fix(task-tool): add task ID validation and improve lock acquisition safety

- Add task ID pattern validation (T-[A-Za-z0-9-]+) to prevent path traversal
- Refactor lock mechanism to use UUID-based IDs for reliable ownership tracking
- Implement atomic lock creation with stale lock detection and cleanup
- Add lock acquisition checks in create/update/delete handlers
- Expand task-reminder hook to track split tool names and clean up on session deletion
- Add comprehensive test coverage for validation and lock handling

src/hooks/task-reminder/index.test.ts

@@ -122,4 +122,29 @@ describe("TaskReminderHook", () => {
     expect(output1.output).toContain("task tools haven't been used")
     expect(output2.output).not.toContain("task tools haven't been used")
   })
+
+  test("cleans up counters on session.deleted", async () => {
+    //#given
+    const sessionID = "test-session"
+    const output = { output: "Result" }
+
+    //#when
+    for (let i = 0; i < 10; i++) {
+      await hook["tool.execute.after"]?.(
+        { tool: "bash", sessionID, callID: `call-${i}` },
+        output
+      )
+    }
+    await hook.event?.({ event: { type: "session.deleted", properties: { info: { id: sessionID } } } })
+    const outputAfterDelete = { output: "Result" }
+    for (let i = 0; i < 9; i++) {
+      await hook["tool.execute.after"]?.(
+        { tool: "bash", sessionID, callID: `call-after-${i}` },
+        outputAfterDelete
+      )
+    }
+
+    //#then
+    expect(outputAfterDelete.output).not.toContain("task tools haven't been used")
+  })
 })