@hasna/todos 0.15.4 → 0.15.6

package/dist/cli/stage-a.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stage-a.d.ts","sourceRoot":"","sources":["../../src/cli/stage-a.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,WAAW,CAAC;AAO1C,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,MAAM,MAAM,+BAA+B,GACvC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAyB/E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CA8BgB,CAAC;AAoEvD,wBAAgB,kCAAkC,IAAI,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,GAC9C,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,GAAG,IAAI,CASnH;AAuWD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,MAAM,EAA0B,EACtC,GAAG,GAAE,GAAwB,GAC5B,+BAA+B,CAgBjC"}
+{"version":3,"file":"stage-a.d.ts","sourceRoot":"","sources":["../../src/cli/stage-a.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,WAAW,CAAC;AAO1C,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,MAAM,MAAM,+BAA+B,GACvC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAyB/E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CA8BgB,CAAC;AAyEvD,wBAAgB,kCAAkC,IAAI,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,GAC9C,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,GAAG,IAAI,CASnH;AAuWD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,MAAM,EAA0B,EACtC,GAAG,GAAE,GAAwB,GAC5B,+BAA+B,CAgBjC"}

package/dist/contracts.js

@@ -9313,6 +9313,18 @@ function updateTask(id, input, db) {
     sets.push("assigned_to = ?");
     params.push(input.assigned_to);
   }
+  if (input.assigned_by !== undefined) {
+    sets.push("assigned_by = ?");
+    params.push(input.assigned_by);
+  }
+  if (input.delegated_from !== undefined) {
+    sets.push("delegated_from = ?");
+    params.push(input.delegated_from);
+  }
+  if (input.delegation_depth !== undefined) {
+    sets.push("delegation_depth = ?");
+    params.push(input.delegation_depth);
+  }
   if (input.working_dir !== undefined) {
     sets.push("working_dir = ?");
     params.push(input.working_dir);
@@ -12032,7 +12044,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.4",
+  version: "0.15.6",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/db/task-crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-crud.d.ts","sourceRoot":"","sources":["../../src/db/task-crud.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAoB,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EACV,eAAe,EACf,IAAI,EACJ,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,4BAA4B,EAC5B,6BAA6B,EAC9B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAY5F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAS5C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,GAAG,IAAI,CAMjF;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,GAAG,IAAI,CAGlF;AAwCD,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,IAAI,CAwFtE;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,IAAI,CAK9D;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,MAAM,EACV,EAAE,CAAC,EAAE,QAAQ,GACZ,iBAAiB,GAAG,IAAI,CA4D1B;AAQD,wBAAgB,SAAS,CAAC,MAAM,GAAE,UAAe,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,IAAI,EAAE,CA0JxE;AAED,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,EAAE,CAAC,EAAE,QAAQ,GACZ,IAAI,GAAG,IAAI,CAKb;AAcD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,EACnC,EAAE,CAAC,EAAE,QAAQ,GACZ,6BAA6B,CAmD/B;AAED,wBAAgB,UAAU,CAAC,MAAM,GAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,MAAM,CA0HnG;AAED,wBAAgB,UAAU,CACxB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,EACtB,EAAE,CAAC,EAAE,QAAQ,GACZ,IAAI,CA8PN;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAY7D"}
+{"version":3,"file":"task-crud.d.ts","sourceRoot":"","sources":["../../src/db/task-crud.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAoB,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EACV,eAAe,EACf,IAAI,EACJ,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,4BAA4B,EAC5B,6BAA6B,EAC9B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAY5F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAS5C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,GAAG,IAAI,CAMjF;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,GAAG,IAAI,CAGlF;AAwCD,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,IAAI,CAwFtE;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,IAAI,CAK9D;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,MAAM,EACV,EAAE,CAAC,EAAE,QAAQ,GACZ,iBAAiB,GAAG,IAAI,CA4D1B;AAQD,wBAAgB,SAAS,CAAC,MAAM,GAAE,UAAe,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,IAAI,EAAE,CA0JxE;AAED,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,EAAE,CAAC,EAAE,QAAQ,GACZ,IAAI,GAAG,IAAI,CAKb;AAcD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,EACnC,EAAE,CAAC,EAAE,QAAQ,GACZ,6BAA6B,CAmD/B;AAED,wBAAgB,UAAU,CAAC,MAAM,GAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,MAAM,CA0HnG;AAED,wBAAgB,UAAU,CACxB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,EACtB,EAAE,CAAC,EAAE,QAAQ,GACZ,IAAI,CAsRN;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAY7D"}

