@hasna/todos 0.15.33 → 0.15.35

package/dist/mcp/index.js

@@ -2096,6 +2096,10 @@ var init_migrations = __esm(() => {
   );
   INSERT OR IGNORE INTO _migrations (id) VALUES (70);
   COMMIT;
+  `,
+    `BEGIN;
+  INSERT OR IGNORE INTO _migrations (id) VALUES (71);
+  COMMIT;
   `
   ];
 });
@@ -2769,6 +2773,8 @@ function ensureSchema(db) {
   ensureColumn("projects", "task_list_id", "TEXT");
   ensureColumn("projects", "task_prefix", "TEXT");
   ensureColumn("projects", "task_counter", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn("projects", "parent_id", "TEXT REFERENCES projects(id) ON DELETE SET NULL");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_projects_parent_id ON projects(parent_id)");
   ensureColumn("tasks", "plan_id", "TEXT REFERENCES plans(id) ON DELETE SET NULL");
   ensureColumn("tasks", "task_list_id", "TEXT REFERENCES task_lists(id) ON DELETE SET NULL");
   ensureColumn("tasks", "short_id", "TEXT");
@@ -4129,6 +4135,7 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -4190,25 +4197,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -4282,7 +4300,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -4290,7 +4308,6 @@ var init_config = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -4307,7 +4324,6 @@ var init_config = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -4323,14 +4339,12 @@ var init_config = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -9677,8 +9691,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -9690,7 +9704,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -9997,10 +10011,12 @@ __export(exports_projects, {
   renameProject: () => renameProject,
   removeProjectSource: () => removeProjectSource,
   removeMachineLocalPath: () => removeMachineLocalPath,
+  orderProjectsParentFirst: () => orderProjectsParentFirst,
   nextTaskShortId: () => nextTaskShortId,
   listProjects: () => listProjects,
   listProjectSources: () => listProjectSources,
   listMachineLocalPaths: () => listMachineLocalPaths,
+  listChildProjects: () => listChildProjects,
   getProjectWithSources: () => getProjectWithSources,
   getProjectByPath: () => getProjectByPath,
   getProject: () => getProject,
@@ -10008,6 +10024,7 @@ __export(exports_projects, {
   ensureProject: () => ensureProject,
   deleteProject: () => deleteProject,
   createProject: () => createProject,
+  assertNotProjectAncestor: () => assertNotProjectAncestor,
   addProjectSource: () => addProjectSource
 });
 function slugify(name) {
@@ -10039,17 +10056,24 @@ function createProject(input, db) {
     const id = uuid();
     const timestamp2 = now();
     const derivedSlug = slugify(input.name);
-    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugify(input.task_list_id);
+    const taskListId = input.task_list_id === undefined ? derivedSlug : slugify(input.task_list_id);
     if (!derivedSlug || !taskListId)
       throw new Error("Project name and task-list slug must be non-empty");
     const slugConflict = d.query("SELECT id FROM projects WHERE task_list_id = ? LIMIT 1").get(taskListId);
     if (slugConflict || !claimCanonicalSlug("project", "global", taskListId, id, d)) {
       throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${taskListId}" already exists`);
     }
+    const parentId = input.parent_id ?? null;
+    if (parentId !== null) {
+      const parent = getProject(parentId, d);
+      if (!parent)
+        throw new ProjectNotFoundError(parentId);
+      assertNotProjectAncestor(id, parentId, d);
+    }
     const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
     const machineId = currentStorageMachineId(d);
-    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
-       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp2, timestamp2, machineId]);
+    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, parent_id, created_at, updated_at, machine_id)
+       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, parentId, timestamp2, timestamp2, machineId]);
     return getProject(id, d);
   })();
 }
@@ -10074,6 +10098,64 @@ function listProjects(db) {
   const d = db || getDatabase();
   return d.query("SELECT * FROM projects ORDER BY name").all();
