@hasna/todos 0.11.43 → 0.11.44

package/dist/cli/commands/environment-snapshots.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerEnvironmentSnapshotCommands(program: Command): void;
+//# sourceMappingURL=environment-snapshots.d.ts.map

package/dist/cli/commands/environment-snapshots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-snapshots.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/environment-snapshots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWzC,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+E1E"}

package/dist/cli/index.js

@@ -26613,6 +26613,8 @@ var init_token_utils = __esm(() => {
       "check_file_lock",
       "create_comment",
       "create_handoff",
+      "capture_environment_snapshot",
+      "compare_environment_snapshots",
       "create_inbox_item",
       "delete_comment",
       "detect_file_relationships",
@@ -33135,6 +33137,334 @@ var init_templates2 = __esm(() => {
   init_tasks();
 });
 
+// src/lib/environment-snapshots.ts
+var exports_environment_snapshots = {};
+__export(exports_environment_snapshots, {
+  writeEnvironmentSnapshot: () => writeEnvironmentSnapshot,
+  recordEnvironmentSnapshot: () => recordEnvironmentSnapshot,
+  readEnvironmentSnapshot: () => readEnvironmentSnapshot,
+  compareEnvironmentSnapshots: () => compareEnvironmentSnapshots,
+  compareEnvironmentSnapshotFiles: () => compareEnvironmentSnapshotFiles,
+  captureEnvironmentSnapshot: () => captureEnvironmentSnapshot
+});
+import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync13, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
+import { hostname, platform, arch } from "os";
+import { dirname as dirname10, join as join14, resolve as resolve12 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+function sha2563(value) {
+  return createHash6("sha256").update(value).digest("hex");
+}
+function fileRecord(root, relativePath) {
+  const path = join14(root, relativePath);
+  if (!existsSync13(path))
+    return null;
+  const stat = statSync6(path);
+  if (!stat.isFile())
+    return null;
+  const content = readFileSync9(path);
+  return { path: relativePath, sha256: sha2563(content), size_bytes: content.length };
+}
+function manifestRecord(root, relativePath) {
+  const base = fileRecord(root, relativePath);
+  if (!base)
+    return null;
+  const parsed = readJsonFile(join14(root, relativePath));
+  if (!parsed)
+    return { ...base, redacted: {} };
+  const redacted = redactValue({
+    name: parsed["name"] ?? null,
+    version: parsed["version"] ?? null,
+    packageManager: parsed["packageManager"] ?? null,
+    scripts: parsed["scripts"] ?? {},
+    dependencies: parsed["dependencies"] ?? {},
+    devDependencies: parsed["devDependencies"] ?? {},
+    peerDependencies: parsed["peerDependencies"] ?? {},
+    optionalDependencies: parsed["optionalDependencies"] ?? {}
+  });
+  return { ...base, redacted };
+}
+function runLocalCommand(root, args) {
+  const result = Bun.spawnSync({
+    cmd: args,
+    cwd: root,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: process.env["PATH"] || "" }
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: redactEvidenceText(result.stdout.toString("utf8").trim()),
+    stderr: redactEvidenceText(result.stderr.toString("utf8").trim())
+  };
+}
+function summarizeGitStatus(lines) {
+  const summary = { added: 0, modified: 0, deleted: 0, renamed: 0, untracked: 0 };
+  for (const line of lines) {
+    if (line.startsWith("??"))
