@hasna/todos 0.11.86 → 0.11.87

package/dist/mcp/index.js

@@ -14085,7 +14085,7 @@ function getComment(id, db) {
 }
 function listComments(taskId, db) {
   const d = db || getDatabase();
-  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at").all(taskId);
+  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at, rowid").all(taskId);
 }
 function updateComment(id, input, db) {
   const d = db || getDatabase();
@@ -22792,14 +22792,18 @@ function unwrapTask(raw) {
 }
 function toListQuery(filter = {}) {
   const query = {};
-  if (typeof filter.status === "string")
-    query["status"] = filter.status;
-  if (typeof filter.priority === "string")
-    query["priority"] = filter.priority;
+  if (filter.status)
+    query["status"] = Array.isArray(filter.status) ? filter.status.join(",") : filter.status;
+  if (filter.priority)
+    query["priority"] = Array.isArray(filter.priority) ? filter.priority.join(",") : filter.priority;
   if (filter.project_id)
     query["project_id"] = filter.project_id;
+  if (filter.parent_id !== undefined)
+    query["parent_id"] = filter.parent_id ?? "";
   if (filter.plan_id)
     query["plan_id"] = filter.plan_id;
+  if (filter.task_list_id)
+    query["task_list_id"] = filter.task_list_id;
   if (filter.assigned_to)
     query["assigned_to"] = filter.assigned_to;
   if (filter.agent_id)
@@ -22849,10 +22853,19 @@ async function cloudListProjects(client) {
 }
 async function cloudAddComment(client, taskId, input) {
   const raw = await client.transport.post(`/tasks/${encodeURIComponent(taskId)}/comments`, input);
-  if (raw && typeof raw === "object" && "comment" in raw) {
-    return raw.comment;
-  }
-  return raw;
+  const comment = raw && typeof raw === "object" && "comment" in raw ? raw.comment : raw;
+  if (!isTaskComment(comment))
+    throw new Error("Invalid cloud comment response");
+  return redactComment(comment);
+}
+function isTaskComment(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const comment = value;
+  return typeof comment["id"] === "string" && typeof comment["task_id"] === "string" && (comment["agent_id"] === null || typeof comment["agent_id"] === "string") && (comment["session_id"] === null || typeof comment["session_id"] === "string") && typeof comment["content"] === "string" && (comment["type"] === "comment" || comment["type"] === "progress" || comment["type"] === "note") && (comment["progress_pct"] === null || typeof comment["progress_pct"] === "number") && typeof comment["created_at"] === "string";
+}
+function redactComment(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
 }
 async function cloudCountTasks(client, filter = {}) {
   const { limit: _drop, offset: _o, ...rest } = filter;
@@ -22885,6 +22898,7 @@ async function cloudReleaseAgent(client, idOrName, sessionId) {
 var _cache;
 var init_cloud_router = __esm(() => {
   init_storage();
+  init_redaction();
 });
 
 // src/mcp/tools/task-crud.ts
@@ -46148,6 +46162,10 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       list: (filter = {}) => listTasks(filter, database()),
       count: (filter = {}) => countTasks(filter, database()),
       update: (id, input) => updateTask(id, input, database()),
+      unlock: (id, agentId) => {
+        unlockTask(id, agentId, database());
+        return true;
+      },
       delete: (id) => deleteTask(id, database()),
       start: (id, agentId) => startTask(id, agentId, database()),
       complete: (id, agentId, options2) => completeTask(id, agentId, database(), options2),
@@ -46199,6 +46217,20 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       logTaskChange: (taskId, action, field, oldValue, newValue, agentId) => logTaskChange(taskId, action, field, oldValue, newValue, agentId, database()),
       addComment: (input) => addComment(input, database()),
       getComments: (taskId) => listComments(taskId, database()),
+      getCommentsPage: (taskId, options2) => {
+        if (options2?.limit !== undefined && (!Number.isSafeInteger(options2.limit) || options2.limit < 1 || options2.limit > 1001)) {
+          throw new Error("Comment limit must be an integer between 1 and 1001");
+        }
