@hasna/todos 0.15.34 → 0.15.35

package/dist/cli/index.js

@@ -2123,7 +2123,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.34",
+    version: "0.15.35",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -2198,6 +2198,9 @@ var init_package = __esm(() => {
       "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
       "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
       "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
+      "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
+      "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+      "test:attested-container-compatibility-vector": "bun test scripts/attested-container-compatibility-vector.test.ts",
       "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
       prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
       postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -5819,7 +5822,31 @@ function classifyRemoteRequestError(baseUrl, route, error) {
   }
   throw error;
 }
-function protectRemoteClient(client) {
+function withBoundedRemoteRequest(options, requestTimeoutMs, run) {
+  const controller = new AbortController;
+  const onBaseAbort = () => controller.abort();
+  if (options?.signal) {
+    if (options.signal.aborted)
+      controller.abort();
+    else
+      options.signal.addEventListener("abort", onBaseAbort, { once: true });
+  }
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new DOMException(`Todos remote request exceeded the ${requestTimeoutMs}ms bounded request timeout`, "AbortError"));
+    }, requestTimeoutMs);
+  });
+  const attempt = run({ ...options, signal: controller.signal });
+  attempt.catch(() => {});
+  return Promise.race([attempt, deadline]).finally(() => {
+    if (timer)
+      clearTimeout(timer);
+    options?.signal?.removeEventListener("abort", onBaseAbort);
+  });
+}
+function protectRemoteClient(client, requestTimeoutMs) {
   const baseUrl = remoteAuthorityBase(client);
   const protect = async (route, request) => {
     try {
@@ -5828,25 +5855,26 @@ function protectRemoteClient(client) {
       return classifyRemoteRequestError(baseUrl, route, error);
     }
   };
+  const bounded = (options, run) => withBoundedRemoteRequest(options, requestTimeoutMs, run);
   const transport = client.transport;
   const protectedTransport = {
     baseUrl: transport.baseUrl,
-    request: (method, path, body, options) => protect(path, () => transport.request(method, path, body, options)),
-    get: (path, options) => protect(path, () => transport.get(path, options)),
-    post: (path, body, options) => protect(path, () => transport.post(path, body, options)),
-    put: (path, body, options) => protect(path, () => transport.put(path, body, options)),
-    patch: (path, body, options) => protect(path, () => transport.patch(path, body, options)),
-    del: (path, body, options) => protect(path, () => transport.del(path, body, options))
+    request: (method, path, body, options) => protect(path, () => bounded(options, (opts) => transport.request(method, path, body, opts))),
+    get: (path, options) => protect(path, () => bounded(options, (opts) => transport.get(path, opts))),
+    post: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.post(path, body, opts))),
+    put: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.put(path, body, opts))),
+    patch: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.patch(path, body, opts))),
+    del: (path, body, options) => protect(path, () => bounded(options, (opts) => transport.del(path, body, opts)))
   };
   return {
     name: client.name,
     baseUrl: client.baseUrl,
     transport: protectedTransport,
-    list: (resource, options) => protect(`/${resource}`, () => client.list(resource, options)),
-    get: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.get(resource, id, options)),
-    create: (resource, body, options) => protect(`/${resource}`, () => client.create(resource, body, options)),
-    update: (resource, id, patch, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.update(resource, id, patch, options)),
-    delete: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => client.delete(resource, id, options))
+    list: (resource, options) => protect(`/${resource}`, () => bounded(options, (opts) => client.list(resource, opts))),
+    get: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.get(resource, id, opts))),