+      summary.untracked += 1;
+    else if (line.includes("R"))
+      summary.renamed += 1;
+    else if (line.includes("D"))
+      summary.deleted += 1;
+    else if (line.includes("A"))
+      summary.added += 1;
+    else if (line.includes("M"))
+      summary.modified += 1;
+  }
+  return summary;
+}
+function captureGit(root, warnings) {
+  const inside = runLocalCommand(root, ["git", "rev-parse", "--is-inside-work-tree"]);
+  if (inside.exitCode !== 0 || inside.stdout !== "true") {
+    return { present: false, branch: null, commit: null, is_dirty: false, status_porcelain: [], status_summary: summarizeGitStatus([]) };
+  }
+  const branch = runLocalCommand(root, ["git", "branch", "--show-current"]);
+  const commit = runLocalCommand(root, ["git", "rev-parse", "HEAD"]);
+  const status = runLocalCommand(root, ["git", "status", "--porcelain=v1"]);
+  if (commit.exitCode !== 0)
+    warnings.push(`git commit unavailable: ${commit.stderr || commit.stdout || "unknown error"}`);
+  if (status.exitCode !== 0)
+    warnings.push(`git status unavailable: ${status.stderr || status.stdout || "unknown error"}`);
+  const lines = status.stdout ? status.stdout.split(/\r?\n/).filter(Boolean) : [];
+  return {
+    present: true,
+    branch: branch.stdout || null,
+    commit: commit.stdout || null,
+    is_dirty: lines.length > 0,
+    status_porcelain: lines,
+    status_summary: summarizeGitStatus(lines)
+  };
+}
+function packageManager(env, lockfiles) {
+  const userAgent = (env["npm_config_user_agent"] || "").toLowerCase();
+  if (userAgent.includes("bun"))
+    return "bun";
+  if (lockfiles.some((file) => file.path.startsWith("bun.lock")))
+    return "bun";
+  if (userAgent.includes("npm") || lockfiles.some((file) => file.path.includes("package-lock")))
+    return "npm";
+  return "unknown";
+}
+function isSecretEnvKey(key) {
+  return /api[_-]?key|token|secret|password|credential|private|session|cookie/i.test(key);
+}
+function commandEnv(env, includeValues) {
+  const keys = Object.keys(env).sort();
+  const interesting = keys.filter((key) => isSecretEnvKey(key) || ["CI", "NODE_ENV", "BUN_ENV", "SHELL", "TERM", "PATH", "PWD", "USER", "npm_config_user_agent"].includes(key) || key.startsWith("TODOS_") || key.startsWith("BUN_"));
+  const redactedKeys = interesting.filter(isSecretEnvKey);
+  const values = includeValues ? Object.fromEntries(interesting.map((key) => [key, isSecretEnvKey(key) ? "[REDACTED]" : redactEvidenceText(String(env[key] ?? ""))])) : null;
+  return {
+    command: null,
+    env_keys: interesting,
+    env: values,
+    redacted_keys: redactedKeys
+  };
+}
+function defaultSnapshotDir() {
+  const dbPath = getDatabasePath();
+  if (dbPath === ":memory:" || dbPath.startsWith("file::memory:"))
+    return join14(tmpdir2(), "hasna-todos", "environment-snapshots");
+  return join14(dirname10(resolve12(dbPath)), "environment-snapshots");
+}
+function snapshotWithId(snapshot) {
+  const digest = sha2563(JSON.stringify(snapshot)).slice(0, 24);
+  return { id: `env_${digest}`, ...snapshot };
+}
+function captureEnvironmentSnapshot(input = {}) {
+  const root = resolve12(input.root || process.cwd());
+  const env = input.env || process.env;
+  const warnings = [];
+  const manifests = MANIFEST_FILES.map((file) => manifestRecord(root, file)).filter((file) => Boolean(file));
+  const lockfiles = LOCKFILES.map((file) => fileRecord(root, file)).filter((file) => Boolean(file));
+  const configHashes = CONFIG_FILES.map((file) => fileRecord(root, file)).filter((file) => Boolean(file));
+  const commandMetadata = commandEnv(env, Boolean(input.include_env_values));
+  commandMetadata.command = input.command ? redactEvidenceText(input.command) : null;
+  if (manifests.length === 0)
+    warnings.push("no package manifest found");
+  if (lockfiles.length === 0)
+    warnings.push("no package lockfile found");
+  return snapshotWithId({
+    schema_version: 1,
+    captured_at: input.now ? new Date(input.now).toISOString() : new Date().toISOString(),
