From 7dae095891ae49d26c48eb70865286a747d2f3d3 Mon Sep 17 00:00:00 2001
From: Michael Uloth <hello@michaeluloth.com>
Date: Fri, 5 Jun 2026 22:43:08 -0400
Subject: [PATCH 1/2] deps: fix cargo-deny bans failure from duplicate crate
 versions

Task: TASK-0010

The CI deny job (cargo deny check bans) failed with exit code 2 because
two crates resolved to two versions each, which the bans config denies.

itertools resolved to both 0.13 (via ratatui 0.29) and 0.14 (a direct
hub-tui dependency). Only with_position()/Position are used here, an API
identical in both versions, so the direct dependency is pinned down to
0.13 to unify on a single version.

unicode-width resolved to both 0.1.14 (via unicode-truncate) and 0.2.0
(via ratatui and tui-textarea). This split lives entirely inside
ratatui's transitive tree and is not controllable without an upstream
change, so it joins the documented skip list.

The crossterm skip is removed: it now resolves to a single version, so
the skip was unnecessary and cargo-deny warned about it.
---
 Cargo.lock        | 15 +++------------
 deny.toml         |  2 +-
 ui/tui/Cargo.toml |  5 ++++-
 3 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b412fe8..98a9860 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -890,7 +890,7 @@ dependencies = [
  "domain",
  "futures",
  "insta",
- "itertools 0.14.0",
+ "itertools",
  "open",
  "proptest",
  "pulldown-cmark",
@@ -1217,15 +1217,6 @@ dependencies = [
  "either",
 ]
 
-[[package]]
-name = "itertools"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -1728,7 +1719,7 @@ dependencies = [
  "crossterm",
  "indoc",
  "instability",
- "itertools 0.13.0",
+ "itertools",
  "lru",
  "paste",
  "strum",
@@ -2701,7 +2692,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b3644627a5af5fa321c95b9b235a72fd24cd29c648c2c379431e6628655627bf"
 dependencies = [
- "itertools 0.13.0",
+ "itertools",
  "unicode-segmentation",
  "unicode-width 0.1.14",
 ]
diff --git a/deny.toml b/deny.toml
index 3a9c963..38c2c2e 100644
--- a/deny.toml
+++ b/deny.toml
@@ -4,13 +4,13 @@
   # These are cross-major-version splits not controllable without upstream changes.
   skip = [
     { name = "core-foundation" },
-    { name = "crossterm" },
     { name = "getrandom" },
     { name = "hashbrown" },
     { name = "linux-raw-sys" },
     { name = "rustix" },
     { name = "thiserror" },
     { name = "thiserror-impl" },
+    { name = "unicode-width" },
     { name = "windows-sys" },
     { name = "windows-targets" },
     { name = "windows_aarch64_gnullvm" },
diff --git a/ui/tui/Cargo.toml b/ui/tui/Cargo.toml
index 4461e5e..0c4b160 100644
--- a/ui/tui/Cargo.toml
+++ b/ui/tui/Cargo.toml
@@ -20,7 +20,10 @@
   crossterm = { version = "0.28", features = ["event-stream"] }
   domain = { path = "../../domain" }
   futures = "0.3"
-  itertools = "0.14"
+  # Pinned to 0.13 to unify with ratatui 0.29, which also depends on itertools 0.13.
+  # cargo-deny's bans check rejects duplicate versions; only with_position()/Position
+  # are used here, an API present in both 0.13 and 0.14. Bump in lockstep with ratatui.
+  itertools = "0.13"
   open = "5"
   pulldown-cmark = { version = "0.13", default-features = false }
   # Pinned to 0.29 to unify with tui-textarea 0.7, which also depends on 0.29.

From 6dce04c6237eec746cf0c571690d01f21743beb6 Mon Sep 17 00:00:00 2001
From: Michael Uloth <hello@michaeluloth.com>
Date: Fri, 5 Jun 2026 22:46:54 -0400
Subject: [PATCH 2/2] dispatch: fix injected hub task link command syntax

The completion steps injected into every dispatched agent session told
the agent to run `hub task link <ID> <path>`, but the CLI requires the
path to be passed via `--value`. A bare positional path is rejected with
"unexpected argument", so every agent hit the error and had to discover
the correct flag before it could register its session log.

The injected command now matches the CLI signature, and the
completion-steps test asserts the `--value` form so the instruction can
no longer drift from the actual interface.
---
 workflows/src/dispatch.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/workflows/src/dispatch.rs b/workflows/src/dispatch.rs
index 7adeb91..37d5b9d 100644
--- a/workflows/src/dispatch.rs
+++ b/workflows/src/dispatch.rs
@@ -95,7 +95,7 @@ pub(crate) fn build_task_prompt(task: &Task) -> String {
          (<slug> is a short kebab-case summary of the task title)"
     ));
     lines.push(format!(
-        "2. hub task link {id} ~/.hub/agent-session-logs/{id}-<slug>.md"
+        "2. hub task link {id} --value ~/.hub/agent-session-logs/{id}-<slug>.md"
     ));
     lines.push(format!("3. hub task report {id} --status in-review"));
     lines.push(String::new());
@@ -935,5 +935,13 @@ mod tests {
             completion_section.contains("hub task report TASK-0099 --status in-review"),
             "completion steps must include the full report command"
         );
+        // The link command requires the --value flag; without it the CLI
+        // rejects a bare path argument, so the injected instruction must match.
+        assert!(
+            completion_section.contains(
+                "hub task link TASK-0099 --value ~/.hub/agent-session-logs/TASK-0099-<slug>.md"
+            ),
+            "completion steps must use the --value flag for the link command"
+        );
     }
 }