@hasna/todos 0.13.7 → 0.13.9

package/dist/mcp/tools/task-crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-crud.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/task-crud.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAgBjD,UAAU,eAAe;IACvB,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC;IACnC,gBAAgB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,mBAAmB,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACvE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC3F;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,QAmX5E"}
+{"version":3,"file":"task-crud.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/task-crud.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAoBjD,UAAU,eAAe;IACvB,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACxC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC;IACnC,gBAAgB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,mBAAmB,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACvE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC3F;AAuBD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,QAkY5E"}

package/dist/mcp.js

@@ -41,7 +41,7 @@ var __require = import.meta.require;
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.13.7",
+  version: "0.13.9",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/registry.js

@@ -4336,6 +4336,7 @@ var init_database = __esm(() => {
 
 // src/lib/sync-utils.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
+import { createHash } from "crypto";
 import { join as join2 } from "path";
 function getHomeDir() {
   return process.env["HOME"] || process.env["USERPROFILE"] || "~";
@@ -4391,7 +4392,40 @@ function appendSyncConflict(metadata, conflict, limit = 5) {
   const next = [conflict, ...current].slice(0, limit);
   return { ...metadata, sync_conflicts: next };
 }
-var HOME;
+function canonicalize(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize);
+  if (!value || typeof value !== "object")
+    return value;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).sort(([a], [b]) => a.localeCompare(b));
+  return Object.fromEntries(entries.map(([key, entryValue]) => [key, canonicalize(entryValue)]));
+}
+function withoutSyncFingerprintMetadata(metadata) {
+  const { [TODO_SYNC_FINGERPRINT_KEY]: _fingerprint, ...rest } = metadata;
+  return rest;
+}
+function syncFingerprint(record) {
+  const metadata = withoutSyncFingerprintMetadata(record.metadata || {});
+  const canonical = canonicalize({ ...record, metadata });
+  return `sha256:${createHash("sha256").update(JSON.stringify(canonical)).digest("hex")}`;
+}
+function withSyncFingerprint(record) {
+  const metadata = withoutSyncFingerprintMetadata(record.metadata);
+  return {
+    ...record,
+    metadata: {
+      ...metadata,
+      [TODO_SYNC_FINGERPRINT_KEY]: syncFingerprint({ ...record, metadata })
+    }
+  };
+}
+function hasSyncFingerprintChanged(record) {
+  const stored = record.metadata?.[TODO_SYNC_FINGERPRINT_KEY];
+  if (typeof stored !== "string" || stored.length === 0)
+    return null;
+  return stored !== syncFingerprint(record);
+}
+var TODO_SYNC_FINGERPRINT_KEY = "todos_sync_fingerprint", HOME;
 var init_sync_utils = __esm(() => {
   HOME = process.env["HOME"] || process.env["USERPROFILE"] || "~";
 });
@@ -5502,7 +5536,7 @@ var init_runner_sandbox = __esm(() => {
 });
 
 // src/lib/event-hooks.ts
-import { createHash, randomUUID } from "crypto";
+import { createHash as createHash2, randomUUID } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
 import { dirname as dirname3, resolve as resolve6 } from "path";
 import { createConnection } from "net";
@@ -5569,7 +5603,7 @@ function buildEnvelope(type, payload, timestamp2 = new Date().toISOString()) {
     payload: redactValue(payload ?? {}),
     source: { package: "@hasna/todos", local_only: true }
   };
-  const digest = createHash("sha256").update(canonicalEvent(base)).digest("hex");
+  const digest = createHash2("sha256").update(canonicalEvent(base)).digest("hex");
   return { ...base, integrity: { algorithm: "sha256", digest } };
 }
 function summarize(value) {
@@ -7479,6 +7513,14 @@ var init_checklists = __esm(() => {
   init_database();
 });
 
