@hasna/todos 0.11.59 → 0.11.60

package/README.md

@@ -412,7 +412,14 @@ polling:
 todos webhooks add loops \
   --id openloops-task-created \
   --transport command \
+  --source todos \
   --type task.created \
+  --metadata 'project_path=/home/hasna/workspace/hasna/opensource/*' \
+  --metadata-json 'route_enabled=true' \
+  --metadata-json 'automation.no_auto!=true' \
+  --metadata-json 'automation.manual_required!=true' \
+  --metadata-json 'automation.requires_approval!=true' \
+  --metadata-json 'automation.approval_required!=true' \
   --arg=events \
   --arg=handle \
   --arg=todos-task \
@@ -432,8 +439,27 @@ When a task is created, `@hasna/events` sends the event JSON on stdin and in
 `HASNA_EVENT_JSON`. OpenLoops uses that event to create a deduped one-shot
 worker/verifier workflow for the task. The event data includes task identity,
 title, description, project/list ids, working directory, tags, metadata, status,
-priority, and timestamps. Local event hooks remain available for local-only
-JSONL/socket/script integrations.
+priority, approval state, and timestamps. Event metadata includes routing-safe
+project/list/path fields, `route_enabled` when the task metadata opts in, and an
+`automation` object containing only boolean routing gates such as `no_auto`,
+`manual_required`, `requires_approval`, and `approval_required`.
+
+Production task-created routes should fail closed:
+
+- Require one explicit opt-in, either task metadata `route_enabled=true` or an
+  approved routing tag such as `auto:route`.
+- Add negative automation predicates so `no_auto`, manual, and approval-gated
+  tasks do not invoke the route.
+- Scope by project path, task list, tags, or repo metadata before invoking
+  OpenLoops.
+- Avoid overlapping opt-in channels for the same task family unless the target
+  handler is idempotent. `loops events handle todos-task` dedupes by task id and
+  event type, but a narrower subscription still avoids wasted invocations.
+
+For tag opt-in, use a second route with the same deny predicates and
+`--data 'tags=auto:route'` instead of `--metadata-json 'route_enabled=true'`.
+Tasks without one of those opt-ins are intentionally no-route. Local event hooks
+remain available for local-only JSONL/socket/script integrations.
 
 ## Local Terminal Notifications
 

package/dist/cli/index.js

@@ -6239,7 +6239,7 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.9/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.10/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
 import { homedir } from "os";
@@ -6286,14 +6286,40 @@ function matchRecord(input, matcher) {
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
     const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected, {
-        segmentSafe: path.endsWith("_path") || path.endsWith(".path")
-      });
-    }
-    return actual === expected;
+    return matchField(actual, expected, path);
   });
 }
+function matchField(actual, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !matchPositiveField(actual, expected.not, path);
+  }
+  return matchPositiveField(actual, expected, path);
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -6901,9 +6927,66 @@ function taskEventData(task, extra = {}) {
     started_at: task.started_at,
     completed_at: task.completed_at,
     due_at: task.due_at,
+    requires_approval: task.requires_approval,
+    approved_by: task.approved_by,
+    approved_at: task.approved_at,
     ...extra
   };
 }
+function booleanField(value) {
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (value === 1)
+      return true;
+    if (value === 0)
+      return false;
+  }
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized))
+      return true;
+    if (["false", "0", "no", "off"].includes(normalized))
+      return false;
+  }
+  return;
+}
+function objectField(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function firstBoolean(records, keys) {
+  for (const record of records) {
+    for (const key of keys) {
+      const value = booleanField(record[key]);
+      if (value !== undefined)
+        return value;
+    }
+  }
+  return;
+}
+function routingAutomationMetadata(task) {
+  const automation = objectField(task.metadata.automation);
+  const records = [task.metadata];
+  if (automation)
+    records.push(automation);
+  const result = {};
+  const aliases = [
+    ["allowed", ["allowed", "automation_allowed", "automationAllowed"]],
+    ["no_auto", ["no_auto", "noAuto"]],
+    ["manual", ["manual"]],
+    ["manual_required", ["manual_required", "manualRequired"]],
+    ["requires_approval", ["requires_approval", "requiresApproval"]],
+    ["approval_required", ["approval_required", "approvalRequired"]]
+  ];
+  for (const [canonical, keys] of aliases) {
+    const value = firstBoolean(records, keys);
+    if (value !== undefined)
+      result[canonical] = value;
+  }
+  if (task.requires_approval)
+    result.requires_approval = true;
+  return Object.keys(result).length > 0 ? result : undefined;
+}
 function taskEventMetadata(task) {
   const metadata = {
     package: "@hasna/todos",
@@ -6914,6 +6997,14 @@ function taskEventMetadata(task) {
     task_list_id: task.task_list_id,
     working_dir: task.working_dir
   };
+  const routeEnabled = booleanField(task.metadata.route_enabled);
+  if (routeEnabled !== undefined) {
+    metadata.route_enabled = routeEnabled;
+  }
+  const automation = routingAutomationMetadata(task);
+  if (automation) {
+    metadata.automation = automation;
+  }
   try {
     const project = task.project_id ? getProject(task.project_id) : null;
     const projectPath = project ? readMachineLocalPath(project) ?? project.path : task.working_dir;
@@ -6931,9 +7022,6 @@ function taskEventMetadata(task) {
     if (projectPath) {
       metadata.project_kind = classifyProjectKind(projectPath);
       metadata.project_is_worktree = isWorktreePath(projectPath);
-      if (typeof task.metadata.route_enabled === "boolean") {
-        metadata.route_enabled = task.metadata.route_enabled;
-      }
       metadata.working_dir = task.working_dir ?? projectPath;
     }
     const taskList = task.task_list_id ? getTaskList(task.task_list_id) ?? (project ? getTaskListBySlug(task.task_list_id, project.id) : null) : project?.task_list_id ? getTaskListBySlug(project.task_list_id, project.id) : null;