+    create: (resource, body, options) => protect(`/${resource}`, () => bounded(options, (opts) => client.create(resource, body, opts))),
+    update: (resource, id, patch, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.update(resource, id, patch, opts))),
+    delete: (resource, id, options) => protect(`/${resource}/${encodeURIComponent(id)}`, () => bounded(options, (opts) => client.delete(resource, id, opts)))
   };
 }
 function remoteAuthorityBase(client) {
@@ -5867,17 +5895,18 @@ async function requiredRemoteRoute(client, route, request, recognized404Codes =
     throw error;
   }
 }
-function getTodosCloudClient(env = process.env) {
+function getTodosCloudClient(env = process.env, requestTimeoutMs = REMOTE_REQUEST_TIMEOUT_MS) {
   if (requestedTransport(env) !== "http")
     return null;
   const resolved = resolveStorageClient("todos", requireTodosRemoteAuthorityEnv(env), {
-    fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" })
+    fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" }),
+    timeoutMs: requestTimeoutMs
   });
   if (resolved.transport === "cloud-http")
-    return protectRemoteClient(resolved.client);
+    return protectRemoteClient(resolved.client, requestTimeoutMs);
   const transportName = resolved.transport;
   if (transportName === "http")
-    return protectRemoteClient(resolved.client);
+    return protectRemoteClient(resolved.client, requestTimeoutMs);
   return null;
 }
 function isCloudRouting(env = process.env) {
@@ -7535,7 +7564,7 @@ async function cloudTimeline(client, options = {}) {
   const limit = options.limit ?? 50;
   return { entries: entries.slice(offset, offset + limit), total, limit, offset };
 }
-var UUID_RE, COMPLETION_EVIDENCE_FIELDS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, LEGACY_STORAGE_MODE_KEYS, PRIORITY_RANK, listTagsCapabilityCache, PLAN_COMPLETION_PROTECTED_FIELDS, RELATION_HYDRATION_CONCURRENCY = 6;
+var UUID_RE, COMPLETION_EVIDENCE_FIELDS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, LEGACY_STORAGE_MODE_KEYS, REMOTE_REQUEST_TIMEOUT_MS = 1e4, PRIORITY_RANK, listTagsCapabilityCache, PLAN_COMPLETION_PROTECTED_FIELDS, RELATION_HYDRATION_CONCURRENCY = 6;
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
@@ -10035,6 +10064,10 @@ var init_migrations = __esm(() => {
   );
   INSERT OR IGNORE INTO _migrations (id) VALUES (70);
   COMMIT;
+  `,
+    `BEGIN;
+  INSERT OR IGNORE INTO _migrations (id) VALUES (71);
+  COMMIT;
   `
   ];
 });
@@ -10708,6 +10741,8 @@ function ensureSchema(db) {
   ensureColumn("projects", "task_list_id", "TEXT");
   ensureColumn("projects", "task_prefix", "TEXT");
   ensureColumn("projects", "task_counter", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn("projects", "parent_id", "TEXT REFERENCES projects(id) ON DELETE SET NULL");
+  ensureIndex("CREATE INDEX IF NOT EXISTS idx_projects_parent_id ON projects(parent_id)");
   ensureColumn("tasks", "plan_id", "TEXT REFERENCES plans(id) ON DELETE SET NULL");
   ensureColumn("tasks", "task_list_id", "TEXT REFERENCES task_lists(id) ON DELETE SET NULL");
   ensureColumn("tasks", "short_id", "TEXT");
@@ -12779,10 +12814,12 @@ __export(exports_projects, {
   renameProject: () => renameProject,
   removeProjectSource: () => removeProjectSource,
   removeMachineLocalPath: () => removeMachineLocalPath,
+  orderProjectsParentFirst: () => orderProjectsParentFirst,
   nextTaskShortId: () => nextTaskShortId,
   listProjects: () => listProjects,
   listProjectSources: () => listProjectSources,
   listMachineLocalPaths: () => listMachineLocalPaths,
+  listChildProjects: () => listChildProjects,
   getProjectWithSources: () => getProjectWithSources,
   getProjectByPath: () => getProjectByPath,
   getProject: () => getProject,
@@ -12790,6 +12827,7 @@ __export(exports_projects, {
   ensureProject: () => ensureProject,
   deleteProject: () => deleteProject,
   createProject: () => createProject,
+  assertNotProjectAncestor: () => assertNotProjectAncestor,
   addProjectSource: () => addProjectSource
 });
 function slugify(name) {
@@ -12821,17 +12859,24 @@ function createProject(input, db) {
     const id = uuid();
     const timestamp2 = now();
     const derivedSlug = slugify(input.name);
-    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugify(input.task_list_id);
+    const taskListId = input.task_list_id === undefined ? derivedSlug : slugify(input.task_list_id);
