syntaur 0.26.0 → 0.27.0

package/dist/dashboard/server.js

@@ -169,8 +169,8 @@ function extractFrontmatter(fileContent) {
   const body = fileContent.slice(match[0].length);
   return [frontmatterBlock, body];
 }
-function parseSimpleValue(raw) {
-  const trimmed = raw.trim();
+function parseSimpleValue(raw2) {
+  const trimmed = raw2.trim();
   if (trimmed === "null" || trimmed === "~" || trimmed === "") return null;
   if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
     return trimmed.slice(1, -1);
@@ -468,8 +468,8 @@ function extractFrontmatter2(fileContent) {
   const body = fileContent.slice(match[0].length).trim();
   return [frontmatterBlock, body];
 }
-function parseSimpleValue2(raw) {
-  const trimmed = raw.trim();
+function parseSimpleValue2(raw2) {
+  const trimmed = raw2.trim();
   if (trimmed === "null" || trimmed === "~" || trimmed === "") return null;
   if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
     return trimmed.slice(1, -1);
@@ -1500,8 +1500,8 @@ ${key}: ${formatted}${content.slice(closingIdx)}`;
 function readFrontmatterField(content, key) {
   const match = content.match(new RegExp(`^${key}:\\s*(.*)$`, "m"));
   if (!match) return null;
-  const raw = match[1].trim().replace(/^['"]|['"]$/g, "");
-  return raw === "" || raw === "null" ? null : raw;
+  const raw2 = match[1].trim().replace(/^['"]|['"]$/g, "");
+  return raw2 === "" || raw2 === "null" ? null : raw2;
 }
 async function migrateLegacyArchivedProjects(projectsDir) {
   const result = { reconciled: [] };
@@ -1771,9 +1771,9 @@ function normalizeHiddenList(input) {
   if (!Array.isArray(input)) return [];
   const seen = /* @__PURE__ */ new Set();
   const out = [];
-  for (const raw of input) {
-    if (typeof raw !== "string") continue;
-    const name = raw.trim();
+  for (const raw2 of input) {
+    if (typeof raw2 !== "string") continue;
+    const name = raw2.trim();
     if (name.length === 0) continue;
     if (name.length > MAX_WORKSPACE_NAME_LENGTH) continue;
     if (/[\r\n]/.test(name)) continue;
@@ -2152,13 +2152,13 @@ function parsePlaybooksConfig(fmBlock) {
       continue;
     }
     if (currentSection === "disabled" && indent >= 4 && trimmed.startsWith("- ")) {
-      const raw = trimmed.slice(2).trim().replace(/^["']|["']$/g, "");
-      if (raw.length === 0) continue;
-      if (/\s/.test(raw)) {
-        console.warn(`Warning: config.md playbooks.disabled entry "${raw}" contains whitespace, ignoring`);
+      const raw2 = trimmed.slice(2).trim().replace(/^["']|["']$/g, "");
+      if (raw2.length === 0) continue;
+      if (/\s/.test(raw2)) {
+        console.warn(`Warning: config.md playbooks.disabled entry "${raw2}" contains whitespace, ignoring`);
         continue;
       }
-      disabled.push(raw);
+      disabled.push(raw2);
       continue;
     }
   }
@@ -2438,9 +2438,9 @@ function serializeHotkeyBindingsConfig(cfg) {
 async function writeHotkeyBindingsConfig(cfg) {
   const cleaned = {};
   for (const kind of BINDABLE_ACTION_KINDS) {
-    const raw = cfg.bindings[kind];
-    if (typeof raw !== "string" || raw.trim() === "") continue;
-    const canonical = canonicalizeCombo(raw);
+    const raw2 = cfg.bindings[kind];
+    if (typeof raw2 !== "string" || raw2.trim() === "") continue;
+    const canonical = canonicalizeCombo(raw2);
     if (!canonical) continue;
     if (isReservedCombo(canonical)) continue;
     cleaned[kind] = canonical;
@@ -3237,8 +3237,8 @@ async function resolvePlaybookSlug(playbooksDir2, slug) {
   for (const entry of entries) {
     if (!isVisiblePlaybookFile(entry.name, entry.isFile())) continue;
     const filePath = resolve7(playbooksDir2, entry.name);
-    const raw = await readFile6(filePath, "utf-8");
-    const parsed = parsePlaybook(raw);
+    const raw2 = await readFile6(filePath, "utf-8");
+    const parsed = parsePlaybook(raw2);
     const canonical = parsed.slug || entry.name.replace(/\.md$/, "");
     if (canonical === slug) {
       return { filename: entry.name, slug: canonical, parsed };
@@ -3285,8 +3285,8 @@ async function rebuildPlaybookManifest(playbooksDir2) {
   const rows = [];
   for (const entry of entries) {
     if (!isVisiblePlaybookFile(entry.name, entry.isFile())) continue;
-    const raw = await readFile6(resolve7(playbooksDir2, entry.name), "utf-8");
-    const parsed = parsePlaybook(raw);
+    const raw2 = await readFile6(resolve7(playbooksDir2, entry.name), "utf-8");
+    const parsed = parsePlaybook(raw2);
     const slug = parsed.slug || entry.name.replace(/\.md$/, "");
     if (disabledSet.has(slug)) continue;
     rows.push({
@@ -3363,8 +3363,8 @@ async function renamePlaybook(playbooksDir2, oldSlug, newSlug) {
       );
     }
   }
-  const raw = await readFile6(oldPath, "utf-8");
-  let next = setFrontmatterField2(raw, "slug", newSlug);
+  const raw2 = await readFile6(oldPath, "utf-8");
+  let next = setFrontmatterField2(raw2, "slug", newSlug);
   next = setFrontmatterField2(next, "updated", `"${nowTimestamp()}"`);
   await writeFileForce(newPath, next);
   if (!renamedInPlace) {
@@ -4090,9 +4090,9 @@ async function migrateFromMarkdown(projectsDir) {
 }
 async function parseMarkdownSessionsIndex(filePath, projectSlug) {
   const { readFile: readFile21 } = await import("fs/promises");
-  const raw = await readFile21(filePath, "utf-8");
+  const raw2 = await readFile21(filePath, "utf-8");
   const sessions = [];
-  const lines = raw.split("\n");
+  const lines = raw2.split("\n");
   let inTable = false;
   let headerSeen = false;
   for (const line of lines) {
@@ -4248,8 +4248,8 @@ async function deleteSessions(sessionIds) {
 }
 async function readAssignmentStatusFromPath(assignmentMdPath) {
   if (!await fileExists(assignmentMdPath)) return null;
-  const raw = await readFile8(assignmentMdPath, "utf-8");
-  const match = raw.match(/^status:\s*(.+)$/m);
+  const raw2 = await readFile8(assignmentMdPath, "utf-8");
+  const match = raw2.match(/^status:\s*(.+)$/m);
   return match ? match[1].trim() : null;
 }
 async function readAssignmentStatus(projectDir, assignmentSlug) {
@@ -4393,8 +4393,8 @@ async function listSessionFiles(dir) {
 async function readSessionFile(dir, name) {
   const filePath = resolve11(dir, `${sanitizeSessionName(name)}.md`);
   if (!await fileExists(filePath)) return null;
-  const raw = await readFile9(filePath, "utf-8");
-  const [frontmatter] = extractFrontmatter2(raw);
+  const raw2 = await readFile9(filePath, "utf-8");
+  const [frontmatter] = extractFrontmatter2(raw2);
   if (!frontmatter) return null;
   const session = getField(frontmatter, "session") ?? name;
   const registered = getField(frontmatter, "registered") ?? "";
@@ -4522,8 +4522,8 @@ function scanKey(serversDir2, projectsDir, assignmentsDir2) {
   return `${serversDir2}\0${projectsDir}\0${assignmentsDir2 ?? ""}`;
 }
 function delay(ms) {
-  return new Promise((resolve29) => {
-    const timer2 = setTimeout(resolve29, ms);
+  return new Promise((resolve30) => {
+    const timer2 = setTimeout(resolve30, ms);
     if (typeof timer2.unref === "function") {
       timer2.unref();
     }
@@ -5130,8 +5130,8 @@ async function listProjects(projectsDir) {
 async function readWorkspaceRegistry(projectsDir) {
   const registryPath = resolve13(dirname2(projectsDir), "workspaces.json");
   try {
-    const raw = await readFile10(registryPath, "utf-8");
-    const parsed = JSON.parse(raw);
+    const raw2 = await readFile10(registryPath, "utf-8");
+    const parsed = JSON.parse(raw2);
     return Array.isArray(parsed) ? parsed.filter((w) => typeof w === "string") : [];
   } catch {
     return [];
@@ -5219,8 +5219,8 @@ async function deleteWorkspace(projectsDir, name, opts = {}) {
     const timestamp = nowTimestamp();
     for (const slug of projectsReferencing) {