 }
+function listChildProjects(parentId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM projects WHERE parent_id = ? ORDER BY name").all(parentId);
+}
+function orderProjectsParentFirst(projects) {
+  const projectId = (project) => {
+    const id = project.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+  };
+  const parentId = (project) => {
+    const parent = project.parent_id;
+    return parent == null ? null : String(parent);
+  };
+  const byId = new Set;
+  for (const project of projects) {
+    const id = projectId(project);
+    if (id !== null)
+      byId.add(id);
+  }
+  const ordered = [];
+  const emitted = new Set;
+  let remaining = [...projects];
+  let progress = true;
+  while (progress && remaining.length > 0) {
+    progress = false;
+    const deferred = [];
+    for (const project of remaining) {
+      const parent = parentId(project);
+      if (parent === null || emitted.has(parent) || !byId.has(parent)) {
+        ordered.push(project);
+        const id = projectId(project);
+        if (id !== null)
+          emitted.add(id);
+        progress = true;
+      } else {
+        deferred.push(project);
+      }
+    }
+    remaining = deferred;
+  }
+  ordered.push(...remaining);
+  return ordered;
+}
+function assertNotProjectAncestor(projectId, ancestorId, db) {
+  const d = db || getDatabase();
+  let cursor = ancestorId;
+  const seen = new Set;
+  while (cursor !== null) {
+    if (cursor === projectId) {
+      throw new ResourceConflictError("PROJECT_PARENT_CYCLE", `Project "${projectId}" cannot be placed under its own descendant`);
+    }
+    if (seen.has(cursor))
+      break;
+    seen.add(cursor);
+    const row = d.query("SELECT parent_id FROM projects WHERE id = ?").get(cursor);
+    cursor = row?.parent_id ?? null;
+  }
+}
 function updateProject(id, input, db) {
   const d = db || getDatabase();
   const project = getProject(id, d);
@@ -10096,6 +10178,16 @@ function updateProject(id, input, db) {
     sets.push("path = ?");
     params.push(input.path);
   }
+  if (input.parent_id !== undefined) {
+    if (input.parent_id !== null) {
+      const parent = getProject(input.parent_id, d);
+      if (!parent)
+        throw new ProjectNotFoundError(input.parent_id);
+      assertNotProjectAncestor(id, input.parent_id, d);
+    }
+    sets.push("parent_id = ?");
+    params.push(input.parent_id);
+  }
   params.push(id);
   d.run(`UPDATE projects SET ${sets.join(", ")} WHERE id = ?`, params);
   return getProject(id, d);
@@ -21093,40 +21185,38 @@ var init_page_validation = __esm(() => {
 
 // src/cli/cloud-router.ts
 import { resolveStorageClient } from "@hasna/contracts/client/storage";
-import { normalizeStorageMode } from "@hasna/contracts/mode";
 import { randomUUID as randomUUID3 } from "crypto";
 import { resolve as resolvePath } from "path";
-function cleanMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  return normalized || null;
+function assertNoLegacyStorageMode(env = process.env) {
+  for (const key of LEGACY_STORAGE_MODE_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`REMOTE_STORAGE_MODE_REMOVED: ${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the on-box SQLite store, or the HTTP API selected by ` + `HASNA_TODOS_API_URL + HASNA_TODOS_API_KEY. ` + `On the server, set HASNA_TODOS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
 }
 function resolveTodosCliStorageMode(env = process.env) {
-  for (const source of ["HASNA_TODOS_STORAGE_MODE", "TODOS_STORAGE_MODE"]) {
-    if (env[source] !== undefined && env[source].trim() === "") {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source} must not be blank; local SQLite fallback is disabled for invalid routing state`);
-    }
+  assertNoLegacyStorageMode(env);
+  const urlValue = env.HASNA_TODOS_API_URL?.trim();
+  const keyValue = env.HASNA_TODOS_API_KEY?.trim();
+  if (urlValue && keyValue) {
+    return {
+      mode: "http",
+      transport: "http",
+      selected: true,
+      source: "HASNA_TODOS_API_URL+HASNA_TODOS_API_KEY"
+    };
   }
-  const canonical = cleanMode(env.HASNA_TODOS_STORAGE_MODE);
