);
+          if (hit) return hit;
+        }
+        const ofDefaultKind = runtimes.filter((r) => r.kind === defaultKind);
+        const candidates = ofDefaultKind.length > 0 ? ofDefaultKind : runtimes;
         const bindings = (await this.opts.registry.listBindings()).filter((b2) => b2.status === "active");
         const load = (r) => bindings.filter((b2) => b2.nodeId === r.nodeId && b2.runtimeKind === r.kind).length;
         return candidates.slice().sort((a, b2) => {
@@ -177316,7 +177474,7 @@ function buildWorkorderDraftDetail(draft, resolveActor, spawnReviewers, resolveR
   const hasDeliverySummary = spawns.some((op) => op.type === DELIVERY_SUMMARY_ARTIFACT_TYPE);
   const nodes = spawns.map((op) => {
     const rows = spawnReviewers ? draft.plan.ops.filter((o) => o.action === "edit" && o.artifactId === op.id && o.reviewers !== void 0).reduce(
-      (current, edit2) => applyReviewerList({ current, next: edit2.reviewers }),
+      (current, edit3) => applyReviewerList({ current, next: edit3.reviewers }),
       [...spawnReviewers(op.type, op.reviewers ?? [], { reviewersFinal: op.reviewersFinal === true })]
     ) : [];
     const pv = rows.length > 0 ? reviewerPreviewOfRows(rows.map((r) => ({ actor: r.reviewerActorId, source: r.source, reviewGroup: r.reviewGroup }))) : null;
@@ -188413,16 +188571,16 @@ function parse2(options) {
   );
   const parser = {
     constructs: constructs2,
-    content: create(content),
+    content: create2(content),
     defined: [],
-    document: create(document2),
-    flow: create(flow),
+    document: create2(document2),
+    flow: create2(flow),
     lazy: {},
-    string: create(string3),
-    text: create(text)
+    string: create2(string3),
+    text: create2(text)
   };
   return parser;
-  function create(initial) {
+  function create2(initial) {
     return creator;
     function creator(from) {
       return createTokenizer(parser, initial, from);
@@ -188866,10 +189024,10 @@ function compiler(options) {
     events[start][1]._spread = listSpread;
     return length;
   }
-  function opener(create, and) {
+  function opener(create2, and) {
     return open3;
     function open3(token2) {
-      enter.call(this, create(token2), token2);
+      enter.call(this, create2(token2), token2);
       if (and) and.call(this, token2);
     }
   }
@@ -212960,10 +213118,10 @@ async function startOasisServer(opts) {
               ...fp(p2)
             }))
           ] : [];
-          const { randomUUID: randomUUID48 } = await import("node:crypto");
+          const { randomUUID: randomUUID50 } = await import("node:crypto");
           try {
             await store.enqueuePendingMessage({
-              id: randomUUID48(),
+              id: randomUUID50(),
               chatSessionId: input.chatSessionId,
               text: input.text,
               createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -212996,11 +213154,11 @@ async function startOasisServer(opts) {
               ...f2?.mtime ? { srcMtime: f2.mtime } : {}
             };
           });
-          const { randomUUID: randomUUID48 } = await import("node:crypto");
+          const { randomUUID: randomUUID50 } = await import("node:crypto");
           const nowIso = (/* @__PURE__ */ new Date()).toISOString();
           try {
             await store.enqueuePendingMessage({
-              id: randomUUID48(),
+              id: randomUUID50(),
               chatSessionId: input.chatSessionId,
               text: "",
               createdAt: nowIso,
@@ -214475,7 +214633,7 @@ async function startOasisServer(opts) {
               const openRoom = async () => {
                 let chatSessionId2;
                 if (chatStore) {
-                  const { randomUUID: randomUUID48 } = await import("node:crypto");
+                  const { randomUUID: randomUUID50 } = await import("node:crypto");
                   const known = discussSessions.get(itemKey);
                   const knownSession = known ? await chatStore.getSession(known) : null;
                   if (knownSession && knownSession.workspace === ctx.workspace && knownSession.humanActorId === ctx.ownerId && (!body2.escalationId || knownSession.escalationId === body2.escalationId)) chatSessionId2 = known;
@@ -214484,7 +214642,7 @@ async function startOasisServer(opts) {
                     chatSessionId2 = existing[0]?.id;
                   }
                   if (!chatSessionId2) {
-                    chatSessionId2 = randomUUID48();
+                    chatSessionId2 = randomUUID50();
                     const now = (/* @__PURE__ */ new Date()).toISOString();
                     const title = `\u89E3\u51B3\uFF1A${ctx.seed.slice(ctx.seed.indexOf("\uFF1A") + 1, ctx.seed.indexOf("\uFF1A") + 25) || "\u5DE5\u5355\u5361\u70B9"}`;
                     const reg0 = (await resolveEngine(currentCompanyId).catch(() => null))?.registry ?? opts.registry;
@@ -215690,7 +215848,7 @@ ${composed}`;
                         if (rejectedLedger.failures === 0 && retriedRow) {
                           turnPersisted = true;
                         } else if (rejectedLedger.failures === 0) {
-                          const { randomUUID: randomUUID48 } = await import("node:crypto");
+                          const { randomUUID: randomUUID50 } = await import("node:crypto");
                           const now = (/* @__PURE__ */ new Date()).toISOString();
                           const rejectedAttachments = effectiveAttachments.map((a) => ({
                             name: a.name,
@@ -215698,7 +215856,7 @@ ${composed}`;
                             ...a.contentType !== void 0 ? { contentType: a.contentType } : {}
                           }));
                           await chatStore.appendMessage({
-                            id: randomUUID48(),
+                            id: randomUUID50(),
                             sessionId: persistTarget.id,
                             role: "user",
                             content: persistedUserMessage,
@@ -215783,14 +215941,14 @@ ${composed}`;
                       runtimeSessionId: session.nativeSessionId ?? session.id
                     }).catch(() => void 0);
                   }
-                  const { randomUUID: randomUUID48 } = await import("node:crypto");
+                  const { randomUUID: randomUUID50 } = await import("node:crypto");
                   const persistAttachments = effectiveAttachments.map((a) => ({
                     name: a.name,
                     ...a.blobRef !== void 0 ? { blobRef: a.blobRef } : {},
                     ...a.contentType !== void 0 ? { contentType: a.contentType } : {}
                   }));
                   if (!retriedRow) await chatStore.appendMessage({
-                    id: randomUUID48(),
+                    id: randomUUID50(),
                     sessionId: persistTarget.id,
                     role: "user",
                     content: persistedUserMessage,
@@ -216442,8 +216600,8 @@ ${composed}`;
                 res.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ error: `\u56DE\u8C03\u5730\u5740\u4E0D\u53EF\u7528\uFF0C\u5DF2\u4E2D\u6B62\uFF08\u907F\u514D\u5728 GitHub \u4E0A\u7559\u4E0B\u5B64\u513F App\uFF09\uFF1A${e.message}` }));
                 return;
               }
-              const { randomUUID: randomUUID48 } = await import("node:crypto");
-              const state = randomUUID48();
+              const { randomUUID: randomUUID50 } = await import("node:crypto");
+              const state = randomUUID50();
               const nameSlug = (actorName || actorId?.split(":").pop() || owner?.login || "bot").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-|-$/g, "").slice(0, 24) || "bot";
               const nameSuffix = await chooseAppNameSuffix(
                 { employeeSlug: nameSlug, namePrefix: "oasis" },
@@ -220112,6 +220270,9 @@ var init_memory_control_plane_store = __esm({
       /** protected：FileControlPlaneStore 子类 open() 回放快照时直接恢复（密码须持久化）。 */
       accountSecrets = /* @__PURE__ */ new Map();
       // accountId → { passwordHash?, tokenVersion }
+      /** 已登出会话（ADR 0636；protected：文件版子类回放快照时直接恢复——不持久化的话重启即「复活」）。 */
+      revokedSessions = /* @__PURE__ */ new Map();
+      // tokenHash → record
       verificationCodes = /* @__PURE__ */ new Map();
       // email → record（短 TTL，文件版不持久化）
       /** 组织模型三表（protected：文件版子类回放快照时直接恢复）。 */
@@ -220173,6 +220334,10 @@ var init_memory_control_plane_store = __esm({
         }
         if (patch.status !== void 0) c.status = patch.status;
         if (patch.onboardingVariant !== void 0) c.onboardingVariant = patch.onboardingVariant;
+        if (patch.timeZone !== void 0) {
+          if (patch.timeZone === null) delete c.timeZone;
+          else c.timeZone = patch.timeZone;
+        }
         if (patch.dissolvedAt !== void 0) {
           if (patch.dissolvedAt === null) delete c.dissolvedAt;
           else c.dissolvedAt = patch.dissolvedAt;
@@ -220469,6 +220634,15 @@ var init_memory_control_plane_store = __esm({
         this.accountSecrets.set(accountId, { ...cur, tokenVersion: next });
         return next;
       }
+      // —— 已登出会话（ADR 0636）——
+      async revokeSession(rec2) {
+        const cutoff = Date.parse(rec2.revokedAt);
+        for (const [k2, r] of this.revokedSessions) if (Date.parse(r.expiresAt) < cutoff) this.revokedSessions.delete(k2);
+        if (!this.revokedSessions.has(rec2.tokenHash)) this.revokedSessions.set(rec2.tokenHash, { ...rec2 });
+      }
+      async isSessionRevoked(tokenHash) {
+        return this.revokedSessions.has(tokenHash);
+      }
       // —— 邮箱验证码（单邮箱一条 active）——
       async putVerificationCode(rec2) {
         this.verificationCodes.set(rec2.email, { ...rec2 });
@@ -220816,12 +220990,12 @@ function isUncategorizedProjectId(projectId2) {
 function latestUncategorizedActivityAt(candidates) {
   let bestIso = UNCATEGORIZED_UNKNOWN_TIME;
   let bestMs = Date.parse(UNCATEGORIZED_UNKNOWN_TIME);
-  for (const iso8 of candidates) {
-    if (!iso8) continue;
-    const ms = Date.parse(iso8);
+  for (const iso9 of candidates) {
+    if (!iso9) continue;
+    const ms = Date.parse(iso9);
     if (Number.isNaN(ms) || ms <= bestMs) continue;
     bestMs = ms;
-    bestIso = iso8;
+    bestIso = iso9;
   }
   return bestIso;
 }
@@ -221594,9 +221768,9 @@ function deriveRounds(runs) {
   }
   return rounds.sort((a, b2) => Date.parse(a.startedAt) - Date.parse(b2.startedAt) || a.key.localeCompare(b2.key));
 }
-function inWindow(iso8, fromMs, toMs) {
-  if (!iso8) return false;
-  const ms = Date.parse(iso8);
+function inWindow(iso9, fromMs, toMs) {
+  if (!iso9) return false;
+  const ms = Date.parse(iso9);
   return Number.isFinite(ms) && ms >= fromMs && ms <= toMs;
 }
 function computeFacts(input) {
@@ -225671,6 +225845,7 @@ var init_control_plane_file_store = __esm({
       "upsertAccount",
       "setAccountPassword",
       "bumpAccountTokenVersion",
+      "revokeSession",
       "upsertDigitalEmployee",
       "patchDigitalEmployee",
       "putAgentCredential",
@@ -225710,6 +225885,7 @@ var init_control_plane_file_store = __esm({
           for (const link of snap.inviteLinks ?? []) await MemoryControlPlaneStore.prototype.createInviteLink.call(store, link);
           for (const a of snap.accounts ?? []) await MemoryControlPlaneStore.prototype.upsertAccount.call(store, a);
           for (const e of snap.accountSecrets ?? []) store.accountSecrets.set(e.accountId, { ...e.secret });
+          for (const r of snap.revokedSessions ?? []) store.revokedSessions.set(r.tokenHash, { ...r });
           for (const e of snap.digitalEmployees ?? []) await MemoryControlPlaneStore.prototype.upsertDigitalEmployee.call(store, e);
           for (const c of snap.agentCredentials ?? []) await MemoryControlPlaneStore.prototype.putAgentCredential.call(store, c);
           for (const b2 of snap.principalBridges ?? []) await MemoryControlPlaneStore.prototype.putPrincipalBridge.call(store, b2);
@@ -225748,6 +225924,8 @@ var init_control_plane_file_store = __esm({
           inviteLinks: [...this.inviteLinks.values()],
           accounts,
           accountSecrets,
+          // 只有按哈希查的读面，直接读 protected map（同 offboardings）。
+          revokedSessions: [...this.revokedSessions.values()],
           digitalEmployees,
           agentCredentials,
           principalBridges,
@@ -230414,6 +230592,12 @@ function verifySession(token2, secret, nowMs) {
   if (typeof claims.exp !== "number" || claims.exp <= nowMs) return null;
   return claims;
 }
+function sessionTokenHash(token2) {
+  return (0, import_node_crypto54.createHash)("sha256").update(token2).digest("base64url");
+}
+function newSessionId() {
+  return (0, import_node_crypto54.randomBytes)(16).toString("base64url");
+}
 function generateCode() {
   return String((0, import_node_crypto54.randomInt)(0, 1e6)).padStart(6, "0");
 }
@@ -231728,40 +231912,21 @@ var init_migrate = __esm({
 });
 
 // ../server/src/domains/actors/variable-expiry.ts
-function zoneOffsetMs(ms, timeZone) {
-  const parts = new Intl.DateTimeFormat("en-US", {
-    timeZone,
-    hour12: false,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit",
-    hour: "2-digit",
-    minute: "2-digit",
-    second: "2-digit"
-  }).formatToParts(new Date(ms));
-  const get = (type) => Number(parts.find((p2) => p2.type === type)?.value ?? "0");
-  const asIfUtc = Date.UTC(get("year"), get("month") - 1, get("day"), get("hour") % 24, get("minute"), get("second"));
-  return asIfUtc - ms;
-}
-function zonedStartOfDayMs(dateStr, timeZone) {
-  const utcMidnight = Date.parse(`${dateStr}T00:00:00Z`);
-  const firstGuess = utcMidnight - zoneOffsetMs(utcMidnight, timeZone);
-  const corrected = utcMidnight - zoneOffsetMs(firstGuess, timeZone);
-  return corrected;
-}
 function isVariableExpired(expiresAt2, nowMs, timeZone = DEFAULT_VARIABLE_TIME_ZONE) {
   if (!expiresAt2) return false;
   const t = Date.parse(expiresAt2);
   if (Number.isNaN(t)) return false;
   const d = new Date(t);
   const dateStr = `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())}`;
+  if (!isValidDay(dateStr)) return false;
   return nowMs >= zonedStartOfDayMs(dateStr, timeZone);
 }
 var DEFAULT_VARIABLE_TIME_ZONE, pad;
 var init_variable_expiry = __esm({
   "../server/src/domains/actors/variable-expiry.ts"() {
     "use strict";
-    DEFAULT_VARIABLE_TIME_ZONE = "Asia/Shanghai";
+    init_src();
+    DEFAULT_VARIABLE_TIME_ZONE = DEFAULT_TIME_ZONE;
     pad = (n) => String(n).padStart(2, "0");
   }
 });
@@ -233300,6 +233465,19 @@ ${input.description}
         if (rows.some((r) => r.key === key2)) return true;
         return this.variableRecordsEnabled() && (await this.opts.store.listVariableRecords()).some((r) => r.key === key2);
       }
+      /**
+       * 变量到期按哪个时区算日界：本组织的生效时区（PRD v1.2 §7「按组织时区，未设置时按默认」）。
+       * 读失败回落 Asia/Shanghai 并告警——宁可按默认日界判，也不让一次控制面抖动把整次派单打挂。
+       */
+      async variableTimeZone() {
+        if (!this.opts.timeZone) return DEFAULT_VARIABLE_TIME_ZONE;
+        try {
+          return await this.opts.timeZone();
+        } catch (err) {
+          console.warn(`[variables] \u8BFB\u7EC4\u7EC7\u65F6\u533A\u5931\u8D25\uFF0C\u6309 ${DEFAULT_VARIABLE_TIME_ZONE} \u5224\u5230\u671F\uFF1A${err.message}`);
+          return DEFAULT_VARIABLE_TIME_ZONE;
+        }
+      }
       async resolveActorEnv(actorId) {
         const cfg = await this.opts.store.latestConfig(actorId);
         const enabledConnectors = await this.effectiveEnabledConnectors(actorId, cfg);
@@ -233319,12 +233497,13 @@ ${input.description}
         const decode2 = (ct) => ct.startsWith("plain:") ? ct.slice(6) : this.decrypt(ct);
         const expiredWinner = /* @__PURE__ */ new Map();
         const nowMs = Date.now();
+        const timeZone = await this.variableTimeZone();
         for (const row of rows) {
           if (row.scope !== "global") continue;
           if (row.actorId) continue;
           if (!row.connectorId || enabledConnectors.has(row.connectorId)) {
             env[row.key] = decode2(row.valueEncrypted);
-            expiredWinner.set(row.key, isVariableExpired(row.expiresAt, nowMs));
+            expiredWinner.set(row.key, isVariableExpired(row.expiresAt, nowMs, timeZone));
           }
         }
         for (const row of rows) {
@@ -233332,7 +233511,7 @@ ${input.description}
           if (row.actorId && row.actorId !== actorId) continue;
           if (!row.connectorId || enabledConnectors.has(row.connectorId)) {
             env[row.key] = decode2(row.valueEncrypted);
-            expiredWinner.set(row.key, isVariableExpired(row.expiresAt, nowMs));
+            expiredWinner.set(row.key, isVariableExpired(row.expiresAt, nowMs, timeZone));
           }
         }
         for (const [key2, expired] of expiredWinner) if (expired) delete env[key2];
@@ -233376,13 +233555,14 @@ ${input.description}
           if (!prev || rank[row.binding.kind] > rank[prev.binding.kind]) best.set(row.key, row);
         }
         const nowMs = Date.now();
+        const timeZone = await this.variableTimeZone();
         const out = [];
         for (const row of best.values()) {
           if (!isInjectableVariableName(row.key)) {
             skipUninjectable(row.key);
             continue;
           }
-          if (isVariableExpired(row.expiresAt, nowMs)) continue;
+          if (isVariableExpired(row.expiresAt, nowMs, timeZone)) continue;
           out.push(row);
         }
         return out;
@@ -233559,6 +233739,7 @@ ${input.description}
         const merged = /* @__PURE__ */ new Map();
         const expiredWinner = /* @__PURE__ */ new Map();
         const nowMs = Date.now();
+        const timeZone = await this.variableTimeZone();
         const gated = (row) => !row.connectorId || enabledConnectors.has(row.connectorId);
         const put3 = (row) => {
           if (!gated(row)) return;
@@ -233572,7 +233753,7 @@ ${input.description}
             deliveryMode: row.deliveryMode ?? "env",
             origin: { ...row.actorId !== void 0 ? { actorId: row.actorId } : {}, ...row.projectId !== void 0 ? { projectId: row.projectId } : {} }
           });
-          expiredWinner.set(row.key, isVariableExpired(row.expiresAt, nowMs));
+          expiredWinner.set(row.key, isVariableExpired(row.expiresAt, nowMs, timeZone));
         };
         for (const row of rows) {
           if (row.scope === "global" && !row.actorId) put3(row);
@@ -234511,10 +234692,10 @@ function normalizeExpiresAt(raw) {
   if (Number.isNaN(t)) throw new ApiError(400, "BAD_REQUEST", `expiresAt \u4E0D\u662F\u5408\u6CD5\u65E5\u671F\uFF1A${raw}`);
   return new Date(t).toISOString();
 }
-function assertCreatableVariable(key2, expiresAt2, nowMs = Date.now()) {
+function assertCreatableVariable(key2, expiresAt2, nowMs = Date.now(), timeZone = DEFAULT_VARIABLE_TIME_ZONE) {
   const problem = variableNameProblem(key2);
   if (problem) throw new ApiError(400, problem.code, problem.message);
-  if (expiresAt2 && isVariableExpired(expiresAt2, nowMs)) {
+  if (expiresAt2 && isVariableExpired(expiresAt2, nowMs, timeZone)) {
     throw new ApiError(400, "VARIABLE_EXPIRY_NOT_FUTURE", "\u65B0\u5EFA\u53D8\u91CF\u7684\u5230\u671F\u65F6\u95F4\u987B\u665A\u4E8E\u4ECA\u5929");
   }
 }
@@ -235069,7 +235250,7 @@ function actorsDomain(opts) {
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (typeof b2?.key !== "string" || !b2.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
-      const create = parseCreateFlag(b2.create);
+      const create2 = parseCreateFlag(b2.create);
       const legacyOpts = { replace: parseReplaceFlag(b2.replace), displaced: [] };
       const expiresAt2 = normalizeExpiresAt(b2.expiresAt);
       const audienceMeta = parseAudienceMeta(b2);
@@ -235123,9 +235304,9 @@ function actorsDomain(opts) {
         by: req.auth.actor,
         expiresAt: expiresAt2
       };
-      if (create) {
+      if (create2) {
         if (b2.value === void 0 || b2.value === "") throw new ApiError(400, "BAD_REQUEST", "\u65B0\u5EFA\u53D8\u91CF\u5FC5\u987B\u63D0\u4F9B\u53D8\u91CF\u503C");
-        assertCreatableVariable(b2.key, expiresAt2);
+        assertCreatableVariable(b2.key, expiresAt2, Date.now(), await service.variableTimeZone());
         const outcome = await service.createVariable({ ...input, value: b2.value }, legacyOpts).catch(rethrowBindingConflict);
         if (outcome === "exists") throw await variableExistsError(service, b2.key, selector);
       } else {
@@ -235262,7 +235443,7 @@ function actorsDomain(opts) {
         throw new ApiError(400, "MISSING_DELIVERY_MODE", "\u5FC5\u987B\u663E\u5F0F\u63D0\u4F9B deliveryMode\uFF08env | ref | broker\uFF09\u2014\u2014\u6295\u9012\u6863\u51B3\u5B9A\u660E\u6587\u662F\u5426\u8FDB agent env\uFF0C\u4E0D\u8BBE\u7F3A\u7701");
       }
       const expiresAt2 = normalizeExpiresAt(b2.expiresAt);
-      assertCreatableVariable(b2.key, expiresAt2);
+      assertCreatableVariable(b2.key, expiresAt2, Date.now(), await service.variableTimeZone());
       const bindings = parseBindingTargets(b2.bindings, "bindings");
       const replace2 = parseBindingTargets(b2.replace, "replace");
       const connectorId = await connectorOwner(service, b2.key);
@@ -235353,9 +235534,9 @@ function actorsDomain(opts) {
       const actorId = req.params.id;
       const b2 = req.body;
       if (typeof b2?.key !== "string" || !b2.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
-      const create = parseCreateFlag(b2.create);
+      const create2 = parseCreateFlag(b2.create);
       const legacyOpts = { replace: parseReplaceFlag(b2.replace), displaced: [] };
-      if (create) {
+      if (create2) {
         const owner = await service.getActor(actorId);
         if (!owner) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A Agent\uFF1A${actorId}`);
         if (owner.kind !== "agent") throw new ApiError(400, "BAD_REQUEST", "\u4E2A\u4EBA\u53D8\u91CF\u53EA\u80FD\u5EFA\u5728 Agent \u4E0A");
@@ -235371,8 +235552,8 @@ function actorsDomain(opts) {
           "\u5FC5\u987B\u663E\u5F0F\u63D0\u4F9B deliveryMode\uFF08env | ref | broker\uFF09\u2014\u2014\u6295\u9012\u6863\u51B3\u5B9A\u660E\u6587\u662F\u5426\u8FDB agent env\uFF0C\u4E0D\u8BBE\u7F3A\u7701"
         );
       }
-      if (create && (b2.value === void 0 || b2.value === "")) throw new ApiError(400, "BAD_REQUEST", "\u65B0\u5EFA\u53D8\u91CF\u5FC5\u987B\u63D0\u4F9B\u53D8\u91CF\u503C");
-      if (create) assertCreatableVariable(b2.key, expiresAt2);
+      if (create2 && (b2.value === void 0 || b2.value === "")) throw new ApiError(400, "BAD_REQUEST", "\u65B0\u5EFA\u53D8\u91CF\u5FC5\u987B\u63D0\u4F9B\u53D8\u91CF\u503C");
+      if (create2) assertCreatableVariable(b2.key, expiresAt2, Date.now(), await service.variableTimeZone());
       if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
       assertInjectableVariableName(b2.key);
       if (b2.connectorId === void 0) {
@@ -235400,7 +235581,7 @@ function actorsDomain(opts) {
         by: req.auth.actor,
         expiresAt: expiresAt2
       };
-      if (create) {
+      if (create2) {
         const outcome = await service.createVariable(input, legacyOpts).catch(rethrowBindingConflict);
         if (outcome === "exists") throw await variableExistsError(service, b2.key, { actorId });
       } else {
@@ -236431,6 +236612,7 @@ function createActorsDomain(opts) {
     ...opts.listSharedSkillFiles !== void 0 ? { listSharedSkillFiles: opts.listSharedSkillFiles } : {},
     ...opts.isInstalledSkillAvailable !== void 0 ? { isInstalledSkillAvailable: opts.isInstalledSkillAvailable } : {},
     ...opts.listBindingModelIds !== void 0 ? { listBindingModelIds: opts.listBindingModelIds } : {},
+    ...opts.companyTimeZone !== void 0 ? { timeZone: () => opts.companyTimeZone(companyOf()) } : {},
     // 服务内部的变量写入（连接器授权）抢占记录时由服务自己记审计（ADR 0578 评审 N-3），与路由同一个旁账。
     ...opts.credentialAudit !== void 0 ? { credentialAudit: (r) => opts.credentialAudit({ ...r, companyId: companyOf() }) } : {},
     ...kernel !== void 0 ? { onRolesChanged: (a, r) => kernel.setActorRoles(a, r) } : {},
@@ -236555,7 +236737,9 @@ function assistantsDomain(opts) {
       const humanId = req.params.humanId;
       try {
         await service.assertWritePermission(req.auth.actor, humanId);
-        const r = await service.ensureFor(humanId, req.auth.actor);
+        const b2 = req.body ?? {};
+        const preferred = typeof b2.nodeId === "string" && b2.nodeId && typeof b2.runtimeKind === "string" && b2.runtimeKind ? { nodeId: b2.nodeId, runtimeKind: b2.runtimeKind } : void 0;
+        const r = await service.ensureFor(humanId, req.auth.actor, preferred);
         return { status: 201, body: { agentId: r.agentId, source: r.source } };
       } catch (e) {
         toApiError2(e);
@@ -241623,7 +241807,8 @@ function fromRow(row) {
     ["result", str2(row["result"])],
     ["invalidReason", str2(row["invalid_reason"])],
     ["readAt", iso2(row["read_at"])],
-    ["item", row["item"] ?? void 0]
+    ["item", row["item"] ?? void 0],
+    ["chatSessionId", str2(row["chat_session_id"])]
   ];
   for (const [k2, v2] of opt) if (v2 !== void 0 && v2 !== null) r[k2] = v2;
   return r;
@@ -241789,6 +241974,7 @@ var init_notification_store = __esm({
         read_at         timestamptz,
         item            jsonb
       )`);
+        await sql.query(`ALTER TABLE "${s2}".notifications ADD COLUMN IF NOT EXISTS chat_session_id text`);
         await sql.query(`CREATE UNIQUE INDEX IF NOT EXISTS notifications_pending_source_uq
       ON "${s2}".notifications (recipient, source_key) WHERE status = 'pending'`);
         await sql.query(`CREATE UNIQUE INDEX IF NOT EXISTS notifications_notice_source_uq
@@ -241801,8 +241987,8 @@ var init_notification_store = __esm({
         const id = `ntf:${(0, import_node_crypto58.randomUUID)()}`;
         const r = await this.sql.query(
           `INSERT INTO ${this.t} (id, recipient, category, source_key, kind, workorder_id, node_id, card_id, actor_id,
-         title, workspace_title, entered_at, updated_at, status, read_at, item)
-       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$12,$13,$14,$15)
+         title, workspace_title, entered_at, updated_at, status, read_at, item, chat_session_id)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$12,$13,$14,$15,$16)
        ON CONFLICT DO NOTHING
        RETURNING *`,
           [
@@ -241820,7 +242006,8 @@ var init_notification_store = __esm({
             n.enteredAt,
             n.status ?? null,
             n.readAt ?? null,
-            n.item ? JSON.stringify(n.item) : null
+            n.item ? JSON.stringify(n.item) : null,
+            n.chatSessionId ?? null
           ]
         );
         if (r.rows[0]) return fromRow(r.rows[0]);
@@ -242472,11 +242659,11 @@ function parseUsageQuery(raw, now) {
   let timeZone = "UTC";
   if (raw.timeZone !== void 0 && raw.timeZone !== null && raw.timeZone !== "") {
     if (typeof raw.timeZone !== "string") throw new UsageQueryError("timeZone \u5FC5\u987B\u662F IANA \u65F6\u533A\u540D");
-    timeZone = canonicalTimeZone(raw.timeZone.trim());
+    timeZone = canonicalTimeZone2(raw.timeZone.trim());
   }
   return { range, asOf: new Date(asOfMs).toISOString(), timeZone };
 }
-function canonicalTimeZone(tz) {
+function canonicalTimeZone2(tz) {
   if (!tz) throw new UsageQueryError("timeZone \u5FC5\u987B\u662F IANA \u65F6\u533A\u540D");
   try {
     return new Intl.DateTimeFormat("en-US", { timeZone: tz }).resolvedOptions().timeZone;
@@ -242995,10 +243182,10 @@ var init_tags = __esm({
         return [...new Set(ids2.map((s2) => String(s2).trim()).filter(Boolean))].filter((id) => known.has(id));
       }
       ensureByName(companyId, name) {
-        const clean2 = cleanName(name ?? "");
-        if (!clean2) return null;
-        const hit = this.entries(companyId).find((t) => nameKey(t.name) === nameKey(clean2));
-        return hit ?? this.create(companyId, { name: clean2 });
+        const clean3 = cleanName(name ?? "");
+        if (!clean3) return null;
+        const hit = this.entries(companyId).find((t) => nameKey(t.name) === nameKey(clean3));
+        return hit ?? this.create(companyId, { name: clean3 });
       }
       /** 子类落盘钩子（内存实现为空）。 */
       persist() {
@@ -244383,6 +244570,11 @@ var init_projects = __esm({
 });
 