+// src/lib/creator-identity.ts
+function canonicalAgentRef(value) {
+  return value.trim().toLowerCase();
+}
+var init_creator_identity = __esm(() => {
+  init_sync_utils();
+});
+
 // src/lib/recurrence.ts
 function parseRecurrenceRule(rule) {
   const normalized = rule.trim().toLowerCase();
@@ -8185,6 +8227,11 @@ __export(exports_task_lifecycle, {
   claimOrSteal: () => claimOrSteal,
   claimNextTask: () => claimNextTask
 });
+function sameHolder(stored, incoming) {
+  if (!stored || !incoming)
+    return false;
+  return canonicalAgentRef(stored) === canonicalAgentRef(incoming);
+}
 function lockExpiresAt(lockedAt) {
   if (!lockedAt)
     return null;
@@ -8235,13 +8282,13 @@ function startTask(id, agentId, db) {
   const cutoff = lockExpiryCutoff();
   const timestamp2 = now();
   const result = d.run(`UPDATE tasks SET status = 'in_progress', assigned_to = ?, locked_by = ?, locked_at = ?, started_at = COALESCE(started_at, ?), version = version + 1, updated_at = ?
-     WHERE id = ? AND status IN ('pending', 'in_progress') AND (locked_by IS NULL OR locked_by = ? OR locked_at < ?)`, [agentId, agentId, timestamp2, timestamp2, timestamp2, id, agentId, cutoff]);
+     WHERE id = ? AND status IN ('pending', 'in_progress') AND (locked_by IS NULL OR LOWER(TRIM(locked_by)) = LOWER(TRIM(?)) OR locked_at < ?)`, [agentId, agentId, timestamp2, timestamp2, timestamp2, id, agentId, cutoff]);
   if (result.changes === 0) {
     const current = getTask(id, d);
     if (!current)
       throw new TaskNotFoundError(id);
     assertStartable(current, agentId);
-    if (current.locked_by && current.locked_by !== agentId && !isLockExpired(current.locked_at)) {
+    if (current.locked_by && !sameHolder(current.locked_by, agentId) && !isLockExpired(current.locked_at)) {
       throw new LockError(id, current.locked_by);
     }
     throw new Error(`Task ${id} could not be started because it changed during claim`);
@@ -8266,7 +8313,7 @@ function completeTask(id, agentId, db, options) {
   if (task.status === "cancelled") {
     throw new Error(`Task ${id} is cancelled and cannot be completed`);
   }
-  if (agentId && task.locked_by && task.locked_by !== agentId && !isLockExpired(task.locked_at)) {
+  if (agentId && task.locked_by && !sameHolder(task.locked_by, agentId) && !isLockExpired(task.locked_at)) {
     throw new LockError(id, task.locked_by);
   }
   checkCompletionGuard(task, agentId || null, d);
@@ -8388,16 +8435,16 @@ function lockTask(id, agentId, db) {
       error: `Task is ${task.status} and cannot be locked`
     };
   }
-  if (task.locked_by === agentId && !isLockExpired(task.locked_at)) {
+  if (sameHolder(task.locked_by, agentId) && !isLockExpired(task.locked_at)) {
     const timestamp3 = now();
-    d.run(`UPDATE tasks SET locked_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND locked_by = ?`, [timestamp3, timestamp3, id, agentId]);
+    d.run(`UPDATE tasks SET locked_at = ?, updated_at = ?, version = version + 1 WHERE id = ? AND LOWER(TRIM(locked_by)) = LOWER(TRIM(?))`, [timestamp3, timestamp3, id, agentId]);
     logTaskChange(id, "lock_renew", "locked_by", agentId, agentId, agentId, d);
     return { success: true, locked_by: agentId, locked_at: timestamp3, expires_at: lockExpiresAt(timestamp3) };
   }
   const cutoff = lockExpiryCutoff();
   const timestamp2 = now();
   const result = d.run(`UPDATE tasks SET locked_by = ?, locked_at = ?, version = version + 1, updated_at = ?
-     WHERE id = ? AND status NOT IN ('completed', 'cancelled') AND (locked_by IS NULL OR locked_by = ? OR locked_at < ?)`, [agentId, timestamp2, timestamp2, id, agentId, cutoff]);
+     WHERE id = ? AND status NOT IN ('completed', 'cancelled') AND (locked_by IS NULL OR LOWER(TRIM(locked_by)) = LOWER(TRIM(?)) OR locked_at < ?)`, [agentId, timestamp2, timestamp2, id, agentId, cutoff]);
   if (result.changes === 0) {
     const current = getTask(id, d);
     if (!current)
@@ -8429,7 +8476,7 @@ function unlockTask(id, agentId, db) {
   const task = getTask(id, d);
   if (!task)
     throw new TaskNotFoundError(id);
-  if (agentId && task.locked_by && task.locked_by !== agentId) {
+  if (agentId && task.locked_by && !sameHolder(task.locked_by, agentId)) {
     throw new LockError(id, task.locked_by);
   }
   const timestamp2 = now();
@@ -8722,6 +8769,7 @@ var MAX_SPAWN_DEPTH = 10;
 var init_task_lifecycle = __esm(() => {
   init_types();
   init_database();
+  init_creator_identity();
   init_completion_guard();
   init_event_emission_safety();
   init_event_hooks();
@@ -10490,7 +10538,7 @@ var init_boards = __esm(() => {
 });
 
