taskchef 3.0.3 → 4.0.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "3.0.3",
+  "version": "4.0.0",
   "description": "Dispatch work from a data-only workspace to visible Codex project tasks.",
   "author": {
     "name": "Favo Yang",

package/README.md

@@ -73,11 +73,13 @@ tasks.jsonl
 TaskChef scans eligible local Codex projects during setup and adds them to the
 managed project list in `taskchef.json`.
 
-`taskchef.json` defines the available routes. A project name or GitHub pull
-request URL in your request is usually enough for TaskChef to choose the right
-project. If a project needs more context, extend its optional `description`
-field with responsibilities and keywords that distinguish it from nearby
-projects.
+`taskchef.json` defines the available routes. A project name or GitHub issue or
+pull-request URL in your request is usually enough for TaskChef to choose the
+right project. Each project's `githubRepos` field is a list. A managed
+`*-workspace` project lists all child or sub-repositories there, so links into
+any of them route to the workspace. If a project needs more context, extend its
+optional `description` field with responsibilities and keywords that
+distinguish it from nearby projects.
 
 The generated `AGENTS.md` turns ordinary requests in this project into
 delegated work. You do not need to name the delegate skill each time.
@@ -161,7 +163,8 @@ $taskchef-bootstrap Diagnose this TaskChef workspace and fix any repairable conf
 Project paths must exist when you add or dispatch to them. Configure the
 repository root for a Git project. TaskChef also accepts non-Git folders. It
 detects Git status and the canonical GitHub `origin` when adding or importing
-a project.
+a project. Repeat `--github-repo` to configure several repositories, or place a
+`githubRepos` array in an import. URLs are canonicalized and deduplicated.
 
 Removing a project does not rewrite old task entries. Each entry keeps the
 project metadata that TaskChef used when it delegated the work.
@@ -242,6 +245,8 @@ taskchef doctor --workspace <workspace>
 taskchef project add /workspace/payments \
   --name payments \
   --description "Owns payment authorization, capture, and refunds." \
+  --github-repo https://github.com/example/payments-api \
+  --github-repo https://github.com/example/payments-sdk \
   --workspace <workspace>
 
 taskchef project list --workspace <workspace>
@@ -255,9 +260,15 @@ taskchef project import projects.json --workspace <workspace>
 taskchef project import - --workspace <workspace> < projects.json
 ```
 
-Import merges by canonical path and preserves an existing name or description
-when the imported object omits it. `--replace` replaces the configured project
-set.
+Import merges by canonical path, preserves an existing name or description
+when the imported object omits it, and unions repository lists without
+duplicates. `--replace` replaces the configured project set.
+
+The current configuration schema is version 2. Version 1 remains readable:
+legacy `githubRepo: null` normalizes to `githubRepos: []`, and a legacy string
+normalizes to a one-item `githubRepos` list. `workspace init` persists this
+migration atomically; other configuration writes also emit version 2. Legacy
+task lines remain readable without an eager rewrite of the append-only history.
 
 ### Task history
 

package/SPEC.md

@@ -54,20 +54,23 @@ the workspace.
 
 ```json
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "projects": [
     {
       "name": "payments-api",
       "path": "/workspace/payments-api",
       "isGitRepository": true,
-      "githubRepo": "https://github.com/example/payments-api",
+      "githubRepos": [
+        "https://github.com/example/payments-api",
+        "https://github.com/example/payments-sdk"
+      ],
       "description": "Owns payment authorization, capture, refunds, and provider integrations."
     },
     {
       "name": "local-data-tools",
       "path": "/workspace/local-data-tools",
       "isGitRepository": false,
-      "githubRepo": null
+      "githubRepos": []
     }
   ]
 }
@@ -79,18 +82,31 @@ the workspace.
 - `path` is the normalized, canonical local directory. A Git project must use
   its repository root.
 - `isGitRepository` identifies Git and non-Git projects.
-- `githubRepo` is a canonical GitHub repository URL or `null`.
+- `githubRepos` is a deduplicated list of canonical GitHub repository URLs. Use
+  `[]` when the project advertises no repositories. A managed `*-workspace`
+  project lists each child or sub-repository that should route to it.
 - `description` is optional routing context.
 
-TaskChef classifies work against `name`, `githubRepo`, and `description`. The
-path identifies the checkout but is not a routing hint. TaskChef asks the user
-when metadata does not produce one clear match.
+TaskChef classifies work against `name`, every URL in `githubRepos`, and
+`description`. The path identifies the checkout but is not a routing hint. For
+a GitHub issue or pull-request URL, TaskChef compares canonical,
+case-insensitive owner/repository identities across every configured list. It
+ignores the issue or PR suffix, `http` versus `https`, optional `www`, trailing
+slashes, and trailing `.git`. It routes only when one configured project
+matches; ambiguous and unmatched URLs are never guessed.
 