package/dist/contracts.js

@@ -6955,7 +6955,7 @@ async function testLocalEventHook(name, input) {
   return emitLocalEventHooks({ ...input, hooks: [hook] });
 }
 
-// node_modules/.bun/@hasna+events@0.1.9/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.10/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
 import { homedir } from "os";
@@ -7002,14 +7002,40 @@ function matchRecord(input, matcher) {
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
     const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected, {
-        segmentSafe: path.endsWith("_path") || path.endsWith(".path")
-      });
-    }
-    return actual === expected;
+    return matchField(actual, expected, path);
   });
 }
+function matchField(actual, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !matchPositiveField(actual, expected.not, path);
+  }
+  return matchPositiveField(actual, expected, path);
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -7616,9 +7642,66 @@ function taskEventData(task, extra = {}) {
     started_at: task.started_at,
     completed_at: task.completed_at,
     due_at: task.due_at,
+    requires_approval: task.requires_approval,
+    approved_by: task.approved_by,
+    approved_at: task.approved_at,
     ...extra
   };
 }
+function booleanField(value) {
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (value === 1)
+      return true;
+    if (value === 0)
+      return false;
+  }
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized))
+      return true;
+    if (["false", "0", "no", "off"].includes(normalized))
+      return false;
+  }
+  return;
+}
+function objectField(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function firstBoolean(records, keys) {
+  for (const record of records) {
+    for (const key of keys) {
+      const value = booleanField(record[key]);
+      if (value !== undefined)
+        return value;
+    }
+  }
+  return;
+}
+function routingAutomationMetadata(task) {
+  const automation = objectField(task.metadata.automation);
+  const records = [task.metadata];
+  if (automation)
+    records.push(automation);
+  const result = {};
+  const aliases = [
+    ["allowed", ["allowed", "automation_allowed", "automationAllowed"]],
+    ["no_auto", ["no_auto", "noAuto"]],
+    ["manual", ["manual"]],
+    ["manual_required", ["manual_required", "manualRequired"]],
+    ["requires_approval", ["requires_approval", "requiresApproval"]],
+    ["approval_required", ["approval_required", "approvalRequired"]]
+  ];
+  for (const [canonical, keys] of aliases) {
+    const value = firstBoolean(records, keys);
+    if (value !== undefined)
+      result[canonical] = value;
+  }
+  if (task.requires_approval)
+    result.requires_approval = true;
+  return Object.keys(result).length > 0 ? result : undefined;
+}
 function taskEventMetadata(task) {
   const metadata = {
     package: "@hasna/todos",
@@ -7629,6 +7712,14 @@ function taskEventMetadata(task) {
     task_list_id: task.task_list_id,
     working_dir: task.working_dir
   };
+  const routeEnabled = booleanField(task.metadata.route_enabled);
+  if (routeEnabled !== undefined) {
+    metadata.route_enabled = routeEnabled;
+  }
+  const automation = routingAutomationMetadata(task);
+  if (automation) {
+    metadata.automation = automation;
+  }
   try {
     const project = task.project_id ? getProject(task.project_id) : null;
     const projectPath = project ? readMachineLocalPath(project) ?? project.path : task.working_dir;
@@ -7646,9 +7737,6 @@ function taskEventMetadata(task) {
     if (projectPath) {
       metadata.project_kind = classifyProjectKind(projectPath);
       metadata.project_is_worktree = isWorktreePath(projectPath);
-      if (typeof task.metadata.route_enabled === "boolean") {
-        metadata.route_enabled = task.metadata.route_enabled;
-      }
       metadata.working_dir = task.working_dir ?? projectPath;
     }
     const taskList = task.task_list_id ? getTaskList(task.task_list_id) ?? (project ? getTaskListBySlug(task.task_list_id, project.id) : null) : project?.task_list_id ? getTaskListBySlug(project.task_list_id, project.id) : null;

