@hasna/todos 0.11.85 → 0.11.87

package/dist/storage.js

@@ -9424,7 +9424,7 @@ function getComment(id, db) {
 }
 function listComments(taskId, db) {
   const d = db || getDatabase();
-  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at").all(taskId);
+  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at, rowid").all(taskId);
 }
 function deleteComment(id, db) {
   const d = db || getDatabase();
@@ -11552,6 +11552,10 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       list: (filter = {}) => listTasks(filter, database()),
       count: (filter = {}) => countTasks(filter, database()),
       update: (id, input) => updateTask(id, input, database()),
+      unlock: (id, agentId) => {
+        unlockTask(id, agentId, database());
+        return true;
+      },
       delete: (id) => deleteTask(id, database()),
       start: (id, agentId) => startTask(id, agentId, database()),
       complete: (id, agentId, options2) => completeTask(id, agentId, database(), options2),
@@ -11603,6 +11607,20 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       logTaskChange: (taskId, action, field, oldValue, newValue, agentId) => logTaskChange(taskId, action, field, oldValue, newValue, agentId, database()),
       addComment: (input) => addComment(input, database()),
       getComments: (taskId) => listComments(taskId, database()),
+      getCommentsPage: (taskId, options2) => {
+        if (options2?.limit !== undefined && (!Number.isSafeInteger(options2.limit) || options2.limit < 1 || options2.limit > 1001)) {
+          throw new Error("Comment limit must be an integer between 1 and 1001");
+        }
+        let comments = listComments(taskId, database());
+        comments = comments.sort((left, right) => left.created_at.localeCompare(right.created_at) || left.id.localeCompare(right.id));
+        if (options2?.before) {
+          const before = options2.before;
+          comments = comments.filter((comment) => comment.created_at < before.created_at || comment.created_at === before.created_at && comment.id < before.id);
+        }
+        if (options2?.limit !== undefined)
+          comments = comments.slice(-options2.limit);
+        return comments;
+      },
       getTaskHistory: (taskId) => getTaskHistory(taskId, database()),
       getRecentActivity: (limit) => getRecentActivity(limit, database())
     },
@@ -11650,6 +11668,12 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
     )`
   ];
 }
+function postgresTodosCommentCursorIndexSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  assertSafeIdentifier(tableName);
+  return `CREATE INDEX CONCURRENTLY IF NOT EXISTS ${tableName}_comment_task_created_idx
+    ON ${tableName} (service, (payload->>'task_id'), (payload->>'created_at'), object_id)
+    WHERE object_type = 'comments' AND deleted_at IS NULL`;
+}
 
 class PostgresTodosSyncStore {
   client;
@@ -11882,7 +11906,9 @@ function createHybridTodosStorageAdapter(options) {
 }
 
 // src/storage/postgres-adapter.ts
+init_types();
 import { randomUUID as randomUUID3 } from "crypto";
+init_redaction();
 function createPostgresTodosStorageAdapter(options) {
   const store = new PostgresJsonRecordStore(options);
   const adapter = {
@@ -11909,7 +11935,8 @@ function createPostgresTodosStorageAdapter(options) {
       getActiveWork: (filters) => getActiveWork2(filters, store),
       getChangedSince: (since, filters) => getChangedSince(since, filters, store),
       lock: (id, agentId) => lockTask2(id, agentId, store),
-      unlock: (id, agentId) => unlockTask2(id, agentId, store)
+      unlock: (id, agentId) => unlockTask2(id, agentId, store),
+      getByFingerprint: (fingerprint) => store.getTaskByFingerprint(fingerprint)
     },
     dependencies: {
       add: (taskId, dependsOn, context) => addDependency2(taskId, dependsOn, store, context),
@@ -11977,7 +12004,24 @@ function createPostgresTodosStorageAdapter(options) {
     audit: {
       logTaskChange: (taskId, action, field, oldValue, newValue, agentId, context) => logTaskChange2(taskId, action, field, oldValue, newValue, agentId, store, context),
       addComment: (input, context) => addComment2(input, store, context),
-      getComments: async (taskId) => (await store.list("comments")).filter((comment) => comment.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
+      getComments: async (taskId) => {
+        const pages = [];
+        let before;
+        while (true) {
+          const page = await store.listComments(taskId, { limit: 1000, ...before ? { before } : {} });
+          if (page.length === 0)
+            break;