 // ../server/src/domains/companies/service.ts
+function assertProfileNameLength(value2, label2) {
+  if (profileNameLength(value2) > PROFILE_NAME_MAX) {
+    throw new CompanyError(400, "NAME_TOO_LONG", `${label2}\u6700\u591A ${PROFILE_NAME_MAX} \u4E2A\u5B57\u7B26`);
+  }
+}
 function normalizeEmail(raw) {
   const v2 = raw?.trim().toLowerCase() ?? "";
   return v2.length > 0 ? v2 : void 0;
@@ -244396,6 +244588,7 @@ var init_service6 = __esm({
   "../server/src/domains/companies/service.ts"() {
     "use strict";
     import_node_crypto60 = require("node:crypto");
+    init_src();
     init_console_url();
     ROLES = ["owner", "admin", "member"];
     INVITABLE_ROLES = ["admin", "member"];
@@ -244417,8 +244610,11 @@ var init_service6 = __esm({
       now;
       sender;
       consoleUrl;
+      /** 部署默认时区，见 {@link CompaniesServiceOptions.defaultTimeZone}。 */
+      defaultTimeZone;
       constructor(opts) {
         this.store = opts.store;
+        this.defaultTimeZone = opts.defaultTimeZone ?? DEFAULT_TIME_ZONE;
         this.now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
         this.sender = opts.sender;
         this.consoleUrl = opts.consoleUrl;
@@ -244484,12 +244680,47 @@ var init_service6 = __esm({
         await this.store.updateCompany(companyId, { onboardingVariant: variant });
         return { ...company, onboardingVariant: variant };
       }
+      /** 给成员看的公司：存的字段 + 实际生效的时区（含部署默认值回落）+ 部署默认时区。 */
+      view(company) {
+        return { ...company, effectiveTimeZone: effectiveTimeZone(company, this.defaultTimeZone), defaultTimeZone: this.defaultTimeZone };
+      }
+      /**
+       * 这家组织实际生效的时区。组织不存在、或控制面读失败时回落部署默认值并告警——
+       * 调用方是变量到期这类「必须给出一个答案」的判定，读不到组织行不该让派单整个失败。
+       */
+      async effectiveTimeZoneOf(companyId) {
+        if (!companyId) return this.defaultTimeZone;
+        try {
+          return effectiveTimeZone(await this.store.getCompany(companyId), this.defaultTimeZone);
+        } catch (err) {
+          console.warn(`[companies] \u8BFB\u7EC4\u7EC7 ${companyId} \u7684\u65F6\u533A\u5931\u8D25\uFF0C\u6309\u90E8\u7F72\u9ED8\u8BA4 ${this.defaultTimeZone}\uFF1A${err.message}`);
+          return this.defaultTimeZone;
+        }
+      }
+      /**
+       * 设置组织时区（IANA 名，存规范写法）；`null` = 清空，回到部署默认值。非法名 400。
+       * 权限（owner/admin）由路由层强制；这里守「组织还可用」（D8.2）。
+       */
+      async setTimeZone(companyId, timeZone) {
+        const canonical2 = timeZone === null ? null : canonicalTimeZone(timeZone);
+        if (timeZone !== null && !canonical2) {
+          throw new CompanyError(400, "INVALID_TIME_ZONE", `timeZone \u4E0D\u662F\u5408\u6CD5\u7684 IANA \u65F6\u533A\u540D\uFF1A${JSON.stringify(timeZone)}`);
+        }
+        const company = await this.requireActiveCompany(companyId);
+        await this.store.updateCompany(companyId, { timeZone: canonical2 });
+        if (canonical2 === null) {
+          const { timeZone: _drop, ...rest } = company;
+          return rest;
+        }
+        return { ...company, timeZone: canonical2 };
+      }
       /**
        * 改团队名称。**只改 name，不动 slug**——slug 是路由键（company:<slug> 与引擎 schema co_<slug>
        * 的一部分，`create` 里注释「建成不可改」），改它会让所有历史链接失效。
        * 校验（非空 / trim）在路由层做完了，这里假设 name 已经是非空 trim 过的字符串。
        */
       async renameCompany(id, name) {
+        assertProfileNameLength(name, "\u56E2\u961F\u7A7A\u95F4\u540D\u79F0");
         const company = await this.requireCompany(id);
         await this.store.updateCompany(id, { name });
         return { ...company, name };
@@ -244608,6 +244839,7 @@ var init_service6 = __esm({
         if (!SLUG_RE.test(slug5)) throw new CompanyError(400, "BAD_SLUG", "slug \u987B\u4E3A URL \u5B89\u5168\u7684\u5C0F\u5199\u4E32\uFF08^[a-z][a-z0-9-]*$\uFF09");
         const name = input.name?.trim() ?? "";
         if (!name) throw new CompanyError(400, "BAD_REQUEST", "\u7F3A\u5C11 name");
+        assertProfileNameLength(name, "\u56E2\u961F\u7A7A\u95F4\u540D\u79F0");
         if (await this.store.getCompanyBySlug(slug5)) throw new CompanyError(409, "SLUG_TAKEN", `slug \u5DF2\u88AB\u5360\u7528\uFF1A${slug5}`);
         const company = {
           id: `company:${slug5}`,
@@ -244800,6 +245032,7 @@ var init_service6 = __esm({
       async setMemberDisplayName(companyId, accountId, displayName3, callerAccountId) {
         const trimmed = displayName3.trim();
         if (!trimmed) throw new CompanyError(400, "BAD_REQUEST", "displayName \u4E0D\u80FD\u4E3A\u7A7A");
+        assertProfileNameLength(trimmed, "\u540D\u5B57");
         await this.requireCompany(companyId);
         const editingSomeoneElse = callerAccountId !== accountId;
         const res = await this.store.updateMemberDisplayName(companyId, accountId, trimmed, {
@@ -245687,7 +245920,7 @@ function isCompanyCrossTenantPath(pathname) {
   return COMPANY_CROSS_TENANT_PREFIXES.some((p2) => pathname === p2 || pathname.startsWith(`${p2}/`));
 }
 function companiesDomain(opts) {
-  const { service, currentUser, blobs, resolveActorsCtx, offboarding, agentCredentials } = opts;
+  const { service, currentUser, blobs, resolveActorsCtx, offboarding, agentCredentials, verifyAccountDeletionTicket, assistantOfHuman } = opts;
   const mapErr = (e) => {
     if (e instanceof CompanyError) throw new ApiError(e.status, e.code, e.message, e.details);
     throw e;
@@ -245707,8 +245940,13 @@ function companiesDomain(opts) {
     if (!name) return;
     const { service: actorsSvc } = await resolveActorsCtx(member.companyId);
     const existing = await actorsSvc.getActor(member.actorId);
-    if (!existing || existing.name === name) return;
-    await actorsSvc.upsertActor({ ...existing, name }, by);
+    if (existing && existing.name !== name) await actorsSvc.upsertActor({ ...existing, name }, by);
+    const bond = assistantOfHuman ? await assistantOfHuman(member.companyId, member.actorId) : null;
+    if (!bond || bond.origin !== "lazy-create") return;
+    const assistant = await actorsSvc.getActor(bond.agentActorId);
+    const assistantName = assistantNameFor(name);
+    if (!assistant || assistant.name === assistantName) return;
+    await actorsSvc.upsertActor({ ...assistant, name: assistantName }, by);
   };
   const requireIfMatch = (req) => {
     const raw = req.raw.headers["if-match"];
@@ -245752,13 +245990,13 @@ function companiesDomain(opts) {
     router.get("/api/companies", async (req) => {
       const me = await whoami(req);
       const items = await service.listForUser(me.accountId);
-      return { status: 200, body: { items } };
+      return { status: 200, body: { items: items.map((c) => service.view(c)) } };
     });
     router.get("/api/companies/:id", async (req) => {
       const cid = req.params.id;
       const me = await whoami(req);
       const company = await service.get(cid);
-      if (company && await service.getMember(cid, me.accountId)) return { status: 200, body: company };
+      if (company && await service.getMember(cid, me.accountId)) return { status: 200, body: service.view(company) };
       if (company && await service.hasPendingInvitation(cid, me.email)) {
         return { status: 200, body: { id: company.id, name: company.name } };
       }
@@ -245769,8 +246007,9 @@ function companiesDomain(opts) {
       const b2 = req.body ?? {};
       const hasName = b2.name !== void 0;
       const hasVariant = b2.onboardingVariant !== void 0;
-      if (!hasName && !hasVariant) {
-        throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11\u53EF\u66F4\u65B0\u5B57\u6BB5\uFF08name / onboardingVariant\uFF09");
+      const hasTimeZone = b2.timeZone !== void 0;
+      if (!hasName && !hasVariant && !hasTimeZone) {
+        throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11\u53EF\u66F4\u65B0\u5B57\u6BB5\uFF08name / onboardingVariant / timeZone\uFF09");
       }
       let trimmedName;
       if (hasName) {
@@ -245782,6 +246021,9 @@ function companiesDomain(opts) {
       if (hasVariant && b2.onboardingVariant !== "A" && b2.onboardingVariant !== "B") {
         throw new ApiError(400, "BAD_REQUEST", `onboardingVariant \u987B\u4E3A "A" | "B"`);
       }
+      if (hasTimeZone && b2.timeZone !== null && !isValidTimeZone(b2.timeZone)) {
+        throw new ApiError(400, "INVALID_TIME_ZONE", `timeZone \u987B\u4E3A\u5408\u6CD5\u7684 IANA \u65F6\u533A\u540D\uFF08\u5982 "Asia/Shanghai"\uFF09\uFF0C\u6216 null \u6E05\u7A7A\uFF1A${JSON.stringify(b2.timeZone)}`);
+      }
       await requireOwnerOrAdmin(req, cid);
       let company;
       if (trimmedName !== void 0) {
@@ -245790,7 +246032,10 @@ function companiesDomain(opts) {
       if (hasVariant) {
         company = await service.setOnboardingVariant(cid, b2.onboardingVariant).catch(mapErr);
       }
-      return { status: 200, body: company };
+      if (hasTimeZone) {
+        company = await service.setTimeZone(cid, b2.timeZone).catch(mapErr);
+      }
+      return { status: 200, body: service.view(company) };
     });
     router.post("/api/companies", async (req) => {
       const b2 = req.body ?? {};
@@ -245942,6 +246187,16 @@ function companiesDomain(opts) {
     router.delete("/api/accounts/me", async (req) => {
       const off = requireOffboarding();
       const me = await whoami(req);
+      if (!verifyAccountDeletionTicket) {
+        throw new ApiError(501, "NOT_IMPLEMENTED", "\u672C\u90E8\u7F72\u672A\u63A5\u5165\u6CE8\u9500\u90AE\u7BB1\u9A8C\u8BC1\uFF0C\u6682\u4E0D\u80FD\u6CE8\u9500\u8D26\u53F7");
+      }
+      const ticket = req.body?.ticket;
+      if (typeof ticket !== "string" || !ticket) {
+        throw new ApiError(403, "DELETION_VERIFICATION_REQUIRED", "\u6CE8\u9500\u524D\u9700\u8981\u5148\u5B8C\u6210\u90AE\u7BB1\u9A8C\u8BC1\u7801\u9A8C\u8BC1");
+      }
+      if (!await verifyAccountDeletionTicket(me.accountId, ticket)) {
+        throw new ApiError(403, "DELETION_VERIFICATION_INVALID", "\u90AE\u7BB1\u9A8C\u8BC1\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u83B7\u53D6\u9A8C\u8BC1\u7801");
+      }
       const { soloOwned, memberships } = await service.peekAccountDeletion(me.accountId).catch(mapErr);
       for (const c of soloOwned) {
         await service.dissolveSoloCompanyOnAccountDeletion(c.id, me.accountId).catch(mapErr);
@@ -246140,14 +246395,16 @@ function companiesDomain(opts) {
     });
   };
 }
-var COMPANY_CROSS_TENANT_PREFIXES;
+var COMPANY_CROSS_TENANT_PREFIXES, assistantNameFor;
 var init_routes6 = __esm({
   "../server/src/domains/companies/routes.ts"() {
     "use strict";
+    init_src();
     init_router();
     init_service6();
     init_image_upload();
     COMPANY_CROSS_TENANT_PREFIXES = ["/api/companies", "/api/invitations", "/api/invite-links", "/api/accounts"];
+    assistantNameFor = (humanName) => `${humanName}\u7684\u52A9\u7406`;
   }
 });
 
@@ -246273,13 +246530,35 @@ var init_agent_credentials = __esm({
   }
 });
 
+// ../server/src/domains/companies/time-zone.ts
+function defaultTimeZoneFromEnv(raw) {
+  const v2 = raw?.trim();
+  if (!v2) return DEFAULT_TIME_ZONE;
+  const canonical2 = canonicalTimeZone(v2);
+  if (!canonical2) {
+    throw new Error(
+      `${DEFAULT_TIME_ZONE_ENV}=${JSON.stringify(raw)} \u4E0D\u662F\u5408\u6CD5\u7684 IANA \u65F6\u533A\u540D\uFF08\u4F8B\uFF1AAsia/Shanghai\u3001America/New_York\u3001UTC\uFF09\uFF1B\u4E0D\u8BBE\u5219\u9ED8\u8BA4 ${DEFAULT_TIME_ZONE}\u3002\u62D2\u7EDD\u5E26\u7740\u9519\u8BEF\u65F6\u533A\u542F\u52A8\u3002`
+    );
+  }
+  return canonical2;
+}
+var DEFAULT_TIME_ZONE_ENV;
+var init_time_zone2 = __esm({
+  "../server/src/domains/companies/time-zone.ts"() {
+    "use strict";
+    init_src();
+    DEFAULT_TIME_ZONE_ENV = "OASIS_DEFAULT_TIMEZONE";
+  }
+});
+
 // ../server/src/domains/companies/index.ts
 function createCompaniesDomain(opts) {
   const service = new CompaniesService({
     store: opts.store,
     ...opts.now !== void 0 ? { now: opts.now } : {},
     ...opts.sender !== void 0 ? { sender: opts.sender } : {},
-    ...opts.consoleUrl !== void 0 ? { consoleUrl: opts.consoleUrl } : {}
+    ...opts.consoleUrl !== void 0 ? { consoleUrl: opts.consoleUrl } : {},
+    ...opts.defaultTimeZone !== void 0 ? { defaultTimeZone: opts.defaultTimeZone } : {}
   });
   const currentUser = opts.currentUser ?? makeCurrentUser(opts.store);
   const offboarding = new MemberOffboardingService({
@@ -246325,8 +246604,10 @@ function createCompaniesDomain(opts) {
       offboarding,
       currentUser,
       ...opts.agentCredentials !== void 0 ? { agentCredentials: opts.agentCredentials } : {},
+      ...opts.verifyAccountDeletionTicket !== void 0 ? { verifyAccountDeletionTicket: opts.verifyAccountDeletionTicket } : {},
       ...opts.blobs !== void 0 ? { blobs: opts.blobs } : {},
-      ...opts.resolveActorsCtx !== void 0 ? { resolveActorsCtx: opts.resolveActorsCtx } : {}
+      ...opts.resolveActorsCtx !== void 0 ? { resolveActorsCtx: opts.resolveActorsCtx } : {},
+      ...opts.assistantOfHuman !== void 0 ? { assistantOfHuman: opts.assistantOfHuman } : {}
     }),
     currentUser
   };
@@ -246348,6 +246629,7 @@ var init_companies = __esm({
     init_agent_credentials();
     init_routes6();
     init_migrate();
+    init_time_zone2();
   }
 });
 
@@ -246365,6 +246647,14 @@ function parseCookies(header) {
 function looksLikeEmail(s2) {
   return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s2);
 }
+function meetsChangePasswordPolicy(pw) {
+  if (pw.length < 8) return false;
+  let classes = 0;
+  if (/[A-Za-z]/.test(pw)) classes++;
+  if (/\d/.test(pw)) classes++;
+  if (/[^A-Za-z0-9]/.test(pw)) classes++;
+  return classes >= 2;
+}
 function maskEmail(email2) {
   const at2 = email2.indexOf("@");
   if (at2 <= 0) return "***";
@@ -246378,11 +246668,13 @@ function createAuth(opts) {
   const maxAttempts = opts.maxCodeAttempts ?? 5;
   const resendThrottleMs = opts.resendThrottleMs ?? 60 * 1e3;
   const riskFailureThreshold = opts.riskFailureThreshold ?? 3;
+  const deletionTicketTtlMs = opts.deletionTicketTtlMs ?? 10 * 60 * 1e3;
   const { store, sender, jwtSecret } = opts;
+  const deletionTicketSecret = `${jwtSecret}\0account-deletion-ticket`;
   const passwordFailures = /* @__PURE__ */ new Map();
   const sessionCookie = (accountId, tokenVersion) => {
     const t = now();
-    const jwt = signSession({ sub: accountId, tokenVersion, iat: t, exp: t + sessionTtlMs }, jwtSecret);
+    const jwt = signSession({ sub: accountId, tokenVersion, iat: t, exp: t + sessionTtlMs, jti: newSessionId() }, jwtSecret);
     const attrs = [`${cookieName}=${jwt}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${Math.floor(sessionTtlMs / 1e3)}`];
     if (opts.secureCookie) attrs.push("Secure");
     return attrs.join("; ");
@@ -246398,45 +246690,55 @@ function createAuth(opts) {
     const tokenVersion = sec?.tokenVersion ?? 0;
     return { status: 200, body: account, setCookie: sessionCookie(account.id, tokenVersion) };
   };
-  const sendCode = async (email2) => {
-    const existing = await store.getVerificationCode(email2);
-    const fresh = existing && Date.parse(existing.createdAt) > now() - resendThrottleMs;
-    if (fresh) return;
+  const codeKey = (email2, purpose = "login") => purpose === "login" ? email2 : `${purpose} ${email2}`;
+  const sendCodeDetailed = async (email2, purpose = "login") => {
+    const key2 = codeKey(email2, purpose);
+    const existing = await store.getVerificationCode(key2);
+    const createdAt = existing ? Date.parse(existing.createdAt) : Number.NaN;
+    if (existing && createdAt > now() - resendThrottleMs) {
+      return { sent: false, retryAfterMs: createdAt + resendThrottleMs - now() };
+    }
     const code2 = generateCode();
     const t = now();
     await store.putVerificationCode({
-      email: email2,
+      email: key2,
       codeHash: hashCode(code2, jwtSecret),
       createdAt: new Date(t).toISOString(),
       expiresAt: new Date(t + codeTtlMs).toISOString(),
       attempts: 0
     });
     try {
-      await sender.sendCode(email2, code2);
+      if (purpose === "login") await sender.sendCode(email2, code2);
+      else await sender.sendCode(email2, code2, purpose);
     } catch (e) {
       console.error(`[auth] \u9A8C\u8BC1\u7801\u53D1\u9001\u5931\u8D25 ${maskEmail(email2)}: ${e instanceof Error ? e.message : String(e)}`);
     }
+    return { sent: true, retryAfterMs: resendThrottleMs };
   };
-  const verifyEmailCode = async (email2, code2) => {
-    const rec2 = email2 ? await store.getVerificationCode(email2) : null;
+  const sendCode = async (email2, purpose = "login") => (await sendCodeDetailed(email2, purpose)).sent;
+  const verifyEmailCode = async (email2, code2, purpose = "login") => {
+    const key2 = codeKey(email2, purpose);
+    const rec2 = email2 ? await store.getVerificationCode(key2) : null;
     if (!rec2) return "invalid";
     if (Date.parse(rec2.expiresAt) <= now()) {
-      await store.deleteVerificationCode(email2);
+      await store.deleteVerificationCode(key2);
       return "expired";
     }
-    if (rec2.attempts >= maxAttempts) return "invalid";
+    if (rec2.attempts >= maxAttempts) return "locked";
     if (!code2 || !safeEqualHash(rec2.codeHash, hashCode(code2, jwtSecret))) {
-      await store.incrementCodeAttempts(email2);
+      await store.incrementCodeAttempts(key2);
       return "invalid";
     }
-    await store.deleteVerificationCode(email2);
+    await store.deleteVerificationCode(key2);
     return "ok";
   };
+  const sessionToken = (headers) => parseCookies(typeof headers.cookie === "string" ? headers.cookie : void 0)[cookieName];
   const currentAccount = async (headers) => {
-    const raw = parseCookies(typeof headers.cookie === "string" ? headers.cookie : void 0)[cookieName];
+    const raw = sessionToken(headers);
     if (!raw) return null;
     const claims = verifySession(raw, jwtSecret, now());
     if (!claims) return null;
+    if (await store.isSessionRevoked(sessionTokenHash(raw))) return null;
     const sec = await store.getAccountSecret(claims.sub);
     if (!sec || sec.tokenVersion !== claims.tokenVersion) return null;
     const account = await store.getAccount(claims.sub);
@@ -246447,6 +246749,15 @@ function createAuth(opts) {
     async sessionAccountId(headers) {
       return (await currentAccount(headers))?.id ?? null;
     },
+    async verifyAccountDeletionTicket(accountId, ticket) {
+      if (!ticket) return false;
+      const claims = verifySession(ticket, deletionTicketSecret, now());
+      if (!claims || claims.sub !== accountId) return false;
+      const sec = await store.getAccountSecret(accountId);
+      if (!sec || sec.tokenVersion !== claims.tokenVersion) return false;
+      const account = await store.getAccount(accountId);
+      return Boolean(account && mayHoldSession(account));
+    },
     async handle(method, pathname, rawBody, headers) {
       const route2 = pathname.replace(/^\/api\/auth\//, "");
       if (method === "GET" && route2 === "me") {
@@ -246550,7 +246861,75 @@ function createAuth(opts) {
         await store.setAccountPassword(account.id, hashPassword(password));
         return { status: 200, body: { ok: true } };
       }
+      if (route2 === "change-password/request-code") {
+        const account = await currentAccount(headers);
+        if (!account) return { status: 401, body: { error: { code: "UNAUTHENTICATED", message: "\u672A\u767B\u5F55" } } };
+        const email2 = account.email.trim().toLowerCase();
+        const { sent, retryAfterMs: retryAfterMs2 } = await sendCodeDetailed(email2, "change-password");
+        return {
+          status: 202,
+          body: { ok: true, maskedEmail: maskEmail(email2), resent: sent, retryAfterSeconds: Math.max(0, Math.ceil(retryAfterMs2 / 1e3)) }
+        };
+      }
+      if (route2 === "change-password") {
+        const account = await currentAccount(headers);
+        if (!account) return { status: 401, body: { error: { code: "UNAUTHENTICATED", message: "\u672A\u767B\u5F55" } } };
+        const code2 = typeof parsed.code === "string" ? parsed.code.trim() : "";
+        const password = typeof parsed.password === "string" ? parsed.password : "";
+        if (!meetsChangePasswordPolicy(password)) {
+          return { status: 400, body: { error: { code: "WEAK_PASSWORD", message: "\u81F3\u5C11 8 \u4F4D\uFF0C\u5305\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u7B26\u53F7\u4E2D\u7684\u81F3\u5C11\u4E24\u7C7B" } } };
+        }
+        if (!/^\d{6}$/.test(code2)) {
+          return { status: 400, body: { error: { code: "BAD_CODE_FORMAT", message: "\u8BF7\u8F93\u5165 6 \u4F4D\u6570\u5B57\u9A8C\u8BC1\u7801" } } };
+        }
+        const verdict = await verifyEmailCode(account.email.trim().toLowerCase(), code2, "change-password");
+        if (verdict !== "ok") {
+          return { status: 401, body: { error: { code: "INVALID_CODE", message: "\u9A8C\u8BC1\u7801\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u83B7\u53D6", reason: verdict } } };
+        }
+        await store.setAccountPassword(account.id, hashPassword(password));
+        return { status: 200, body: { ok: true } };
+      }
+      if (route2 === "account-deletion/request-code") {
+        const account = await currentAccount(headers);
+        if (!account) return { status: 401, body: { error: { code: "UNAUTHENTICATED", message: "\u672A\u767B\u5F55" } } };
+        const email2 = account.email.trim().toLowerCase();
+        const sent = await sendCode(email2, "account-deletion");
+        return { status: 202, body: { ok: true, maskedEmail: maskEmail(email2), resent: sent } };
+      }
+      if (route2 === "account-deletion/verify-code") {
+        const account = await currentAccount(headers);
+        if (!account) return { status: 401, body: { error: { code: "UNAUTHENTICATED", message: "\u672A\u767B\u5F55" } } };
+        const code2 = typeof parsed.code === "string" ? parsed.code.trim() : "";
+        if (!/^\d{6}$/.test(code2)) {
+          return { status: 400, body: { error: { code: "BAD_CODE_FORMAT", message: "\u8BF7\u8F93\u5165 6 \u4F4D\u6570\u5B57\u9A8C\u8BC1\u7801" } } };
+        }
+        const verdict = await verifyEmailCode(account.email.trim().toLowerCase(), code2, "account-deletion");
+        if (verdict !== "ok") {
+          const message = verdict === "expired" ? "\u9A8C\u8BC1\u7801\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u83B7\u53D6" : verdict === "locked" ? "\u9A8C\u8BC1\u7801\u9519\u8BEF\u6B21\u6570\u8FC7\u591A\uFF0C\u8BF7\u91CD\u65B0\u83B7\u53D6" : "\u9A8C\u8BC1\u7801\u9519\u8BEF\u6216\u5DF2\u5931\u6548\uFF0C\u8BF7\u68C0\u67E5\u540E\u91CD\u8BD5";
+          return { status: 401, body: { error: { code: "INVALID_CODE", message, reason: verdict } } };
+        }
+        const sec = await store.getAccountSecret(account.id);
+        const t = now();
+        const exp = t + deletionTicketTtlMs;
+        const ticket = signSession({ sub: account.id, tokenVersion: sec?.tokenVersion ?? 0, iat: t, exp }, deletionTicketSecret);
+        return { status: 200, body: { ticket, expiresAt: new Date(exp).toISOString() } };
+      }
       if (route2 === "logout") {
+        const raw = sessionToken(headers);
+        const claims = raw ? verifySession(raw, jwtSecret, now()) : null;
+        if (raw && claims) {
+          try {
+            await store.revokeSession({
+              tokenHash: sessionTokenHash(raw),
+              accountId: claims.sub,
+              revokedAt: new Date(now()).toISOString(),
+              expiresAt: new Date(claims.exp).toISOString()
+            });
+          } catch (e) {
+            console.error(`[auth] \u767B\u51FA\u540A\u9500\u5931\u8D25 ${claims.sub}: ${e instanceof Error ? e.message : String(e)}`);
+            return { status: 500, body: { error: { code: "LOGOUT_REVOKE_FAILED", message: "\u767B\u51FA\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u8BD5" } }, setCookie: clearCookie() };
+          }
+        }
         return { status: 200, body: { ok: true }, setCookie: clearCookie() };
       }
       return { status: 404, body: { error: { code: "NOT_FOUND", message: pathname } } };
@@ -246574,8 +246953,8 @@ var init_auth = __esm({
 // ../server/src/auth/sender.ts
 function consoleSender() {
   return {
-    async sendCode(email2, code2) {
-      console.log(`[auth] \u9A8C\u8BC1\u7801 \u2192 ${email2}: ${code2}`);
+    async sendCode(email2, code2, purpose) {
+      console.log(`[auth] ${purpose && purpose !== "login" ? CODE_PURPOSE_LABEL[purpose] : "\u9A8C\u8BC1\u7801"} \u2192 ${email2}: ${code2}`);
     },
     async sendInvitation(email2, opts) {
       console.log(
@@ -246587,15 +246966,17 @@ function consoleSender() {
 function resendSender(opts) {
   const doFetch = opts.fetchImpl ?? fetch;
   return {
-    async sendCode(email2, code2) {
+    async sendCode(email2, code2, purpose) {
+      const deletion = purpose === "account-deletion";
+      const label2 = CODE_PURPOSE_LABEL[purpose ?? "login"];
       const res = await doFetch("https://api.resend.com/emails", {
         method: "POST",
         headers: { authorization: `Bearer ${opts.apiKey}`, "content-type": "application/json" },
         body: JSON.stringify({
           from: opts.from,
           to: [email2],
-          subject: "\u4F60\u7684 Oasis \u767B\u5F55\u9A8C\u8BC1\u7801",
-          html: `<div style="font-family:sans-serif;max-width:400px;margin:0 auto"><h2>\u767B\u5F55\u9A8C\u8BC1\u7801</h2><p style="font-size:32px;font-weight:bold;letter-spacing:8px;margin:24px 0">${code2}</p><p>\u9A8C\u8BC1\u7801 10 \u5206\u949F\u5185\u6709\u6548\u3002</p><p style="color:#666;font-size:14px">\u5982\u679C\u4E0D\u662F\u4F60\u672C\u4EBA\u64CD\u4F5C\uFF0C\u5FFD\u7565\u6B64\u90AE\u4EF6\u5373\u53EF\u3002</p></div>`
+          subject: `\u4F60\u7684 Oasis ${label2}`,
+          html: `<div style="font-family:sans-serif;max-width:400px;margin:0 auto"><h2>${label2}</h2><p style="font-size:32px;font-weight:bold;letter-spacing:8px;margin:24px 0">${code2}</p><p>\u9A8C\u8BC1\u7801 10 \u5206\u949F\u5185\u6709\u6548\u3002</p>` + (deletion ? `<p style="color:#b42318;font-size:14px">\u4F60\u6B63\u5728\u6CE8\u9500 Oasis \u8D26\u53F7\uFF0C\u6CE8\u9500\u540E\u4E0D\u53EF\u6062\u590D\u3002\u8BF7\u52FF\u628A\u9A8C\u8BC1\u7801\u544A\u8BC9\u4EFB\u4F55\u4EBA\uFF1B\u5982\u679C\u4E0D\u662F\u4F60\u672C\u4EBA\u64CD\u4F5C\uFF0C\u8BF7\u5FFD\u7565\u6B64\u90AE\u4EF6\u5E76\u5C3D\u5FEB\u4FEE\u6539\u5BC6\u7801\u3002</p></div>` : purpose === "change-password" ? `<p style="color:#b42318;font-size:14px">\u4F60\u6B63\u5728\u4FEE\u6539 Oasis \u767B\u5F55\u5BC6\u7801\u3002\u8BF7\u52FF\u628A\u9A8C\u8BC1\u7801\u544A\u8BC9\u4EFB\u4F55\u4EBA\uFF1B\u5982\u679C\u4E0D\u662F\u4F60\u672C\u4EBA\u64CD\u4F5C\uFF0C\u8BF7\u5FFD\u7565\u6B64\u90AE\u4EF6\u5E76\u5C3D\u5FEB\u68C0\u67E5\u8D26\u53F7\u5B89\u5168\u3002</p></div>` : `<p style="color:#666;font-size:14px">\u5982\u679C\u4E0D\u662F\u4F60\u672C\u4EBA\u64CD\u4F5C\uFF0C\u5FFD\u7565\u6B64\u90AE\u4EF6\u5373\u53EF\u3002</p></div>`)
         })
       });
       if (!res.ok) {
@@ -246622,9 +247003,15 @@ function resendSender(opts) {
     }
   };
 }
+var CODE_PURPOSE_LABEL;
 var init_sender = __esm({
   "../server/src/auth/sender.ts"() {
     "use strict";
+    CODE_PURPOSE_LABEL = {
+      login: "\u767B\u5F55\u9A8C\u8BC1\u7801",
+      "account-deletion": "\u6CE8\u9500\u8D26\u53F7\u9A8C\u8BC1\u7801",
+      "change-password": "\u4FEE\u6539\u5BC6\u7801\u9A8C\u8BC1\u7801"
+    };
   }
 });
 