+    root,
+    machine: { hostname: hostname(), platform: platform(), arch: arch() },
+    target: {
+      task_id: input.task_id ?? null,
+      run_id: input.run_id ?? null,
+      agent_id: input.agent_id ?? null
+    },
+    runtime: {
+      bun: Bun.version || null,
+      node: process.version,
+      executable: process.execPath
+    },
+    package_manager: {
+      manager: packageManager(env, lockfiles),
+      user_agent: env["npm_config_user_agent"] ? redactEvidenceText(env["npm_config_user_agent"]) : null,
+      manifests,
+      lockfiles
+    },
+    git: captureGit(root, warnings),
+    config_hashes: configHashes,
+    command_env: commandMetadata,
+    warnings
+  });
+}
+function writeEnvironmentSnapshot(snapshot, outputPath) {
+  const path = outputPath ? resolve12(outputPath) : join14(defaultSnapshotDir(), `${snapshot.id}.json`);
+  ensureDir2(dirname10(path));
+  writeJsonFile(path, snapshot);
+  return path;
+}
+function readEnvironmentSnapshot(path) {
+  const snapshot = readJsonFile(resolve12(path));
+  if (!snapshot || snapshot.schema_version !== 1 || typeof snapshot.id !== "string") {
+    throw new Error(`Invalid environment snapshot: ${path}`);
+  }
+  return snapshot;
+}
+function recordEnvironmentSnapshot(input = {}, db) {
+  let taskId = input.task_id;
+  let runId = input.run_id;
+  const needsDatabase = Boolean(taskId || runId);
+  const d = needsDatabase ? db || getDatabase() : null;
+  if (runId) {
+    runId = resolveTaskRunId(runId, d);
+    const run = getTaskRun(runId, d);
+    if (!run)
+      throw new Error(`Run not found: ${input.run_id}`);
+    taskId = taskId || run.task_id;
+  }
+  if (taskId && d) {
+    taskId = resolvePartialId(d, "tasks", taskId) || taskId;
+    if (!getTask(taskId, d))
+      throw new Error(`Task not found: ${taskId}`);
+  }
+  const snapshot = captureEnvironmentSnapshot({ ...input, task_id: taskId, run_id: runId });
+  const outputPath = writeEnvironmentSnapshot(snapshot, input.output_path);
+  let taskVerificationId = null;
+  let runArtifactId = null;
+  if (runId) {
+    const artifact = addTaskRunArtifact({
+      run_id: runId,
+      path: outputPath,
+      artifact_type: "environment_snapshot",
+      description: "Reproducible local environment snapshot",
+      metadata: { environment_snapshot_id: snapshot.id, schema_version: snapshot.schema_version },
+      store_content: input.store_content ?? true,
+      agent_id: input.agent_id
+    }, d);
+    runArtifactId = artifact.id;
+  } else if (taskId) {
+    const verification = addTaskVerification({
+      task_id: taskId,
+      command: input.command || "capture environment snapshot",
+      status: "unknown",
+      output_summary: `environment snapshot ${snapshot.id}`,
+      artifact_path: outputPath,
+      agent_id: input.agent_id,
+      run_at: snapshot.captured_at
+    }, d);
+    taskVerificationId = verification.id;
+  }
+  return { snapshot, output_path: outputPath, task_verification_id: taskVerificationId, run_artifact_id: runArtifactId };
+}
+function keyed(files) {
+  return new Map(files.map((file) => [file.path, file]));
+}
+function diffFiles(left, right) {
+  const leftMap = keyed(left);
+  const rightMap = keyed(right);
+  const paths = [...new Set([...leftMap.keys(), ...rightMap.keys()])].sort((a, b) => a.localeCompare(b));
+  return paths.map((path) => ({ path, left_sha256: leftMap.get(path)?.sha256 ?? null, right_sha256: rightMap.get(path)?.sha256 ?? null })).filter((entry) => entry.left_sha256 !== entry.right_sha256);
+}
+function compareEnvironmentSnapshots(left, right) {
+  const warnings = [];
+  if (left.schema_version !== right.schema_version)
+    warnings.push("snapshot schema versions differ");
+  return {
+    schema_version: 1,
+    left_id: left.id,
+    right_id: right.id,
+    same_root: left.root === right.root,
+    same_machine: left.machine.hostname === right.machine.hostname && left.machine.platform === right.machine.platform && left.machine.arch === right.machine.arch,