package/dist/index.js

@@ -9313,6 +9313,18 @@ function updateTask(id, input, db) {
     sets.push("assigned_to = ?");
     params.push(input.assigned_to);
   }
+  if (input.assigned_by !== undefined) {
+    sets.push("assigned_by = ?");
+    params.push(input.assigned_by);
+  }
+  if (input.delegated_from !== undefined) {
+    sets.push("delegated_from = ?");
+    params.push(input.delegated_from);
+  }
+  if (input.delegation_depth !== undefined) {
+    sets.push("delegation_depth = ?");
+    params.push(input.delegation_depth);
+  }
   if (input.working_dir !== undefined) {
     sets.push("working_dir = ?");
     params.push(input.working_dir);
@@ -12145,7 +12157,7 @@ var init_dispatches = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.4",
+  version: "0.15.6",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/lib/comment-cursor.d.ts

@@ -0,0 +1,40 @@
+import type { TaskComment } from "../types/index.js";
+/**
+ * Keyset cursor for the task-comment read model, and the pure pager that walks
+ * it. Both the `/v1` server and the CLI encode and decode the same cursor, so
+ * the codec lives here rather than beside either consumer — a second copy of
+ * this keyset logic is exactly how the two ends drift into disagreeing about
+ * what a cursor means.
+ *
+ * ORDERING CONTRACT, measured against the live deployment rather than assumed:
+ * a page carries the NEWEST `limit` comments in ASCENDING display order, so the
+ * newest comment is the LAST element. `next_cursor` encodes the FIRST (oldest)
+ * element of the page, and walking it moves toward OLDER history.
+ */
+export interface CommentCursor {
+    created_at: string;
+    id: string;
+}
+export declare const MAX_COMMENT_CURSOR_LENGTH = 1024;
+export declare function encodeCommentCursor(comment: Pick<TaskComment, "created_at" | "id">): string;
+export declare function decodeCommentCursor(value: string): CommentCursor;
+/** True when `comment` sorts strictly before `before` on the `(created_at, id)` keyset. */
+export declare function isStrictlyOlder(comment: Pick<TaskComment, "created_at" | "id">, before: CommentCursor): boolean;
+export interface CommentPageResult<T> {
+    comments: T[];
+    count: number;
+    has_more: boolean;
+    next_cursor: string | null;
+    limit: number;
+}
+/**
+ * Page an already-materialised, ascending comment list. Used by the local
+ * (SQLite) read path, where the whole history is in hand; the cloud path gets
+ * the identical shape from the server, which applies the same rule against the
+ * database.
+ */
+export declare function pageComments<T extends Pick<TaskComment, "created_at" | "id">>(all: readonly T[], options: {
+    limit: number;
+    before?: CommentCursor;
+}): CommentPageResult<T>;
+//# sourceMappingURL=comment-cursor.d.ts.map

package/dist/lib/comment-cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-cursor.d.ts","sourceRoot":"","sources":["../../src/lib/comment-cursor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAE/C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC,GAAG,MAAM,CAG3F;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAgBhE;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,CAC7B,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC,EAC/C,MAAM,EAAE,aAAa,GACpB,OAAO,CAGT;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC;IAClC,QAAQ,EAAE,CAAC,EAAE,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC,EAC3E,GAAG,EAAE,SAAS,CAAC,EAAE,EACjB,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAE,GACjD,iBAAiB,CAAC,CAAC,CAAC,CAetB"}