package/dist/index.js

@@ -7060,7 +7060,7 @@ async function testLocalEventHook(name, input) {
   return emitLocalEventHooks({ ...input, hooks: [hook] });
 }
 
-// node_modules/.bun/@hasna+events@0.1.9/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.10/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
 import { homedir } from "os";
@@ -7107,14 +7107,40 @@ function matchRecord(input, matcher) {
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
     const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected, {
-        segmentSafe: path.endsWith("_path") || path.endsWith(".path")
-      });
-    }
-    return actual === expected;
+    return matchField(actual, expected, path);
   });
 }
+function matchField(actual, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !matchPositiveField(actual, expected.not, path);
+  }
+  return matchPositiveField(actual, expected, path);
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -7721,9 +7747,66 @@ function taskEventData(task, extra = {}) {
     started_at: task.started_at,
     completed_at: task.completed_at,
     due_at: task.due_at,
+    requires_approval: task.requires_approval,
+    approved_by: task.approved_by,
+    approved_at: task.approved_at,
     ...extra
   };
 }
+function booleanField(value) {
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (value === 1)
+      return true;
+    if (value === 0)
+      return false;
+  }
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized))
+      return true;
+    if (["false", "0", "no", "off"].includes(normalized))
+      return false;
+  }
+  return;
+}
+function objectField(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function firstBoolean(records, keys) {
+  for (const record of records) {
+    for (const key of keys) {
+      const value = booleanField(record[key]);
+      if (value !== undefined)
+        return value;
+    }
+  }
+  return;
+}
+function routingAutomationMetadata(task) {
+  const automation = objectField(task.metadata.automation);
+  const records = [task.metadata];
+  if (automation)
+    records.push(automation);
+  const result = {};
+  const aliases = [
+    ["allowed", ["allowed", "automation_allowed", "automationAllowed"]],
+    ["no_auto", ["no_auto", "noAuto"]],
+    ["manual", ["manual"]],
+    ["manual_required", ["manual_required", "manualRequired"]],
+    ["requires_approval", ["requires_approval", "requiresApproval"]],
+    ["approval_required", ["approval_required", "approvalRequired"]]
+  ];
+  for (const [canonical, keys] of aliases) {
+    const value = firstBoolean(records, keys);
+    if (value !== undefined)
+      result[canonical] = value;
+  }
+  if (task.requires_approval)
+    result.requires_approval = true;
+  return Object.keys(result).length > 0 ? result : undefined;
+}
 function taskEventMetadata(task) {
   const metadata = {
     package: "@hasna/todos",
@@ -7734,6 +7817,14 @@ function taskEventMetadata(task) {
     task_list_id: task.task_list_id,
     working_dir: task.working_dir
   };
+  const routeEnabled = booleanField(task.metadata.route_enabled);
+  if (routeEnabled !== undefined) {
+    metadata.route_enabled = routeEnabled;
+  }
+  const automation = routingAutomationMetadata(task);
+  if (automation) {
+    metadata.automation = automation;
+  }
   try {
     const project = task.project_id ? getProject(task.project_id) : null;
     const projectPath = project ? readMachineLocalPath(project) ?? project.path : task.working_dir;
@@ -7751,9 +7842,6 @@ function taskEventMetadata(task) {
     if (projectPath) {
       metadata.project_kind = classifyProjectKind(projectPath);
       metadata.project_is_worktree = isWorktreePath(projectPath);
-      if (typeof task.metadata.route_enabled === "boolean") {
-        metadata.route_enabled = task.metadata.route_enabled;
-      }
       metadata.working_dir = task.working_dir ?? projectPath;
     }
     const taskList = task.task_list_id ? getTaskList(task.task_list_id) ?? (project ? getTaskListBySlug(task.task_list_id, project.id) : null) : project?.task_list_id ? getTaskListBySlug(project.task_list_id, project.id) : null;