-  const fallback = cleanMode(env.TODOS_STORAGE_MODE);
-  for (const [source, value] of [
-    ["HASNA_TODOS_STORAGE_MODE", canonical],
-    ["TODOS_STORAGE_MODE", fallback]
-  ]) {
-    if (value && !(value in TRANSPORT_TOKENS)) {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source}=${value} must be sqlite (local file) or http (hosted /v1 authority); ` + "legacy values local and remote are accepted; " + "local SQLite fallback is disabled for invalid routing state");
-    }
+  if (urlValue) {
+    throw new Error("REMOTE_API_KEY_MISSING: remote Todos storage requires HASNA_TODOS_API_KEY; local SQLite fallback is disabled");
   }
-  const canonicalTransport = canonical ? TRANSPORT_TOKENS[canonical] : null;
-  const fallbackTransport = fallback ? TRANSPORT_TOKENS[fallback] : null;
-  if (canonicalTransport && fallbackTransport && canonicalTransport !== fallbackTransport) {
-    throw new Error(`REMOTE_STORAGE_MODE_CONFLICT: HASNA_TODOS_STORAGE_MODE=${canonical} conflicts with ` + `TODOS_STORAGE_MODE=${fallback}; local SQLite fallback is disabled`);
+  if (keyValue) {
+    throw new Error("REMOTE_API_URL_MISSING: remote Todos storage requires HASNA_TODOS_API_URL; local SQLite fallback is disabled");
   }
-  const transport = canonicalTransport ?? fallbackTransport ?? "sqlite";
   return {
-    mode: transport,
-    transport,
-    selected: transport === "http",
-    source: canonical ? "HASNA_TODOS_STORAGE_MODE" : fallback ? "TODOS_STORAGE_MODE" : "default"
+    mode: "sqlite",
+    transport: "sqlite",
+    selected: false,
+    source: "default"
   };
 }
 function requestedTransport(env) {
@@ -21170,7 +21260,7 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     return {
       selected: true,
       ok: false,
-      mode: cleanMode(env.HASNA_TODOS_STORAGE_MODE) ?? cleanMode(env.TODOS_STORAGE_MODE) ?? "invalid",
+      mode: "invalid",
       api_url_configured: Boolean(env.HASNA_TODOS_API_URL?.trim()),
       api_key_configured: Boolean(env.HASNA_TODOS_API_KEY?.trim()),
       v1_base_url: null,
@@ -21216,27 +21306,12 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     local_fallback: false
   };
 }
-function serverStorageMode(normalize = normalizeStorageMode) {
-  const useCache = normalize === normalizeStorageMode;
-  if (useCache && cachedServerMode !== null)
-    return cachedServerMode;
-  for (const candidate of SERVER_MODE_CANDIDATES) {
-    try {
-      normalize(candidate);
-      if (useCache)
-        cachedServerMode = candidate;
-      return candidate;
-    } catch {}
-  }
-  throw new Error(`REMOTE_STORAGE_MODE_UNSUPPORTED: no known server storage mode is accepted by the installed ` + `@hasna/contracts (tried ${SERVER_MODE_CANDIDATES.join(", ")}); the storage-mode enum has changed. ` + `Add the new server token to SERVER_MODE_CANDIDATES in src/cli/cloud-router.ts; ` + `local SQLite fallback is disabled.`);
-}
 function requireTodosRemoteAuthorityEnv(env) {
   const status = getTodosRemoteAuthorityConfigStatus(env);
   if (!status.ok)
     throw new Error(status.issues[0]);
   return {
     ...env,
-    HASNA_TODOS_STORAGE_MODE: serverStorageMode(),
     HASNA_TODOS_API_URL: status.v1_base_url.replace(/\/v1$/, ""),
     HASNA_TODOS_API_KEY: env.HASNA_TODOS_API_KEY.trim()
   };
@@ -21274,7 +21349,31 @@ function classifyRemoteRequestError(baseUrl, route, error) {
   }
   throw error;
 }
-function protectRemoteClient(client) {
+function withBoundedRemoteRequest(options, requestTimeoutMs, run) {
+  const controller = new AbortController;
+  const onBaseAbort = () => controller.abort();
+  if (options?.signal) {
+    if (options.signal.aborted)
+      controller.abort();
+    else
+      options.signal.addEventListener("abort", onBaseAbort, { once: true });
+  }
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new DOMException(`Todos remote request exceeded the ${requestTimeoutMs}ms bounded request timeout`, "AbortError"));
+    }, requestTimeoutMs);
+  });
+  const attempt = run({ ...options, signal: controller.signal });
+  attempt.catch(() => {});
+  return Promise.race([attempt, deadline]).finally(() => {
+    if (timer)
+      clearTimeout(timer);