+    same_runtime: left.runtime.bun === right.runtime.bun && left.runtime.node === right.runtime.node,
+    same_git_commit: left.git.commit === right.git.commit,
+    dirty_state_changed: left.git.is_dirty !== right.git.is_dirty,
+    changed_config_hashes: diffFiles(left.config_hashes, right.config_hashes),
+    changed_lockfiles: diffFiles(left.package_manager.lockfiles, right.package_manager.lockfiles),
+    changed_manifests: diffFiles(left.package_manager.manifests, right.package_manager.manifests),
+    warnings
+  };
+}
+function compareEnvironmentSnapshotFiles(leftPath, rightPath) {
+  return compareEnvironmentSnapshots(readEnvironmentSnapshot(leftPath), readEnvironmentSnapshot(rightPath));
+}
+var MANIFEST_FILES, LOCKFILES, CONFIG_FILES;
+var init_environment_snapshots = __esm(() => {
+  init_task_runs();
+  init_task_commits();
+  init_database();
+  init_tasks();
+  init_sync_utils();
+  MANIFEST_FILES = ["package.json", "dashboard/package.json", "sdk/package.json"];
+  LOCKFILES = ["bun.lock", "bun.lockb", "package-lock.json", "npm-shrinkwrap.json"];
+  CONFIG_FILES = [
+    "AGENTS.md",
+    "CLAUDE.md",
+    "README.md",
+    "SECURITY.md",
+    "bunfig.toml",
+    "tsconfig.json",
+    "components.json",
+    "next.config.js",
+    "next.config.mjs",
+    "next.config.ts",
+    "vite.config.ts",
+    "dashboard/vite.config.ts"
+  ];
+});
+
+// src/mcp/tools/environment-snapshots.ts
+function registerEnvironmentSnapshotTools(server, { shouldRegisterTool, formatError }) {
+  if (shouldRegisterTool("capture_environment_snapshot")) {
+    server.tool("capture_environment_snapshot", "Capture a local reproducible environment snapshot with Bun/node versions, package-manager state, git status, config hashes, command metadata, and redacted manifests. Optionally attach it to a local task or run.", {
+      root: exports_external.string().optional(),
+      task_id: exports_external.string().optional(),
+      run_id: exports_external.string().optional(),
+      agent_id: exports_external.string().optional(),
+      command: exports_external.string().optional(),
+      output_path: exports_external.string().optional(),
+      include_env_values: exports_external.boolean().optional()
+    }, async (params) => {
+      try {
+        const { recordEnvironmentSnapshot: recordEnvironmentSnapshot2 } = await Promise.resolve().then(() => (init_environment_snapshots(), exports_environment_snapshots));
+        const result = recordEnvironmentSnapshot2(params);
+        return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      } catch (e) {
+        return { content: [{ type: "text", text: formatError(e) }], isError: true };
+      }
+    });
+  }
+  if (shouldRegisterTool("compare_environment_snapshots")) {
+    server.tool("compare_environment_snapshots", "Compare two local environment snapshot JSON files and report runtime, git, manifest, lockfile, and config hash drift.", {
+      left_path: exports_external.string(),
+      right_path: exports_external.string()
+    }, async ({ left_path, right_path }) => {
+      try {
+        const { compareEnvironmentSnapshotFiles: compareEnvironmentSnapshotFiles2 } = await Promise.resolve().then(() => (init_environment_snapshots(), exports_environment_snapshots));
+        return { content: [{ type: "text", text: JSON.stringify(compareEnvironmentSnapshotFiles2(left_path, right_path), null, 2) }] };
+      } catch (e) {
+        return { content: [{ type: "text", text: formatError(e) }], isError: true };
+      }
+    });
+  }
+}
+var init_environment_snapshots2 = __esm(() => {
+  init_zod();
+});
+
 // src/mcp/index.ts
 var exports_mcp = {};
 __export(exports_mcp, {
@@ -33304,6 +33634,7 @@ var init_mcp = __esm(() => {
   init_machines2();
   init_agents2();
   init_templates2();
+  init_environment_snapshots2();
   init_package_version();
   init_token_utils();
   if (hasVersionFlag()) {
