@hasna/todos 0.11.86 → 0.11.88

package/dist/contracts.js

@@ -9424,7 +9424,7 @@ function getComment(id, db) {
 }
 function listComments(taskId, db) {
   const d = db || getDatabase();
-  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at").all(taskId);
+  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at, rowid").all(taskId);
 }
 function deleteComment(id, db) {
   const d = db || getDatabase();

package/dist/db/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../src/db/comments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMzE,wBAAgB,UAAU,CACxB,KAAK,EAAE,kBAAkB,EACzB,EAAE,CAAC,EAAE,QAAQ,GACZ,WAAW,CA2Bb;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,EAAE,CAAC,EAAE,QAAQ,GACZ,WAAW,CAEb;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,IAAI,CAKxE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,WAAW,EAAE,CAOzE;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAC1B,EAAE,CAAC,EAAE,QAAQ,GACZ,WAAW,CAQb;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAIhE"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../src/db/comments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMzE,wBAAgB,UAAU,CACxB,KAAK,EAAE,kBAAkB,EACzB,EAAE,CAAC,EAAE,QAAQ,GACZ,WAAW,CA2Bb;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,EAAE,CAAC,EAAE,QAAQ,GACZ,WAAW,CAEb;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,IAAI,CAKxE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,WAAW,EAAE,CAUzE;AAED,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAC1B,EAAE,CAAC,EAAE,QAAQ,GACZ,WAAW,CAQb;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAIhE"}

package/dist/index.js

@@ -9424,7 +9424,7 @@ function getComment(id, db) {
 }
 function listComments(taskId, db) {
   const d = db || getDatabase();
-  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at").all(taskId);
+  return d.query("SELECT * FROM task_comments WHERE task_id = ? ORDER BY created_at, rowid").all(taskId);
 }
 function deleteComment(id, db) {
   const d = db || getDatabase();
@@ -23170,6 +23170,10 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       list: (filter = {}) => listTasks(filter, database()),
       count: (filter = {}) => countTasks(filter, database()),
       update: (id, input) => updateTask(id, input, database()),
+      unlock: (id, agentId) => {
+        unlockTask(id, agentId, database());
+        return true;
+      },
       delete: (id) => deleteTask(id, database()),
       start: (id, agentId) => startTask(id, agentId, database()),
       complete: (id, agentId, options2) => completeTask(id, agentId, database(), options2),
@@ -23221,6 +23225,20 @@ function createLocalSqliteTodosStorageAdapter(options = {}) {
       logTaskChange: (taskId, action, field2, oldValue, newValue, agentId) => logTaskChange(taskId, action, field2, oldValue, newValue, agentId, database()),
       addComment: (input) => addComment(input, database()),
       getComments: (taskId) => listComments(taskId, database()),
+      getCommentsPage: (taskId, options2) => {
+        if (options2?.limit !== undefined && (!Number.isSafeInteger(options2.limit) || options2.limit < 1 || options2.limit > 1001)) {
+          throw new Error("Comment limit must be an integer between 1 and 1001");
+        }
+        let comments = listComments(taskId, database());
+        comments = comments.sort((left, right) => left.created_at.localeCompare(right.created_at) || left.id.localeCompare(right.id));
+        if (options2?.before) {
+          const before = options2.before;
+          comments = comments.filter((comment) => comment.created_at < before.created_at || comment.created_at === before.created_at && comment.id < before.id);
+        }
+        if (options2?.limit !== undefined)
+          comments = comments.slice(-options2.limit);
+        return comments;
+      },
       getTaskHistory: (taskId) => getTaskHistory(taskId, database()),
       getRecentActivity: (limit) => getRecentActivity(limit, database())
     },
@@ -23268,6 +23286,12 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
     )`
   ];
 }
+function postgresTodosCommentCursorIndexSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE) {
+  assertSafeIdentifier(tableName);
+  return `CREATE INDEX CONCURRENTLY IF NOT EXISTS ${tableName}_comment_task_created_idx
+    ON ${tableName} (service, (payload->>'task_id'), (payload->>'created_at'), object_id)
+    WHERE object_type = 'comments' AND deleted_at IS NULL`;
+}
 
 class PostgresTodosSyncStore {
   client;
@@ -23500,7 +23524,9 @@ function createHybridTodosStorageAdapter(options) {
 }
 