       const path = resolve13(projectsDir, slug, "project.md");
-      const raw = await readFile10(path, "utf-8");
-      let next = clearFrontmatterField(raw, "workspace");
+      const raw2 = await readFile10(path, "utf-8");
+      let next = clearFrontmatterField(raw2, "workspace");
       next = setUpdatedField(next, timestamp);
       await writeFileForce(path, next);
       rewroteFiles = true;
@@ -5228,8 +5228,8 @@ async function deleteWorkspace(projectsDir, name, opts = {}) {
     for (const id of standalonesReferencing) {
       if (!opts.assignmentsDir) break;
       const path = resolve13(opts.assignmentsDir, id, "assignment.md");
-      const raw = await readFile10(path, "utf-8");
-      let next = clearFrontmatterField(raw, "workspaceGroup");
+      const raw2 = await readFile10(path, "utf-8");
+      let next = clearFrontmatterField(raw2, "workspaceGroup");
       next = setUpdatedField(next, timestamp);
       await writeFileForce(path, next);
       rewroteFiles = true;
@@ -6679,8 +6679,8 @@ async function listPlaybooks(playbooksDir2) {
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".md") || entry.name.startsWith("_") || entry.name === "manifest.md") continue;
     const filePath = resolve13(playbooksDir2, entry.name);
-    const raw = await readFile10(filePath, "utf-8");
-    const parsed = parsePlaybook(raw);
+    const raw2 = await readFile10(filePath, "utf-8");
+    const parsed = parsePlaybook(raw2);
     const slug = parsed.slug || entry.name.replace(/\.md$/, "");
     playbooks.push({
       slug,
@@ -6904,8 +6904,8 @@ init_assignment_resolver();
 init_agent_sessions();
 import express from "express";
 import { createServer } from "http";
-import { resolve as resolve28 } from "path";
-import { writeFile as writeFile6, unlink as unlink6 } from "fs/promises";
+import { resolve as resolve29 } from "path";
+import { writeFile as writeFile7, unlink as unlink7 } from "fs/promises";
 import { WebSocketServer, WebSocket } from "ws";
 
 // src/dashboard/session-liveness.ts
@@ -7379,15 +7379,15 @@ async function readViewPrefsFile() {
   if (!await fileExists(path)) {
     return { ...DEFAULT_VIEW_PREFS_FILE };
   }
-  let raw;
+  let raw2;
   try {
-    raw = await readFile11(path, "utf-8");
+    raw2 = await readFile11(path, "utf-8");
   } catch {
     return { ...DEFAULT_VIEW_PREFS_FILE };
   }
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = JSON.parse(raw2);
   } catch {
     await backupCorrupt(path);
     return { ...DEFAULT_VIEW_PREFS_FILE };
@@ -7592,15 +7592,15 @@ async function readSavedViewsFile() {
   if (!await fileExists(path)) {
     return cloneDefault();
   }
-  let raw;
+  let raw2;
   try {
-    raw = await readFile12(path, "utf-8");
+    raw2 = await readFile12(path, "utf-8");
   } catch {
     return cloneDefault();
   }
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = JSON.parse(raw2);
   } catch {
     await backupCorrupt2(path);
     return cloneDefault();
@@ -8145,8 +8145,8 @@ async function getProjectRepositoryCandidates(projectsDir, projectSlug) {
   const projectPath = resolve17(projectsDir, projectSlug, "project.md");
   if (await fileExists(projectPath)) {
     const project = parseProject(await readFile14(projectPath, "utf-8"));
-    for (const raw of project.repositories) {
-      const path = raw.trim();
+    for (const raw2 of project.repositories) {
+      const path = raw2.trim();
       if (!path) continue;
       const abs = resolve17(path);
       if (seen.has(abs)) continue;
@@ -11459,8 +11459,8 @@ function mapAgentErrorToFieldErrors(err) {
   }
   return { error: message };
 }
-function coerceAgentRow(raw, index) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+function coerceAgentRow(raw2, index) {
+  if (!raw2 || typeof raw2 !== "object" || Array.isArray(raw2)) {
     return {
       ok: false,
       status: 400,
@@ -11470,7 +11470,7 @@ function coerceAgentRow(raw, index) {
       }
     };
   }
-  const entry = raw;
+  const entry = raw2;
   if (typeof entry.id !== "string" || entry.id.length === 0) {
     return {
       ok: false,
@@ -11579,14 +11579,14 @@ function createAgentsRouter() {
   });
   router.put("/", async (req, res) => {
     try {
-      const raw = req.body && typeof req.body === "object" ? req.body : {};
-      if (!Array.isArray(raw.agents)) {
+      const raw2 = req.body && typeof req.body === "object" ? req.body : {};
+      if (!Array.isArray(raw2.agents)) {
         res.status(400).json({ error: "agents must be an array" });
         return;
       }
       const cleaned = [];
-      for (let i = 0; i < raw.agents.length; i++) {
-        const result = coerceAgentRow(raw.agents[i], i);
+      for (let i = 0; i < raw2.agents.length; i++) {
+        const result = coerceAgentRow(raw2.agents[i], i);
         if (!result.ok) {
           res.status(result.status).json(result.body);
           return;
@@ -12186,18 +12186,18 @@ function buildAffectedResponse(id, list) {
 function isString(x) {
   return typeof x === "string" && x.length > 0;
 }
-function parseResolutions(raw) {
-  if (raw === void 0) {
+function parseResolutions(raw2) {
+  if (raw2 === void 0) {
     return { resolutions: [], malformed: null, duplicateIds: null };
   }
-  if (!Array.isArray(raw)) {
+  if (!Array.isArray(raw2)) {
     return { resolutions: [], malformed: "resolutions must be an array", duplicateIds: null };
   }
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   const dups = /* @__PURE__ */ new Set();
-  for (let i = 0; i < raw.length; i++) {
-    const r = raw[i];
+  for (let i = 0; i < raw2.length; i++) {
+    const r = raw2[i];
     if (!r || typeof r !== "object") {
       return { resolutions: [], malformed: `resolutions[${i}] must be an object`, duplicateIds: null };
     }
@@ -13173,10 +13173,10 @@ init_fs_migration();
 init_parser2();
 init_fs();
 init_paths();
-import { Router as Router13 } from "express";
-import { readdir as readdir10 } from "fs/promises";
-import { resolve as resolvePath, dirname as dirname5 } from "path";
-import { rename as rename5, mkdir as mkdir2 } from "fs/promises";
+import { Router as Router14 } from "express";
+import { readdir as readdir11 } from "fs/promises";
+import { resolve as resolvePath, dirname as dirname6 } from "path";
+import { rename as rename6, mkdir as mkdir3 } from "fs/promises";
 init_slug();
 
 // src/utils/promote-todos.ts
@@ -13515,6 +13515,331 @@ async function promoteTodosToNewAssignment(groups, options) {
 
 // src/dashboard/api-todos.ts
 init_api();
+
+// src/dashboard/todo-attachments-routes.ts
+import { raw } from "express";
+
+// src/todos/attachments.ts
+import { mkdir as mkdir2, readdir as readdir10, stat, rename as rename5, rm as rm3, unlink as unlink5, writeFile as writeFile5, cp } from "fs/promises";
+import { resolve as resolve25, basename as basename4, dirname as dirname5, extname } from "path";
+
+// src/utils/proof-artifact-id.ts
+import { randomBytes as randomBytes2 } from "crypto";
+function generateArtifactId() {
+  const ts = Date.now().toString(36);
+  const rand = randomBytes2(2).toString("hex");
+  return `${ts}-${rand}`;
+}
+
+// src/todos/attachments.ts
+var SCOPE_RE = /^[a-z0-9_][a-z0-9-]*$/;
+var TODO_ID_RE = /^[a-f0-9]{4}$/;
+var ATTACHMENT_ID_RE = /^[a-z0-9]+-[0-9a-f]{4}$/;
+var AttachmentValidationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AttachmentValidationError";
+  }
+};
+function assertScope(scopeId) {
+  if (!SCOPE_RE.test(scopeId)) throw new AttachmentValidationError(`Invalid scope id: "${scopeId}"`);
+}
+function assertTodoId(todoId) {
+  if (!TODO_ID_RE.test(todoId)) throw new AttachmentValidationError(`Invalid todo id: "${todoId}"`);
+}
+function assertAttachmentId(attachmentId) {
+  if (!ATTACHMENT_ID_RE.test(attachmentId)) {
