@hasna/todos 0.13.6 → 0.13.8

package/dist/index.js

@@ -4336,6 +4336,7 @@ var init_database = __esm(() => {
 
 // src/lib/sync-utils.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
+import { createHash } from "crypto";
 import { join as join2 } from "path";
 function getHomeDir() {
   return process.env["HOME"] || process.env["USERPROFILE"] || "~";
@@ -4391,7 +4392,40 @@ function appendSyncConflict(metadata, conflict, limit = 5) {
   const next = [conflict, ...current].slice(0, limit);
   return { ...metadata, sync_conflicts: next };
 }
-var HOME;
+function canonicalize(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize);
+  if (!value || typeof value !== "object")
+    return value;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).sort(([a], [b]) => a.localeCompare(b));
+  return Object.fromEntries(entries.map(([key, entryValue]) => [key, canonicalize(entryValue)]));
+}
+function withoutSyncFingerprintMetadata(metadata) {
+  const { [TODO_SYNC_FINGERPRINT_KEY]: _fingerprint, ...rest } = metadata;
+  return rest;
+}
+function syncFingerprint(record) {
+  const metadata = withoutSyncFingerprintMetadata(record.metadata || {});
+  const canonical = canonicalize({ ...record, metadata });
+  return `sha256:${createHash("sha256").update(JSON.stringify(canonical)).digest("hex")}`;
+}
+function withSyncFingerprint(record) {
+  const metadata = withoutSyncFingerprintMetadata(record.metadata);
+  return {
+    ...record,
+    metadata: {
+      ...metadata,
+      [TODO_SYNC_FINGERPRINT_KEY]: syncFingerprint({ ...record, metadata })
+    }
+  };
+}
+function hasSyncFingerprintChanged(record) {
+  const stored = record.metadata?.[TODO_SYNC_FINGERPRINT_KEY];
+  if (typeof stored !== "string" || stored.length === 0)
+    return null;
+  return stored !== syncFingerprint(record);
+}
+var TODO_SYNC_FINGERPRINT_KEY = "todos_sync_fingerprint", HOME;
 var init_sync_utils = __esm(() => {
   HOME = process.env["HOME"] || process.env["USERPROFILE"] || "~";
 });
@@ -5502,7 +5536,7 @@ var init_runner_sandbox = __esm(() => {
 });
 
 // src/lib/event-hooks.ts
-import { createHash, randomUUID } from "crypto";
+import { createHash as createHash2, randomUUID } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
 import { dirname as dirname3, resolve as resolve6 } from "path";
 import { createConnection } from "net";
@@ -5569,7 +5603,7 @@ function buildEnvelope(type, payload, timestamp2 = new Date().toISOString()) {
     payload: redactValue(payload ?? {}),
     source: { package: "@hasna/todos", local_only: true }
   };
-  const digest = createHash("sha256").update(canonicalEvent(base)).digest("hex");
+  const digest = createHash2("sha256").update(canonicalEvent(base)).digest("hex");
   return { ...base, integrity: { algorithm: "sha256", digest } };
 }
 function summarize(value) {
@@ -7479,6 +7513,14 @@ var init_checklists = __esm(() => {
   init_database();
 });
 
+// src/lib/creator-identity.ts
+function canonicalAgentRef(value) {
+  return value.trim().toLowerCase();
+}
+var init_creator_identity = __esm(() => {
+  init_sync_utils();
+});
+
 // src/lib/recurrence.ts
 function parseRecurrenceRule(rule) {
   const normalized = rule.trim().toLowerCase();
@@ -8185,6 +8227,11 @@ __export(exports_task_lifecycle, {
   claimOrSteal: () => claimOrSteal,
   claimNextTask: () => claimNextTask
 });
+function sameHolder(stored, incoming) {
+  if (!stored || !incoming)
+    return false;
+  return canonicalAgentRef(stored) === canonicalAgentRef(incoming);
+}
 function lockExpiresAt(lockedAt) {
   if (!lockedAt)
     return null;
@@ -8235,13 +8282,13 @@ function startTask(id, agentId, db) {
   const cutoff = lockExpiryCutoff();
   const timestamp2 = now();
   const result = d.run(`UPDATE tasks SET status = 'in_progress', assigned_to = ?, locked_by = ?, locked_at = ?, started_at = COALESCE(started_at, ?), version = version + 1, updated_at = ?
