@hasna/todos 0.15.20 → 0.15.25

package/dist/mcp.js

@@ -41,7 +41,7 @@ var __require = import.meta.require;
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.20",
+  version: "0.15.25",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -113,6 +113,8 @@ var package_default = {
     "dev:serve": "bun run src/server/index.ts",
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
+    "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -165,6 +167,7 @@ var package_default = {
     "@types/bun": "^1.2.4",
     "@types/react": "^18.3.18",
     "bun-types": "1.3.9",
+    "hasna-deployment-contracts": "npm:@hasna/contracts@0.10.4",
     typescript: "^5.7.3"
   }
 };

package/dist/project-registration.js

@@ -429,7 +429,7 @@ var init_creator_identity = __esm(() => {
 });
 
 // src/lib/config.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { dirname, join as join2 } from "path";
 function getConfigPath() {
   return join2(getTodosGlobalDir(), "config.json");
@@ -461,6 +461,22 @@ function saveConfig(config) {
 function updateConfig(patch) {
   return saveConfig({ ...loadConfig(), ...patch });
 }
+function getTodosAiConfig() {
+  const configPath = getConfigPath();
+  if (!existsSync2(configPath))
+    return {};
+  const parsed = JSON.parse(readFileSync2(configPath, "utf8"));
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Todos config must be a JSON object");
+  }
+  const ai = parsed["ai"];
+  if (ai === undefined)
+    return {};
+  if (ai === null || typeof ai !== "object" || Array.isArray(ai)) {
+    throw new Error("Todos AI configuration must be an object");
+  }
+  return { ...ai };
+}
 function normalizeApiUrl(value) {
   const trimmed = value?.trim();
   if (!trimmed)
@@ -635,7 +651,7 @@ var init_redaction = __esm(() => {
 });
 
 // src/lib/secret-redaction.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
+import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
 function registerCustomRedactor(fn) {
   customRedactors.push(fn);
 }
@@ -702,7 +718,7 @@ function scanAndRedactText(text, options = {}) {
 function scanFileForSecrets(path, options = {}) {
   if (!existsSync3(path))
     throw new Error(`File not found: ${path}`);
-  const content = readFileSync2(path, "utf8");
+  const content = readFileSync3(path, "utf8");
   return scanAndRedactText(content, options);
 }
 function safeStringify(value, space) {
@@ -885,7 +901,7 @@ function requireCanonicalLockVersion(value) {
     throw new StaleLockHandoffError("STALE_LOCK_HANDOFF_INVALID_INPUT", "expected_lock_version must be the exact canonical locked_at timestamp (YYYY-MM-DDTHH:mm:ss.sssZ)", { field: "expected_lock_version" });
   }
   const parsed = Date.parse(value);
-  if (Number.isNaN(parsed) || new Date(parsed).toISOString() !== value) {
+  if (value.startsWith("0000-") || Number.isNaN(parsed) || new Date(parsed).toISOString() !== value) {
     throw new StaleLockHandoffError("STALE_LOCK_HANDOFF_INVALID_INPUT", "expected_lock_version must name a real canonical UTC instant", { field: "expected_lock_version" });
   }
   return value;
@@ -910,9 +926,6 @@ function prepareStaleLockHandoff(input, options = {}) {
   if (canonicalAgentRef(actor) !== canonicalAgentRef(newHolder)) {
     throw new StaleLockHandoffError("STALE_LOCK_HANDOFF_ACTOR_MISMATCH", "new_holder must match the authenticated actor", { actor, new_holder: newHolder });
   }
-  if (canonicalAgentRef(expectedHolder) === canonicalAgentRef(newHolder)) {
-    throw new StaleLockHandoffError("STALE_LOCK_HANDOFF_INVALID_INPUT", "new_holder must differ from expected_holder", { field: "new_holder" });
-  }
   const operationTimestamp = options.now ?? new Date().toISOString();
   if (!CANONICAL_LOCK_VERSION_RE.test(operationTimestamp) || new Date(Date.parse(operationTimestamp)).toISOString() !== operationTimestamp) {
     throw new StaleLockHandoffError("STALE_LOCK_HANDOFF_INVALID_INPUT", "operation timestamp must be a canonical UTC instant");
@@ -6215,7 +6228,7 @@ var init_runner_sandbox = __esm(() => {
 });
 