+    throw new AttachmentValidationError(`Invalid attachment id: "${attachmentId}"`);
+  }
+}
+var EXT_MIME = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp",
+  ico: "image/x-icon",
+  svg: "image/svg+xml",
+  pdf: "application/pdf",
+  txt: "text/plain",
+  log: "text/plain",
+  md: "text/markdown",
+  json: "application/json",
+  csv: "text/csv",
+  html: "text/html",
+  htm: "text/html",
+  xml: "application/xml",
+  mp4: "video/mp4",
+  mov: "video/quicktime",
+  webm: "video/webm",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  m4a: "audio/mp4",
+  zip: "application/zip"
+};
+function mimeForName(name) {
+  const ext = extname(name).slice(1).toLowerCase();
+  return EXT_MIME[ext] ?? "application/octet-stream";
+}
+var SAFE_INLINE_MIME = /* @__PURE__ */ new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "application/pdf",
+  "text/plain"
+]);
+function isSafeInlineMime(mime) {
+  return SAFE_INLINE_MIME.has(mime);
+}
+function sanitizeAttachmentName(name) {
+  let n = basename4(name || "").replace(/["'\\/]/g, "_");
+  n = Array.from(n, (ch) => {
+    const code = ch.charCodeAt(0);
+    return code < 32 || code === 127 ? "_" : ch;
+  }).join("");
+  n = n.trim();
+  if (!n || n === "." || n === "..") n = "file";
+  if (n.length > 120) {
+    const ext = extname(n);
+    n = n.slice(0, Math.max(1, 120 - ext.length)) + ext;
+  }
+  return n;
+}
+function attachmentsRootDir(todosDir2) {
+  return resolve25(todosDir2, "attachments");
+}
+function attachmentDirFor(todosDir2, scopeId, todoId) {
+  assertScope(scopeId);
+  assertTodoId(todoId);
+  return resolve25(attachmentsRootDir(todosDir2), scopeId, todoId);
+}
+async function dirExists(p) {
+  try {
+    return (await stat(p)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function writeAttachment(todosDir2, scopeId, todoId, originalName, bytes) {
+  const dir = attachmentDirFor(todosDir2, scopeId, todoId);
+  await mkdir2(dir, { recursive: true });
+  const id = generateArtifactId();
+  const filename = sanitizeAttachmentName(originalName);
+  await writeFile5(resolve25(dir, `${id}__${filename}`), bytes);
+  return {
+    id,
+    filename,
+    mime: mimeForName(filename),
+    size: bytes.length,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function listAttachments(todosDir2, scopeId, todoId) {
+  const dir = attachmentDirFor(todosDir2, scopeId, todoId);
+  let names;
+  try {
+    names = await readdir10(dir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const stored of names) {
+    const sep2 = stored.indexOf("__");
+    if (sep2 <= 0) continue;
+    const id = stored.slice(0, sep2);
+    if (!ATTACHMENT_ID_RE.test(id)) continue;
+    const filename = stored.slice(sep2 + 2);
+    try {
+      const st = await stat(resolve25(dir, stored));
+      if (!st.isFile()) continue;
+      out.push({ id, filename, mime: mimeForName(filename), size: st.size, createdAt: st.mtime.toISOString() });
+    } catch {
+    }
+  }
+  out.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  return out;
+}
+async function readScopeAttachments(todosDir2, scopeId) {
+  assertScope(scopeId);
+  const scopeDir = resolve25(attachmentsRootDir(todosDir2), scopeId);
+  let todoIds;
+  try {
+    todoIds = await readdir10(scopeDir);
+  } catch {
+    return {};
+  }
+  const result = {};
+  for (const todoId of todoIds) {
+    if (!TODO_ID_RE.test(todoId)) continue;
+    const list = await listAttachments(todosDir2, scopeId, todoId);
+    if (list.length) result[todoId] = list;
+  }
+  return result;
+}
+async function resolveAttachmentFile(todosDir2, scopeId, todoId, attachmentId) {
+  assertAttachmentId(attachmentId);
+  const dir = attachmentDirFor(todosDir2, scopeId, todoId);
+  let names;
+  try {
+    names = await readdir10(dir);
+  } catch {
+    return null;
+  }
+  const prefix = `${attachmentId}__`;
+  const stored = names.find((n) => n.startsWith(prefix));
+  if (!stored) return null;
+  const filename = stored.slice(prefix.length);
+  return { path: resolve25(dir, stored), filename, mime: mimeForName(filename) };
+}
+async function deleteAttachment(todosDir2, scopeId, todoId, attachmentId) {
+  const resolved = await resolveAttachmentFile(todosDir2, scopeId, todoId, attachmentId);
+  if (!resolved) return false;
+  await unlink5(resolved.path);
+  return true;
+}
+async function deleteAllAttachments(todosDir2, scopeId, todoId) {
+  await rm3(attachmentDirFor(todosDir2, scopeId, todoId), { recursive: true, force: true });
+}
+async function attachmentMoveConflict(srcTodosDir, srcScopeId, dstTodosDir, dstScopeId, todoId) {
+  const src = attachmentDirFor(srcTodosDir, srcScopeId, todoId);
+  const dst = attachmentDirFor(dstTodosDir, dstScopeId, todoId);
+  return await dirExists(src) && await dirExists(dst);
+}
+async function moveAttachments(srcTodosDir, srcScopeId, dstTodosDir, dstScopeId, todoId) {
+  const src = attachmentDirFor(srcTodosDir, srcScopeId, todoId);
+  if (!await dirExists(src)) return;
+  const dst = attachmentDirFor(dstTodosDir, dstScopeId, todoId);
+  await mkdir2(dirname5(dst), { recursive: true });
+  try {
+    await rename5(src, dst);
+  } catch (err) {
+    if (err?.code === "EXDEV") {
+      await cp(src, dst, { recursive: true });
+      await rm3(src, { recursive: true, force: true });
+    } else {
+      throw err;
+    }
+  }
+}
+
+// src/dashboard/todo-attachments-routes.ts
+var MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
+function headerValue(req, name) {
+  const v = req.headers[name];
+  return Array.isArray(v) ? v[0] : v;
+}
+function paramStr(v) {
+  return Array.isArray(v) ? v[0] ?? "" : v ?? "";
+}
+function sendError(res, err) {
+  if (err instanceof AttachmentValidationError) {
+    res.status(400).json({ error: err.message });
+    return;
+  }
+  res.status(500).json({ error: err instanceof Error ? err.message : "Attachment operation failed" });
+}
+function contentDisposition(filename, inline) {
+  const disp = inline ? "inline" : "attachment";
+  const asciiFallback = Array.from(filename, (ch) => {
+    const code = ch.charCodeAt(0);
+    return code >= 32 && code <= 126 && ch !== '"' && ch !== "\\" ? ch : "_";
+  }).join("");
+  return `${disp}; filename="${asciiFallback}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
+}
+function installTodoAttachmentRoutes(router, prefix, opts) {
+  router.post(
+    `${prefix}/attachments`,
+    raw({ type: () => true, limit: MAX_UPLOAD_BYTES }),
+    async (req, res) => {
+      try {
+        const rawName = headerValue(req, "x-attachment-filename");
+        let filename = "file";
+        if (rawName) {
+          try {
+            filename = decodeURIComponent(rawName);
+          } catch {
+            res.status(400).json({ error: "Invalid x-attachment-filename header" });
+            return;
+          }
+        }
+        const body = req.body;
+        if (!Buffer.isBuffer(body) || body.length === 0) {
+          res.status(400).json({ error: "Empty upload body" });
+          return;
+        }
+        const scope = opts.resolveScope(req);
+        const result = await opts.withScopeLock(req, async () => {
+          if (!await opts.todoExists(scope)) return null;
+          return writeAttachment(scope.todosDir, scope.scopeId, scope.todoId, filename, body);
+        });
+        if (!result) {
+          res.status(404).json({ error: `Todo "${scope.todoId}" not found` });
+          return;
+        }
+        opts.onChange(req);
+        res.status(201).json(result);
+      } catch (err) {
+        sendError(res, err);
+      }
+    }
+  );
+  router.get(`${prefix}/attachments/:attachmentId`, async (req, res) => {
+    try {
+      const scope = opts.resolveScope(req);
+      const attachmentId = paramStr(req.params.attachmentId);