-     WHERE id = ? AND status IN ('pending', 'in_progress') AND (locked_by IS NULL OR locked_by = ? OR locked_at < ?)`, [agentId, agentId, timestamp2, timestamp2, timestamp2, id, agentId, cutoff]);
+     WHERE id = ? AND status IN ('pending', 'in_progress') AND (locked_by IS NULL OR LOWER(TRIM(locked_by)) = LOWER(TRIM(?)) OR locked_at < ?)`, [agentId, agentId, timestamp2, timestamp2, timestamp2, id, agentId, cutoff]);
   if (result.changes === 0) {
     const current = getTask(id, d);
     if (!current)
       throw new TaskNotFoundError(id);
     assertStartable(current, agentId);
-    if (current.locked_by && current.locked_by !== agentId && !isLockExpired(current.locked_at)) {
+    if (current.locked_by && !sameHolder(current.locked_by, agentId) && !isLockExpired(current.locked_at)) {
       throw new LockError(id, current.locked_by);
     }
     throw new Error(`Task ${id} could not be started because it changed during claim`);
@@ -8266,7 +8313,7 @@ function completeTask(id, agentId, db, options) {
   if (task.status === "cancelled") {
     throw new Error(`Task ${id} is cancelled and cannot be completed`);
   }
-  if (agentId && task.locked_by && task.locked_by !== agentId && !isLockExpired(task.locked_at)) {
+  if (agentId && task.locked_by && !sameHolder(task.locked_by, agentId) && !isLockExpired(task.locked_at)) {
     throw new LockError(id, task.locked_by);
   }
   checkCompletionGuard(task, agentId || null, d);
@@ -8388,16 +8435,16 @@ function lockTask(id, agentId, db) {
       error: `Task is ${task.status} and cannot be locked`
     };
   }
-  if (task.locked_by === agentId && !isLockExpired(task.locked_at)) {
+  if (sameHolder(task.locked_by, agentId) && !isLockExpired(task.locked_at)) {
     const timestamp3 = now();
-    d.run(`UPDATE tasks SET locked_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND locked_by = ?`, [timestamp3, timestamp3, id, agentId]);
+    d.run(`UPDATE tasks SET locked_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND LOWER(TRIM(locked_by)) = LOWER(TRIM(?))`, [timestamp3, timestamp3, id, agentId]);
     logTaskChange(id, "lock_renew", "locked_by", agentId, agentId, agentId, d);
     return { success: true, locked_by: agentId, locked_at: timestamp3, expires_at: lockExpiresAt(timestamp3) };
   }
   const cutoff = lockExpiryCutoff();
   const timestamp2 = now();
   const result = d.run(`UPDATE tasks SET locked_by = ?, locked_at = ?, version = version + 1, updated_at = ?
-     WHERE id = ? AND status NOT IN ('completed', 'cancelled') AND (locked_by IS NULL OR locked_by = ? OR locked_at < ?)`, [agentId, timestamp2, timestamp2, id, agentId, cutoff]);
+     WHERE id = ? AND status NOT IN ('completed', 'cancelled') AND (locked_by IS NULL OR LOWER(TRIM(locked_by)) = LOWER(TRIM(?)) OR locked_at < ?)`, [agentId, timestamp2, timestamp2, id, agentId, cutoff]);
   if (result.changes === 0) {
     const current = getTask(id, d);
     if (!current)
@@ -8429,7 +8476,7 @@ function unlockTask(id, agentId, db) {
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
-  if (agentId && task.locked_by && task.locked_by !== agentId) {
+  if (agentId && task.locked_by && !sameHolder(task.locked_by, agentId)) {
     throw new LockError(id, task.locked_by);
   }
   const timestamp2 = now();
@@ -8722,6 +8769,7 @@ var MAX_SPAWN_DEPTH = 10;
 var init_task_lifecycle = __esm(() => {
   init_types();
   init_database();
+  init_creator_identity();
   init_completion_guard();
   init_event_emission_safety();
   init_event_hooks();
@@ -9177,6 +9225,10 @@ function updateTask(id, input, db) {
     sets.push("description = ?");
     params.push(input.description);
   }
+  if (input.agent_id !== undefined) {
+    sets.push("agent_id = ?");
+    params.push(input.agent_id);
+  }
   if (input.status !== undefined) {
     if (input.status === "completed") {
       checkCompletionGuard(task, task.assigned_to || task.agent_id || null, d);
@@ -10486,7 +10538,7 @@ var init_boards = __esm(() => {
 });
 
 // src/lib/artifact-store.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
 import { basename, dirname as dirname4, join as join5, resolve as resolve7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