@@ -33335,6 +33666,7 @@ var init_mcp = __esm(() => {
   registerCodeTools(server, toolContext);
   registerAgentTools(server, { ...toolContext, agentFocusMap });
   registerTemplateTools(server, toolContext);
+  registerEnvironmentSnapshotTools(server, toolContext);
   registerMachineTools(server, { shouldRegisterTool, formatError });
   registerDispatchTools(server, { shouldRegisterTool, resolveId, formatError });
   main().catch(async (err) => {
@@ -33354,43 +33686,43 @@ __export(exports_mcp_hooks_commands, {
 });
 import chalk8 from "chalk";
 import { execSync as execSync3 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync8, chmodSync as chmodSync2 } from "fs";
-import { dirname as dirname10, join as join14 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync10, writeFileSync as writeFileSync6, mkdirSync as mkdirSync8, chmodSync as chmodSync2 } from "fs";
+import { dirname as dirname11, join as join15 } from "path";
 function getMcpBinaryPath() {
   try {
     const p = execSync3("which todos-mcp", { encoding: "utf-8" }).trim();
     if (p)
       return p;
   } catch {}
-  const bunBin = join14(HOME2, ".bun", "bin", "todos-mcp");
-  if (existsSync13(bunBin))
+  const bunBin = join15(HOME2, ".bun", "bin", "todos-mcp");
+  if (existsSync14(bunBin))
     return bunBin;
   return "todos-mcp";
 }
 function readJsonFile2(path) {
-  if (!existsSync13(path))
+  if (!existsSync14(path))
     return {};
   try {
-    return JSON.parse(readFileSync9(path, "utf-8"));
+    return JSON.parse(readFileSync10(path, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeJsonFile2(path, data) {
-  const dir = dirname10(path);
-  if (!existsSync13(dir))
+  const dir = dirname11(path);
+  if (!existsSync14(dir))
     mkdirSync8(dir, { recursive: true });
   writeFileSync6(path, JSON.stringify(data, null, 2) + `
 `);
 }
 function readTomlFile(path) {
-  if (!existsSync13(path))
+  if (!existsSync14(path))
     return "";
-  return readFileSync9(path, "utf-8");
+  return readFileSync10(path, "utf-8");
 }
 function writeTomlFile(path, content) {
-  const dir = dirname10(path);
-  if (!existsSync13(dir))
+  const dir = dirname11(path);
+  if (!existsSync14(dir))
     mkdirSync8(dir, { recursive: true });
   writeFileSync6(path, content);
 }
@@ -33456,7 +33788,7 @@ function unregisterClaude(_global) {
   }
 }
 function registerCodex(binPath) {
-  const configPath = join14(HOME2, ".codex", "config.toml");
+  const configPath = join15(HOME2, ".codex", "config.toml");
   let content = readTomlFile(configPath);
   content = removeTomlBlock(content, "mcp_servers.todos");
   const block = `
@@ -33470,7 +33802,7 @@ args = []
   console.log(chalk8.green(`Codex CLI: registered in ${configPath}`));
 }
 function unregisterCodex() {
-  const configPath = join14(HOME2, ".codex", "config.toml");
+  const configPath = join15(HOME2, ".codex", "config.toml");
   let content = readTomlFile(configPath);
   if (!content.includes("[mcp_servers.todos]")) {
     console.log(chalk8.dim(`Codex CLI: todos not found in ${configPath}`));
@@ -33482,7 +33814,7 @@ function unregisterCodex() {
   console.log(chalk8.green(`Codex CLI: unregistered from ${configPath}`));
 }
 function registerGemini(binPath) {
-  const configPath = join14(HOME2, ".gemini", "settings.json");
+  const configPath = join15(HOME2, ".gemini", "settings.json");
   const config = readJsonFile2(configPath);
   if (!config["mcpServers"]) {
     config["mcpServers"] = {};
@@ -33496,7 +33828,7 @@ function registerGemini(binPath) {
   console.log(chalk8.green(`Gemini CLI: registered in ${configPath}`));
 }
 function unregisterGemini() {
-  const configPath = join14(HOME2, ".gemini", "settings.json");
+  const configPath = join15(HOME2, ".gemini", "settings.json");
   const config = readJsonFile2(configPath);
   const servers = config["mcpServers"];
   if (!servers || !("todos" in servers)) {
@@ -33553,8 +33885,8 @@ function registerMcpHooksCommands(program2) {
       if (p)
         todosBin = p;
     } catch {}
