aitasks 1.3.2 → 1.3.3

package/dist/index.js

@@ -1890,7 +1890,7 @@ var require_commander = __commonJS((exports) => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "aitasks",
-    version: "1.3.2",
+    version: "1.3.3",
     description: "CLI task management tool built for AI agents",
     type: "module",
     bin: {
@@ -29420,17 +29420,22 @@ ${reviewRequired ? `3. Submit for review \u2014 you CANNOT mark done directly:
    \`\`\`bash
    aitasks review TASK-001 --agent $AITASKS_AGENT_ID
    \`\`\`
+   **STOP HERE. Do not run \`aitasks done\` yourself.** The system will block self-approval.
 
-4. **IMMEDIATELY spawn a review sub-agent** \u2014 do NOT move to other tasks until review resolves.
-   The task is still incomplete. The review sub-agent must either:
-   - **Approve** (moves task to done):
-     \`\`\`bash
-     aitasks done TASK-001 --agent <review-agent-id>
-     \`\`\`
-   - **Reject** (sends task back to in_progress with feedback):
-     \`\`\`bash
-     aitasks reject TASK-001 --reason "<specific feedback>" --agent <review-agent-id>
-     \`\`\`
+4. **IMMEDIATELY spawn a review sub-agent with a DIFFERENT agent ID** to inspect the implementation.
+   The review sub-agent must first register itself, then approve or reject:
+   \`\`\`bash
+   # Review sub-agent registers itself
+   aitasks heartbeat --agent <review-agent-id>
+
+   # Approve (moves task to done):
+   aitasks done TASK-001 --agent <review-agent-id>
+
+   # OR reject (sends task back to in_progress with feedback):
+   aitasks reject TASK-001 --reason "<specific feedback>" --agent <review-agent-id>
+   \`\`\`
+   The task is still incomplete until the review agent approves it.
+   **The system will block approval from any agent that has not registered or that submitted the review itself.**
 
 5. If rejected: address the feedback, re-check criteria, and repeat from step 3.
 
@@ -29479,7 +29484,7 @@ aitasks unclaim TASK-001 --agent $AITASKS_AGENT_ID --reason "Blocked on missing
 6. If a task needs splitting, create subtasks BEFORE marking parent done.
 7. Your evidence strings must be concrete and verifiable \u2014 not vague affirmations.
 8. Always provide --desc and at least one --ac when creating a task. Both are required.${reviewRequired ? `
-9. NEVER move a task to done directly. Always submit for review first with \`aitasks review\`, then IMMEDIATELY spawn a review sub-agent. Do NOT work on other tasks until the review resolves. A task is only complete when its status is \`done\`.` : ""}
+9. NEVER move a task to done directly. Always submit for review first with \`aitasks review\`, then IMMEDIATELY spawn a review sub-agent with a DIFFERENT agent ID. Do NOT call \`aitasks done\` yourself after submitting for review \u2014 the system blocks self-approval.` : ""}
 