     if (!derivedSlug || !taskListId)
       throw new Error("Project name and task-list slug must be non-empty");
     const slugConflict = d.query("SELECT id FROM projects WHERE task_list_id = ? LIMIT 1").get(taskListId);
     if (slugConflict || !claimCanonicalSlug("project", "global", taskListId, id, d)) {
       throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${taskListId}" already exists`);
     }
+    const parentId = input.parent_id ?? null;
+    if (parentId !== null) {
+      const parent = getProject(parentId, d);
+      if (!parent)
+        throw new ProjectNotFoundError(parentId);
+      assertNotProjectAncestor(id, parentId, d);
+    }
     const taskPrefix = input.task_prefix || generatePrefix(input.name, d);
     const machineId = currentStorageMachineId(d);
-    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, created_at, updated_at, machine_id)
-       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, timestamp2, timestamp2, machineId]);
+    d.run(`INSERT INTO projects (id, name, path, description, task_list_id, task_prefix, task_counter, parent_id, created_at, updated_at, machine_id)
+       VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`, [id, input.name, input.path, input.description || null, taskListId, taskPrefix, parentId, timestamp2, timestamp2, machineId]);
     return getProject(id, d);
   })();
 }
@@ -12856,6 +12901,64 @@ function listProjects(db) {
   const d = db || getDatabase();
   return d.query("SELECT * FROM projects ORDER BY name").all();
 }
+function listChildProjects(parentId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM projects WHERE parent_id = ? ORDER BY name").all(parentId);
+}
+function orderProjectsParentFirst(projects) {
+  const projectId = (project) => {
+    const id = project.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+  };
+  const parentId = (project) => {
+    const parent = project.parent_id;
+    return parent == null ? null : String(parent);
+  };
+  const byId = new Set;
+  for (const project of projects) {
+    const id = projectId(project);
+    if (id !== null)
+      byId.add(id);
+  }
+  const ordered = [];
+  const emitted = new Set;
+  let remaining = [...projects];
+  let progress = true;
+  while (progress && remaining.length > 0) {
+    progress = false;
+    const deferred = [];
+    for (const project of remaining) {
+      const parent = parentId(project);
+      if (parent === null || emitted.has(parent) || !byId.has(parent)) {
+        ordered.push(project);
+        const id = projectId(project);
+        if (id !== null)
+          emitted.add(id);
+        progress = true;
+      } else {
+        deferred.push(project);
+      }
+    }
+    remaining = deferred;
+  }
+  ordered.push(...remaining);
+  return ordered;
+}
+function assertNotProjectAncestor(projectId, ancestorId, db) {
+  const d = db || getDatabase();
+  let cursor = ancestorId;
+  const seen = new Set;
+  while (cursor !== null) {
+    if (cursor === projectId) {
+      throw new ResourceConflictError("PROJECT_PARENT_CYCLE", `Project "${projectId}" cannot be placed under its own descendant`);
+    }
+    if (seen.has(cursor))
+      break;
+    seen.add(cursor);
+    const row = d.query("SELECT parent_id FROM projects WHERE id = ?").get(cursor);
+    cursor = row?.parent_id ?? null;
+  }
+}
 function updateProject(id, input, db) {
   const d = db || getDatabase();
   const project = getProject(id, d);
@@ -12878,6 +12981,16 @@ function updateProject(id, input, db) {
     sets.push("path = ?");
     params.push(input.path);
   }
+  if (input.parent_id !== undefined) {
+    if (input.parent_id !== null) {
+      const parent = getProject(input.parent_id, d);
+      if (!parent)
+        throw new ProjectNotFoundError(input.parent_id);
+      assertNotProjectAncestor(id, input.parent_id, d);
+    }
+    sets.push("parent_id = ?");
+    params.push(input.parent_id);
+  }
   params.push(id);
   d.run(`UPDATE projects SET ${sets.join(", ")} WHERE id = ?`, params);
   return getProject(id, d);
@@ -23142,11 +23255,14 @@ function registerTaskCommands(program2) {
     const narrowsAfterQuery = Boolean(opts.dueToday) || Boolean(opts.overdue) || creatorFilterActive && cloud || taskListFilterActive;
     const withholdLimit = requestedLimit !== undefined && (reordersAfterQuery || narrowsAfterQuery);