@@ -249921,7 +250308,7 @@ var init_notification_reconciler = __esm({
         if (!store) return 0;
         const members = new Set(ctx.humans);
         const titleOf = workspaceTitleMap(model);
-        const fresh = (iso8) => nowMs - Date.parse(iso8) <= TASK_NOTICE_FRESH_MS;
+        const fresh = (iso9) => nowMs - Date.parse(iso9) <= TASK_NOTICE_FRESH_MS;
         let sent = 0;
         const emit = async (workorderId, kind, rec2, trigger) => {
           const recipients = taskNoticeRecipients(model, workorderId, await loadSnapshot2(workorderId), members, trigger);
@@ -250143,6 +250530,7 @@ function pushThrottleOptionsFromEnv(env = process.env) {
   };
 }
 function shouldPush(record10) {
+  if (record10.category === "todo") return !record10.readAt;
   if (record10.category !== "action") return false;
   if (record10.readAt) return false;
   return record10.status === "pending";
@@ -250458,7 +250846,7 @@ var init_push_notifier = __esm({
 function makeSeededWorkorderCreator(deps) {
   const locks = createKeyedMutex();
   const genWorkspace = deps.genWorkspace ?? (() => `ws:wo-${(0, import_node_crypto66.randomUUID)().slice(0, 8)}`);
-  const create = async (input) => {
+  const create2 = async (input) => {
     const company = input.companyId && deps.resolveCompany ? await deps.resolveCompany(input.companyId) : void 0;
     const kernel = company?.kernel ?? deps.kernel;
     const blobs = company?.blobs ?? deps.blobs;
@@ -250546,7 +250934,7 @@ function makeSeededWorkorderCreator(deps) {
   return async (input) => {
     const release = await locks.acquire(`${input.companyId ?? ""}\0${input.idempotencyKey ?? (0, import_node_crypto66.randomUUID)()}`);
     try {
-      return await create(input);
+      return await create2(input);
     } finally {
       release();
     }
@@ -254763,6 +255151,496 @@ var init_agent_default_runtime_store = __esm({
   }
 });
 
+// ../server/src/domains/todos/flag.ts
+function personalTodoEnabledFromEnv(env = process.env) {
+  const raw = (env["OASIS_PERSONAL_TODO"] ?? "").trim().toLowerCase();
+  return !(raw === "off" || raw === "0" || raw === "false");
+}
+var init_flag = __esm({
+  "../server/src/domains/todos/flag.ts"() {
+    "use strict";
+  }
+});
+
+// ../server/src/domains/todos/service.ts
+function assertFirstVersionAssignee(creator, assignee) {
+  if (creator !== assignee) {
+    throw new ApiError(403, "TODO_ASSIGNEE_NOT_SELF", "\u4E2A\u4EBA\u5F85\u529E\u7B2C\u4E00\u7248\u53EA\u80FD\u8BB0\u7ED9\u81EA\u5DF1\uFF1A\u53D1\u8D77\u4EBA\u548C\u627F\u63A5\u4EBA\u5FC5\u987B\u662F\u540C\u4E00\u4E2A\u4EBA\u3002");
+  }
+}
+function canAccessTodo(todo, caller) {
+  return isTodoParty(todo, caller.principal);
+}
+function newTodoId() {
+  return `td_${(0, import_node_crypto69.randomBytes)(4).toString("hex")}`;
+}
+function assertDay(day, what = "\u622A\u6B62\u65E5") {
+  if (typeof day !== "string" || !isValidDay(day)) {
+    throw new ApiError(400, "TODO_INVALID_DATE", `${what}\u987B\u4E3A\u4E0D\u5E26\u65F6\u533A\u7684\u771F\u5B9E\u65E5\u671F YYYY-MM-DD\uFF08\u4F8B\uFF1A2026-10-09\uFF09\uFF0C\u6536\u5230\uFF1A${String(day)}`);
+  }
+}
+function assertTime(time3, what = "\u622A\u6B62\u65F6\u523B") {
+  if (typeof time3 !== "string" || !isValidTodoTime(time3)) {
+    throw new ApiError(400, "TODO_INVALID_TIME", `${what}\u987B\u4E3A 24 \u5C0F\u65F6\u5236 HH:mm\uFF08\u4F8B\uFF1A18:00\uFF09\uFF0C\u6536\u5230\uFF1A${String(time3)}`);
+  }
+}
+function assertStartBeforeDue(t) {
+  if (!isTodoStartBeforeDue(t)) {
+    const fmt = (d, h) => `${d}${h ? ` ${h}` : ""}`;
+    throw new ApiError(400, "TODO_START_AFTER_DUE", `\u5F00\u59CB\uFF08${fmt(t.startDate, t.startTime)}\uFF09\u4E0D\u80FD\u665A\u4E8E\u622A\u6B62\uFF08${fmt(t.dueDate, t.dueTime)}\uFF09`);
+  }
+}
+var import_node_crypto69, TITLE_MAX, NOTE_MAX, REASON_MAX, clean2, TodoService;
+var init_service10 = __esm({
+  "../server/src/domains/todos/service.ts"() {
+    "use strict";
+    import_node_crypto69 = require("node:crypto");
+    init_src();
+    init_router();
+    TITLE_MAX = 200;
+    NOTE_MAX = 4e3;
+    REASON_MAX = 500;
+    clean2 = (v2) => {
+      const t = v2?.trim();
+      return t ? t : void 0;
+    };
+    TodoService = class {
+      constructor(deps) {
+        this.deps = deps;
+      }
+      nowMs() {
+        return this.deps.now?.() ?? Date.now();
+      }
+      async today() {
+        return todoToday(await this.deps.timeZone(), this.nowMs());
+      }
+      async respond(todo) {
+        const today = await this.today();
+        return { today, todayLine: formatTodayLine(today), todo };
+      }
+      change(todoId, caller, at2, field, oldValue, newValue, reason) {
+        return {
+          id: `tdc_${(0, import_node_crypto69.randomUUID)()}`,
+          todoId,
+          actorId: caller.principal,
+          at: at2,
+          field,
+          ...caller.hand ? { handActorId: caller.hand } : {},
+          ...oldValue !== void 0 ? { oldValue } : {},
+          ...newValue !== void 0 ? { newValue } : {},
+          ...reason ? { reason } : {}
+        };
+      }
+      async create(caller, input) {
+        const title = clean2(input.title);
+        if (!title) throw new ApiError(400, "TODO_INVALID", "title \u4E0D\u80FD\u4E3A\u7A7A");
+        if (title.length > TITLE_MAX) throw new ApiError(400, "TODO_INVALID", `title \u4E0D\u80FD\u8D85\u8FC7 ${TITLE_MAX} \u5B57`);
+        const note = clean2(input.note);
+        if (note && note.length > NOTE_MAX) throw new ApiError(400, "TODO_INVALID", `note \u4E0D\u80FD\u8D85\u8FC7 ${NOTE_MAX} \u5B57`);
+        assertDay(input.dueDate);
+        if (input.dueTime !== void 0) assertTime(input.dueTime);
+        if (input.startDate !== void 0) assertDay(input.startDate, "\u5F00\u59CB\u65E5");
+        if (input.startTime !== void 0) {
+          if (input.startDate === void 0) throw new ApiError(400, "TODO_INVALID", "\u6709\u5F00\u59CB\u65F6\u523B\u5C31\u8981\u6709\u5F00\u59CB\u65E5\uFF08startTime \u987B\u914D startDate\uFF09");
+          assertTime(input.startTime, "\u5F00\u59CB\u65F6\u523B");
+        }
+        assertStartBeforeDue({ ...input });
+        const creator = caller.principal;
+        const assignee = caller.principal;
+        assertFirstVersionAssignee(creator, assignee);
+        const at2 = new Date(this.nowMs()).toISOString();
+        const todo = {
+          id: newTodoId(),
+          title,
+          ...note ? { note } : {},
+          creatorActorId: creator,
+          assigneeActorId: assignee,
+          recordedByActorId: caller.actor,
+          dueDate: input.dueDate,
+          ...input.dueTime ? { dueTime: input.dueTime } : {},
+          ...input.startDate ? { startDate: input.startDate } : {},
+          ...input.startTime ? { startTime: input.startTime } : {},
+          status: "open",
+          ...clean2(input.sourceChatSessionId) ? { sourceChatSessionId: clean2(input.sourceChatSessionId) } : {},
+          createdAt: at2,
+          updatedAt: at2
+        };
+        const saved = await this.deps.store.create(todo, [this.change(todo.id, caller, at2, "created", void 0, title)]);
+        return this.respond(saved);
+      }
+      async list(caller, opts = {}) {
+        const statuses2 = opts.all ? ["open", "done", "cancelled"] : ["open"];
+        const items = (await this.deps.store.listInvolving(caller.principal, statuses2)).filter((t) => canAccessTodo(t, caller));
+        const today = await this.today();
+        return { today, todayLine: formatTodayLine(today), items };
+      }
+      /** 读一条并校验权限：不存在与无权限分开报（无权限 403——任务书口径「其他人 403」）。 */
+      async get(caller, id) {
+        const todo = await this.deps.store.get(id);
+        if (!todo) throw new ApiError(404, "TODO_NOT_FOUND", `\u5F85\u529E ${id} \u4E0D\u5B58\u5728`);
+        if (!canAccessTodo(todo, caller)) throw new ApiError(403, "TODO_FORBIDDEN", "\u65E0\u6743\u67E5\u770B\u6216\u4FEE\u6539\u8FD9\u6761\u5F85\u529E");
+        return todo;
+      }
+      async save(caller, before, next, changes) {
+        if (changes.length === 0) return this.respond(before);
+        const saved = await this.deps.store.update(next, before.updatedAt, changes);
+        if (!saved) throw new ApiError(409, "TODO_CONFLICT", "\u8FD9\u6761\u5F85\u529E\u521A\u88AB\u522B\u5904\u6539\u8FC7\uFF0C\u8BF7\u91CD\u65B0\u8BFB\u53D6\u540E\u518D\u6539");
+        return this.respond(saved);
+      }
+      async edit(caller, id, input) {
+        const before = await this.get(caller, id);
+        const reason = clean2(input.reason);
+        if (reason && reason.length > REASON_MAX) throw new ApiError(400, "TODO_INVALID", `reason \u4E0D\u80FD\u8D85\u8FC7 ${REASON_MAX} \u5B57`);
+        const at2 = new Date(this.nowMs()).toISOString();
+        const next = { ...before };
+        const changes = [];
+        const set = (field, value2) => {
+          const old = before[field];
+          if (old === value2) return;
+          if (value2 === void 0) delete next[field];
+          else next[field] = value2;
+          changes.push(this.change(id, caller, at2, field, old, value2, reason));
+        };
+        if (input.title !== void 0) {
+          const title = clean2(input.title);
+          if (!title) throw new ApiError(400, "TODO_INVALID", "title \u4E0D\u80FD\u6E05\u7A7A");
+          if (title.length > TITLE_MAX) throw new ApiError(400, "TODO_INVALID", `title \u4E0D\u80FD\u8D85\u8FC7 ${TITLE_MAX} \u5B57`);
+          set("title", title);
+        }
+        if (input.note !== void 0) {
+          const note = clean2(input.note);
+          if (note && note.length > NOTE_MAX) throw new ApiError(400, "TODO_INVALID", `note \u4E0D\u80FD\u8D85\u8FC7 ${NOTE_MAX} \u5B57`);
+          set("note", note);
+        }
+        if (input.startDate !== void 0) {
+          if (input.startDate === null) {
+            set("startDate", void 0);
+            if (input.startTime === void 0) set("startTime", void 0);
+          } else {
+            assertDay(input.startDate, "\u5F00\u59CB\u65E5");
+            set("startDate", input.startDate);
+          }
+        }
+        if (input.startTime !== void 0) {
+          if (input.startTime !== null) assertTime(input.startTime, "\u5F00\u59CB\u65F6\u523B");
+          set("startTime", input.startTime ?? void 0);
+        }
+        if (input.dueDate !== void 0) {
+          assertDay(input.dueDate);
+          set("dueDate", input.dueDate);
+        }
+        if (input.dueTime !== void 0) {
+          if (input.dueTime !== null) assertTime(input.dueTime);
+          set("dueTime", input.dueTime ?? void 0);
+        }
+        if (input.linkedWorkorderId !== void 0) set("linkedWorkorderId", clean2(input.linkedWorkorderId));
+        if (next.startTime && !next.startDate) throw new ApiError(400, "TODO_INVALID", "\u6709\u5F00\u59CB\u65F6\u523B\u5C31\u8981\u6709\u5F00\u59CB\u65E5\uFF08\u5148\u8BBE startDate\uFF09");
+        assertStartBeforeDue(next);
+        if (changes.length > 0) {
+          next.updatedAt = at2;
+          next.recordedByActorId = caller.actor;
+        }
+        return this.save(caller, before, next, changes);
+      }
+      async setStatus(caller, id, status, reason) {
+        const before = await this.get(caller, id);
+        const why = clean2(reason);
+        if (why && why.length > REASON_MAX) throw new ApiError(400, "TODO_INVALID", `reason \u4E0D\u80FD\u8D85\u8FC7 ${REASON_MAX} \u5B57`);
+        if (before.status === status) return this.respond(before);
+        const at2 = new Date(this.nowMs()).toISOString();
+        const next = { ...before, status, updatedAt: at2, recordedByActorId: caller.actor };
+        delete next.doneAt;
+        delete next.cancelledAt;
+        if (status === "done") next.doneAt = at2;
+        if (status === "cancelled") next.cancelledAt = at2;
+        return this.save(caller, before, next, [this.change(id, caller, at2, "status", before.status, status, why)]);
+      }
+      history(caller, id) {
+        return this.get(caller, id).then(() => this.deps.store.listChanges(id));
+      }
+    };
+  }
+});
+
+// ../server/src/domains/todos/store.ts
+var import_node_crypto70, import_promises15, import_node_path25, MemoryTodoStore;
+var init_store3 = __esm({
+  "../server/src/domains/todos/store.ts"() {
+    "use strict";
+    import_node_crypto70 = require("node:crypto");
+    import_promises15 = require("node:fs/promises");
+    import_node_path25 = require("node:path");
+    init_src();
+    MemoryTodoStore = class _MemoryTodoStore {
+      constructor(filename) {
+        this.filename = filename;
+      }
+      rows = { todos: {}, changes: [] };
+      tail = Promise.resolve();
+      static async open(filename) {
+        const store = new _MemoryTodoStore(filename);
+        try {
+          store.rows = JSON.parse(await (0, import_promises15.readFile)(filename, "utf8"));
+        } catch (error2) {
+          if (error2.code !== "ENOENT") throw error2;
+        }
+        return store;
+      }
+      write(run) {
+        const pending = this.tail.then(async () => {
+          const next = structuredClone(this.rows);
+          const result = run(next);
+          if (result === null) return null;
+          if (this.filename) {
+            await (0, import_promises15.mkdir)((0, import_node_path25.dirname)(this.filename), { recursive: true });
+            const temp = `${this.filename}.${(0, import_node_crypto70.randomUUID)()}.tmp`;
+            await (0, import_promises15.writeFile)(temp, JSON.stringify(next), "utf8");
+            await (0, import_promises15.rename)(temp, this.filename);
+          }
+          this.rows = next;
+          return structuredClone(result);
+        });
+        this.tail = pending.catch(() => void 0);
+        return pending;
+      }
+      async create(todo, changes) {
+        const saved = await this.write((next) => {
+          if (next.todos[todo.id]) throw new Error(`todo ${todo.id} already exists`);
+          next.todos[todo.id] = structuredClone(todo);
+          next.changes.push(...structuredClone(changes));
+          return todo;
+        });
+        return saved;
+      }
+      async get(id) {
+        await this.tail;
+        return structuredClone(this.rows.todos[id] ?? null);
+      }
+      update(next, expectedUpdatedAt, changes) {
+        return this.write((rows) => {
+          const current = rows.todos[next.id];
+          if (!current || current.updatedAt !== expectedUpdatedAt) return null;
+          rows.todos[next.id] = structuredClone(next);
+          rows.changes.push(...structuredClone(changes));
+          return next;
+        });
+      }
+      async listInvolving(actorId, statuses2) {
+        await this.tail;
+        return Object.values(this.rows.todos).filter((t) => statuses2.includes(t.status) && (t.creatorActorId === actorId || todoAssignees(t).includes(actorId))).sort(compareTodos).map((t) => structuredClone(t));
+      }
+      async listOpenReminderCandidates(fromDay, toDay) {
+        await this.tail;
+        const within = (day) => day !== void 0 && day >= fromDay && day <= toDay;
+        return Object.values(this.rows.todos).filter((t) => t.status === "open" && (within(t.dueDate) || within(t.startDate))).sort(compareTodos).map((t) => structuredClone(t));
+      }
+      async listChanges(todoId) {
+        await this.tail;
+        return this.rows.changes.filter((c) => c.todoId === todoId).map((c) => structuredClone(c));
+      }
+    };
+  }
+});
+
+// ../server/src/domains/todos/routes.ts
+function todosDomain(options) {
+  const wrap = (fn) => async (req) => {
+    if (!options.enabled()) throw new ApiError(404, "NOT_FOUND", "\u4E2A\u4EBA\u5F85\u529E\u672A\u5F00\u542F");
+    try {
+      const service = await options.serviceFor(req.auth.companyId);
+      const caller = await options.resolveCaller(req.auth.actor, req.auth.companyId);
+      return await fn(req, service, caller);
+    } catch (e) {
+      if (e instanceof ZodError) throw new ApiError(400, "TODO_INVALID", e.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "));
+      throw e;
+    }
+  };
+  const sourceSession = (req, fromBody) => req.auth.dispatch?.chatSessionId ?? fromBody;
+  return (router) => {
+    router.get("/api/todos", wrap(async (req, service, caller) => {
+      const all2 = ["1", "true"].includes((req.query.get("all") ?? "").toLowerCase());
+      return { status: 200, body: await service.list(caller, { all: all2 }) };
+    }));
+    router.post("/api/todos", wrap(async (req, service, caller) => {
+      const body2 = create.parse(req.body ?? {});
+      const sourceChatSessionId = sourceSession(req, body2.sourceChatSessionId);
+      return { status: 201, body: await service.create(caller, { ...body2, ...sourceChatSessionId ? { sourceChatSessionId } : {} }) };
+    }));
+    router.get("/api/todos/:id", wrap(async (req, service, caller) => {
+      const todo = await service.get(caller, req.params.id);
+      return { status: 200, body: { todo, changes: await service.history(caller, todo.id) } };
+    }));
+    router.patch("/api/todos/:id", wrap(async (req, service, caller) => {
+      const body2 = edit.parse(req.body ?? {});
+      return { status: 200, body: await service.edit(caller, req.params.id, body2) };
+    }));
+    const status = (path47, to) => router.post(`/api/todos/:id/${path47}`, wrap(async (req, service, caller) => {
+      const body2 = statusBody.parse(req.body ?? {});
+      return { status: 200, body: await service.setStatus(caller, req.params.id, to, body2.reason) };
+    }));
+    status("done", "done");
+    status("cancel", "cancelled");
+    status("reopen", "open");
+  };
+}
+var create, edit, statusBody;
+var init_routes11 = __esm({
+  "../server/src/domains/todos/routes.ts"() {
+    "use strict";
+    init_zod();
+    init_router();
+    create = external_exports.object({
+      title: external_exports.string(),
+      note: external_exports.string().optional(),
+      dueDate: external_exports.string(),
+      dueTime: external_exports.string().optional(),
+      startDate: external_exports.string().optional(),
+      startTime: external_exports.string().optional(),
+      sourceChatSessionId: external_exports.string().optional()
+    }).strict();
+    edit = external_exports.object({
+      title: external_exports.string().optional(),
+      note: external_exports.string().nullable().optional(),
+      dueDate: external_exports.string().optional(),
+      dueTime: external_exports.string().nullable().optional(),
+      startDate: external_exports.string().nullable().optional(),
+      startTime: external_exports.string().nullable().optional(),
+      linkedWorkorderId: external_exports.string().nullable().optional(),
+      reason: external_exports.string().optional()
+    }).strict();
+    statusBody = external_exports.object({ reason: external_exports.string().optional() }).strict();
+  }
+});
+
+// ../server/src/domains/todos/reminders.ts
+function todoReminderSourceKey(todo, kind) {
+  if (kind === "todo-start") return `todo:${todo.id}@start:${todo.startDate}`;
+  return `todo:${todo.id}@${kind === "todo-due-1d" ? "due-1d" : "due"}:${todo.dueDate}`;
+}
+function dueReminders(todo, timeZone, nowMs) {
+  if (todo.status !== "open") return [];
+  const created = Date.parse(todo.createdAt);
+  const dayBefore = zonedDateTimeToUtcMs(shiftDay(todo.dueDate, -1), TODO_REMINDER_TIME, timeZone);
+  const onDay = zonedDateTimeToUtcMs(todo.dueDate, TODO_REMINDER_TIME, timeZone);
+  const dayEnd = zonedStartOfDayMs(shiftDay(todo.dueDate, 1), timeZone);
+  const out = [];
+  if (nowMs >= dayBefore && nowMs < onDay && created <= dayBefore) {
+    out.push({ kind: "todo-due-1d", sourceKey: todoReminderSourceKey(todo, "todo-due-1d"), fireAt: dayBefore });
+  }
+  if (nowMs >= onDay && nowMs < dayEnd && created <= onDay) {
+    out.push({ kind: "todo-due", sourceKey: todoReminderSourceKey(todo, "todo-due"), fireAt: onDay });
+  }
+  if (todo.startDate && todo.startDate !== todo.dueDate) {
+    const startAt = zonedDateTimeToUtcMs(todo.startDate, TODO_REMINDER_TIME, timeZone);
+    const startEnd = zonedStartOfDayMs(shiftDay(todo.startDate, 1), timeZone);
+    if (nowMs >= startAt && nowMs < startEnd && created <= startAt) {
+      out.push({ kind: "todo-start", sourceKey: todoReminderSourceKey(todo, "todo-start"), fireAt: startAt });
+    }
+  }
+  return out;
+}
+var TODO_REMINDER_TIME, TODO_REMINDER_SCAN_MS, TODO_REMINDER_TITLE, TodoReminderScanner;
+var init_reminders = __esm({
+  "../server/src/domains/todos/reminders.ts"() {
+    "use strict";
+    init_src();
+    TODO_REMINDER_TIME = "09:00";
+    TODO_REMINDER_SCAN_MS = 6e4;
+    TODO_REMINDER_TITLE = {
+      "todo-due-1d": (title) => `\u5F85\u529E\u660E\u5929\u5230\u671F\uFF1A${title}`,
+      "todo-due": (title) => `\u5F85\u529E\u4ECA\u5929\u5230\u671F\uFF1A${title}`,
+      "todo-start": (title) => `\u5F85\u529E\u4ECA\u5929\u5F00\u59CB\uFF1A${title}`
+    };
+    TodoReminderScanner = class {
+      constructor(deps) {
+        this.deps = deps;
+      }
+      timer;
+      first;
+      scanning = false;
+      /** 本进程已经确认在台账里的 (公司, 收件人, 来源键)：省掉每拍对同一条的重复 insert。重启后靠台账唯一约束兜底。 */
+      seen = /* @__PURE__ */ new Set();
+      /** 扫一遍所有公司。防重入：上一拍没扫完，这一拍直接跳过。返回本拍新写入的条数。 */
+      async sweep() {
+        if (this.scanning || !this.deps.enabled()) return 0;
+        this.scanning = true;
+        let inserted = 0;
+        try {
+          for (const companyId of await this.deps.companies()) {
+            try {
+              inserted += await this.sweepCompany(companyId);
+            } catch (error2) {
+              this.deps.warn(new Error(`\u5F85\u529E\u63D0\u9192 company=${companyId}: ${String(error2)}`));
+            }
+          }
+        } catch (error2) {
+          this.deps.warn(error2);
+        } finally {
+          this.scanning = false;
+        }
+        return inserted;
+      }
+      async sweepCompany(companyId) {
+        const ledger = await this.deps.notifications(companyId);
+        if (!ledger) return 0;
+        const nowMs = this.deps.now?.() ?? Date.now();
+        const timeZone = await this.deps.timeZone(companyId);
+        const today = zonedToday(timeZone, nowMs).date;
+        const candidates = await (await this.deps.todos(companyId)).listOpenReminderCandidates(today, shiftDay(today, 1));
+        const enteredAt = new Date(nowMs).toISOString();
+        const fresh = [];
+        for (const todo of candidates) {
+          for (const r of dueReminders(todo, timeZone, nowMs)) {
+            for (const recipient of todoAssignees(todo)) {
+              const key2 = JSON.stringify([companyId, recipient, r.sourceKey]);
+              if (this.seen.has(key2)) continue;
+              const row = await ledger.insert({
+                recipient,
+                category: "todo",
+                sourceKey: r.sourceKey,
+                kind: r.kind,
+                title: TODO_REMINDER_TITLE[r.kind](todo.title),
+                enteredAt,
+                ...todo.sourceChatSessionId ? { chatSessionId: todo.sourceChatSessionId } : {}
+              });
+              this.seen.add(key2);
+              if (row.enteredAt === enteredAt) fresh.push(row);
+            }
+          }
+        }
+        if (fresh.length > 0) this.deps.onInserted?.(companyId, fresh);
+        return fresh.length;
+      }
+      /** 首拍延后一点（默认 10 秒，与通知对账器同款）：等 serve 把推送、台账都装好再扫。 */
+      start(intervalMs = TODO_REMINDER_SCAN_MS, firstDelayMs = 1e4) {
+        if (this.timer) return;
+        this.timer = setInterval(() => void this.sweep(), intervalMs);
+        this.timer.unref?.();
+        this.first = setTimeout(() => void this.sweep(), firstDelayMs);
+        this.first.unref?.();
+      }
+      stop() {
+        if (this.timer) clearInterval(this.timer);
+        if (this.first) clearTimeout(this.first);
+        this.timer = void 0;
+        this.first = void 0;
+      }
+    };
+  }
+});
+
+// ../server/src/domains/todos/index.ts
+var init_todos2 = __esm({
+  "../server/src/domains/todos/index.ts"() {
+    "use strict";
+    init_flag();
+    init_service10();
+    init_store3();
+    init_routes11();
+    init_reminders();
+  }
+});
+
 // ../server/src/domains/playbooks/registry.ts
 function deriveGraph(structure, filerReviews) {
   const idOf = (n) => `${n.type}:${n.title}`;
@@ -256128,7 +257006,7 @@ function busyError(chatSessionId, blockedBy) {
   return `\u76EE\u6807\u4F1A\u8BDD ${chatSessionId} \u6B63\u6709\u4E00\u8F6E\u5728\u8DD1${blockedBy ? `\uFF08${blockedBy}\uFF09` : ""}\u2014\u2014\u672C\u6B21\u89E6\u53D1\u5DF2\u4E22\u5F03\uFF0C\u4E0D\u6392\u961F\u3001\u4E0D\u8865\u8DD1`;
 }
 function genWebhookToken() {
-  return `owt_${(0, import_node_crypto69.randomBytes)(32).toString("base64url")}`;
+  return `owt_${(0, import_node_crypto71.randomBytes)(32).toString("base64url")}`;
 }
 function validateTitleTemplate(tpl) {
   const residue = tpl.replace(DATE_TOKEN, "");
@@ -256184,11 +257062,11 @@ function appendSourceNote(brief, automation, source, atIso) {
 ---
 \u672C\u5DE5\u5355\u7531\u81EA\u52A8\u5316\u300C${automation.name}\u300D\u4E8E ${atIso} \u89E6\u53D1\uFF08\u6765\u6E90\uFF1A${source}\uFF09\u3002\u5F00\u5DE5\u540E\u8BF7\u628A\u5DE5\u5355\u6807\u9898\u6539\u6210\u51C6\u786E\u53CD\u6620\u5B9E\u9645\u5DE5\u4F5C\u7684\u63CF\u8FF0\u3002`;
 }
-var import_node_crypto69, DATE_TOKEN, AutomationsService, EVENT_RETRY_BASE_MS, EVENT_RETRY_MAX_MS, EVENT_RETRY_MAX_ATTEMPTS, eventAttempts, eventLastAttemptAt, eventLastError, CHAT_REPLY_MAX;
-var init_service10 = __esm({
+var import_node_crypto71, DATE_TOKEN, AutomationsService, EVENT_RETRY_BASE_MS, EVENT_RETRY_MAX_MS, EVENT_RETRY_MAX_ATTEMPTS, eventAttempts, eventLastAttemptAt, eventLastError, CHAT_REPLY_MAX;
+var init_service11 = __esm({
   "../server/src/domains/automations/service.ts"() {
     "use strict";
-    import_node_crypto69 = require("node:crypto");
+    import_node_crypto71 = require("node:crypto");
     init_src();
     init_registry3();
     init_attribution();
@@ -257002,11 +257880,11 @@ function verifySignature(rawBody, headers, secret) {
   if (!secret) return "not_required";
   const given = header1(headers, "x-hub-signature-256");
   if (!given) return "missing";
-  const expected = `sha256=${(0, import_node_crypto70.createHmac)("sha256", secret).update(rawBody).digest("hex")}`;
+  const expected = `sha256=${(0, import_node_crypto72.createHmac)("sha256", secret).update(rawBody).digest("hex")}`;
   const a = Buffer.from(given);
   const b2 = Buffer.from(expected);
   if (a.length !== b2.length) return "invalid";
-  return (0, import_node_crypto70.timingSafeEqual)(a, b2) ? "valid" : "invalid";
+  return (0, import_node_crypto72.timingSafeEqual)(a, b2) ? "valid" : "invalid";
 }
 function eventAllowed(filters, envelope) {
   if (!filters || filters.length === 0) return true;
@@ -257036,11 +257914,11 @@ function splitEvent(envelope) {
   }
   return { eventName, actionCandidates: candidates };
 }
-var import_node_crypto70, MAX_BODY_BYTES, AutomationWebhookService, header1, PROVIDER_PREFIXES;
+var import_node_crypto72, MAX_BODY_BYTES, AutomationWebhookService, header1, PROVIDER_PREFIXES;
 var init_webhook = __esm({
   "../server/src/domains/automations/webhook.ts"() {
     "use strict";
-    import_node_crypto70 = require("node:crypto");
+    import_node_crypto72 = require("node:crypto");
     MAX_BODY_BYTES = 256 * 1024;
     AutomationWebhookService = class {
       store;
@@ -257914,13 +258792,13 @@ function automationsDomain(opts) {
   };
 }
 var RECENT_LIMIT2, TARGET_ISSUE_MESSAGE;
-var init_routes11 = __esm({
+var init_routes12 = __esm({
   "../server/src/domains/automations/routes.ts"() {
     "use strict";
     init_src();
     init_templates();
     init_router();
-    init_service10();
+    init_service11();
     init_projection2();
     init_scheduler();
     init_registry3();
@@ -258035,11 +258913,11 @@ function createAutomationsDomain(opts) {
 var init_automations = __esm({
   "../server/src/domains/automations/index.ts"() {
     "use strict";
-    init_service10();
+    init_service11();
     init_webhook();
-    init_routes11();
-    init_service10();
-    init_routes11();
+    init_routes12();
+    init_service11();
+    init_routes12();
     init_projection2();
     init_webhook();
     init_attribution();
@@ -258192,7 +259070,7 @@ function playbooksDomain(opts) {
       opts.overrides.set(companyOf(req), ref2, nodeKey, nextOverride);
       try {
         await opts.audit?.({
-          id: `reg_${(0, import_node_crypto71.randomUUID)()}`,
+          id: `reg_${(0, import_node_crypto73.randomUUID)()}`,
           actor: req.auth.actor,
           kind: "registry_change",
           target: `playbook:${ref2}#${nodeKey}`,
@@ -258209,11 +259087,11 @@ function playbooksDomain(opts) {
     });
   };
 }
-var import_node_crypto71;
-var init_routes12 = __esm({
+var import_node_crypto73;
+var init_routes13 = __esm({
   "../server/src/domains/playbooks/routes.ts"() {
     "use strict";
-    import_node_crypto71 = require("node:crypto");
+    import_node_crypto73 = require("node:crypto");
     init_router();
     init_registry3();
     init_planner();
@@ -258232,12 +259110,12 @@ function normalize(patch) {
     ...reviewers !== void 0 ? { reviewers: [...new Set(reviewers.map((r) => r.trim()).filter(Boolean))] } : {}
   };
 }
-var import_node_fs22, import_node_path25, SEP3, keyOf2, prefixOf2, MemoryPlaybookOverrideStore, FilePlaybookOverrideStore;
+var import_node_fs22, import_node_path26, SEP3, keyOf2, prefixOf2, MemoryPlaybookOverrideStore, FilePlaybookOverrideStore;
 var init_overrides = __esm({
   "../server/src/domains/playbooks/overrides.ts"() {
     "use strict";
     import_node_fs22 = __toESM(require("node:fs"), 1);
-    import_node_path25 = __toESM(require("node:path"), 1);
+    import_node_path26 = __toESM(require("node:path"), 1);
     SEP3 = "::";
     keyOf2 = (companyId, ref2, nodeKey) => `${companyId}${SEP3}${ref2}${SEP3}${nodeKey}`;
     prefixOf2 = (companyId, ref2) => `${companyId}${SEP3}${ref2}${SEP3}`;
@@ -258293,7 +259171,7 @@ var init_overrides = __esm({
       }
       persist() {
         try {
-          import_node_fs22.default.mkdirSync(import_node_path25.default.dirname(this.file), { recursive: true });
+          import_node_fs22.default.mkdirSync(import_node_path26.default.dirname(this.file), { recursive: true });
           const tmp = `${this.file}.tmp`;
           import_node_fs22.default.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.map), null, 2));
           import_node_fs22.default.renameSync(tmp, this.file);
@@ -258329,9 +259207,9 @@ function createPlaybooksDomain(opts) {
 var init_playbooks = __esm({
   "../server/src/domains/playbooks/index.ts"() {
     "use strict";
-    init_routes12();
+    init_routes13();
     init_registry3();
-    init_routes12();
+    init_routes13();
     init_overrides();
   }
 });
@@ -258342,17 +259220,17 @@ function completionFingerprint(workspace, members) {
     workspace,
     members: [...members].sort((a, b2) => a.artifactId < b2.artifactId ? -1 : a.artifactId > b2.artifactId ? 1 : 0).map((m2) => ({ artifactId: m2.artifactId, currentRevisionId: m2.currentRevisionId ?? null }))
   });
-  return (0, import_node_crypto72.createHash)("sha256").update(canonical2).digest("hex");
+  return (0, import_node_crypto74.createHash)("sha256").update(canonical2).digest("hex");
 }
 function eventConsumptionKey(args) {
   const raw = `project-event:${EVENT_KEY_VERSION}:${args.triggerId}:${args.event}:${args.workspace}:${args.fingerprint}`;
-  return raw.length <= 200 ? raw : `project-event:${EVENT_KEY_VERSION}:sha256:${(0, import_node_crypto72.createHash)("sha256").update(raw).digest("hex")}`;
+  return raw.length <= 200 ? raw : `project-event:${EVENT_KEY_VERSION}:sha256:${(0, import_node_crypto74.createHash)("sha256").update(raw).digest("hex")}`;
 }
-var import_node_crypto72, EVENT_KEY_VERSION, EMPTY_METRICS, AUTOMATION_EVENT_HANDLERS, ProjectEventPoller;
+var import_node_crypto74, EVENT_KEY_VERSION, EMPTY_METRICS, AUTOMATION_EVENT_HANDLERS, ProjectEventPoller;
 var init_project_event_poller = __esm({
   "../server/src/automations/project-event-poller.ts"() {
     "use strict";
-    import_node_crypto72 = require("node:crypto");
+    import_node_crypto74 = require("node:crypto");
     EVENT_KEY_VERSION = "v1";
     EMPTY_METRICS = () => ({
       scanDurationMs: 0,
@@ -258562,7 +259440,7 @@ function queryInputReceipt(hub, nodeId, dispatchId, clientMessageKey, pending, t
     const viaSession = hub.hasSession?.(dispatchId) === true;
     const supported = viaSession ? hub.supportsInputReceiptQuery?.(dispatchId) === true : daemonMetaOf(hub, nodeId)?.supportsInputReceiptQuery === true;
     if (!supported) return Promise.resolve({ status: "unknown", reason: "unsupported" });
-    const requestId = (0, import_node_crypto73.randomUUID)();
+    const requestId = (0, import_node_crypto75.randomUUID)();
     return new Promise((resolve11) => {
       const timer = setTimeout(() => {
         pending.delete(requestId);
@@ -258624,7 +259502,7 @@ function sendAppendInput(hub, nodeId, dispatchId, entry, input, timeoutMs, sessi
   if (input.requireConsumptionReceipt && !hub.supportsInputConsumptionReceipts?.(dispatchId)) {
     return Promise.resolve({ accepted: false, reason: "consumption-unsupported" });
   }
-  const requestId = (0, import_node_crypto73.randomUUID)();
+  const requestId = (0, import_node_crypto75.randomUUID)();
   const sent = routeToSession(hub, nodeId, dispatchId, { type: "append_input", dispatchId, input, requestId });
   if (!sent) return Promise.resolve({ accepted: false, reason: "session-closing", ...unknownIfInterrupting });
   return new Promise((resolve11) => {
@@ -258637,11 +259515,11 @@ function sendAppendInput(hub, nodeId, dispatchId, entry, input, timeoutMs, sessi
     entry.appendWaiters.push({ requestId, requireConsumptionReceipt: input.requireConsumptionReceipt, resolve: resolve11, timer });
   });
 }
-var import_node_crypto73, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_TOTAL_FRAMES, STASH_MAX_IDS, STASH_LOSS_MAX_IDS, STASH_LOSS_TTL_MS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
+var import_node_crypto75, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_TOTAL_FRAMES, STASH_MAX_IDS, STASH_LOSS_MAX_IDS, STASH_LOSS_TTL_MS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
 var init_daemon_adapter = __esm({
   "../server/src/daemon-adapter.ts"() {
     "use strict";
-    import_node_crypto73 = require("node:crypto");
+    import_node_crypto75 = require("node:crypto");
     init_src();
     STASH_TTL_MS = 5 * 6e4;
     STASH_MAX_FRAMES_PER_ID = 1e4;
@@ -259100,7 +259978,7 @@ var init_daemon_adapter = __esm({
       async spawn(job) {
         const nodeId = job.binding?.nodeId;
         if (!nodeId) throw new Error("DaemonHubAdapter \u9700\u8981 job.binding.nodeId\uFF08\u8DEF\u7531\u9519\u8BEF\uFF09");
-        const dispatchId = job.dispatchId ?? `dispatch:${(0, import_node_crypto73.randomUUID)()}`;
+        const dispatchId = job.dispatchId ?? `dispatch:${(0, import_node_crypto75.randomUUID)()}`;
         if (job.dispatchId && this.pending.has(dispatchId)) {
           return this.recover(dispatchId, nodeId, job.binding?.runtimeKind, job.actor);
         }
@@ -259357,7 +260235,7 @@ var init_daemon_adapter = __esm({
         return daemon?.meta.supportsWorkdirWalk === true;
       }
       request(nodeId, buildFrame) {
-        const requestId = (0, import_node_crypto73.randomUUID)();
+        const requestId = (0, import_node_crypto75.randomUUID)();
         const sent = this.hub.dispatch(nodeId, buildFrame(requestId));
         if (!sent) return Promise.resolve({ ok: false, code: "NODE_OFFLINE" });
         return new Promise((resolve11) => {
@@ -259415,12 +260293,12 @@ var init_dispatch_fence = __esm({
 });
 