+        let comments = listComments(taskId, database());
+        comments = comments.sort((left, right) => left.created_at.localeCompare(right.created_at) || left.id.localeCompare(right.id));
+        if (options2?.before) {
+          const before = options2.before;
+          comments = comments.filter((comment) => comment.created_at < before.created_at || comment.created_at === before.created_at && comment.id < before.id);
+        }
+        if (options2?.limit !== undefined)
+          comments = comments.slice(-options2.limit);
+        return comments;
+      },
       getTaskHistory: (taskId) => getTaskHistory(taskId, database()),
       getRecentActivity: (limit) => getRecentActivity(limit, database())
     },
@@ -46256,6 +46288,12 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
     )`
   ];
 }
+function postgresTodosCommentCursorIndexSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  assertSafeIdentifier(tableName);
+  return `CREATE INDEX CONCURRENTLY IF NOT EXISTS ${tableName}_comment_task_created_idx
+    ON ${tableName} (service, (payload->>'task_id'), (payload->>'created_at'), object_id)
+    WHERE object_type = 'comments' AND deleted_at IS NULL`;
+}
 
 class PostgresTodosSyncStore {
   client;
@@ -48240,7 +48278,24 @@ function createPostgresTodosStorageAdapter(options) {
     audit: {
       logTaskChange: (taskId, action, field, oldValue, newValue, agentId, context) => logTaskChange2(taskId, action, field, oldValue, newValue, agentId, store, context),
       addComment: (input, context) => addComment2(input, store, context),
-      getComments: async (taskId) => (await store.list("comments")).filter((comment) => comment.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
+      getComments: async (taskId) => {
+        const pages = [];
+        let before;
+        while (true) {
+          const page = await store.listComments(taskId, { limit: 1000, ...before ? { before } : {} });
+          if (page.length === 0)
+            break;
+          pages.unshift(page);
+          if (page.length < 1000)
+            break;
+          const oldest = page[0];
+          before = { created_at: oldest.created_at, id: oldest.id };
+        }
+        return pages.flat().map(redactComment2).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
+      getCommentsPage: async (taskId, options2) => {
+        return (await store.listComments(taskId, options2)).map(redactComment2).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
       getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
       getRecentActivity: async (limit = 20) => (await store.list("audit_history")).sort((a, b) => b.created_at.localeCompare(a.created_at)).slice(0, limit)
     },
@@ -48290,6 +48345,27 @@ class PostgresJsonRecordStore {
   async list(type) {
     return (await this.listRecords(type)).map((record) => record.payload);
   }
+  async listComments(taskId, options = {}) {
+    await this.ensureSchema();
+    const limit = options.limit ?? 100;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1001) {
+      throw new Error("Postgres comment limit must be an integer between 1 and 1001");
+    }
+    const params = [this.service, taskId];
+    let cursorPredicate = "";
+    if (options.before) {
+      params.push(options.before.created_at, options.before.id);
+      cursorPredicate = `AND (payload->>'created_at', object_id) < ($3, $4)`;
+    }
+    params.push(limit);
+    const result = await this.options.client.query(`/* todos:list-comments */ SELECT payload FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'comments' AND deleted_at IS NULL
+         AND payload->>'task_id' = $2
+         ${cursorPredicate}
+       ORDER BY payload->>'created_at' DESC, object_id DESC
+       LIMIT $${params.length}`, params);
+    return result.rows.map((row) => payloadRecord2(row.payload)).reverse();
+  }
   async listRecords(type) {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at
@@ -48683,7 +48759,7 @@ async function lockTask2(id, agentId, store) {
 async function unlockTask2(id, agentId, store) {
   const task2 = await requireRecord("tasks", id, store);