 // src/lib/event-hooks.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
 import { dirname as dirname3, resolve as resolve6 } from "path";
 import { createConnection } from "net";
@@ -6282,7 +6295,7 @@ function buildEnvelope(type, payload, timestamp2 = new Date().toISOString()) {
     payload: redactValue(payload ?? {}),
     source: { package: "@hasna/todos", local_only: true }
   };
-  const digest = createHash3("sha256").update(canonicalEvent(base)).digest("hex");
+  const digest = createHash4("sha256").update(canonicalEvent(base)).digest("hex");
   return { ...base, integrity: { algorithm: "sha256", digest } };
 }
 function summarize(value) {
@@ -11210,8 +11223,8 @@ var init_boards = __esm(() => {
 });
 
 // src/lib/artifact-store.ts
-import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
 import { basename, dirname as dirname4, join as join5, resolve as resolve7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function isInMemoryDb2(path) {
@@ -11235,7 +11248,7 @@ function artifactStorePath(relativePath) {
   return join5(artifactStoreRoot(), normalized);
 }
 function sha256(buffer) {
-  return createHash4("sha256").update(buffer).digest("hex");
+  return createHash5("sha256").update(buffer).digest("hex");
 }
 function isTextLike(buffer, path) {
   if (buffer.includes(0))
@@ -11278,7 +11291,7 @@ function storeArtifactContent(input) {
   const sourceStat = statSync2(sourcePath);
   if (!sourceStat.isFile())
     throw new Error(`Artifact path is not a file: ${sanitizePreWriteText(input.path, "artifact.path")}`);
-  const sourceBuffer = readFileSync3(sourcePath);
+  const sourceBuffer = readFileSync4(sourcePath);
   const sourceSha = sha256(sourceBuffer);
   const textLike = isTextLike(sourceBuffer, input.path);
   let storedBuffer = sourceBuffer;
@@ -11365,7 +11378,7 @@ function verifyStoredArtifact(input) {
       message: "stored artifact content is missing"
     };
   }
-  const buffer = readFileSync3(storedPath);
+  const buffer = readFileSync4(storedPath);
   const actualSha = sha256(buffer);
   const actualSize = buffer.length;
   const ok = actualSha === store.sha256 && actualSize === store.size_bytes;
@@ -11385,7 +11398,7 @@ function exportStoredArtifactContent(input) {
   const report = verifyStoredArtifact(input);
   if (report.status !== "ok" || !report.relative_path || !report.actual_sha256 || report.actual_size_bytes === null)
     return null;
-  const content = readFileSync3(artifactStorePath(report.relative_path));
+  const content = readFileSync4(artifactStorePath(report.relative_path));
   return {
     artifact_id: input.id,
     sha256: report.actual_sha256,
@@ -11436,7 +11449,7 @@ function getArtifactStoreRoot(dbPath) {
   return join5(dirname4(resolve7(path)), "artifacts");
 }
 function computeContentHash(path) {
-  return sha256(readFileSync3(resolve7(path)));
+  return sha256(readFileSync4(resolve7(path)));
 }
 function storeArtifactFile(input) {
   const sourcePath = resolve7(input.sourcePath);
@@ -11446,7 +11459,7 @@ function storeArtifactFile(input) {
   if (!statSync2(sourcePath).isFile()) {
     throw new Error(`Source path is not a file: ${input.sourcePath}`);
   }
-  const buffer = readFileSync3(sourcePath);
+  const buffer = readFileSync4(sourcePath);
   const contentHash = sha256(buffer);
   const mimeType = mediaTypeFor(sourcePath, isTextLike(buffer, sourcePath));
   const storageMode = input.storageMode ?? "copy";
@@ -12644,11 +12657,11 @@ var init_tasks = __esm(() => {
 });
 
