@hasna/todos 0.15.10 → 0.15.12

package/dist/contracts.js

@@ -12379,7 +12379,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.10",
+  version: "0.15.12",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/index.js

@@ -12492,7 +12492,7 @@ var init_dispatches = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.10",
+  version: "0.15.12",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -25321,6 +25321,7 @@ function scanSqliteIntegrity(db = getDatabase()) {
 }
 
 // src/lib/plan-project-link-contract.ts
+init_types();
 import { createHash as createHash10 } from "crypto";
 var PLAN_PROJECT_LINK_SCHEMA_VERSION = "todos.plan-project-link.v1";
 

package/dist/lib/plan-project-link-contract.d.ts

@@ -1,4 +1,4 @@
-import type { Plan, PlanProjectLinkReceipt, Task } from "../types/index.js";
+import type { Plan, PlanProjectLinkReceipt, PlanProjectLinkResult, PlanProjectLinkRollbackResult, Task } from "../types/index.js";
 export declare const PLAN_PROJECT_LINK_SCHEMA_VERSION: "todos.plan-project-link.v1";
 export type PlanProjectLinkErrorCode = "PLAN_PROJECT_LINK_PLAN_NOT_FOUND" | "PLAN_PROJECT_LINK_PROJECT_NOT_FOUND" | "PLAN_PROJECT_LINK_PLAN_REVISION_CONFLICT" | "PLAN_PROJECT_LINK_PROJECT_REVISION_CONFLICT" | "PLAN_PROJECT_LINK_SCOPE_COLLISION" | "PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID" | "PLAN_PROJECT_LINK_IDEMPOTENCY_CONFLICT" | "PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND" | "PLAN_PROJECT_LINK_RESULT_DRIFT" | "PLAN_PROJECT_LINK_ROLLBACK_CONFLICT" | "PLAN_PROJECT_LINK_UNSUPPORTED";
 export declare class PlanProjectLinkError extends Error {
@@ -14,4 +14,19 @@ export declare function planProjectLinkRollbackReceiptId(receiptId: string): str
 export declare function planProjectLinkRequestHash(planId: string, projectId: string): string;
 export declare function planProjectLinkResultDigest(plan: Pick<Plan, "id" | "project_id">, tasks: Task[]): string;
 export declare function assertPlanProjectLinkReceipt(value: unknown): PlanProjectLinkReceipt;
+type PlanProjectLinkResponseExpectation = {
+    mode: "plan" | "apply";
+    plan_id: string;
+    project_id: string;
+    idempotency_key?: string;
+};
+type PlanProjectLinkRollbackResponseExpectation = {
+    plan_id: string;
+    receipt_id: string;
+};
+/** Validate an untrusted HTTP plan/apply response before the CLI can report success. */
+export declare function assertPlanProjectLinkResponse(value: unknown, expectation: PlanProjectLinkResponseExpectation): PlanProjectLinkResult;
+/** Validate an untrusted HTTP rollback response before the CLI can report success. */
+export declare function assertPlanProjectLinkRollbackResponse(value: unknown, expectation: PlanProjectLinkRollbackResponseExpectation): PlanProjectLinkRollbackResult;
+export {};
 //# sourceMappingURL=plan-project-link-contract.d.ts.map

