aibroker 0.13.1 → 0.14.0

package/dist/daemon/todoist-oauth.js

@@ -0,0 +1,182 @@
+/**
+ * daemon/todoist-oauth.ts — the OAuth landing the redirect URL actually needs.
+ *
+ * Todoist does not deliver webhooks to the account that created the app. The
+ * app has to be authorised like any third party would authorise it, and the
+ * console's "install for myself" button does not do that — only a completed
+ * OAuth round trip does. Todoist's own guidance is to run the flow by hand and
+ * lift the `code` out of the address bar with developer tools, then exchange it
+ * from a separate HTTP client because the exchange has to be a POST.
+ *
+ * That instruction is a description of a missing endpoint. The redirect URL is
+ * ours; if it serves nothing, the browser lands on a 404 and the human has to
+ * play proxy for a machine-to-machine step. So we serve it: this module takes
+ * the `code` off the redirect, does the token exchange itself, stores the token
+ * and reports what happened — on the page and in the audit trail.
+ *
+ * The state parameter is not decoration. `aibroker todoist auth` mints one and
+ * records it; a callback that cannot present it is refused, because otherwise
+ * anyone who can reach the redirect can drive a code of their choosing into
+ * this exchange.
+ */
+import { randomBytes } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync, existsSync, unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { log } from "../core/log.js";
+import { audit } from "./audit.js";
+const STATE_DIR = join(homedir(), ".aibroker");
+const TOKEN_FILE = join(STATE_DIR, "todoist-oauth.json");
+const PENDING_FILE = join(STATE_DIR, "todoist-oauth-pending.json");
+/** A pending authorisation is only good for one attempt, and not for long. */
+const PENDING_TTL_MS = 15 * 60 * 1000;
+function writePrivate(file, data) {
+    mkdirSync(STATE_DIR, { recursive: true });
+    writeFileSync(file, JSON.stringify(data, null, 2), "utf-8");
+    // The token is a bearer credential for the whole account. Group and world
+    // have no business reading it, and the default umask is not a guarantee.
+    chmodSync(file, 0o600);
+}
+function readJson(file) {
+    if (!existsSync(file))
+        return null;
+    try {
+        return JSON.parse(readFileSync(file, "utf-8"));
+    }
+    catch {
+        // A corrupt file is not a reason to erase it — see core/json-store.
+        return null;
+    }
+}
+/** Mint and record the state for one authorisation attempt. */
+export function beginAuth() {
+    const state = randomBytes(16).toString("hex");
+    writePrivate(PENDING_FILE, { state, created_at: new Date().toISOString() });
+    return state;
+}
+/**
+ * Check a callback's state against the recorded one and consume it.
+ *
+ * Returns a reason when it does not hold up, so the caller can say precisely
+ * what was wrong rather than "invalid request".
+ */
+export function consumeState(got) {
+    const pending = readJson(PENDING_FILE);
+    if (!pending)
+        return { ok: false, reason: "no authorisation is in progress — run `aibroker todoist auth` first" };
+    if (Date.now() - Date.parse(pending.created_at) > PENDING_TTL_MS) {
+        unlinkSync(PENDING_FILE);
+        return { ok: false, reason: "the authorisation attempt expired — run `aibroker todoist auth` again" };
+    }
+    if (!got || got !== pending.state)
+        return { ok: false, reason: "state did not match the pending authorisation" };
+    unlinkSync(PENDING_FILE);
+    return { ok: true };
+}
+export function loadToken() {
+    return readJson(TOKEN_FILE);
+}
+export function saveToken(t) {
+    writePrivate(TOKEN_FILE, t);
+}
+/** Build the URL a browser has to visit to authorise the app. */
+export function authorizeUrl(clientId, scope, state) {
+    const q = new URLSearchParams({ client_id: clientId, scope, state });
+    return `https://todoist.com/oauth/authorize?${q.toString()}`;
+}
+/**
+ * Trade the authorisation code for a token.
+ *
+ * Kept separate from the request handler so the exchange can be tested and so
+ * the secret is used in exactly one place.
+ */