package/dist/lib/shared-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared-events.d.ts","sourceRoot":"","sources":["../../src/lib/shared-events.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAKnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAI9C,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,cAAc,GACd,eAAe,GACf,qBAAqB,GACrB,gBAAgB,CAAC;AAErB,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2BtG;AAgFD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAE/F"}
+{"version":3,"file":"shared-events.d.ts","sourceRoot":"","sources":["../../src/lib/shared-events.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAKnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAI9C,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,aAAa,GACb,cAAc,GACd,eAAe,GACf,qBAAqB,GACrB,gBAAgB,CAAC;AAErB,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA8BtG;AA0ID,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAE/F"}

package/dist/mcp/index.js

@@ -8738,7 +8738,7 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.9/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.10/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
 import { homedir } from "os";
@@ -8785,14 +8785,40 @@ function matchRecord(input, matcher) {
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
     const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected, {
-        segmentSafe: path.endsWith("_path") || path.endsWith(".path")
-      });
-    }
-    return actual === expected;
+    return matchField(actual, expected, path);
   });
 }
+function matchField(actual, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !matchPositiveField(actual, expected.not, path);
+  }
+  return matchPositiveField(actual, expected, path);
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -9400,9 +9426,66 @@ function taskEventData(task, extra = {}) {
     started_at: task.started_at,
     completed_at: task.completed_at,
     due_at: task.due_at,
+    requires_approval: task.requires_approval,
+    approved_by: task.approved_by,
+    approved_at: task.approved_at,
     ...extra
   };
 }
+function booleanField(value) {
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (value === 1)
+      return true;
+    if (value === 0)
+      return false;
+  }
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized))
+      return true;
+    if (["false", "0", "no", "off"].includes(normalized))
+      return false;
+  }
+  return;
+}
+function objectField(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function firstBoolean(records, keys) {
+  for (const record of records) {
+    for (const key of keys) {
+      const value = booleanField(record[key]);
+      if (value !== undefined)
+        return value;
+    }
+  }
+  return;
+}
+function routingAutomationMetadata(task) {
+  const automation = objectField(task.metadata.automation);
+  const records = [task.metadata];
+  if (automation)
+    records.push(automation);
+  const result = {};
+  const aliases = [
+    ["allowed", ["allowed", "automation_allowed", "automationAllowed"]],
+    ["no_auto", ["no_auto", "noAuto"]],
+    ["manual", ["manual"]],
+    ["manual_required", ["manual_required", "manualRequired"]],
+    ["requires_approval", ["requires_approval", "requiresApproval"]],
+    ["approval_required", ["approval_required", "approvalRequired"]]
+  ];
+  for (const [canonical, keys] of aliases) {
+    const value = firstBoolean(records, keys);
+    if (value !== undefined)
+      result[canonical] = value;
+  }
+  if (task.requires_approval)
+    result.requires_approval = true;
+  return Object.keys(result).length > 0 ? result : undefined;
+}
 function taskEventMetadata(task) {
   const metadata = {
     package: "@hasna/todos",
@@ -9413,6 +9496,14 @@ function taskEventMetadata(task) {
     task_list_id: task.task_list_id,
     working_dir: task.working_dir
   };
+  const routeEnabled = booleanField(task.metadata.route_enabled);
+  if (routeEnabled !== undefined) {
+    metadata.route_enabled = routeEnabled;
+  }
+  const automation = routingAutomationMetadata(task);
+  if (automation) {
+    metadata.automation = automation;
+  }
   try {
     const project = task.project_id ? getProject(task.project_id) : null;
     const projectPath = project ? readMachineLocalPath(project) ?? project.path : task.working_dir;
@@ -9430,9 +9521,6 @@ function taskEventMetadata(task) {
     if (projectPath) {
       metadata.project_kind = classifyProjectKind(projectPath);
       metadata.project_is_worktree = isWorktreePath(projectPath);
-      if (typeof task.metadata.route_enabled === "boolean") {
-        metadata.route_enabled = task.metadata.route_enabled;
-      }
       metadata.working_dir = task.working_dir ?? projectPath;
     }
     const taskList = task.task_list_id ? getTaskList(task.task_list_id) ?? (project ? getTaskListBySlug(task.task_list_id, project.id) : null) : project?.task_list_id ? getTaskListBySlug(project.task_list_id, project.id) : null;