 // ../server/src/side-map.ts
-var import_node_fs23, import_node_path26, FileSideMap;
+var import_node_fs23, import_node_path27, FileSideMap;
 var init_side_map = __esm({
   "../server/src/side-map.ts"() {
     "use strict";
     import_node_fs23 = __toESM(require("node:fs"), 1);
-    import_node_path26 = __toESM(require("node:path"), 1);
+    import_node_path27 = __toESM(require("node:path"), 1);
     FileSideMap = class {
       constructor(file) {
         this.file = file;
@@ -259447,7 +260325,7 @@ var init_side_map = __esm({
       }
       persist() {
         try {
-          import_node_fs23.default.mkdirSync(import_node_path26.default.dirname(this.file), { recursive: true });
+          import_node_fs23.default.mkdirSync(import_node_path27.default.dirname(this.file), { recursive: true });
           const tmp = `${this.file}.tmp`;
           import_node_fs23.default.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.map), null, 2));
           import_node_fs23.default.renameSync(tmp, this.file);
@@ -259465,13 +260343,13 @@ function classifyPage(page, lastPushedHash, serviceAccount) {
   if (sha(body2) === lastPushedHash) return { kind: "echo" };
   return { kind: "human-edit", content: body2, updatedBy: page.updatedBy };
 }
-var import_node_crypto74, sha, enc2, dec, MirrorEngine, MemoryMirrorStateStore, MapMirrorIdentities;
+var import_node_crypto76, sha, enc2, dec, MirrorEngine, MemoryMirrorStateStore, MapMirrorIdentities;
 var init_engine = __esm({
   "../server/src/mirror/engine.ts"() {
     "use strict";
-    import_node_crypto74 = require("node:crypto");
+    import_node_crypto76 = require("node:crypto");
     init_src();
-    sha = (s2) => (0, import_node_crypto74.createHash)("sha256").update(s2, "utf8").digest("hex");
+    sha = (s2) => (0, import_node_crypto76.createHash)("sha256").update(s2, "utf8").digest("hex");
     enc2 = (s2) => new TextEncoder().encode(s2);
     dec = (b2) => new TextDecoder().decode(b2);
     MirrorEngine = class {
@@ -259752,11 +260630,11 @@ function humanExitCause(exit3) {
   const base = (exit3.reason ? label2[exit3.reason] : void 0) ?? `\u4F1A\u8BDD\u5F02\u5E38\u7ED3\u675F\uFF08${exit3.reason ?? "\u65E0\u9000\u51FA\u4FE1\u606F"}\uFF09`;
   return exit3.errorMessage ? `${base}\uFF1A${exit3.errorMessage.slice(0, 200)}` : base;
 }
-var import_node_crypto75, AUTONOMOUS_ETHOS, CONVERSATIONAL_ETHOS, SHARED_GRAPH_BODY, AUTONOMOUS_RECOVERY_TOOLS, HIGH_RISK_COMMANDS, REJECTED_PROPOSALS_IN_TASK, COORDINATOR_SYSTEM_PROMPT, CONVERSATIONAL_RECOVERY_TOOLS, CONVERSATIONAL_ESCALATION_TOOLS, CONVERSATIONAL_MANAGER_BODY, MACHINE_EXIT_CODES, CoordinatorWorker;
+var import_node_crypto77, AUTONOMOUS_ETHOS, CONVERSATIONAL_ETHOS, SHARED_GRAPH_BODY, AUTONOMOUS_RECOVERY_TOOLS, HIGH_RISK_COMMANDS, REJECTED_PROPOSALS_IN_TASK, COORDINATOR_SYSTEM_PROMPT, CONVERSATIONAL_RECOVERY_TOOLS, CONVERSATIONAL_ESCALATION_TOOLS, CONVERSATIONAL_MANAGER_BODY, MACHINE_EXIT_CODES, CoordinatorWorker;
 var init_worker = __esm({
   "../server/src/coordinator/worker.ts"() {
     "use strict";
-    import_node_crypto75 = require("node:crypto");
+    import_node_crypto77 = require("node:crypto");
     init_src7();
     init_identity();
     init_escalation_kind();
@@ -260029,7 +260907,7 @@ ${HIGH_RISK_COMMANDS}`;
         return this.deps.kernel.model.lastSeq.get(artifactId) ?? 0;
       }
       evaluationKey(kind, artifactId, evidence) {
-        const fingerprint2 = (0, import_node_crypto75.createHash)("sha256").update(JSON.stringify(evidence)).digest("hex");
+        const fingerprint2 = (0, import_node_crypto77.createHash)("sha256").update(JSON.stringify(evidence)).digest("hex");
         return `${kind}:${artifactId}:${fingerprint2}`;
       }
       artifactEvidence(id) {
@@ -260420,8 +261298,8 @@ ${ctx.nodeFault}
         const taskWithRejections = rejectedSection ? `${task}
 
 ${rejectedSection}` : task;
-        const runtimeSessionId = opts?.resumeSessionId ?? (0, import_node_crypto75.randomUUID)();
-        const coordinatorRunId = `coordinate:${(0, import_node_crypto75.randomUUID)()}`;
+        const runtimeSessionId = opts?.resumeSessionId ?? (0, import_node_crypto77.randomUUID)();
+        const coordinatorRunId = `coordinate:${(0, import_node_crypto77.randomUUID)()}`;
         const taskWithContext = coordinatorContext ? [
           taskWithRejections,
           ``,
@@ -260465,7 +261343,7 @@ ${rejectedSection}` : task;
         const startedAtMs = Date.now();
         let trajectoryStarted = false;
         if (this.deps.trajectory) {
-          const bundleManifest = Object.fromEntries(Object.entries(job.bundle.files).map(([name, content3]) => [name, (0, import_node_crypto75.createHash)("sha256").update(content3).digest("hex")]));
+          const bundleManifest = Object.fromEntries(Object.entries(job.bundle.files).map(([name, content3]) => [name, (0, import_node_crypto77.createHash)("sha256").update(content3).digest("hex")]));
           const session = {
             runId: coordinatorRunId,
             runtimeSessionId,
@@ -260676,11 +261554,11 @@ var init_pg_ident = __esm({
 });
 
 // ../storage/src/postgres.ts
-var import_node_crypto76, ident5, isUniqueViolation, PostgresOplogStore, PostgresBlobStore;
+var import_node_crypto78, ident5, isUniqueViolation, PostgresOplogStore, PostgresBlobStore;
 var init_postgres = __esm({
   "../storage/src/postgres.ts"() {
     "use strict";
-    import_node_crypto76 = require("node:crypto");
+    import_node_crypto78 = require("node:crypto");
     init_pg_ident();
     init_esm();
     init_src();
@@ -260860,7 +261738,7 @@ var init_postgres = __esm({
         return new _PostgresBlobStore(pool, schema);
       }
       async put(bytes2) {
-        const hash3 = (0, import_node_crypto76.createHash)("sha256").update(bytes2).digest("hex");
+        const hash3 = (0, import_node_crypto78.createHash)("sha256").update(bytes2).digest("hex");
         await this.pool.query(
           `INSERT INTO ${this.t} (hash, bytes, size, content_type) VALUES ($1, $2, $3, $4) ON CONFLICT (hash) DO NOTHING`,
           [hash3, Buffer.from(bytes2), bytes2.byteLength, sniffContentType(bytes2) ?? null]
@@ -260908,7 +261786,7 @@ function stageAtLeast(stage, min2) {
   return STAGES.indexOf(stage) >= STAGES.indexOf(min2);
 }
 function newVariableId() {
-  return `var_${(0, import_node_crypto77.randomUUID)()}`;
+  return `var_${(0, import_node_crypto79.randomUUID)()}`;
 }
 async function declareRecordsAware(db) {
   await db.query(`SELECT set_config('${RECORDS_AWARE_SETTING}', 'on', true)`);
@@ -261264,11 +262142,11 @@ async function listBindingTargetIds(db, s2, kind) {
     [kind]
   )).rows.map((x2) => x2.target_id);
 }
-var import_node_crypto77, STAGES, RECORDS_AWARE_SETTING, markLockName;
+var import_node_crypto79, STAGES, RECORDS_AWARE_SETTING, markLockName;
 var init_variable_bindings = __esm({
   "../storage/src/variable-bindings.ts"() {
     "use strict";
-    import_node_crypto77 = require("node:crypto");
+    import_node_crypto79 = require("node:crypto");
     init_src();
     STAGES = ["off", "dual", "read", "records"];
     RECORDS_AWARE_SETTING = "oasis.variable_records_aware";
@@ -264020,9 +264898,11 @@ var init_postgres_control_plane = __esm({
         avatar     text,                        -- "blob:<hash>"\uFF0C\u7A7A=\u9ED8\u8BA4
         status     text NOT NULL,               -- active | suspended
         created_at timestamptz NOT NULL,
-        onboarding_variant text                  -- \u767B\u5F55\u540E\u52A9\u7406\u5F15\u5BFC\u53D8\u4F53 A|B\uFF1BNULL=\u7F3A\u7701\u89C6\u4E3A A
+        onboarding_variant text,                 -- \u767B\u5F55\u540E\u52A9\u7406\u5F15\u5BFC\u53D8\u4F53 A|B\uFF1BNULL=\u7F3A\u7701\u89C6\u4E3A A
+        time_zone  text                         -- \u7EC4\u7EC7\u65F6\u533A IANA \u540D\uFF1BNULL=\u6309\u90E8\u7F72\u9ED8\u8BA4\u503C
       )`);
         await pool.query(`ALTER TABLE "${s2}".companies ADD COLUMN IF NOT EXISTS onboarding_variant text`);
+        await pool.query(`ALTER TABLE "${s2}".companies ADD COLUMN IF NOT EXISTS time_zone text`);
         await pool.query(`ALTER TABLE "${s2}".companies ADD COLUMN IF NOT EXISTS dissolved_at timestamptz`);
         await pool.query(`ALTER TABLE "${s2}".companies ADD COLUMN IF NOT EXISTS dissolved_by text`);
         await pool.query(`
@@ -264076,6 +264956,14 @@ var init_postgres_control_plane = __esm({
         expires_at timestamptz NOT NULL,
         attempts   int  NOT NULL DEFAULT 0
       )`);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".revoked_sessions (
+        token_hash text PRIMARY KEY,             -- SHA-256(base64url) of the oasis_auth JWT
+        account_id text NOT NULL,
+        revoked_at timestamptz NOT NULL,
+        expires_at timestamptz NOT NULL          -- = \u4EE4\u724C exp\uFF1B\u8FC7\u4E86\u4EE4\u724C\u672C\u6765\u5C31\u9A8C\u4E0D\u8FC7\uFF0C\u884C\u53EF\u5220
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS revoked_sessions_expires_idx ON "${s2}".revoked_sessions (expires_at)`);
         await pool.query(`ALTER TABLE "${s2}".company_members ADD COLUMN IF NOT EXISTS display_name text`);
         await pool.query(`ALTER TABLE "${s2}".company_members ADD COLUMN IF NOT EXISTS created_at timestamptz`);
         await pool.query(`ALTER TABLE "${s2}".company_members ADD COLUMN IF NOT EXISTS updated_at timestamptz`);
@@ -264231,8 +265119,8 @@ var init_postgres_control_plane = __esm({
       // —— 公司 ——
       async createCompany(c) {
         await this.pool.query(
-          `INSERT INTO ${this.s}.companies (id, slug, name, avatar, status, created_at, onboarding_variant) VALUES ($1,$2,$3,$4,$5,$6,$7)`,
-          [c.id, c.slug, c.name, c.avatar ?? null, c.status, c.createdAt, c.onboardingVariant ?? null]
+          `INSERT INTO ${this.s}.companies (id, slug, name, avatar, status, created_at, onboarding_variant, time_zone) VALUES ($1,$2,$3,$4,$5,$6,$7,$8)`,
+          [c.id, c.slug, c.name, c.avatar ?? null, c.status, c.createdAt, c.onboardingVariant ?? null, c.timeZone ?? null]
         );
       }
       async getCompany(id) {
@@ -264266,6 +265154,10 @@ var init_postgres_control_plane = __esm({
           args.push(patch.onboardingVariant);
           sets.push(`onboarding_variant = $${args.length}`);
         }
+        if (patch.timeZone !== void 0) {
+          args.push(patch.timeZone);
+          sets.push(`time_zone = $${args.length}`);
+        }
         if (patch.dissolvedAt !== void 0) {
           args.push(patch.dissolvedAt);
           sets.push(`dissolved_at = $${args.length}`);
@@ -264962,6 +265854,19 @@ var init_postgres_control_plane = __esm({
         if (r.rowCount === 0) throw new Error(`account not found: ${accountId}`);
         return Number(r.rows[0].token_version);
       }
+      // —— 已登出会话（ADR 0636）——
+      async revokeSession(rec2) {
+        await this.pool.query(`DELETE FROM ${this.s}.revoked_sessions WHERE expires_at < $1`, [rec2.revokedAt]);
+        await this.pool.query(
+          `INSERT INTO ${this.s}.revoked_sessions (token_hash, account_id, revoked_at, expires_at) VALUES ($1,$2,$3,$4)
+       ON CONFLICT (token_hash) DO NOTHING`,
+          [rec2.tokenHash, rec2.accountId, rec2.revokedAt, rec2.expiresAt]
+        );
+      }
+      async isSessionRevoked(tokenHash) {
+        const r = await this.pool.query(`SELECT 1 FROM ${this.s}.revoked_sessions WHERE token_hash = $1`, [tokenHash]);
+        return (r.rowCount ?? 0) > 0;
+      }
       // —— 邮箱验证码（单邮箱一条 active）——
       async putVerificationCode(rec2) {
         await this.pool.query(
@@ -265274,6 +266179,7 @@ var init_postgres_control_plane = __esm({
       status: row.status,
       createdAt: new Date(row.created_at).toISOString(),
       ...row.onboarding_variant ? { onboardingVariant: row.onboarding_variant } : {},
+      ...row.time_zone ? { timeZone: row.time_zone } : {},
       // 解散痕迹（组织三层身份 ADR D9.2）：两列一起有、一起空。普通运维停用不写它们。
       ...row.dissolved_at != null ? { dissolvedAt: toIso(row.dissolved_at) } : {},
       ...row.dissolved_by != null ? { dissolvedBy: row.dissolved_by } : {}
@@ -271571,11 +272477,11 @@ var init_postgres_delegations = __esm({
 });
 