@@ -10511,7 +10563,7 @@ function artifactStorePath(relativePath) {
   return join5(artifactStoreRoot(), normalized);
 }
 function sha256(buffer) {
-  return createHash2("sha256").update(buffer).digest("hex");
+  return createHash3("sha256").update(buffer).digest("hex");
 }
 function isTextLike(buffer, path) {
   if (buffer.includes(0))
@@ -12034,7 +12086,7 @@ var init_dispatches = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.13.6",
+  version: "0.13.8",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -15749,7 +15801,7 @@ function importOnboardingFixture(options = {}) {
 }
 // src/lib/local-backups.ts
 init_database();
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname5, resolve as resolve8 } from "path";
 import { mkdirSync as mkdirSync6 } from "fs";
@@ -15767,7 +15819,7 @@ function stableJson(value) {
   return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
 }
 function sha2562(value) {
-  return createHash3("sha256").update(stableJson(value)).digest("hex");
+  return createHash4("sha256").update(stableJson(value)).digest("hex");
 }
 function sqliteIntegrity(db) {
   let quick = "unknown";
@@ -16045,7 +16097,7 @@ function checkLocalIntegrity(options = {}, db) {
 }
 // src/lib/local-snapshots.ts
 init_database();
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/lib/activity-timeline.ts
 init_database();
@@ -16321,7 +16373,7 @@ function stable(value) {
   return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, stable(item)]));
 }
 function sha2563(value) {
-  return createHash4("sha256").update(JSON.stringify(stable(value))).digest("hex");
+  return createHash5("sha256").update(JSON.stringify(stable(value))).digest("hex");
 }
 function latestTimestamp(items, fallback) {
   const timestamps = [];
@@ -19533,20 +19585,20 @@ init_database();
 init_task_runs();
 init_config2();
 init_redaction();
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var LOCAL_AUDIT_LEDGER_SCHEMA_VERSION = 1;
 var LOCAL_AUDIT_LEDGER_HASH_ALGORITHM = "sha256";
 var LOCAL_AUDIT_LEDGER_INITIAL_HASH = "0".repeat(64);
-function canonicalize(value) {
+function canonicalize2(value) {
   if (value === null || typeof value !== "object")
     return JSON.stringify(value);
   if (Array.isArray(value))
-    return `[${value.map(canonicalize).join(",")}]`;
+    return `[${value.map(canonicalize2).join(",")}]`;
   const object = value;
-  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(object[key])}`).join(",")}}`;
+  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalize2(object[key])}`).join(",")}}`;
 }
 function hash(value) {
-  return createHash5("sha256").update(value).digest("hex");
+  return createHash6("sha256").update(value).digest("hex");
 }
 function parsePayload2(value) {
   if (!value)
@@ -19679,7 +19731,7 @@ function toLedgerEntries(rows) {
   let previous = LOCAL_AUDIT_LEDGER_INITIAL_HASH;
   return ordered.map((row, index) => {
     const payload = parsePayload2(row.payload_json);
-    const payloadHash = hash(canonicalize({ source: row.source, source_id: row.source_id, created_at: row.created_at, payload }));
+    const payloadHash = hash(canonicalize2({ source: row.source, source_id: row.source_id, created_at: row.created_at, payload }));
     const chainHash = hash(`${previous}
 ${payloadHash}`);
     const entry = {
@@ -20066,7 +20118,7 @@ function renderReleaseCompatibilityMarkdown(report) {
 `);
 }
 // src/db/inbox.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 
 // src/lib/github.ts
 import { execFileSync } from "child_process";
@@ -20151,7 +20203,7 @@ function compactWhitespace(value) {
 function fingerprintInboxInput(input) {
   const sourceType = input.source_type || detectInboxSourceType(input.body, input.source_url);
   const normalized = compactWhitespace(sanitizePreWriteText(input.body, "inbox.fingerprint")).slice(0, 8000);
-  return createHash6("sha256").update(`${sourceType}
+  return createHash7("sha256").update(`${sourceType}
 ${input.source_url || ""}
 ${normalized}`).digest("hex");
 }
@@ -21268,7 +21320,7 @@ function importExternalIssues(input, db) {
 init_database();
 init_tasks();
 init_redaction();
