feat: Phase 2 — project registry, legacy field cleanup, credential path fix

- task.Project type + storage CRUD + UpsertProject + SeedProjects
- Remove AgentConfig.ProjectDir, RepositoryURL, SkipPlanning
- Remove ContainerRunner fallback git init logic
- Project API endpoints: GET/POST /api/projects, GET/PUT /api/projects/{id}
- processResult no longer extracts changestats (pool-side only)
- claude_config_dir config field; default to credentials/claude/
- New scripts: sync-credentials, fix-permissions, check-token

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

3 files changed, 182 insertions, 1 deletions

diff --git a/internal/storage/db.go b/internal/storage/db.go
index 1a0e74f..8f834b2 100644
--- a/internal/storage/db.go
+++ b/internal/storage/db.go
@@ -109,6 +109,16 @@ func (s *DB) migrate() error {
 		)`,
 		`CREATE INDEX IF NOT EXISTS idx_agent_events_agent ON agent_events(agent)`,
 		`CREATE INDEX IF NOT EXISTS idx_agent_events_timestamp ON agent_events(timestamp)`,
+		`CREATE TABLE IF NOT EXISTS projects (
+			id TEXT PRIMARY KEY,
+			name TEXT NOT NULL,
+			remote_url TEXT NOT NULL DEFAULT '',
+			local_path TEXT NOT NULL DEFAULT '',
+			type TEXT NOT NULL DEFAULT 'web',
+			deploy_script TEXT NOT NULL DEFAULT '',
+			created_at DATETIME NOT NULL,
+			updated_at DATETIME NOT NULL
+		)`,
 	}
 	for _, m := range migrations {
 		if _, err := s.db.Exec(m); err != nil {
@@ -1056,3 +1066,64 @@ func timeOrNull(t *time.Time) interface{} {
 	}
 	return t.UTC()
 }
+
+// CreateProject inserts a new project.
+func (s *DB) CreateProject(p *task.Project) error {
+	now := time.Now().UTC()
+	_, err := s.db.Exec(
+		`INSERT INTO projects (id, name, remote_url, local_path, type, deploy_script, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+		p.ID, p.Name, p.RemoteURL, p.LocalPath, p.Type, p.DeployScript, now, now,
+	)
+	return err
+}
+
+// GetProject retrieves a project by ID.
+func (s *DB) GetProject(id string) (*task.Project, error) {
+	row := s.db.QueryRow(`SELECT id, name, remote_url, local_path, type, deploy_script FROM projects WHERE id = ?`, id)
+	p := &task.Project{}
+	if err := row.Scan(&p.ID, &p.Name, &p.RemoteURL, &p.LocalPath, &p.Type, &p.DeployScript); err != nil {
+		return nil, err
+	}
+	return p, nil
+}
+
+// ListProjects returns all projects.
+func (s *DB) ListProjects() ([]*task.Project, error) {
+	rows, err := s.db.Query(`SELECT id, name, remote_url, local_path, type, deploy_script FROM projects ORDER BY name`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var projects []*task.Project
+	for rows.Next() {
+		p := &task.Project{}
+		if err := rows.Scan(&p.ID, &p.Name, &p.RemoteURL, &p.LocalPath, &p.Type, &p.DeployScript); err != nil {
+			return nil, err
+		}
+		projects = append(projects, p)
+	}
+	return projects, rows.Err()
+}
+
+// UpdateProject updates an existing project.
+func (s *DB) UpdateProject(p *task.Project) error {
+	now := time.Now().UTC()
+	_, err := s.db.Exec(
+		`UPDATE projects SET name = ?, remote_url = ?, local_path = ?, type = ?, deploy_script = ?, updated_at = ? WHERE id = ?`,
+		p.Name, p.RemoteURL, p.LocalPath, p.Type, p.DeployScript, now, p.ID,
+	)
+	return err
+}
+
+// UpsertProject inserts or updates a project by ID (used for seeding).
+func (s *DB) UpsertProject(p *task.Project) error {
+	now := time.Now().UTC()
+	_, err := s.db.Exec(
+		`INSERT INTO projects (id, name, remote_url, local_path, type, deploy_script, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(id) DO UPDATE SET name=excluded.name, remote_url=excluded.remote_url,
+		   local_path=excluded.local_path, type=excluded.type, deploy_script=excluded.deploy_script, updated_at=excluded.updated_at`,
+		p.ID, p.Name, p.RemoteURL, p.LocalPath, p.Type, p.DeployScript, now, now,
+	)
+	return err
+}
diff --git a/internal/storage/db_test.go b/internal/storage/db_test.go
index 5c447af..82c8262 100644
--- a/internal/storage/db_test.go
+++ b/internal/storage/db_test.go
@@ -41,7 +41,6 @@ func TestCreateTask_AndGetTask(t *testing.T) {
 			Type:         "claude",
 			Model:        "sonnet",
 			Instructions: "do it",
-			ProjectDir:   "/tmp",
 			MaxBudgetUSD: 2.5,
 		},
 		Priority:  task.PriorityHigh,
@@ -1154,3 +1153,68 @@ func TestExecution_StoreAndRetrieveChangestats(t *testing.T) {
 	}
 }
 