+      const resolved = await opts.withScopeLock(req, async () => {
+        if (!await opts.todoExists(scope)) return { notFound: true };
+        return {
+          file: await resolveAttachmentFile(scope.todosDir, scope.scopeId, scope.todoId, attachmentId)
+        };
+      });
+      if ("notFound" in resolved) {
+        res.status(404).json({ error: `Todo "${scope.todoId}" not found` });
+        return;
+      }
+      if (!resolved.file) {
+        res.status(404).json({ error: `Attachment "${attachmentId}" not found` });
+        return;
+      }
+      const { path, filename, mime } = resolved.file;
+      const inline = isSafeInlineMime(mime);
+      res.setHeader("X-Content-Type-Options", "nosniff");
+      res.setHeader("Content-Type", inline ? mime : "application/octet-stream");
+      res.setHeader("Content-Disposition", contentDisposition(filename, inline));
+      res.sendFile(path, (err) => {
+        if (err && !res.headersSent) res.status(500).end();
+      });
+    } catch (err) {
+      sendError(res, err);
+    }
+  });
+  router.delete(`${prefix}/attachments/:attachmentId`, async (req, res) => {
+    try {
+      const scope = opts.resolveScope(req);
+      const attachmentId = paramStr(req.params.attachmentId);
+      const result = await opts.withScopeLock(req, async () => {
+        if (!await opts.todoExists(scope)) return { notFound: true };
+        return { deleted: await deleteAttachment(scope.todosDir, scope.scopeId, scope.todoId, attachmentId) };
+      });
+      if ("notFound" in result) {
+        res.status(404).json({ error: `Todo "${scope.todoId}" not found` });
+        return;
+      }
+      if (!result.deleted) {
+        res.status(404).json({ error: `Attachment "${attachmentId}" not found` });
+        return;
+      }
+      opts.onChange(req);
+      res.json({ deleted: attachmentId });
+    } catch (err) {
+      sendError(res, err);
+    }
+  });
+}
+
+// src/dashboard/api-todos.ts
 var WORKSPACE_REGEX = /^[a-z0-9_][a-z0-9-]*$/;
 function getWorkspaceParam(value) {
   if (Array.isArray(value)) {
@@ -13528,7 +13853,7 @@ function touchItem3(item) {
   item.updatedAt = now;
 }
 function createTodosRouter(todosDir2, broadcast, projectsDir) {
-  const router = Router13();
+  const router = Router14();
   installRecordsInvalidation(router);
   function broadcastUpdate() {
     broadcast({ type: "todos-updated", timestamp: (/* @__PURE__ */ new Date()).toISOString() });
@@ -13545,6 +13870,19 @@ function createTodosRouter(todosDir2, broadcast, projectsDir) {
     next();
   }
   router.param("workspace", validateWorkspace);
+  installTodoAttachmentRoutes(router, "/:workspace/:id", {
+    resolveScope: (req) => ({
+      todosDir: todosDir2,
+      scopeId: getWorkspaceParam(req.params.workspace),
+      todoId: getWorkspaceParam(req.params.id)
+    }),
+    withScopeLock: (req, fn) => wsLock(getWorkspaceParam(req.params.workspace), fn),
+    todoExists: async (scope) => {
+      const checklist = await readChecklist(scope.todosDir, scope.scopeId);
+      return checklist.items.some((i) => i.id === scope.todoId);
+    },
+    onChange: () => broadcastUpdate()
+  });
   router.post("/promote-bulk", async (req, res) => {
     try {
       const { groups, mode, target, title, type, priority, keepSource } = req.body ?? {};
@@ -13649,17 +13987,18 @@ function createTodosRouter(todosDir2, broadcast, projectsDir) {
   router.get("/", async (_req, res) => {
     try {
       await ensureDir(todosDir2);
-      const files = await readdir10(todosDir2).catch(() => []);
+      const files = await readdir11(todosDir2).catch(() => []);
       const workspaces = [];
       for (const file of files) {
         if (typeof file !== "string") continue;
         if (!file.endsWith(".md") || file.endsWith("-log.md")) continue;
         const workspace = file.replace(".md", "");
         const checklist = await readChecklist(todosDir2, workspace);
+        const attachmentsByTodo = await readScopeAttachments(todosDir2, checklist.workspace);
         workspaces.push({
           workspace: checklist.workspace,
           archiveInterval: checklist.archiveInterval,
-          items: checklist.items,
+          items: checklist.items.map((i) => ({ ...i, attachments: attachmentsByTodo[i.id] ?? [] })),
           counts: computeCounts(checklist.items)
         });
       }
@@ -13672,10 +14011,11 @@ function createTodosRouter(todosDir2, broadcast, projectsDir) {
     try {
       const workspace = getWorkspaceParam(req.params.workspace);
       const checklist = await readChecklist(todosDir2, workspace);
+      const attachmentsByTodo = await readScopeAttachments(todosDir2, workspace);
       res.json({
         workspace: checklist.workspace,
         archiveInterval: checklist.archiveInterval,
-        items: checklist.items,
+        items: checklist.items.map((i) => ({ ...i, attachments: attachmentsByTodo[i.id] ?? [] })),
         counts: computeCounts(checklist.items)
       });
     } catch (error) {
@@ -13763,63 +14103,68 @@ function createTodosRouter(todosDir2, broadcast, projectsDir) {
   router.post("/:workspace/archive", async (req, res) => {
     try {
       const { archivePath: archivePath2 } = await Promise.resolve().then(() => (init_parser2(), parser_exports));
-      const { resolve: resolve29 } = await import("path");
+      const { resolve: resolve30 } = await import("path");
       const { readFile: readFile21 } = await import("fs/promises");
       const { writeFileForce: writeFileForce2 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
       const workspace = getWorkspaceParam(req.params.workspace);
-      const checklist = await readChecklist(todosDir2, workspace);
-      const log = await readLog(todosDir2, workspace);
-      const completedIds = new Set(
-        checklist.items.filter((i) => i.status === "completed").map((i) => i.id)
-      );
-      if (completedIds.size === 0) {
-        res.json({ archived: 0, message: "No completed items to archive" });
-        return;
-      }
-      const toArchive = log.entries.filter(
-        (e) => e.itemIds.every((id) => completedIds.has(id))
-      );
-      const archFile = archivePath2(todosDir2, workspace, checklist.archiveInterval);
-      await ensureDir(resolve29(todosDir2, "archive"));
-      let archContent = "";
-      if (await fileExists(archFile)) {
-        archContent = await readFile21(archFile, "utf-8");
-        archContent = archContent.trimEnd() + "\n\n";
-      } else {
-        archContent = `---
+      const outcome = await wsLock(workspace, async () => {
+        const checklist = await readChecklist(todosDir2, workspace);
+        const log = await readLog(todosDir2, workspace);
+        const completedIds = new Set(
+          checklist.items.filter((i) => i.status === "completed").map((i) => i.id)
+        );
+        if (completedIds.size === 0) {
+          return { archived: 0, message: "No completed items to archive" };
+        }
+        const toArchive = log.entries.filter(
+          (e) => e.itemIds.every((id) => completedIds.has(id))
+        );
+        const archFile = archivePath2(todosDir2, workspace, checklist.archiveInterval);
+        await ensureDir(resolve30(todosDir2, "archive"));
+        let archContent = "";
+        if (await fileExists(archFile)) {
+          archContent = await readFile21(archFile, "utf-8");
+          archContent = archContent.trimEnd() + "\n\n";
+        } else {
+          archContent = `---
 workspace: ${workspace}
 ---
 
 # Archive
 
 `;
-      }
-      const completedItems = checklist.items.filter((i) => completedIds.has(i.id));
-      for (const item of completedItems) {
-        archContent += `- [x] ${item.description} ${item.tags.map((t) => `#${t}`).join(" ")} [t:${item.id}]
