aitasks 1.3.2 → 1.3.4

package/README.md

@@ -140,7 +140,8 @@ aitasks create \
   --ac "Returns 200" \          # Acceptance criterion (repeatable, at least one required)
   --priority high \             # critical | high | medium | low
   --type feature \              # feature | bug | chore | spike
-  --parent TASK-001             # Parent task ID (optional)
+  --parent TASK-001 \           # Parent task ID (optional)
+  --agent $AITASKS_AGENT_ID     # Agent creating the task (logged in event history)
 ```
 
 ---

package/dist/index.js

@@ -1890,7 +1890,7 @@ var require_commander = __commonJS((exports) => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "aitasks",
-    version: "1.3.2",
+    version: "1.3.4",
     description: "CLI task management tool built for AI agents",
     type: "module",
     bin: {
@@ -29071,7 +29071,7 @@ import { join as join3 } from "path";
 import { existsSync as existsSync3 } from "fs";
 
 // src/db/schema.ts
-var SCHEMA_VERSION = 2;
+var SCHEMA_VERSION = 3;
 function runMigrations(db) {
   const row = db.query(`SELECT value FROM meta WHERE key = 'schema_version'`).get();
   const current = row ? parseInt(row.value, 10) : 1;
@@ -29080,6 +29080,11 @@ function runMigrations(db) {
     db.exec(`INSERT OR IGNORE INTO meta (key, value) VALUES ('review_required', 'false')`);
     db.exec(`UPDATE meta SET value = '2' WHERE key = 'schema_version'`);
   }
+  if (current < 3) {
+    db.exec(`ALTER TABLE agents ADD COLUMN first_seen INTEGER`);
+    db.exec(`UPDATE agents SET first_seen = last_seen WHERE first_seen IS NULL`);
+    db.exec(`UPDATE meta SET value = '3' WHERE key = 'schema_version'`);
+  }
 }
 function initializeSchema(db) {
   db.exec(`
@@ -29111,6 +29116,7 @@ function initializeSchema(db) {
 
     CREATE TABLE IF NOT EXISTS agents (
       id           TEXT PRIMARY KEY,
+      first_seen   INTEGER NOT NULL,
       last_seen    INTEGER NOT NULL,
       current_task TEXT REFERENCES tasks(id) ON DELETE SET NULL
     );
@@ -29383,7 +29389,7 @@ Always note:
 
 Creating subtasks:
 \`\`\`bash
-aitasks create --title "Write unit tests for auth" --desc "Add unit tests covering all auth edge cases" --ac "All tests pass" --ac "Coverage \u2265 90%" --parent TASK-001 --priority high --type chore
+aitasks create --title "Write unit tests for auth" --desc "Add unit tests covering all auth edge cases" --ac "All tests pass" --ac "Coverage \u2265 90%" --parent TASK-001 --priority high --type chore --agent $AITASKS_AGENT_ID
 \`\`\`
 
 If you discover your task is blocked by something:
@@ -29420,17 +29426,22 @@ ${reviewRequired ? `3. Submit for review \u2014 you CANNOT mark done directly:
    \`\`\`bash
    aitasks review TASK-001 --agent $AITASKS_AGENT_ID
    \`\`\`
+   **STOP HERE. Do not run \`aitasks done\` yourself.** The system will block self-approval.
+
+4. **IMMEDIATELY spawn a review sub-agent with a DIFFERENT agent ID** to inspect the implementation.
+   The review sub-agent must first register itself, then approve or reject:
+   \`\`\`bash
+   # Review sub-agent registers itself
+   aitasks heartbeat --agent <review-agent-id>
 
-4. **IMMEDIATELY spawn a review sub-agent** \u2014 do NOT move to other tasks until review resolves.
-   The task is still incomplete. The review sub-agent must either:
-   - **Approve** (moves task to done):
-     \`\`\`bash
-     aitasks done TASK-001 --agent <review-agent-id>
-     \`\`\`
-   - **Reject** (sends task back to in_progress with feedback):
-     \`\`\`bash
-     aitasks reject TASK-001 --reason "<specific feedback>" --agent <review-agent-id>
-     \`\`\`
+   # Approve (moves task to done):
+   aitasks done TASK-001 --agent <review-agent-id>
+
+   # OR reject (sends task back to in_progress with feedback):
+   aitasks reject TASK-001 --reason "<specific feedback>" --agent <review-agent-id>
+   \`\`\`
+   The task is still incomplete until the review agent approves it.