package/dist/lib/delegation-brief.d.ts

@@ -0,0 +1,31 @@
+export interface DelegationBriefInput {
+    /** `--brief <path>`; the literal `-` means stdin. */
+    briefPath?: string | undefined;
+    /** `--brief-text <text>`. Mutually exclusive with {@link briefPath}. */
+    briefText?: string | undefined;
+}
+/** The two reads the gate needs, injected so every branch is testable. */
+export interface DelegationBriefSources {
+    /** Reads a file as utf8; THROWS when the path cannot be read. */
+    readFile(path: string): string;
+    /** Reads stdin to end as utf8. */
+    readStdin(): string;
+}
+export type DelegationBriefRefusal = "missing" | "conflict" | "unreadable" | "empty";
+export type DelegationBriefVerdict = {
+    ok: true;
+    /** The brief exactly as read — never trimmed. */
+    text: string;
+    /** Where it came from, for the [DISPATCH] record: a path, `(stdin)`, or `(--brief-text)`. */
+    source: string;
+    /** sha256 of the utf8 bytes of {@link text}. */
+    sha256: string;
+    /** Byte length of {@link text}. */
+    bytes: number;
+} | {
+    ok: false;
+    reason: DelegationBriefRefusal;
+    message: string;
+};
+export declare function resolveDelegationBrief(input: DelegationBriefInput, sources: DelegationBriefSources): DelegationBriefVerdict;
+//# sourceMappingURL=delegation-brief.d.ts.map

package/dist/lib/delegation-brief.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-brief.d.ts","sourceRoot":"","sources":["../../src/lib/delegation-brief.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,kCAAkC;IAClC,SAAS,IAAI,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC;AAErF,MAAM,MAAM,sBAAsB,GAC9B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAInE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,sBAAsB,GAC9B,sBAAsB,CA6ExB"}

package/dist/lib/delegation-policy.d.ts

@@ -0,0 +1,32 @@
+export declare function defaultDelegationEmbargoPath(): string;
+/**
+ * Normalised names that must not receive a delegation.
+ *
+ * Accepts either `{ "embargoed": ["name", ...] }` or a bare array, and tolerates
+ * entries shaped `{ "slug": "name" }` so the file can carry a reason alongside
+ * each name without the reader needing a schema version.
+ */
+export declare function loadDelegationEmbargo(path?: string): Set<string>;
+export interface DelegationDepthThreshold {
+    /** `null` means no threshold is armed: report the count, never park. */
+    value: number | null;
+    source: "flag" | "env" | "unset";
+}
+/**
+ * Resolve the open-task count above which a delegation parks.
+ *
+ * THE DEFAULT IS DELIBERATELY UNSET, and this is the clause with a cost
+ * attached. Seat queues on this fleet were measured at 190 open rows, so any
+ * plausible shipped number would park essentially every delegation — and a gate
+ * that fires on every invocation is one operators learn to type past, which
+ * converts a real signal into a formality. What the step is actually worth is
+ * the PRINTED NUMBER and the RECORDED OVERRIDE, and those are delivered
+ * unconditionally.
+ *
+ * So parking is opt-in until per-seat data justifies a number, and the number
+ * lives in configuration rather than in a release when it does.
+ */
+export declare function resolveDelegationDepthThreshold(flagValue?: string | number | undefined): DelegationDepthThreshold;
+/** Minutes a dispatched row may sit unclaimed before the steering pass owns it. */
+export declare const DEFAULT_CLAIM_WINDOW_MINUTES = 30;
+//# sourceMappingURL=delegation-policy.d.ts.map

package/dist/lib/delegation-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-policy.d.ts","sourceRoot":"","sources":["../../src/lib/delegation-policy.ts"],"names":[],"mappings":"AA8BA,wBAAgB,4BAA4B,IAAI,MAAM,CAKrD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAAuC,GAAG,GAAG,CAAC,MAAM,CAAC,CAiBhG;AAED,MAAM,WAAW,wBAAwB;IACvC,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,wBAAwB,CAQjH;AASD,mFAAmF;AACnF,eAAO,MAAM,4BAA4B,KAAK,CAAC"}