 // ../storage/src/postgres-nodes.ts
-var import_node_crypto78, ident14, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToFault, rowToQuota, rowToRuntime;
+var import_node_crypto80, ident14, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToFault, rowToQuota, rowToRuntime;
 var init_postgres_nodes = __esm({
   "../storage/src/postgres-nodes.ts"() {
     "use strict";
-    import_node_crypto78 = require("node:crypto");
+    import_node_crypto80 = require("node:crypto");
     init_pg_ident();
     init_esm();
     ident14 = (s2) => {
@@ -271929,7 +272835,7 @@ var init_postgres_nodes = __esm({
         return store;
       }
       issue(nodeId) {
-        const token2 = `ont_${(0, import_node_crypto78.randomBytes)(24).toString("base64url")}`;
+        const token2 = `ont_${(0, import_node_crypto80.randomBytes)(24).toString("base64url")}`;
         this.cache.set(token2, nodeId);
         void this.pool.query(`INSERT INTO ${this.s}.node_tokens (token,node_id) VALUES ($1,$2)`, [token2, nodeId]);
         return token2;
@@ -272231,11 +273137,11 @@ var init_postgres_type_registry = __esm({
 });
 
 // ../storage/src/postgres-actor-memory.ts
-var import_node_crypto79, matchClause, ident16, PostgresActorMemoryStore, rowToIndexEntry, rowToRecord;
+var import_node_crypto81, matchClause, ident16, PostgresActorMemoryStore, rowToIndexEntry, rowToRecord;
 var init_postgres_actor_memory = __esm({
   "../storage/src/postgres-actor-memory.ts"() {
     "use strict";
-    import_node_crypto79 = require("node:crypto");
+    import_node_crypto81 = require("node:crypto");
     init_pg_ident();
     init_src();
     matchClause = (q2) => q2.requireMatch && q2.keywords.length > 0 ? " WHERE m > 0" : "";
@@ -272445,7 +273351,7 @@ var init_postgres_actor_memory = __esm({
       }
       async write(input, now) {
         if (input.memId === void 0) {
-          const memId = `mem:${(0, import_node_crypto79.randomUUID)()}`;
+          const memId = `mem:${(0, import_node_crypto81.randomUUID)()}`;
           const r2 = await this.pool.query(
             `INSERT INTO ${this.s}.actor_memories
            (mem_id, actor_id, project_id, keywords, content, version, created_at, updated_at, accessed_at, source_artifact_id, source_session_id)
@@ -274016,14 +274922,14 @@ function companySchemaName(companyId) {
   if (typeof companyId !== "string" || !companyId.trim()) {
     throw new Error("company schema mapping \u9700\u8981\u975E\u7A7A companyId\uFF08fail-closed\uFF1A\u4E0D\u56DE\u9000\u9ED8\u8BA4\u516C\u53F8\uFF09");
   }
-  const hex = (0, import_node_crypto80.createHash)("sha256").update(companyId, "utf8").digest("hex");
+  const hex = (0, import_node_crypto82.createHash)("sha256").update(companyId, "utf8").digest("hex");
   return `${COMPANY_SCHEMA_PREFIX}${hex.slice(0, DIGEST_HEX_LEN)}`;
 }
-var import_node_crypto80, COMPANY_SCHEMA_PREFIX, DIGEST_HEX_LEN, SchemaMappingConflictError, TenantStorageLocationStore;
+var import_node_crypto82, COMPANY_SCHEMA_PREFIX, DIGEST_HEX_LEN, SchemaMappingConflictError, TenantStorageLocationStore;
 var init_tenant_schema_mapping = __esm({
   "../storage/src/tenant-schema-mapping.ts"() {
     "use strict";
-    import_node_crypto80 = require("node:crypto");
+    import_node_crypto82 = require("node:crypto");
     init_esm();
     init_pg_ident();
     COMPANY_SCHEMA_PREFIX = "c_";
@@ -274097,7 +275003,7 @@ var init_tenant_schema_mapping = __esm({
 
 // ../storage/src/company-data-plane-schema.ts
 function canonicalTypeDefHash(def) {
-  return `sha256:${(0, import_node_crypto81.createHash)("sha256").update(JSON.stringify(def), "utf8").digest("hex")}`;
+  return `sha256:${(0, import_node_crypto83.createHash)("sha256").update(JSON.stringify(def), "utf8").digest("hex")}`;
 }
 function defaultArtifactTypeTemplate() {
   return [
@@ -274279,11 +275185,11 @@ async function seedDefaultArtifactTypes(pool, schema, templates = defaultArtifac
   }
   return { inserted };
 }
-var import_node_crypto81, DEFAULT_ARTIFACT_TYPE_TEMPLATE_VERSION;
+var import_node_crypto83, DEFAULT_ARTIFACT_TYPE_TEMPLATE_VERSION;
 var init_company_data_plane_schema = __esm({
   "../storage/src/company-data-plane-schema.ts"() {
     "use strict";
-    import_node_crypto81 = require("node:crypto");
+    import_node_crypto83 = require("node:crypto");
     init_esm();
     init_pg_ident();
     DEFAULT_ARTIFACT_TYPE_TEMPLATE_VERSION = "4c368e5c-types-v1";
@@ -274362,11 +275268,11 @@ function rowToFile2(row) {
     updatedAt: new Date(row.updated_at).toISOString()
   };
 }
-var import_node_crypto82, COMPANY_CONFLICT_MSG, CompanyIdentifierConflictError, CompanyOwnedRegistryStore;
+var import_node_crypto84, COMPANY_CONFLICT_MSG, CompanyIdentifierConflictError, CompanyOwnedRegistryStore;
 var init_company_owned_registry_store = __esm({
   "../storage/src/company-owned-registry-store.ts"() {
     "use strict";
-    import_node_crypto82 = require("node:crypto");
+    import_node_crypto84 = require("node:crypto");
     init_esm();
     init_src();
     init_pg_ident();
@@ -274751,7 +275657,7 @@ var init_company_owned_registry_store = __esm({
           enabled: skill.enabled,
           files: files.map((f2) => ({ path: f2.path, blobHash: f2.blobHash }))
         });
-        return (0, import_node_crypto82.createHash)("sha256").update(body2).digest("hex");
+        return (0, import_node_crypto84.createHash)("sha256").update(body2).digest("hex");
       }
     };
   }
@@ -277561,7 +278467,7 @@ function sourceSetConservation(input) {
   return input.sourceFinal === input.copied + input.approvedRuntimeConversion + input.approvedArchive + input.approvedDiscard;
 }
 function payloadChecksum(value2) {
-  return (0, import_node_crypto83.createHash)("sha256").update(JSON.stringify(value2)).digest("hex");
+  return (0, import_node_crypto85.createHash)("sha256").update(JSON.stringify(value2)).digest("hex");
 }
 async function copyWorkorderDraftsIdempotent(pool, companyId, companySchema, manifestId, opts) {
   const cs = quoteIdent2(companySchema);
@@ -277953,11 +278859,11 @@ async function copyTraceFamilyIdempotent(pool, companyId, companySchema, manifes
     sequences
   };
 }
-var import_node_crypto83, MissingInstallerActorsError, TypeCatalogNotCoveredError, ORG_REGISTRY_TABLES, TRACE_FAMILY;
+var import_node_crypto85, MissingInstallerActorsError, TypeCatalogNotCoveredError, ORG_REGISTRY_TABLES, TRACE_FAMILY;
 var init_tenant_migration_operator = __esm({
   "../storage/src/tenant-migration-operator.ts"() {
     "use strict";
-    import_node_crypto83 = require("node:crypto");
+    import_node_crypto85 = require("node:crypto");
     init_esm();
     init_pg_ident();
     init_tenancy_attribution();
@@ -278193,8 +279099,8 @@ var init_tenant_new_company_provision = __esm({
 // ../storage/src/knowledge-snapshot-crypto.ts
 function sealSnapshot(snapshot, key2) {
   if (snapshot.content.startsWith(PREFIX3)) return structuredClone(snapshot);
-  const iv = (0, import_node_crypto84.randomBytes)(12);
-  const cipher = (0, import_node_crypto84.createCipheriv)("aes-256-gcm", bytes(key2), iv);
+  const iv = (0, import_node_crypto86.randomBytes)(12);
+  const cipher = (0, import_node_crypto86.createCipheriv)("aes-256-gcm", bytes(key2), iv);
   cipher.setAAD(aad2(snapshot));
   const encrypted = Buffer.concat([cipher.update(snapshot.content, "utf8"), cipher.final()]);
   return { ...structuredClone(snapshot), content: `${PREFIX3}${iv.toString("base64url")}.${cipher.getAuthTag().toString("base64url")}.${encrypted.toString("base64url")}` };
@@ -278204,7 +279110,7 @@ function openSnapshot(snapshot, key2) {
   const packed = snapshot.content.slice(PREFIX3.length).split(".");
   if (packed.length !== 3 || packed.some((part) => !part)) throw new Error(`knowledge snapshot ${snapshot.ref} ciphertext is malformed`);
   const [iv, tag, data] = packed;
-  const decipher = (0, import_node_crypto84.createDecipheriv)("aes-256-gcm", bytes(key2), Buffer.from(iv, "base64url"));
+  const decipher = (0, import_node_crypto86.createDecipheriv)("aes-256-gcm", bytes(key2), Buffer.from(iv, "base64url"));
   decipher.setAAD(aad2(snapshot));
   decipher.setAuthTag(Buffer.from(tag, "base64url"));
   return {
@@ -278212,11 +279118,11 @@ function openSnapshot(snapshot, key2) {
     content: Buffer.concat([decipher.update(Buffer.from(data, "base64url")), decipher.final()]).toString("utf8")
   };
 }
-var import_node_crypto84, PREFIX3, bytes, aad2;
+var import_node_crypto86, PREFIX3, bytes, aad2;
 var init_knowledge_snapshot_crypto = __esm({
   "../storage/src/knowledge-snapshot-crypto.ts"() {
     "use strict";
-    import_node_crypto84 = require("node:crypto");
+    import_node_crypto86 = require("node:crypto");
     PREFIX3 = "oasis-knowledge:v1:";
     bytes = (key2) => {
       const value2 = Buffer.from(key2);
@@ -278965,6 +279871,9 @@ var init_default_company_schema_move = __esm({
       "review_requirements",
       "review_view",
       "reviews",
+      // 个人待办与它的变更记录（2026-10-08 落库，ADR 0635）：每行锚在本公司成员与会话上，整表搬（与 discussion_entries 同理）。
+      "todo_changes",
+      "todos",
       "work_artifacts",
       "work_inputs",
       "work_order_files",
@@ -279111,7 +280020,7 @@ function reportedCost(v2) {
 }
 function newUsageBackfillManifestId(now = /* @__PURE__ */ new Date()) {
   const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
-  return `ulb-${stamp}-${(0, import_node_crypto85.randomBytes)(3).toString("hex")}`;
+  return `ulb-${stamp}-${(0, import_node_crypto87.randomBytes)(3).toString("hex")}`;
 }
 async function backfillUsageLedger(ledger, opts) {
   if (!opts.dryRun && !opts.manifestId) throw new Error("execute \u9700\u8981 manifestId");
@@ -279660,11 +280569,11 @@ async function audit(c, s2, manifestId, runId, field, before, after, createdAt)
     [manifestId, runId, field, before == null ? null : JSON.stringify(before), after == null ? null : JSON.stringify(after), createdAt]
   );
 }
-var import_node_crypto85, BUCKETS, ENDED_SQL, START_EVIDENCE_SQL, CHAT_RUN_SQL, ALLOWED_MODEL_EVIDENCE_TIERS, emptyStep, MODEL_BACKFILL_SOURCE, fourOf, sameUsage, ChatRunLookup;
+var import_node_crypto87, BUCKETS, ENDED_SQL, START_EVIDENCE_SQL, CHAT_RUN_SQL, ALLOWED_MODEL_EVIDENCE_TIERS, emptyStep, MODEL_BACKFILL_SOURCE, fourOf, sameUsage, ChatRunLookup;
 var init_usage_ledger_backfill = __esm({
   "../storage/src/usage-ledger-backfill.ts"() {
     "use strict";
-    import_node_crypto85 = require("node:crypto");
+    import_node_crypto87 = require("node:crypto");
     init_src();
     init_pg_ident();
     init_postgres_trace();
@@ -280049,26 +280958,26 @@ var init_cutover_aware_workorder_drafts = __esm({
 
 // ../server/src/governance/builtin-skills.ts
 async function collectDir(root, dir, out) {
-  const entries = await (0, import_promises15.readdir)(dir, { withFileTypes: true });
+  const entries = await (0, import_promises16.readdir)(dir, { withFileTypes: true });
   for (const e of entries) {
-    const abs = (0, import_node_path27.join)(dir, e.name);
+    const abs = (0, import_node_path28.join)(dir, e.name);
     if (e.isDirectory()) {
       await collectDir(root, abs, out);
     } else if (e.isFile()) {
-      const info = await (0, import_promises15.stat)(abs);
+      const info = await (0, import_promises16.stat)(abs);
       if (info.size > MAX_FILE_BYTES2) {
         console.warn(`[builtin-skills] skip oversized file (${info.size}B): ${abs}`);
         continue;
       }
-      const rel = (0, import_node_path27.relative)(root, abs).split(/[\\/]/).join("/");
-      out[rel] = await (0, import_promises15.readFile)(abs, "utf8");
+      const rel = (0, import_node_path28.relative)(root, abs).split(/[\\/]/).join("/");
+      out[rel] = await (0, import_promises16.readFile)(abs, "utf8");
     }
   }
 }
 async function loadBuiltinSkills(skillsDir) {
   let dirents;
   try {
-    dirents = await (0, import_promises15.readdir)(skillsDir, { withFileTypes: true });
+    dirents = await (0, import_promises16.readdir)(skillsDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -280076,7 +280985,7 @@ async function loadBuiltinSkills(skillsDir) {
   for (const d of dirents) {
     if (!d.isDirectory()) continue;
     const slug5 = d.name;
-    const skillDir = (0, import_node_path27.join)(skillsDir, slug5);
+    const skillDir = (0, import_node_path28.join)(skillsDir, slug5);
     const files = {};
     try {
       await collectDir(skillDir, skillDir, files);
@@ -280105,7 +281014,8 @@ function materializeBuiltinSkills(builtins, skillsDirPrefix) {
   return out;
 }
 function applyBuiltinSkillVariants(builtins, opts) {
-  return builtins.map((skill) => {
+  const personalTodoEnabled = opts.personalTodoEnabled ?? personalTodoEnabledFromEnv();
+  return builtins.filter((skill) => skill.id !== PERSONAL_TODO_SKILL_ID || personalTodoEnabled).map((skill) => {
     const variant = skill.files[BUILTIN_SKILL_DELEGATION_VARIANT];
     if (variant === void 0) return skill;
     const files = { ...skill.files };
@@ -280116,16 +281026,18 @@ function applyBuiltinSkillVariants(builtins, opts) {
     return { ...skill, name: name || skill.id, description, files };
   });
 }
-var import_promises15, import_node_path27, MAX_FILE_BYTES2, BUILTIN_SKILL_DELEGATION_VARIANT;
+var import_promises16, import_node_path28, MAX_FILE_BYTES2, BUILTIN_SKILL_DELEGATION_VARIANT, PERSONAL_TODO_SKILL_ID;
 var init_builtin_skills = __esm({
   "../server/src/governance/builtin-skills.ts"() {
     "use strict";
-    import_promises15 = require("node:fs/promises");
-    import_node_path27 = require("node:path");
+    import_promises16 = require("node:fs/promises");
+    import_node_path28 = require("node:path");
     init_skill_fetcher();
     init_skill_materializer();
+    init_flag();
     MAX_FILE_BYTES2 = 1 << 20;
     BUILTIN_SKILL_DELEGATION_VARIANT = "SKILL.delegation.md";
+    PERSONAL_TODO_SKILL_ID = "personal-todo";
   }
 });
 
@@ -280153,7 +281065,7 @@ var init_chat_builtin_skills = __esm({
 
 // ../server/src/governance/connector-tool-versions.ts
 function connectorToolVersionsFile(dataDir) {
-  return (0, import_node_path28.join)(dataDir, "connector-tools", "versions.json");
+  return (0, import_node_path29.join)(dataDir, "connector-tools", "versions.json");
 }
 function registryBase() {
   const raw = process.env["npm_config_registry"] || process.env["NPM_CONFIG_REGISTRY"] || "https://registry.npmjs.org";
@@ -280172,7 +281084,7 @@ async function fetchLatestNpmVersion(pkg) {
 }
 async function readRegisteredToolVersions(dataDir) {
   try {
-    const raw = JSON.parse(await (0, import_promises16.readFile)(connectorToolVersionsFile(dataDir), "utf8"));
+    const raw = JSON.parse(await (0, import_promises17.readFile)(connectorToolVersionsFile(dataDir), "utf8"));
     if (!raw || typeof raw !== "object") return {};
     const out = {};
     for (const [k2, v2] of Object.entries(raw)) {
@@ -280185,11 +281097,11 @@ async function readRegisteredToolVersions(dataDir) {
 }
 async function writeRegisteredToolVersions(dataDir, versions) {
   const file = connectorToolVersionsFile(dataDir);
-  await (0, import_promises16.mkdir)((0, import_node_path28.join)(dataDir, "connector-tools"), { recursive: true });
+  await (0, import_promises17.mkdir)((0, import_node_path29.join)(dataDir, "connector-tools"), { recursive: true });
   const tmp = `${file}.${process.pid}.tmp`;
-  await (0, import_promises16.writeFile)(tmp, `${JSON.stringify(versions, null, 2)}
+  await (0, import_promises17.writeFile)(tmp, `${JSON.stringify(versions, null, 2)}
 `, "utf8");
-  await (0, import_promises16.rename)(tmp, file);
+  await (0, import_promises17.rename)(tmp, file);
 }
 async function refreshConnectorToolVersions(opts) {
   const fetchLatest = opts.fetchLatest ?? fetchLatestNpmVersion;
@@ -280232,12 +281144,12 @@ function pickToolVersions(registered, tools) {
   }
   return out;
 }
-var import_promises16, import_node_path28, NPM_PROBE_TIMEOUT_MS;
+var import_promises17, import_node_path29, NPM_PROBE_TIMEOUT_MS;
 var init_connector_tool_versions = __esm({
   "../server/src/governance/connector-tool-versions.ts"() {
     "use strict";
-    import_promises16 = require("node:fs/promises");
-    import_node_path28 = require("node:path");
+    import_promises17 = require("node:fs/promises");
+    import_node_path29 = require("node:path");
     init_src8();
     NPM_PROBE_TIMEOUT_MS = 3e3;
   }
@@ -281330,6 +282242,7 @@ __export(src_exports2, {
   DEFAULT_PUSH_THROTTLE_MS: () => DEFAULT_PUSH_THROTTLE_MS,
   DEFAULT_SIMPLE_QUERY_MAX_CHARS: () => DEFAULT_SIMPLE_QUERY_MAX_CHARS,
   DEFAULT_TERMINAL_MAX_AGE_MS: () => DEFAULT_TERMINAL_MAX_AGE_MS,
+  DEFAULT_TIME_ZONE_ENV: () => DEFAULT_TIME_ZONE_ENV,
   DELIVERY_REPAIR_BATCH: () => DELIVERY_REPAIR_BATCH,
   DENY_ALL_TRACE_READ: () => DENY_ALL_TRACE_READ,
   DISPATCH_DROP_BACKOFF_MS: () => DISPATCH_DROP_BACKOFF_MS,
@@ -281413,6 +282326,7 @@ __export(src_exports2, {
   MemoryProjectStateStore: () => MemoryProjectStateStore,
   MemoryPushSubscriptionStore: () => MemoryPushSubscriptionStore,
   MemoryReadMarkerStore: () => MemoryReadMarkerStore,
+  MemoryTodoStore: () => MemoryTodoStore,
   MemoryWorkorderDraftPlannerIssuesStore: () => MemoryWorkorderDraftPlannerIssuesStore,
   MemoryWorkorderTagStore: () => MemoryWorkorderTagStore,
   MemoryWriteConflictError: () => MemoryWriteConflictError,
@@ -281431,6 +282345,7 @@ __export(src_exports2, {
   OWNER_PROTECTED_PROFILE_MESSAGE: () => OWNER_PROTECTED_PROFILE_MESSAGE,
   PARENT_CONVERSATION_PATH: () => PARENT_CONVERSATION_PATH,
   PARENT_CONVERSATION_RECENT_TURNS: () => PARENT_CONVERSATION_RECENT_TURNS,
+  PERSONAL_TODO_SKILL_ID: () => PERSONAL_TODO_SKILL_ID,
   PostgresNotificationStore: () => PostgresNotificationStore,
   PostgresPushSubscriptionStore: () => PostgresPushSubscriptionStore,
   PostgresWorkorderDraftPlannerIssuesStore: () => PostgresWorkorderDraftPlannerIssuesStore,
@@ -281461,7 +282376,12 @@ __export(src_exports2, {
   STATUS_MARKER: () => STATUS_MARKER,
   SessionRuntimeOverrideError: () => SessionRuntimeOverrideError,
   SkillFetchHttpError: () => SkillFetchHttpError,
+  TODO_REMINDER_SCAN_MS: () => TODO_REMINDER_SCAN_MS,
+  TODO_REMINDER_TIME: () => TODO_REMINDER_TIME,
+  TODO_REMINDER_TITLE: () => TODO_REMINDER_TITLE,
   TenancyVisibilityInputError: () => TenancyVisibilityInputError,
+  TodoReminderScanner: () => TodoReminderScanner,
+  TodoService: () => TodoService,
   TraceService: () => TraceService,
   TraceStoreSink: () => TraceStoreSink,
   TypesAdminService: () => TypesAdminService,
@@ -281487,10 +282407,12 @@ __export(src_exports2, {
   assertBindingWritePermission: () => assertBindingWritePermission,
   assertCompanyManager: () => assertCompanyManager,
   assertCreatableVariable: () => assertCreatableVariable,
+  assertFirstVersionAssignee: () => assertFirstVersionAssignee,
   assertMayCreateAgent: () => assertMayCreateAgent,
   assertMayManageAgent: () => assertMayManageAgent,
   assertMaySelfOrManage: () => assertMaySelfOrManage,
   assistantBoundToMember: () => assistantBoundToMember,
+  assistantNameFor: () => assistantNameFor,
   assistantRowRecovery: () => assistantRowRecovery,
   assistantsDomain: () => assistantsDomain,
   atCapacity: () => atCapacity,
@@ -281526,6 +282448,7 @@ __export(src_exports2, {
   buildWorkorderMetrics: () => buildWorkorderMetrics,
   buildWorkorderSummaries: () => buildWorkorderSummaries,
   builtinSkillToFiles: () => builtinSkillToFiles,
+  canAccessTodo: () => canAccessTodo,
   canAnnounceRuntimeSwitch: () => canAnnounceRuntimeSwitch,
   canRetryAllocation: () => canRetryAllocation,
   chatBroadcastEnabledFromEnv: () => chatBroadcastEnabledFromEnv,
@@ -281611,6 +282534,7 @@ __export(src_exports2, {
   decideArrival: () => decideArrival,
   decideFlush: () => decideFlush,
   defaultAvatarRefOf: () => defaultAvatarRefOf,
+  defaultTimeZoneFromEnv: () => defaultTimeZoneFromEnv,
   delegationArtifactsView: () => delegationArtifactsView,
   delegationBundleAdditions: () => delegationBundleAdditions,
   delegationDirName: () => delegationDirName,
@@ -281635,6 +282559,7 @@ __export(src_exports2, {
   dispatchIntentMarker: () => dispatchIntentMarker,
   displayCostUsdMicros: () => displayCostUsdMicros,
   dropUnchangedOutputs: () => dropUnchangedOutputs,
+  dueReminders: () => dueReminders,
   employeeHref: () => employeeHref,
   encryptPushMessage: () => encryptPushMessage,
   ensureCompanyActors: () => ensureCompanyActors,
@@ -281770,6 +282695,7 @@ __export(src_exports2, {
   parseWriteScope: () => parseWriteScope,
   parseZhizengzengMarkdown: () => parseZhizengzengMarkdown,
   participatingTaskCount: () => participatingTaskCount,
+  personalTodoEnabledFromEnv: () => personalTodoEnabledFromEnv,
   pickToolVersions: () => pickToolVersions,
   placeholderRuntimeSessionFlag: () => placeholderRuntimeSessionFlag,
   planChatContinuation: () => planChatContinuation,
@@ -281911,6 +282837,8 @@ __export(src_exports2, {
   toBundleFiles: () => toBundleFiles,
   toChatDispatchRequest: () => toChatDispatchRequest,
   toYamlDoubleQuoted: () => toYamlDoubleQuoted,
+  todoReminderSourceKey: () => todoReminderSourceKey,
+  todosDomain: () => todosDomain,
   touchKey: () => touchKey,
   traceDomain: () => traceDomain,
   traceReadAllows: () => traceReadAllows,
@@ -282039,6 +282967,7 @@ var init_src11 = __esm({
     init_agent_default_runtime_store();
     init_knowledge2();
     init_delegations();
+    init_todos2();
     init_automations();
     init_automations();
     init_playbooks();
@@ -282450,14 +283379,14 @@ init_src();
 var os16 = __toESM(require("node:os"));
 var path46 = __toESM(require("node:path"));
 var import_node_child_process23 = require("node:child_process");
-var import_node_crypto98 = require("node:crypto");
+var import_node_crypto100 = require("node:crypto");
 
 // ../cli/src/cli.ts
 init_src();
 var fs44 = __toESM(require("node:fs"), 1);
 var os13 = __toESM(require("node:os"), 1);
 var path39 = __toESM(require("node:path"), 1);
-var import_node_crypto96 = require("node:crypto");
+var import_node_crypto98 = require("node:crypto");
 
 // ../cli/src/serve.ts
 init_src11();
@@ -282470,11 +283399,11 @@ var fs36 = __toESM(require("node:fs"), 1);
 var os9 = __toESM(require("node:os"), 1);
 var path29 = __toESM(require("node:path"), 1);
 var import_node_child_process15 = require("node:child_process");
-var import_node_crypto91 = require("node:crypto");
+var import_node_crypto93 = require("node:crypto");
 var import_node_url7 = require("node:url");
 
 // ../cli/src/artifact-discovery-source.ts
-var import_node_crypto86 = require("node:crypto");
+var import_node_crypto88 = require("node:crypto");
 init_src7();
 var ArtifactDiscoverySourceUnreadableError = class extends Error {
   constructor(message) {
@@ -282504,7 +283433,7 @@ async function resolveArtifactDiscoverySourceContent(blobs, input) {
     throw new ArtifactDiscoverySourceUnreadableError(`Artifact Revision ${input.revisionId} \u7684 contentKind \u4E0D\u53D7\u652F\u6301\uFF1A${String(input.contentKind)}`);
   }
   const rootBytes = await blobs.get(input.contentRef);
-  const sourceFingerprint = (0, import_node_crypto86.createHash)("sha256").update(rootBytes).digest("hex");
+  const sourceFingerprint = (0, import_node_crypto88.createHash)("sha256").update(rootBytes).digest("hex");
   if (input.contentKind === "inline-blob") {
     const sourceContent = decodeText3(rootBytes);
     if (sourceContent === null) {
@@ -282528,7 +283457,7 @@ ${entry.text}`).join("\n\n"),
 }
 
