T1/Phase 1: scaffold Vite SPA + Hono API + Bun worker

- apps/web: Vite + React 19 + TanStack Router/Query + shadcn/ui - apps/api: Hono + Bun on :3001 with /api/health, /api/auth/*, /mcp stubs - apps/worker: Bun worker stub, DB connection, graceful SIGTERM - apps/web-legacy/: old Next.js code moved aside (preserved for T2-T8 reference) - Dockerfiles: api (Bun), worker (Bun), spa (multi-stage Caddy) - Caddyfile: serves dist + reverse-proxies /api/* + /mcp to api - docker-compose.yml: 4-service target (api, spa, db, worker) - packages/db/src/client.ts: shared Drizzle client for api + worker - db/client.ts: root-level alias for convenience Parent: t_e1cbd87d -> t_24c9c3fd (T0)
2026-08-01 01:15:31 +00:00
parent 9203aee758
commit fca56ab77e
312 changed files with 3489 additions and 196 deletions
@@ -0,0 +1,90 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, tasks } from '@project-e/db';
+import { and, eq, isNull } from 'drizzle-orm';
+import { RRule } from 'rrule';
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// POST /api/domains/[domainId]/tasks/[id]/complete — Mark task as done
+export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [existing] = await db.select()
+    .from(tasks)
+    .where(and(eq(tasks.id, id), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+    .limit(1);
+
+  if (!existing) {
+    return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+  }
+
+  const [updated] = await db.update(tasks)
+    .set({
+      status: 'done',
+      completedAt: new Date(),
+      updatedAt: new Date(),
+    })
+    .where(eq(tasks.id, id))
+    .returning();
+
+  await recordActivity({
+    actor: user.name,
+    action: 'completed',
+    entityType: 'task',
+    entityId: id,
+    changes: { previousStatus: existing.status },
+    workspaceId: domainId,
+  });
+
+  // Auto-create next recurring instance if recurrenceRule is set
+  if (existing.recurrenceRule) {
+    try {
+      const rule = RRule.fromString(existing.recurrenceRule);
+      const nextOccurrence = rule.after(new Date(), true);
+
+      if (nextOccurrence) {
+        const [spawned] = await db.insert(tasks).values({
+          title: existing.title,
+          description: existing.description,
+          status: 'todo',
+          priority: existing.priority,
+          domainId: existing.domainId,
+          projectId: existing.projectId,
+          sectionId: existing.sectionId,
+          parentId: existing.parentId,
+          dueDate: nextOccurrence,
+          estimatedMinutes: existing.estimatedMinutes,
+          order: existing.order,
+          customFields: existing.customFields ?? {},
+          recurrenceRule: existing.recurrenceRule,
+        }).returning();
+
+        await recordActivity({
+          actor: user.name,
+          action: 'created',
+          entityType: 'task',
+          entityId: spawned.id,
+          changes: {
+            title: spawned.title,
+            note: 'Auto-created from recurring task',
+            sourceTaskId: id,
+          },
+          workspaceId: domainId,
+        });
+      }
+    } catch (err) {
+      console.error('[tasks complete] Failed to spawn recurring instance:', err);
+      // Don't fail the completion — the original task is already marked done
+    }
+  }
+
+  return NextResponse.json(updated);
+});
@@ -0,0 +1,162 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, tasks, taskDependencies } from '@project-e/db';
+import { and, eq, isNull } from 'drizzle-orm';
+import { z } from 'zod';
+
+const addDependencySchema = z.object({
+  taskId: z.string().uuid(),
+});
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+/**
+ * Cycle detection: check if adding dep (taskId -> dependsOnTaskId) would create a cycle.
+ * Uses BFS from dependsOnTaskId following the dependency chain.