+          pages.unshift(page);
+          if (page.length < 1000)
+            break;
+          const oldest = page[0];
+          before = { created_at: oldest.created_at, id: oldest.id };
+        }
+        return pages.flat().map(redactComment).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
+      getCommentsPage: async (taskId, options2) => {
+        return (await store.listComments(taskId, options2)).map(redactComment).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
       getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
       getRecentActivity: async (limit = 20) => (await store.list("audit_history")).sort((a, b) => b.created_at.localeCompare(a.created_at)).slice(0, limit)
     },
@@ -12027,6 +12071,27 @@ class PostgresJsonRecordStore {
   async list(type) {
     return (await this.listRecords(type)).map((record) => record.payload);
   }
+  async listComments(taskId, options = {}) {
+    await this.ensureSchema();
+    const limit = options.limit ?? 100;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1001) {
+      throw new Error("Postgres comment limit must be an integer between 1 and 1001");
+    }
+    const params = [this.service, taskId];
+    let cursorPredicate = "";
+    if (options.before) {
+      params.push(options.before.created_at, options.before.id);
+      cursorPredicate = `AND (payload->>'created_at', object_id) < ($3, $4)`;
+    }
+    params.push(limit);
+    const result = await this.options.client.query(`/* todos:list-comments */ SELECT payload FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'comments' AND deleted_at IS NULL
+         AND payload->>'task_id' = $2
+         ${cursorPredicate}
+       ORDER BY payload->>'created_at' DESC, object_id DESC
+       LIMIT $${params.length}`, params);
+    return result.rows.map((row) => payloadRecord2(row.payload)).reverse();
+  }
   async listRecords(type) {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at
@@ -12098,6 +12163,17 @@ class PostgresJsonRecordStore {
     const result = await this.options.client.query(sql, params);
     return result.rows.map((row) => payloadRecord2(row.payload));
   }
+  async getTaskByFingerprint(fingerprint) {
+    await this.ensureSchema();
+    const sql = `/* todos:task-by-fingerprint */ SELECT payload FROM ${this.tableName}
+      WHERE service = $1 AND object_type = $2 AND deleted_at IS NULL
+        AND payload->'metadata'->>'fingerprint' = $3
+      ORDER BY payload->>'created_at' ASC
+      LIMIT 1`;
+    const result = await this.options.client.query(sql, [this.service, "tasks", fingerprint]);
+    const row = result.rows[0];
+    return row ? payloadRecord2(row.payload) : null;
+  }
   async countTasks(filter) {
     await this.ensureSchema();
     const { where, params } = this.buildTaskFilterSql(filter);
@@ -12410,7 +12486,7 @@ async function lockTask2(id, agentId, store) {
 async function unlockTask2(id, agentId, store) {
   const task = await requireRecord("tasks", id, store);
   if (agentId && task.locked_by && task.locked_by !== agentId) {
-    throw new Error(`Task ${id} is locked by ${task.locked_by}, not ${agentId}`);
+    throw new LockError(id, task.locked_by);
   }
   await patchTask(task, { locked_by: null, locked_at: null }, store);
   return true;
@@ -12776,13 +12852,16 @@ async function addComment2(input, store, context) {
     task_id: input.task_id,
     agent_id: input.agent_id ?? context?.agentId ?? null,
     session_id: input.session_id ?? context?.sessionId ?? null,
-    content: input.content,
+    content: redactEvidenceText(input.content),
     type: input.type ?? "comment",
     progress_pct: input.progress_pct ?? null,
     created_at: new Date().toISOString()
   };
   return store.upsert("comments", comment, context);
 }
+function redactComment(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
+}
 async function exportSnapshot(store) {
   return {
     exportedAt: new Date().toISOString(),
@@ -13714,6 +13793,102 @@ async function closeRuntimeShadowCloud() {
     await cloud.close().catch(() => {});
   }
 }
+// src/storage/comment-redaction-backfill.ts
+init_redaction();
+var COMMENT_REDACTION_BACKFILL_CONFIRMATION = "REDACT_STORED_TODOS_COMMENTS";
+function assertSafeIdentifier2(value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`Unsafe Postgres identifier: ${value}`);
+  }
+}
+function payloadObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  if (typeof value !== "string")
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function backfillPostgresCommentRedaction(client, options = {}) {