+export async function exchangeCode(clientId, clientSecret, code, fetchImpl = fetch) {
+    const res = await fetchImpl("https://todoist.com/oauth/access_token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ client_id: clientId, client_secret: clientSecret, code }).toString(),
+    });
+    const text = await res.text();
+    if (!res.ok)
+        throw new Error(`token exchange returned ${res.status}: ${text.slice(0, 200)}`);
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`token exchange returned unparseable body: ${text.slice(0, 200)}`);
+    }
+    if (body.error)
+        throw new Error(`token exchange refused: ${body.error}`);
+    if (!body.access_token)
+        throw new Error("token exchange returned no access_token");
+    return {
+        access_token: body.access_token,
+        token_type: body.token_type ?? "Bearer",
+        scope: body.scope,
+        obtained_at: new Date().toISOString(),
+    };
+}
+function page(title, detail, ok) {
+    const accent = ok ? "#2d7a4b" : "#a33";
+    return `<!doctype html><meta charset="utf-8"><title>${title}</title>
+<style>
+ body{font:16px/1.5 -apple-system,system-ui,sans-serif;margin:0;display:grid;place-items:center;height:100vh;background:#faf9f7;color:#1a1a1a}
+ main{max-width:34rem;padding:2rem}
+ h1{font-size:1.3rem;margin:0 0 .6rem;color:${accent}}
+ p{margin:.4rem 0;color:#444}
+ code{background:#eee;padding:.1rem .3rem;border-radius:3px;font-size:.9em}
+ @media(prefers-color-scheme:dark){body{background:#141414;color:#eee}p{color:#bbb}code{background:#2a2a2a}}
+</style>
+<main><h1>${title}</h1><p>${detail}</p></main>`;
+}
+/**
+ * Handle the redirect Todoist sends the browser to.
+ *
+ * Always answers with a readable page — this is the one endpoint here a human
+ * looks at directly, and "404" taught the last person to debug it nothing.
+ */
+export async function handleOAuthCallback(url, deps) {
+    const fail = (status, title, detail, reason) => {
+        audit({ action: "todoist-oauth", actor: "todoist", target: "aibroker", outcome: "failed", reason });
+        log(`todoist-oauth: ${reason}`);
+        return { status, html: page(title, detail, false) };
+    };
+    const denied = url.searchParams.get("error");
+    if (denied) {
+        return fail(400, "Authorisation declined", `Todoist reported <code>${denied}</code>. Nothing was changed.`, `authorisation declined by Todoist: ${denied}`);
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+        return fail(400, "Nothing to exchange", "This is the OAuth landing for the AIBroker Todoist bridge. It expects a <code>code</code> from Todoist; " +
+            "opening it directly does nothing. Start with <code>aibroker todoist auth</code>.", "callback carried no code");
+    }
+    if (!deps.clientId) {
+        return fail(500, "Not configured", "Set <code>TODOIST_CLIENT_ID</code> in <code>~/.aibroker/env</code> and restart the daemon — " +
+            "the exchange cannot be made without it.", "TODOIST_CLIENT_ID is not set");
+    }
+    const state = consumeState(url.searchParams.get("state"));
+    if (!state.ok) {
+        return fail(400, "Unexpected callback", state.reason, `state check failed: ${state.reason}`);
+    }
+    try {
+        const token = await exchangeCode(deps.clientId, deps.clientSecret, code, deps.fetchImpl);
+        saveToken(token);
+        audit({
+            action: "todoist-oauth", actor: "todoist", target: "aibroker", outcome: "authorized",
+            // The token itself is never recorded — only that one was obtained, and for what.
+            meta: { scope: token.scope },
+        });
+        log(`todoist-oauth: authorised, scope ${token.scope ?? "(unreported)"}`);
+        return {
+            status: 200,
+            html: page("Authorised", `AIBroker can now act on this Todoist account${token.scope ? ` with <code>${token.scope}</code>` : ""}. ` +
+                "Webhooks will be delivered from now on. You can close this tab.", true),
+        };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return fail(502, "Exchange failed", reason, reason);
+    }
+}
+//# sourceMappingURL=todoist-oauth.js.map