 // src/project-registration/authority.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.20",
+  version: "0.15.25",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -12720,6 +12733,8 @@ var package_default = {
     "dev:serve": "bun run src/server/index.ts",
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
+    "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -12772,6 +12787,7 @@ var package_default = {
     "@types/bun": "^1.2.4",
     "@types/react": "^18.3.18",
     "bun-types": "1.3.9",
+    "hasna-deployment-contracts": "npm:@hasna/contracts@0.10.4",
     typescript: "^5.7.3"
   }
 };
@@ -13523,6 +13539,30 @@ function forbiddenAuditHistoryTombstoneError(id) {
   return `${AUDIT_HISTORY_TOMBSTONE_FORBIDDEN}: audit_history tombstone ${id} is not allowed`;
 }
 
+// src/task-manifest/canonical.ts
+import { createHash as createHash3 } from "crypto";
+function canonicalize2(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize2);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([, entry2]) => entry2 !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry2]) => [key, canonicalize2(entry2)]));
+  }
+  return value;
+}
+function canonicalJson(value) {
+  return JSON.stringify(canonicalize2(value));
+}
+function canonicalDigest(value) {
+  return createHash3("sha256").update(canonicalJson(value)).digest("hex");
+}
+function deterministicUuid(namespace, ...parts) {
+  const bytes = createHash3("sha256").update([namespace, ...parts].join("\x1F")).digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
 // src/storage/postgres-adapter.ts
 function createPostgresTodosStorageAdapter(options) {
   const store = new PostgresJsonRecordStore(options);
@@ -13747,7 +13787,7 @@ class PostgresJsonRecordStore {
            AND task_record.deleted_at IS NULL
            AND target.payload->>'locked_by' = $3
            AND target.payload->>'locked_at' = $4
-           AND todos_try_timestamptz(target.payload->>'locked_at') < $5::timestamptz
+           AND $4::timestamptz < $5::timestamptz
            AND COALESCE(target.payload->>'status', '') NOT IN ('completed', 'failed', 'cancelled')
          RETURNING task_record.payload
        ),
@@ -15190,16 +15230,17 @@ async function findCommit(sha, store) {
 async function addGitRef(input, store, context) {
   if (!await store.get("tasks", input.task_id))
     throw new Error(`Task not found: ${input.task_id}`);
+  const existing = (await store.list("refs")).filter((ref) => ref.task_id === input.task_id && ref.ref_type === input.ref_type && ref.name === input.name).sort((left, right) => left.created_at.localeCompare(right.created_at) || left.id.localeCompare(right.id))[0];
   const timestamp = new Date().toISOString();
   const gitRef = {
-    id: randomUUID(),
+    id: existing?.id ?? deterministicUuid("todos:git-ref:v1", input.task_id, input.ref_type, input.name),
     task_id: input.task_id,
     ref_type: input.ref_type,
     name: input.name,
-    url: input.url ?? null,
-    provider: input.provider ?? null,
+    url: input.url ?? existing?.url ?? null,
+    provider: input.provider ?? existing?.provider ?? null,
     metadata: input.metadata ?? {},
-    created_at: timestamp,
+    created_at: existing?.created_at ?? timestamp,
     updated_at: timestamp
   };
   await store.upsert("refs", gitRef, context);
@@ -18477,23 +18518,23 @@ class WriteBoundaryError extends Error {
   }
 }
 function canonicalProjectRegistrationJson(value) {
-  return JSON.stringify(canonicalize2(value));
+  return JSON.stringify(canonicalize3(value));
 }
-function canonicalize2(value) {
+function canonicalize3(value) {
   if (Array.isArray(value))
-    return value.map(canonicalize2);
+    return value.map(canonicalize3);
   if (!value || typeof value !== "object")
     return value;
   const out = {};
   for (const key of Object.keys(value).sort()) {
     const entry2 = value[key];
     if (entry2 !== undefined)
-      out[key] = canonicalize2(entry2);
+      out[key] = canonicalize3(entry2);
   }
   return out;
 }
 function digestProjectRegistrationValue(value) {
-  return createHash5("sha256").update(canonicalProjectRegistrationJson(value)).digest("hex");
+  return createHash6("sha256").update(canonicalProjectRegistrationJson(value)).digest("hex");
 }
 function deriveTodosProjectRegistrationIdempotencyKey(input) {
   return `prk_${digestProjectRegistrationValue({