 `project add` and `project import` detect Git status, exact Git roots, and
-canonical GitHub origins. Import merges by canonical path and preserves an
-existing name or description when omitted. `--replace` replaces the configured
-set. Removing or replacing a project does not alter historical task
-entries.
+canonical GitHub origins. `--github-repo` is repeatable. Import merges by
+canonical path, preserves an existing name or description when omitted, and
+unions existing and imported repository lists without duplicates. `--replace`
+replaces the configured set. Removing or replacing a project does not alter
+historical task entries.
+
+Schema version 2 replaces the string-or-null `githubRepo` field with the
+list-valued `githubRepos` field. Schema-version-1 configurations remain
+compatible: reads normalize a legacy string to one canonical list item and
+legacy `null` to `[]`; `workspace init` persists the migration atomically, and
+any later configuration write emits version 2.
 
 The configuration does not store dispatcher identity, execution modes,
 schedules, task status, results, host information, or the workspace path.
@@ -100,7 +116,7 @@ schedules, task status, results, host information, or the workspace path.
 `tasks.jsonl` contains one compact JSON object per line, in append order:
 
 ```json
-{"schemaVersion":1,"id":"c0f010ff-84f2-4838-a69d-0ff1f5d721d7","project":{"name":"payments-api","path":"/workspace/payments-api","isGitRepository":true,"githubRepo":"https://github.com/example/payments-api","description":"Owns payment authorization, capture, refunds, and provider integrations."},"title":"Add payment retry logs","instruction":"# taskchef_id=c0f010ff-84f2-4838-a69d-0ff1f5d721d7\n\nAdd structured logs for failed payment retries and test them.","threadId":"019f9d46-f42c-7482-9707-3c107bf241ee","createdAt":"2026-08-08T10:00:00.000Z"}
+{"schemaVersion":2,"id":"c0f010ff-84f2-4838-a69d-0ff1f5d721d7","project":{"name":"payments-api","path":"/workspace/payments-api","isGitRepository":true,"githubRepos":["https://github.com/example/payments-api","https://github.com/example/payments-sdk"],"description":"Owns payment authorization, capture, refunds, and provider integrations."},"title":"Add payment retry logs","instruction":"# taskchef_id=c0f010ff-84f2-4838-a69d-0ff1f5d721d7\n\nAdd structured logs for failed payment retries and test them.","threadId":"019f9d46-f42c-7482-9707-3c107bf241ee","createdAt":"2026-08-08T10:00:00.000Z"}
 ```
 
 - `schemaVersion` identifies the task entry format.
@@ -129,6 +145,11 @@ The project snapshot preserves the route even if the project is renamed,
 moved, or removed later. Entries never contain status, result, transcript,
 hidden reasoning, `hostId`, or update timestamps.
 
+New task entries use schema version 2 and list-valued project snapshots.
+Version 1 entries with string or null repository metadata remain readable and
+normalize to version 2 in API and CLI output. TaskChef does not eagerly rewrite
+legacy history solely for this migration.
+
 ## Dispatch workflow
 
 For each assignment, `$taskchef-delegate`:

package/assets/taskchef-dispatcher-instructions.md

@@ -9,6 +9,8 @@ This repository is a TaskChef dispatcher workspace.
 - For every actionable work request, use `$taskchef-delegate`
   automatically, even when the user does not explicitly say "delegate" or
   mention TaskChef.
+- GitHub issue and pull-request URLs may identify any repository advertised by
+  a configured project, including child repositories of managed workspaces.
 - Do not perform delegated work directly in the dispatcher thread.
 - Return immediately after dispatch, as required by `$taskchef-delegate`.
 - Answer directly only when the user explicitly asks about TaskChef itself or

package/index.js

@@ -20,6 +20,12 @@ export {
   validateConfig,
 } from "./src/workspace.js";
 
+export {
+  canonicalGithubRepository,
+  matchProjectForGithubUrl,
+  normalizeGithubRepositories,
+} from "./src/github.js";
+
 export {
   THREAD_RESOLUTION_CHECKPOINTS_MS,
   THREAD_RESOLUTION_CLOCK_SKEW_MS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "3.0.3",
+  "version": "4.0.0",
   "description": "A non-blocking interactive dispatcher for visible Codex tasks.",
   "license": "MIT",
   "author": "Favo Yang",