package/dist/daemon/todoist-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-oauth.js","sourceRoot":"","sources":["../../src/daemon/todoist-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AACzD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;AAenE,8EAA8E;AAC9E,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAS,YAAY,CAAC,IAAY,EAAE,IAAa;IAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,yEAAyE;IACzE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAM,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,YAAY,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAoB,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAU,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC;IAClH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,cAAc,EAAE,CAAC;QACjE,UAAU,CAAC,YAAY,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IACjH,UAAU,CAAC,YAAY,CAAC,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,QAAQ,CAAc,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAc;IACtC,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa;IACzE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,OAAO,uCAAuC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,YAAoB,EACpB,IAAY,EACZ,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,wCAAwC,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;KACjG,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAE7F,IAAI,IAAoF,CAAC;IACzF,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAEnF,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;QACvC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,EAAW;IACtD,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,+CAA+C,KAAK;;;;8CAIf,MAAM;;;;;YAKxC,KAAK,WAAW,MAAM,aAAa,CAAC;AAChD,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAQ,EACR,IAAe;IAEf,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE;QAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACpG,GAAG,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;IACtD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,GAAG,EAAE,wBAAwB,EAAE,0BAA0B,MAAM,+BAA+B,EACxG,sCAAsC,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,EACpC,0GAA0G;YAC1G,kFAAkF,EAClF,0BAA0B,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAC/B,8FAA8F;YAC9F,yCAAyC,EACzC,8BAA8B,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,EAAE,uBAAuB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzF,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,CAAC;YACJ,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY;YACpF,iFAAiF;YACjF,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;SAC7B,CAAC,CAAC;QACH,GAAG,CAAC,oCAAoC,KAAK,CAAC,KAAK,IAAI,cAAc,EAAE,CAAC,CAAC;QACzE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,IAAI,CAAC,YAAY,EACrB,+CAA+C,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI;gBACzG,iEAAiE,EAAE,IAAI,CAAC;SAC3E,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/daemon/todoist-owners.d.ts