 // src/storage/postgres-adapter.ts
+init_types();
 import { randomUUID as randomUUID3 } from "crypto";
+init_redaction();
 function createPostgresTodosStorageAdapter(options) {
   const store = new PostgresJsonRecordStore(options);
   const adapter = {
@@ -23596,7 +23622,24 @@ function createPostgresTodosStorageAdapter(options) {
     audit: {
       logTaskChange: (taskId, action, field2, oldValue, newValue, agentId, context) => logTaskChange2(taskId, action, field2, oldValue, newValue, agentId, store, context),
       addComment: (input, context) => addComment2(input, store, context),
-      getComments: async (taskId) => (await store.list("comments")).filter((comment) => comment.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
+      getComments: async (taskId) => {
+        const pages = [];
+        let before;
+        while (true) {
+          const page = await store.listComments(taskId, { limit: 1000, ...before ? { before } : {} });
+          if (page.length === 0)
+            break;
+          pages.unshift(page);
+          if (page.length < 1000)
+            break;
+          const oldest = page[0];
+          before = { created_at: oldest.created_at, id: oldest.id };
+        }
+        return pages.flat().map(redactComment).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
+      getCommentsPage: async (taskId, options2) => {
+        return (await store.listComments(taskId, options2)).map(redactComment).sort((a, b) => a.created_at.localeCompare(b.created_at) || a.id.localeCompare(b.id));
+      },
       getTaskHistory: async (taskId) => (await store.list("audit_history")).filter((entry2) => entry2.task_id === taskId).sort((a, b) => a.created_at.localeCompare(b.created_at)),
       getRecentActivity: async (limit = 20) => (await store.list("audit_history")).sort((a, b) => b.created_at.localeCompare(a.created_at)).slice(0, limit)
     },
@@ -23646,6 +23689,27 @@ class PostgresJsonRecordStore {
   async list(type) {
     return (await this.listRecords(type)).map((record) => record.payload);
   }
+  async listComments(taskId, options = {}) {
+    await this.ensureSchema();
+    const limit = options.limit ?? 100;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1001) {
+      throw new Error("Postgres comment limit must be an integer between 1 and 1001");
+    }
+    const params = [this.service, taskId];
+    let cursorPredicate = "";
+    if (options.before) {
+      params.push(options.before.created_at, options.before.id);
+      cursorPredicate = `AND (payload->>'created_at', object_id) < ($3, $4)`;
+    }
+    params.push(limit);
+    const result = await this.options.client.query(`/* todos:list-comments */ SELECT payload FROM ${this.tableName}
+       WHERE service = $1 AND object_type = 'comments' AND deleted_at IS NULL
+         AND payload->>'task_id' = $2
+         ${cursorPredicate}
+       ORDER BY payload->>'created_at' DESC, object_id DESC
+       LIMIT $${params.length}`, params);
+    return result.rows.map((row) => payloadRecord2(row.payload)).reverse();
+  }
   async listRecords(type) {
     await this.ensureSchema();
     const result = await this.options.client.query(`SELECT object_type, object_id, payload, updated_at
@@ -24040,7 +24104,7 @@ async function lockTask2(id, agentId, store) {
 async function unlockTask2(id, agentId, store) {
   const task2 = await requireRecord("tasks", id, store);
   if (agentId && task2.locked_by && task2.locked_by !== agentId) {
-    throw new Error(`Task ${id} is locked by ${task2.locked_by}, not ${agentId}`);
+    throw new LockError(id, task2.locked_by);
   }
   await patchTask(task2, { locked_by: null, locked_at: null }, store);
   return true;
@@ -24406,13 +24470,16 @@ async function addComment2(input, store, context) {
     task_id: input.task_id,
     agent_id: input.agent_id ?? context?.agentId ?? null,
     session_id: input.session_id ?? context?.sessionId ?? null,
-    content: input.content,