     const scanCeiling = cloud && (withholdLimit || requestedLimit === undefined) ? Math.max(requestedLimit ?? 0, listScanLimit()) : undefined;
+    const probeLimit = !withholdLimit && requestedLimit !== undefined ? requestedLimit + 1 : undefined;
     const serverFilter = (() => {
       const base = withholdLimit ? (() => {
         const { limit: _dropped, ...rest } = filter;
         return rest;
       })() : filter;
+      if (probeLimit !== undefined)
+        return { ...base, limit: probeLimit };
       return scanCeiling === undefined ? base : { ...base, limit: scanCeiling };
     })();
     let tasks = cloud ? await cloudListTasks(cloud, serverFilter) : listTasks(serverFilter);
@@ -23195,8 +23311,21 @@ function registerTaskCommands(program2) {
         return 0;
       });
     }
-    if (withholdLimit && requestedLimit !== undefined)
-      tasks = tasks.slice(0, requestedLimit);
+    let truncatedByLimit = false;
+    if (requestedLimit !== undefined) {
+      if (withholdLimit) {
+        truncatedByLimit = tasks.length > requestedLimit;
+        tasks = tasks.slice(0, requestedLimit);
+      } else if (tasks.length > requestedLimit) {
+        truncatedByLimit = true;
+        tasks = tasks.slice(0, requestedLimit);
+      }
+    }
+    if (truncatedByLimit) {
+      console.error(chalk3.yellow(`Warning: the matching set has more than --limit ${requestedLimit} rows, so only the first
+` + `         ${requestedLimit} are shown. This read is bounded \u2014 raise --limit or narrow the
+` + `         query (--project, --status, --assigned) to see the full population.`));
+    }
     if (rosterPromise && assignedFilter) {
       try {
         const roster = await rosterPromise;
@@ -25296,7 +25425,7 @@ function importSqliteTodosStorageSnapshot(snapshot, db) {
       }
     }
   };
-  applyRows("projects", "projects", PROJECT_COLUMNS, snapshot.projects, "updated_at");
+  applyRows("projects", "projects", PROJECT_COLUMNS, orderProjectsParentFirst(snapshot.projects), "updated_at");
   applyRows("project_machine_paths", "project_machine_paths", PROJECT_MACHINE_PATH_COLUMNS, snapshot.projectMachinePaths ?? [], "updated_at");
   applyRows("agents", "agents", AGENT_COLUMNS, snapshot.agents, "last_seen_at");
   applyRows("task_lists", "task_lists", TASK_LIST_COLUMNS, snapshot.taskLists, "updated_at");
@@ -25527,6 +25656,7 @@ var init_sqlite_snapshot = __esm(() => {
     "task_list_id",
     "task_prefix",
     "task_counter",
+    "parent_id",
     "created_at",
     "updated_at",
     "machine_id",
@@ -28531,7 +28661,7 @@ function addSourceOnce(projectId, type, name, uri, metadata, db) {
 function bootstrapProject(options = {}, db) {
   const d = db || getDatabase();
   const discovery = discoverProjectWorkspace(options.path);
-  const taskListSlug = options.taskListSlug || `todos-${slugify(options.name || discovery.projectName)}`;
+  const taskListSlug = options.taskListSlug || slugify(options.name || discovery.projectName);
   if (options.dryRun) {
     return {
       dryRun: true,
@@ -30901,7 +31031,7 @@ function registerProjectCommands(program2) {
       }
     }
   });
-  program2.command("projects").description("List and manage projects").option("--add <path>", "Register a project by path").option("--show <project>", "Resolve and show a project").option("--update <project>", "Update a project's name, path, or description").option("--deregister <project>", "Deregister a project without deleting its tasks; refuses projects with incomplete tasks").option("--path-prefix <prefix>", "Require deregistered project path to start with this prefix").option("--dry-run", "Show what would change without modifying local state").option("--name <name>", "Project name (with --add)").option("--path <path>", "Project path (with --update)").option("--description <text>", "Project description (with --add or --update)").option("--task-list-id <id>", "Custom task list ID (with --add)").option("--ensure-task-list <project>", "Plan or apply creation of an existing project's declared task list").option("--rollback-task-list <project>", "Conditionally roll back a task list created by --ensure-task-list").option("--apply", "Apply --ensure-task-list or --rollback-task-list; ensure plans by default").option("--idempotency-key <key>", "Stable idempotency key for --ensure-task-list --apply").option("--receipt <id>", "Accepted ensure receipt for --rollback-task-list --apply").action(async (opts) => {