 // src/lib/artifact-store.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
 import { basename, dirname as dirname4, join as join5, resolve as resolve7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
@@ -10515,7 +10563,7 @@ function artifactStorePath(relativePath) {
   return join5(artifactStoreRoot(), normalized);
 }
 function sha256(buffer) {
-  return createHash2("sha256").update(buffer).digest("hex");
+  return createHash3("sha256").update(buffer).digest("hex");
 }
 function isTextLike(buffer, path) {
   if (buffer.includes(0))
@@ -11925,7 +11973,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.13.7",
+  version: "0.13.9",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -15640,7 +15688,7 @@ function importOnboardingFixture(options = {}) {
 }
 // src/lib/local-backups.ts
 init_database();
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname5, resolve as resolve8 } from "path";
 import { mkdirSync as mkdirSync6 } from "fs";
@@ -15658,7 +15706,7 @@ function stableJson(value) {
   return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
 }
 function sha2562(value) {
-  return createHash3("sha256").update(stableJson(value)).digest("hex");
+  return createHash4("sha256").update(stableJson(value)).digest("hex");
 }
 function sqliteIntegrity(db) {
   let quick = "unknown";
@@ -15936,7 +15984,7 @@ function checkLocalIntegrity(options = {}, db) {
 }
 // src/lib/local-snapshots.ts
 init_database();
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/lib/activity-timeline.ts
 init_database();
@@ -16212,7 +16260,7 @@ function stable(value) {
   return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, stable(item)]));
 }
 function sha2563(value) {
-  return createHash4("sha256").update(JSON.stringify(stable(value))).digest("hex");
+  return createHash5("sha256").update(JSON.stringify(stable(value))).digest("hex");
 }
 function latestTimestamp(items, fallback) {
   const timestamps = [];
@@ -19424,20 +19472,20 @@ init_database();
 init_task_runs();
 init_config2();
 init_redaction();
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var LOCAL_AUDIT_LEDGER_SCHEMA_VERSION = 1;
 var LOCAL_AUDIT_LEDGER_HASH_ALGORITHM = "sha256";
 var LOCAL_AUDIT_LEDGER_INITIAL_HASH = "0".repeat(64);
-function canonicalize(value) {
+function canonicalize2(value) {
   if (value === null || typeof value !== "object")
     return JSON.stringify(value);
   if (Array.isArray(value))
-    return `[${value.map(canonicalize).join(",")}]`;
+    return `[${value.map(canonicalize2).join(",")}]`;
   const object = value;
-  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(object[key])}`).join(",")}}`;
+  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalize2(object[key])}`).join(",")}}`;
 }
 function hash(value) {
-  return createHash5("sha256").update(value).digest("hex");
+  return createHash6("sha256").update(value).digest("hex");
 }
 function parsePayload2(value) {
   if (!value)
@@ -19570,7 +19618,7 @@ function toLedgerEntries(rows) {
   let previous = LOCAL_AUDIT_LEDGER_INITIAL_HASH;
   return ordered.map((row, index) => {
     const payload = parsePayload2(row.payload_json);
-    const payloadHash = hash(canonicalize({ source: row.source, source_id: row.source_id, created_at: row.created_at, payload }));
+    const payloadHash = hash(canonicalize2({ source: row.source, source_id: row.source_id, created_at: row.created_at, payload }));
