feat(tasks-for-obsidian): Todoist ergonomics wave — reschedule sheet, org editing, NLP, autocomplete, undo, bulk edit, polish (#1611)

* docs(docs): tasknotes session log, Todoist comparison, ergonomics-wave plan

* feat(tasks-for-obsidian): reschedule sheet — calendar grid, correct Todoist semantics, scheduled+due editing everywhere

* feat(tasks-for-obsidian): post-creation org editing, NLP date grammar, Quick Add autocomplete

* feat(tasks-for-obsidian): undo toast for recurring completions with next-occurrence copy

* feat(tasks-for-obsidian): multi-select bulk edit — schedule, priority, complete, delete

* feat(tasks-for-obsidian): delight pass — today heading, all-clear state, swipe detent, pending dots, quick actions

* docs(docs): skipped-files canary runbook + single-PR plan restructure

* fix(tasks-for-obsidian): bump react-native-worklets to 0.10 for reanimated 4.5 pod compatibility

* docs(docs): ergonomics-wave verification complete — e2e green, media posted

* fix(terraform-provider-asuswrt): bump x/net and grpc for fresh trivy CVEs (CVE-2026-33814, CVE-2026-39821, GHSA-hrxh-6v49-42gf)

* fix(deps): patch fresh HIGH CVEs across bun.lock and the Go provider

trivy DB picked up a new wave of advisories that fail every PR build:
sharp 0.35 (libvips CVEs), axios 1.18, shell-quote 1.9, fast-xml-parser
5.10.1, js-yaml 4.3, linkify-it 5.0.2, svgo 4.0.2, otel propagator-jaeger
2.9 (+core aligned 2.10), undici via discord.js 14.27, and x/net 0.55 /
x/crypto 0.52 / grpc 1.82.1 in terraform-provider-asuswrt. Rides along:
sharp 0.35 ESM-first type fix for the dvs lazy-import shim, a discord.js
14.27 type-portability annotation in streambot, docs-board's phantom
shadcn dep declared (knip-ignored: CSS-only import), and an ios/Pods
gitleaks allowlist (Apple code-signature manifests in prebuilt frameworks).

* fix(tasks-for-obsidian): surface schedule/bulk errors, per-open preset dates, guide snapshot note (Greptile P1s/P2s)

* fix(tasks-for-obsidian): surface TaskDetail save and read-mode reschedule errors (Greptile P1)

* fix(tasks-for-obsidian): suppress per-task undo toasts in bulk complete (Greptile P1)

---------

Co-authored-by: CI Bot <ci@sjer.red>

Author: shepherdjerred

.gitleaks.toml

@@ -10,6 +10,9 @@ paths = [
   '''\.claude/worktrees/''',
   # Lock files — contain hashes, not secrets
   '''\.lock$''',
+  # CocoaPods build output (gitignored, never committed) — Apple code-signature
+  # hash manifests inside the RN 0.85 prebuilt xcframeworks flag as generic-api-key
+  '''ios/Pods/''',
   '''Podfile\.lock$''',
   '''Manifest\.lock$''',
   # Generated/vendored code

bun.lock

@@ -21,7 +21,8 @@
         "src/cli/*.ts",
         "vite.config.ts"
       ],
-      "project": ["src/**/*.{ts,tsx}", "vite.config.ts"]
+      "project": ["src/**/*.{ts,tsx}", "vite.config.ts"],
+      "ignoreDependencies": ["shadcn"]
     },
     "packages/discord-plays-core": {
       "entry": ["src/index.ts", "src/entry.ts"],