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 var TESTERS_ISSUE_REPORT_SCHEMA_VERSION = "testers.issue_report.v1";
 var TESTERS_ISSUE_REPORT_RESULT_SCHEMA_VERSION = "todos.tester_issue_report_result.v1";
 var TESTERS_ISSUE_REPORT_BATCH_RESULT_SCHEMA_VERSION = "todos.tester_issue_report_batch_result.v1";
@@ -21457,7 +21509,7 @@ function fingerprintTesterIssueReport(report) {
     normalizeText2(report.failure?.message || report.summary || report.title).slice(0, 240),
     normalizeText2(stackTop).slice(0, 160)
   ].join("::");
-  return `testers:${createHash7("sha256").update(raw).digest("hex").slice(0, 16)}`;
+  return `testers:${createHash8("sha256").update(raw).digest("hex").slice(0, 16)}`;
 }
 function priorityForSeverity(severity, fallback) {
   return PRIORITIES3.includes(severity) ? severity : fallback;
@@ -22909,7 +22961,7 @@ function renderLocalReportMarkdown(report) {
 init_config2();
 init_redaction();
 init_prewrite_secrets();
-import { createCipheriv, createDecipheriv, createHash as createHash8, randomBytes, scryptSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash9, randomBytes, scryptSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var TODOS_ENCRYPTED_VALUE_KIND = "hasna.todos.encrypted-value";
 var TODOS_ENCRYPTED_BRIDGE_KIND = "hasna.todos.encrypted-bridge";
 var TODOS_ENCRYPTION_SCHEMA_VERSION = 1;
@@ -22935,7 +22987,7 @@ function now3() {
   return new Date().toISOString();
 }
 function sha2564(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash9("sha256").update(value).digest("hex");
 }
 function normalizeProfileName(value) {
   const name = (value || DEFAULT_ENCRYPTION_PROFILE).trim();
@@ -28249,7 +28301,7 @@ function isCommentRedactionBackfillComplete(result) {
   return !result.dry_run && result.conflicts === 0 && result.remaining_candidates === 0;
 }
 // src/storage/s3-artifacts.ts
-import { createHash as createHash9, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash10, createHmac as createHmac2 } from "crypto";
 function createTodosS3ArtifactStore(options) {
   const requestFetch = options.fetch ?? fetch;
   const now4 = options.now ?? (() => new Date);
@@ -28421,7 +28473,7 @@ function toAmzDate(date) {
   return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
 }
 function sha256Hex(value) {
-  return createHash9("sha256").update(value).digest("hex");
+  return createHash10("sha256").update(value).digest("hex");
 }
 function hmac(key, value) {
   return createHmac2("sha256", key).update(value).digest();
@@ -29268,7 +29320,7 @@ function createClient(options) {
 init_database();
 
 // src/pr-groups/ledger.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 
 // src/pr-groups/types.ts
 var PR_GROUP_LEDGER_SCHEMA_VERSION = 1;
@@ -29331,7 +29383,7 @@ var RECEIPT_EVENT_TYPES = new Set([
   "merge_outcome"
 ]);
 function sha2565(value) {
-  return createHash10("sha256").update(value).digest("hex");
+  return createHash11("sha256").update(value).digest("hex");
 }
 function stableValue(value) {
   if (Array.isArray(value))
@@ -31849,7 +31901,7 @@ init_task_lifecycle();
 init_task_crud();
 init_redaction();
 import { Database as Database3 } from "bun:sqlite";
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { existsSync as existsSync9, readdirSync as readdirSync2, statSync as statSync4 } from "fs";
 import { basename as basename2, dirname as dirname6, join as join9, resolve as resolve10 } from "path";
 
@@ -32132,7 +32184,7 @@ function normalizePath3(input) {
   return resolve10(input);
 }
 function sourceStoreId(sourceDbPath) {
-  const digest = createHash11("sha256").update(sourceDbPath).digest("hex").slice(0, 16);
+  const digest = createHash12("sha256").update(sourceDbPath).digest("hex").slice(0, 16);
   return `sqlite:${digest}`;
 }
 function inferSourceRepoPath(sourceDbPath) {
@@ -34094,7 +34146,7 @@ init_comments();
 
 // src/db/api-keys.ts
 init_database();
-import { createHash as createHash12, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash13, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
 function rowToRecord(row) {
   return {
     id: row.id,
@@ -34108,7 +34160,7 @@ function rowToRecord(row) {
   };
 }
 function hashApiKey(key) {
-  return createHash12("sha256").update(key).digest("hex");