+func TestCreateProject(t *testing.T) {
+	db := testDB(t)
+	defer db.Close()
+
+	p := &task.Project{
+		ID:        "proj-1",
+		Name:      "claudomator",
+		RemoteURL: "/bare/claudomator.git",
+		LocalPath: "/workspace/claudomator",
+		Type:      "web",
+	}
+	if err := db.CreateProject(p); err != nil {
+		t.Fatalf("CreateProject: %v", err)
+	}
+	got, err := db.GetProject("proj-1")
+	if err != nil {
+		t.Fatalf("GetProject: %v", err)
+	}
+	if got.Name != "claudomator" {
+		t.Errorf("Name: want claudomator, got %q", got.Name)
+	}
+	if got.LocalPath != "/workspace/claudomator" {
+		t.Errorf("LocalPath: want /workspace/claudomator, got %q", got.LocalPath)
+	}
+}
+
+func TestListProjects(t *testing.T) {
+	db := testDB(t)
+	defer db.Close()
+
+	for _, p := range []*task.Project{
+		{ID: "p1", Name: "alpha", Type: "web"},
+		{ID: "p2", Name: "beta", Type: "android"},
+	} {
+		if err := db.CreateProject(p); err != nil {
+			t.Fatalf("CreateProject: %v", err)
+		}
+	}
+	list, err := db.ListProjects()
+	if err != nil {
+		t.Fatalf("ListProjects: %v", err)
+	}
+	if len(list) != 2 {
+		t.Errorf("want 2 projects, got %d", len(list))
+	}
+}
+
+func TestUpdateProject(t *testing.T) {
+	db := testDB(t)
+	defer db.Close()
+
+	p := &task.Project{ID: "p1", Name: "original", Type: "web"}
+	if err := db.CreateProject(p); err != nil {
+		t.Fatalf("CreateProject: %v", err)
+	}
+	p.Name = "updated"
+	if err := db.UpdateProject(p); err != nil {
+		t.Fatalf("UpdateProject: %v", err)
+	}
+	got, _ := db.GetProject("p1")
+	if got.Name != "updated" {
+		t.Errorf("Name after update: want updated, got %q", got.Name)
+	}
+}
+
diff --git a/internal/storage/seed.go b/internal/storage/seed.go
new file mode 100644
index 0000000..d1ded8a
--- /dev/null
+++ b/internal/storage/seed.go
@@ -0,0 +1,46 @@
+package storage
+
+import (
+	"os/exec"
+	"strings"
+
+	"github.com/thepeterstone/claudomator/internal/task"
+)
+
+// SeedProjects upserts the default project registry on startup.
+func (s *DB) SeedProjects() error {
+	projects := []*task.Project{
+		{
+			ID:        "claudomator",
+			Name:      "claudomator",
+			LocalPath: "/workspace/claudomator",
+			RemoteURL: localBareRemote("/workspace/claudomator"),
+			Type:      "web",
+		},
+		{
+			ID:        "nav",
+			Name:      "nav",
+			LocalPath: "/workspace/nav",
+			RemoteURL: localBareRemote("/workspace/nav"),
+			Type:      "android",
+		},
+	}
+	for _, p := range projects {
+		if err := s.UpsertProject(p); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// localBareRemote returns the URL of the "local" git remote for dir,
+// falling back to dir itself if the remote is not configured.
+func localBareRemote(dir string) string {
+	out, err := exec.Command("git", "-C", dir, "remote", "get-url", "local").Output()
+	if err == nil {
+		if url := strings.TrimSpace(string(out)); url != "" {
+			return url
+		}
+	}
+	return dir
+}