+    content: redactEvidenceText(input.content),
     type: input.type ?? "comment",
     progress_pct: input.progress_pct ?? null,
     created_at: new Date().toISOString()
   };
   return store.upsert("comments", comment, context);
 }
+function redactComment(comment) {
+  return { ...comment, content: redactEvidenceText(comment.content) };
+}
 async function exportSnapshot(store) {
   return {
     exportedAt: new Date().toISOString(),
@@ -25344,6 +25411,102 @@ async function closeRuntimeShadowCloud() {
     await cloud.close().catch(() => {});
   }
 }
+// src/storage/comment-redaction-backfill.ts
+init_redaction();
+var COMMENT_REDACTION_BACKFILL_CONFIRMATION = "REDACT_STORED_TODOS_COMMENTS";
+function assertSafeIdentifier2(value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`Unsafe Postgres identifier: ${value}`);
+  }
+}
+function payloadObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value))
+    return value;
+  if (typeof value !== "string")
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function backfillPostgresCommentRedaction(client, options = {}) {
+  const apply = options.apply === true;
+  if (apply && options.confirmation !== COMMENT_REDACTION_BACKFILL_CONFIRMATION) {
+    throw new Error(`Applying the comment redaction backfill requires confirmation ${COMMENT_REDACTION_BACKFILL_CONFIRMATION}`);
+  }
+  const tableName = options.tableName ?? DEFAULT_TODOS_POSTGRES_SYNC_TABLE;
+  assertSafeIdentifier2(tableName);
+  const service = options.service ?? "todos";
+  const batchSize = options.batchSize ?? 100;
+  if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 500) {
+    throw new Error("Comment redaction backfill batchSize must be an integer between 1 and 500");
+  }
+  const result = {
+    dry_run: !apply,
+    scanned: 0,
+    candidates: 0,
+    updated: 0,
+    conflicts: 0,
+    batches: 0,
+    remaining_candidates: 0
+  };
+  let afterId = "";
+  while (true) {
+    const page = await client.query(`/* todos:comment-redaction-backfill-scan */
+       SELECT object_id, payload
+       FROM ${tableName}
+       WHERE service = $1 AND object_type = 'comments'
+         AND object_id > $2
+       ORDER BY object_id ASC
+       LIMIT $3`, [service, afterId, batchSize]);
+    if (page.rows.length === 0)
+      break;
+    result.batches += 1;
+    for (const row of page.rows) {
+      afterId = row.object_id;
+      result.scanned += 1;
+      const payload = payloadObject(row.payload);
+      const original = payload?.["content"];
+      if (typeof original !== "string")
+        continue;
+      const redacted = redactEvidenceText(original);
+      if (redacted === original)
+        continue;
+      result.candidates += 1;
+      if (!apply)
+        continue;
+      const nextPayload = { ...payload, content: redacted };
+      const update = await client.query(`/* todos:comment-redaction-backfill-apply */
+         UPDATE ${tableName}
+         SET payload = $3::jsonb
+         WHERE service = $1 AND object_type = 'comments' AND object_id = $2
+           AND payload = $4::jsonb
+         RETURNING object_id`, [service, row.object_id, nextPayload, row.payload]);
+      if (update.rows.length === 1)
+        result.updated += 1;
+      else
+        result.conflicts += 1;
+    }
+    if (page.rows.length < batchSize)
+      break;
+  }
+  if (!apply) {
+    result.remaining_candidates = result.candidates;
+    return result;
+  }
+  const verification = await backfillPostgresCommentRedaction(client, {
+    ...options,
+    apply: false,
+    confirmation: undefined
+  });
+  result.remaining_candidates = verification.candidates;
+  return result;
+}
+function isCommentRedactionBackfillComplete(result) {
+  return !result.dry_run && result.conflicts === 0 && result.remaining_candidates === 0;
+}
 // src/storage/s3-artifacts.ts
 import { createHash as createHash9, createHmac as createHmac2 } from "crypto";
 function createTodosS3ArtifactStore(options) {