package/dist/lib/delegation-record.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The `[DISPATCH]` record, and the one-line channel notice.
+ *
+ * These are separated from the command so the exact text is testable without
+ * spawning a CLI, and so the record's SHAPE is a decision made once rather than
+ * a template string buried in an action handler.
+ *
+ * WHY NOT `lib/dispatch-formatter.ts`, which already exists and already formats
+ * a dispatch: that module builds a HUMAN PROMPT to be typed into a tmux pane —
+ * it is the message body of the legacy `dispatch` verb. This builds a
+ * MACHINE-GREPPABLE AUDIT LINE that lands in a task comment. Bending the
+ * existing formatter to do both would couple the record this verb is measured
+ * by to the message format of the verb it replaces.
+ *
+ * The first line is a fixed, anchored marker because the terminal-state
+ * counters read it: N1 counts directive-cited rows with NO `[DISPATCH]`
+ * comment, and N2 counts `[DISPATCH]` comments older than the claim window
+ * whose row still has a null `started_at`. Both are greps, so the marker must
+ * be stable and must start the comment.
+ */
+export interface DelegationRecordInput {
+    taskId: string;
+    worker: string;
+    dispatcher: string;
+    runtime: string | null;
+    briefSource: string;
+    briefSha256: string;
+    briefBytes: number;
+    depth: number;
+    reportsTo: string;
+    seatSlug: string;
+    seatOpenTasks: number;
+    depthThreshold: number | null;
+    override: "despite-depth" | "owner-directive" | null;
+    identityOutcome: "created" | "reused" | "skipped";
+    dispatchedAt: string;
+    claimDeadline: string;
+}
+/** The marker every reader and counter greps for. Anchored at line start. */
+export declare const DISPATCH_COMMENT_MARKER = "[DISPATCH]";
+export declare function formatDispatchComment(input: DelegationRecordInput): string;
+/**
+ * The channel notice. ONE line, because it goes to a shared channel that
+ * several seats read, and a multi-line dispatch log there is how a channel
+ * stops being read at all.
+ */
+export declare function formatDispatchNotice(input: DelegationRecordInput): string;
+/** Dispatch time plus the claim window, as an ISO instant. */
+export declare function claimDeadlineFrom(dispatchedAt: Date, windowMinutes: number): string;
+//# sourceMappingURL=delegation-record.d.ts.map

package/dist/lib/delegation-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-record.d.ts","sourceRoot":"","sources":["../../src/lib/delegation-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,eAAe,GAAG,iBAAiB,GAAG,IAAI,CAAC;IACrD,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,eAAe,CAAC;AAEpD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAkB1E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAOzE;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAEnF"}

package/dist/lib/delegation-verify.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Read-back verification for a delegation: did the authority ACTUALLY persist
+ * the lineage, or did it accept the patch and drop it?
+ *
+ * WHY THIS IS NOT PARANOIA. `todos delegate` writes through
+ * `PATCH /v1/tasks/:id`, and the authority serving that route is a separately
+ * deployed build with its own release cadence. Before this change, NOTHING in
+ * the server or storage layer handled `assigned_by`, `delegated_from` or
+ * `delegation_depth` — the columns existed, were indexed, and had no write path
+ * — so any authority running an earlier build accepts the patch, returns 200
+ * with a bumped version, and writes none of the lineage.
+ *
+ * That produces the one failure shape this verb cannot afford: a successful
+ * exit code, a [DISPATCH] comment asserting a lineage, and a row that is
+ * indistinguishable from a plain `todos assign`. The whole claim of `delegate`
+ * over `assign` is the handover record; reporting one that was silently
+ * discarded is worse than not having the verb.
+ *
+ * So: `secrets exec` returning 0 means the command ran, not that the credential
+ * arrived — same shape. A 200 means the request was accepted, not that the
+ * field was stored. Verify the PROPERTY, not the CALL.
+ *
+ * Kept as a pure function over a plain row so both arms are testable without an
+ * old server to point at. A check that can only ever be observed passing is not
+ * evidence about anything.
+ */
+/** The subset of a task row this verification reads. */
+export interface PersistedLineage {
+    assigned_to?: string | null;
+    assigned_by?: string | null;
+    delegated_from?: string | null;
+    delegation_depth?: number | null;
+}
+export interface ExpectedLineage {
+    assignedTo: string;
+    assignedBy: string;
+    delegatedFrom: string;
+    depth: number;
+}
+/**
+ * Field names the authority did not persist as asked. Empty means the handover
+ * is fully recorded.
+ *
+ * Names are compared case-insensitively: agent names are a case-INSENSITIVE
+ * identity across this codebase, so a server that canonicalises casing is
+ * behaving correctly and must not be reported as having dropped the field.
+ * Depth is compared exactly, and `0` is a legitimate value rather than absence
+ * — a truthiness test here would call every root dispatch a failure.
+ */
+export declare function missingDelegationLineage(persisted: PersistedLineage, expected: ExpectedLineage): string[];
+/**
+ * The refusal text for a partial delegation. It names what DID land, so nobody
+ * re-runs blindly against a row that is already half-changed, and it names the
+ * real remedy rather than sending the reader to debug their connection.
+ */
+export declare function partialDelegationMessage(missing: readonly string[], taskId: string): string;
+//# sourceMappingURL=delegation-verify.d.ts.map