+ */
+async function wouldCreateCycle(taskId: string, dependsOnTaskId: string): Promise<boolean> {
+  if (taskId === dependsOnTaskId) return true;
+
+  // BFS: follow dependencies from dependsOnTaskId to see if we reach taskId
+  const visited = new Set<string>();
+  const queue = [dependsOnTaskId];
+
+  while (queue.length > 0) {
+    const current = queue.shift()!;
+    if (current === taskId) return true;
+    if (visited.has(current)) continue;
+    visited.add(current);
+
+    const deps = await db.select({ dependsOnTaskId: taskDependencies.dependsOnTaskId })
+      .from(taskDependencies)
+      .where(eq(taskDependencies.taskId, current));
+
+    for (const dep of deps) {
+      if (!visited.has(dep.dependsOnTaskId)) {
+        queue.push(dep.dependsOnTaskId);
+      }
+    }
+  }
+
+  return false;
+}
+
+// POST /api/domains/[domainId]/tasks/[id]/dependencies — Add a dependency
+export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = addDependencySchema.parse(body);
+
+    // Verify both tasks exist
+    const [task] = await db.select()
+      .from(tasks)
+      .where(and(eq(tasks.id, id), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+      .limit(1);
+
+    if (!task) {
+      return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+    }
+
+    const [depTask] = await db.select()
+      .from(tasks)
+      .where(and(eq(tasks.id, data.taskId), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+      .limit(1);
+
+    if (!depTask) {
+      return createErrorResponse('NOT_FOUND', 'Dependency task not found', 404);
+    }
+
+    // Cycle detection
+    const cycle = await wouldCreateCycle(id, data.taskId);
+    if (cycle) {
+      return createErrorResponse('CONFLICT', 'Adding this dependency would create a cycle', 400);
+    }
+
+    // Check if dependency already exists
+    const [existing] = await db.select()
+      .from(taskDependencies)
+      .where(and(eq(taskDependencies.taskId, id), eq(taskDependencies.dependsOnTaskId, data.taskId)))
+      .limit(1);
+
+    if (existing) {
+      return createErrorResponse('CONFLICT', 'Dependency already exists', 409);
+    }
+
+    await db.insert(taskDependencies).values({
+      taskId: id,
+      dependsOnTaskId: data.taskId,
+    });
+
+    await recordActivity({
+      actor: user.name,
+      action: 'dependency_added',
+      entityType: 'task',
+      entityId: id,
+      changes: { dependsOnTaskId: data.taskId, dependsOnTitle: depTask.title },
+      workspaceId: domainId,
+    });
+
+    return NextResponse.json({ success: true }, { status: 201 });
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[dependencies POST] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to add dependency', 500);
+  }
+});
+
+// DELETE /api/domains/[domainId]/tasks/[id]/dependencies — Remove a dependency
+export const DELETE = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = addDependencySchema.parse(body);
+
+    const [existing] = await db.select()
+      .from(taskDependencies)
+      .where(and(eq(taskDependencies.taskId, id), eq(taskDependencies.dependsOnTaskId, data.taskId)))
+      .limit(1);
+
+    if (!existing) {
+      return createErrorResponse('NOT_FOUND', 'Dependency not found', 404);
+    }
+
+    await db.delete(taskDependencies)
+      .where(and(eq(taskDependencies.taskId, id), eq(taskDependencies.dependsOnTaskId, data.taskId)));
+
+    await recordActivity({
+      actor: user.name,
+      action: 'dependency_removed',
+      entityType: 'task',
+      entityId: id,
+      changes: { dependsOnTaskId: data.taskId },
+      workspaceId: domainId,
+    });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[dependencies DELETE] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to remove dependency', 500);
+  }
+});
@@ -0,0 +1,205 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, tasks, taskTags, tags as tagsTable, taskDependencies } from '@project-e/db';
+import { and, asc, eq, inArray, isNull, sql } from 'drizzle-orm';
+import { z } from 'zod';
+
+const taskStatusEnum = z.enum(['todo', 'in_progress', 'done', 'cancelled']);
+const taskPriorityEnum = z.enum(['low', 'medium', 'high', 'urgent']);
+
+const updateTaskSchema = z.object({
+  title: z.string().min(1).optional(),
+  description: z.string().optional().nullable(),
+  status: taskStatusEnum.optional(),
+  priority: taskPriorityEnum.optional(),
+  projectId: z.string().uuid().optional().nullable(),
+  sectionId: z.string().uuid().optional().nullable(),
+  parentId: z.string().uuid().optional().nullable(),
+  dueDate: z.string().datetime().optional().nullable(),
+  estimatedMinutes: z.number().int().positive().optional().nullable(),
+  order: z.number().int().optional(),
+  customFields: z.record(z.string(), z.unknown()).optional(),
+  recurrenceRule: z.string().optional().nullable(),
+});
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// GET /api/domains/[domainId]/tasks/[id] — Get a single task with subtasks + dependencies
+export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [task] = await db.select()
+    .from(tasks)
+    .where(and(eq(tasks.id, id), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+    .limit(1);
+
+  if (!task) {
+    return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+  }