+    options?.signal?.removeEventListener("abort", onBaseAbort);
+  });
+}
+function protectRemoteClient(client, requestTimeoutMs) {
   const baseUrl = remoteAuthorityBase(client);
   const protect = async (route, request) => {
     try {
@@ -21283,25 +21382,26 @@ function protectRemoteClient(client) {
       return classifyRemoteRequestError(baseUrl, route, error);
     }
   };
+  const bounded = (options, run) => withBoundedRemoteRequest(options, requestTimeoutMs, run);
   const transport = client.transport;
   const protectedTransport = {
     baseUrl: transport.baseUrl,
-    request: (method, path, body, options) => protect(path, () => transport.request(method, path, body, options)),
-    get: (path, options) => protect(path, () => transport.get(path, options)),
-    post: (path, body, options) => protect(path, () => transport.post(path, body, options)),
-    put: (path, body, options) => protect(path, () => transport.put(path, body, options)),
-    patch: (path, body, options) => protect(path, () => transport.patch(path, body, options)),
-    del: (path, body, options) => protect(path, () => transport.del(path, body, options))
+    request: (method, path, body, options) => protect(path, () => bounded(options, (opts) => transport.request(method, path, body, opts))),
+    get: (path, options) => protect(path, () => bounded(options, (opts) => transport.get(path, opts))),
+    post: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.post(path, body, opts))),
+    put: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.put(path, body, opts))),
+    patch: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.patch(path, body, opts))),
+    del: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.del(path, body, opts)))
   };
   return {
     name: client.name,
     baseUrl: client.baseUrl,
     transport: protectedTransport,
-    list: (resource, options) => protect(`/${resource}`, () => client.list(resource, options)),
-    get: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.get(resource, id, options)),
-    create: (resource, body, options) => protect(`/${resource}`, () => client.create(resource, body, options)),
-    update: (resource, id, patch, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.update(resource, id, patch, options)),
-    delete: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.delete(resource, id, options))
+    list: (resource, options) => protect(`/${resource}`, () => bounded(options, (opts) => client.list(resource, opts))),
+    get: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.get(resource, id, opts))),
+    create: (resource, body, options) => protect(`/${resource}`, () => bounded(options, (opts) => client.create(resource, body, opts))),
+    update: (resource, id, patch, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.update(resource, id, patch, opts))),
+    delete: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.delete(resource, id, opts)))
   };
 }
 function remoteAuthorityBase(client) {
@@ -21322,13 +21422,19 @@ async function requiredRemoteRoute(client, route, request, recognized404Codes =
     throw error;
   }
 }
-function getTodosCloudClient(env = process.env) {
+function getTodosCloudClient(env = process.env, requestTimeoutMs = REMOTE_REQUEST_TIMEOUT_MS) {
   if (requestedTransport(env) !== "http")
     return null;
   const resolved = resolveStorageClient("todos", requireTodosRemoteAuthorityEnv(env), {
-    fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" })
+    fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" }),
+    timeoutMs: requestTimeoutMs
   });
-  return resolved.transport === "cloud-http" ? protectRemoteClient(resolved.client) : null;
+  if (resolved.transport === "cloud-http")
+    return protectRemoteClient(resolved.client, requestTimeoutMs);
+  const transportName = resolved.transport;
+  if (transportName === "http")
+    return protectRemoteClient(resolved.client, requestTimeoutMs);
+  return null;
 }
 function unwrapTask(raw) {
   if (raw && typeof raw === "object" && "task" in raw) {
@@ -21799,7 +21905,7 @@ async function cloudResolveTaskListRef(client, ref, projectId) {