-    const hooksDir = join14(process.cwd(), ".claude", "hooks");
-    if (!existsSync13(hooksDir))
+    const hooksDir = join15(process.cwd(), ".claude", "hooks");
+    if (!existsSync14(hooksDir))
       mkdirSync8(hooksDir, { recursive: true });
     const hookScript = `#!/usr/bin/env bash
 # Auto-generated by: todos hooks install
@@ -33579,11 +33911,11 @@ esac
 
 exit 0
 `;
-    const hookPath = join14(hooksDir, "todos-sync.sh");
+    const hookPath = join15(hooksDir, "todos-sync.sh");
     writeFileSync6(hookPath, hookScript);
     execSync3(`chmod +x "${hookPath}"`);
     console.log(chalk8.green(`Hook script created: ${hookPath}`));
-    const settingsPath = join14(process.cwd(), ".claude", "settings.json");
+    const settingsPath = join15(process.cwd(), ".claude", "settings.json");
     const settings = readJsonFile2(settingsPath);
     if (!settings["hooks"]) {
       settings["hooks"] = {};
@@ -34326,8 +34658,8 @@ Artifacts:`));
       const gitDir = execSync3("git rev-parse --git-dir", { encoding: "utf-8" }).trim();
       const hookPath = `${gitDir}/hooks/post-commit`;
       const marker = "# todos-auto-link";
-      if (existsSync13(hookPath)) {
-        const existing = readFileSync9(hookPath, "utf-8");
+      if (existsSync14(hookPath)) {
+        const existing = readFileSync10(hookPath, "utf-8");
         if (existing.includes(marker)) {
           console.log(chalk8.yellow("Hook already installed."));
           return;
@@ -34354,11 +34686,11 @@ $(dirname "$0")/../../scripts/post-commit-hook.sh
       const gitDir = execSync3("git rev-parse --git-dir", { encoding: "utf-8" }).trim();
       const hookPath = `${gitDir}/hooks/post-commit`;
       const marker = "# todos-auto-link";
-      if (!existsSync13(hookPath)) {
+      if (!existsSync14(hookPath)) {
         console.log(chalk8.dim("No post-commit hook found."));
         return;
       }
-      const content = readFileSync9(hookPath, "utf-8");
+      const content = readFileSync10(hookPath, "utf-8");
       if (!content.includes(marker)) {
         console.log(chalk8.dim("Hook not managed by todos."));
         return;
@@ -34535,8 +34867,8 @@ __export(exports_machines2, {
 import chalk10 from "chalk";
 import { execSync as execSync4 } from "child_process";
 import { writeFileSync as writeFileSync7 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join15 } from "path";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join16 } from "path";
 function getOrCreateLocalMachineName() {
   return process.env["TODOS_MACHINE_NAME"] || __require("os").hostname() || "unknown";
 }
@@ -34730,7 +35062,7 @@ Warning: No primary machine set.`));
       if (opts.push) {
         try {
           const localTasks = listTasks3();
-          const tmpFile = join15(tmpdir2(), `todos-export-${uuid()}.json`);
+          const tmpFile = join16(tmpdir3(), `todos-export-${uuid()}.json`);
           writeFileSync7(tmpFile, JSON.stringify(localTasks, null, 2));
           execSync4(`scp ${tmpFile} ${ssh}:/tmp/todos-import.json`, { timeout: 15000 });
           const importCmd = `ssh ${ssh} 'node -e "const fs=require(\\'fs\\');const tasks=JSON.parse(fs.readFileSync(\\'/tmp/todos-import.json\\',\\'utf-8\\'));console.log(JSON.stringify(tasks.length))"'`;
@@ -34880,6 +35212,84 @@ var init_api_key_commands = __esm(() => {
   init_helpers();
 });
 
+// src/cli/commands/environment-snapshots.ts
+var exports_environment_snapshots2 = {};
+__export(exports_environment_snapshots2, {
+  registerEnvironmentSnapshotCommands: () => registerEnvironmentSnapshotCommands
+});
+import chalk12 from "chalk";
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+function registerEnvironmentSnapshotCommands(program2) {
+  const envCmd = program2.command("env-snapshot").alias("environment-snapshot").description("Capture and compare local reproducible environment snapshots");