 // ../server/src/domains/discussions/service.ts
-var import_node_crypto87 = require("node:crypto");
+var import_node_crypto89 = require("node:crypto");
 init_zod();
 init_discussions();
 init_router();
@@ -282597,7 +283526,7 @@ var decisionOption = (row) => ({
   state: row.value.record.state,
   revision: row.revision
 });
-var hash2 = (s2) => (0, import_node_crypto87.createHash)("sha256").update(s2).digest("hex").slice(0, 24);
+var hash2 = (s2) => (0, import_node_crypto89.createHash)("sha256").update(s2).digest("hex").slice(0, 24);
 var canonical = (s2) => s2.normalize("NFKC").trim().toLocaleLowerCase();
 function decisionFingerprint(d) {
   return hash2(JSON.stringify([d.statement, d.rationale, d.alternatives]));
@@ -282870,7 +283799,7 @@ var DiscussionService = class {
         throw new ApiError(409, "DISCUSSION_CONFLICT", "\u9879\u76EE\u8BAE\u9898\u6216\u51B3\u7B56\u5DF2\u53D8\u5316\uFF0C\u8BF7\u8BFB\u53D6\u6700\u65B0\u5185\u5BB9\u540E\u4FEE\u6B63");
       }
     }
-    const operation = (value2) => tx.put("operation", (0, import_node_crypto87.randomUUID)(), {
+    const operation = (value2) => tx.put("operation", (0, import_node_crypto89.randomUUID)(), {
       ...value2,
       projectId: projectId2,
       actorId: ctx.actorId,
@@ -282887,7 +283816,7 @@ var DiscussionService = class {
       if (id.startsWith("new:")) {
         if (BUG_TOPIC.test(t.title.trim())) invalid("topics.title", `\u300C${t.title}\u300D\u662F\u5355\u4E2A Bug\uFF1A\u4FEE\u590D\u60C5\u51B5\u5199\u8FDB\u8BA8\u8BBA\u8BB0\u5F55\uFF0C\u5B9A\u51FA\u7684\u89C4\u5219\u6302\u5230\u5BF9\u5E94\u529F\u80FD\u8BAE\u9898\u4E0B\uFF0C\u4E0D\u6309 Bug \u53F7\u5EFA\u8BAE\u9898`);
         const existing = [...topicMap.values()].find((x2) => canonical(x2.title) === canonical(t.title));
-        id = existing?.topicId ?? `topic_${(0, import_node_crypto87.randomUUID)()}`;
+        id = existing?.topicId ?? `topic_${(0, import_node_crypto89.randomUUID)()}`;
         if (!existing) createdTopics.add(id);
       } else if (!topicMap.has(id)) invalid("topics.topic_id", `\u8BAE\u9898 ${id} \u4E0D\u5B58\u5728\uFF1B\u65B0\u8BAE\u9898\u4F7F\u7528 new: \u524D\u7F00`);
       topicAliases.set(t.topic_id, id);
@@ -282939,7 +283868,7 @@ var DiscussionService = class {
       if (id.startsWith("new:")) {
         const candidateKey = JSON.stringify([topicId, canonical(d.record.statement)]);
         const existing = [...decisionMap.values()].find((x2) => x2.topicId === topicId && canonical(x2.record.statement) === canonical(d.record.statement));
-        id = existing?.decisionId ?? candidateIds.get(candidateKey) ?? `decision_${(0, import_node_crypto87.randomUUID)()}`;
+        id = existing?.decisionId ?? candidateIds.get(candidateKey) ?? `decision_${(0, import_node_crypto89.randomUUID)()}`;
         candidateIds.set(candidateKey, id);
       } else if (!decisionMap.has(id)) invalid("decision_id", `\u51B3\u7B56 ${id} \u4E0D\u5B58\u5728\uFF1B\u65B0\u51B3\u7B56\u4F7F\u7528 new: \u524D\u7F00`);
       decisionAliases.set(d.decision_id, id);
@@ -283063,15 +283992,15 @@ var DiscussionService = class {
     });
   }
   async editTopic(projectId2, topicId, revision, raw, actorId) {
-    const edit2 = external_exports.object({ title: nonempty, summary: text6.optional() }).strict().parse(raw);
+    const edit3 = external_exports.object({ title: nonempty, summary: text6.optional() }).strict().parse(raw);
     return this.store.transaction(async (tx) => {
       const key2 = entryId(projectId2, topicId);
       const old = await tx.get("topic", key2);
       if (!old) throw new ApiError(404, "NOT_FOUND", "\u8BAE\u9898\u4E0D\u5B58\u5728");
       assertRevision(old.revision, revision);
-      const summary = (edit2.summary ?? old.value.summary ?? "").trim();
-      if (old.value.title === edit2.title && (old.value.summary ?? "") === summary) return old;
-      const result = await tx.put("topic", key2, { ...old.value, title: edit2.title, summary, updated_at: new Date(this.now()).toISOString() });
+      const summary = (edit3.summary ?? old.value.summary ?? "").trim();
+      if (old.value.title === edit3.title && (old.value.summary ?? "") === summary) return old;
+      const result = await tx.put("topic", key2, { ...old.value, title: edit3.title, summary, updated_at: new Date(this.now()).toISOString() });
       await this.operation(tx, actorId, "topic", key2, old.revision, result.revision);
       return result;
     });
@@ -283201,7 +284130,7 @@ var DiscussionService = class {
           ...row.value.confirmation ? { confirmation: { ...row.value.confirmation, fingerprint: decisionFingerprint(record10) } } : {}
         };
         await tx.put("decision", row.id, value2);
-        await tx.put("operation", (0, import_node_crypto87.randomUUID)(), {
+        await tx.put("operation", (0, import_node_crypto89.randomUUID)(), {
           action: "edit",
           kind: "decision",
           projectId: projectId2,
@@ -283265,7 +284194,7 @@ var DiscussionService = class {
         if (!current || current.revision !== row.revision) throw new ApiError(409, "DISCUSSION_CONFLICT", `\u8BA8\u8BBA ${row.id} \u5DF2\u88AB\u4FEE\u6539\uFF0C\u8BF7\u8BFB\u53D6\u6700\u65B0\u5185\u5BB9\u540E\u91CD\u8BD5`);
         const summary = given.get(row.id);
         await tx.put("discussion", row.id, { ...current.value, record: { ...current.value.record, summary } });
-        await tx.put("operation", (0, import_node_crypto87.randomUUID)(), {
+        await tx.put("operation", (0, import_node_crypto89.randomUUID)(), {
           action: "edit",
           kind: "discussion",
           projectId: current.value.record.project_id,
@@ -283281,7 +284210,7 @@ var DiscussionService = class {
     });
   }
   async operation(tx, actorId, kind, id, from, to) {
-    await tx.put("operation", (0, import_node_crypto87.randomUUID)(), { actorId, kind, id, from, to, at: new Date(this.now()).toISOString() });
+    await tx.put("operation", (0, import_node_crypto89.randomUUID)(), { actorId, kind, id, from, to, at: new Date(this.now()).toISOString() });
   }
 };
 function pickDiscussionContent(d) {
@@ -283412,13 +284341,13 @@ function renderProjectContext(input) {
   const dir = PROJECT_DISCUSSIONS_DIR;
   const files = {};
   const width = (n) => Math.max(2, String(n).length);
-  const pad2 = (i, n) => String(i + 1).padStart(width(n), "0");
+  const pad3 = (i, n) => String(i + 1).padStart(width(n), "0");
   const mine = new Set(input.discussions.flatMap((row) => row.value.record.topics.map((t) => `${row.value.record.project_id}\0${t.topic_id}`)));
-  const discussionPaths = input.discussions.map((row, i) => `${dir}/\u6211\u7684\u8BA8\u8BBA/${pad2(i, input.discussions.length)}-${row.value.discussedAt.slice(0, 10)}-${fileSegment(row.value.record.title, "\u672A\u547D\u540D\u8BA8\u8BBA")}.md`);
+  const discussionPaths = input.discussions.map((row, i) => `${dir}/\u6211\u7684\u8BA8\u8BBA/${pad3(i, input.discussions.length)}-${row.value.discussedAt.slice(0, 10)}-${fileSegment(row.value.record.title, "\u672A\u547D\u540D\u8BA8\u8BBA")}.md`);
   input.discussions.forEach((row, i) => {
     files[discussionPaths[i]] = [`# ${row.value.record.title}`, "", ...discussionBody(input, row)].join("\n");
   });
-  const topicPaths = input.topics.map((t, i) => `${dir}/\u8BAE\u9898/${pad2(i, input.topics.length)}-${fileSegment(t.value.title, "\u672A\u547D\u540D\u8BAE\u9898")}.md`);
+  const topicPaths = input.topics.map((t, i) => `${dir}/\u8BAE\u9898/${pad3(i, input.topics.length)}-${fileSegment(t.value.title, "\u672A\u547D\u540D\u8BAE\u9898")}.md`);
   input.topics.forEach((t, i) => {
     files[topicPaths[i]] = [`# \u8BAE\u9898\uFF1A${t.value.title}`, "", decisionLegend, "", ...topicBody(input, t, "##")].join("\n");
   });
@@ -283581,7 +284510,7 @@ var DiscussionContext = class {
 };
 
 // ../server/src/domains/discussions/worker.ts
-var import_node_crypto88 = require("node:crypto");
+var import_node_crypto90 = require("node:crypto");
 var DISCUSSION_IDLE_MS = 15 * 6e4;
 var DISCUSSION_MAX_CORRECTIONS = 3;
 var DISCUSSION_LEASE_MS = 2 * 6e4;
@@ -283607,7 +284536,7 @@ var DiscussionWorker = class {
     if (await this.isReplying(sessionId)) return false;
     const cutoff = eligibleCutoff(await this.service.chat.listMessages(sessionId), this.service.now());
     if (!cutoff) return false;
-    const owner = (0, import_node_crypto88.randomUUID)();
+    const owner = (0, import_node_crypto90.randomUUID)();
     const claimed = await this.service.store.transaction(async (tx) => {
       const old = (await tx.get("job", sessionId))?.value;
       if (old?.status === "running" && (old.leaseUntil ?? 0) > this.service.now()) return null;
@@ -284033,7 +284962,7 @@ init_zod();
 init_discussions();
 init_router();
 init_uncategorized_project();
-var edit = external_exports.object({ revision: external_exports.number().int().positive(), content: external_exports.unknown() }).strict();
+var edit2 = external_exports.object({ revision: external_exports.number().int().positive(), content: external_exports.unknown() }).strict();
 var removal = external_exports.object({ revision: external_exports.number().int().positive(), reason: external_exports.string() }).strict();
 function paging(query) {
   const parsed = external_exports.object({
@@ -284122,7 +285051,7 @@ function discussionsDomain(options) {
     router.patch("/api/chat-sessions/:id/discussion", wrap(async (req) => {
       await human(req);
       const { service, session } = await sessionAccess(req);
-      const body2 = edit.parse(req.body);
+      const body2 = edit2.parse(req.body);
       return { status: 200, body: await service.editDiscussion(session.id, body2.revision, body2.content, req.auth.actor) };
     }));
     router.post("/api/chat-sessions/:id/discussion/retry", wrap(async (req) => {
@@ -284184,7 +285113,7 @@ function discussionsDomain(options) {
       await human(req);
       const service = await options.serviceFor(req.auth.companyId);
       await service.project(req.params.id);
-      const body2 = edit.extend({ relatedRevisions: external_exports.record(external_exports.number().int().positive()).optional() }).parse(req.body);
+      const body2 = edit2.extend({ relatedRevisions: external_exports.record(external_exports.number().int().positive()).optional() }).parse(req.body);
       return { status: 200, body: await service.editDecision(req.params.id, req.params.decisionId, body2.revision, body2.content, req.auth.actor, body2.relatedRevisions) };
     }));
     router.get("/api/chat-sessions/:id/project-context", wrap(async (req) => {
@@ -284367,9 +285296,9 @@ function createDiscussionRuntime(options) {
 }
 
 // ../server/src/domains/discussions/store.ts
-var import_node_crypto89 = require("node:crypto");
-var import_promises17 = require("node:fs/promises");
-var import_node_path29 = require("node:path");
+var import_node_crypto91 = require("node:crypto");
+var import_promises18 = require("node:fs/promises");
+var import_node_path30 = require("node:path");
 var key = (kind, id) => JSON.stringify([kind, id]);
 function contains(value2, match) {
   if (match !== null && typeof match === "object" && !Array.isArray(match)) {
@@ -284390,7 +285319,7 @@ var MemoryDiscussionStore = class _MemoryDiscussionStore {
   static async open(filename) {
     const store = new _MemoryDiscussionStore(filename);
     try {
-      store.rows = JSON.parse(await (0, import_promises17.readFile)(filename, "utf8"));
+      store.rows = JSON.parse(await (0, import_promises18.readFile)(filename, "utf8"));
     } catch (error2) {
       if (error2.code !== "ENOENT") throw error2;
     }
@@ -284442,10 +285371,10 @@ var MemoryDiscussionStore = class _MemoryDiscussionStore {
       const result = await run(tx);
       if (changed) {
         if (this.filename) {
-          await (0, import_promises17.mkdir)((0, import_node_path29.dirname)(this.filename), { recursive: true });
-          const temp = `${this.filename}.${(0, import_node_crypto89.randomUUID)()}.tmp`;
-          await (0, import_promises17.writeFile)(temp, JSON.stringify(next), "utf8");
-          await (0, import_promises17.rename)(temp, this.filename);
+          await (0, import_promises18.mkdir)((0, import_node_path30.dirname)(this.filename), { recursive: true });
+          const temp = `${this.filename}.${(0, import_node_crypto91.randomUUID)()}.tmp`;
+          await (0, import_promises18.writeFile)(temp, JSON.stringify(next), "utf8");
+          await (0, import_promises18.rename)(temp, this.filename);
         }
         this.rows = next;
       }
@@ -284536,6 +285465,225 @@ var PostgresDiscussionStore = class _PostgresDiscussionStore {
   }
 };
 
+// ../cli/src/todo-wiring.ts
+init_src();
+init_router();
+init_service10();
+init_routes11();
+init_reminders();
+init_flag();
+function createTodoRuntime(options) {
+  const enabled = options.enabled ?? (() => personalTodoEnabledFromEnv());
+  const cache = /* @__PURE__ */ new Map();
+  const serviceFor = (companyId) => {
+    const id = companyId ?? options.defaultCompanyId();
+    let value2 = cache.get(id);
+    if (!value2) {
+      value2 = options.store(id).then((store) => new TodoService({ store, timeZone: () => options.timeZone(id) }));
+      cache.set(id, value2);
+      void value2.catch(() => cache.delete(id));
+    }
+    return value2;
+  };
+  const resolveCaller = async (actorId, companyId) => {
+    if (isHumanActorId(actorId)) return { principal: actorId, actor: actorId };
+    const human = await options.boundHuman(actorId, companyId ?? options.defaultCompanyId());
+    if (!human) throw new ApiError(403, "TODO_NO_OWNER", "\u4E2A\u4EBA\u5F85\u529E\u53EA\u80FD\u7531\u771F\u4EBA\u6216\u771F\u4EBA\u7684\u52A9\u7406\u8BB0\uFF1A\u8FD9\u4E2A agent \u6CA1\u6709\u7ED1\u5B9A\u4EFB\u4F55\u771F\u4EBA\u3002");
+    return { principal: human, hand: actorId, actor: actorId };
+  };
+  const register = todosDomain({ serviceFor, resolveCaller, enabled });
+  const scanner = new TodoReminderScanner({
+    companies: options.companies,
+    todos: options.store,
+    notifications: options.notifications,
+    timeZone: options.timeZone,
+    enabled,
+    warn: options.warn,
+    ...options.onReminders ? { onInserted: options.onReminders } : {}
+  });
+  return {
+    register,
+    serviceFor,
+    resolveCaller,
+    scanner,
+    start: () => scanner.start(),
+    stop: () => scanner.stop()
+  };
+}
+
+// ../cli/src/serve.ts
+init_store3();
+
+// ../storage/src/postgres-todos.ts
+init_pg_ident();
+init_schema_ddl_lock();
+var PostgresTodoStore = class _PostgresTodoStore {
+  constructor(pool, schema) {
+    this.pool = pool;
+    this.s = quoteIdent2(schema);
+  }
+  s;
+  static async open(pool, schema) {
+    const store = new _PostgresTodoStore(pool, schema);
+    await withSchemaDdlLock(pool, schema, async () => {
+      await pool.query(`CREATE SCHEMA IF NOT EXISTS ${store.s}`);
+      await pool.query(`CREATE TABLE IF NOT EXISTS ${store.s}.todos (
+        id text PRIMARY KEY,
+        title text NOT NULL,
+        note text,
+        creator_actor_id text NOT NULL,
+        assignee_actor_id text NOT NULL,
+        recorded_by_actor_id text NOT NULL,
+        due_date text NOT NULL,
+        due_time text,
+        start_date text,
+        start_time text,
+        status text NOT NULL CHECK (status IN ('open','done','cancelled')),
+        done_at timestamptz,
+        cancelled_at timestamptz,
+        source_chat_session_id text,
+        linked_workorder_id text,
+        created_at timestamptz NOT NULL,
+        updated_at timestamptz NOT NULL
+      )`);
+      await pool.query(`CREATE INDEX IF NOT EXISTS todos_assignee_status_due_idx ON ${store.s}.todos (assignee_actor_id, status, due_date)`);
+      await pool.query(`CREATE INDEX IF NOT EXISTS todos_creator_status_due_idx ON ${store.s}.todos (creator_actor_id, status, due_date)`);
+      await pool.query(`CREATE INDEX IF NOT EXISTS todos_open_due_idx ON ${store.s}.todos (due_date) WHERE status = 'open'`);
+      await pool.query(`CREATE INDEX IF NOT EXISTS todos_open_start_idx ON ${store.s}.todos (start_date) WHERE status = 'open' AND start_date IS NOT NULL`);
+      await pool.query(`CREATE TABLE IF NOT EXISTS ${store.s}.todo_changes (
+        id text PRIMARY KEY,
+        todo_id text NOT NULL REFERENCES ${store.s}.todos(id) ON DELETE CASCADE,
+        actor_id text NOT NULL,
+        hand_actor_id text,
+        at timestamptz NOT NULL,
+        field text NOT NULL,
+        old_value text,
+        new_value text,
+        reason text
+      )`);
+      await pool.query(`CREATE INDEX IF NOT EXISTS todo_changes_todo_at_idx ON ${store.s}.todo_changes (todo_id, at, id)`);
+    });
+    return store;
+  }
+  async tx(run) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const result = await run(client);
+      await client.query("COMMIT");
+      return result;
+    } catch (error2) {
+      await client.query("ROLLBACK");
+      throw error2;
+    } finally {
+      client.release();
+    }
+  }
+  async insertChanges(client, changes) {
+    for (const c of changes) {
+      await client.query(
+        `INSERT INTO ${this.s}.todo_changes (id,todo_id,actor_id,hand_actor_id,at,field,old_value,new_value,reason)
+        VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)`,
+        [c.id, c.todoId, c.actorId, c.handActorId ?? null, c.at, c.field, c.oldValue ?? null, c.newValue ?? null, c.reason ?? null]
+      );
+    }
+  }
+  async create(todo, changes) {
+    return this.tx(async (client) => {
+      const r = await client.query(`INSERT INTO ${this.s}.todos (id,title,note,creator_actor_id,assignee_actor_id,recorded_by_actor_id,
+          due_date,due_time,status,done_at,cancelled_at,source_chat_session_id,linked_workorder_id,created_at,updated_at,start_date,start_time)
+        VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17) RETURNING *`, rowValues(todo));
+      await this.insertChanges(client, changes);
+      return fromRow3(r.rows[0]);
+    });
+  }
+  async get(id) {
+    const r = await this.pool.query(`SELECT * FROM ${this.s}.todos WHERE id=$1`, [id]);
+    return r.rows[0] ? fromRow3(r.rows[0]) : null;
+  }
+  async update(next, expectedUpdatedAt, changes) {
+    return this.tx(async (client) => {
+      const r = await client.query(`UPDATE ${this.s}.todos SET title=$2,note=$3,creator_actor_id=$4,assignee_actor_id=$5,
+          recorded_by_actor_id=$6,due_date=$7,due_time=$8,status=$9,done_at=$10,cancelled_at=$11,source_chat_session_id=$12,
+          linked_workorder_id=$13,created_at=$14,updated_at=$15,start_date=$16,start_time=$17
+        WHERE id=$1 AND updated_at=$18::timestamptz RETURNING *`, [...rowValues(next), expectedUpdatedAt]);
+      if (!r.rows[0]) return null;
+      await this.insertChanges(client, changes);
+      return fromRow3(r.rows[0]);
+    });
+  }
+  async listInvolving(actorId, statuses2) {
+    const r = await this.pool.query(`SELECT * FROM ${this.s}.todos
+      WHERE (creator_actor_id=$1 OR assignee_actor_id=$1) AND status = ANY($2::text[])
+      ORDER BY due_date, COALESCE(due_time,'99:99'), created_at, id`, [actorId, [...statuses2]]);
+    return r.rows.map(fromRow3);
+  }
+  async listOpenReminderCandidates(fromDay, toDay) {
+    const r = await this.pool.query(`SELECT * FROM ${this.s}.todos
+      WHERE status='open' AND (due_date BETWEEN $1 AND $2 OR start_date BETWEEN $1 AND $2)
+      ORDER BY due_date, COALESCE(due_time,'99:99'), created_at, id`, [fromDay, toDay]);
+    return r.rows.map(fromRow3);
+  }
+  async listChanges(todoId) {
+    const r = await this.pool.query(`SELECT * FROM ${this.s}.todo_changes WHERE todo_id=$1 ORDER BY at, id`, [todoId]);
+    return r.rows.map((row) => {
+      const c = { id: row.id, todoId: row.todo_id, actorId: row.actor_id, at: iso8(row.at), field: row.field };
+      if (row.hand_actor_id) c.handActorId = row.hand_actor_id;
+      if (row.old_value !== null) c.oldValue = row.old_value;
+      if (row.new_value !== null) c.newValue = row.new_value;
+      if (row.reason !== null) c.reason = row.reason;
+      return c;
+    });
+  }
+};
+var iso8 = (v2) => v2 instanceof Date ? v2.toISOString() : typeof v2 === "string" ? new Date(v2).toISOString() : void 0;
+function rowValues(t) {
+  return [
+    t.id,
+    t.title,
+    t.note ?? null,
+    t.creatorActorId,
+    t.assigneeActorId,
+    t.recordedByActorId,
+    t.dueDate,
+    t.dueTime ?? null,
+    t.status,
+    t.doneAt ?? null,
+    t.cancelledAt ?? null,
+    t.sourceChatSessionId ?? null,
+    t.linkedWorkorderId ?? null,
+    t.createdAt,
+    t.updatedAt,
+    t.startDate ?? null,
+    t.startTime ?? null
+  ];
+}
+function fromRow3(row) {
+  const t = {
+    id: row["id"],
+    title: row["title"],
+    creatorActorId: row["creator_actor_id"],
+    assigneeActorId: row["assignee_actor_id"],
+    recordedByActorId: row["recorded_by_actor_id"],
+    dueDate: row["due_date"],
+    status: row["status"],
+    createdAt: iso8(row["created_at"]),
+    updatedAt: iso8(row["updated_at"])
+  };
+  const opt = [
+    ["note", row["note"]],
+    ["dueTime", row["due_time"]],
+    ["startDate", row["start_date"]],
+    ["startTime", row["start_time"]],
+    ["doneAt", iso8(row["done_at"])],
+    ["cancelledAt", iso8(row["cancelled_at"])],
+    ["sourceChatSessionId", row["source_chat_session_id"]],
+    ["linkedWorkorderId", row["linked_workorder_id"]]
+  ];
+  for (const [k2, v2] of opt) if (v2 !== void 0 && v2 !== null) t[k2] = v2;
+  return t;
+}
+
 // ../cli/src/rebuild-artifact-projections-per-company.ts
 init_src11();
 var DEFAULT_LOGGER = {
@@ -284592,7 +285740,7 @@ init_src4();
 init_chat_exit();
 
 // ../cli/src/chat-task-header.ts
-var import_node_crypto90 = require("node:crypto");
+var import_node_crypto92 = require("node:crypto");
 init_src11();
 init_src();
 var BRAINSTORM_LEGACY_LINE = "\u8BF7\u76F4\u63A5\u56DE\u7B54\u7528\u6237\u95EE\u9898\u3002\u9664\u975E\u7528\u6237\u660E\u786E\u8981\u6C42\u5199\u5165\u7CFB\u7EDF\uFF0C\u5426\u5219\u4E0D\u8981\u521B\u5EFA\u6216\u4FEE\u6539 artifact\u3002";
@@ -284653,7 +285801,7 @@ function buildChatTurnPrompts(input) {
   };
 }
 function chatSystemPromptFingerprint(systemPrompt) {
-  return (0, import_node_crypto90.createHash)("sha256").update(systemPrompt ?? "").digest("hex").slice(0, 16);
+  return (0, import_node_crypto92.createHash)("sha256").update(systemPrompt ?? "").digest("hex").slice(0, 16);
 }
 