     return input.toLowerCase();
   return (await cloudResolveTaskList(client, ref, projectId)).id;
 }
-var UUID_RE, TRANSPORT_TOKENS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, SERVER_MODE_CANDIDATES, cachedServerMode = null, PRIORITY_RANK, listTagsCapabilityCache;
+var UUID_RE, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, LEGACY_STORAGE_MODE_KEYS, REMOTE_REQUEST_TIMEOUT_MS = 1e4, PRIORITY_RANK, listTagsCapabilityCache;
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
@@ -21808,21 +21914,17 @@ var init_cloud_router = __esm(() => {
   init_adoption_validation();
   init_page_validation();
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  TRANSPORT_TOKENS = {
-    sqlite: "sqlite",
-    http: "http",
-    local: "sqlite",
-    remote: "http",
-    self_hosted: "http",
-    cloud: "http",
-    hybrid: "http"
-  };
   completionCapabilityCache = new Map;
   retryCapabilityCache = new Map;
   taskCreatorCapabilityCache = new Map;
   gitRefCapabilityCache = new Map;
   remoteCommandCapabilityCache = new Map;
-  SERVER_MODE_CANDIDATES = ["postgres", "cloud", "self_hosted"];
+  LEGACY_STORAGE_MODE_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
   PRIORITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
   listTagsCapabilityCache = new Map;
 });
@@ -22330,7 +22432,7 @@ function addSourceOnce(projectId, type, name, uri, metadata, db) {
 function bootstrapProject(options = {}, db) {
   const d = db || getDatabase();
   const discovery = discoverProjectWorkspace(options.path);
-  const taskListSlug = options.taskListSlug || `todos-${slugify(options.name || discovery.projectName)}`;
+  const taskListSlug = options.taskListSlug || slugify(options.name || discovery.projectName);
   if (options.dryRun) {
     return {
       dryRun: true,
@@ -28457,6 +28559,7 @@ function registerTaskProjectTools(server, ctx) {
       name: exports_external.string().describe("Project name"),
       path: exports_external.string().describe("Unique filesystem path for the project"),
       description: exports_external.string().optional(),
+      parent_id: exports_external.string().optional().describe("Optional parent project id to create this as a sub-project"),
       status: exports_external.enum(["active", "completed", "on_hold", "archived"]).optional(),
       short_id: exports_external.string().nullable().optional().describe("Short ID (auto-generated if omitted)"),
       metadata: exports_external.record(exports_external.unknown()).optional()
@@ -35939,7 +36042,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.33",
+    version: "0.15.35",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -36013,9 +36116,10 @@ var init_package = __esm(() => {
       "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
       "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
       "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
+      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
       "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
       "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+      "test:attested-container-compatibility-vector": "bun test scripts/attested-container-compatibility-vector.test.ts",
       "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
       prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
       postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -37055,6 +37159,7 @@ function createAgentProjectDemoBundle() {
     task_list_id: ids.list,
     task_prefix: "DEMO",
     task_counter: 4,
+    parent_id: null,
     created_at: createdAt,
     updated_at: completedAt
   });
@@ -45621,7 +45726,7 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
       }
     }
   };
-  applyRows("projects", "projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
+  applyRows("projects", "projects", PROJECT_COLUMNS, orderProjectsParentFirst(snapshot.projects), "updated_at");
   applyRows("project_machine_paths", "project_machine_paths", PROJECT_MACHINE_PATH_COLUMNS, snapshot.projectMachinePaths ?? [], "updated_at");
   applyRows("agents", "agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