package/dist/registry.js

@@ -6955,7 +6955,7 @@ async function testLocalEventHook(name, input) {
   return emitLocalEventHooks({ ...input, hooks: [hook] });
 }
 
-// node_modules/.bun/@hasna+events@0.1.9/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.10/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
 import { homedir } from "os";
@@ -7002,14 +7002,40 @@ function matchRecord(input, matcher) {
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
     const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected, {
-        segmentSafe: path.endsWith("_path") || path.endsWith(".path")
-      });
-    }
-    return actual === expected;
+    return matchField(actual, expected, path);
   });
 }
+function matchField(actual, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !matchPositiveField(actual, expected.not, path);
+  }
+  return matchPositiveField(actual, expected, path);
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -7616,9 +7642,66 @@ function taskEventData(task, extra = {}) {
     started_at: task.started_at,
     completed_at: task.completed_at,
     due_at: task.due_at,
+    requires_approval: task.requires_approval,
+    approved_by: task.approved_by,
+    approved_at: task.approved_at,
     ...extra
   };
 }
+function booleanField(value) {
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (value === 1)
+      return true;
+    if (value === 0)
+      return false;
+  }
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized))
+      return true;
+    if (["false", "0", "no", "off"].includes(normalized))
+      return false;
+  }
+  return;
+}
+function objectField(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function firstBoolean(records, keys) {
+  for (const record of records) {
+    for (const key of keys) {
+      const value = booleanField(record[key]);
+      if (value !== undefined)
+        return value;
+    }
+  }
+  return;
+}
+function routingAutomationMetadata(task) {
+  const automation = objectField(task.metadata.automation);
+  const records = [task.metadata];
+  if (automation)
+    records.push(automation);
+  const result = {};
+  const aliases = [
+    ["allowed", ["allowed", "automation_allowed", "automationAllowed"]],
+    ["no_auto", ["no_auto", "noAuto"]],
+    ["manual", ["manual"]],
+    ["manual_required", ["manual_required", "manualRequired"]],
+    ["requires_approval", ["requires_approval", "requiresApproval"]],
+    ["approval_required", ["approval_required", "approvalRequired"]]
+  ];
+  for (const [canonical, keys] of aliases) {
+    const value = firstBoolean(records, keys);
+    if (value !== undefined)
+      result[canonical] = value;
+  }
+  if (task.requires_approval)
+    result.requires_approval = true;
+  return Object.keys(result).length > 0 ? result : undefined;
+}
 function taskEventMetadata(task) {
   const metadata = {
     package: "@hasna/todos",
@@ -7629,6 +7712,14 @@ function taskEventMetadata(task) {
     task_list_id: task.task_list_id,
     working_dir: task.working_dir
   };
+  const routeEnabled = booleanField(task.metadata.route_enabled);
+  if (routeEnabled !== undefined) {
+    metadata.route_enabled = routeEnabled;
+  }
+  const automation = routingAutomationMetadata(task);
+  if (automation) {
+    metadata.automation = automation;
+  }
   try {
     const project = task.project_id ? getProject(task.project_id) : null;
     const projectPath = project ? readMachineLocalPath(project) ?? project.path : task.working_dir;
@@ -7646,9 +7737,6 @@ function taskEventMetadata(task) {
     if (projectPath) {
       metadata.project_kind = classifyProjectKind(projectPath);
       metadata.project_is_worktree = isWorktreePath(projectPath);
-      if (typeof task.metadata.route_enabled === "boolean") {
-        metadata.route_enabled = task.metadata.route_enabled;
-      }
       metadata.working_dir = task.working_dir ?? projectPath;
     }
     const taskList = task.task_list_id ? getTaskList(task.task_list_id) ?? (project ? getTaskListBySlug(task.task_list_id, project.id) : null) : project?.task_list_id ? getTaskListBySlug(project.task_list_id, project.id) : null;

