@hasna/todos 0.11.58 → 0.11.60

package/README.md

@@ -33,6 +33,20 @@ todos manual
 todos manual --json
 ```
 
+Deterministic loops can upsert a task by stable fingerprint without creating
+duplicates. The fingerprint is stored as `metadata.fingerprint`, and later
+upserts shallow-merge metadata so expectation fields can be refreshed safely:
+
+```bash
+todos --json task upsert \
+  --fingerprint "loop:expectation:key" \
+  --title "Expectation failed" \
+  --metadata-json '{"expectation_id":"exp-1"}' \
+  --evidence-paths "logs/loop.txt" \
+  --expected '{"status":"ok"}' \
+  --observed '{"status":"failed"}'
+```
+
 ## Terminal Dashboard
 
 `todos dashboard` launches a local Ink TUI with keyboard tabs for overview,
@@ -398,7 +412,14 @@ polling:
 todos webhooks add loops \
   --id openloops-task-created \
   --transport command \
+  --source todos \
   --type task.created \
+  --metadata 'project_path=/home/hasna/workspace/hasna/opensource/*' \
+  --metadata-json 'route_enabled=true' \
+  --metadata-json 'automation.no_auto!=true' \
+  --metadata-json 'automation.manual_required!=true' \
+  --metadata-json 'automation.requires_approval!=true' \
+  --metadata-json 'automation.approval_required!=true' \
   --arg=events \
   --arg=handle \
   --arg=todos-task \
@@ -418,8 +439,27 @@ When a task is created, `@hasna/events` sends the event JSON on stdin and in
 `HASNA_EVENT_JSON`. OpenLoops uses that event to create a deduped one-shot
 worker/verifier workflow for the task. The event data includes task identity,
 title, description, project/list ids, working directory, tags, metadata, status,
-priority, and timestamps. Local event hooks remain available for local-only
-JSONL/socket/script integrations.
+priority, approval state, and timestamps. Event metadata includes routing-safe
+project/list/path fields, `route_enabled` when the task metadata opts in, and an
+`automation` object containing only boolean routing gates such as `no_auto`,
+`manual_required`, `requires_approval`, and `approval_required`.
+
+Production task-created routes should fail closed:
+
+- Require one explicit opt-in, either task metadata `route_enabled=true` or an
+  approved routing tag such as `auto:route`.
+- Add negative automation predicates so `no_auto`, manual, and approval-gated
+  tasks do not invoke the route.
+- Scope by project path, task list, tags, or repo metadata before invoking
+  OpenLoops.
+- Avoid overlapping opt-in channels for the same task family unless the target
+  handler is idempotent. `loops events handle todos-task` dedupes by task id and
+  event type, but a narrower subscription still avoids wasted invocations.
+
+For tag opt-in, use a second route with the same deny predicates and
+`--data 'tags=auto:route'` instead of `--metadata-json 'route_enabled=true'`.
+Tasks without one of those opt-ins are intentionally no-route. Local event hooks
+remain available for local-only JSONL/socket/script integrations.
 
 ## Local Terminal Notifications
 
@@ -781,6 +821,30 @@ metadata, redaction status, retention metadata, and metadata-only fallback when
 the original path is unavailable. Use `--no-store` to record only artifact
 metadata.
 
+Loops that need bounded, idempotent JSON can use the transaction commands
+instead of scripting around comments and run lookup:
+
+```bash
+todos runs begin <task-id> --key nightly:parser:42 --agent codex --title "Nightly parser loop"
+RUN_ID=$(todos runs begin <task-id> --key nightly:parser:42 --agent codex --title "Nightly parser loop" --apply | jq -r .run.id)
+todos findings upsert --task <task-id> --run "$RUN_ID" --fingerprint parser-timeout --title "Parser timeout" --severity high --source nightly-parser --artifact logs/parser-loop.txt --apply
+todos findings resolve-missing --task <task-id> --source nightly-parser --fingerprints parser-timeout --run "$RUN_ID"
+todos findings resolve-missing --task <task-id> --source nightly-parser --fingerprints parser-timeout --run "$RUN_ID" --apply
+todos runs finish "$RUN_ID" --status completed --summary "nightly loop complete"
+```
+
+`runs begin` is dry-run by default and only creates a run when `--apply` is
+provided. Reusing the same `--key`, `--loop-run-id`, or `--loop-id` returns the
+existing compact run summary instead of creating duplicates. `runs finish` is
+idempotent for already-finished runs and can resolve a run by `--key --task`.
+Finding upserts are deduped by task and fingerprint, redacted before storage,
+and expose only artifact paths/references by default. `findings upsert` and
+`findings resolve-missing` are dry-run by default; add `--apply` to mutate local
+state. MCP clients use `begin_task_run_transaction`, `finish_task_run`,
+`upsert_task_finding`, `list_task_findings`, and
+`resolve_missing_task_findings`; these compact loop tools are included in the
+default `TODOS_PROFILE=minimal` surface.
+
 ## Local Time Tracking
 
 Manual time logs and focus sessions stay in the local SQLite database and roll

package/dist/cli/commands/mcp-hooks-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-hooks-commands.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/mcp-hooks-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwMzC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,QAghCxD"}
+{"version":3,"file":"mcp-hooks-commands.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/mcp-hooks-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwMzC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,QA6oCxD"}

package/dist/cli/commands/task-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-commands.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/task-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuEzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QA0wBpD"}
+{"version":3,"file":"task-commands.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/task-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0HzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QAo1BpD"}