PTD: Open-Core Work Tracker for Hybrid Human-AI Teams
PTD is an open-core work tracker designed for hybrid human + AI-agent teams, offering a unified interface for task planning and progress logging with support for self-hosting and Postgres integration.
Overview and Core Features
PTD — Plan Track Done — is an open-core work tracker designed for hybrid human + AI-agent teams. It offers a unified interface where users can plan tasks in one view and log progress in another, ensuring a single source of truth for each task, regardless of whether it was completed by a human or an agent. The tool supports self-hosting, with a free, forever option available through a simple setup process. Users can clone the repository, configure environment variables, and launch the application using Docker Compose. PTD ships with HeliosDB-Nano as its database, which is automatically built and configured by the provided docker-compose.yml file. This makes deployment straightforward and accessible for developers and teams looking to manage workflows involving both human and AI contributions.
Self-Hosting and Database Configuration
Self-hosting PTD is free and perpetual, requiring only a few terminal commands to set up. Users can clone the repository, configure environment variables such as DB_PASSWORD and JWT_SECRET, and launch the application using Docker Compose. The setup includes HeliosDB-Nano as the default database, which is automatically configured by the docker-compose.yml file. For those who prefer using an external Postgres instance, PTD supports the Postgres wire protocol, allowing users to point DATABASE_URL to their own Postgres server. Detailed instructions for this configuration are available in the docs/self-hosting.md file. A hosted version of PTD is also available at ptd.danimoya.com, priced at $15 per month per organization.
Security and Encryption
Security and encryption are central to PTD’s design. Communication between the app and database uses TLS with the X25519MLKEM768 post-quantum hybrid key exchange, available in HeliosDB-Nano ≥ 4.40 and supported by Node 24’s OpenSSL 3.5. Server certificates are pinned via the shared /tls volume, and SCRAM-SHA-256 authentication is enforced. The database HTTP/MCP listener is disabled, and the database is isolated to the compose network, ensuring it is unreachable from outside.
Data at rest is encrypted using AES-256-GCM, with the DB_ENCRYPTION_KEY set before the first start. Third-party integration secrets are sealed with AES-256-GCM under PTD_SECRET_KEY. Passwords are stored using bcrypt with a cost factor of 12, and agent tokens are hashed with scrypt.
Agent Integration and Authentication
Agent Integration and Authentication in PTD involves registering an agent to obtain a bearer token for the MCP server and REST API. This process is initiated via a POST request to the PTD API with the agent's name and an invite code provided by the organization. Once registered, the agent uses the bearer token for authentication when connecting to the MCP server at https://ptd.danimoya.com/mcp.The tools an agent can access depend on the role assigned to it, and this role-based access control applies consistently across MCP, REST, Slack, and other adapters. Additionally, when enabled, the agent sends a weekly report containing only installation_id, dashboard_version, heliosdb_version, and timestamp, with no personal or task-related data. The page displaying this information also shows the JSON before transmission and provides options to opt out.
Development and CLI Tools
The development and CLI tools for PTD are designed with simplicity and extensibility in mind. The CLI offers a zero-dependency Node client, supporting commands like ptd next for viewing the highest-priority task, ptd start and ptd stop for managing timer and token costs, and ptd run for executing actions by name. Developers can install the CLI globally or via npx, and use --json for piping data into other tools. For local development, the project requires npm install, followed by setting environment variables like DATABASE_URL and JWT_SECRET. The npm run dev command starts the API and Vite on port 3001, while npm run docs regenerates the action reference in docs/api.md from the live registry via scripts/gen-docs.ts. Changes to actions require running npm run docs, and npm run docs -- --check ensures the documentation remains up to date.
Sources and reporting notes
Based on published source material. No independent hands-on testing is claimed.