+  return createHash13("sha256").update(key).digest("hex");
 }
 function safeEqualHex(a, b) {
   if (a.length !== b.length)
@@ -38553,7 +38605,7 @@ init_database();
 init_tasks();
 import { existsSync as existsSync17, readFileSync as readFileSync13 } from "fs";
 import { basename as basename5 } from "path";
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 init_secret_redaction();
 var INBOX_INTAKE_SCHEMA = "todos.inbox_intake.v1";
 var INTAKE_SOURCE_TYPES = [
@@ -38566,7 +38618,7 @@ var INTAKE_SOURCE_TYPES = [
 ];
 var INTAKE_TRIAGE_STATUSES = ["preview", "triaged", "duplicate", "created"];
 function fingerprint2(text) {
-  return createHash13("sha256").update(text).digest("hex").slice(0, 16);
+  return createHash14("sha256").update(text).digest("hex").slice(0, 16);
 }
 function loadRawContent(input) {
   if (input.github_url) {
@@ -43106,7 +43158,7 @@ var CLI_COMMAND_GROUPS = [
     commands: [
       { name: "completion", summary: "Shell completions", usage: "todos completion <bash|zsh|fish>", example: "todos completion bash >> ~/.bashrc" },
       { name: "docs", summary: "CLI reference and adapter docs", example: "todos docs cli" },
-      { name: "mcp", summary: "Register MCP server", flags: ["--claude", "--codex"] }
+      { name: "mcp", summary: "Register MCP server", flags: ["--register <agent>", "--unregister <agent>", "--global"] }
     ]
   }
 ];
@@ -44026,7 +44078,7 @@ init_database();
 init_tasks();
 init_redaction();
 init_sync_utils();
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { existsSync as existsSync22, readFileSync as readFileSync19, statSync as statSync9 } from "fs";
 import { hostname as hostname3, platform, arch } from "os";
 import { dirname as dirname15, join as join18, resolve as resolve17 } from "path";
@@ -44048,7 +44100,7 @@ var CONFIG_FILES = [
   "dashboard/vite.config.ts"
 ];
 function sha2566(value) {
-  return createHash14("sha256").update(value).digest("hex");
+  return createHash15("sha256").update(value).digest("hex");
 }
 function fileRecord(root, relativePath) {
   const path = join18(root, relativePath);
@@ -44300,7 +44352,7 @@ function compareEnvironmentSnapshotFiles(leftPath, rightPath) {
 init_database();
 init_projects();
 init_plans();
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync16 } from "fs";
 import { dirname as dirname16, join as join19 } from "path";
 var DECISION_RECORD_SCHEMA = "todos.decision_record.v1";
@@ -44356,7 +44408,7 @@ function rowToDecisionRecord(row) {
 }
 function stableSnapshotHash(payload) {
   const { captured_at: _capturedAt, ...rest } = payload;
-  return createHash15("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash16("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 function createDecisionRecord(input, db) {
   const d = db || getDatabase();
@@ -48405,15 +48457,17 @@ function pushToClaudeTaskList(taskListId, projectId, options = {}) {
         const lastSyncedAt = parseTimestamp(existing.task.metadata?.["todos_updated_at"]);
         const localUpdatedAt = parseTimestamp(task2.updated_at);
         const remoteUpdatedAt = existing.mtimeMs;
+        const remoteChanged = hasSyncFingerprintChanged(existing.task);
+        const remoteChangedSinceSync = remoteChanged ?? Boolean(lastSyncedAt && remoteUpdatedAt && remoteUpdatedAt > lastSyncedAt);
         let recordConflict = false;
-        if (lastSyncedAt && localUpdatedAt && remoteUpdatedAt && localUpdatedAt > lastSyncedAt && remoteUpdatedAt > lastSyncedAt) {
+        if (lastSyncedAt && localUpdatedAt && localUpdatedAt > lastSyncedAt && remoteChangedSinceSync) {
           if (prefer === "remote") {
             const conflict = {
               agent: "claude",
               direction: "push",
               prefer,
               local_updated_at: task2.updated_at,
-              remote_updated_at: new Date(remoteUpdatedAt).toISOString(),
+              remote_updated_at: remoteUpdatedAt ? new Date(remoteUpdatedAt).toISOString() : undefined,
               detected_at: new Date().toISOString()
             };
             const newMeta = appendSyncConflict(task2.metadata, conflict);
@@ -48427,7 +48481,7 @@ function pushToClaudeTaskList(taskListId, projectId, options = {}) {