@@ -0,0 +1,23 @@
+/**
+ * daemon/todoist-owners.ts — which session took which task.
+ *
+ * A comment on a task is a correction to work already in flight: "actually, do
+ * it this way", "that's wrong, try again". It has to reach the session holding
+ * that work, and re-deriving the owner from the parent's project and labels is
+ * not the same thing. The original may have been addressed in its title — "pai
+ * send me a mail" — while the comment says only "make it next month". Re-derive
+ * and the correction lands on whatever the project or the default says, which
+ * is a different session than the one that did the work.
+ *
+ * So the owner is remembered at delivery and preferred at comment time.
+ *
+ * Bounded and on disk: bounded because this is a cache, not a ledger, and on
+ * disk because the daemon restarts more often than a conversation ends.
+ */
+/** Record who took a task, so a later comment on it reaches the same session. */
+export declare function rememberOwner(taskId: string, owner: string): void;
+/** Who took this task, if we still know. */
+export declare function ownerOf(taskId: string): string | undefined;
+/** Test seam: forget everything. */
+export declare function forgetAllOwners(): void;
+//# sourceMappingURL=todoist-owners.d.ts.map

package/dist/daemon/todoist-owners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-owners.d.ts","sourceRoot":"","sources":["../../src/daemon/todoist-owners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA8BH,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAUjE;AAED,4CAA4C;AAC5C,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED,oCAAoC;AACpC,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/daemon/todoist-owners.js