   applyRows("task_lists", "task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
@@ -45852,6 +45957,7 @@ var init_sqlite_snapshot = __esm(() => {
     "task_list_id",
     "task_prefix",
     "task_counter",
+    "parent_id",
     "created_at",
     "updated_at",
     "machine_id",
@@ -47669,8 +47775,12 @@ class PostgresJsonRecordStore {
              OR ($11::text <> $2
                AND NOT EXISTS (SELECT 1 FROM parent_chain WHERE object_id = $2)
                AND NOT EXISTS (SELECT 1 FROM parent_chain WHERE cycle))) AS parent_acyclic,
-           (SELECT count(*) FROM locked_plans) = jsonb_array_length($7::jsonb) AS all_plans_found,
-           ($8::text IS NULL OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
+           (COALESCE((SELECT payload->>'plan_id' FROM locked_task), '')
+              IS DISTINCT FROM COALESCE($3::jsonb->>'plan_id', '')) AS membership_changed,
+           (NOT (COALESCE((SELECT payload->>'plan_id' FROM locked_task), '')
+                   IS DISTINCT FROM COALESCE($3::jsonb->>'plan_id', ''))
+             OR $8::text IS NULL
+             OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
            (SELECT payload->>'project_id' FROM locked_plans WHERE object_id = $8) AS target_project_id
        ), guarded AS (
          SELECT
@@ -47693,7 +47803,6 @@ class PostgresJsonRecordStore {
            AND guarded.version_matches
            AND guarded.parent_found
            AND guarded.parent_acyclic
-           AND guarded.all_plans_found
            AND guarded.target_plan_found
            AND NOT guarded.project_conflict
          ON CONFLICT (service, object_type, object_id) DO UPDATE SET
@@ -47709,7 +47818,7 @@ class PostgresJsonRecordStore {
          RETURNING payload
        )
        SELECT guarded.task_found, guarded.version_matches, guarded.parent_found, guarded.parent_acyclic,
-              guarded.all_plans_found, guarded.target_plan_found, guarded.project_conflict,
+              guarded.membership_changed, guarded.target_plan_found, guarded.project_conflict,
               (SELECT payload FROM stored) AS payload,
               (SELECT payload FROM locked_task) AS current_payload
        FROM guarded`, [
@@ -47741,7 +47850,7 @@ class PostgresJsonRecordStore {
     if (parentGuard && !row?.parent_acyclic && parentGuard.parentId) {
       throw new ResourceConflictError("TASK_PARENT_CYCLE", `TASK_PARENT_CYCLE: assigning parent ${parentGuard.parentId} to task ${value.id} would create or retain a parent cycle`);
     }
-    if (!row?.all_plans_found || !row.target_plan_found) {
+    if (!row?.target_plan_found) {
       throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan membership changed through a missing plan: ${targetPlanId ?? planIds.join(", ")}`, { plan_ids: planIds, target_plan_id: targetPlanId });
     }
     if (row.project_conflict) {
@@ -48950,17 +49059,26 @@ async function getChangedSince(since, filters, store) {
 async function createProject2(input, store, context) {
   const timestamp4 = new Date().toISOString();
   const derivedSlug = slugifyRaw(input.name);
-  const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugifyRaw(input.task_list_id);
+  const taskListId = input.task_list_id === undefined ? derivedSlug : slugifyRaw(input.task_list_id);
   if (!derivedSlug || !taskListId)
     throw new Error("Project name and task-list slug must be non-empty");
+  const parentId = input.parent_id ?? null;
+  const id = randomUUID4();
+  if (parentId !== null) {
+    const parent = await store.get("projects", parentId);
+    if (!parent)
+      throw new ProjectNotFoundError(parentId);
+    await assertNotProjectAncestorPostgres(id, parentId, store);
+  }
   const project = {
-    id: randomUUID4(),
+    id,
     name: input.name,
     path: input.path,
     description: input.description ?? null,
     task_list_id: taskListId,
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
     task_counter: 0,
+    parent_id: parentId,
     created_at: timestamp4,
     updated_at: timestamp4,
     machine_id: store.machineId(context),
@@ -48968,12 +49086,38 @@ async function createProject2(input, store, context) {