package/dist/lib/plan-project-link-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-project-link-contract.d.ts","sourceRoot":"","sources":["../../src/lib/plan-project-link-contract.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE5E,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AAEtF,MAAM,MAAM,wBAAwB,GAChC,kCAAkC,GAClC,qCAAqC,GACrC,0CAA0C,GAC1C,6CAA6C,GAC7C,mCAAmC,GACnC,2CAA2C,GAC3C,wCAAwC,GACxC,qCAAqC,GACrC,gCAAgC,GAChC,qCAAqC,GACrC,+BAA+B,CAAC;AAEpC,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,wBAAwB;IAEvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFhC,IAAI,EAAE,wBAAwB,EACvC,OAAO,EAAE,MAAM,EACN,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKjD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQnE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D;AAED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CASxF;AAED,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAQxG;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAsBnF"}
+{"version":3,"file":"plan-project-link-contract.d.ts","sourceRoot":"","sources":["../../src/lib/plan-project-link-contract.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,IAAI,EACJ,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,IAAI,EACL,MAAM,mBAAmB,CAAC;AAE3B,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AAEtF,MAAM,MAAM,wBAAwB,GAChC,kCAAkC,GAClC,qCAAqC,GACrC,0CAA0C,GAC1C,6CAA6C,GAC7C,mCAAmC,GACnC,2CAA2C,GAC3C,wCAAwC,GACxC,qCAAqC,GACrC,gCAAgC,GAChC,qCAAqC,GACrC,+BAA+B,CAAC;AAEpC,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,wBAAwB;IAEvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFhC,IAAI,EAAE,wBAAwB,EACvC,OAAO,EAAE,MAAM,EACN,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKjD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQnE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D;AAED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CASxF;AAED,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAQxG;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAsBnF;AAED,KAAK,kCAAkC,GAAG;IACxC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,KAAK,0CAA0C,GAAG;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AA8RF,wFAAwF;AACxF,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,kCAAkC,GAC9C,qBAAqB,CA2CvB;AAED,sFAAsF;AACtF,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,0CAA0C,GACtD,6BAA6B,CA6B/B"}

package/dist/mcp/index.js

@@ -18443,6 +18443,63 @@ var init_assignee_context = __esm(() => {
   init_assignee_validation();
 });
 
+// src/lib/plan-project-link-contract.ts
+import { createHash as createHash3 } from "crypto";
+function canonicalPlanProjectLinkJson(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalPlanProjectLinkJson).join(",")}]`;
+  return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalPlanProjectLinkJson(item)}`).join(",")}}`;
+}
+function planProjectLinkDigest(value) {
+  return createHash3("sha256").update(canonicalPlanProjectLinkJson(value)).digest("hex");
+}
+function normalizePlanProjectLinkIdempotencyKey(value) {
+  const key = value?.trim() ?? "";
+  if (key.length < 8 || key.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID", "idempotency_key must be 8-128 ASCII letters, digits, dots, underscores, colons, or hyphens");
+  }
+  return key;
+}
+function planProjectLinkReceiptId(idempotencyKey) {
+  return `pplr_${planProjectLinkDigest({ idempotency_key: idempotencyKey }).slice(0, 48)}`;
+}
+function planProjectLinkRollbackReceiptId(receiptId) {
+  return `pplr_inverse_${planProjectLinkDigest({ accepted_receipt_id: receiptId }).slice(0, 38)}`;
+}
+function planProjectLinkRequestHash(planId, projectId) {
+  return planProjectLinkDigest({ plan_id: planId, project_id: projectId });
+}
+function planProjectLinkResultDigest(plan, tasks) {
+  return planProjectLinkDigest({
+    plan_id: plan.id,
+    plan_project_id: plan.project_id,
+    tasks: tasks.map((task) => ({ id: task.id, plan_id: task.plan_id, project_id: task.project_id })).sort((left, right) => left.id.localeCompare(right.id))
+  });
+}
+function assertPlanProjectLinkReceipt(value) {
+  const receipt = value;
+  if (!receipt || typeof receipt !== "object" || receipt.schema_version !== PLAN_PROJECT_LINK_SCHEMA_VERSION || typeof receipt.receipt_id !== "string" || typeof receipt.idempotency_key !== "string" || typeof receipt.plan_id !== "string" || typeof receipt.project_id !== "string" || !Array.isArray(receipt.task_ids) || receipt.task_ids.some((id) => typeof id !== "string") || !receipt.prior_task_project_ids || typeof receipt.prior_task_project_ids !== "object" || typeof receipt.result_digest !== "string") {
+    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "Stored plan-project-link receipt is invalid");
+  }
+  return receipt;
+}
+var PLAN_PROJECT_LINK_SCHEMA_VERSION = "todos.plan-project-link.v1", PlanProjectLinkError;
+var init_plan_project_link_contract = __esm(() => {
+  init_types();
+  PlanProjectLinkError = class PlanProjectLinkError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+      super(message);
+      this.code = code;
+      this.details = details;
+      this.name = "PlanProjectLinkError";
+    }
+  };
+});
+
 // src/pr-groups/types.ts
 var PR_GROUP_LEDGER_SCHEMA_VERSION = 1, PR_GROUP_REPAIR_CYCLE_LIMIT = 2, PrGroupLedgerError;
 var init_types3 = __esm(() => {
@@ -18459,9 +18516,9 @@ var init_types3 = __esm(() => {
 });
 