package/dist/release-provenance.json

@@ -1,7 +1,7 @@
 {
   "packageName": "@hasna/todos",
-  "packageVersion": "0.11.59",
+  "packageVersion": "0.11.60",
   "repository": "https://github.com/hasna/todos.git",
-  "gitCommit": "b507930ee09c9b1f5c7a46881679965fd35b03fb",
-  "generatedAt": "2026-06-27T09:34:02.825Z"
+  "gitCommit": "ab13bc3c275c0fd348e6ff5a2a1a6109002baf04",
+  "generatedAt": "2026-06-27T12:02:52.731Z"
 }

package/dist/server/index.js

@@ -4099,7 +4099,7 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.9/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.10/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
 import { homedir } from "os";
@@ -4146,14 +4146,40 @@ function matchRecord(input, matcher) {
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
     const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected, {
-        segmentSafe: path.endsWith("_path") || path.endsWith(".path")
-      });
-    }
-    return actual === expected;
+    return matchField(actual, expected, path);
   });
 }
+function matchField(actual, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !matchPositiveField(actual, expected.not, path);
+  }
+  return matchPositiveField(actual, expected, path);
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -4761,9 +4787,66 @@ function taskEventData(task, extra = {}) {
     started_at: task.started_at,
     completed_at: task.completed_at,
     due_at: task.due_at,
+    requires_approval: task.requires_approval,
+    approved_by: task.approved_by,
+    approved_at: task.approved_at,
     ...extra
   };
 }
+function booleanField(value) {
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (value === 1)
+      return true;
+    if (value === 0)
+      return false;
+  }
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized))
+      return true;
+    if (["false", "0", "no", "off"].includes(normalized))
+      return false;
+  }
+  return;
+}
+function objectField(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function firstBoolean(records, keys) {
+  for (const record of records) {
+    for (const key of keys) {
+      const value = booleanField(record[key]);
+      if (value !== undefined)
+        return value;
+    }
+  }
+  return;
+}
+function routingAutomationMetadata(task) {
+  const automation = objectField(task.metadata.automation);
+  const records = [task.metadata];
+  if (automation)
+    records.push(automation);
+  const result = {};
+  const aliases = [
+    ["allowed", ["allowed", "automation_allowed", "automationAllowed"]],
+    ["no_auto", ["no_auto", "noAuto"]],
+    ["manual", ["manual"]],
+    ["manual_required", ["manual_required", "manualRequired"]],
+    ["requires_approval", ["requires_approval", "requiresApproval"]],
+    ["approval_required", ["approval_required", "approvalRequired"]]
+  ];
+  for (const [canonical, keys] of aliases) {
+    const value = firstBoolean(records, keys);
+    if (value !== undefined)
+      result[canonical] = value;
+  }
+  if (task.requires_approval)
+    result.requires_approval = true;
+  return Object.keys(result).length > 0 ? result : undefined;
+}
 function taskEventMetadata(task) {
   const metadata = {
     package: "@hasna/todos",
@@ -4774,6 +4857,14 @@ function taskEventMetadata(task) {
     task_list_id: task.task_list_id,
     working_dir: task.working_dir
   };
+  const routeEnabled = booleanField(task.metadata.route_enabled);
+  if (routeEnabled !== undefined) {
+    metadata.route_enabled = routeEnabled;
+  }
+  const automation = routingAutomationMetadata(task);
+  if (automation) {
+    metadata.automation = automation;
+  }
   try {
     const project = task.project_id ? getProject(task.project_id) : null;
     const projectPath = project ? readMachineLocalPath(project) ?? project.path : task.working_dir;
@@ -4791,9 +4882,6 @@ function taskEventMetadata(task) {
     if (projectPath) {
       metadata.project_kind = classifyProjectKind(projectPath);
       metadata.project_is_worktree = isWorktreePath(projectPath);
-      if (typeof task.metadata.route_enabled === "boolean") {
-        metadata.route_enabled = task.metadata.route_enabled;
-      }
       metadata.working_dir = task.working_dir ?? projectPath;
     }
     const taskList = task.task_list_id ? getTaskList(task.task_list_id) ?? (project ? getTaskListBySlug(task.task_list_id, project.id) : null) : project?.task_list_id ? getTaskListBySlug(project.task_list_id, project.id) : null;

package/dist/storage.js

@@ -4503,7 +4503,7 @@ async function testLocalEventHook(name, input) {
   return emitLocalEventHooks({ ...input, hooks: [hook] });
 }
 