+
+  // Fetch subtasks
+  const subtasks = await db.select()
+    .from(tasks)
+    .where(and(eq(tasks.parentId, id), isNull(tasks.deletedAt)))
+    .orderBy(asc(tasks.order));
+
+  // Fetch tags
+  const tagRows = await db.select({
+    id: tagsTable.id,
+    name: tagsTable.name,
+    color: tagsTable.color,
+  })
+    .from(taskTags)
+    .innerJoin(tagsTable, eq(taskTags.tagId, tagsTable.id))
+    .where(eq(taskTags.taskId, id));
+
+  // Fetch dependencies (tasks this task depends on)
+  const depRows = await db.select({
+    id: tasks.id,
+    title: tasks.title,
+    status: tasks.status,
+  })
+    .from(taskDependencies)
+    .innerJoin(tasks, eq(taskDependencies.dependsOnTaskId, tasks.id))
+    .where(and(eq(taskDependencies.taskId, id), isNull(tasks.deletedAt)));
+
+  // Fetch dependents (tasks that depend on this task)
+  const dependentRows = await db.select({
+    id: tasks.id,
+    title: tasks.title,
+    status: tasks.status,
+  })
+    .from(taskDependencies)
+    .innerJoin(tasks, eq(taskDependencies.taskId, tasks.id))
+    .where(and(eq(taskDependencies.dependsOnTaskId, id), isNull(tasks.deletedAt)));
+
+  return NextResponse.json({
+    ...task,
+    subtasks,
+    tags: tagRows,
+    dependencies: depRows,
+    dependents: dependentRows,
+  });
+});
+
+// PATCH /api/domains/[domainId]/tasks/[id] — Update a task
+export const PATCH = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = updateTaskSchema.parse(body);
+
+    // Verify task exists
+    const [existing] = await db.select()
+      .from(tasks)
+      .where(and(eq(tasks.id, id), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+      .limit(1);
+
+    if (!existing) {
+      return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+    }
+
+    // Cycle detection for parentId (can't set parent to self or descendant)
+    if (data.parentId && data.parentId === id) {
+      return createErrorResponse('VALIDATION_ERROR', 'A task cannot be its own parent', 400);
+    }
+    if (data.parentId) {
+      // Check for cycles in parent chain
+      let currentParentId: string | null = data.parentId;
+      const visited = new Set<string>([id]);
+      while (currentParentId) {
+        if (visited.has(currentParentId)) {
+          return createErrorResponse('VALIDATION_ERROR', 'Circular parent reference detected', 400);
+        }
+        visited.add(currentParentId);
+        const [parent] = await db.select({ parentId: tasks.parentId })
+          .from(tasks)
+          .where(eq(tasks.id, currentParentId))
+          .limit(1);
+        currentParentId = parent?.parentId ?? null;
+      }
+    }
+
+    // Build update object
+    const updateValues: Record<string, unknown> = {};
+    if (data.title !== undefined) updateValues.title = data.title;
+    if (data.description !== undefined) updateValues.description = data.description;
+    if (data.status !== undefined) updateValues.status = data.status;
+    if (data.priority !== undefined) updateValues.priority = data.priority;
+    if (data.projectId !== undefined) updateValues.projectId = data.projectId;
+    if (data.sectionId !== undefined) updateValues.sectionId = data.sectionId;
+    if (data.parentId !== undefined) updateValues.parentId = data.parentId;
+    if (data.dueDate !== undefined) updateValues.dueDate = data.dueDate ? new Date(data.dueDate) : null;
+    if (data.estimatedMinutes !== undefined) updateValues.estimatedMinutes = data.estimatedMinutes;
+    if (data.order !== undefined) updateValues.order = data.order;
+    if (data.customFields !== undefined) updateValues.customFields = data.customFields;
+    if (data.recurrenceRule !== undefined) updateValues.recurrenceRule = data.recurrenceRule;
+    updateValues.updatedAt = new Date();
+
+    const [updated] = await db.update(tasks)
+      .set(updateValues)
+      .where(eq(tasks.id, id))
+      .returning();
+
+    // Record activity
+    await recordActivity({
+      actor: user.name,
+      action: 'updated',
+      entityType: 'task',
+      entityId: id,
+      changes: { ...data, previousStatus: existing.status },
+      workspaceId: domainId,
+    });
+
+    return NextResponse.json(updated);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[tasks PATCH] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to update task', 500);
+  }
+});
+
+// DELETE /api/domains/[domainId]/tasks/[id] — Soft delete a task
+export const DELETE = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [existing] = await db.select()
+    .from(tasks)
+    .where(and(eq(tasks.id, id), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+    .limit(1);
+
+  if (!existing) {
+    return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+  }
+
+  await db.update(tasks)
+    .set({ deletedAt: new Date(), updatedAt: new Date() })
+    .where(eq(tasks.id, id));
+
+  // Record activity
+  await recordActivity({
+    actor: user.name,
+    action: 'deleted',
+    entityType: 'task',
+    entityId: id,
+    changes: { title: existing.title },
+    workspaceId: domainId,
+  });
+
+  return new NextResponse(null, { status: 204 });
+});
@@ -0,0 +1,67 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, tasks } from '@project-e/db';