package/skills/taskchef-bootstrap/SKILL.md

@@ -39,12 +39,34 @@ all deterministic workspace operations.
    projects are outside the v1 contract.
 2. Add one project with `project add <path>`, normally supplying `--name` and a
    curated `--description`. The CLI detects Git status, exact Git root, and a
-   canonical GitHub `origin`. Use `--no-github` or `--github-repo` only to
-   override detection.
+   canonical GitHub `origin`. Repeat `--github-repo <url>` to advertise several
+   repositories, or use `--no-github` for an empty list. A managed
+   `*-workspace` project must list all of its child or sub-repositories so issue
+   and pull-request URLs route to that workspace.
 3. Bulk import with `project import <file|-> --json`. Input is a JSON array of
    objects containing `path` plus optional `name`, `description`, and
-   `githubRepo`. Import merges by canonical path and preserves an existing name
-   or description when omitted. Use `--replace` only when the user explicitly
-   requests replacement.
+   `githubRepos`, which is always a JSON array of GitHub repository URLs. Import
+   merges by canonical path, preserves an existing name or description when
+   omitted, and unions existing and imported repository lists without
+   duplicates. Use `--replace` only when the user explicitly requests
+   replacement.
 4. Inspect configured projects with `project list --json`. Remove by name with
    `project remove`. Existing task entries keep their project snapshots.
+
+Example managed-workspace import entry:
+
+```json
+{
+  "name": "skills-workspace",
+  "path": "/workspace/skills-workspace",
+  "githubRepos": [
+    "https://github.com/example/skill-one",
+    "https://github.com/example/skill-two"
+  ],
+  "description": "Manages the listed child skill repositories."
+}
+```
+
+`workspace init` safely migrates schema-version-1 configuration: a string
+`githubRepo` becomes a one-item `githubRepos` list and `null` becomes
+`githubRepos: []`. All subsequent configuration writes use schema version 2.

package/skills/taskchef-delegate/SKILL.md

@@ -32,9 +32,15 @@ for all deterministic workspace and task-record operations.
    `$taskchef-bootstrap` if the workspace is missing or unhealthy.
 2. Split the request into the smallest independently useful outcomes. Include
    constraints, expected testing, and reporting in every instruction.
-3. Classify against configured `name`, `githubRepo`, and `description`. Use
-   `path` only as checkout identity. Ask when metadata does not produce one
-   clear project match.
+3. Classify against configured `name`, every URL in the `githubRepos` list, and
+   `description`. Use `path` only as checkout identity. Managed `*-workspace`
+   projects advertise their child or sub-repositories in this list.
+   When the prompt contains a GitHub issue or pull-request URL, canonicalize
+   its case-insensitive owner/repository identity, ignoring `http` versus
+   `https`, an optional `www`, a trailing slash or `.git`, and the issue or PR
+   suffix. Check that identity against every repository URL of every configured
+   project. Route on this evidence only when exactly one configured project
+   matches. Ask instead of guessing when no project or several projects match.
 4. Resolve native projects once and require the exact configured path.
 5. Generate a lowercase full UUID task ID before creation. Prefix the complete
    executor instruction with exactly `# taskchef_id=<full UUID>`, followed by a
@@ -97,11 +103,12 @@ for all deterministic workspace and task-record operations.
     not read an executor for progress and never wait for executor work
     completion.
 
-The package exports pure marker, candidate-filtering, and injected-adapter
-orchestration helpers from `src/delegation.js` for deterministic tests and
-hosts that can supply thread-tool callbacks. The standalone Node CLI cannot
-call desktop thread tools; perform the tool calls in Codex and use the CLI only
-for validated workspace data operations.
+The package exports pure repository canonicalization and unique URL matching
+helpers from `src/github.js`, plus marker, candidate-filtering, and
+injected-adapter orchestration helpers from `src/delegation.js`, for
+deterministic tests and hosts that can supply thread-tool callbacks. The
+standalone Node CLI cannot call desktop thread tools; perform the tool calls in
+Codex and use the CLI only for validated workspace data operations.
 
 ## Later resolution
 

package/src/cli.js

@@ -37,6 +37,14 @@ function option(args, name, fallback) {
   return args[index + 1];
 }
 