 // src/pr-groups/ledger.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function sha2562(value) {
-  return createHash3("sha256").update(value).digest("hex");
+  return createHash4("sha256").update(value).digest("hex");
 }
 function stableValue(value) {
   if (Array.isArray(value))
@@ -20957,6 +21014,12 @@ function toListQuery(filter = {}) {
     query["offset"] = filter.offset;
   return query;
 }
+function priorityRank(priority) {
+  return PRIORITY_RANK[priority ?? ""] ?? 4;
+}
+function compareCloudTaskOrder(a, b) {
+  return priorityRank(a.priority) - priorityRank(b.priority) || b.created_at.localeCompare(a.created_at) || a.id.localeCompare(b.id);
+}
 async function fetchListTagsCapability(client) {
   const document = await requiredRemoteRoute(client, "/v1/openapi.json", () => client.transport.get("/openapi.json"));
   if (!document || typeof document !== "object" || Array.isArray(document))
@@ -20978,13 +21041,40 @@ async function requireTagsFilterCapability(client) {
     throw new Error(`REMOTE_TAGS_FILTER_UNSUPPORTED: configured Todos authority ${authority} does not advertise the tags ` + "query param on GET /v1/tasks; deploy the current @hasna/todos /v1 server to filter by tag; " + "no unfiltered task read was issued");
   }
 }
-async function cloudListTasks(client, filter = {}) {
-  if (filter.tags?.length)
-    await requireTagsFilterCapability(client);
+async function requestCloudTaskPage(client, filter) {
   const res = await requiredRemoteRoute(client, "/v1/tasks", () => client.list("tasks", { query: toListQuery(filter) }));
   const envelope = res.raw;
   return Array.isArray(envelope?.tasks) ? envelope.tasks : res.items;
 }
+async function cloudListTasks(client, filter = {}) {
+  if (filter.tags?.length)
+    await requireTagsFilterCapability(client);
+  const statuses = Array.isArray(filter.status) ? filter.status : undefined;
+  if (!statuses)
+    return requestCloudTaskPage(client, filter);
+  if (statuses.length === 0)
+    return [];
+  if (statuses.length === 1) {
+    return requestCloudTaskPage(client, { ...filter, status: statuses[0] });
+  }
+  const { status: _status, limit, offset, ...baseFilter } = filter;
+  const start = offset ?? 0;
+  const windowEnd = typeof limit === "number" ? start + limit : undefined;
+  const pages = await Promise.all(statuses.map((status) => requestCloudTaskPage(client, {
+    ...baseFilter,
+    status,
+    ...windowEnd === undefined ? {} : { limit: windowEnd }
+  })));
+  const seen = new Set;
+  const union = pages.flat().filter((task) => {
+    if (seen.has(task.id))
+      return false;
+    seen.add(task.id);
+    return true;
+  });
+  union.sort(compareCloudTaskOrder);
+  return union.slice(start, windowEnd);
+}
 async function cloudGetTask(client, id) {
   const raw = await client.get("tasks", id);
   return raw == null ? null : unwrapTask(raw);
@@ -21199,10 +21289,11 @@ async function cloudResolveTaskListRef(client, ref, projectId) {
   }
   throw new Error(`Task list not found: "${input}"`);
 }
-var UUID_RE, TRANSPORT_TOKENS, completionCapabilityCache, SERVER_MODE_CANDIDATES, cachedServerMode = null, listTagsCapabilityCache;
+var UUID_RE, TRANSPORT_TOKENS, completionCapabilityCache, gitRefCapabilityCache, SERVER_MODE_CANDIDATES, cachedServerMode = null, PRIORITY_RANK, listTagsCapabilityCache;
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
+  init_plan_project_link_contract();
   init_http_client();
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   TRANSPORT_TOKENS = {
@@ -21215,7 +21306,9 @@ var init_cloud_router = __esm(() => {
     hybrid: "http"
   };
   completionCapabilityCache = new Map;
+  gitRefCapabilityCache = new Map;
   SERVER_MODE_CANDIDATES = ["postgres", "cloud", "self_hosted"];
+  PRIORITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
   listTagsCapabilityCache = new Map;
 });
 