   if (agentId && task2.locked_by && task2.locked_by !== agentId) {
-    throw new Error(`Task ${id} is locked by ${task2.locked_by}, not ${agentId}`);
+    throw new LockError(id, task2.locked_by);
   }
   await patchTask(task2, { locked_by: null, locked_at: null }, store);
   return true;
@@ -49048,13 +49124,16 @@ async function addComment2(input, store, context) {
     task_id: input.task_id,
     agent_id: input.agent_id ?? context?.agentId ?? null,
     session_id: input.session_id ?? context?.sessionId ?? null,
-    content: input.content,
+    content: redactEvidenceText(input.content),
     type: input.type ?? "comment",
     progress_pct: input.progress_pct ?? null,
     created_at: new Date().toISOString()
   };
   return store.upsert("comments", comment, context);
 }
+function redactComment2(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
+}
 async function exportSnapshot(store) {
   return {
     exportedAt: new Date().toISOString(),
@@ -49200,7 +49279,106 @@ function numberValue3(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
 var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_BY = "ORDER BY CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC";
-var init_postgres_adapter = () => {};
+var init_postgres_adapter = __esm(() => {
+  init_types();
+  init_redaction();
+});
+
+// src/storage/comment-redaction-backfill.ts
+function assertSafeIdentifier2(value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`Unsafe Postgres identifier: ${value}`);
+  }
+}
+function payloadObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  if (typeof value !== "string")
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function backfillPostgresCommentRedaction(client, options = {}) {
+  const apply = options.apply === true;
+  if (apply && options.confirmation !== COMMENT_REDACTION_BACKFILL_CONFIRMATION) {
+    throw new Error(`Applying the comment redaction backfill requires confirmation ${COMMENT_REDACTION_BACKFILL_CONFIRMATION}`);
+  }
+  const tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
+  assertSafeIdentifier2(tableName);
+  const service = options.service ?? "todos";
+  const batchSize = options.batchSize ?? 100;
+  if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 500) {
+    throw new Error("Comment redaction backfill batchSize must be an integer between 1 and 500");
+  }
+  const result = {
+    dry_run: !apply,
+    scanned: 0,
+    candidates: 0,
+    updated: 0,
+    conflicts: 0,
+    batches: 0,
+    remaining_candidates: 0
+  };
+  let afterId = "";
+  while (true) {
+    const page = await client.query(`/* todos:comment-redaction-backfill-scan */
+       SELECT object_id, payload
+       FROM ${tableName}
+       WHERE service = $1 AND object_type = 'comments'
+         AND object_id > $2
+       ORDER BY object_id ASC
+       LIMIT $3`, [service, afterId, batchSize]);
+    if (page.rows.length === 0)
+      break;
+    result.batches += 1;
+    for (const row of page.rows) {
+      afterId = row.object_id;
+      result.scanned += 1;
+      const payload = payloadObject(row.payload);
+      const original = payload?.["content"];
+      if (typeof original !== "string")
+        continue;
+      const redacted = redactEvidenceText(original);
+      if (redacted === original)
+        continue;
+      result.candidates += 1;
+      if (!apply)
+        continue;
+      const nextPayload = { ...payload, content: redacted };
+      const update = await client.query(`/* todos:comment-redaction-backfill-apply */
+         UPDATE ${tableName}
+         SET payload = $3::jsonb
+         WHERE service = $1 AND object_type = 'comments' AND object_id = $2
+           AND payload = $4::jsonb
+         RETURNING object_id`, [service, row.object_id, nextPayload, row.payload]);
+      if (update.rows.length === 1)
+        result.updated += 1;
+      else
+        result.conflicts += 1;
+    }
+    if (page.rows.length < batchSize)
+      break;
+  }
+  if (!apply) {
+    result.remaining_candidates = result.candidates;
+    return result;
+  }
+  const verification = await backfillPostgresCommentRedaction(client, {
+    ...options,
+    apply: false,