+function options(args, name) {
+  const values = [];
+  for (let index = 0; index < args.length; index += 1) {
+    if (args[index] === name) values.push(args[index + 1]);
+  }
+  return values;
+}
+
 function validateCommandArgs(
   args,
   startIndex,
@@ -113,6 +121,7 @@ async function projectAdd(args) {
   validateCommandArgs(args, 3, {
     values: ["--workspace", "--name", "--description", "--github-repo"],
     switches: ["--json", "--no-github"],
+    repeatable: ["--github-repo"],
   });
   if (args.includes("--no-github") && args.includes("--github-repo")) {
     throw new Error("--no-github and --github-repo cannot be used together");
@@ -122,8 +131,8 @@ async function projectAdd(args) {
   const description = option(args, "--description", null);
   if (name !== null) input.name = name;
   if (description !== null) input.description = description;
-  if (args.includes("--no-github")) input.githubRepo = null;
-  else if (args.includes("--github-repo")) input.githubRepo = option(args, "--github-repo");
+  if (args.includes("--no-github")) input.githubRepos = [];
+  else if (args.includes("--github-repo")) input.githubRepos = options(args, "--github-repo");
   const project = await addProject(workspaceRoot(args), input);
   print(project, args, (value) => `Added ${value.name}: ${value.path}`);
   return 0;
@@ -152,10 +161,11 @@ async function projectList(args) {
   validateCommandArgs(args, 2, { values: ["--workspace"], switches: ["--json"] });
   const projects = await listProjects(workspaceRoot(args));
   print({ projectCount: projects.length, projects }, args, (value) => table(
-    ["NAME", "KIND", "PATH"],
+    ["NAME", "KIND", "GITHUB REPOSITORIES", "PATH"],
     value.projects.map((project) => [
       project.name,
       project.isGitRepository ? "git" : "folder",
+      project.githubRepos.join(", ") || "-",
       project.path,
     ]),
   ));
@@ -240,7 +250,7 @@ Usage:
   taskchef help
   taskchef doctor [--json] [--workspace <path>]
   taskchef workspace init [--json] [--workspace <path>]
-  taskchef project add <path> [--name <name>] [--description <text>] [--github-repo <url> | --no-github] [--json] [--workspace <path>]
+  taskchef project add <path> [--name <name>] [--description <text>] [--github-repo <url> ... | --no-github] [--json] [--workspace <path>]
   taskchef project import [<file> | -] [--replace] [--json] [--workspace <path>]
   taskchef project list [--json] [--workspace <path>]
   taskchef project remove <name> [--json] [--workspace <path>]

package/src/github.js

@@ -0,0 +1,108 @@
+function requireRepositoryString(value, name) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error(`${name} must be a non-empty string`);
+  }
+  return value.trim();
+}
+
+function parseGithubUrl(value, name, { allowIssueOrPull = false } = {}) {
+  let remote = requireRepositoryString(value, name);
+  const scpMatch = remote.match(/^git@github\.com:([^/]+)\/([^/]+)\/?$/i);
+  if (scpMatch) {
+    return {
+      owner: scpMatch[1],
+      repository: scpMatch[2].replace(/\.git$/i, ""),
+    };
+  }
+  if (/^(?:www\.)?github\.com\//i.test(remote)) remote = `https://${remote}`;
+  let url;
+  try {
+    url = new URL(remote);
+  } catch {
+    throw new Error(`${name} must be a GitHub repository URL`);
+  }
+  if (
+    !["https:", "http:", "ssh:", "git:"].includes(url.protocol)
+    || !["github.com", "www.github.com"].includes(url.hostname.toLowerCase())
+    || (url.username && !(url.protocol === "ssh:" && url.username === "git"))
+    || url.password
+    || url.port
+    || (!allowIssueOrPull && (url.search || url.hash))
+  ) {
+    throw new Error(`${name} must be a GitHub repository URL`);
+  }
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments.length < 2) throw new Error(`${name} must identify one GitHub repository`);
+  const suffix = segments.slice(2);
+  if (
+    (!allowIssueOrPull && suffix.length > 0)
+    || (
+      allowIssueOrPull
+      && suffix.length > 0
+      && !(suffix.length >= 2 && ["issues", "pull"].includes(suffix[0]) && /^\d+$/.test(suffix[1]))
+    )
+  ) {
+    throw new Error(`${name} must identify one GitHub repository`);
+  }
+  return {
+    owner: segments[0],
+    repository: segments[1].replace(/\.git$/i, ""),
+  };
+}
+
+export function canonicalGithubRepository(value, name = "githubRepos") {
+  const { owner, repository } = parseGithubUrl(value, name);
+  if (repository.length === 0) throw new Error(`${name} must identify one GitHub repository`);
+  return `https://github.com/${owner}/${repository}`;
+}
+
+export function normalizeGithubRepositories(
+  value,
+  name = "githubRepos",
+  { allowLegacyScalar = false } = {},
+) {
+  if (allowLegacyScalar && (value === null || typeof value === "string")) {
+    value = value === null ? [] : [value];
+  }
+  if (!Array.isArray(value)) throw new Error(`${name} must be an array of GitHub repository URLs`);
+  const repositories = [];
+  const seen = new Set();
+  for (const [index, repository] of value.entries()) {
+    const canonical = canonicalGithubRepository(repository, `${name}[${index}]`);
+    const key = canonical.toLowerCase();
+    if (!seen.has(key)) {
+      seen.add(key);
+      repositories.push(canonical);
+    }
+  }
+  return repositories;
+}
+
+export function matchProjectForGithubUrl(value, projects) {
+  if (!Array.isArray(projects)) throw new Error("projects must be an array");
+  let parsed;
+  try {
+    parsed = parseGithubUrl(value, "GitHub URL", { allowIssueOrPull: true });
+  } catch {
+    return { status: "unmatched", repository: null, projects: [] };
+  }
+  const repository = `https://github.com/${parsed.owner}/${parsed.repository}`;
+  const key = repository.toLowerCase();
+  const matches = projects.filter((project) =>
+    Array.isArray(project?.githubRepos)
+    && project.githubRepos.some((candidate) => {
+      try {
+        return canonicalGithubRepository(candidate).toLowerCase() === key;
+      } catch {
+        return false;
+      }
+    }));
+  if (matches.length === 1) {
+    return { status: "matched", repository, project: matches[0], projects: matches };
+  }
+  return {
+    status: matches.length > 1 ? "ambiguous" : "unmatched",
+    repository,
+    projects: matches,
+  };
+}