+  program2.command("projects").description("List and manage projects").option("--add <path>", "Register a project by path").option("--show <project>", "Resolve and show a project").option("--update <project>", "Update a project's name, path, or description").option("--deregister <project>", "Deregister a project without deleting its tasks; refuses projects with incomplete tasks").option("--path-prefix <prefix>", "Require deregistered project path to start with this prefix").option("--dry-run", "Show what would change without modifying local state").option("--name <name>", "Project name (with --add)").option("--path <path>", "Project path (with --update)").option("--description <text>", "Project description (with --add or --update)").option("--task-list-id <id>", "Custom task list ID (with --add)").option("--parent <project>", "Parent project (id, path, task-list slug, or name) to create a sub-project under (with --add)").option("--ensure-task-list <project>", "Plan or apply creation of an existing project's declared task list").option("--rollback-task-list <project>", "Conditionally roll back a task list created by --ensure-task-list").option("--apply", "Apply --ensure-task-list or --rollback-task-list; ensure plans by default").option("--idempotency-key <key>", "Stable idempotency key for --ensure-task-list --apply").option("--receipt <id>", "Accepted ensure receipt for --rollback-task-list --apply").action(async (opts) => {
     const globalOpts = program2.opts();
     const cloud = getTodosCloudClient();
     if (opts.ensureTaskList && opts.rollbackTaskList) {
@@ -31018,10 +31148,21 @@ function registerProjectCommands(program2) {
     if (opts.add) {
       const projectPath = resolve13(opts.add);
       const name = opts.name || basename5(projectPath);
+      let parentId;
+      if (opts.parent !== undefined) {
+        const parent = cloud ? await cloudResolveProject(cloud, opts.parent) : resolveExplicitProject(opts.parent);
+        parentId = parent.id;
+      }
       const existing = cloud ? (await cloudListProjects(cloud)).find((project2) => project2.path === projectPath) : getProjectByPath(projectPath);
       let project;
       if (existing) {
         project = existing;
+        if (opts.parent !== undefined && existing.parent_id !== parentId) {
+          if (cloud)
+            project = await cloudUpdateProject(cloud, existing.id, { parent_id: parentId });
+          else
+            project = updateProject(existing.id, { parent_id: parentId });
+        }
         if (opts.taskListId) {
           if (cloud && existing.task_list_id !== opts.taskListId) {
             handleError(new Error("Remote project task-list slug changes require project-rename"));
@@ -31030,7 +31171,7 @@ function registerProjectCommands(program2) {
             project = renameProject(existing.id, { new_slug: opts.taskListId }).project;
         }
       } else {
-        const input = { name, path: projectPath, description: opts.description, task_list_id: opts.taskListId };
+        const input = { name, path: projectPath, description: opts.description, task_list_id: opts.taskListId, parent_id: parentId };
         project = cloud ? await cloudCreateProject(cloud, input) : createProject(input);
       }
       if (!cloud) {
@@ -31047,6 +31188,8 @@ function registerProjectCommands(program2) {
         console.log(chalk5.green(`Project registered: ${project.name} (${project.path})`));
         if (project.task_list_id)
           console.log(chalk5.dim(`  Task list: ${project.task_list_id}`));
+        if (parentId)
+          console.log(chalk5.dim(`  Parent: ${parentId}`));
       }
       return;
     }
@@ -32538,8 +32681,12 @@ class PostgresJsonRecordStore {
              OR ($11::text <> $2
                AND NOT EXISTS (SELECT 1 FROM parent_chain WHERE object_id = $2)
                AND NOT EXISTS (SELECT 1 FROM parent_chain WHERE cycle))) AS parent_acyclic,
-           (SELECT count(*) FROM locked_plans) = jsonb_array_length($7::jsonb) AS all_plans_found,
-           ($8::text IS NULL OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
+           (COALESCE((SELECT payload->>'plan_id' FROM locked_task), '')
+              IS DISTINCT FROM COALESCE($3::jsonb->>'plan_id', '')) AS membership_changed,