 // ../cli/src/chat-task-md.ts
@@ -285507,7 +286655,7 @@ function oasisWrapperScript() {
   const repoRoot = (0, import_node_url7.fileURLToPath)(new URL("../../../", __esm_import_meta_url));
   const tsx = path29.join(repoRoot, "node_modules/.bin/tsx");
   const main = path29.join(repoRoot, "packages/cli/src/main.ts");
-  const key2 = (0, import_node_crypto91.createHash)("sha256").update(repoRoot).digest("hex").slice(0, 12);
+  const key2 = (0, import_node_crypto93.createHash)("sha256").update(repoRoot).digest("hex").slice(0, 12);
   const uid = typeof process.getuid === "function" ? process.getuid() : "na";
   const stable = path29.join(os9.tmpdir(), `oasis-cli-wrapper-${uid}-${key2}`);
   let dir;
@@ -285727,6 +286875,14 @@ function consoleLinksFromEnv(rawUrl, rawRoutes) {
 }
 async function startServe(opts) {
   const serverStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+  let defaultTimeZone;
+  try {
+    defaultTimeZone = defaultTimeZoneFromEnv(process.env[DEFAULT_TIME_ZONE_ENV]);
+    console.log(`[serve] \u90E8\u7F72\u9ED8\u8BA4\u65F6\u533A=${defaultTimeZone}\uFF08${DEFAULT_TIME_ZONE_ENV}\uFF1B\u7EC4\u7EC7\u6CA1\u914D\u65F6\u533A\u65F6\u4F7F\u7528\uFF09`);
+  } catch (err) {
+    console.error(`[serve] ${err.message}`);
+    throw err;
+  }
   fs36.mkdirSync(opts.dir, { recursive: true });
   const serverHeartbeatFile = path29.join(opts.dir, "serve-heartbeat.json");
   let previousServerHeartbeatAt;
@@ -285919,7 +287075,7 @@ async function startServe(opts) {
     if (!hub) return Promise.resolve({ ok: false, reason: "\u672C\u8FDB\u7A0B\u6CA1\u6709\u8282\u70B9\u7F51\u5173" });
     const online = hub.connectedDaemons().some((d) => d.daemonId === nodeId);
     if (!online) return Promise.resolve({ ok: false, reason: "\u8282\u70B9\u5F53\u524D\u4E0D\u5728\u7EBF\uFF0C\u7528\u7684\u662F\u5B83\u4E0A\u6B21\u62A5\u7684\u6E05\u5355" });
-    const requestId = (0, import_node_crypto91.randomUUID)();
+    const requestId = (0, import_node_crypto93.randomUUID)();
     const task = new Promise((resolve11) => {
       const timer = setTimeout(() => {
         modelRefreshWaiters.delete(requestId);
@@ -285993,6 +287149,8 @@ async function startServe(opts) {
     // 租户闸（ADR-0164 §5）：`POST /api/bindings` 据它拦「把本公司员工绑到别家公司的机器上」。
     // 闭包读当前 nodeStore（下方 PG 分支会重赋值），与 `listBindingModelIds` 同一写法。
     resolveNodeTenancy: async (nodeId) => nodeStore.getNode(nodeId),
+    // 变量到期按组织的生效时区算日界（PRD v1.2 §7）。`companies` 在下方才建好——本箭头只在派单 / 请求时跑，那时已就绪。
+    companyTimeZone: (companyId) => companies.service.effectiveTimeZoneOf(companyId),
     store: registryStore,
     oplog,
     kernel: defaultCompanyKernel,
@@ -286766,7 +287924,7 @@ async function startServe(opts) {
             const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
             if (buf || session.runId) {
               await turnStore.appendMessage({
-                id: (0, import_node_crypto91.randomUUID)(),
+                id: (0, import_node_crypto93.randomUUID)(),
                 sessionId: chatSessionId,
                 role: "assistant",
                 content: buf,
@@ -286812,7 +287970,7 @@ async function startServe(opts) {
     chatTargets: {
       inspect: inspectChatTarget,
       createTargetSession: async ({ companyId, agentId, ownerHumanActorId, title }) => {
-        const sessionId = (0, import_node_crypto91.randomUUID)();
+        const sessionId = (0, import_node_crypto93.randomUUID)();
         const nowIso = (/* @__PURE__ */ new Date()).toISOString();
         const binding = await registryStore.getBinding(agentId).catch(() => null);
         await (await chatStoreFor(companyId)).createSession({
@@ -286928,7 +288086,26 @@ async function startServe(opts) {
     secret: jwtSecret ?? "oasis-dev-secret",
     onAuthFailure: (reason) => console.warn(`[org-model] agent credential auth failure: ${reason}`)
   });
-  const companies = createCompaniesDomain({ store: controlPlaneStore, blobs, sender: mailSender, consoleUrl, resolveActorsCtx: actors.resolveCtx, listInFlightAssignments, agentCredentials });
+  const companies = createCompaniesDomain({
+    store: controlPlaneStore,
+    blobs,
+    sender: mailSender,
+    consoleUrl,
+    resolveActorsCtx: actors.resolveCtx,
+    listInFlightAssignments,
+    agentCredentials,
+    defaultTimeZone,
+    // 注销的邮箱验证门禁（设置页 PRD §4.3）：票据由 auth 域签发与校验。auth 要拿 companies.service
+    // 建号，只能建在后面——这里包一层闭包，请求时才解引用，不撞 TDZ。
+    verifyAccountDeletionTicket: (accountId, ticket) => auth.verifyAccountDeletionTicket(accountId, ticket),
+    // 改成员昵称时同步其懒创建助理的名字（设置页 PRD §3.1）。解析器在下方才装好、只在请求时调用；
+    // 还没装好（启动期，没有请求）就当作没有绑定，只改真人档案。
+    assistantOfHuman: async (companyId, humanActorId) => {
+      const ctx = await resolveAssistantsCtxLazy(companyId);
+      const bond = ctx ? await ctx.service.getByHuman(humanActorId) : null;
+      return bond ? { agentActorId: bond.agentActorId, origin: bond.origin } : null;
+    }
+  });
   const auth = createAuth({
     store: controlPlaneStore,
     sender: mailSender,
@@ -287954,7 +289131,7 @@ async function startServe(opts) {
       onQuotaExhausted: (t) => {
         const daemon = hub?.connectedDaemons().find((d) => d.daemonId === t.nodeId);
         if (!daemon?.meta.supportsQuotaRefresh) return;
-        hub?.dispatch(t.nodeId, { type: "refresh_quotas", requestId: (0, import_node_crypto91.randomUUID)() });
+        hub?.dispatch(t.nodeId, { type: "refresh_quotas", requestId: (0, import_node_crypto93.randomUUID)() });
       },
       actorName: async (actorId) => (await (await actors.resolveCtx(companyId)).service.getActor(actorId).catch(() => null))?.name ?? null
     });
@@ -288069,6 +289246,30 @@ async function startServe(opts) {
     isDelegationChild: async (sessionId, companyId) => Boolean(await (await delegationStoreFor(companyId)).getByChildSession(sessionId)),
     warn: (error2) => console.warn(`[discussions] ${String(error2)}`)
   });
+  const todoStores = /* @__PURE__ */ new Map();
+  const todoRuntime = createTodoRuntime({
+    companies: async () => (await controlPlaneStore.listCompanies()).filter((c) => c.status === "active").map((c) => c.id),
+    store: (companyId) => {
+      let store = todoStores.get(companyId);
+      if (!store) {
+        store = pgPool ? PostgresTodoStore.open(pgPool, engineSchemaFor(companyId)) : MemoryTodoStore.open(path29.join(opts.dir, "companies", companyEngineDirName(companyId), "todos.json"));
+        todoStores.set(companyId, store);
+        void store.catch(() => todoStores.delete(companyId));
+      }
+      return store;
+    },
+    timeZone: (companyId) => companies.service.effectiveTimeZoneOf(companyId),
+    boundHuman: async (agentId, companyId) => (await (await resolveAssistantsCtx(companyId)).service.getByAgent(agentId))?.humanActorId ?? null,
+    notifications: (companyId) => notificationStoreFor(companyId),
+    onReminders: (companyId, records) => {
+      pushNotifier?.notify(companyId, records);
+      const recipients = [...new Set(records.map((r) => r.recipient))];
+      console.warn(`[todos] ${companyId} \u5230\u671F\u63D0\u9192 ${records.length} \u6761 \u2192 ${recipients.join(",")}`);
+      auditSink.notifyNotificationsChanged(recipients);
+    },
+    defaultCompanyId: () => defaultCompanyId,
+    warn: (error2) => console.warn(`[todos] ${String(error2)}`)
+  });
   let notificationLedgerWorker;
   let pushNotifier;
   let notificationLedgerTimer;
@@ -288279,7 +289480,7 @@ async function startServe(opts) {
         }));
       }
       const limits = { wallClockMs: wallClockForKind("planner") };
-      const artifactId = `artifact:planner:${(0, import_node_crypto91.randomUUID)()}`;
+      const artifactId = `artifact:planner:${(0, import_node_crypto93.randomUUID)()}`;
       const handle = await chatRemoteAdapter.spawn({
         actor: planner.id,
         // companyId 同协调者：planner 用的就是默认公司的 actors 服务，漏签会让它一调公司域端点就 404。
@@ -288321,6 +289522,7 @@ async function startServe(opts) {
       companies.register,
       projectsDomain2.register,
       discussionRuntime.register,
+      todoRuntime.register,
       typesDomain({
         admin: typesAdmin,
         resolveAdmin: async (companyId) => {
@@ -289201,10 +290403,10 @@ async function startServe(opts) {
         if (isDeletedActor(dispatchTarget)) {
           throw new ApiError(409, ACTOR_DELETED_ERROR_CODE, ACTOR_DELETED_CHAT_MESSAGE);
         }
-        const runtimeSessionId = sessionId ?? (requestDispatchId ? deterministicUuid(retargetClaimedDispatch ? `chat-runtime:${requestDispatchId}:retry:${(0, import_node_crypto91.randomUUID)()}` : `chat-runtime:${requestDispatchId}`) : (0, import_node_crypto91.randomUUID)());
+        const runtimeSessionId = sessionId ?? (requestDispatchId ? deterministicUuid(retargetClaimedDispatch ? `chat-runtime:${requestDispatchId}:retry:${(0, import_node_crypto93.randomUUID)()}` : `chat-runtime:${requestDispatchId}`) : (0, import_node_crypto93.randomUUID)());
         const resumeRuntimeSession = Boolean(sessionId);
-        const traceRunId = requestDispatchId ? stableChatTraceRunId(requestDispatchId) : `chat-run:${(0, import_node_crypto91.randomUUID)()}`;
-        const artifactId = requestDispatchId ? `artifact:chat:${deterministicUuid(`chat-artifact:${requestDispatchId}`)}` : `artifact:chat:${(0, import_node_crypto91.randomUUID)()}`;
+        const traceRunId = requestDispatchId ? stableChatTraceRunId(requestDispatchId) : `chat-run:${(0, import_node_crypto93.randomUUID)()}`;
+        const artifactId = requestDispatchId ? `artifact:chat:${deterministicUuid(`chat-artifact:${requestDispatchId}`)}` : `artifact:chat:${(0, import_node_crypto93.randomUUID)()}`;
         let stableDispatch = requestDispatchId ? await resolveStableChatDispatch({ store: await traceStoreFor(runCompanyId), runId: traceRunId }) : null;
         const retargetClaim = Boolean(retargetClaimedDispatch && stableDispatch && allocatedTurn);
         if (stableDispatch && !stableDispatch.shouldDispatch && !retargetClaim) {
@@ -289961,6 +291163,7 @@ async function startServe(opts) {
     notifications: auditSink.notifications
   });
   discussionRuntime.start();
+  todoRuntime.start();
   projectsDomain2.service.setProjectCreatedHandler(async (project) => {
     if (!server.knowledgeGovernance) return;
     await server.knowledgeGovernance.initializeProjectSpace({
@@ -290867,7 +292070,7 @@ async function startServe(opts) {
             console.log(`[new-engine] dispatchWork ${workId} \u662F human work\u2014\u2014\u4E0D\u6D3E runtime\uFF0C\u7B49\u5F85\u4EBA\u5DE5\u5904\u7406`);
             return;
           }
-          const ledgerId = opts2?.protocolRecovery?.dispatchId ?? `dispatch:${(0, import_node_crypto91.randomUUID)()}`;
+          const ledgerId = opts2?.protocolRecovery?.dispatchId ?? `dispatch:${(0, import_node_crypto93.randomUUID)()}`;
           try {
             const inserted = await (await dispatchLedgerFor(companyId)).insertOpen({
               id: ledgerId,
@@ -290967,7 +292170,7 @@ async function startServe(opts) {
           const kernelModel = newKernel.model;
           const art = kernelModel.artifacts.get(nodeId);
           const revWid = art?.workspace ?? "";
-          const ledgerId = `dispatch:${(0, import_node_crypto91.randomUUID)()}`;
+          const ledgerId = `dispatch:${(0, import_node_crypto93.randomUUID)()}`;
           try {
             await (await dispatchLedgerFor(companyId)).insertOpen({
               id: ledgerId,
@@ -291338,7 +292541,7 @@ async function startServe(opts) {
         resolveSupplementalContext: server.knowledgeGovernance ? async ({ actorId, artifactId, workOrderId, action, part, runtimeKind, taskMarkdown }) => {
           try {
             const governance = server.knowledgeGovernance;
-            const taskFingerprint = (0, import_node_crypto91.createHash)("sha256").update(JSON.stringify({ artifactId, workOrderId, action, part: part ?? null, taskMarkdown })).digest("hex");
+            const taskFingerprint = (0, import_node_crypto93.createHash)("sha256").update(JSON.stringify({ artifactId, workOrderId, action, part: part ?? null, taskMarkdown })).digest("hex");
             const requestContext = {
               organizationId: companyId,
               actorId,
@@ -291811,8 +293014,8 @@ async function startServe(opts) {
   const quotaStarvationMs = opts.sla?.quotaStarvationMs ?? 6 * 36e5;
   const nodeIdleFallbackMs = opts.sla?.nodeIdleFallbackMs ?? opts.sla?.reviewStallMs ?? (Number(process.env["OASIS_SLA_NODE_IDLE_FALLBACK_MS"]) || 2 * 36e5);
   console.log(`[sla] \u8282\u70B9\u9759\u6B62\u515C\u5E95\u9608\u503C nodeIdleFallbackMs=${nodeIdleFallbackMs}ms\uFF08${Math.round(nodeIdleFallbackMs / 6e4)} \u5206\u949F\uFF09`);
-  const fmtSince = (iso8, now) => {
-    const min2 = Math.floor(Math.max(0, now - Date.parse(iso8)) / 6e4);
+  const fmtSince = (iso9, now) => {
+    const min2 = Math.floor(Math.max(0, now - Date.parse(iso9)) / 6e4);
     if (!Number.isFinite(min2)) return "\u521A\u624D";
     if (min2 < 1) return "\u4E0D\u5230 1 \u5206\u949F\u524D";
     if (min2 < 60) return `${min2} \u5206\u949F\u524D`;
@@ -292815,6 +294018,7 @@ ${nodeFault}` : "");
         })
       ]);
       await discussionRuntime.stop();
+      todoRuntime.stop();
       for (const timer of dispatchTimers) clearInterval(timer);
       clearInterval(slaTimer);
       escalationDeliveryWorker.stop();
@@ -293841,9 +295045,9 @@ function readCodexQuota(binary, signal, timeoutMs = 15e3) {
 
 // ../cli/src/daemon/quota/claude.ts
 var import_node_child_process18 = require("node:child_process");
-var import_promises18 = require("node:fs/promises");
+var import_promises19 = require("node:fs/promises");
 var import_node_os12 = require("node:os");
-var import_node_path30 = require("node:path");
+var import_node_path31 = require("node:path");
 var import_node_util5 = require("node:util");
 var exec = (0, import_node_util5.promisify)(import_node_child_process18.execFile);
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
@@ -293862,9 +295066,9 @@ async function credentials(env, signal) {
     }
   }
   if (!raw) {
-    const file = (0, import_node_path30.join)(env.CLAUDE_CONFIG_DIR || (0, import_node_path30.join)((0, import_node_os12.homedir)(), ".claude"), ".credentials.json");
-    if ((await (0, import_promises18.stat)(file)).size > 256 * 1024) return void 0;
-    raw = await (0, import_promises18.readFile)(file, { encoding: "utf8", ...signal ? { signal } : {} });
+    const file = (0, import_node_path31.join)(env.CLAUDE_CONFIG_DIR || (0, import_node_path31.join)((0, import_node_os12.homedir)(), ".claude"), ".credentials.json");
+    if ((await (0, import_promises19.stat)(file)).size > 256 * 1024) return void 0;
+    raw = await (0, import_promises19.readFile)(file, { encoding: "utf8", ...signal ? { signal } : {} });
   }
   const oauth = object6(object6(JSON.parse(raw)).claudeAiOauth);
   if (typeof oauth.expiresAt === "number" && oauth.expiresAt <= Date.now()) return void 0;
@@ -293933,18 +295137,18 @@ async function readClaudeQuota(binary, signal, deps = {}) {
 }
 
 // ../cli/src/daemon/quota/shared-cache.ts
-var import_node_crypto92 = require("node:crypto");
+var import_node_crypto94 = require("node:crypto");
 var import_node_fs25 = require("node:fs");
 var import_node_os13 = require("node:os");
-var import_node_path31 = require("node:path");
+var import_node_path32 = require("node:path");
 init_src();
 function profileOf(kind, env) {
-  if (kind === "codex") return `codex:${env.CODEX_HOME || (0, import_node_path31.join)((0, import_node_os13.homedir)(), ".codex")}`;
-  if (env.CLAUDE_CODE_OAUTH_TOKEN) return `claude-token:${(0, import_node_crypto92.createHash)("sha256").update(env.CLAUDE_CODE_OAUTH_TOKEN).digest("hex")}`;
-  return `claude:${env.CLAUDE_CONFIG_DIR || (0, import_node_path31.join)((0, import_node_os13.homedir)(), ".claude")}`;
+  if (kind === "codex") return `codex:${env.CODEX_HOME || (0, import_node_path32.join)((0, import_node_os13.homedir)(), ".codex")}`;
+  if (env.CLAUDE_CODE_OAUTH_TOKEN) return `claude-token:${(0, import_node_crypto94.createHash)("sha256").update(env.CLAUDE_CODE_OAUTH_TOKEN).digest("hex")}`;
+  return `claude:${env.CLAUDE_CONFIG_DIR || (0, import_node_path32.join)((0, import_node_os13.homedir)(), ".claude")}`;
 }
 function fileQuotaCache(dir, env = process.env) {
-  const file = (kind) => (0, import_node_path31.join)(dir, `${kind}-${(0, import_node_crypto92.createHash)("sha256").update(profileOf(kind, env)).digest("hex").slice(0, 16)}.json`);
+  const file = (kind) => (0, import_node_path32.join)(dir, `${kind}-${(0, import_node_crypto94.createHash)("sha256").update(profileOf(kind, env)).digest("hex").slice(0, 16)}.json`);
   return {
     get(kind) {
       try {
@@ -294126,7 +295330,7 @@ var RuntimeQuotaMonitor = class _RuntimeQuotaMonitor {
 init_wrapper();
 init_src();
 var import_node_os14 = require("node:os");
-var import_node_crypto93 = require("node:crypto");
+var import_node_crypto95 = require("node:crypto");
 init_src8();
 init_src2();
 
@@ -294192,7 +295396,7 @@ function detectRuntimes() {
 
 // ../cli/src/daemon/workdir-handler.ts
 var import_node_fs26 = __toESM(require("node:fs"), 1);
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
 init_src2();
 init_src();
 var WORKDIR_READ_MAX_BYTES = 2 * 1024 * 1024;
@@ -294213,10 +295417,10 @@ function isSensitiveSegment(segment) {
 }
 function relPathIsSensitive(rel) {
   if (!rel) return false;
-  return rel.split(import_node_path32.default.sep).some((seg) => seg.length > 0 && isSensitiveSegment(seg));
+  return rel.split(import_node_path33.default.sep).some((seg) => seg.length > 0 && isSensitiveSegment(seg));
 }
 function withinBase(p2, base) {
-  return p2 === base || p2.startsWith(base + import_node_path32.default.sep);
+  return p2 === base || p2.startsWith(base + import_node_path33.default.sep);
 }
 function normalizeRel(raw) {
   const trimmed = (raw ?? "").trim();
@@ -294233,7 +295437,7 @@ async function trustedCanonicalContainer(req, logicalBase, dirKind) {
   } catch {
     return null;
   }
-  return isLegacy ? import_node_path32.default.join(trustedRootReal, "oasis-chat-sessions") : import_node_path32.default.join(trustedRootReal, "sessions", dirKind);
+  return isLegacy ? import_node_path33.default.join(trustedRootReal, "oasis-chat-sessions") : import_node_path33.default.join(trustedRootReal, "sessions", dirKind);
 }
 async function resolveWithinWorkdir(req) {
   const dirKind = sessionDirKind(req.runtimeKind);
@@ -294251,11 +295455,11 @@ async function resolveWithinWorkdir(req) {
   } catch {
     return { ok: false, code: "NOT_FOUND" };
   }
-  if (import_node_path32.default.dirname(base) !== canonicalContainer) return { ok: false, code: "PATH_ESCAPE" };
+  if (import_node_path33.default.dirname(base) !== canonicalContainer) return { ok: false, code: "PATH_ESCAPE" };
   const rel = normalizeRel(req.path);
-  const requested = import_node_path32.default.resolve(base, rel);
+  const requested = import_node_path33.default.resolve(base, rel);
   if (!withinBase(requested, base)) return { ok: false, code: "PATH_ESCAPE" };
-  const cleanRel = base === requested ? "" : import_node_path32.default.relative(base, requested);
+  const cleanRel = base === requested ? "" : import_node_path33.default.relative(base, requested);
   if (relPathIsSensitive(cleanRel)) return { ok: false, code: "SENSITIVE" };
   let real;
   try {
@@ -294265,7 +295469,7 @@ async function resolveWithinWorkdir(req) {
     return { ok: false, code: "PATH_ESCAPE" };
   }
   if (!withinBase(real, base)) return { ok: false, code: "PATH_ESCAPE" };
-  const realRel = base === real ? "" : import_node_path32.default.relative(base, real);
+  const realRel = base === real ? "" : import_node_path33.default.relative(base, real);
   if (relPathIsSensitive(realRel)) return { ok: false, code: "SENSITIVE" };
   return { ok: true, base, real };
 }
@@ -294301,7 +295505,7 @@ async function handleWorkdirList(req) {
       const slice = truncated ? visible.slice(0, WORKDIR_LIST_MAX_ENTRIES) : visible;
       const entries = [];
       for (const d of slice) {
-        const abs = import_node_path32.default.join(anchor, d.name);
+        const abs = import_node_path33.default.join(anchor, d.name);
         try {
           const st = await import_node_fs26.default.promises.lstat(abs);
           if (st.isSymbolicLink()) continue;
@@ -294368,7 +295572,7 @@ async function verifyOpenedFd(fh, base, fallback) {
   const fdReal = await fdCanonicalPath(fh);
   if (fdReal === null) return { anchor: fallback };
   if (!withinBase(fdReal, base)) return { error: { ok: false, code: "PATH_ESCAPE" } };
-  const fdRel = base === fdReal ? "" : import_node_path32.default.relative(base, fdReal);
+  const fdRel = base === fdReal ? "" : import_node_path33.default.relative(base, fdReal);
   if (relPathIsSensitive(fdRel)) return { error: { ok: false, code: "SENSITIVE" } };
   return { anchor: `/proc/self/fd/${fh.fd}` };
 }
@@ -294462,7 +295666,7 @@ function looksBinary(bytes2) {
 function contentTypeFor(absPath, bytes2) {
   const sniffed = sniffContentType(bytes2);
   if (sniffed) return sniffed;
-  const ext = import_node_path32.default.extname(absPath).toLowerCase();
+  const ext = import_node_path33.default.extname(absPath).toLowerCase();
   if (EXT_CONTENT_TYPE[ext]) return EXT_CONTENT_TYPE[ext];
   return looksBinary(bytes2) ? "application/octet-stream" : "text/plain; charset=utf-8";
 }
@@ -295045,7 +296249,7 @@ var DaemonWsClient = class {
    */
   async queryArtifactStates(artifactIds, timeoutMs = 15e3) {
     if (artifactIds.length === 0) return {};
-    const requestId = (0, import_node_crypto93.randomUUID)();
+    const requestId = (0, import_node_crypto95.randomUUID)();
     return new Promise((resolve11, reject) => {
       const timer = setTimeout(() => {
         this.gcPending.delete(requestId);
@@ -295225,17 +296429,17 @@ var RuntimeRouterAdapter = class {
 // ../cli/src/daemon/reap-claude-projects.ts
 var import_node_fs27 = __toESM(require("node:fs"), 1);
 var import_node_os15 = __toESM(require("node:os"), 1);
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 function claudeProjectSlug(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
 function claudeProjectsRoot() {
-  const configDir = process.env["CLAUDE_CONFIG_DIR"] || import_node_path33.default.join(import_node_os15.default.homedir(), ".claude");
-  return import_node_path33.default.join(configDir, "projects");
+  const configDir = process.env["CLAUDE_CONFIG_DIR"] || import_node_path34.default.join(import_node_os15.default.homedir(), ".claude");
+  return import_node_path34.default.join(configDir, "projects");
 }
 function reapClaudeProjects(workdir, runtimeKind) {
   if (runtimeKind !== "claude" && runtimeKind !== "claude-code") return;
-  const dir = import_node_path33.default.join(claudeProjectsRoot(), claudeProjectSlug(workdir));
+  const dir = import_node_path34.default.join(claudeProjectsRoot(), claudeProjectSlug(workdir));
   if (!import_node_fs27.default.existsSync(dir)) return;
   try {
     import_node_fs27.default.rmSync(dir, { recursive: true, force: true });
@@ -295244,7 +296448,7 @@ function reapClaudeProjects(workdir, runtimeKind) {
 }
 function measureClaudeProjects(workdir, runtimeKind) {
   if (runtimeKind !== "claude" && runtimeKind !== "claude-code") return 0;
-  const dir = import_node_path33.default.join(claudeProjectsRoot(), claudeProjectSlug(workdir));
+  const dir = import_node_path34.default.join(claudeProjectsRoot(), claudeProjectSlug(workdir));
   return dirSizeBytes2(dir);
 }
 function dirSizeBytes2(dir) {
@@ -295256,7 +296460,7 @@ function dirSizeBytes2(dir) {
     return 0;
   }
   for (const e of entries) {
-    const p2 = import_node_path33.default.join(dir, e.name);
+    const p2 = import_node_path34.default.join(dir, e.name);
     if (e.isSymbolicLink()) continue;
     if (e.isDirectory()) {
       total += dirSizeBytes2(p2);
@@ -295273,7 +296477,7 @@ function dirSizeBytes2(dir) {
 // ../cli/src/node.ts
 init_src2();
 var import_node_os16 = __toESM(require("node:os"), 1);
-var import_node_path34 = __toESM(require("node:path"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 var idleFor = (runtimeKind) => CODE_DEFAULT_POLICY.resolve({ executor: "agent", scenario: "runtime-idle", runtimeKind }).idleTimeoutMs ?? 0;
 var RESILIENCE = {
   codex: { idleTimeoutMs: idleFor("codex") }
@@ -295345,7 +296549,7 @@ async function startNode(opts) {
   const client = new DaemonWsClient(opts.serverUrl, opts.nodeId, sessions, adapters, opts.token, runtimes, opts.nodeName, opts.reportRuntimes ?? false, true, opts.onUpdate, opts.daemonVersion, {
     ...opts.daemonPkg ? { daemonPkg: opts.daemonPkg } : {},
     // 同一个 OS 用户下的所有实例（~/.oasis/instances/*）共用一份额度采集结果：同账号 5 分钟只问一次上游。
-    quotaCacheDir: import_node_path34.default.join(import_node_os16.default.homedir(), ".oasis", "quota-cache"),
+    quotaCacheDir: import_node_path35.default.join(import_node_os16.default.homedir(), ".oasis", "quota-cache"),
     // chat 文件浏览 handler 用它定位会话目录；production 不传 = 与 adapter 同款默认根（~/.oasis/work）。
     ...opts.workRoot !== void 0 ? { workRoot: opts.workRoot } : {},
     ...opts.spawnSessionProcess ? { spawnSessionProcess: opts.spawnSessionProcess } : {},
@@ -295464,7 +296668,7 @@ function forwardSignal(child, sig, killGroup = (pgid, signal) => {
 // ../cli/src/daemon/machine-id.ts
 var import_node_child_process20 = require("node:child_process");
 var import_node_fs28 = require("node:fs");
-var import_node_crypto94 = require("node:crypto");
+var import_node_crypto96 = require("node:crypto");
 var import_node_os17 = require("node:os");
 function linuxMachineId() {
   for (const p2 of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
@@ -295530,7 +296734,7 @@ var defaultSources = {
 function resolveNodeId(sources = {}) {
   const s2 = { ...defaultSources, ...sources };
   const material = `${s2.machineFingerprint()}:${s2.osUser()}`;
-  const digest = (0, import_node_crypto94.createHash)("sha256").update(material).digest("hex").slice(0, 12);
+  const digest = (0, import_node_crypto96.createHash)("sha256").update(material).digest("hex").slice(0, 12);
   return `node-${digest}`;
 }
 