   };
   return store.upsert("projects", project, context);
 }
+async function assertNotProjectAncestorPostgres(projectId, candidateParentId, store) {
+  const all = await store.list("projects");
+  const byId = new Map(all.map((project) => [project.id, project.parent_id ?? null]));
+  let cursor = candidateParentId;
+  const seen = new Set;
+  while (cursor !== null) {
+    if (cursor === projectId) {
+      throw new ResourceConflictError("PROJECT_PARENT_CYCLE", `Project "${projectId}" cannot be placed under its own descendant`);
+    }
+    if (seen.has(cursor))
+      break;
+    seen.add(cursor);
+    cursor = byId.get(cursor) ?? null;
+  }
+}
 async function updateProject2(id, input, store) {
   if ("task_list_id" in input) {
     throw new Error("task_list_id cannot be changed by updateProject; use renameProject for an atomic canonical rename");
   }
   const project = await requireRecord("projects", id, store);
-  const updated = { ...project, ...definedPatch(input), updated_at: new Date().toISOString() };
+  if (input.parent_id !== undefined && input.parent_id !== null) {
+    const parent = await store.get("projects", input.parent_id);
+    if (!parent)
+      throw new ProjectNotFoundError(input.parent_id);
+    await assertNotProjectAncestorPostgres(id, input.parent_id, store);
+  }
+  const updated = {
+    ...project,
+    ...definedPatch(input),
+    ...input.parent_id !== undefined ? { parent_id: input.parent_id } : {},
+    updated_at: new Date().toISOString()
+  };
   return store.upsert("projects", updated);
 }
 async function createPlan2(input, store, context) {
@@ -50844,7 +50988,7 @@ class StagedSqliteTodosProjectRegistrationTransaction {
   }
   async createProject(input) {
     const derivedSlug = normalizeSlug(input.name);
-    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : normalizeSlug(input.task_list_id);
+    const taskListId = input.task_list_id === undefined ? derivedSlug : normalizeSlug(input.task_list_id);
     if (!derivedSlug || !taskListId) {
       throw new Error("Project name and task-list slug must be non-empty");
     }
@@ -50856,6 +51000,7 @@ class StagedSqliteTodosProjectRegistrationTransaction {
       task_list_id: taskListId,
       task_prefix: input.task_prefix ?? this.availableProjectPrefix(input.name),
       task_counter: 0,
+      parent_id: input.parent_id ?? null,
       created_at: now(),
       updated_at: now(),
       machine_id: currentStorageMachineId(this.db)
@@ -50866,14 +51011,15 @@ class StagedSqliteTodosProjectRegistrationTransaction {
       try {
         const result = this.db.run(`INSERT INTO projects (
              id, name, path, description, task_list_id, task_prefix,
-             task_counter, created_at, updated_at, machine_id
-           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [
+             task_counter, parent_id, created_at, updated_at, machine_id
+           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`, [
           project.id,
           project.name,
           project.path,
           project.description,
           project.task_list_id,
           project.task_prefix,
+          project.parent_id,
           project.created_at,
           project.updated_at,
           project.machine_id ?? null
@@ -51157,7 +51303,10 @@ function taskListSlug(projectSlug) {
   if (!slug || slug !== projectSlug) {
     throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "project_slug must be canonical kebab-case");
   }
-  return `todos-${slug}`;
+  return slug;
+}
+function legacyTaskListSlug(projectSlug) {
+  return `todos-${normalizeSlug(projectSlug)}`;
 }
 function deterministicTaskPrefix(projectSlug) {
   const letters = projectSlug.replace(/[^a-z0-9]/gi, "").toUpperCase();
@@ -51676,6 +51825,12 @@ class PackageOwnedTodosProjectRegistrationAuthority {
             created_by_operation: false
           };
         }
+        if (request.bind_existing === true && conflict2.path === path && conflict2.task_list_id === legacyTaskListSlug(request.project_slug)) {
+          return {
+            record: boundExistingProjectRecord(conflict2),
+            created_by_operation: false