+    confirmation: undefined
+  });
+  result.remaining_candidates = verification.candidates;
+  return result;
+}
+var COMMENT_REDACTION_BACKFILL_CONFIRMATION = "REDACT_STORED_TODOS_COMMENTS";
+var init_comment_redaction_backfill = __esm(() => {
+  init_redaction();
+});
 
 // src/server/cloud.ts
 var exports_cloud = {};
@@ -49214,7 +49392,9 @@ __export(exports_cloud, {
   getCloudStorageAdapter: () => getCloudStorageAdapter,
   getApiKeyStore: () => getApiKeyStore,
   ensureCloudSchema: () => ensureCloudSchema,
+  ensureCloudCommentCursorIndex: () => ensureCloudCommentCursorIndex,
   closeCloud: () => closeCloud,
+  backfillCloudCommentRedaction: () => backfillCloudCommentRedaction,
   TODOS_APP_SLUG: () => TODOS_APP_SLUG
 });
 function resolveCloudDatabaseUrl(env = process.env) {
@@ -49292,6 +49472,9 @@ async function ensureCloudSchema() {
   })();
   return schemaEnsured;
 }
+async function ensureCloudCommentCursorIndex() {
+  await getClient().query(postgresTodosCommentCursorIndexSql());
+}
 async function normalizeCloudPayloads() {
   const client = getClient();
   const res = await client.query(`UPDATE todos_sync_records
@@ -49300,6 +49483,9 @@ async function normalizeCloudPayloads() {
      RETURNING object_id AS id`);
   return res.rows.length;
 }
+function backfillCloudCommentRedaction(options = {}) {
+  return backfillPostgresCommentRedaction(getClient(), { ...options, service: TODOS_APP_SLUG });
+}
 async function pingCloud() {
   const client = getClient();
   const res = await client.query("select 1 as ok");
@@ -49320,6 +49506,7 @@ var init_cloud = __esm(() => {
   init_auth();
   init_cloud_client();
   init_postgres_adapter();
+  init_comment_redaction_backfill();
 });
 
 // src/server/openapi.ts
@@ -49343,6 +49530,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
       schemas: {
         Task: taskSchema,
         Project: projectSchema,
+        TaskComment: taskCommentSchema,
         CreateTaskInput: {
           type: "object",
           required: ["title"],
@@ -49377,6 +49565,17 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             description: { type: "string" },
             task_prefix: { type: "string" }
           }
+        },
+        CreateTaskCommentInput: {
+          type: "object",
+          required: ["content"],
+          properties: {
+            content: { type: "string", minLength: 1 },
+            agent_id: { type: "string" },
+            session_id: { type: "string" },
+            type: { type: "string", enum: ["comment", "progress", "note"] },
+            progress_pct: { type: "number" }
+          }
         }
       }
     },
@@ -49475,6 +49674,61 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           }
         }
       },
+      "/v1/tasks/{id}/comments": {
+        get: {
+          operationId: "listTaskComments",
+          summary: "List a bounded page of task comments",
+          description: "Returns the newest page in oldest-to-newest display order. Use next_cursor to request older pages; count is the page size, not a total. Pagination-aware clients must send limit during the mixed-version rollout.",
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            { name: "limit", in: "query", required: true, schema: { type: "integer", minimum: 1, maximum: 500, default: 100 } },
+            { name: "cursor", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    required: ["comments", "count", "has_more", "next_cursor"],
+                    properties: {
+                      comments: { type: "array", maxItems: 500, items: { $ref: "#/components/schemas/TaskComment" } },
+                      count: { type: "integer", minimum: 0, maximum: 500 },
+                      has_more: { type: "boolean" },
+                      next_cursor: { type: "string", nullable: true }
+                    }
+                  }
+                }
+              }
+            },
+            "426": {
+              description: "Upgrade required: a predecessor client omitted limit and the complete legacy history exceeds 500 comments, or the configured storage adapter lacks cursor pagination support."