@@ -23608,12 +23701,12 @@ var init_local_notifications = __esm(() => {
 });
 
 // src/lib/local-encryption.ts
-import { createCipheriv, createDecipheriv, createHash as createHash4, randomBytes, scryptSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash5, randomBytes, scryptSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
 function now3() {
   return new Date().toISOString();
 }
 function sha2563(value) {
-  return createHash4("sha256").update(value).digest("hex");
+  return createHash5("sha256").update(value).digest("hex");
 }
 function normalizeProfileName(value) {
   const name = (value || DEFAULT_ENCRYPTION_PROFILE).trim();
@@ -25751,7 +25844,7 @@ var init_capacity_forecasts = __esm(() => {
 });
 
 // src/lib/audit-ledger.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function canonicalize(value) {
   if (value === null || typeof value !== "object")
     return JSON.stringify(value);
@@ -25761,7 +25854,7 @@ function canonicalize(value) {
   return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(object[key])}`).join(",")}}`;
 }
 function hash(value) {
-  return createHash5("sha256").update(value).digest("hex");
+  return createHash6("sha256").update(value).digest("hex");
 }
 function parsePayload2(value) {
   if (!value)
@@ -35309,7 +35402,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.10",
+    version: "0.15.12",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -36023,7 +36116,7 @@ var init_local_bridge = __esm(() => {
 });
 
 // src/lib/local-backups.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname7, resolve as resolve12 } from "path";
 import { mkdirSync as mkdirSync6 } from "fs";
@@ -36036,7 +36129,7 @@ function stableJson2(value) {
   return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson2(record[key])}`).join(",")}}`;
 }
 function sha2564(value) {
-  return createHash6("sha256").update(stableJson2(value)).digest("hex");
+  return createHash7("sha256").update(stableJson2(value)).digest("hex");
 }
 function sqliteIntegrity(db) {
   let quick = "unknown";
@@ -36686,7 +36779,7 @@ var init_onboarding_fixtures = __esm(() => {
 });
 
 // src/lib/local-snapshots.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function source(version) {
   return {
     packageName: "@hasna/todos",
@@ -36710,7 +36803,7 @@ function stable(value) {
   return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => [key, stable(item)]));
 }
 function sha2565(value) {
-  return createHash7("sha256").update(JSON.stringify(stable(value))).digest("hex");
+  return createHash8("sha256").update(JSON.stringify(stable(value))).digest("hex");
 }
 function latestTimestamp2(items, fallback) {
   const timestamps = [];
@@ -37276,7 +37369,7 @@ var init_retrospectives = __esm(() => {
 });
 
 // src/lib/agent-replay-simulator.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function isObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -37297,7 +37390,7 @@ function stable2(value) {
   return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable2(value[key])]));
 }
 function fingerprint2(value) {
-  return createHash8("sha256").update(JSON.stringify(stable2(value))).digest("hex");
+  return createHash9("sha256").update(JSON.stringify(stable2(value))).digest("hex");
 }
 function unpackFixture(input) {
   if (!isObject(input))
@@ -37584,7 +37677,7 @@ __export(exports_local_extensions, {
   getLocalExtension: () => getLocalExtension,
   discoverLocalExtensions: () => discoverLocalExtensions
 });
-import { createHash as createHash9, createVerify } from "crypto";
+import { createHash as createHash10, createVerify } from "crypto";
 import { existsSync as existsSync13, readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
 import { basename as basename5, join as join11, resolve as resolve13 } from "path";
 function isObject2(value) {
@@ -37670,7 +37763,7 @@ function parseJson(path) {
   return JSON.parse(readFileSync9(path, "utf8"));
 }
 function sha2566(bytes) {
-  return `sha256:${createHash9("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash10("sha256").update(bytes).digest("hex")}`;
 }
 function compareVersions(a, b) {
   const left = a.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -38145,7 +38238,7 @@ function issueToTask(issue, opts) {
 var init_github = () => {};
 