package/src/workspace.js

@@ -19,6 +19,10 @@ import path from "node:path";
 import { promisify } from "node:util";
 import lockfile from "proper-lockfile";
 import { normalizeDurableThreadId, parseTaskChefMarker } from "./delegation.js";
+import {
+  canonicalGithubRepository,
+  normalizeGithubRepositories,
+} from "./github.js";
 
 const execFile = promisify(execFileCallback);
 const DISPATCHER_INSTRUCTIONS_URL = new URL(
@@ -37,15 +41,18 @@ const SKILLS_SOURCE_ROOT = fileURLToPath(new URL("../skills/", import.meta.url))
 const DISPATCH_FILE_NAME = "tasks.jsonl";
 const DISPATCH_LOCK_NAME = ".taskchef-dispatch.lock";
 const SAFE_ID = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+const CURRENT_SCHEMA_VERSION = 2;
+const LEGACY_SCHEMA_VERSION = 1;
 const CONFIG_FIELDS = new Set(["schemaVersion", "projects"]);
 const PROJECT_FIELDS = new Set([
   "name",
   "path",
   "isGitRepository",
   "githubRepo",
+  "githubRepos",
   "description",
 ]);
-const PROJECT_INPUT_FIELDS = new Set(["name", "path", "githubRepo", "description"]);
+const PROJECT_INPUT_FIELDS = new Set(["name", "path", "githubRepos", "description"]);
 const DISPATCH_FIELDS = new Set([
   "schemaVersion",
   "id",
@@ -165,9 +172,9 @@ async function appendDispatchesAtomic(workspaceRoot, dispatches) {
   await writeTextAtomic(dispatchPath, `${content}${appended}`);
 }
 
-async function writeDispatchesAtomic(workspaceRoot, dispatches) {
+async function writeDispatchLinesAtomic(workspaceRoot, lines) {
   const dispatchPath = path.join(workspaceRoot, DISPATCH_FILE_NAME);
-  const content = dispatches.map((dispatch) => `${JSON.stringify(dispatch)}\n`).join("");
+  const content = lines.length === 0 ? "" : `${lines.join("\n")}\n`;
   await writeTextAtomic(dispatchPath, content);
 }
 
@@ -369,39 +376,23 @@ export async function canonicalDirectory(projectPath) {
   return requested;
 }
 
-function validateGithubRepository(value, name) {
-  if (value === null) return null;
-  requireString(value, name);
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`${name} must be a canonical GitHub repository URL or null`);
-  }
-  if (
-    url.protocol !== "https:" ||
-    url.hostname !== "github.com" ||
-    url.username ||
-    url.password ||
-    url.port ||
-    url.search ||
-    url.hash ||
-    !/^\/[^/]+\/[^/]+$/.test(url.pathname) ||
-    url.pathname.endsWith(".git")
-  ) {
-    throw new Error(`${name} must be a canonical GitHub repository URL or null`);
-  }
-  return value;
-}
-
-async function normalizeProject(project, index, { checkPath = true } = {}) {
+async function normalizeProject(
+  project,
+  index,
+  { checkPath = true, allowLegacyGithubRepo = false } = {},
+) {
   const field = `projects[${index}]`;
   if (!project || typeof project !== "object" || Array.isArray(project)) {
     throw new Error(`${field} must be an object`);
   }
   const unexpected = Object.keys(project).find((key) => !PROJECT_FIELDS.has(key));
   if (unexpected) throw new Error(`${field} has unsupported field: ${unexpected}`);
-  for (const required of ["name", "path", "isGitRepository", "githubRepo"]) {
+  const repositoryField = allowLegacyGithubRepo ? "githubRepo" : "githubRepos";
+  const unsupportedRepositoryField = allowLegacyGithubRepo ? "githubRepos" : "githubRepo";
+  if (unsupportedRepositoryField in project) {
+    throw new Error(`${field} has unsupported field: ${unsupportedRepositoryField}`);
+  }
+  for (const required of ["name", "path", "isGitRepository", repositoryField]) {
     if (!(required in project)) throw new Error(`${field} is missing field: ${required}`);
   }
   const name = requireString(project.name, `${field}.name`).trim();
@@ -419,15 +410,14 @@ async function normalizeProject(project, index, { checkPath = true } = {}) {
       throw new Error(`${field}.path must be a normalized absolute path`);
     }
   }
-  const githubRepo = validateGithubRepository(project.githubRepo, `${field}.githubRepo`);
-  if (!project.isGitRepository && githubRepo !== null) {
-    throw new Error(`${field}.githubRepo must be null for a non-Git project`);
-  }
+  const githubRepos = normalizeGithubRepositories(project[repositoryField], `${field}.${repositoryField}`, {
+    allowLegacyScalar: allowLegacyGithubRepo,
+  });
   const normalized = {
     name,
     path: projectPath,
     isGitRepository: project.isGitRepository,
-    githubRepo,
+    githubRepos,
   };
   if ("description" in project) {
     normalized.description = requireString(
@@ -438,11 +428,17 @@ async function normalizeProject(project, index, { checkPath = true } = {}) {
   return normalized;
 }
 