+  envCmd.command("capture").description("Capture runtime, package-manager, git, config hash, and redacted environment metadata").option("--root <path>", "Project root to inspect").option("--task <id>", "Attach snapshot evidence to a task").option("--run <id>", "Attach snapshot artifact to a task run").option("--agent <name>", "Agent name for attached evidence").option("--command <command>", "Command or verification step this snapshot explains").option("--output <path>", "Write snapshot JSON to a specific path").option("--include-env-values", "Include nonsecret environment values; secret-like keys are still redacted").action((opts) => {
+    const globalOpts = program2.opts();
+    try {
+      const result = recordEnvironmentSnapshot({
+        root: opts.root,
+        task_id: opts.task,
+        run_id: opts.run,
+        agent_id: opts.agent || globalOpts.agent,
+        command: opts.command,
+        output_path: opts.output,
+        include_env_values: Boolean(opts.includeEnvValues)
+      });
+      if (globalOpts.json) {
+        printJson(result);
+        return;
+      }
+      console.log(chalk12.green("Captured") + ` ${result.snapshot.id}`);
+      console.log(`path: ${result.output_path}`);
+      console.log(`root: ${result.snapshot.root}`);
+      console.log(`git: ${result.snapshot.git.commit || "none"}${result.snapshot.git.is_dirty ? " dirty" : ""}`);
+      console.log(`runtime: bun ${result.snapshot.runtime.bun || "unknown"} / node ${result.snapshot.runtime.node}`);
+      if (result.run_artifact_id)
+        console.log(`run artifact: ${result.run_artifact_id}`);
+      if (result.task_verification_id)
+        console.log(`task verification: ${result.task_verification_id}`);
+      for (const warning of result.snapshot.warnings)
+        console.log(chalk12.yellow(`warning: ${warning}`));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (globalOpts.json)
+        printJson({ error: message });
+      else
+        console.error(chalk12.red(`Error: ${message}`));
+      process.exit(1);
+    }
+  });
+  envCmd.command("compare").description("Compare two environment snapshot JSON files").argument("<left>", "Left snapshot JSON path").argument("<right>", "Right snapshot JSON path").action((left, right) => {
+    const globalOpts = program2.opts();
+    try {
+      const comparison = compareEnvironmentSnapshotFiles(left, right);
+      if (globalOpts.json) {
+        printJson(comparison);
+        return;
+      }
+      console.log(`left: ${comparison.left_id}`);
+      console.log(`right: ${comparison.right_id}`);
+      console.log(`same root: ${comparison.same_root}`);
+      console.log(`same machine: ${comparison.same_machine}`);
+      console.log(`same runtime: ${comparison.same_runtime}`);
+      console.log(`same git commit: ${comparison.same_git_commit}`);
+      console.log(`dirty state changed: ${comparison.dirty_state_changed}`);
+      const changed = comparison.changed_config_hashes.length + comparison.changed_lockfiles.length + comparison.changed_manifests.length;
+      console.log(`changed files: ${changed}`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (globalOpts.json)
+        printJson({ error: message });
+      else
+        console.error(chalk12.red(`Error: ${message}`));
+      process.exit(1);
+    }
+  });
+}
+var init_environment_snapshots3 = __esm(() => {
+  init_environment_snapshots();
+});
+
 // src/cli/index.tsx
 init_esm();
 init_package_version();
@@ -34895,7 +35305,8 @@ var [
   { registerMcpHooksCommands: registerMcpHooksCommands2 },
   { registerDispatchCommands: registerDispatchCommands2 },
   { registerMachineCommands: registerMachineCommands2 },
-  { registerApiKeyCommands: registerApiKeyCommands2 }
+  { registerApiKeyCommands: registerApiKeyCommands2 },
+  { registerEnvironmentSnapshotCommands: registerEnvironmentSnapshotCommands2 }
 ] = await Promise.all([
   Promise.resolve().then(() => (init_task_commands(), exports_task_commands)),
   Promise.resolve().then(() => (init_plan_template_commands(), exports_plan_template_commands)),
@@ -34906,7 +35317,8 @@ var [