 // src/db/inbox.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 function parseMetadata3(value) {
   if (!value)
     return {};
@@ -38165,7 +38258,7 @@ function compactWhitespace(value) {
 function fingerprintInboxInput(input) {
   const sourceType = input.source_type || detectInboxSourceType(input.body, input.source_url);
   const normalized = compactWhitespace(sanitizePreWriteText(input.body, "inbox.fingerprint")).slice(0, 8000);
-  return createHash10("sha256").update(`${sourceType}
+  return createHash11("sha256").update(`${sourceType}
 ${input.source_url || ""}
 ${normalized}`).digest("hex");
 }
@@ -42365,10 +42458,10 @@ __export(exports_extract, {
   EXTRACT_TAGS: () => EXTRACT_TAGS
 });
 import { existsSync as existsSync14, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { relative as relative5, resolve as resolve14, join as join12 } from "path";
 function stableHash(value) {
-  return createHash11("sha256").update(value).digest("hex");
+  return createHash12("sha256").update(value).digest("hex");
 }
 function normalizePathForMatch(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -44092,13 +44185,13 @@ __export(exports_environment_snapshots, {
   compareEnvironmentSnapshotFiles: () => compareEnvironmentSnapshotFiles,
   captureEnvironmentSnapshot: () => captureEnvironmentSnapshot
 });
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { existsSync as existsSync15, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
 import { hostname as hostname2, platform, arch } from "os";
 import { dirname as dirname8, join as join14, resolve as resolve15 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 function sha2567(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash13("sha256").update(value).digest("hex");
 }
 function fileRecord(root, relativePath) {
   const path = join14(root, relativePath);
@@ -44689,62 +44782,6 @@ var init_cloud_client = __esm(() => {
   init_config();
 });
 