@@ -0,0 +1,60 @@
+/**
+ * daemon/todoist-owners.ts — which session took which task.
+ *
+ * A comment on a task is a correction to work already in flight: "actually, do
+ * it this way", "that's wrong, try again". It has to reach the session holding
+ * that work, and re-deriving the owner from the parent's project and labels is
+ * not the same thing. The original may have been addressed in its title — "pai
+ * send me a mail" — while the comment says only "make it next month". Re-derive
+ * and the correction lands on whatever the project or the default says, which
+ * is a different session than the one that did the work.
+ *
+ * So the owner is remembered at delivery and preferred at comment time.
+ *
+ * Bounded and on disk: bounded because this is a cache, not a ledger, and on
+ * disk because the daemon restarts more often than a conversation ends.
+ */
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { loadJson, saveJson } from "../core/json-store.js";
+const FILE = join(homedir(), ".aibroker", "todoist-owners.json");
+/** Enough for any live conversation; old entries are not worth keeping. */
+const MAX = 500;
+function empty() {
+    return { order: [], owners: {} };
+}
+function read() {
+    const r = loadJson(FILE);
+    // An unreadable cache is not a reason to lose the daemon: start empty and
+    // let the next delivery repopulate it. Never erase the file on a parse error
+    // — that is the bug core/json-store exists to avoid.
+    if (r.status === "ok" && Array.isArray(r.data?.order) && r.data?.owners)
+        return r.data;
+    return empty();
+}
+/** Record who took a task, so a later comment on it reaches the same session. */
+export function rememberOwner(taskId, owner) {
+    if (!taskId || !owner)
+        return;
+    const s = read();
+    if (!(taskId in s.owners))
+        s.order.push(taskId);
+    s.owners[taskId] = owner;
+    while (s.order.length > MAX) {
+        const drop = s.order.shift();
+        if (drop)
+            delete s.owners[drop];
+    }
+    saveJson(FILE, s);
+}
+/** Who took this task, if we still know. */
+export function ownerOf(taskId) {
+    if (!taskId)
+        return undefined;
+    return read().owners[taskId];
+}
+/** Test seam: forget everything. */
+export function forgetAllOwners() {
+    saveJson(FILE, empty());
+}
+//# sourceMappingURL=todoist-owners.js.map

package/dist/daemon/todoist-owners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-owners.js","sourceRoot":"","sources":["../../src/daemon/todoist-owners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;AAEjE,2EAA2E;AAC3E,MAAM,GAAG,GAAG,GAAG,CAAC;AAQhB,SAAS,KAAK;IACZ,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,IAAI;IACX,MAAM,CAAC,GAAG,QAAQ,CAAQ,IAAI,CAAC,CAAC;IAChC,0EAA0E;IAC1E,6EAA6E;IAC7E,qDAAqD;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACvF,OAAO,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa;IACzD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO;IAC9B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACjB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;QAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,eAAe;IAC7B,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1B,CAAC"}

package/dist/daemon/todoist-reply.d.ts

@@ -0,0 +1,58 @@
+/**
+ * daemon/todoist-reply.ts — answering on the task you were asked from.
+ *
+ * A task arriving here is often a question, not a work order, and until now the
+ * answer went to a terminal the asker was not looking at. Filing from a watch
+ * and reading the reply at a desk is not a channel; it is two half channels.
+ *
+ * So a session answers on the task itself. The comment carries the agent mark,
+ * which `route()` already drops before anything else, so our own writes cannot
+ * come back as instructions.
+ *
+ * Deliberately does NOT complete the task. Completion is the human saying done
+ * — the same rule the receiver enforces on the way in — and a question whose
+ * answer you have not read yet is not done. Left open, the task keeps its place
+ * in the list with a comment indicator; completed, it vanishes from view and
+ * the answer with it.
+ */
+export interface ReplyResult {
+    commentId: string;
+    taskId: string;
+}
+/** What a comment event needs from its parent task to be routable at all. */
+export interface ParentTask {
+    content: string;
+    projectId: string;
+    labels: string[];
+}
+/**
+ * Fetch the task a comment belongs to.
+ *
+ * A `note:added` payload carries `item_id` and the comment text and nothing
+ * else — no project, no labels. Without them the security boundary cannot be
+ * evaluated, so a comment is unroutable until its parent is resolved. This is
+ * the lookup that makes replying-by-comment possible at all.
+ */
+export declare function fetchParentTask(taskId: string, fetchImpl?: typeof fetch): Promise<ParentTask>;
+/**
+ * Post a comment on a task as the agent.
+ *
+ * The mark is added here rather than trusted to callers: every path that can
+ * write to Todoist has to be echo-safe, and "remember the prefix" is not a
+ * safety mechanism.
+ */
+export declare function replyToTask(taskId: string, text: string, fetchImpl?: typeof fetch): Promise<ReplyResult>;
+/**
+ * How many OPEN tasks in this project share a title.
+ *
+ * Two tasks called the same thing are indistinguishable in a list, so a reply
+ * posted on one looks — to whoever is watching the other — exactly like being
+ * ignored. That cost two full rounds today: comment routing was working
+ * perfectly and the answers were landing on a sibling nobody was looking at.
+ * Being ignored and being answered elsewhere must not look the same.
+ *
+ * Returns 1 in the ordinary case (this task alone) and 0 when it cannot tell —
+ * a lookup failure must not invent a duplicate warning.
+ */
+export declare function countTasksWithTitle(projectId: string, title: string, fetchImpl?: typeof fetch): Promise<number>;
+//# sourceMappingURL=todoist-reply.d.ts.map