+        }
+        const completedItems = checklist.items.filter((i) => completedIds.has(i.id));
+        for (const item of completedItems) {
+          archContent += `- [x] ${item.description} ${item.tags.map((t) => `#${t}`).join(" ")} [t:${item.id}]
 `;
-      }
-      archContent += "\n";
-      for (const entry of toArchive) {
-        archContent += `### ${entry.timestamp} \u2014 ${entry.itemIds.map((i) => `t:${i}`).join(", ")}
+        }
+        archContent += "\n";
+        for (const entry of toArchive) {
+          archContent += `### ${entry.timestamp} \u2014 ${entry.itemIds.map((i) => `t:${i}`).join(", ")}
 `;
-        if (entry.items) archContent += `**Items:** ${entry.items}
+          if (entry.items) archContent += `**Items:** ${entry.items}
 `;
-        if (entry.session) archContent += `**Session:** ${entry.session}
+          if (entry.session) archContent += `**Session:** ${entry.session}
 `;
-        if (entry.branch) archContent += `**Branch:** ${entry.branch}
+          if (entry.branch) archContent += `**Branch:** ${entry.branch}
 `;
-        if (entry.summary) archContent += `**Summary:** ${entry.summary}
+          if (entry.summary) archContent += `**Summary:** ${entry.summary}
 `;
-        if (entry.blockers) archContent += `**Blockers:** ${entry.blockers}
+          if (entry.blockers) archContent += `**Blockers:** ${entry.blockers}
 `;
-        archContent += "\n";
-      }
-      await writeFileForce2(archFile, archContent);
-      checklist.items = checklist.items.filter((i) => !completedIds.has(i.id));
-      await writeChecklist(todosDir2, checklist);
-      broadcastUpdate();
-      res.json({ archived: completedIds.size, logEntries: toArchive.length });
+          archContent += "\n";
+        }
+        await writeFileForce2(archFile, archContent);
+        checklist.items = checklist.items.filter((i) => !completedIds.has(i.id));
+        await writeChecklist(todosDir2, checklist);
+        for (const id of completedIds) {
+          await deleteAllAttachments(todosDir2, workspace, id);
+        }
+        return { archived: completedIds.size, logEntries: toArchive.length };
+      });
+      if (outcome.archived > 0) broadcastUpdate();
+      res.json(outcome);
     } catch (error) {
       res.status(500).json({ error: error instanceof Error ? error.message : "Failed to archive" });
     }
@@ -13844,7 +14189,8 @@ workspace: ${workspace}
       }
       const log = await readLog(todosDir2, workspace);
       const logEntries = log.entries.filter((e) => e.itemIds.includes(req.params.id));
-      res.json({ ...item, log: logEntries });
+      const attachments = await listAttachments(todosDir2, workspace, item.id);
+      res.json({ ...item, attachments, log: logEntries });
     } catch (error) {
       res.status(500).json({ error: error instanceof Error ? error.message : "Failed to get todo" });
     }
@@ -13881,6 +14227,7 @@ workspace: ${workspace}
         if (idx === -1) return false;
         checklist.items.splice(idx, 1);
         await writeChecklist(todosDir2, checklist);
+        await deleteAllAttachments(todosDir2, workspace, req.params.id);
         return true;
       });
       if (!deleted) {
@@ -14192,15 +14539,22 @@ workspace: ${workspace}
           return { status: 409, error: "id already exists in target" };
         }
         const item = sourceChecklist.items[idx];
+        let newPlanDir = null;
         if (item.planDir) {
-          const newPlanDir = todoPlanDir(target.todosPath, target.id, id);
+          newPlanDir = todoPlanDir(target.todosPath, target.id, id);
           if (await fileExists(newPlanDir)) {
             return { status: 409, error: "plan dir already exists in target" };
           }
-          await mkdir2(dirname5(newPlanDir), { recursive: true });
-          await rename5(item.planDir, newPlanDir);
+        }
+        if (await attachmentMoveConflict(todosDir2, sourceWs, target.todosPath, target.id, id)) {
+          return { status: 409, error: "attachments already exist in target" };
+        }
+        if (item.planDir && newPlanDir) {
+          await mkdir3(dirname6(newPlanDir), { recursive: true });
+          await rename6(item.planDir, newPlanDir);
           item.planDir = newPlanDir;
         }
+        await moveAttachments(todosDir2, sourceWs, target.todosPath, target.id, id);
         sourceChecklist.items.splice(idx, 1);
         targetChecklist.items.push(item);
         await writeChecklist(todosDir2, sourceChecklist);
@@ -14273,9 +14627,9 @@ init_parser2();
 init_fs();
 init_paths();
 init_slug();
-import { Router as Router14 } from "express";
-import { mkdir as mkdir3, readFile as readFile18, rename as rename6 } from "fs/promises";
-import { resolve as resolve25, dirname as dirname6 } from "path";
+import { Router as Router15 } from "express";
+import { mkdir as mkdir4, readFile as readFile18, rename as rename7 } from "fs/promises";
+import { resolve as resolve26, dirname as dirname7 } from "path";
 init_api();
 var WORKSPACE_REGEX2 = /^[a-z0-9_][a-z0-9-]*$/;
 function touchItem4(item) {
@@ -14291,12 +14645,12 @@ function params(req) {
   return req.params;
 }
 async function projectExists(projectsDir, slug) {
-  return fileExists(resolve25(projectsDir, slug, "project.md"));
+  return fileExists(resolve26(projectsDir, slug, "project.md"));
 }
 async function ensureProjectTodosDir(projectsDir, slug) {
   const todosDir2 = projectTodosDir(projectsDir, slug);
   try {
-    await mkdir3(todosDir2, { recursive: false });
+    await mkdir4(todosDir2, { recursive: false });
   } catch (err) {
     const code = err.code;
     if (code === "EEXIST") return;
@@ -14308,7 +14662,7 @@ async function ensureProjectTodosDir(projectsDir, slug) {
     throw err;
   }
   try {
-    await mkdir3(resolve25(todosDir2, "archive"), { recursive: false });
+    await mkdir4(resolve26(todosDir2, "archive"), { recursive: false });
   } catch (err) {
     const code = err.code;
     if (code === "EEXIST") return;
@@ -14324,7 +14678,7 @@ function notFound(res, slug) {
   res.status(404).json({ error: `Project "${slug}" not found` });
 }
 function createProjectTodosRouter(projectsDir, broadcast, workspaceTodosDir) {
-  const router = Router14({ mergeParams: true });
+  const router = Router15({ mergeParams: true });
   installRecordsInvalidation(router);
   function broadcastUpdate(projectSlug) {
     broadcast({ type: "todos-updated", projectSlug, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
@@ -14341,6 +14695,18 @@ function createProjectTodosRouter(projectsDir, broadcast, workspaceTodosDir) {
     next();
   }
   router.use(validateProjectId);
+  installTodoAttachmentRoutes(router, "/:id", {
+    resolveScope: (req) => {
+      const slug = getProjectIdParam(params(req).projectId);
+      return { todosDir: projectTodosDir(projectsDir, slug), scopeId: slug, todoId: params(req).id ?? "" };
+    },
+    withScopeLock: (req, fn) => projLock(getProjectIdParam(params(req).projectId), fn),
+    todoExists: async (scope) => {
+      const checklist = await readChecklist(scope.todosDir, scope.scopeId);
+      return checklist.items.some((i) => i.id === scope.todoId);
+    },
+    onChange: (req) => broadcastUpdate(getProjectIdParam(params(req).projectId))
+  });
   router.get("/", async (req, res) => {
     try {
       const slug = getProjectIdParam(params(req).projectId);
@@ -14350,10 +14716,11 @@ function createProjectTodosRouter(projectsDir, broadcast, workspaceTodosDir) {
       }
       const todosDir2 = projectTodosDir(projectsDir, slug);
       const checklist = await readChecklist(todosDir2, slug);
+      const attachmentsByTodo = await readScopeAttachments(todosDir2, slug);
       res.json({