-// src/lib/plan-project-link-contract.ts
-import { createHash as createHash13 } from "crypto";
-function canonicalPlanProjectLinkJson(value) {
-  if (value === null || typeof value !== "object")
-    return JSON.stringify(value);
-  if (Array.isArray(value))
-    return `[${value.map(canonicalPlanProjectLinkJson).join(",")}]`;
-  return `{${Object.entries(value).filter(([, item]) => item !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalPlanProjectLinkJson(item)}`).join(",")}}`;
-}
-function planProjectLinkDigest(value) {
-  return createHash13("sha256").update(canonicalPlanProjectLinkJson(value)).digest("hex");
-}
-function normalizePlanProjectLinkIdempotencyKey(value) {
-  const key = value?.trim() ?? "";
-  if (key.length < 8 || key.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
-    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_IDEMPOTENCY_KEY_INVALID", "idempotency_key must be 8-128 ASCII letters, digits, dots, underscores, colons, or hyphens");
-  }
-  return key;
-}
-function planProjectLinkReceiptId(idempotencyKey) {
-  return `pplr_${planProjectLinkDigest({ idempotency_key: idempotencyKey }).slice(0, 48)}`;
-}
-function planProjectLinkRollbackReceiptId(receiptId) {
-  return `pplr_inverse_${planProjectLinkDigest({ accepted_receipt_id: receiptId }).slice(0, 38)}`;
-}
-function planProjectLinkRequestHash(planId, projectId) {
-  return planProjectLinkDigest({ plan_id: planId, project_id: projectId });
-}
-function planProjectLinkResultDigest(plan, tasks) {
-  return planProjectLinkDigest({
-    plan_id: plan.id,
-    plan_project_id: plan.project_id,
-    tasks: tasks.map((task2) => ({ id: task2.id, plan_id: task2.plan_id, project_id: task2.project_id })).sort((left, right) => left.id.localeCompare(right.id))
-  });
-}
-function assertPlanProjectLinkReceipt(value) {
-  const receipt = value;
-  if (!receipt || typeof receipt !== "object" || receipt.schema_version !== PLAN_PROJECT_LINK_SCHEMA_VERSION || typeof receipt.receipt_id !== "string" || typeof receipt.idempotency_key !== "string" || typeof receipt.plan_id !== "string" || typeof receipt.project_id !== "string" || !Array.isArray(receipt.task_ids) || receipt.task_ids.some((id) => typeof id !== "string") || !receipt.prior_task_project_ids || typeof receipt.prior_task_project_ids !== "object" || typeof receipt.result_digest !== "string") {
-    throw new PlanProjectLinkError("PLAN_PROJECT_LINK_RECEIPT_NOT_FOUND", "Stored plan-project-link receipt is invalid");
-  }
-  return receipt;
-}
-var PLAN_PROJECT_LINK_SCHEMA_VERSION = "todos.plan-project-link.v1", PlanProjectLinkError;
-var init_plan_project_link_contract = __esm(() => {
-  PlanProjectLinkError = class PlanProjectLinkError extends Error {
-    code;
-    details;
-    constructor(code, message, details = {}) {
-      super(message);
-      this.code = code;
-      this.details = details;
-      this.name = "PlanProjectLinkError";
-    }
-  };
-});
-
 // src/db/plan-project-links.ts
 function getPlanProjectLinkReceipt(receiptId, db) {
   const d = db || getDatabase();
@@ -52350,6 +52387,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
         ProjectTaskListEnsureResult: projectTaskListEnsureResultSchema,
         ProjectTaskListRollbackResult: projectTaskListRollbackResultSchema,
         TaskComment: taskCommentSchema,
+        TaskGitRef: taskGitRefSchema,
         Plan: planSchema,
         PlanProjectLinkReceipt: planProjectLinkReceiptSchema,
         PlanProjectLinkResult: planProjectLinkResultSchema,
@@ -53511,6 +53549,92 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           }
         }
       },
+      "/v1/tasks/{id}/refs": {
+        get: {
+          operationId: "listTaskGitRefs",
+          summary: "List git branch and pull-request refs linked to a task",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["refs", "count"],
+                    properties: {
+                      refs: { type: "array", items: { $ref: "#/components/schemas/TaskGitRef" } },
+                      count: { type: "integer", minimum: 0 }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        post: {
+          operationId: "linkTaskGitRef",
+          summary: "Link a git branch or pull-request ref to a task",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["ref_type", "name"],
+                  properties: {
+                    ref_type: { type: "string", enum: ["branch", "pull_request"] },
+                    name: { type: "string", minLength: 1 },
+                    url: { type: "string" },
+                    provider: { type: "string" },
+                    metadata: { type: "object", additionalProperties: true }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "201": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["ref"],
+                    properties: { ref: { $ref: "#/components/schemas/TaskGitRef" } }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/v1/refs/{ref}": {
+        get: {
+          operationId: "findTaskGitRefs",
+          summary: "Find task links by git branch or pull-request ref",
+          parameters: [{ name: "ref", in: "path", required: true, schema: { type: "string" } }],
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["refs", "count"],
+                    properties: {
+                      refs: { type: "array", items: { $ref: "#/components/schemas/TaskGitRef" } },
+                      count: { type: "integer", minimum: 0 }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
       "/v1/tasks/{id}/start": {
         post: {
           operationId: "startTask",
@@ -53962,7 +54086,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
     }
   };
 }
-var taskSchema, projectSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, planSchema, planProjectLinkReceiptSchema, planProjectLinkResultSchema, planProjectLinkRollbackResultSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema;
+var taskSchema, projectSchema, taskListSchema, projectTaskListEnsureReceiptSchema, projectTaskListEnsureResultSchema, projectTaskListRollbackResultSchema, taskCommentSchema, taskGitRefSchema, planSchema, planProjectLinkReceiptSchema, planProjectLinkResultSchema, planProjectLinkRollbackResultSchema, templateTaskSchema, templateSchema, templateVariableSchema, createTemplateTaskInputSchema;
 var init_openapi = __esm(() => {
   init_package_version();
   init_types();
@@ -54098,6 +54222,32 @@ var init_openapi = __esm(() => {
       created_at: { type: "string", format: "date-time" }
     }
   };
+  taskGitRefSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "id",
+      "task_id",
+      "ref_type",
+      "name",
+      "url",
+      "provider",
+      "metadata",
+      "created_at",
+      "updated_at"
+    ],
+    properties: {
+      id: { type: "string", minLength: 1 },
+      task_id: { type: "string", minLength: 1 },
+      ref_type: { type: "string", enum: ["branch", "pull_request"] },
+      name: { type: "string", minLength: 1 },
+      url: { type: "string", nullable: true },
+      provider: { type: "string", nullable: true },
+      metadata: { type: "object", additionalProperties: true },
+      created_at: { type: "string", format: "date-time" },
+      updated_at: { type: "string", format: "date-time" }
+    }
+  };
   planSchema = {
     type: "object",
     required: ["id", "slug", "name", "status", "created_at", "updated_at"],