knip.json

@@ -95,15 +95,21 @@
     "@typescript-eslint/eslint-plugin": "8.59.0",
     "@typescript-eslint/parser": "8.59.0",
     "@typescript-eslint/utils": "8.59.0",
-    "axios": "1.16.1",
+    "axios": "1.18.0",
+    "@opentelemetry/propagator-jaeger": "2.9.0",
+    "@opentelemetry/core": "2.10.0",
+    "fast-xml-parser": "5.10.1",
+    "js-yaml": "4.3.0",
+    "linkify-it": "5.0.2",
+    "svgo": "4.0.2",
     "devalue": "5.8.1",
     "esbuild": "0.28.1",
     "fast-uri": "3.1.2",
     "fast-xml-builder": "1.2.0",
     "js-cookie": "3.0.7",
     "protobufjs": "^7.5.7",
     "sanitize-html": "^2.17.4",
-    "shell-quote": "1.8.4",
+    "shell-quote": "1.9.0",
     "tmp": "0.2.6",
     "typescript-eslint": "8.59.0"
   },

package.json

@@ -53,7 +53,7 @@
     "cron-parser": "^5.5.0",
     "discord-player": "7.2.0",
     "discord-player-youtubei": "^2.0.0",
-    "discord.js": "^14.26.4",
+    "discord.js": "^14.27.0",
     "ffmpeg-static": "^5.3.0",
     "hono": "^4.12.18",
     "mediaplex": "^1.0.0",

packages/birmel/package.json

@@ -50,7 +50,7 @@
     "lodash": "4.18.1",
     "prom-client": "^15.1.3",
     "rxjs": "^7.8.2",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.0",
     "smol-toml": "1.6.1",
     "socket.io": "^4.8.1",
     "ts-pattern": "^5.7.0",

packages/discord-plays-mario-kart/packages/backend/package.json

@@ -28,11 +28,12 @@
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.40.0",
+    "@shepherdjerred/discord-plays-core": "workspace:*",
     "@shepherdjerred/discord-stream-lifecycle": "workspace:*",
     "@shepherdjerred/discord-video-stream": "workspace:*",
     "@shepherdjerred/llm-models": "workspace:*",
     "@shepherdjerred/llm-observability": "workspace:*",
-    "discord.js": "^14.26.4",
+    "discord.js": "^14.27.0",
     "discord.js-selfbot-v13": "^3.6.1",
     "express": "^5.0.0",
     "lodash": "4.18.1",
@@ -43,8 +44,7 @@
     "ts-pattern": "^5.7.0",
     "winston": "^3.17.0",
     "xstate": "^5.32.4",
-    "zod": "^4.4.3",
-    "@shepherdjerred/discord-plays-core": "workspace:*"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

packages/discord-plays-pokemon/packages/backend/package.json

@@ -30,7 +30,7 @@
     "fluent-ffmpeg": "^2.1.3",
     "node-av": "^5.2.2",
     "p-debounce": "^5.1.0",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.0",
     "zeromq": "^6.5.0"
   },
   "peerDependencies": {

packages/discord-video-stream/package.json

@@ -18,7 +18,10 @@ import Log from "debug-level";
 // the bundler cannot statically pre-resolve (and therefore eagerly load) it. Previously a committed
 // bun patch in the consumer packages; baked into source here.
 const __require = __createRequire(import.meta.url);
-type SharpFactory = typeof import("sharp");
+// sharp 0.35 ships ESM-first types: the callable factory is the DEFAULT export
+// of the module type, while the CJS require() below still returns the callable
+// directly at runtime.
+type SharpFactory = (typeof import("sharp"))["default"];
 let __sharpModule: SharpFactory | undefined;
 const __sharpName = ["sh", "arp"].join("");
 const sharp = ((...args: Parameters<SharpFactory>): ReturnType<SharpFactory> => {

packages/discord-video-stream/src/media/newApi.ts

@@ -58,6 +58,7 @@
     "@vitejs/plugin-react": "^6.0.1",
     "eslint": "^10.7.0",
     "jiti": "^2.7.0",
+    "shadcn": "^4.14.1",
     "tailwindcss": "^4.2.4",
     "typescript": "^6.0.3",
     "vite": "^8.0.11"