-async function normalizeProjects(projects, { checkPaths = true } = {}) {
+async function normalizeProjects(
+  projects,
+  { checkPaths = true, allowLegacyGithubRepo = false } = {},
+) {
   if (!Array.isArray(projects)) throw new Error("projects must be an array");
   const normalized = [];
   for (const [index, project] of projects.entries()) {
-    normalized.push(await normalizeProject(project, index, { checkPath: checkPaths }));
+    normalized.push(await normalizeProject(project, index, {
+      checkPath: checkPaths,
+      allowLegacyGithubRepo,
+    }));
   }
   if (new Set(normalized.map((project) => project.path)).size !== normalized.length) {
     throw new Error("project paths must not contain duplicates");
@@ -458,16 +454,8 @@ async function normalizeProjects(projects, { checkPaths = true } = {}) {
 
 function normalizeGithubRemote(remote) {
   if (typeof remote !== "string" || remote.trim().length === 0) return null;
-  const value = remote.trim();
-  const scpMatch = value.match(/^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/);
-  if (scpMatch) return `https://github.com/${scpMatch[1]}/${scpMatch[2]}`;
-  const sshMatch = value.match(/^ssh:\/\/git@github\.com\/([^/]+)\/(.+?)(?:\.git)?$/);
-  if (sshMatch) return `https://github.com/${sshMatch[1]}/${sshMatch[2]}`;
   try {
-    const url = new URL(value);
-    if (url.hostname !== "github.com") return null;
-    const match = url.pathname.match(/^\/([^/]+)\/([^/]+?)(?:\.git)?$/);
-    return match ? `https://github.com/${match[1]}/${match[2]}` : null;
+    return canonicalGithubRepository(remote, "GitHub origin");
   } catch {
     return null;
   }
@@ -507,10 +495,10 @@ async function inspectProject(input, index = 0) {
   if (isGitRepository && gitRoot !== projectPath) {
     throw new Error(`project must be the Git repository root: ${projectPath}`);
   }
-  let githubRepo = null;
+  let githubRepos = [];
   if (isGitRepository) {
-    if ("githubRepo" in input) {
-      githubRepo = validateGithubRepository(input.githubRepo, `${field}.githubRepo`);
+    if ("githubRepos" in input) {
+      githubRepos = normalizeGithubRepositories(input.githubRepos, `${field}.githubRepos`);
     } else {
       const remote = await execFile("git", ["remote", "get-url", "origin"], {
         cwd: projectPath,
@@ -518,10 +506,11 @@ async function inspectProject(input, index = 0) {
         if (error.code === 2 && /No such remote/i.test(error.stderr ?? "")) return null;
         throw gitInspectionError("failed to inspect GitHub origin", error);
       });
-      githubRepo = normalizeGithubRemote(remote);
+      const detected = normalizeGithubRemote(remote);
+      githubRepos = detected === null ? [] : [detected];
     }
-  } else if ("githubRepo" in input && input.githubRepo !== null) {
-    throw new Error(`${field}.githubRepo must be null for a non-Git project`);
+  } else if ("githubRepos" in input) {
+    githubRepos = normalizeGithubRepositories(input.githubRepos, `${field}.githubRepos`);
   }
   const project = {
     name: "name" in input
@@ -529,7 +518,7 @@ async function inspectProject(input, index = 0) {
       : path.basename(projectPath),
     path: projectPath,
     isGitRepository,
-    githubRepo,
+    githubRepos,
   };
   if ("description" in input) {
     project.description = requireString(input.description, `${field}.description`).trim();
@@ -539,10 +528,15 @@ async function inspectProject(input, index = 0) {
 
 export async function validateConfig(config, { checkPaths = true } = {}) {
   requireExactFields(config, CONFIG_FIELDS, "taskchef.json");
-  if (config.schemaVersion !== 1) throw new Error("unsupported configuration schemaVersion");
+  if (![LEGACY_SCHEMA_VERSION, CURRENT_SCHEMA_VERSION].includes(config.schemaVersion)) {
+    throw new Error("unsupported configuration schemaVersion");
+  }
   return {
-    schemaVersion: 1,
-    projects: await normalizeProjects(config.projects, { checkPaths }),
+    schemaVersion: CURRENT_SCHEMA_VERSION,
+    projects: await normalizeProjects(config.projects, {
+      checkPaths,
+      allowLegacyGithubRepo: config.schemaVersion === LEGACY_SCHEMA_VERSION,
+    }),
   };
 }
 