package/dist/daemon/todoist-reply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-reply.d.ts","sourceRoot":"","sources":["../../src/daemon/todoist-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,WAAW,CAAC,CAiCtB;AAQD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,CA4BjB"}

package/dist/daemon/todoist-reply.js

@@ -0,0 +1,135 @@
+/**
+ * daemon/todoist-reply.ts — answering on the task you were asked from.
+ *
+ * A task arriving here is often a question, not a work order, and until now the
+ * answer went to a terminal the asker was not looking at. Filing from a watch
+ * and reading the reply at a desk is not a channel; it is two half channels.
+ *
+ * So a session answers on the task itself. The comment carries the agent mark,
+ * which `route()` already drops before anything else, so our own writes cannot
+ * come back as instructions.
+ *
+ * Deliberately does NOT complete the task. Completion is the human saying done
+ * — the same rule the receiver enforces on the way in — and a question whose
+ * answer you have not read yet is not done. Left open, the task keeps its place
+ * in the list with a comment indicator; completed, it vanishes from view and
+ * the answer with it.
+ */
+import { AGENT_MARK } from "./todoist-webhook.js";
+import { loadToken } from "./todoist-oauth.js";
+import { log } from "../core/log.js";
+import { audit } from "./audit.js";
+/**
+ * Fetch the task a comment belongs to.
+ *
+ * A `note:added` payload carries `item_id` and the comment text and nothing
+ * else — no project, no labels. Without them the security boundary cannot be
+ * evaluated, so a comment is unroutable until its parent is resolved. This is
+ * the lookup that makes replying-by-comment possible at all.
+ */
+export async function fetchParentTask(taskId, fetchImpl = fetch) {
+    const token = loadToken();
+    if (!token)
+        throw new Error("no Todoist authorisation on file — run `aibroker todoist auth`");
+    const res = await fetchImpl(`https://api.todoist.com/api/v1/tasks/${encodeURIComponent(taskId)}`, {
+        headers: { authorization: `${token.token_type} ${token.access_token}` },
+    });
+    const raw = await res.text();
+    if (!res.ok)
+        throw new Error(`task lookup failed with ${res.status}: ${raw.slice(0, 200)}`);
+    let t;
+    try {
+        t = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`task lookup returned unparseable body: ${raw.slice(0, 200)}`);
+    }
+    return {
+        content: t.content ?? "",
+        projectId: t.project_id ?? "",
+        labels: Array.isArray(t.labels) ? t.labels.map(String) : [],
+    };
+}
+/**
+ * Post a comment on a task as the agent.
+ *
+ * The mark is added here rather than trusted to callers: every path that can
+ * write to Todoist has to be echo-safe, and "remember the prefix" is not a
+ * safety mechanism.
+ */
+export async function replyToTask(taskId, text, fetchImpl = fetch) {
+    const token = loadToken();
+    if (!token) {
+        throw new Error("no Todoist authorisation on file — run `aibroker todoist auth`");
+    }
+    const body = text.trimStart().startsWith(AGENT_MARK) ? text : `${AGENT_MARK} ${text}`;
+    const res = await fetchImpl("https://api.todoist.com/api/v1/comments", {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `${token.token_type} ${token.access_token}`,
+        },
+        body: JSON.stringify({ task_id: taskId, content: body }),
+    });
+    const raw = await res.text();
+    if (!res.ok)
+        throw new Error(`comment failed with ${res.status}: ${raw.slice(0, 200)}`);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`comment returned unparseable body: ${raw.slice(0, 200)}`);
+    }
+    const result = { commentId: parsed.id ?? "?", taskId };
+    audit({
+        action: "todoist-reply", actor: "aibroker", target: `todoist:task:${taskId}`,
+        outcome: "posted", body,
+    });
+    log(`todoist-reply: commented on ${taskId}`);
+    return result;
+}
+/** Normalise a title the way a human comparing two list rows would. */
+function sameTitle(a, b) {
+    const n = (s) => s.trim().toLowerCase().replace(/\s+/g, " ");
+    return n(a) === n(b);
+}
+/**
+ * How many OPEN tasks in this project share a title.
+ *
+ * Two tasks called the same thing are indistinguishable in a list, so a reply
+ * posted on one looks — to whoever is watching the other — exactly like being
+ * ignored. That cost two full rounds today: comment routing was working
+ * perfectly and the answers were landing on a sibling nobody was looking at.
+ * Being ignored and being answered elsewhere must not look the same.
+ *
+ * Returns 1 in the ordinary case (this task alone) and 0 when it cannot tell —
+ * a lookup failure must not invent a duplicate warning.
+ */
+export async function countTasksWithTitle(projectId, title, fetchImpl = fetch) {
+    const token = loadToken();
+    if (!token || !projectId || !title.trim())
+        return 0;
+    const res = await fetchImpl(`https://api.todoist.com/api/v1/tasks?project_id=${encodeURIComponent(projectId)}`, { headers: { authorization: `${token.token_type} ${token.access_token}` } });
+    if (!res.ok)
+        return 0;
+    let body;
+    try {
+        body = JSON.parse(await res.text());
+    }
+    catch {
+        return 0;
+    }
+    // This endpoint has returned both a bare array and a {results:[…]} envelope
+    // across versions; accept either rather than silently counting zero.
+    const list = Array.isArray(body)
+        ? body
+        : Array.isArray(body?.results)
+            ? body.results
+            : [];
+    return list.filter((t) => {
+        const c = t?.content;
+        return typeof c === "string" && sameTitle(c, title);
+    }).length;
+}
+//# sourceMappingURL=todoist-reply.js.map