@@ -297211,6 +298415,84 @@ var COMMAND_DECLS = {
     ],
     examples: ["oasis var rm STALE_KEY --scope project --project oasis", "oasis var rm --id var_1234 --yes"]
   },
+  // —— 个人待办（ADR 0635）：人对助理说「帮我记一下」→ 助理用这组命令记、改、勾掉。发起人 / 承接人由服务端按调用者
+  //    填（agent 调 = 它绑定的那个真人），命令行不收。开关 OASIS_PERSONAL_TODO=off 时服务端 404。 ——
+  todo: {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo <add|list|show|edit|done|cancel|reopen> ...",
+    description: "\u4E2A\u4EBA\u5F85\u529E\uFF1A\u66FF\u4F60\u7ED1\u5B9A\u7684\u90A3\u4E2A\u771F\u4EBA\u8BB0\u4E0B\u6709\u622A\u6B62\u65E5\u7684\u4E8B\uFF0C\u5230\u671F\u524D\u4E00\u5929 09:00\u3001\u5F53\u5929 09:00 \u7CFB\u7EDF\u4F1A\u63D0\u9192 TA\uFF08\u8BBE\u4E86\u5F00\u59CB\u65E5\u7684\uFF0C\u5F00\u59CB\u5F53\u5929 09:00 \u4E5F\u63D0\u9192\u4E00\u6B21\uFF09\u3002\u6BCF\u6761\u8F93\u51FA\u7B2C\u4E00\u884C\u662F\u300C\u4ECA\u5929\uFF1AYYYY-MM-DD \u5468X\uFF08\u65F6\u533A\uFF09\u300D\u2014\u2014\u6362\u7B97\u300C\u8FD9\u5468\u4E94\u300D\u300C\u6708\u5E95\u300D\u4E00\u5F8B\u4EE5\u5B83\u4E3A\u51C6\u3002**\u6CA1\u6709 `oasis todo` \u547D\u4EE4\u6267\u884C\u6210\u529F\uFF0C\u5C31\u4E0D\u80FD\u8BF4\u8BB0\u4E0B\u4E86\u3002**",
+    subCommands: ["todo add", "todo list", "todo show", "todo edit", "todo done", "todo cancel", "todo reopen"],
+    examples: [
+      'oasis todo add --title "\u4EA4 Q3 \u590D\u76D8\u62A5\u544A" --note "\u738B\u603B\u8981\uFF0C\u5468\u4F1A\u524D\u8FC7\u4E00\u904D" --due 2026-10-09',
+      "oasis todo list",
+      "oasis todo show td_3f9a1c2b",
+      'oasis todo edit td_3f9a1c2b --due 2026-10-12 --reason "\u6392\u671F\u8C03\u6574"',
+      "oasis todo done td_3f9a1c2b"
+    ]
+  },
+  "todo add": {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo add --title <\u4E00\u53E5\u8BDD\uFF0C\u52A8\u8BCD\u5F00\u5934> [--note <\u8C01\u8981\u3001\u4E3A\u4EC0\u4E48\u3001\u539F\u8BDD\u8981\u70B9>] [--start YYYY-MM-DD [--start-time HH:mm]] --due YYYY-MM-DD [--time HH:mm]",
+    description: "\u8BB0\u4E00\u6761\u5F85\u529E\u3002--due / --start \u53EA\u6536\u4E0D\u5E26\u65F6\u533A\u7684\u65E5\u671F\uFF08\u7EC4\u7EC7\u65F6\u533A\u91CC\u7684\u90A3\u4E00\u5929\uFF09\uFF0C\u975E\u6CD5\u65E5\u671F\u5F53\u573A\u62A5\u9519\uFF1B\u6CA1\u8BF4\u51E0\u70B9\u5C31\u522B\u7ED9 --time\uFF1B\u7528\u6237\u6CA1\u8BF4\u4EC0\u4E48\u65F6\u5019\u5F00\u59CB\u5C31\u522B\u7ED9 --start\uFF08\u4E0D\u8FFD\u95EE\u3001\u4E0D\u731C\uFF09\uFF0C\u5F00\u59CB\u4E0D\u80FD\u665A\u4E8E\u622A\u6B62\u3002\u6765\u6E90\u5BF9\u8BDD\u81EA\u52A8\u53D6 $OASIS_CHAT_SESSION_ID\uFF08\u63D0\u9192\u70B9\u5F00\u4F1A\u8DF3\u56DE\u8FD9\u91CC\uFF09\u3002\u6210\u529F\u8F93\u51FA\u300C\u8BB0\u4E0B\u4E86\uFF1A<\u6807\u9898>\uFF0C\u622A\u6B62 X \u6708 X \u65E5\uFF08\u5468X\uFF09\u300D\u3002",
+    flags: [
+      { name: "title", desc: "\u6807\u9898\uFF1A\u4E00\u53E5\u8BDD\u3001\u52A8\u8BCD\u5F00\u5934", required: true, own: true },
+      { name: "note", desc: "\u5907\u6CE8\uFF1A\u8C01\u8981\u3001\u4E3A\u4EC0\u4E48\u8981\u3001\u539F\u8BDD\u91CC\u7684\u5173\u952E\u4FE1\u606F", own: true },
+      { name: "due", desc: "\u622A\u6B62\u65E5 YYYY-MM-DD\uFF08\u4E0D\u5E26\u65F6\u533A\uFF09", required: true, own: true },
+      { name: "time", desc: "\u622A\u6B62\u65F6\u523B HH:mm\uFF0824 \u5C0F\u65F6\u5236\uFF1B\u6CA1\u8BF4\u5C31\u4E0D\u7ED9\uFF09", own: true },
+      { name: "start", desc: "\u5F00\u59CB\u65E5 YYYY-MM-DD\uFF08\u7528\u6237\u8BF4\u4E86\u300C\u54EA\u5929\u5F00\u59CB\u5F04\u300D\u624D\u7ED9\uFF09", own: true },
+      { name: "start-time", desc: "\u5F00\u59CB\u65F6\u523B HH:mm\uFF08\u914D --start\uFF09", own: true }
+    ],
+    examples: ['oasis todo add --title "\u4EA4 Q3 \u590D\u76D8\u62A5\u544A" --due 2026-10-09 --time 18:00']
+  },
+  "todo list": {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo list [--all]",
+    description: "\u5217\u51FA\u5F85\u529E\uFF0C\u6309\u622A\u6B62\u65E5\u6392\u5E8F\uFF0C\u8FC7\u671F\u7684\u6807\u300C\u5DF2\u8FC7\u671F\u300D\uFF1B\u8BBE\u4E86\u5F00\u59CB\u65E5\u7684\u663E\u793A\u300CX \u6708 X \u65E5\u5F00\u59CB \u2192 X \u6708 X \u65E5\u622A\u6B62\u300D\u3002\u9ED8\u8BA4\u53EA\u5217\u672A\u5B8C\u6210\u7684\uFF1B--all \u8FDE\u5DF2\u5B8C\u6210\u3001\u5DF2\u53D6\u6D88\u7684\u4E00\u8D77\u5217\u3002",
+    flags: [{ name: "all", desc: "\u8FDE\u5DF2\u5B8C\u6210 / \u5DF2\u53D6\u6D88\u7684\u4E00\u8D77\u5217", boolean: true, own: true }]
+  },
+  "todo show": {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo show <id>",
+    description: "\u770B\u4E00\u6761\u5F85\u529E\u7684\u5168\u8C8C\uFF1A\u6807\u9898\u3001\u5F00\u59CB \u2192 \u622A\u6B62\u3001\u72B6\u6001\u3001\u5907\u6CE8\u5168\u6587\uFF0C\u4EE5\u53CA\u53D8\u66F4\u8BB0\u5F55\uFF08\u65F6\u95F4\u3001\u8C01\u6539\u7684 / \u7ECF\u624B agent\u3001\u5B57\u6BB5\u3001\u65E7\u503C \u2192 \u65B0\u503C\u3001\u539F\u56E0\uFF0C\u65B0\u7684\u5728\u524D\uFF09\u3002\u6539\u5907\u6CE8\u524D\u5148\u7528\u5B83\u8BFB\u51FA\u5F53\u524D\u5907\u6CE8\u5168\u6587\uFF1B\u7528\u6237\u95EE\u300C\u4E4B\u524D\u5199\u7684\u662F\u4EC0\u4E48\u300D\u4E5F\u67E5\u8FD9\u91CC\u3002",
+    positional: [{ name: "<id>", required: true, desc: "\u5F85\u529E id\uFF08oasis todo list \u7B2C\u4E00\u5217\uFF09" }],
+    examples: ["oasis todo show td_3f9a1c2b"]
+  },
+  "todo edit": {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo edit <id> [--title \u2026] [--note \u2026] [--start YYYY-MM-DD|none] [--start-time HH:mm|none] [--due YYYY-MM-DD] [--time HH:mm|none] [--workorder <\u5DE5\u5355 id>|none] [--reason \u2026]",
+    description: '\u6539\u4E00\u6761\u5F85\u529E\u7684\u5B57\u6BB5\uFF0C\u7ED9\u4E86\u54EA\u4E2A\u6539\u54EA\u4E2A\uFF1B\u6BCF\u6539\u4E00\u4E2A\u5B57\u6BB5\u90FD\u7559\u4E00\u6761\u8BB0\u5F55\uFF08\u65E7\u503C\u3001\u65B0\u503C\u3001\u539F\u56E0\uFF09\u3002\u6539\u671F\u8981\u5199\u539F\u56E0\uFF1A\u7528\u6237\u6CA1\u8BF4\u5C31\u95EE\u4E00\u53E5\uFF0C\u7528\u6237\u8BF4\u4E0D\u7528\u5C31\u4E0D\u5199\uFF0C\u522B\u7F16\u3002--start none\uFF08\u8FDE\u540C\u5F00\u59CB\u65F6\u523B\uFF09/ --start-time none / --time none / --workorder none \u6E05\u7A7A\uFF0C--note "" \u6E05\u7A7A\u5907\u6CE8\u3002',
+    positional: [{ name: "<id>", required: true, desc: "\u5F85\u529E id\uFF08oasis todo list \u7B2C\u4E00\u5217\uFF09" }],
+    flags: [
+      { name: "title", desc: "\u65B0\u6807\u9898", own: true },
+      { name: "note", desc: "\u65B0\u5907\u6CE8\uFF08\u7A7A\u4E32 = \u6E05\u7A7A\uFF09", own: true },
+      { name: "start", desc: "\u65B0\u5F00\u59CB\u65E5 YYYY-MM-DD\uFF1Bnone = \u6E05\u7A7A\uFF08\u8FDE\u540C\u5F00\u59CB\u65F6\u523B\uFF09", own: true },
+      { name: "start-time", desc: "\u65B0\u5F00\u59CB\u65F6\u523B HH:mm\uFF1Bnone = \u6E05\u7A7A", own: true },
+      { name: "due", desc: "\u65B0\u622A\u6B62\u65E5 YYYY-MM-DD", own: true },
+      { name: "time", desc: "\u65B0\u622A\u6B62\u65F6\u523B HH:mm\uFF1Bnone = \u6E05\u7A7A", own: true },
+      { name: "workorder", desc: "\u5173\u8054\u7684\u5DE5\u5355 id\uFF08\u300C\u8FD9\u4EF6\u4F60\u5E2E\u6211\u505A\u4E86\u5427\u300D\u5EFA\u5355\u540E\u6302\u4E0A\uFF09\uFF1Bnone = \u6E05\u7A7A", own: true },
+      { name: "reason", desc: "\u4E3A\u4EC0\u4E48\u6539\uFF08\u6539\u671F\u65F6\u8981\u5199\uFF1B\u7528\u6237\u8BF4\u4E0D\u7528\u5C31\u4E0D\u5199\uFF09", own: true }
+    ],
+    examples: ['oasis todo edit td_3f9a1c2b --due 2026-10-12 --reason "\u5BA2\u6237\u5EF6\u671F\u4E00\u5468"']
+  },
+  "todo done": {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo done <id>",
+    description: "\u6807\u8BB0\u5B8C\u6210\u3002\u5339\u914D\u5230\u591A\u6761\u65F6\u5148\u95EE\u7528\u6237\u662F\u54EA\u6761\uFF0C\u522B\u731C\u3002",
+    positional: [{ name: "<id>", required: true, desc: "\u5F85\u529E id" }]
+  },
+  "todo cancel": {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo cancel <id> [--reason \u2026]",
+    description: "\u53D6\u6D88\uFF08\u4E0D\u7528\u505A\u4E86\uFF09\u3002\u53EA\u6539\u72B6\u6001\u3001\u4E0D\u5220\u9664\uFF0C--all \u5217\u8868\u91CC\u8FD8\u770B\u5F97\u5230\u3002",
+    positional: [{ name: "<id>", required: true, desc: "\u5F85\u529E id" }],
+    flags: [{ name: "reason", desc: "\u4E3A\u4EC0\u4E48\u4E0D\u7528\u505A\u4E86", own: true }]
+  },
+  "todo reopen": {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo reopen <id>",
+    description: "\u628A\u5DF2\u5B8C\u6210 / \u5DF2\u53D6\u6D88\u7684\u5F85\u529E\u91CD\u65B0\u6253\u5F00\u3002",
+    positional: [{ name: "<id>", required: true, desc: "\u5F85\u529E id" }]
+  },
   // —— 技能：组织技能库的 CLI 面（Web 上是「管理 > 技能」那一页）。
   //    agent 把自己写好的一个技能目录沉淀进公司，并决定它对谁生效。 ——
   skill: {
@@ -297300,21 +298582,21 @@ function formatCommandHelp(decl) {
   const posNames = (decl.positional ?? []).map((p2) => p2.name);
   const flagNames = (decl.flags ?? []).map((f2) => `--${f2.name}`);
   const allNames = [...posNames, ...flagNames];
-  const pad2 = allNames.length > 0 ? Math.max(...allNames.map((n) => n.length)) + 2 : 0;
+  const pad3 = allNames.length > 0 ? Math.max(...allNames.map((n) => n.length)) + 2 : 0;
   const reqPos = (decl.positional ?? []).filter((p2) => p2.required);
   const reqFlags = (decl.flags ?? []).filter((f2) => f2.required);
   if (reqPos.length > 0 || reqFlags.length > 0) {
     lines.push("\u5FC5\u586B\uFF1A");
-    for (const p2 of reqPos) lines.push(`  ${p2.name.padEnd(pad2)} ${p2.desc}`);
-    for (const f2 of reqFlags) lines.push(`  --${f2.name.padEnd(pad2 - 2)} ${f2.desc}`);
+    for (const p2 of reqPos) lines.push(`  ${p2.name.padEnd(pad3)} ${p2.desc}`);
+    for (const f2 of reqFlags) lines.push(`  --${f2.name.padEnd(pad3 - 2)} ${f2.desc}`);
     lines.push("");
   }
   const optPos = (decl.positional ?? []).filter((p2) => !p2.required);
   const optFlags = (decl.flags ?? []).filter((f2) => !f2.required);
   if (optPos.length > 0 || optFlags.length > 0) {
     lines.push("\u53EF\u9009\uFF1A");
-    for (const p2 of optPos) lines.push(`  ${p2.name.padEnd(pad2)} ${p2.desc}`);
-    for (const f2 of optFlags) lines.push(`  --${f2.name.padEnd(pad2 - 2)} ${f2.desc}`);
+    for (const p2 of optPos) lines.push(`  ${p2.name.padEnd(pad3)} ${p2.desc}`);
+    for (const f2 of optFlags) lines.push(`  --${f2.name.padEnd(pad3 - 2)} ${f2.desc}`);
     lines.push("");
   }
   lines.push(`\u8BF4\u660E\uFF1A${decl.description}`);
@@ -297341,6 +298623,7 @@ var GROUP_ORDER = [
   "\u957F\u671F\u8BB0\u5FC6\uFF08ADR-0084/0102\uFF09",
   "\u77E5\u8BC6\u5E93",
   "\u59D4\u6D3E\u4E13\u5BB6",
+  "\u4E2A\u4EBA\u5F85\u529E",
   "\u751F\u547D\u5468\u671F",
   "\u89D2\u8272 & \u4EBA\u5458",
   "\u8BFB\u4EA7\u7269",
@@ -297405,13 +298688,13 @@ function ownFlagsFromDecl(command2) {
 }
 
 // ../cli/src/connector-effect-runner.ts
-var import_node_crypto95 = require("node:crypto");
+var import_node_crypto97 = require("node:crypto");
 var import_node_child_process21 = require("node:child_process");
 init_src8();
 function stableKey(effect) {
   const keyFields = Object.fromEntries(Object.entries(effect.keyFields).sort(([a], [b2]) => a.localeCompare(b2)));
   const canonical2 = JSON.stringify({ kind: effect.kind, target: effect.target, keyFields });
-  return `sha256:${(0, import_node_crypto95.createHash)("sha256").update(canonical2).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto97.createHash)("sha256").update(canonical2).digest("hex")}`;
 }
 async function runConnectorEffect(connector, toolArgs, deps) {
   const effect = connector.describeExternalEffect?.(toolArgs) ?? null;
@@ -297630,8 +298913,8 @@ function formatSize(size) {
   if (size < 1024 * 1024) return `${(size / 1024).toFixed(1)}KB`;
   return `${(size / 1024 / 1024).toFixed(1)}MB`;
 }
-function formatTime(iso8) {
-  return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(iso8) ? `${iso8.slice(5, 10)} ${iso8.slice(11, 16)}` : iso8;
+function formatTime(iso9) {
+  return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(iso9) ? `${iso9.slice(5, 10)} ${iso9.slice(11, 16)}` : iso9;
 }
 function displayName2(name) {
   const cut = name.lastIndexOf("/");
@@ -297980,7 +299263,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
   const timeoutMs = resolveAuthWaitMs();
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const waiterId = (0, import_node_crypto96.randomUUID)();
+  const waiterId = (0, import_node_crypto98.randomUUID)();
   process.stderr.write(
     `\u7B49\u5F85\u4EBA\u5DE5\u6388\u6743\u4E2D\u2026\u2026\u6700\u591A ${Math.round(timeoutMs / 1e3)} \u79D2\uFF0C\u8D85\u65F6\u4F1A\u81EA\u52A8\u8F6C\u4E3A\u5F85\u5BA1\uFF1B\u8FD9\u4E0D\u662F\u9519\u8BEF\uFF0C\u8BF7\u52FF\u91CD\u8BD5\u540C\u4E00\u6761\u547D\u4EE4\u3002
 `
@@ -298064,7 +299347,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.105" ? "2.2.105" : "dev";
+var CLI_VERSION = "2.2.107" ? "2.2.107" : "dev";
 function apiHeaders(token2, company) {
   const headers = {
     authorization: `Bearer ${token2}`,
@@ -298154,7 +299437,7 @@ function fieldsFromFlags(flags, ownFlags) {
   }
   return Object.keys(fields).length > 0 ? fields : void 0;
 }
-function buildStageOp(cmd, flags, positional, readFile12 = (file) => fs44.readFileSync(file, "utf8")) {
+function buildStageOp(cmd, flags, positional, readFile13 = (file) => fs44.readFileSync(file, "utf8")) {
   switch (cmd) {
     case "link":
       return {
@@ -298176,7 +299459,7 @@ function buildStageOp(cmd, flags, positional, readFile12 = (file) => fs44.readFi
         ...flags.get("title") !== void 0 ? { title: flags.get("title") } : {},
         ...(flags.get("brief") ?? flags.get("description")) !== void 0 ? { description: flags.get("brief") ?? flags.get("description") } : {},
         ...flags.get("input") !== void 0 ? { inputs: flags.get("input").split(",").map((to) => ({ to: to.trim() })) } : {},
-        ...partsFile !== void 0 ? { parts: JSON.parse(readFile12(partsFile)) } : {},
+        ...partsFile !== void 0 ? { parts: JSON.parse(readFile13(partsFile)) } : {},
         ...fields !== void 0 ? { fields } : {}
       };
     }
@@ -298430,7 +299713,7 @@ async function runCli(argv, println = console.log, progressln = console.error) {
     const store = createNodeTokenStore(path39.join(dir, "node-tokens.json"));
     const sub = positional[0];
     if (sub === "issue") {
-      const id = flags.get("id") ?? `node-${(0, import_node_crypto96.randomUUID)()}`;
+      const id = flags.get("id") ?? `node-${(0, import_node_crypto98.randomUUID)()}`;
       const token3 = store.issue(id);
       println(token3);
       process.stderr.write(
@@ -299582,7 +300865,7 @@ ${t.ref}  ${t.name}  [\u5267\u672C=${t.playbookRef}]`);
         if (!name) throw new Error("\u9879\u76EE\u540D\u79F0\u4E0D\u80FD\u4E3A\u7A7A");
         const goal = flags.get("goal")?.trim();
         const slug5 = flags.get("slug");
-        const id = slug5 !== void 0 ? projectSlug(slug5) : projectIdFromUuid((0, import_node_crypto96.randomUUID)());
+        const id = slug5 !== void 0 ? projectSlug(slug5) : projectIdFromUuid((0, import_node_crypto98.randomUUID)());
         const result = await api.request("POST", "/api/projects", {
           ...id ? { id } : {},
           name,
@@ -300434,6 +301717,141 @@ ${res.warning}`);
   oasis var rm <key> --scope \u2026 | oasis var rm --id <\u8BB0\u5F55 id> [--yes]
 \u540E\u4E09\u4E2A\u662F\u7BA1\u7406\u9762\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002`);
     }
+    case "todo": {
+      const sub = positional[0];
+      const due = (t) => formatTodoSpan(t);
+      const call = async (method, url, body2) => {
+        try {
+          return await api.request(method, url, body2);
+        } catch (e) {
+          if (e instanceof ApiRequestError && e.status === 404 && e.body?.error?.code === "NOT_FOUND") {
+            throw new Error("\u4E2A\u4EBA\u5F85\u529E\u6CA1\u6709\u5F00\u542F\uFF08\u670D\u52A1\u7AEF OASIS_PERSONAL_TODO=off\uFF09\uFF0C\u8FD9\u6761\u6CA1\u6709\u8BB0\u4E0B\u3002");
+          }
+          throw e;
+        }
+      };
+      const checkDay = (v2, flag) => {
+        if (!isValidDay(v2)) throw new Error(`--${flag} \u53EA\u6536\u4E0D\u5E26\u65F6\u533A\u7684\u65E5\u671F YYYY-MM-DD\uFF08\u4F8B\uFF1A2026-10-09\uFF09\uFF0C\u6536\u5230\uFF1A${v2}`);
+        return v2;
+      };
+      const checkTime = (v2, flag = "time") => {
+        if (!isValidTodoTime(v2)) throw new Error(`--${flag} \u53EA\u6536 24 \u5C0F\u65F6\u5236 HH:mm\uFF08\u4F8B\uFF1A18:00\uFF09\uFF0C\u6536\u5230\uFF1A${v2}`);
+        return v2;
+      };
+      const idOf = () => needPos(positional, 1, `oasis todo ${sub} <id>`);
+      const todoPath = (id, tail = "") => `/api/todos/${encodeURIComponent(id)}${tail}`;
+      if (sub === "add") {
+        const title = need(flags, "title");
+        const dueDate = checkDay(need(flags, "due"), "due");
+        const time3 = flags.get("time");
+        const note = flags.get("note");
+        const start = flags.get("start");
+        const startTime = flags.get("start-time");
+        if (startTime !== void 0 && start === void 0) throw new Error("--start-time \u8981\u914D --start\uFF08\u5148\u8BF4\u54EA\u5929\u5F00\u59CB\uFF09");
+        if (start !== void 0 && start > dueDate && isValidDay(start)) throw new Error(`--start ${start} \u665A\u4E8E --due ${dueDate}\uFF1A\u5F00\u59CB\u4E0D\u80FD\u665A\u4E8E\u622A\u6B62`);
+        const sourceChatSessionId = process.env["OASIS_CHAT_SESSION_ID"];
+        const r = await call("POST", "/api/todos", {
+          title,
+          dueDate,
+          ...time3 !== void 0 ? { dueTime: checkTime(time3) } : {},
+          ...start !== void 0 ? { startDate: checkDay(start, "start") } : {},
+          ...startTime !== void 0 ? { startTime: checkTime(startTime, "start-time") } : {},
+          ...note ? { note } : {},
+          ...sourceChatSessionId ? { sourceChatSessionId } : {}
+        });
+        println(r.todayLine);
+        println(`\u8BB0\u4E0B\u4E86\uFF1A${r.todo.title}\uFF0C${due(r.todo)}`);
+        println(`id\uFF1A${r.todo.id}`);
+        break;
+      }
+      if (sub === "list") {
+        const all2 = flags.get("all") === "true";
+        const r = await call("GET", `/api/todos${all2 ? "?all=1" : ""}`);
+        println(r.todayLine);
+        if (r.items.length === 0) {
+          println(all2 ? "\u6CA1\u6709\u5F85\u529E\u3002" : "\u6CA1\u6709\u672A\u5B8C\u6210\u7684\u5F85\u529E\u3002");
+          break;
+        }
+        for (const t of r.items) {
+          const tag = t.status === "done" ? "  [\u5DF2\u5B8C\u6210]" : t.status === "cancelled" ? "  [\u5DF2\u53D6\u6D88]" : t.dueDate < r.today.date ? "  [\u5DF2\u8FC7\u671F]" : "";
+          const when = t.startDate ? formatTodoSpan(t) : formatTodoDue(t.dueDate, t.dueTime);
+          println(`${t.id}  ${when}  ${t.title}${tag}`);
+        }
+        break;
+      }
+      if (sub === "show") {
+        const id = idOf();
+        const [one2, day] = await Promise.all([
+          call("GET", todoPath(id)),
+          call("GET", "/api/todos")
+        ]);
+        const t = one2.todo;
+        const statusText = t.status === "done" ? "\u5DF2\u5B8C\u6210" : t.status === "cancelled" ? "\u5DF2\u53D6\u6D88" : t.dueDate < day.today.date ? "\u672A\u5B8C\u6210\uFF08\u5DF2\u8FC7\u671F\uFF09" : "\u672A\u5B8C\u6210";
+        println(day.todayLine);
+        println(`${t.id}  ${t.title}`);
+        println(`\u65F6\u95F4\uFF1A${due(t)}`);
+        println(`\u72B6\u6001\uFF1A${statusText}`);
+        if (t.linkedWorkorderId) println(`\u5DE5\u5355\uFF1A${t.linkedWorkorderId}`);
+        println("\u5907\u6CE8\uFF1A");
+        println(t.note ? t.note : "\uFF08\u65E0\uFF09");
+        const FIELD = {
+          created: "\u8BB0\u4E0B",
+          status: "\u72B6\u6001",
+          title: "\u6807\u9898",
+          note: "\u5907\u6CE8",
+          startDate: "\u5F00\u59CB\u65E5",
+          startTime: "\u5F00\u59CB\u65F6\u523B",
+          dueDate: "\u622A\u6B62\u65E5",
+          dueTime: "\u622A\u6B62\u65F6\u523B",
+          linkedWorkorderId: "\u5DE5\u5355"
+        };
+        const STATUS = { open: "\u672A\u5B8C\u6210", done: "\u5DF2\u5B8C\u6210", cancelled: "\u5DF2\u53D6\u6D88" };
+        const val = (field, v2) => v2 === void 0 || v2 === "" ? "\uFF08\u7A7A\uFF09" : field === "status" ? STATUS[v2] ?? v2 : v2;
+        const fmtAt = (iso9) => new Intl.DateTimeFormat("sv-SE", {
+          timeZone: day.today.timeZone,
+          year: "numeric",
+          month: "2-digit",
+          day: "2-digit",
+          hour: "2-digit",
+          minute: "2-digit",
+          hour12: false
+        }).format(new Date(iso9));
+        const changes = [...one2.changes].sort((a, b2) => b2.at.localeCompare(a.at));
+        println(`\u53D8\u66F4\u8BB0\u5F55\uFF08${changes.length} \u6761\uFF0C\u65B0\u7684\u5728\u524D\uFF09\uFF1A`);
+        for (const c of changes) {
+          const who = c.handActorId ? `${c.actorId}\uFF08\u7ECF\u624B ${c.handActorId}\uFF09` : c.actorId;
+          const what = c.field === "created" ? `\u8BB0\u4E0B\uFF1A${c.newValue ?? ""}` : `${FIELD[c.field] ?? c.field}\uFF1A${val(c.field, c.oldValue)} \u2192 ${val(c.field, c.newValue)}`;
+          println(`- ${fmtAt(c.at)}  ${who}  ${what}${c.reason ? `  \u539F\u56E0\uFF1A${c.reason}` : ""}`);
+        }
+        break;
+      }
+      if (sub === "edit") {
+        const id = idOf();
+        const body2 = {};
+        if (flags.has("title")) body2["title"] = flags.get("title");
+        if (flags.has("note")) body2["note"] = flags.get("note") === "" ? null : flags.get("note");
+        if (flags.has("due")) body2["dueDate"] = checkDay(flags.get("due"), "due");
+        if (flags.has("time")) body2["dueTime"] = flags.get("time") === "none" ? null : checkTime(flags.get("time"));
+        if (flags.has("start")) body2["startDate"] = flags.get("start") === "none" ? null : checkDay(flags.get("start"), "start");
+        if (flags.has("start-time")) body2["startTime"] = flags.get("start-time") === "none" ? null : checkTime(flags.get("start-time"), "start-time");
+        if (flags.has("workorder")) body2["linkedWorkorderId"] = flags.get("workorder") === "none" ? null : flags.get("workorder");
+        if (Object.keys(body2).length === 0) throw new Error("\u6CA1\u6709\u8981\u6539\u7684\u5B57\u6BB5\uFF1A\u7ED9 --title / --note / --start / --start-time / --due / --time / --workorder \u91CC\u7684\u81F3\u5C11\u4E00\u4E2A");
+        if (flags.get("reason")) body2["reason"] = flags.get("reason");
+        const r = await call("PATCH", todoPath(id), body2);
+        println(r.todayLine);
+        println(`\u5DF2\u6539\uFF1A${r.todo.title}\uFF0C${due(r.todo)}`);
+        break;
+      }
+      if (sub === "done" || sub === "cancel" || sub === "reopen") {
+        const id = idOf();
+        const reason = sub === "cancel" ? flags.get("reason") : void 0;
+        const r = await call("POST", todoPath(id, `/${sub}`), reason ? { reason } : {});
+        println(r.todayLine);
+        println(`${sub === "done" ? "\u5DF2\u5B8C\u6210" : sub === "cancel" ? "\u5DF2\u53D6\u6D88" : "\u5DF2\u91CD\u65B0\u6253\u5F00"}\uFF1A${r.todo.title}\uFF0C${due(r.todo)}`);
+        break;
+      }
+      throw new Error("\u7528\u6CD5: oasis todo <add|list|show|edit|done|cancel|reopen> \u2026\uFF08oasis todo --help \u770B\u8BE6\u60C5\uFF09");
+    }
     case "skill": {
       const sub = positional[0];
       const asJson2 = flags.get("json") === "true";
@@ -301577,8 +302995,8 @@ var LOG_RETAIN_DAYS = 30;
 var LOG_RETAIN_MAX_FILES = 10;
 var ROTATED_SUFFIX = /^\d{8}-\d{6}(-\d+)?$/;
 function stampOf(now) {
-  const iso8 = now.toISOString();
-  return `${iso8.slice(0, 10).replace(/-/g, "")}-${iso8.slice(11, 19).replace(/:/g, "")}`;
+  const iso9 = now.toISOString();
+  return `${iso9.slice(0, 10).replace(/-/g, "")}-${iso9.slice(11, 19).replace(/:/g, "")}`;
 }
 function rotateLogIfNeeded(file, opts = {}) {
   const maxBytes = opts.maxBytes ?? LOG_ROTATE_MAX_BYTES;
@@ -301971,13 +303389,13 @@ async function exchangeEnrollToken(o) {
 }
 
 // src/install.ts
-var import_node_crypto97 = require("node:crypto");
+var import_node_crypto99 = require("node:crypto");
 var fs50 = __toESM(require("node:fs"));
 var path45 = __toESM(require("node:path"));
 function versionLabel(sourceFile, pkgVersion, npmPrefixDir, pkgName = LEGACY_PKG_NAME) {
   const tag = pkgName === LEGACY_PKG_NAME ? "" : `+pkg.${pkgName.replace(/[^A-Za-z0-9-]/g, "-")}`;
   if (isFromNpmPrefix(sourceFile, npmPrefixDir)) return `${pkgVersion}${tag}`;
-  const digest = (0, import_node_crypto97.createHash)("sha256").update(fs50.readFileSync(sourceFile)).digest("hex").slice(0, 8);
+  const digest = (0, import_node_crypto99.createHash)("sha256").update(fs50.readFileSync(sourceFile)).digest("hex").slice(0, 8);
   return tag ? `${pkgVersion}${tag}.local.${digest}` : `${pkgVersion}+local.${digest}`;
 }
 function isFromNpmPrefix(sourceFile, npmPrefixDir) {
@@ -302100,7 +303518,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.105" : "dev";
+var PKG_VERSION = true ? "2.2.107" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;
@@ -302408,7 +303826,7 @@ function newInstanceName() {
   const existing = new Set(listInstances());
   if (!existing.has(DEFAULT_INSTANCE)) return DEFAULT_INSTANCE;
   for (; ; ) {
-    const n = `inst-${(0, import_node_crypto98.randomBytes)(3).toString("hex")}`;
+    const n = `inst-${(0, import_node_crypto100.randomBytes)(3).toString("hex")}`;
     if (!existing.has(n)) return n;
   }
 }