-// node_modules/.bun/@hasna+events@0.1.9/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.10/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
 import { homedir } from "os";
@@ -4550,14 +4550,40 @@ function matchRecord(input, matcher) {
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
     const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected, {
-        segmentSafe: path.endsWith("_path") || path.endsWith(".path")
-      });
-    }
-    return actual === expected;
+    return matchField(actual, expected, path);
   });
 }
+function matchField(actual, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !matchPositiveField(actual, expected.not, path);
+  }
+  return matchPositiveField(actual, expected, path);
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -5164,9 +5190,66 @@ function taskEventData(task, extra = {}) {
     started_at: task.started_at,
     completed_at: task.completed_at,
     due_at: task.due_at,
+    requires_approval: task.requires_approval,
+    approved_by: task.approved_by,
+    approved_at: task.approved_at,
     ...extra
   };
 }
+function booleanField(value) {
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (value === 1)
+      return true;
+    if (value === 0)
+      return false;
+  }
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (["true", "1", "yes", "on"].includes(normalized))
+      return true;
+    if (["false", "0", "no", "off"].includes(normalized))
+      return false;
+  }
+  return;
+}
+function objectField(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function firstBoolean(records, keys) {
+  for (const record of records) {
+    for (const key of keys) {
+      const value = booleanField(record[key]);
+      if (value !== undefined)
+        return value;
+    }
+  }
+  return;
+}
+function routingAutomationMetadata(task) {
+  const automation = objectField(task.metadata.automation);
+  const records = [task.metadata];
+  if (automation)
+    records.push(automation);
+  const result = {};
+  const aliases = [
+    ["allowed", ["allowed", "automation_allowed", "automationAllowed"]],
+    ["no_auto", ["no_auto", "noAuto"]],
+    ["manual", ["manual"]],
+    ["manual_required", ["manual_required", "manualRequired"]],
+    ["requires_approval", ["requires_approval", "requiresApproval"]],
+    ["approval_required", ["approval_required", "approvalRequired"]]
+  ];
+  for (const [canonical, keys] of aliases) {
+    const value = firstBoolean(records, keys);
+    if (value !== undefined)
+      result[canonical] = value;
+  }
+  if (task.requires_approval)
+    result.requires_approval = true;
+  return Object.keys(result).length > 0 ? result : undefined;
+}
 function taskEventMetadata(task) {
   const metadata = {
     package: "@hasna/todos",
@@ -5177,6 +5260,14 @@ function taskEventMetadata(task) {
     task_list_id: task.task_list_id,
     working_dir: task.working_dir
   };
+  const routeEnabled = booleanField(task.metadata.route_enabled);
+  if (routeEnabled !== undefined) {
+    metadata.route_enabled = routeEnabled;
+  }
+  const automation = routingAutomationMetadata(task);
+  if (automation) {
+    metadata.automation = automation;
+  }
   try {
     const project = task.project_id ? getProject(task.project_id) : null;
     const projectPath = project ? readMachineLocalPath(project) ?? project.path : task.working_dir;
@@ -5194,9 +5285,6 @@ function taskEventMetadata(task) {
     if (projectPath) {
       metadata.project_kind = classifyProjectKind(projectPath);
       metadata.project_is_worktree = isWorktreePath(projectPath);
-      if (typeof task.metadata.route_enabled === "boolean") {
-        metadata.route_enabled = task.metadata.route_enabled;
-      }
       metadata.working_dir = task.working_dir ?? projectPath;
     }
     const taskList = task.task_list_id ? getTaskList(task.task_list_id) ?? (project ? getTaskListBySlug(task.task_list_id, project.id) : null) : project?.task_list_id ? getTaskListBySlug(project.task_list_id, project.id) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/todos",
-  "version": "0.11.59",
+  "version": "0.11.60",
   "description": "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   "type": "module",
   "main": "dist/index.js",
@@ -89,7 +89,7 @@
   "author": "Andrei Hasna <andrei@hasna.com>",
   "license": "Apache-2.0",
   "dependencies": {
-    "@hasna/events": "^0.1.9",
+    "@hasna/events": "^0.1.10",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",