 ---
 
@@ -30448,16 +30453,43 @@ function completeTask(taskId, agentId) {
   if (unchecked.length > 0) {
     return { task: null, error: "Not all acceptance criteria are verified", unchecked };
   }
-  if (getReviewRequired() && task.status !== "review") {
-    return {
-      task: null,
-      error: `Review required: submit this task for review first.
+  if (getReviewRequired()) {
+    if (task.status !== "review") {
+      return {
+        task: null,
+        error: `Review required: submit this task for review first.
 ` + `  1. aitasks review <taskId> --agent $AITASKS_AGENT_ID
 ` + `  2. Spawn a review sub-agent to inspect the work
 ` + `  3. Review agent approves: aitasks done <taskId> --agent <review-agent-id>
 ` + `     Review agent rejects: aitasks reject <taskId> --reason "<feedback>"
 ` + "  Tasks cannot be moved to Done without a passing review."
-    };
+      };
+    }
+    if (task.assigned_to && task.assigned_to === agentId) {
+      return {
+        task: null,
+        error: `Self-approval blocked: ${agentId} is the implementing agent and cannot approve their own review.
+` + `  A separate review sub-agent must run: aitasks done ${taskId} --agent <review-agent-id>`
+      };
+    }
+    const events = getTaskEvents(taskId);
+    const reviewEvent = [...events].reverse().find((e2) => e2.event_type === "review_requested");
+    if (reviewEvent?.agent_id && reviewEvent.agent_id === agentId) {
+      return {
+        task: null,
+        error: `Self-approval blocked: ${agentId} submitted this task for review and cannot also approve it.
+` + `  A separate review sub-agent must run: aitasks done ${taskId} --agent <review-agent-id>`
+      };
+    }
+    const knownAgent = db.query(`SELECT id FROM agents WHERE id = ?`).get(agentId);
+    if (!knownAgent) {
+      return {
+        task: null,
+        error: `Unknown review agent: '${agentId}' has not registered with the system.
+` + `  A real review sub-agent must register first by running any aitasks command
+` + `  (e.g. aitasks heartbeat --agent ${agentId}) before it can approve a review.`
+      };
+    }
   }
   const updated = updateTask(taskId, { status: "done", completed_at: Date.now() });
   logEvent({ task_id: taskId, agent_id: agentId, event_type: "completed", payload: {} });
@@ -41322,10 +41354,10 @@ var reviewCommand = new Command("review").description("Request human review for
         id: taskId,
         success: true,
         status: "review",
-        next_action: "REQUIRED: Spawn a review sub-agent immediately. This task is NOT complete until the review agent approves it.",
+        next_action: `REQUIRED: Spawn a review sub-agent immediately with a DIFFERENT agent ID (e.g. review-${taskId.toLowerCase()}). Do NOT call aitasks done yourself \u2014 the system will block self-approval.`,
         review_commands: {
-          approve: `aitasks done ${taskId} --agent <review-agent-id>`,
-          reject: `aitasks reject ${taskId} --reason "<specific feedback>" --agent <review-agent-id>`
+          approve: `aitasks done ${taskId} --agent review-${taskId.toLowerCase()}`,
+          reject: `aitasks reject ${taskId} --reason "<specific feedback>" --agent review-${taskId.toLowerCase()}`
         }
       });
     } else {
@@ -41340,10 +41372,16 @@ var reviewCommand = new Command("review").description("Request human review for
         console.log(`  You MUST ${source_default.bold("immediately spawn a review sub-agent")} to inspect the implementation.`);
         console.log(source_default.dim("  The task remains incomplete until the review agent moves it to done."));
         console.log("");
+        console.log(source_default.yellow("  \u2716 ") + source_default.bold("STOP \u2014 do NOT run `aitasks done` yourself."));
+        console.log(source_default.dim("  The system will block self-approval. A separate agent must do the review."));
+        console.log("");
         console.log(source_default.dim("  Review sub-agent steps:"));
-        console.log(source_default.dim(`  1. Examine implementation and verify all acceptance criteria`));
-        console.log(source_default.dim(`  2. Approve:  aitasks done ${task.id} --agent <review-agent-id>`));
-        console.log(source_default.dim(`     Reject:   aitasks reject ${task.id} --reason "<feedback>" --agent <review-agent-id>`));
+        console.log(source_default.dim(`  1. Spawn a sub-agent with a unique agent ID, e.g. review-${task.id.toLowerCase()}`));
+        console.log(source_default.dim(`  2. Sub-agent registers:  aitasks heartbeat --agent review-${task.id.toLowerCase()}`));
+        console.log(source_default.dim(`  3. Sub-agent examines implementation and verifies all acceptance criteria`));
+        console.log(source_default.dim(`  4. Approve:  aitasks done ${task.id} --agent review-${task.id.toLowerCase()}`));
+        console.log(source_default.dim(`     Reject:   aitasks reject ${task.id} --reason "<feedback>" --agent review-${task.id.toLowerCase()}`));
+        console.log(source_default.dim(`  The system will reject approval from unregistered or self-approving agents.`));
       } else {
         console.log(source_default.dim(`     Approve: aitasks done ${task.id} --agent <review-agent-id>`));
         console.log(source_default.dim(`     Reject:  aitasks reject ${task.id} --reason "<feedback>"`));
@@ -43280,4 +43318,4 @@ program2.parseAsync(process.argv).catch((err) => {
   process.exit(1);
 });
 
-//# debugId=3AB57D11F115EBBB64756E2164756E21
+//# debugId=62CCA2B3357C2C9A64756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aitasks",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "CLI task management tool built for AI agents",
   "type": "module",
   "bin": {