+           (NOT (COALESCE((SELECT payload->>'plan_id' FROM locked_task), '')
+                   IS DISTINCT FROM COALESCE($3::jsonb->>'plan_id', ''))
+             OR $8::text IS NULL
+             OR EXISTS (SELECT 1 FROM locked_plans WHERE object_id = $8)) AS target_plan_found,
            (SELECT payload->>'project_id' FROM locked_plans WHERE object_id = $8) AS target_project_id
        ), guarded AS (
          SELECT
@@ -32562,7 +32709,6 @@ class PostgresJsonRecordStore {
            AND guarded.version_matches
            AND guarded.parent_found
            AND guarded.parent_acyclic
-           AND guarded.all_plans_found
            AND guarded.target_plan_found
            AND NOT guarded.project_conflict
          ON CONFLICT (service, object_type, object_id) DO UPDATE SET
@@ -32578,7 +32724,7 @@ class PostgresJsonRecordStore {
          RETURNING payload
        )
        SELECT guarded.task_found, guarded.version_matches, guarded.parent_found, guarded.parent_acyclic,
-              guarded.all_plans_found, guarded.target_plan_found, guarded.project_conflict,
+              guarded.membership_changed, guarded.target_plan_found, guarded.project_conflict,
               (SELECT payload FROM stored) AS payload,
               (SELECT payload FROM locked_task) AS current_payload
        FROM guarded`, [
@@ -32610,7 +32756,7 @@ class PostgresJsonRecordStore {
     if (parentGuard && !row?.parent_acyclic && parentGuard.parentId) {
       throw new ResourceConflictError("TASK_PARENT_CYCLE", `TASK_PARENT_CYCLE: assigning parent ${parentGuard.parentId} to task ${value.id} would create or retain a parent cycle`);
     }
-    if (!row?.all_plans_found || !row.target_plan_found) {
+    if (!row?.target_plan_found) {
       throw new PlanProjectLinkError("PLAN_PROJECT_LINK_PLAN_NOT_FOUND", `Plan membership changed through a missing plan: ${targetPlanId ?? planIds.join(", ")}`, { plan_ids: planIds, target_plan_id: targetPlanId });
     }
     if (row.project_conflict) {
@@ -33819,17 +33965,26 @@ async function getChangedSince(since, filters, store) {
 async function createProject2(input, store, context) {
   const timestamp2 = new Date().toISOString();
   const derivedSlug = slugifyRaw(input.name);
-  const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : slugifyRaw(input.task_list_id);
+  const taskListId = input.task_list_id === undefined ? derivedSlug : slugifyRaw(input.task_list_id);
   if (!derivedSlug || !taskListId)
     throw new Error("Project name and task-list slug must be non-empty");
+  const parentId = input.parent_id ?? null;
+  const id = randomUUID4();
+  if (parentId !== null) {
+    const parent = await store.get("projects", parentId);
+    if (!parent)
+      throw new ProjectNotFoundError(parentId);
+    await assertNotProjectAncestorPostgres(id, parentId, store);
+  }
   const project = {
-    id: randomUUID4(),
+    id,
     name: input.name,
     path: input.path,
     description: input.description ?? null,
     task_list_id: taskListId,
     task_prefix: input.task_prefix ?? await generateProjectPrefix(input.name, store),
     task_counter: 0,
+    parent_id: parentId,
     created_at: timestamp2,
     updated_at: timestamp2,
     machine_id: store.machineId(context),
@@ -33837,12 +33992,38 @@ async function createProject2(input, store, context) {
   };
   return store.upsert("projects", project, context);
 }
+async function assertNotProjectAncestorPostgres(projectId, candidateParentId, store) {
+  const all = await store.list("projects");
+  const byId = new Map(all.map((project) => [project.id, project.parent_id ?? null]));
+  let cursor = candidateParentId;
+  const seen = new Set;
+  while (cursor !== null) {
+    if (cursor === projectId) {
+      throw new ResourceConflictError("PROJECT_PARENT_CYCLE", `Project "${projectId}" cannot be placed under its own descendant`);
+    }
+    if (seen.has(cursor))
+      break;
+    seen.add(cursor);
+    cursor = byId.get(cursor) ?? null;
+  }
+}
 async function updateProject2(id, input, store) {
   if ("task_list_id" in input) {
     throw new Error("task_list_id cannot be changed by updateProject; use renameProject for an atomic canonical rename");
   }
   const project = await requireRecord("projects", id, store);
-  const updated = { ...project, ...definedPatch(input), updated_at: new Date().toISOString() };
+  if (input.parent_id !== undefined && input.parent_id !== null) {