+  const apply = options.apply === true;
+  if (apply && options.confirmation !== COMMENT_REDACTION_BACKFILL_CONFIRMATION) {
+    throw new Error(`Applying the comment redaction backfill requires confirmation ${COMMENT_REDACTION_BACKFILL_CONFIRMATION}`);
+  }
+  const tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
+  assertSafeIdentifier2(tableName);
+  const service = options.service ?? "todos";
+  const batchSize = options.batchSize ?? 100;
+  if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 500) {
+    throw new Error("Comment redaction backfill batchSize must be an integer between 1 and 500");
+  }
+  const result = {
+    dry_run: !apply,
+    scanned: 0,
+    candidates: 0,
+    updated: 0,
+    conflicts: 0,
+    batches: 0,
+    remaining_candidates: 0
+  };
+  let afterId = "";
+  while (true) {
+    const page = await client.query(`/* todos:comment-redaction-backfill-scan */
+       SELECT object_id, payload
+       FROM ${tableName}
+       WHERE service = $1 AND object_type = 'comments'
+         AND object_id > $2
+       ORDER BY object_id ASC
+       LIMIT $3`, [service, afterId, batchSize]);
+    if (page.rows.length === 0)
+      break;
+    result.batches += 1;
+    for (const row of page.rows) {
+      afterId = row.object_id;
+      result.scanned += 1;
+      const payload = payloadObject(row.payload);
+      const original = payload?.["content"];
+      if (typeof original !== "string")
+        continue;
+      const redacted = redactEvidenceText(original);
+      if (redacted === original)
+        continue;
+      result.candidates += 1;
+      if (!apply)
+        continue;
+      const nextPayload = { ...payload, content: redacted };
+      const update = await client.query(`/* todos:comment-redaction-backfill-apply */
+         UPDATE ${tableName}
+         SET payload = $3::jsonb
+         WHERE service = $1 AND object_type = 'comments' AND object_id = $2
+           AND payload = $4::jsonb
+         RETURNING object_id`, [service, row.object_id, nextPayload, row.payload]);
+      if (update.rows.length === 1)
+        result.updated += 1;
+      else
+        result.conflicts += 1;
+    }
+    if (page.rows.length < batchSize)
+      break;
+  }
+  if (!apply) {
+    result.remaining_candidates = result.candidates;
+    return result;
+  }
+  const verification = await backfillPostgresCommentRedaction(client, {
+    ...options,
+    apply: false,
+    confirmation: undefined
+  });
+  result.remaining_candidates = verification.candidates;
+  return result;
+}
+function isCommentRedactionBackfillComplete(result) {
+  return !result.dry_run && result.conflicts === 0 && result.remaining_candidates === 0;
+}
 // src/storage/s3-artifacts.ts
 import { createHash as createHash3, createHmac as createHmac2 } from "crypto";
 function createTodosS3ArtifactStore(options) {
@@ -14146,6 +14321,7 @@ export {
   signAwsV4Request,
   registerShadowExitFlush,
   postgresTodosSyncSchemaSql,
+  postgresTodosCommentCursorIndexSql,
   planRunArtifactsS3Sync,
   parseStorageMode,
   maybeInstallShadowCapture2 as maybeInstallShadowCapture,
@@ -14153,6 +14329,7 @@ export {
   loadStorageConfig,
   isTodosShadowEnabled,
   isTodosRemoteStorageEnabled,
+  isCommentRedactionBackfillComplete,
   installShadowOutboxSchema,
   importSqliteTodosStorageSnapshot,
   getTodosStorageShadowEnvName,
@@ -14180,6 +14357,7 @@ export {
   closeRuntimeShadowCloud,
   buildS3ObjectUrl,
   buildS3ObjectKey,
+  backfillPostgresCommentRedaction,
   assertTodosShadowConfig,
   assertTodosRemoteStorageConfig,
   TodosShadowOutbox,
@@ -14188,6 +14366,7 @@ export {
   TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV,
   STORAGE_TABLES,
+  COMMENT_REDACTION_BACKFILL_CONFIRMATION,
   CANONICAL_TODOS_RDS_RUNTIME_PATH,
   CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/todos",
-  "version": "0.11.85",
+  "version": "0.11.87",
   "description": "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   "type": "module",
   "main": "dist/index.js",
@@ -50,6 +50,7 @@
     "build": "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts --outdir dist --target bun && tsc --emitDeclarationOnly --outDir dist",
     "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts --outdir dist --target bun",
     "migrate": "bun run src/server/index.ts migrate",
+    "backfill:comment-redaction": "bun run src/server/index.ts redact-comments",
     "generate:sdk": "bun run scripts/generate-sdk.ts",
     "build:dashboard": "cd dashboard && bun install --frozen-lockfile && bun run build",
     "typecheck": "tsc --noEmit",