         workspace: checklist.workspace,
         archiveInterval: checklist.archiveInterval,
-        items: checklist.items,
+        items: checklist.items.map((i) => ({ ...i, attachments: attachmentsByTodo[i.id] ?? [] })),
         counts: computeCounts(checklist.items)
       });
     } catch (error) {
@@ -14481,61 +14848,71 @@ function createProjectTodosRouter(projectsDir, broadcast, workspaceTodosDir) {
         notFound(res, slug);
         return;
       }
-      const todosDir2 = projectTodosDir(projectsDir, slug);
-      await ensureProjectTodosDir(projectsDir, slug);
-      const checklist = await readChecklist(todosDir2, slug);
-      const log = await readLog(todosDir2, slug);
-      const completedIds = new Set(
-        checklist.items.filter((i) => i.status === "completed").map((i) => i.id)
-      );
-      if (completedIds.size === 0) {
-        res.json({ archived: 0, message: "No completed items to archive" });
-        return;
-      }
-      const toArchive = log.entries.filter(
-        (e) => e.itemIds.every((id) => completedIds.has(id))
-      );
-      const archFile = archivePath(todosDir2, slug, checklist.archiveInterval);
-      let archContent = "";
-      if (await fileExists(archFile)) {
-        archContent = await readFile18(archFile, "utf-8");
-        archContent = archContent.trimEnd() + "\n\n";
-      } else {
-        archContent = `---
+      const outcome = await projLock(slug, async () => {
+        if (!await projectExists(projectsDir, slug)) return "gone";
+        await ensureProjectTodosDir(projectsDir, slug);
+        const todosDir2 = projectTodosDir(projectsDir, slug);
+        const checklist = await readChecklist(todosDir2, slug);
+        const log = await readLog(todosDir2, slug);
+        const completedIds = new Set(
+          checklist.items.filter((i) => i.status === "completed").map((i) => i.id)
+        );
+        if (completedIds.size === 0) {
+          return { archived: 0, message: "No completed items to archive" };
+        }
+        const toArchive = log.entries.filter(
+          (e) => e.itemIds.every((id) => completedIds.has(id))
+        );
+        const archFile = archivePath(todosDir2, slug, checklist.archiveInterval);
+        let archContent = "";
+        if (await fileExists(archFile)) {
+          archContent = await readFile18(archFile, "utf-8");
+          archContent = archContent.trimEnd() + "\n\n";
+        } else {
+          archContent = `---
 workspace: ${slug}
 ---
 
 # Archive
 
 `;
-      }
-      const completedItems = checklist.items.filter((i) => completedIds.has(i.id));
-      for (const item of completedItems) {
-        archContent += `- [x] ${item.description} ${item.tags.map((t) => `#${t}`).join(" ")} [t:${item.id}]
+        }
+        const completedItems = checklist.items.filter((i) => completedIds.has(i.id));
+        for (const item of completedItems) {
+          archContent += `- [x] ${item.description} ${item.tags.map((t) => `#${t}`).join(" ")} [t:${item.id}]
 `;
-      }
-      archContent += "\n";
-      for (const entry of toArchive) {
-        archContent += `### ${entry.timestamp} \u2014 ${entry.itemIds.map((i) => `t:${i}`).join(", ")}
+        }
+        archContent += "\n";
+        for (const entry of toArchive) {
+          archContent += `### ${entry.timestamp} \u2014 ${entry.itemIds.map((i) => `t:${i}`).join(", ")}
 `;
-        if (entry.items) archContent += `**Items:** ${entry.items}
+          if (entry.items) archContent += `**Items:** ${entry.items}
 `;
-        if (entry.session) archContent += `**Session:** ${entry.session}
+          if (entry.session) archContent += `**Session:** ${entry.session}
 `;
-        if (entry.branch) archContent += `**Branch:** ${entry.branch}
+          if (entry.branch) archContent += `**Branch:** ${entry.branch}
 `;
-        if (entry.summary) archContent += `**Summary:** ${entry.summary}
+          if (entry.summary) archContent += `**Summary:** ${entry.summary}
 `;
-        if (entry.blockers) archContent += `**Blockers:** ${entry.blockers}
+          if (entry.blockers) archContent += `**Blockers:** ${entry.blockers}
 `;
-        archContent += "\n";
+          archContent += "\n";
+        }
+        await writeFileForce(archFile, archContent);
+        checklist.workspace = slug;
+        checklist.items = checklist.items.filter((i) => !completedIds.has(i.id));
+        await writeChecklist(todosDir2, checklist);
+        for (const id of completedIds) {
+          await deleteAllAttachments(todosDir2, slug, id);
+        }
+        return { archived: completedIds.size, logEntries: toArchive.length };
+      });
+      if (outcome === "gone") {
+        notFound(res, slug);
+        return;
       }
-      await writeFileForce(archFile, archContent);
-      checklist.workspace = slug;
-      checklist.items = checklist.items.filter((i) => !completedIds.has(i.id));
-      await writeChecklist(todosDir2, checklist);
-      broadcastUpdate(slug);
-      res.json({ archived: completedIds.size, logEntries: toArchive.length });
+      if (outcome.archived > 0) broadcastUpdate(slug);
+      res.json(outcome);
     } catch (error) {
       if (error.code === "PROJECT_GONE") {
         notFound(res, getProjectIdParam(params(req).projectId));
@@ -14575,7 +14952,8 @@ workspace: ${slug}
       }
       const log = await readLog(todosDir2, slug);
       const logEntries = log.entries.filter((e) => e.itemIds.includes(params(req).id ?? ""));
-      res.json({ ...item, log: logEntries });
+      const attachments = await listAttachments(todosDir2, slug, item.id);
+      res.json({ ...item, attachments, log: logEntries });
     } catch (error) {
       res.status(500).json({ error: error instanceof Error ? error.message : "Failed to get todo" });
     }
@@ -14631,11 +15009,13 @@ workspace: ${slug}
         await ensureProjectTodosDir(projectsDir, slug);
         const todosDir2 = projectTodosDir(projectsDir, slug);
         const checklist = await readChecklist(todosDir2, slug);
-        const idx = checklist.items.findIndex((i) => i.id === (params(req).id ?? ""));
+        const targetId = params(req).id ?? "";
+        const idx = checklist.items.findIndex((i) => i.id === targetId);
         if (idx === -1) return false;
         checklist.items.splice(idx, 1);
         checklist.workspace = slug;
         await writeChecklist(todosDir2, checklist);
+        await deleteAllAttachments(todosDir2, slug, targetId);
         return true;
       });
       if (deleted === "gone") {
@@ -14945,15 +15325,15 @@ workspace: ${slug}
         if (tg.includes("/")) {
           const parts = tg.split("/");
           if (parts.length !== 2) return { error: `Invalid target.assignment "${tg}"` };
-          assignmentDir = resolve25(projectsDir, parts[0], "assignments", parts[1]);
+          assignmentDir = resolve26(projectsDir, parts[0], "assignments", parts[1]);
           assignmentRef = `${parts[0]}/${parts[1]}`;
         } else if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(tg)) {
-          assignmentDir = resolve25(assignmentsDirFn(), tg);
+          assignmentDir = resolve26(assignmentsDirFn(), tg);
           assignmentRef = tg;
         } else {
           return { error: `Invalid target.assignment "${tg}"` };
         }
-        const assignmentMdPath = resolve25(assignmentDir, "assignment.md");
+        const assignmentMdPath = resolve26(assignmentDir, "assignment.md");
         if (!await fileExists(assignmentMdPath)) return { error: `Target assignment not found: ${assignmentMdPath}` };
         let content = await readFile18(assignmentMdPath, "utf-8");
         content = appendTodosToAssignmentBody2(
@@ -15083,15 +15463,22 @@ workspace: ${slug}