package/dist/mcp.js

@@ -41,7 +41,7 @@ var __require = import.meta.require;
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.10",
+  version: "0.15.12",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/project-registration.js

@@ -12382,7 +12382,7 @@ import { createHash as createHash5 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.10",
+  version: "0.15.12",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -12525,6 +12525,7 @@ function normalizeAgentNameInput(name) {
 init_creator_identity();
 
 // src/lib/plan-project-link-contract.ts
+init_types();
 import { createHash as createHash2 } from "crypto";
 var PLAN_PROJECT_LINK_SCHEMA_VERSION = "todos.plan-project-link.v1";
 

package/dist/registry.js

@@ -12379,7 +12379,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.10",
+  version: "0.15.12",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/release-provenance.json

@@ -1,9 +1,9 @@
 {
   "packageName": "@hasna/todos",
-  "packageVersion": "0.15.10",
+  "packageVersion": "0.15.12",
   "repository": "https://github.com/hasna/todos.git",
-  "gitCommit": "dd84cfb6a3378e752b50bc39216cadb5580b940c",
-  "gitTree": "f16ba8feaa88db61a16ab2f1e9870907b956f0dc",
-  "sourceTreeSha256": "3640eb1e471e33dc0ab91cab9ec4e7529e5b70940a4aa09401b4069573b6055c",
-  "generatedAt": "2026-08-08T05:45:27.000Z"
+  "gitCommit": "dae785f5a49e6533a9405bef55feaaae3ee7ff6c",
+  "gitTree": "64227c25323ab56c0fecb8512f12b96ac0b3645e",
+  "sourceTreeSha256": "2284d1b1074d2fb2376c1b184d011e43337effe8fea1eb50241c0e07b272c380",
+  "generatedAt": "2026-08-08T11:31:06.000Z"
 }

package/dist/sdk/index.js

@@ -868,6 +868,13 @@ class TodosV1Client {
       init
     });
   }
+  async findTaskGitRefs(ref, init) {
+    return this.request("GET", `/v1/refs/${encodeURIComponent(String(ref))}`, {
+      body: undefined,
+      query: undefined,
+      init
+    });
+  }
   async getStats(init) {
     return this.request("GET", `/v1/stats`, {
       body: undefined,
@@ -966,6 +973,20 @@ class TodosV1Client {
       init
     });
   }
+  async listTaskGitRefs(id, init) {
+    return this.request("GET", `/v1/tasks/${encodeURIComponent(String(id))}/refs`, {
+      body: undefined,
+      query: undefined,
+      init
+    });
+  }
+  async linkTaskGitRef(id, body, init) {
+    return this.request("POST", `/v1/tasks/${encodeURIComponent(String(id))}/refs`, {
+      body,
+      query: undefined,
+      init
+    });
+  }
   async startTask(id, init) {
     return this.request("POST", `/v1/tasks/${encodeURIComponent(String(id))}/start`, {
       body: undefined,