     const chainHash = hash(`${previous}
 ${payloadHash}`);
     const entry = {
@@ -19957,7 +20005,7 @@ function renderReleaseCompatibilityMarkdown(report) {
 `);
 }
 // src/db/inbox.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 
 // src/lib/github.ts
 import { execFileSync } from "child_process";
@@ -20042,7 +20090,7 @@ function compactWhitespace(value) {
 function fingerprintInboxInput(input) {
   const sourceType = input.source_type || detectInboxSourceType(input.body, input.source_url);
   const normalized = compactWhitespace(sanitizePreWriteText(input.body, "inbox.fingerprint")).slice(0, 8000);
-  return createHash6("sha256").update(`${sourceType}
+  return createHash7("sha256").update(`${sourceType}
 ${input.source_url || ""}
 ${normalized}`).digest("hex");
 }
@@ -21159,7 +21207,7 @@ function importExternalIssues(input, db) {
 init_database();
 init_tasks();
 init_redaction();
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 var TESTERS_ISSUE_REPORT_SCHEMA_VERSION = "testers.issue_report.v1";
 var TESTERS_ISSUE_REPORT_RESULT_SCHEMA_VERSION = "todos.tester_issue_report_result.v1";
 var TESTERS_ISSUE_REPORT_BATCH_RESULT_SCHEMA_VERSION = "todos.tester_issue_report_batch_result.v1";
@@ -21348,7 +21396,7 @@ function fingerprintTesterIssueReport(report) {
     normalizeText2(report.failure?.message || report.summary || report.title).slice(0, 240),
     normalizeText2(stackTop).slice(0, 160)
   ].join("::");
-  return `testers:${createHash7("sha256").update(raw).digest("hex").slice(0, 16)}`;
+  return `testers:${createHash8("sha256").update(raw).digest("hex").slice(0, 16)}`;
 }
 function priorityForSeverity(severity, fallback) {
   return PRIORITIES3.includes(severity) ? severity : fallback;
@@ -22800,7 +22848,7 @@ function renderLocalReportMarkdown(report) {
 init_config2();
 init_redaction();
 init_prewrite_secrets();
-import { createCipheriv, createDecipheriv, createHash as createHash8, randomBytes, scryptSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash9, randomBytes, scryptSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var TODOS_ENCRYPTED_VALUE_KIND = "hasna.todos.encrypted-value";
 var TODOS_ENCRYPTED_BRIDGE_KIND = "hasna.todos.encrypted-bridge";
 var TODOS_ENCRYPTION_SCHEMA_VERSION = 1;
@@ -22826,7 +22874,7 @@ function now3() {
   return new Date().toISOString();
 }
 function sha2564(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash9("sha256").update(value).digest("hex");
 }
 function normalizeProfileName(value) {
   const name = (value || DEFAULT_ENCRYPTION_PROFILE).trim();

package/dist/release-provenance.json

@@ -1,9 +1,9 @@
 {
   "packageName": "@hasna/todos",
-  "packageVersion": "0.13.7",
+  "packageVersion": "0.13.9",
   "repository": "https://github.com/hasna/todos.git",
-  "gitCommit": "aa3d008fc49ace7658ecef4863568757b74bb746",
-  "gitTree": "39730eb0fa5cdc58f5433b152ac1c64a1b63eb81",
-  "sourceTreeSha256": "e7e24d6bc56270c1cfabb0ed47b856cd2143b0ab1085c41a6de18a2eb1ff127b",
-  "generatedAt": "2026-07-31T21:21:34.000Z"
+  "gitCommit": "0877f637ea98eb762347fc78d43d033cf4999ef6",
+  "gitTree": "458f99b7674b48d37f779b7bc1329369385b6ce5",
+  "sourceTreeSha256": "49de4d648f9049fe5fdab5edfb8d47e17b5c5241b655c203f17fe0046b02e07f",
+  "generatedAt": "2026-08-01T10:18:22.000Z"
 }