package/dist/lib/delegation-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-verify.d.ts","sourceRoot":"","sources":["../../src/lib/delegation-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,gBAAgB,EAC3B,QAAQ,EAAE,eAAe,GACxB,MAAM,EAAE,CAOV;AAMD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAS3F"}

package/dist/mcp/index.js

@@ -13960,6 +13960,18 @@ function updateTask(id, input, db) {
     sets.push("assigned_to = ?");
     params.push(input.assigned_to);
   }
+  if (input.assigned_by !== undefined) {
+    sets.push("assigned_by = ?");
+    params.push(input.assigned_by);
+  }
+  if (input.delegated_from !== undefined) {
+    sets.push("delegated_from = ?");
+    params.push(input.delegated_from);
+  }
+  if (input.delegation_depth !== undefined) {
+    sets.push("delegation_depth = ?");
+    params.push(input.delegation_depth);
+  }
   if (input.working_dir !== undefined) {
     sets.push("working_dir = ?");
     params.push(input.working_dir);
@@ -34914,7 +34926,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.4",
+    version: "0.15.6",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -50900,6 +50912,29 @@ var init_pr_groups = __esm(() => {
   JSON_HEADERS = { "Content-Type": "application/json" };
 });
 
+// src/lib/comment-cursor.ts
+function encodeCommentCursor(comment) {
+  return Buffer.from(JSON.stringify({ created_at: comment.created_at, id: comment.id }), "utf8").toString("base64url");
+}
+function decodeCommentCursor(value) {
+  if (value.length > MAX_COMMENT_CURSOR_LENGTH)
+    throw new Error("invalid comment cursor");
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    throw new Error("invalid comment cursor");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("invalid comment cursor");
+  const cursor = parsed;
+  if (typeof cursor["created_at"] !== "string" || cursor["created_at"].length > 64 || !Number.isFinite(Date.parse(cursor["created_at"])) || typeof cursor["id"] !== "string" || !cursor["id"] || cursor["id"].length > 256) {
+    throw new Error("invalid comment cursor");
+  }
+  return { created_at: cursor["created_at"], id: cursor["id"] };
+}
+var MAX_COMMENT_CURSOR_LENGTH = 1024;
+
 // src/server/v1.ts
 var exports_v1 = {};
 __export(exports_v1, {
@@ -51189,26 +51224,6 @@ function contextFromPrincipal(principal, body) {
 function redactComment3(comment) {
   return { ...comment, content: redactEvidenceText(comment.content) };
 }
-function encodeCommentCursor(comment) {
-  return Buffer.from(JSON.stringify({ created_at: comment.created_at, id: comment.id }), "utf8").toString("base64url");
-}
-function decodeCommentCursor(value) {
-  if (value.length > 1024)
-    throw new Error("invalid comment cursor");
-  let parsed;
-  try {
-    parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-  } catch {
-    throw new Error("invalid comment cursor");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-    throw new Error("invalid comment cursor");
-  const cursor = parsed;
-  if (typeof cursor["created_at"] !== "string" || cursor["created_at"].length > 64 || !Number.isFinite(Date.parse(cursor["created_at"])) || typeof cursor["id"] !== "string" || !cursor["id"] || cursor["id"].length > 256) {
-    throw new Error("invalid comment cursor");
-  }
-  return { created_at: cursor["created_at"], id: cursor["id"] };
-}
 function normalizeImportSnapshot(raw) {
   const body = raw && typeof raw === "object" ? raw : {};
   const arr = (v) => Array.isArray(v) ? v : [];

package/dist/mcp.js

@@ -41,7 +41,7 @@ var __require = import.meta.require;
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.4",
+  version: "0.15.6",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/registry.js