+    const parent = await store.get("projects", input.parent_id);
+    if (!parent)
+      throw new ProjectNotFoundError(input.parent_id);
+    await assertNotProjectAncestorPostgres(id, input.parent_id, store);
+  }
+  const updated = {
+    ...project,
+    ...definedPatch(input),
+    ...input.parent_id !== undefined ? { parent_id: input.parent_id } : {},
+    updated_at: new Date().toISOString()
+  };
   return store.upsert("projects", updated);
 }
 async function createPlan2(input, store, context) {
@@ -35234,7 +35415,7 @@ class StagedSqliteTodosProjectRegistrationTransaction {
   }
   async createProject(input) {
     const derivedSlug = normalizeSlug(input.name);
-    const taskListId = input.task_list_id === undefined ? `todos-${derivedSlug}` : normalizeSlug(input.task_list_id);
+    const taskListId = input.task_list_id === undefined ? derivedSlug : normalizeSlug(input.task_list_id);
     if (!derivedSlug || !taskListId) {
       throw new Error("Project name and task-list slug must be non-empty");
     }
@@ -35246,6 +35427,7 @@ class StagedSqliteTodosProjectRegistrationTransaction {
       task_list_id: taskListId,
       task_prefix: input.task_prefix ?? this.availableProjectPrefix(input.name),
       task_counter: 0,
+      parent_id: input.parent_id ?? null,
       created_at: now(),
       updated_at: now(),
       machine_id: currentStorageMachineId(this.db)
@@ -35256,14 +35438,15 @@ class StagedSqliteTodosProjectRegistrationTransaction {
       try {
         const result = this.db.run(`INSERT INTO projects (
              id, name, path, description, task_list_id, task_prefix,
-             task_counter, created_at, updated_at, machine_id
-           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`, [
+             task_counter, parent_id, created_at, updated_at, machine_id
+           ) VALUES (?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?)`, [
           project.id,
           project.name,
           project.path,
           project.description,
           project.task_list_id,
           project.task_prefix,
+          project.parent_id,
           project.created_at,
           project.updated_at,
           project.machine_id ?? null
@@ -35660,7 +35843,10 @@ function taskListSlug(projectSlug) {
   if (!slug || slug !== projectSlug) {
     throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_INPUT", "project_slug must be canonical kebab-case");
   }
-  return `todos-${slug}`;
+  return slug;
+}
+function legacyTaskListSlug(projectSlug) {
+  return `todos-${normalizeSlug(projectSlug)}`;
 }
 function deterministicTaskPrefix(projectSlug) {
   const letters = projectSlug.replace(/[^a-z0-9]/gi, "").toUpperCase();
@@ -36179,6 +36365,12 @@ class PackageOwnedTodosProjectRegistrationAuthority {
             created_by_operation: false
           };
         }
+        if (request.bind_existing === true && conflict2.path === path && conflict2.task_list_id === legacyTaskListSlug(request.project_slug)) {
+          return {
+            record: boundExistingProjectRecord(conflict2),
+            created_by_operation: false
+          };
+        }
         return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict2.id });
       }
       await this.fault("before_object_write", request);
@@ -36215,6 +36407,15 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       }
       return this.terminalFor(transaction, request, normalizedCallDigest(request), "target_already_exists", { targetId: conflict.id });
     }
+    if (request.bind_existing === true) {
+      const legacy = await transaction.findTaskListConflict(todosProjectId, legacyTaskListSlug(request.project_slug));
+      if (legacy && legacy.project_id === todosProjectId) {
+        return {
+          record: boundExistingTaskListRecord(legacy),
+          created_by_operation: false
+        };
+      }
+    }
     await this.fault("before_object_write", request);
     const taskList = await transaction.createTaskList({
       name: request.project_name,
@@ -51904,7 +52105,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             path: { type: "string", minLength: 1 },
             description: { type: "string" },
             task_list_id: { type: "string", minLength: 1, pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
-            task_prefix: { type: "string", minLength: 1 }
