feat: task queue fixes - stale recovery, smart defaults, search (#477)

* feat: task queue fixes - stale recovery, smart defaults, search, purge

- On startup, mark all orphaned 'working' tasks as 'failed' (crash recovery)
- Default `visor tasks` shows only active tasks, use --all for history
- Add --search <text> to filter tasks by input message
- Add --instance <id> to filter by visor instance
- Add `visor tasks purge --age 7d` to clean old terminal tasks
- Add failStaleTasks() and purgeOldTasks() to TaskStore interface

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: escape SQL LIKE wildcards and add test coverage for task queue

Prevents SQL wildcard injection in search filter by escaping %, _, \
characters. Changes purgeOldTasks boundary from < to <= for consistency.
Adds 10 new tests covering failStaleTasks, purgeOldTasks, search,
claimedBy filter, and claimTask.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: use cli-table3 for tasks output, fix cancel prefix matching, fix markdown in code blocks

- Replace manual table formatting with cli-table3 for consistent styled output
  in tasks list, show, and stats subcommands
- Add colored state indicators (yellow=working, green=completed, red=failed)
- Fix cancel command not finding tasks by prefix (was requiring full UUID)
- Extract shared findTaskByPrefix helper used by both cancel and show
- Fix markdownToSlack converting bold/links inside fenced code blocks
  by moving all transformations into the line-by-line code block tracker

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: buger

src/agent-protocol/task-store.ts

@@ -110,6 +110,8 @@ export interface ListTasksFilter {
   contextId?: string;
   state?: TaskState[];
   workflowId?: string;
+  search?: string; // text search in request_message
+  claimedBy?: string; // filter by instance/worker
   limit?: number; // default 50, max 200
   offset?: number;
 }
@@ -160,7 +162,11 @@ export interface TaskStore {
   // Queue monitoring (optional — only SqliteTaskStore implements this)
   listTasksRaw?(filter: ListTasksFilter): { rows: TaskQueueRow[]; total: number };
 
-  // Cleanup
+  // Cleanup & recovery
+  /** Mark all 'working' tasks as 'failed' (crash recovery on startup). */
+  failStaleTasks(reason?: string): number;
+  /** Delete completed/failed/canceled tasks older than the given age. */
+  purgeOldTasks(olderThanMs: number): number;
   deleteExpiredTasks(): string[];
   deleteTask(taskId: string): void;
 }
@@ -320,6 +326,16 @@ export class SqliteTaskStore implements TaskStore {
       conditions.push('workflow_id = ?');
       params.push(filter.workflowId);
     }
+    if (filter.search) {
+      // Escape SQL LIKE wildcards to prevent wildcard injection
+      const escaped = filter.search.replace(/[%_\\]/g, '\\$&');
+      conditions.push("request_message LIKE ? ESCAPE '\\'");
+      params.push(`%${escaped}%`);
+    }
+    if (filter.claimedBy) {
+      conditions.push('claimed_by = ?');
+      params.push(filter.claimedBy);
+    }
 
     const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
     return { where, params };
@@ -532,6 +548,38 @@ export class SqliteTaskStore implements TaskStore {
   // Cleanup
   // -------------------------------------------------------------------------
 
+  failStaleTasks(reason?: string): number {
+    const db = this.getDb();
+    const now = nowISO();
+    const msg = reason || 'Process terminated while task was running';
+    const statusMessage = JSON.stringify({
+      message_id: crypto.randomUUID(),
+      role: 'agent',
+      parts: [{ text: msg }],
+    });
+    const result = db
+      .prepare(
+        `UPDATE agent_tasks
+         SET state = 'failed', updated_at = ?, status_message = ?
+         WHERE state = 'working'`
+      )
+      .run(now, statusMessage);
+    return result.changes;
+  }
+
+  purgeOldTasks(olderThanMs: number): number {
+    const db = this.getDb();
+    const cutoff = new Date(Date.now() - olderThanMs).toISOString();
+    const result = db
+      .prepare(
+        `DELETE FROM agent_tasks
+         WHERE state IN ('completed', 'failed', 'canceled', 'rejected')
+         AND updated_at <= ?`
+      )
+      .run(cutoff);
+    return result.changes;
+  }
+
   deleteExpiredTasks(): string[] {
     const db = this.getDb();
     const now = nowISO();