         updated.blocks = existing.task.blocks;
         updated.blockedBy = existing.task.blockedBy;
         updated.activeForm = existing.task.activeForm;
-        writeClaudeTask(dir, updated);
+        writeClaudeTask(dir, withSyncFingerprint(updated));
         if (recordConflict) {
           const latest = getTask(task2.id);
           if (latest) {
@@ -48451,7 +48505,7 @@ function pushToClaudeTaskList(taskListId, projectId, options = {}) {
           prefixCounter++;
           ct.subject = formatPrefixedSubject(task2.title, prefixConfig.prefix, prefixCounter);
         }
-        writeClaudeTask(dir, ct);
+        writeClaudeTask(dir, withSyncFingerprint(ct));
         const current = getTask(task2.id);
         if (current) {
           const newMeta = { ...current.metadata, claude_task_id: claudeId };
@@ -48577,7 +48631,7 @@ function writeAgentTask(dir, task2) {
   writeJsonFile(join24(dir, `${task2.id}.json`), task2);
 }
 function taskToAgentTask(task2, externalId, existingMeta) {
-  return {
+  return withSyncFingerprint({
     id: externalId,
     title: task2.title,
     description: task2.description || "",
@@ -48592,7 +48646,7 @@ function taskToAgentTask(task2, externalId, existingMeta) {
       todos_updated_at: task2.updated_at,
       todos_version: task2.version
     }
-  };
+  });
 }
 function metadataKey(agent) {
   return `${agent}_task_id`;
@@ -48626,15 +48680,17 @@ function pushToAgentTaskList(agent, taskListId, projectId, options = {}) {
         const lastSyncedAt = parseTimestamp(existing.task.metadata?.["todos_updated_at"]);
         const localUpdatedAt = parseTimestamp(task2.updated_at);
         const remoteUpdatedAt = existing.mtimeMs;
+        const remoteChanged = hasSyncFingerprintChanged(existing.task);
+        const remoteChangedSinceSync = remoteChanged ?? Boolean(lastSyncedAt && remoteUpdatedAt && remoteUpdatedAt > lastSyncedAt);
         let recordConflict = false;
-        if (lastSyncedAt && localUpdatedAt && remoteUpdatedAt && localUpdatedAt > lastSyncedAt && remoteUpdatedAt > lastSyncedAt) {
+        if (lastSyncedAt && localUpdatedAt && localUpdatedAt > lastSyncedAt && remoteChangedSinceSync) {
           if (prefer === "remote") {
             const conflict = {
               agent,
               direction: "push",
               prefer,
               local_updated_at: task2.updated_at,
-              remote_updated_at: new Date(remoteUpdatedAt).toISOString(),
+              remote_updated_at: remoteUpdatedAt ? new Date(remoteUpdatedAt).toISOString() : undefined,
               detected_at: new Date().toISOString()
             };
             const newMeta = appendSyncConflict(task2.metadata, conflict);
@@ -48842,7 +48898,7 @@ function syncWithAgents(agents, taskListIdByAgent, projectId, direction = "both"
 init_tasks();
 init_task_files();
 import { existsSync as existsSync27, readFileSync as readFileSync23, statSync as statSync10 } from "fs";
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { relative as relative6, resolve as resolve18, join as join25 } from "path";
 var EXTRACT_TAGS = ["TODO", "FIXME", "HACK", "XXX", "BUG", "NOTE"];
 var DEFAULT_EXTENSIONS = new Set([
@@ -48907,7 +48963,7 @@ var SKIP_DIRS2 = new Set([
   ".parcel-cache"
 ]);
 function stableHash(value) {
-  return createHash16("sha256").update(value).digest("hex");
+  return createHash17("sha256").update(value).digest("hex");
 }
 function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -49803,7 +49859,7 @@ function renderWorkflowStatesMarkdown(states = listWorkflowStates()) {
 }
 // src/lib/agent-replay-simulator.ts
 init_redaction();
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import { readFileSync as readFileSync24 } from "fs";
 function isObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -49825,7 +49881,7 @@ function stable2(value) {
   return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable2(value[key])]));
 }
 function fingerprint3(value) {
-  return createHash17("sha256").update(JSON.stringify(stable2(value))).digest("hex");
+  return createHash18("sha256").update(JSON.stringify(stable2(value))).digest("hex");
 }