+            task_prefix: { type: "string", minLength: 1 },
+            parent_id: { type: "string", minLength: 1 }
           }
         },
         UpdateProjectInput: {
@@ -51914,7 +52116,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           properties: {
             name: { type: "string", minLength: 1 },
             path: { type: "string", minLength: 1 },
-            description: { type: "string", nullable: true }
+            description: { type: "string", nullable: true },
+            parent_id: { type: "string", minLength: 1, nullable: true }
           }
         },
         RenameProjectInput: {
@@ -54213,6 +54416,7 @@ var init_openapi = __esm(() => {
       task_list_id: { type: "string", nullable: true },
       task_prefix: { type: "string", nullable: true },
       task_counter: { type: "number" },
+      parent_id: { type: "string", nullable: true },
       created_at: { type: "string" },
       updated_at: { type: "string" }
     }
@@ -55283,7 +55487,7 @@ function validateProjectPatch(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "project patch must be an object" };
   const body2 = value;
-  const allowed = new Set(["name", "path", "description"]);
+  const allowed = new Set(["name", "path", "description", "parent_id"]);
   const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown project field: ${unknown}` };
@@ -55295,13 +55499,15 @@ function validateProjectPatch(value) {
     return { ok: false, message: "path must be a non-empty string" };
   if (body2["description"] !== undefined && body2["description"] !== null && typeof body2["description"] !== "string")
     return { ok: false, message: "description must be a string or null" };
+  if (body2["parent_id"] !== undefined && body2["parent_id"] !== null && (typeof body2["parent_id"] !== "string" || !body2["parent_id"].trim()))
+    return { ok: false, message: "parent_id must be a string or null" };
   return { ok: true, patch: body2 };
 }
 function validateProjectCreate(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "project body must be an object" };
   const body2 = value;
-  const allowed = new Set(["name", "path", "description", "task_list_id", "task_prefix"]);
+  const allowed = new Set(["name", "path", "description", "task_list_id", "task_prefix", "parent_id"]);
   const unknown = Object.keys(body2).find((key2) => !allowed.has(key2));
   if (unknown)
     return { ok: false, message: `unknown project field: ${unknown}` };
@@ -55319,6 +55525,9 @@ function validateProjectCreate(value) {
   if (body2["task_prefix"] !== undefined && (typeof body2["task_prefix"] !== "string" || !body2["task_prefix"].trim())) {
     return { ok: false, message: "task_prefix must be a non-empty string" };
   }
+  if (body2["parent_id"] !== undefined && (typeof body2["parent_id"] !== "string" || !body2["parent_id"].trim())) {
+    return { ok: false, message: "parent_id must be a non-empty string" };
+  }
   return { ok: true, input: body2 };
 }
 function validatePlanCreate(value) {
@@ -62034,6 +62243,7 @@ function registerTaskProjectTools(server, ctx) {
       name: exports_external.string().describe("Project name"),
       path: exports_external.string().describe("Unique filesystem path for the project"),
       description: exports_external.string().optional(),
+      parent_id: exports_external.string().optional().describe("Optional parent project id to create this as a sub-project"),
       status: exports_external.enum(["active", "completed", "on_hold", "archived"]).optional(),
       short_id: exports_external.string().nullable().optional().describe("Short ID (auto-generated if omitted)"),
       metadata: exports_external.record(exports_external.unknown()).optional()
@@ -69584,6 +69794,7 @@ function createAgentProjectDemoBundle() {
     task_list_id: ids.list,
     task_prefix: "DEMO",
     task_counter: 4,
+    parent_id: null,
     created_at: createdAt,
     updated_at: completedAt
   });
@@ -89333,6 +89544,7 @@ var init_json_contracts = __esm(() => {
         task_list_id: nullableIdField,
         task_prefix: field(["string", "null"], "Optional task prefix.", true),
         task_counter: field("integer", "Monotonic project task counter."),
+        parent_id: field(["string", "null"], "Optional parent project id; null means top-level.", true),
         created_at: isoDateField,
         updated_at: isoDateField
       },