+            }
+          }
+        },
+        post: {
+          operationId: "createTaskComment",
+          summary: "Create a task comment",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/CreateTaskCommentInput" } } }
+          },
+          responses: {
+            "201": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    required: ["comment"],
+                    properties: { comment: { $ref: "#/components/schemas/TaskComment" } }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
       "/v1/tasks/{id}/start": {
         post: {
           operationId: "startTask",
@@ -49593,7 +49847,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     }
   };
 }
-var taskSchema, projectSchema;
+var taskSchema, projectSchema, taskCommentSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   taskSchema = {
@@ -49624,6 +49878,20 @@ var init_openapi = __esm(() => {
       updated_at: { type: "string" }
     }
   };
+  taskCommentSchema = {
+    type: "object",
+    required: ["id", "task_id", "agent_id", "session_id", "content", "type", "progress_pct", "created_at"],
+    properties: {
+      id: { type: "string" },
+      task_id: { type: "string" },
+      agent_id: { type: "string", nullable: true },
+      session_id: { type: "string", nullable: true },
+      content: { type: "string" },
+      type: { type: "string", enum: ["comment", "progress", "note"] },
+      progress_pct: { type: "number", nullable: true },
+      created_at: { type: "string", format: "date-time" }
+    }
+  };
 });
 
 // src/server/v1.ts
@@ -49653,6 +49921,29 @@ function contextFromPrincipal(principal, body) {
   const agentId = body?.agent_id || principal.agent || undefined;
   return agentId ? { agentId } : {};
 }
+function redactComment3(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
+}
+function encodeCommentCursor(comment) {
+  return Buffer.from(JSON.stringify({ created_at: comment.created_at, id: comment.id }), "utf8").toString("base64url");
+}
+function decodeCommentCursor(value) {
+  if (value.length > 1024)
+    throw new Error("invalid comment cursor");
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    throw new Error("invalid comment cursor");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("invalid comment cursor");
+  const cursor = parsed;
+  if (typeof cursor["created_at"] !== "string" || cursor["created_at"].length > 64 || !Number.isFinite(Date.parse(cursor["created_at"])) || typeof cursor["id"] !== "string" || !cursor["id"] || cursor["id"].length > 256) {
+    throw new Error("invalid comment cursor");
+  }
+  return { created_at: cursor["created_at"], id: cursor["id"] };
+}
 function normalizeImportSnapshot(raw) {
   const body = raw && typeof raw === "object" ? raw : {};
   const arr = (v) => Array.isArray(v) ? v : [];
@@ -49673,7 +49964,7 @@ function normalizeImportSnapshot(raw) {
 function countSnapshotRecords(s) {
   return s.tasks.length + s.projects.length + (s.projectMachinePaths?.length ?? 0) + s.plans.length + s.agents.length + s.taskLists.length + s.templates.length + s.auditHistory.length + (s.tombstones?.length ?? 0);
 }
-async function handleV1Request(req, url) {
+async function handleV1Request(req, url, dependencies = {}) {
   const path = url.pathname;
   if (path !== "/v1" && !path.startsWith("/v1/"))
     return null;
@@ -49682,7 +49973,7 @@ async function handleV1Request(req, url) {
   const requiredScopes = [isWrite ? "todos:write" : "todos:read"];
   let verifier;
   try {
-    verifier = getCloudVerifier();
+    verifier = (dependencies.getVerifier ?? getCloudVerifier)();
   } catch (e) {
     return error(503, e.message);
   }
@@ -49691,8 +49982,8 @@ async function handleV1Request(req, url) {
     return error(decision.status, decision.message, { reason: decision.reason });
   }
   const principal = decision.principal;
-  await ensureCloudSchema();
-  const store = getCloudStorageAdapter();
+  await (dependencies.ensureSchema ?? ensureCloudSchema)();
+  const store = (dependencies.getStorageAdapter ?? getCloudStorageAdapter)();
   const segments = path.split("/").filter(Boolean);
   const resource = segments[1];
   const id = segments[2];
@@ -49778,10 +50069,16 @@ async function handleV1Request(req, url) {
       if (!id) {
         if (method === "GET") {
           const filter = {
-            ...url.searchParams.get("status") ? { status: url.searchParams.get("status") } : {},
-            ...url.searchParams.get("priority") ? { priority: url.searchParams.get("priority") } : {},
+            ...url.searchParams.get("status") ? {
+              status: url.searchParams.get("status").includes(",") ? url.searchParams.get("status").split(",") : url.searchParams.get("status")