           return { status: 409, error: "id already exists in target" };
         }
         const item = sourceChecklist.items[idx];
+        let newPlanDir = null;
         if (item.planDir) {
-          const newPlanDir = todoPlanDir(target.todosPath, target.id, id);
+          newPlanDir = todoPlanDir(target.todosPath, target.id, id);
           if (await fileExists(newPlanDir)) {
             return { status: 409, error: "plan dir already exists in target" };
           }
-          await mkdir3(dirname6(newPlanDir), { recursive: true });
-          await rename6(item.planDir, newPlanDir);
+        }
+        if (await attachmentMoveConflict(sourceTodosDir, sourceSlug, target.todosPath, target.id, id)) {
+          return { status: 409, error: "attachments already exist in target" };
+        }
+        if (item.planDir && newPlanDir) {
+          await mkdir4(dirname7(newPlanDir), { recursive: true });
+          await rename7(item.planDir, newPlanDir);
           item.planDir = newPlanDir;
         }
+        await moveAttachments(sourceTodosDir, sourceSlug, target.todosPath, target.id, id);
         sourceChecklist.items.splice(idx, 1);
         targetChecklist.items.push(item);
         sourceChecklist.workspace = sourceSlug;
@@ -15150,33 +15537,33 @@ workspace: ${slug}
 }
 
 // src/dashboard/api-bundles.ts
-import { Router as Router15 } from "express";
-import { readdir as readdir11 } from "fs/promises";
+import { Router as Router16 } from "express";
+import { readdir as readdir12 } from "fs/promises";
 
 // src/todos/bundle-parser.ts
 init_parser();
 init_fs();
 init_paths();
 init_parser2();
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 import { readFile as readFile19 } from "fs/promises";
 var BUNDLE_ID_REGEX = /^[a-f0-9]{4}$/;
 var SCOPE_VALUES = /* @__PURE__ */ new Set(["workspace", "project", "global"]);
 var SCOPE_ID_REGEX = /^[a-z0-9_][a-z0-9_-]*$/;
 var BUNDLE_LINE_REGEX = /^- b:([a-f0-9]{4})\s+<([^>]*)>\s*$/;
-function parseScopeToken(raw) {
-  const idx = raw.indexOf(":");
+function parseScopeToken(raw2) {
+  const idx = raw2.indexOf(":");
   if (idx < 0) return null;
-  const scopeRaw = raw.slice(0, idx);
-  const scopeId = raw.slice(idx + 1);
+  const scopeRaw = raw2.slice(0, idx);
+  const scopeId = raw2.slice(idx + 1);
   if (!SCOPE_VALUES.has(scopeRaw)) return null;
   if (!scopeId) return null;
   if (!SCOPE_ID_REGEX.test(scopeId)) return null;
   return { scope: scopeRaw, scopeId };
 }
-function parseTodosToken(raw) {
-  if (!raw) return [];
-  return raw.split(",").map((s) => s.trim()).filter((s) => BUNDLE_ID_REGEX.test(s));
+function parseTodosToken(raw2) {
+  if (!raw2) return [];
+  return raw2.split(",").map((s) => s.trim()).filter((s) => BUNDLE_ID_REGEX.test(s));
 }
 function parseBundleLine(line) {
   const match = line.match(BUNDLE_LINE_REGEX);
@@ -15261,7 +15648,7 @@ function annotate(bundle, items) {
 }
 function createBundlesRouter(todosDir2, broadcast) {
   void broadcast;
-  const router = Router15();
+  const router = Router16();
   function validateWorkspace(req, res, next) {
     const workspace = getWorkspaceParam2(req.params.workspace);
     if (workspace && !WORKSPACE_REGEX3.test(workspace)) {
@@ -15275,7 +15662,7 @@ function createBundlesRouter(todosDir2, broadcast) {
     try {
       await ensureDir(todosDir2);
       const bundles = await readBundles(todosDir2);
-      const workspaceFiles = await readdir11(todosDir2).catch(() => []);
+      const workspaceFiles = await readdir12(todosDir2).catch(() => []);
       const itemsByKey = /* @__PURE__ */ new Map();
       for (const f of workspaceFiles) {
         if (typeof f !== "string") continue;
@@ -15327,8 +15714,8 @@ function createBundlesRouter(todosDir2, broadcast) {
 init_fs();
 init_paths();
 init_slug();
-import { Router as Router16 } from "express";
-import { resolve as resolve26 } from "path";
+import { Router as Router17 } from "express";
+import { resolve as resolve27 } from "path";
 init_parser2();
 function deriveStatus2(bundle, items) {
   const members = bundle.todoIds.map((id) => items.find((i) => i.id === id)).filter((i) => i !== void 0);
@@ -15357,7 +15744,7 @@ function notFound2(res, slug) {
 }
 function createProjectBundlesRouter(projectsDir, broadcast) {
   void broadcast;
-  const router = Router16({ mergeParams: true });
+  const router = Router17({ mergeParams: true });
   function validateProjectId(req, res, next) {
     const slug = getProjectIdParam2(req.params.projectId);
     if (!slug || !isValidSlug(slug)) {
@@ -15370,7 +15757,7 @@ function createProjectBundlesRouter(projectsDir, broadcast) {
   router.get("/", async (req, res) => {
     try {
       const slug = getProjectIdParam2(req.params.projectId);
-      const projectMd = resolve26(projectsDir, slug, "project.md");
+      const projectMd = resolve27(projectsDir, slug, "project.md");
       if (!await fileExists(projectMd)) {
         notFound2(res, slug);
         return;
@@ -15391,7 +15778,7 @@ function createProjectBundlesRouter(projectsDir, broadcast) {
 init_config2();
 init_api();
 init_scanner();
-import { Router as Router17 } from "express";
+import { Router as Router18 } from "express";
 
 // src/utils/github-backup.ts
 init_paths();
@@ -15399,8 +15786,8 @@ init_fs();
 init_config2();
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import { cp, mkdtemp, rm as rm3, readFile as readFile20, writeFile as writeFile5, unlink as unlink5, stat, open as open2, rename as rename7 } from "fs/promises";
-import { resolve as resolve27, join as join3 } from "path";
+import { cp as cp2, mkdtemp, rm as rm4, readFile as readFile20, writeFile as writeFile6, unlink as unlink6, stat as stat2, open as open2, rename as rename8 } from "fs/promises";
+import { resolve as resolve28, join as join3 } from "path";
 import { tmpdir } from "os";
 var exec2 = promisify2(execFile2);
 var VALID_CATEGORIES = ["projects", "playbooks", "todos", "servers", "config"];
@@ -15440,7 +15827,7 @@ async function resolveCategoryPath(category) {
     case "servers":
       return { sourcePath: serversDir(), repoPath: "servers", isFile: false };
     case "config":
-      return { sourcePath: resolve27(syntaurRoot(), "config.md"), repoPath: "config.md", isFile: true };
+      return { sourcePath: resolve28(syntaurRoot(), "config.md"), repoPath: "config.md", isFile: true };
   }
 }
 async function checkGitInstalled() {
@@ -15451,7 +15838,7 @@ async function checkGitInstalled() {
   }
 }
 async function acquireLock() {
-  const lockPath = resolve27(syntaurRoot(), LOCK_FILE_NAME);
+  const lockPath = resolve28(syntaurRoot(), LOCK_FILE_NAME);
   await ensureDir(syntaurRoot());
   try {
     const handle = await open2(lockPath, "wx");
@@ -15470,7 +15857,7 @@ async function acquireLock() {
 }
 async function releaseLock(lockPath) {
   try {
-    await unlink5(lockPath);
+    await unlink6(lockPath);
   } catch {
   }
 }
@@ -15493,13 +15880,13 @@ async function cloneOrInit(repoUrl, destDir) {
 }
 async function copyRecursive(src, dest) {
   if (!await fileExists(src)) return;
-  const s = await stat(src);
+  const s = await stat2(src);
   if (s.isDirectory()) {
     await ensureDir(dest);
-    await cp(src, dest, { recursive: true, force: true });
+    await cp2(src, dest, { recursive: true, force: true });
   } else {
-    await ensureDir(resolve27(dest, ".."));
-    await cp(src, dest, { force: true });
+    await ensureDir(resolve28(dest, ".."));
+    await cp2(src, dest, { force: true });
   }
 }
 function resolveCategoriesStrict(csv) {
@@ -15536,9 +15923,9 @@ async function backupToGithub(overrides) {
       const { sourcePath, repoPath, isFile } = await resolveCategoryPath(category);
       const destPath = join3(tmpDir, repoPath);
       if (isFile) {