@@ -561,15 +555,21 @@ export async function initializeWorkspace(workspaceRoot) {
   const root = await realpath(requestedRoot);
   const configPath = path.join(root, "taskchef.json");
   const configExists = await managedRegularFileExists(configPath);
+  const storedConfigVersion = configExists
+    ? JSON.parse(await readFile(configPath, "utf8")).schemaVersion
+    : null;
   const config = configExists
     ? await readConfig(root, { checkPaths: false })
-    : { schemaVersion: 1, projects: [] };
+    : { schemaVersion: CURRENT_SCHEMA_VERSION, projects: [] };
   const dispatchPath = path.join(root, DISPATCH_FILE_NAME);
   if (configExists && (await managedRegularFileExists(dispatchPath))) {
     await readDispatchesUnlocked(root);
   }
   const { legacySkills } = await ensureWorkspaceSkills(root);
   if (!configExists) await writeJsonAtomic(configPath, config, { exclusive: true });
+  else if (storedConfigVersion !== CURRENT_SCHEMA_VERSION) {
+    await writeJsonAtomic(configPath, config);
+  }
   const tasks = await ensureDispatchFile(root);
   const instructions = await ensureWorkspaceInstructions(root).catch(async (error) => {
     if (!configExists) await unlink(configPath).catch(() => {});
@@ -577,7 +577,13 @@ export async function initializeWorkspace(workspaceRoot) {
   });
   return {
     workspace: root,
-    config: { path: configPath, action: configExists ? "unchanged" : "created", value: config },
+    config: {
+      path: configPath,
+      action: !configExists
+        ? "created"
+        : storedConfigVersion === CURRENT_SCHEMA_VERSION ? "unchanged" : "migrated",
+      value: config,
+    },
     tasks,
     instructions,
     legacySkills,
@@ -604,7 +610,7 @@ export async function addProject(workspaceRoot, input) {
   const config = await readConfig(root);
   const project = await inspectProject(input);
   const updated = await validateConfig({
-    schemaVersion: 1,
+    schemaVersion: CURRENT_SCHEMA_VERSION,
     projects: [...config.projects, project],
   });
   await writeJsonAtomic(path.join(root, "taskchef.json"), updated);
@@ -624,6 +630,12 @@ export async function importProjects(workspaceRoot, inputs, { replace = false }
     if (!("description" in mergedInput) && existing?.description) {
       mergedInput.description = existing.description;
     }
+    if (existing && !replace) {
+      const importedRepositories = "githubRepos" in mergedInput
+        ? normalizeGithubRepositories(mergedInput.githubRepos, `projects[${index}].githubRepos`)
+        : [];
+      mergedInput.githubRepos = [...existing.githubRepos, ...importedRepositories];
+    }
     imported.push(await inspectProject(mergedInput, index));
   }
   const projects = replace ? [] : [...current.projects];
@@ -632,7 +644,7 @@ export async function importProjects(workspaceRoot, inputs, { replace = false }
     if (index === -1) projects.push(project);
     else projects[index] = project;
   }
-  const config = await validateConfig({ schemaVersion: 1, projects });
+  const config = await validateConfig({ schemaVersion: CURRENT_SCHEMA_VERSION, projects });
   await writeJsonAtomic(path.join(root, "taskchef.json"), config);
   return {
     mode: replace ? "replace" : "merge",
@@ -651,17 +663,25 @@ export async function removeProject(workspaceRoot, name) {
   if (index === -1) throw new Error(`configured project not found: ${name}`);
   const [project] = config.projects.slice(index, index + 1);
   const projects = config.projects.filter((_, projectIndex) => projectIndex !== index);
-  await writeJsonAtomic(path.join(root, "taskchef.json"), { schemaVersion: 1, projects });
+  await writeJsonAtomic(path.join(root, "taskchef.json"), {
+    schemaVersion: CURRENT_SCHEMA_VERSION,
+    projects,
+  });
   return { project };
 }
 