@@ -9313,6 +9313,18 @@ function updateTask(id, input, db) {
     sets.push("assigned_to = ?");
     params.push(input.assigned_to);
   }
+  if (input.assigned_by !== undefined) {
+    sets.push("assigned_by = ?");
+    params.push(input.assigned_by);
+  }
+  if (input.delegated_from !== undefined) {
+    sets.push("delegated_from = ?");
+    params.push(input.delegated_from);
+  }
+  if (input.delegation_depth !== undefined) {
+    sets.push("delegation_depth = ?");
+    params.push(input.delegation_depth);
+  }
   if (input.working_dir !== undefined) {
     sets.push("working_dir = ?");
     params.push(input.working_dir);
@@ -12032,7 +12044,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.4",
+  version: "0.15.6",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/release-provenance.json

@@ -1,9 +1,9 @@
 {
   "packageName": "@hasna/todos",
-  "packageVersion": "0.15.4",
+  "packageVersion": "0.15.6",
   "repository": "https://github.com/hasna/todos.git",
-  "gitCommit": "f2cba9a1a2f689b5f657a9e4b0343c06bb5a9053",
-  "gitTree": "940acc30831db4a32ab7e0ef6d143d50924295ee",
-  "sourceTreeSha256": "de35dde8cbad7cf3afceb9b03ae2a70dfff78415251ff1c0f62fbdf18f582415",
-  "generatedAt": "2026-08-04T23:12:15.000Z"
+  "gitCommit": "912706df4217032e0fa328b8e63c631cbd2dbaaa",
+  "gitTree": "55ffcbf22946c2823608bf05b7db8c77c3d1837f",
+  "sourceTreeSha256": "6d97deaa19cf1aca86ae5d2ac810239a96079987884dffad727762b91dbbe660",
+  "generatedAt": "2026-08-06T09:35:27.000Z"
 }

package/dist/server/index.js

@@ -70,7 +70,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.4",
+    version: "0.15.6",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -14223,6 +14223,18 @@ function updateTask2(id, input, db) {
     sets.push("assigned_to = ?");
     params.push(input.assigned_to);
   }
+  if (input.assigned_by !== undefined) {
+    sets.push("assigned_by = ?");
+    params.push(input.assigned_by);
+  }
+  if (input.delegated_from !== undefined) {
+    sets.push("delegated_from = ?");
+    params.push(input.delegated_from);
+  }
+  if (input.delegation_depth !== undefined) {
+    sets.push("delegation_depth = ?");
+    params.push(input.delegation_depth);
+  }
   if (input.working_dir !== undefined) {
     sets.push("working_dir = ?");
     params.push(input.working_dir);
@@ -22300,6 +22312,29 @@ var init_pr_groups = __esm(() => {
   JSON_HEADERS = { "Content-Type": "application/json" };
 });
 