+            } : {},
+            ...url.searchParams.get("priority") ? {
+              priority: url.searchParams.get("priority").includes(",") ? url.searchParams.get("priority").split(",") : url.searchParams.get("priority")
+            } : {},
             ...url.searchParams.get("project_id") ? { project_id: url.searchParams.get("project_id") } : {},
+            ...url.searchParams.has("parent_id") ? { parent_id: url.searchParams.get("parent_id") || null, include_subtasks: true } : {},
             ...url.searchParams.get("plan_id") ? { plan_id: url.searchParams.get("plan_id") } : {},
+            ...url.searchParams.get("task_list_id") ? { task_list_id: url.searchParams.get("task_list_id") } : {},
             ...url.searchParams.get("assigned_to") ? { assigned_to: url.searchParams.get("assigned_to") } : {},
             ...url.searchParams.get("agent_id") ? { agent_id: url.searchParams.get("agent_id") } : {},
             ...url.searchParams.get("limit") ? { limit: Number(url.searchParams.get("limit")) } : {},
@@ -49805,8 +50102,47 @@ async function handleV1Request(req, url) {
       if (action) {
         if (action === "comments") {
           if (method === "GET") {
-            const comments = await store.audit.getComments(id);
-            return json2({ comments, count: comments.length });
+            if (!await store.tasks.get(id))
+              return error(404, "task not found");
+            const rawLimit = url.searchParams.get("limit");
+            const cursor = url.searchParams.get("cursor");
+            if (rawLimit === null && cursor === null) {
+              const storageContext = contextFromPrincipal(principal);
+              const legacyPage = (await (store.audit.getCommentsPage ? store.audit.getCommentsPage(id, { limit: LEGACY_COMMENT_RESPONSE_LIMIT + 1 }, storageContext) : store.audit.getComments(id, storageContext))).map(redactComment3);
+              if (legacyPage.length > LEGACY_COMMENT_RESPONSE_LIMIT) {
+                return error(426, "task has too many comments for this client; upgrade @hasna/todos to use cursor pagination");
+              }
+              return json2({
+                comments: legacyPage,
+                count: legacyPage.length,
+                has_more: false,
+                next_cursor: null
+              });
+            }
+            const limit = rawLimit === null ? DEFAULT_COMMENT_PAGE_SIZE : Number(rawLimit);
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_COMMENT_PAGE_SIZE) {
+              return error(400, `limit must be an integer between 1 and ${MAX_COMMENT_PAGE_SIZE}`);
+            }
+            let before;
+            if (cursor) {
+              try {
+                before = decodeCommentCursor(cursor);
+              } catch {
+                return error(400, "invalid comment cursor");
+              }
+            }
+            if (!store.audit.getCommentsPage) {
+              return error(426, "storage adapter must be upgraded to support cursor-paginated comments");
+            }
+            const page = (await store.audit.getCommentsPage(id, { limit: limit + 1, ...before ? { before } : {} }, contextFromPrincipal(principal))).map(redactComment3);
+            const hasMore = page.length > limit;
+            const comments = hasMore ? page.slice(1) : page;
+            return json2({
+              comments,
+              count: comments.length,
+              has_more: hasMore,
+              next_cursor: hasMore && comments[0] ? encodeCommentCursor(comments[0]) : null
+            });
           }
           if (method === "POST") {
             const body2 = await readJson(req) ?? {};
@@ -49824,7 +50160,7 @@ async function handleV1Request(req, url) {
               type: body2.type,
               progress_pct: body2.progress_pct
             }, contextFromPrincipal(principal, body2));
-            return json2({ comment }, 201);
+            return json2({ comment: redactComment3(comment) }, 201);
           }
           return error(405, `method ${method} not allowed on /v1/tasks/:id/comments`);
         }
@@ -49839,17 +50175,30 @@ async function handleV1Request(req, url) {
         if (action === "lock" || action === "unlock") {
           if (method !== "POST")
             return error(405, `method ${method} not allowed on /v1/tasks/:id/${action}`);
-          if (typeof store.tasks.lock !== "function" || typeof store.tasks.unlock !== "function") {
-            return error(501, "task locking is not supported by this storage backend");
-          }
           const body2 = await readJson(req) ?? {};
           if (!await store.tasks.get(id))