 function unpackFixture(input) {
   if (!isObject(input))
@@ -50064,7 +50120,7 @@ function renderAgentReplaySimulationMarkdown(simulation) {
 }
 // src/lib/local-extensions.ts
 init_config2();
-import { createHash as createHash18, createVerify } from "crypto";
+import { createHash as createHash19, createVerify } from "crypto";
 import { existsSync as existsSync28, readdirSync as readdirSync6, readFileSync as readFileSync25, statSync as statSync11 } from "fs";
 import { basename as basename6, join as join26, resolve as resolve19 } from "path";
 init_redaction();
@@ -50152,7 +50208,7 @@ function parseJson2(path) {
   return JSON.parse(readFileSync25(path, "utf8"));
 }
 function sha2567(bytes) {
-  return `sha256:${createHash18("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash19("sha256").update(bytes).digest("hex")}`;
 }
 function compareVersions(a, b) {
   const left = a.split(".").map((part) => Number.parseInt(part, 10) || 0);

package/dist/lib/agent-tasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tasks.d.ts","sourceRoot":"","sources":["../../src/lib/agent-tasks.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAwD9D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACpC,UAAU,CAuFZ;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACpC,UAAU,CAoFZ;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACpC,UAAU,CAQZ"}
+{"version":3,"file":"agent-tasks.d.ts","sourceRoot":"","sources":["../../src/lib/agent-tasks.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAwD9D,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACpC,UAAU,CA2FZ;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACpC,UAAU,CAoFZ;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACpC,UAAU,CAQZ"}

package/dist/lib/assignee-context.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Builds the {@link AssigneeContext} that `validateAssignee` consumes, and
+ * caches it briefly.
+ *
+ * `assignee-validation.ts` is deliberately pure and does no IO. This module is
+ * the IO half, kept separate so the validator stays trivially testable.
+ *
+ * WHY THE CACHE EXISTS. Validation needs the agent roster, and on this fleet
+ * that is a ~710KB / ~2.4s fetch against the cloud store. The one-shot CLI pays
+ * it once and does not care. The MCP server is LONG-LIVED and validates on
+ * every create/update/upsert, so a 50-task bulk upsert — the loop-driven path —
+ * would refetch ~35MB. Found in adversarial review of todos 056f3597.
+ *
+ * The TTL is deliberately short. An agent that registers during the window is
+ * invisible for at most that long, and the only consequence is a WARNING on an
+ * assignee that is in fact valid — never a refusal, because the refusing tiers
+ * (seat, ambiguous) cannot be created by a registration the cache missed:
+ * a new seat requires an owner ruling and a roster edit, and a name becoming
+ * ambiguous only ever ADDS a row, which at worst delays the refusal by the TTL.
+ */
+import type { AssigneeContext } from "./assignee-validation.js";
+/** Drop the cache. For tests, and for any caller that has just mutated agents. */
+export declare function resetAssigneeContextCache(): void;
+/**
+ * Fetch (or reuse) the agent roster and seat list.
+ *
+ * `listAgentsFn` is injected rather than imported so this module does not pull
+ * `bun:sqlite` into every consumer's module graph — the same constraint that
+ * keeps `agent-name-normalize.ts` import-free.
+ */
+export declare function loadAssigneeContext(listAgentsFn: () => Promise<Array<{
+    id: string;
+    name: string;
+}>> | Array<{
+    id: string;
+    name: string;
+}>, allowSeat: boolean, nowMs?: number): Promise<AssigneeContext & {
+    degraded: boolean;
+}>;
+//# sourceMappingURL=assignee-context.d.ts.map

package/dist/lib/assignee-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee-context.d.ts","sourceRoot":"","sources":["../../src/lib/assignee-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAc,MAAM,0BAA0B,CAAC;AAgB5E,kFAAkF;AAClF,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EACtG,SAAS,EAAE,OAAO,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,eAAe,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAkClD"}