+import { and, eq, isNull } from 'drizzle-orm';
+import { z } from 'zod';
+
+const scheduleSchema = z.object({
+  dueDate: z.string().datetime().nullable(),
+});
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// PATCH /api/domains/[domainId]/tasks/[id]/schedule — Reschedule a task via drag
+export const PATCH = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = scheduleSchema.parse(body);
+
+    // Verify task exists
+    const [existing] = await db.select()
+      .from(tasks)
+      .where(and(eq(tasks.id, id), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+      .limit(1);
+
+    if (!existing) {
+      return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+    }
+
+    const [updated] = await db.update(tasks)
+      .set({
+        dueDate: data.dueDate ? new Date(data.dueDate) : null,
+        updatedAt: new Date(),
+      })
+      .where(eq(tasks.id, id))
+      .returning();
+
+    // Record activity
+    await recordActivity({
+      actor: user.name,
+      action: 'updated',
+      entityType: 'task',
+      entityId: id,
+      changes: { dueDate: data.dueDate, previousDueDate: existing.dueDate?.toISOString() || null },
+      workspaceId: domainId,
+    });
+
+    return NextResponse.json(updated);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[schedule PATCH] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to reschedule task', 500);
+  }
+});
@@ -0,0 +1,123 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, tasks, taskTags, tags as tagsTable } from '@project-e/db';
+import { and, eq, isNull } from 'drizzle-orm';
+import { z } from 'zod';
+
+const tagActionSchema = z.object({
+  tagId: z.string().uuid(),
+});
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// POST /api/domains/[domainId]/tasks/[id]/tags — Add a tag to a task
+export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = tagActionSchema.parse(body);
+
+    // Verify task exists
+    const [task] = await db.select()
+      .from(tasks)
+      .where(and(eq(tasks.id, id), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+      .limit(1);
+
+    if (!task) {
+      return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+    }
+
+    // Verify tag exists
+    const [tag] = await db.select()
+      .from(tagsTable)
+      .where(eq(tagsTable.id, data.tagId))
+      .limit(1);
+
+    if (!tag) {
+      return createErrorResponse('NOT_FOUND', 'Tag not found', 404);
+    }
+
+    // Check if already tagged
+    const [existing] = await db.select()
+      .from(taskTags)
+      .where(and(eq(taskTags.taskId, id), eq(taskTags.tagId, data.tagId)))
+      .limit(1);
+
+    if (existing) {
+      return createErrorResponse('CONFLICT', 'Tag already added to this task', 409);
+    }
+
+    await db.insert(taskTags).values({ taskId: id, tagId: data.tagId });
+
+    await recordActivity({
+      actor: user.name,
+      action: 'tag_added',
+      entityType: 'task',
+      entityId: id,
+      changes: { tagId: data.tagId, tagName: tag.name },
+      workspaceId: domainId,
+    });
+
+    return NextResponse.json({ success: true }, { status: 201 });
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[tags POST] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to add tag', 500);
+  }
+});
+
+// DELETE /api/domains/[domainId]/tasks/[id]/tags — Remove a tag from a task
+export const DELETE = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = tagActionSchema.parse(body);
+
+    const [existing] = await db.select()
+      .from(taskTags)
+      .where(and(eq(taskTags.taskId, id), eq(taskTags.tagId, data.tagId)))
+      .limit(1);
+
+    if (!existing) {
+      return createErrorResponse('NOT_FOUND', 'Tag not found on this task', 404);
+    }
+
+    await db.delete(taskTags)
+      .where(and(eq(taskTags.taskId, id), eq(taskTags.tagId, data.tagId)));
+
+    await recordActivity({
+      actor: user.name,
+      action: 'tag_removed',
+      entityType: 'task',
+      entityId: id,
+      changes: { tagId: data.tagId },
+      workspaceId: domainId,
+    });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[tags DELETE] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to remove tag', 500);
+  }
+});
@@ -0,0 +1,47 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, tasks } from '@project-e/db';
+import { and, eq, isNull } from 'drizzle-orm';
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// POST /api/domains/[domainId]/tasks/[id]/uncomplete — Revert task from done
+export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [existing] = await db.select()
+    .from(tasks)
+    .where(and(eq(tasks.id, id), eq(tasks.domainId, domainId), isNull(tasks.deletedAt)))
+    .limit(1);
+
+  if (!existing) {
+    return createErrorResponse('NOT_FOUND', 'Task not found', 404);
+  }
+
+  const [updated] = await db.update(tasks)
+    .set({
+      status: 'todo',
+      completedAt: null,
+      updatedAt: new Date(),
+    })
+    .where(eq(tasks.id, id))
+    .returning();
+
+  await recordActivity({
+    actor: user.name,
+    action: 'uncompleted',
+    entityType: 'task',
+    entityId: id,
+    changes: { previousStatus: existing.status },
+    workspaceId: domainId,
+  });
+
+  return NextResponse.json(updated);
+});