             return error(404, "task not found");
           if (action === "lock") {
-            const agentId2 = body2.agent_id || principal.agent || "todos-serve";
-            return json2({ result: await store.tasks.lock(id, agentId2) });
+            if (typeof store.tasks.lock !== "function")
+              return error(501, "task locking is not supported by this storage backend");
+            const agentId3 = body2.agent_id || principal.agent || "todos-serve";
+            return json2({ result: await store.tasks.lock(id, agentId3) });
+          }
+          if (typeof store.tasks.unlock !== "function")
+            return error(501, "task unlocking is not supported by this storage backend");
+          if (body2.force === true) {
+            if (!principal.scopes.includes("todos:*"))
+              return error(403, "force unlock requires todos:* scope");
+            const released2 = await store.tasks.unlock(id);
+            return json2({ success: released2 });
+          }
+          if (body2.agent_id && principal.agent && body2.agent_id !== principal.agent && !principal.scopes.includes("todos:*")) {
+            return error(403, "unlock agent_id must match the authenticated agent");
           }
-          const released = await store.tasks.unlock(id, body2.agent_id || principal.agent || undefined);
+          const agentId2 = principal.agent || body2.agent_id;
+          if (!agentId2)
+            return error(403, "unlock requires an agent-bound key or force=true");
+          const released = await store.tasks.unlock(id, agentId2);
           return json2({ success: released });
         }
         if (action === "dependencies") {
@@ -50132,12 +50481,28 @@ async function handleV1Request(req, url) {
       const activity = await store.audit.getRecentActivity(limit);
       return json2({ activity, count: activity.length });
     }
-    if (resource === "task-lists" && !id) {
-      if (method !== "GET")
-        return error(405, `method ${method} not allowed on /v1/task-lists`);
-      const projectId = url.searchParams.get("project_id") ?? undefined;
-      const taskLists = await store.taskLists.list(projectId);
-      return json2({ task_lists: taskLists, count: taskLists.length });
+    if (resource === "task-lists") {
+      if (!id && method === "GET") {
+        const projectId = url.searchParams.get("project_id") ?? undefined;
+        const taskLists = await store.taskLists.list(projectId);
+        return json2({ task_lists: taskLists, count: taskLists.length });
+      }
+      if (!id && method === "POST") {
+        const body = await readJson(req);
+        if (!body || typeof body.name !== "string" || !body.name.trim())
+          return error(400, "name is required");
+        const taskList = await store.taskLists.create(body, contextFromPrincipal(principal));
+        return json2({ task_list: taskList }, 201);
+      }
+      if (id && method === "GET") {
+        const taskList = await store.taskLists.get(id);
+        return taskList ? json2({ task_list: taskList }) : error(404, "task list not found");
+      }
+      if (id && method === "DELETE") {
+        const deleted = await store.taskLists.delete(id, contextFromPrincipal(principal));
+        return deleted ? json2({ deleted: true, id }) : error(404, "task list not found");
+      }
+      return error(405, `method ${method} not allowed on /v1/task-lists${id ? "/:id" : ""}`);
     }
     if (resource === "dependencies" && !id) {
       if (method !== "GET")
@@ -50145,8 +50510,8 @@ async function handleV1Request(req, url) {
       if (typeof store.dependencies?.listAll !== "function") {
         return error(501, "dependency edge listing is not supported by this storage backend");
       }
-      const dependencies = await store.dependencies.listAll();
-      return json2({ dependencies, count: dependencies.length });
+      const dependencies2 = await store.dependencies.listAll();
+      return json2({ dependencies: dependencies2, count: dependencies2.length });
     }
     if (resource === "commits" && id) {
       if (method !== "GET")
@@ -50203,12 +50568,16 @@ async function handleV1Request(req, url) {
     }
     return error(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
+    if (e instanceof LockError)
+      return error(409, e.message, { code: LockError.code });
     return error(500, e.message || "internal error");
   }
 }
-var JSON_HEADERS;
+var JSON_HEADERS, DEFAULT_COMMENT_PAGE_SIZE = 100, MAX_COMMENT_PAGE_SIZE = 500, LEGACY_COMMENT_RESPONSE_LIMIT = 500;
 var init_v1 = __esm(() => {
+  init_types();
   init_cloud();
+  init_redaction();
   JSON_HEADERS = { "Content-Type": "application/json" };
 });