package/dist/daemon/todoist-reply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-reply.js","sourceRoot":"","sources":["../../src/daemon/todoist-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAcnC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,YAA0B,KAAK;IAE/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAE9F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,wCAAwC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE;QAChG,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE;KACxE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAE5F,IAAI,CAAgE,CAAC;IACrE,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;QACxB,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;QAC7B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,IAAY,EACZ,YAA0B,KAAK;IAE/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC;IAEtF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,yCAAyC,EAAE;QACrE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE;SAC3D;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAExF,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;IACvD,KAAK,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,MAAM,EAAE;QAC5E,OAAO,EAAE,QAAQ,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,GAAG,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,KAAa,EACb,YAA0B,KAAK;IAE/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,CAAC;IAEpD,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,mDAAmD,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAClF,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,EAAE,CAC5E,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAEtB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,IAAI,GAAc,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,OAAO,CAAE,IAAgC,EAAE,OAAO,CAAC;YACzD,CAAC,CAAE,IAA+B,CAAC,OAAO;YAC1C,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,CAAC,GAAI,CAA0B,EAAE,OAAO,CAAC;QAC/C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC,MAAM,CAAC;AACZ,CAAC"}

package/dist/daemon/todoist-webhook.d.ts

@@ -65,6 +65,21 @@ export interface WebhookConfig {
     bind: string;
     /** Path the receiver answers on. Anything else 404s. */
     path: string;
+    /**
+     * Client id from the App Management Console.
+     *
+     * Only needed for the OAuth landing below — the webhook path itself is
+     * verified by HMAC and never uses it.
+     */
+    clientId?: string;
+    /**
+     * Path the OAuth redirect lands on.
+     *
+     * Todoist rejects a redirect URL carrying a port, so this one cannot be
+     * reached over the same Funnel as the webhook. Put a tailnet-only Serve on
+     * 443 in front of it — see docs/todoist.md.
+     */
+    oauthPath: string;
     /**
      * Project ids allowed to reach a session. An explicit allowlist, not a
      * subtree resolved at runtime, and deliberately so: a project added later
@@ -80,14 +95,35 @@ export interface WebhookConfig {
      */
     defaultOwner?: string;
 }
+/** Which rule chose the owner. Recorded, so a wrong guess is visible. */
+export type OwnerRule = "label" | "address" | "held" | "project" | "default";
 export type RouteDecision = {
     act: true;
     project: string;
     body: string;
     taskId: string;
+    rule: OwnerRule;
+    nearMiss?: string;
 } | {
     act: false;
     reason: string;
+    nearMiss?: string;
+};
+/**
+ * Pull a leading session name off the content.
+ *
+ * Typing a label is several taps on a phone and worse on a watch, so the
+ * cheapest possible address is the first word: "pai send a whatsapp message".
+ * Only names we already know are accepted — otherwise "home improvements"
+ * becomes a work order for the Home session — and an explicit `name:` or
+ * `name,` counts as addressing even when the name is unknown, so that a typo
+ * can be reported instead of silently ignored.
+ */
+export declare function parseAddress(content: string, known: Set<string>): {
+    owner?: string;
+    rest: string;
+    firstToken: string | null;
+    addressed: boolean;
 };
 /**
  * Verify Todoist's HMAC over the RAW body.
@@ -104,14 +140,41 @@ export declare function eventKey(e: TodoistEvent): string;
  * Pure, so the routing rules are testable without a socket: this function is
  * the entire security boundary of the ingress.
  */
-export declare function route(e: TodoistEvent, cfg: WebhookConfig): RouteDecision;
+export declare function route(e: TodoistEvent, cfg: WebhookConfig, knownOwners?: Iterable<string>, 
+/**
+ * The session already holding this task, when we know it.
+ *
+ * Only meaningful for a comment: a follow-up belongs to whoever did the work,
+ * not to whatever the project mapping would pick today.
+ */
+heldBy?: string): RouteDecision;
 export interface WebhookDeps {
-    /** Deliver a work order. Returns a short outcome for the audit record. */
-    deliver: (project: string, body: string) => Promise<{
+    /**
+     * Deliver a work order. Returns a short outcome for the audit record.
+     *
+     * `prefix` distinguishes a correction from a new work order: `[Task]` reads
+     * as "start this", and a session that receives a comment under that heading
+     * will begin again rather than adjust.
+     */
+    deliver: (project: string, body: string, opts?: {
+        prefix?: string;
+    }) => Promise<{
         outcome: string;
         session: string;
         reason?: string;
     }>;
+    /**
+     * Names that may be used as an address in a task's first word.
+     *
+     * Must be the names DISPATCH can resolve, not merely the ones a human would
+     * recognise. Addressing a live session that dispatch has no alias for reads
+     * as success and delivers nothing — which is exactly how "paicloud send me a
+     * mail" was quietly answered by the wrong session.
+     *
+     * A function rather than a list: aliases and sessions both change while the
+     * daemon runs, and a name that was valid at boot need not be valid now.
+     */
+    knownOwners?: () => string[] | Promise<string[]>;
 }
 export declare function createWebhookServer(cfg: WebhookConfig, deps: WebhookDeps): Server;
 /** Read config from the environment. Returns null when not configured. */

package/dist/daemon/todoist-webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"todoist-webhook.d.ts","sourceRoot":"","sources":["../../src/daemon/todoist-webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAKjG,qFAAqF;AACrF,eAAO,MAAM,UAAU,iBAAO,CAAC;AAE/B,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,mFAAmF;IACnF,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOhG;AAED,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAGhD;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,GAAG,aAAa,CAkDxE;AAmBD,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5G;AAgBD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CA+EjF;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,IAAI,aAAa,GAAG,IAAI,CAuB3D;AAED,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAwBpE"}
+{"version":3,"file":"todoist-webhook.d.ts","sourceRoot":"","sources":["../../src/daemon/todoist-webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAMjG,qFAAqF;AACrF,eAAO,MAAM,UAAU,iBAAO,CAAC;AAE/B,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,mFAAmF;IACnF,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7E,MAAM,MAAM,aAAa,GACrB;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAChG;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AA6CtD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GACjB;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAOjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOhG;AAED,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAGhD;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CACnB,CAAC,EAAE,YAAY,EACf,GAAG,EAAE,aAAa,EAClB,WAAW,GAAE,QAAQ,CAAC,MAAM,CAAM;AAClC;;;;;GAKG;AACH,MAAM,CAAC,EAAE,MAAM,GACd,aAAa,CA6Ef;AAmBD,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KACjE,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAClD;AAgBD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAsMjF;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,IAAI,aAAa,GAAG,IAAI,CAyB3D;AAED,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CA0BpE"}