+          };
+        }
         return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict2.id });
       }
       await this.fault("before_object_write", request);
@@ -51712,6 +51867,15 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       }
       return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict.id });
     }
+    if (request.bind_existing === true) {
+      const legacy = await transaction.findTaskListConflict(todosProjectId, legacyTaskListSlug(request.project_slug));
+      if (legacy && legacy.project_id === todosProjectId) {
+        return {
+          record: boundExistingTaskListRecord(legacy),
+          created_by_operation: false
+        };
+      }
+    }
     await this.fault("before_object_write", request);
     const taskList = await transaction.createTaskList({
       name: request.project_name,
@@ -55641,7 +55805,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             path: { type: "string", minLength: 1 },
             description: { type: "string" },
             task_list_id: { type: "string", minLength: 1, pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
-            task_prefix: { type: "string", minLength: 1 }
+            task_prefix: { type: "string", minLength: 1 },
+            parent_id: { type: "string", minLength: 1 }
           }
         },
         UpdateProjectInput: {
@@ -55651,7 +55816,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           properties: {
             name: { type: "string", minLength: 1 },
             path: { type: "string", minLength: 1 },
-            description: { type: "string", nullable: true }
+            description: { type: "string", nullable: true },
+            parent_id: { type: "string", minLength: 1, nullable: true }
           }
         },
         RenameProjectInput: {
@@ -57950,6 +58116,7 @@ var init_openapi = __esm(() => {
       task_list_id: { type: "string", nullable: true },
       task_prefix: { type: "string", nullable: true },
       task_counter: { type: "number" },
+      parent_id: { type: "string", nullable: true },
       created_at: { type: "string" },
       updated_at: { type: "string" }
     }
@@ -59367,7 +59534,7 @@ function validateProjectPatch(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "project patch must be an object" };
   const body2 = value;
-  const allowed = new Set(["name", "path", "description"]);
+  const allowed = new Set(["name", "path", "description", "parent_id"]);
   const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown project field: ${unknown}` };
@@ -59379,13 +59546,15 @@ function validateProjectPatch(value) {
     return { ok: false, message: "path must be a non-empty string" };
   if (body2["description"] !== undefined && body2["description"] !== null && typeof body2["description"] !== "string")
     return { ok: false, message: "description must be a string or null" };
+  if (body2["parent_id"] !== undefined && body2["parent_id"] !== null && (typeof body2["parent_id"] !== "string" || !body2["parent_id"].trim()))
+    return { ok: false, message: "parent_id must be a string or null" };
   return { ok: true, patch: body2 };
 }
 function validateProjectCreate(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "project body must be an object" };
   const body2 = value;
-  const allowed = new Set(["name", "path", "description", "task_list_id", "task_prefix"]);
+  const allowed = new Set(["name", "path", "description", "task_list_id", "task_prefix", "parent_id"]);
   const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown project field: ${unknown}` };
@@ -59403,6 +59572,9 @@ function validateProjectCreate(value) {
   if (body2["task_prefix"] !== undefined && (typeof body2["task_prefix"] !== "string" || !body2["task_prefix"].trim())) {
     return { ok: false, message: "task_prefix must be a non-empty string" };
   }
+  if (body2["parent_id"] !== undefined && (typeof body2["parent_id"] !== "string" || !body2["parent_id"].trim())) {
+    return { ok: false, message: "parent_id must be a non-empty string" };
+  }
   return { ok: true, input: body2 };
 }
 function validatePlanCreate(value) {