   Promise.resolve().then(() => (init_mcp_hooks_commands(), exports_mcp_hooks_commands)),
   Promise.resolve().then(() => (init_dispatch3(), exports_dispatch2)),
   Promise.resolve().then(() => (init_machines3(), exports_machines2)),
-  Promise.resolve().then(() => (init_api_key_commands(), exports_api_key_commands))
+  Promise.resolve().then(() => (init_api_key_commands(), exports_api_key_commands)),
+  Promise.resolve().then(() => (init_environment_snapshots3(), exports_environment_snapshots2))
 ]);
 registerTaskCommands2(program2);
 registerPlanTemplateCommands2(program2);
@@ -34918,4 +35330,5 @@ registerMcpHooksCommands2(program2);
 registerDispatchCommands2(program2);
 registerMachineCommands2(program2);
 registerApiKeyCommands2(program2);
+registerEnvironmentSnapshotCommands2(program2);
 program2.parse();

package/dist/cli-mcp-parity.d.ts

@@ -1,4 +1,4 @@
-export type TodosCliMcpParityDomain = "tasks" | "local-fields" | "dedupe" | "verification-providers" | "projects" | "plans" | "templates" | "workspace-trust" | "runner-sandbox" | "policy-packs" | "approval-gates" | "local-event-hooks" | "encryption" | "agent-runs" | "handoffs" | "runs" | "comments" | "search" | "context-packs" | "imports" | "exports";
+export type TodosCliMcpParityDomain = "tasks" | "local-fields" | "dedupe" | "verification-providers" | "projects" | "plans" | "templates" | "workspace-trust" | "runner-sandbox" | "policy-packs" | "approval-gates" | "local-event-hooks" | "encryption" | "agent-runs" | "handoffs" | "runs" | "comments" | "search" | "context-packs" | "environment-snapshots" | "imports" | "exports";
 export type TodosCliMcpParityStatus = "matched" | "intentional-gap";
 export interface CreateCliMcpParityManifestOptions {
     version?: string;

package/dist/cli-mcp-parity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-mcp-parity.d.ts","sourceRoot":"","sources":["../src/cli-mcp-parity.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,uBAAuB,GAC/B,OAAO,GACP,cAAc,GACd,QAAQ,GACR,wBAAwB,GACxB,UAAU,GACV,OAAO,GACP,WAAW,GACX,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,mBAAmB,GACnB,YAAY,GACZ,YAAY,GACZ,UAAU,GACV,MAAM,GACN,UAAU,GACV,QAAQ,GACR,eAAe,GACf,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEpE,MAAM,WAAW,iCAAiC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,cAAc,CAAC;IAC5B,UAAU,EAAE,aAAa,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,uBAAuB,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,uBAAuB,CAAC;IAChC,eAAe,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,CAAC,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,8BAA8B,CAAC;IACxC,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;IACxB,MAAM,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAUD,eAAO,MAAM,oBAAoB,EAAE,sBAAsB,EAsjBxD,CAAC;AAYF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,iCAAsC,GAC9C,yBAAyB,CAW3B;AAED,eAAO,MAAM,6BAA6B,2BAExC,CAAC"}
+{"version":3,"file":"cli-mcp-parity.d.ts","sourceRoot":"","sources":["../src/cli-mcp-parity.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,uBAAuB,GAC/B,OAAO,GACP,cAAc,GACd,QAAQ,GACR,wBAAwB,GACxB,UAAU,GACV,OAAO,GACP,WAAW,GACX,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,mBAAmB,GACnB,YAAY,GACZ,YAAY,GACZ,UAAU,GACV,MAAM,GACN,UAAU,GACV,QAAQ,GACR,eAAe,GACf,uBAAuB,GACvB,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAEpE,MAAM,WAAW,iCAAiC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,cAAc,CAAC;IAC5B,UAAU,EAAE,aAAa,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,uBAAuB,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,uBAAuB,CAAC;IAChC,eAAe,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,CAAC,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,8BAA8B,CAAC;IACxC,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;IACxB,MAAM,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAUD,eAAO,MAAM,oBAAoB,EAAE,sBAAsB,EAkkBxD,CAAC;AAYF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,iCAAsC,GAC9C,yBAAyB,CAW3B;AAED,eAAO,MAAM,6BAA6B,2BAExC,CAAC"}