-        await rm3(destPath, { force: true });
+        await rm4(destPath, { force: true });
       } else {
-        await rm3(destPath, { recursive: true, force: true });
+        await rm4(destPath, { recursive: true, force: true });
       }
       if (!await fileExists(sourcePath)) {
         console.warn(`Category "${category}": no local data at ${sourcePath}; backup will reflect deletion.`);
@@ -15546,8 +15933,8 @@ async function backupToGithub(overrides) {
       }
       if (category === "config") {
         const sanitized = await readSanitizedConfig(sourcePath);
-        await ensureDir(resolve27(destPath, ".."));
-        await writeFile5(destPath, sanitized, "utf-8");
+        await ensureDir(resolve28(destPath, ".."));
+        await writeFile6(destPath, sanitized, "utf-8");
       } else {
         await copyRecursive(sourcePath, destPath);
       }
@@ -15592,7 +15979,7 @@ async function backupToGithub(overrides) {
     };
   } finally {
     if (tmpDir) {
-      await rm3(tmpDir, { recursive: true, force: true }).catch(() => {
+      await rm4(tmpDir, { recursive: true, force: true }).catch(() => {
       });
     }
     await releaseLock(lockPath);
@@ -15600,18 +15987,18 @@ async function backupToGithub(overrides) {
 }
 async function safeRestoreCategory(localPath, repoSrcPath, isFile) {
   if (isFile) {
-    await ensureDir(resolve27(localPath, ".."));
-    await cp(repoSrcPath, localPath, { force: true });
+    await ensureDir(resolve28(localPath, ".."));
+    await cp2(repoSrcPath, localPath, { force: true });
     return;
   }
   const stagingPath = `${localPath}.syntaur-restore-staging`;
   const backupPath = `${localPath}.syntaur-restore-backup`;
-  await rm3(stagingPath, { recursive: true, force: true });
+  await rm4(stagingPath, { recursive: true, force: true });
   const backupExistsBefore = await fileExists(backupPath);
   const localExistsBefore = await fileExists(localPath);
   if (backupExistsBefore) {
     if (!localExistsBefore) {
-      await rename7(backupPath, localPath);
+      await rename8(backupPath, localPath);
     } else {
       throw new Error(
         `Cannot restore "${localPath}": a stale crash-recovery backup exists at ${backupPath} while the current path also exists. Inspect both and remove the one you don't need, then retry.`
@@ -15620,21 +16007,21 @@ async function safeRestoreCategory(localPath, repoSrcPath, isFile) {
   }
   let localMovedAside = false;
   try {
-    await cp(repoSrcPath, stagingPath, { recursive: true, force: true });
+    await cp2(repoSrcPath, stagingPath, { recursive: true, force: true });
     const localExists = await fileExists(localPath);
     if (localExists) {
-      await rename7(localPath, backupPath);
+      await rename8(localPath, backupPath);
       localMovedAside = true;
     }
-    await rename7(stagingPath, localPath);
-    await rm3(backupPath, { recursive: true, force: true }).catch(() => {
+    await rename8(stagingPath, localPath);
+    await rm4(backupPath, { recursive: true, force: true }).catch(() => {
     });
   } catch (err) {
     if (localMovedAside && await fileExists(backupPath)) {
-      await rename7(backupPath, localPath).catch(() => {
+      await rename8(backupPath, localPath).catch(() => {
       });
     }
-    await rm3(stagingPath, { recursive: true, force: true }).catch(() => {
+    await rm4(stagingPath, { recursive: true, force: true }).catch(() => {
     });
     throw err;
   }
@@ -15693,7 +16080,7 @@ async function restoreFromGithub(overrides) {
     };
   } finally {
     if (tmpDir) {
-      await rm3(tmpDir, { recursive: true, force: true }).catch(() => {
+      await rm4(tmpDir, { recursive: true, force: true }).catch(() => {
       });
     }
     await releaseLock(lockPath);
@@ -15701,7 +16088,7 @@ async function restoreFromGithub(overrides) {
 }
 async function getBackupStatus() {
   const config = await readConfig();
-  const lockPath = resolve27(syntaurRoot(), LOCK_FILE_NAME);
+  const lockPath = resolve28(syntaurRoot(), LOCK_FILE_NAME);
   const locked = await fileExists(lockPath);
   return {
     repo: config.backup?.repo ?? null,
@@ -15714,7 +16101,7 @@ async function getBackupStatus() {
 
 // src/dashboard/api-backup.ts
 function createBackupRouter() {
-  const router = Router17();
+  const router = Router18();
   router.get("/", async (_req, res) => {
     try {
       const status = await getBackupStatus();
@@ -16049,7 +16436,7 @@ function createDashboardServer(options) {
   (async () => {
     try {
       const configResult = await migrateLegacyConfig(
-        resolve28(syntaurRoot(), "config.md")
+        resolve29(syntaurRoot(), "config.md")
       );
       const projectResult = await migrateLegacyProjectFiles(projectsDir);
       const summary = summarizeMigration(projectResult, configResult);
@@ -16150,8 +16537,8 @@ function createDashboardServer(options) {
   });
   app.put("/api/config/hotkeys", async (req, res) => {
     try {
-      const raw = req.body && typeof req.body === "object" ? req.body : {};
-      const incoming = raw.bindings;
+      const raw2 = req.body && typeof req.body === "object" ? req.body : {};
+      const incoming = raw2.bindings;
       if (!incoming || typeof incoming !== "object" || Array.isArray(incoming)) {
         res.status(400).json({ error: "bindings must be an object keyed by action kind" });
         return;
@@ -16567,14 +16954,14 @@ function createDashboardServer(options) {
   app.use("/api/backup", createBackupRouter());
   if (serveStaticUi && dashboardDistPath) {
     const sendOpts = { dotfiles: "allow" };
-    app.use("/assets", express.static(resolve28(dashboardDistPath, "assets"), sendOpts));
+    app.use("/assets", express.static(resolve29(dashboardDistPath, "assets"), sendOpts));
     app.use(express.static(dashboardDistPath, { ...sendOpts, index: false, fallthrough: true }));
     app.get("{*path}", async (req, res) => {
       if (req.path.startsWith("/api") || req.path === "/ws" || req.path.startsWith("/assets")) {
         res.status(404).json({ error: "Not Found" });
         return;
       }
-      const indexPath = resolve28(dashboardDistPath, "index.html");
+      const indexPath = resolve29(dashboardDistPath, "index.html");
       if (!await fileExists(indexPath)) {
         res.status(503).send(
           'Dashboard not built. Run "npm run build:dashboard" first.'
@@ -16598,7 +16985,7 @@ function createDashboardServer(options) {
         serversDir: serversDir2,
         playbooksDir: playbooksDir2,
         todosDir: todosDir2,
-        dbPath: resolve28(syntaurRoot(), "syntaur.db"),
+        dbPath: resolve29(syntaurRoot(), "syntaur.db"),
         onMessage: broadcast
       });
       startAutodiscovery({ serversDir: serversDir2, projectsDir, assignmentsDir: assignmentsDir2, excludePids: /* @__PURE__ */ new Set([process.pid]) });
@@ -16613,8 +17000,8 @@ function createDashboardServer(options) {
           }
         });
         server.listen(port, () => {
-          const portFile = resolve28(syntaurRoot(), "dashboard-port");
-          writeFile6(portFile, String(port), "utf-8").catch(() => {
+          const portFile = resolve29(syntaurRoot(), "dashboard-port");
+          writeFile7(portFile, String(port), "utf-8").catch(() => {
           });
           resolvePromise();
         });
@@ -16632,8 +17019,8 @@ function createDashboardServer(options) {
         client.terminate();
       }
       clients.clear();
-      const portFile = resolve28(syntaurRoot(), "dashboard-port");
-      await unlink6(portFile).catch(() => {
+      const portFile = resolve29(syntaurRoot(), "dashboard-port");
+      await unlink7(portFile).catch(() => {
       });
       server.closeAllConnections?.();
       return new Promise((resolvePromise) => {