 async function validateDispatchShape(dispatch, name = "task") {
   requireExactFields(dispatch, DISPATCH_FIELDS, name);
-  if (dispatch.schemaVersion !== 1) throw new Error(`unsupported ${name} schemaVersion`);
+  if (![LEGACY_SCHEMA_VERSION, CURRENT_SCHEMA_VERSION].includes(dispatch.schemaVersion)) {
+    throw new Error(`unsupported ${name} schemaVersion`);
+  }
   const id = requireSafeId(dispatch.id, `${name}.id`);
-  const project = await normalizeProject(dispatch.project, 0, { checkPath: false });
+  const project = await normalizeProject(dispatch.project, 0, {
+    checkPath: false,
+    allowLegacyGithubRepo: dispatch.schemaVersion === LEGACY_SCHEMA_VERSION,
+  });
   const normalized = {
-    schemaVersion: 1,
+    schemaVersion: CURRENT_SCHEMA_VERSION,
     id,
     project,
     title: requireString(dispatch.title, `${name}.title`).trim(),
@@ -680,7 +700,7 @@ async function validateDispatchShape(dispatch, name = "task") {
   return normalized;
 }
 
-async function readDispatchesUnlocked(root) {
+async function readDispatchRecordsUnlocked(root) {
   await readConfig(root, { checkPaths: false });
   const filePath = path.join(root, DISPATCH_FILE_NAME);
   if (!(await managedRegularFileExists(filePath))) {
@@ -691,7 +711,7 @@ async function readDispatchesUnlocked(root) {
     throw new Error(`${DISPATCH_FILE_NAME} must end with a newline`);
   }
   const lines = content.length === 0 ? [] : content.slice(0, -1).split("\n");
-  const dispatches = [];
+  const records = [];
   for (const [index, line] of lines.entries()) {
     if (line.trim().length === 0) {
       throw new Error(`${DISPATCH_FILE_NAME} line ${index + 1} is empty`);
@@ -702,11 +722,15 @@ async function readDispatchesUnlocked(root) {
     } catch (error) {
       throw new Error(`${DISPATCH_FILE_NAME} line ${index + 1} is invalid JSON: ${error.message}`);
     }
-    dispatches.push(await validateDispatchShape(value, `task line ${index + 1}`));
+    records.push({
+      line,
+      raw: value,
+      normalized: await validateDispatchShape(value, `task line ${index + 1}`),
+    });
   }
   const ids = new Set();
   const threadIds = new Set();
-  for (const dispatch of dispatches) {
+  for (const { normalized: dispatch } of records) {
     if (ids.has(dispatch.id)) throw new Error(`duplicate task ID: ${dispatch.id}`);
     if (dispatch.threadId !== null && threadIds.has(dispatch.threadId)) {
       throw new Error(`duplicate task threadId: ${dispatch.threadId}`);
@@ -714,7 +738,11 @@ async function readDispatchesUnlocked(root) {
     ids.add(dispatch.id);
     if (dispatch.threadId !== null) threadIds.add(dispatch.threadId);
   }
-  return dispatches;
+  return records;
+}
+
+async function readDispatchesUnlocked(root) {
+  return (await readDispatchRecordsUnlocked(root)).map((record) => record.normalized);
 }
 
 export async function listTasks(workspaceRoot) {
@@ -730,7 +758,7 @@ export async function recordTask(workspaceRoot, input, { now } = {}) {
   const project = config.projects.find((candidate) => candidate.path === projectPath);
   if (!project) throw new Error(`project is not configured in taskchef.json: ${projectPath}`);
   const dispatch = await validateDispatchShape({
-    schemaVersion: 1,
+    schemaVersion: CURRENT_SCHEMA_VERSION,
     id: input.id,
     project,
     title: input.title,
@@ -759,7 +787,8 @@ export async function resolveTask(workspaceRoot, taskId, threadId) {
   const durableThreadId = normalizeDurableThreadId(threadId);
   const root = await realpath(path.resolve(workspaceRoot));
   return withDispatchLock(root, async () => {
-    const dispatches = await readDispatchesUnlocked(root);
+    const records = await readDispatchRecordsUnlocked(root);
+    const dispatches = records.map((record) => record.normalized);
     const index = dispatches.findIndex((dispatch) => dispatch.id === id);
     if (index === -1) throw new Error(`task not found: ${id}`);
     const dispatch = dispatches[index];
@@ -774,8 +803,10 @@ export async function resolveTask(workspaceRoot, taskId, threadId) {
       throw new Error(`threadId is already recorded: ${durableThreadId}`);
     }
     const resolved = { ...dispatch, threadId: durableThreadId };
-    dispatches[index] = resolved;
-    await writeDispatchesAtomic(root, dispatches);
+    const lines = records.map((record, recordIndex) => recordIndex === index
+      ? JSON.stringify({ ...record.raw, threadId: durableThreadId })
+      : record.line);
+    await writeDispatchLinesAtomic(root, lines);
     return resolved;
   });
 }