+// src/lib/comment-cursor.ts
+function encodeCommentCursor(comment) {
+  return Buffer.from(JSON.stringify({ created_at: comment.created_at, id: comment.id }), "utf8").toString("base64url");
+}
+function decodeCommentCursor(value) {
+  if (value.length > MAX_COMMENT_CURSOR_LENGTH)
+    throw new Error("invalid comment cursor");
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+  } catch {
+    throw new Error("invalid comment cursor");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("invalid comment cursor");
+  const cursor = parsed;
+  if (typeof cursor["created_at"] !== "string" || cursor["created_at"].length > 64 || !Number.isFinite(Date.parse(cursor["created_at"])) || typeof cursor["id"] !== "string" || !cursor["id"] || cursor["id"].length > 256) {
+    throw new Error("invalid comment cursor");
+  }
+  return { created_at: cursor["created_at"], id: cursor["id"] };
+}
+var MAX_COMMENT_CURSOR_LENGTH = 1024;
+
 // src/server/v1.ts
 var exports_v1 = {};
 __export(exports_v1, {
@@ -22589,26 +22624,6 @@ function contextFromPrincipal(principal, body) {
 function redactComment2(comment) {
   return { ...comment, content: redactEvidenceText(comment.content) };
 }
-function encodeCommentCursor(comment) {
-  return Buffer.from(JSON.stringify({ created_at: comment.created_at, id: comment.id }), "utf8").toString("base64url");
-}
-function decodeCommentCursor(value) {
-  if (value.length > 1024)
-    throw new Error("invalid comment cursor");
-  let parsed;
-  try {
-    parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-  } catch {
-    throw new Error("invalid comment cursor");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-    throw new Error("invalid comment cursor");
-  const cursor = parsed;
-  if (typeof cursor["created_at"] !== "string" || cursor["created_at"].length > 64 || !Number.isFinite(Date.parse(cursor["created_at"])) || typeof cursor["id"] !== "string" || !cursor["id"] || cursor["id"].length > 256) {
-    throw new Error("invalid comment cursor");
-  }
-  return { created_at: cursor["created_at"], id: cursor["id"] };
-}
 function normalizeImportSnapshot(raw) {
   const body = raw && typeof raw === "object" ? raw : {};
   const arr = (v) => Array.isArray(v) ? v : [];

package/dist/server/v1.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v1.d.ts","sourceRoot":"","sources":["../../src/server/v1.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAuB,oBAAoB,EAAmD,MAAM,0BAA0B,CAAC;AAC3I,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAKhH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACtC,YAAY,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACxC,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAClD,gBAAgB,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACjD;AA0TD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAiB1E;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAapE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,YAAY,GAAE,qBAA0B,GACvC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAu6B1B"}
+{"version":3,"file":"v1.d.ts","sourceRoot":"","sources":["../../src/server/v1.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAuB,oBAAoB,EAAmD,MAAM,0BAA0B,CAAC;AAC3I,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMhH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACtC,YAAY,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACxC,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAClD,gBAAgB,CAAC,EAAE,OAAO,qBAAqB,CAAC;CACjD;AAuSD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAiB1E;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAapE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,GAAG,EACR,YAAY,GAAE,qBAA0B,GACvC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAu6B1B"}

package/dist/storage.js

@@ -9313,6 +9313,18 @@ function updateTask(id, input, db) {
     sets.push("assigned_to = ?");
     params.push(input.assigned_to);
   }
+  if (input.assigned_by !== undefined) {
+    sets.push("assigned_by = ?");
+    params.push(input.assigned_by);
+  }
+  if (input.delegated_from !== undefined) {
+    sets.push("delegated_from = ?");
+    params.push(input.delegated_from);
+  }
+  if (input.delegation_depth !== undefined) {
+    sets.push("delegation_depth = ?");
+    params.push(input.delegation_depth);
+  }
   if (input.working_dir !== undefined) {
     sets.push("working_dir = ?");
     params.push(input.working_dir);

package/dist/types/index.d.ts

@@ -562,6 +562,24 @@ export interface UpdateTaskInput {
     requires_approval?: boolean;
     approved_by?: string;
     recurrence_rule?: string | null;
+    /**
+     * Who handed this row over. Stamped at creation from `agent_id` and, until
+     * `todos delegate`, WRITE-ONCE by omission rather than by design — there was
+     * no update branch, so a task filed by one agent and later dispatched by
+     * another kept naming the filer. Distinct from `agent_id` (who owns the row)
+     * and `created_by` (who filed it, which stays write-once).
+     */
+    assigned_by?: string | null;
+    /**
+     * The parent in the delegation chain. Column present since migration 520 and
+     * hardcoded to `null` at every creation site, so nothing could ever set it.
+     */
+    delegated_from?: string | null;
+    /**
+     * How deep this row sits in the delegation chain. Column present since
+     * migration 521 and hardcoded to `0` at every creation site.
+     */
+    delegation_depth?: number;
     version: number;
     task_type?: string | null;
 }