+   **The system will block approval from any agent that has not registered or that submitted the review itself.**
 
 5. If rejected: address the feedback, re-check criteria, and repeat from step 3.
 
@@ -29478,8 +29489,8 @@ aitasks unclaim TASK-001 --agent $AITASKS_AGENT_ID --reason "Blocked on missing
 5. Add implementation notes continuously, not just at the end.
 6. If a task needs splitting, create subtasks BEFORE marking parent done.
 7. Your evidence strings must be concrete and verifiable \u2014 not vague affirmations.
-8. Always provide --desc and at least one --ac when creating a task. Both are required.${reviewRequired ? `
-9. NEVER move a task to done directly. Always submit for review first with \`aitasks review\`, then IMMEDIATELY spawn a review sub-agent. Do NOT work on other tasks until the review resolves. A task is only complete when its status is \`done\`.` : ""}
+8. Always provide --desc, at least one --ac, and --agent when creating a task. All three are required.${reviewRequired ? `
+9. NEVER move a task to done directly. Always submit for review first with \`aitasks review\`, then IMMEDIATELY spawn a review sub-agent with a DIFFERENT agent ID. Do NOT call \`aitasks done\` yourself after submitting for review \u2014 the system blocks self-approval.` : ""}
 
 ---
 
@@ -29491,7 +29502,7 @@ aitasks list [--status <s>] [--json]        List tasks
 aitasks show <id>                           Full task detail (includes time tracking)
 aitasks search <query>                      Search titles, descriptions, notes
 aitasks deps <id>                           Show dependency tree
-aitasks create --title <t> --desc <d> --ac <c> [--ac <c> ...]   Create a task
+aitasks create --title <t> --desc <d> --ac <c> [--ac <c> ...] --agent <id>   Create a task
 aitasks claim <id...> --agent <id>          Claim task(s) - supports patterns like TASK-0*
 aitasks start <id...> --agent <id>          Begin work on task(s)
 aitasks note <id> <text> --agent <id>       Add implementation note
@@ -30318,7 +30329,7 @@ function createTask(data) {
     now,
     JSON.stringify(data.metadata ?? {})
   ]);
-  logEvent({ task_id: id, event_type: "created", payload: { title: data.title } });
+  logEvent({ task_id: id, agent_id: data.created_by, event_type: "created", payload: { title: data.title } });
   return getTask(id);
 }
 var JSON_FIELDS = new Set([
@@ -30404,9 +30415,9 @@ function claimTask(taskId, agentId) {
       error: `Task is blocked by: ${task.blocked_by.join(", ")}. Complete those first.`
     };
   }
-  db.run(`INSERT INTO agents (id, last_seen, current_task)
-     VALUES (?, ?, ?)
-     ON CONFLICT(id) DO UPDATE SET last_seen = excluded.last_seen, current_task = excluded.current_task`, [agentId, Date.now(), taskId]);
+  db.run(`INSERT INTO agents (id, first_seen, last_seen, current_task)
+     VALUES (?, ?, ?, ?)
+     ON CONFLICT(id) DO UPDATE SET last_seen = excluded.last_seen, current_task = excluded.current_task`, [agentId, Date.now(), Date.now(), taskId]);
   const updated = updateTask(taskId, { assigned_to: agentId, status: "ready" });
   logEvent({ task_id: taskId, agent_id: agentId, event_type: "claimed", payload: {} });
   return { task: updated };
@@ -30422,9 +30433,9 @@ function startTask(taskId, agentId) {
   }
   const db = getDb();
   if (!task.assigned_to) {
-    db.run(`INSERT INTO agents (id, last_seen, current_task)
-       VALUES (?, ?, ?)
-       ON CONFLICT(id) DO UPDATE SET last_seen = excluded.last_seen, current_task = excluded.current_task`, [agentId, Date.now(), taskId]);
+    db.run(`INSERT INTO agents (id, first_seen, last_seen, current_task)
+       VALUES (?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET last_seen = excluded.last_seen, current_task = excluded.current_task`, [agentId, Date.now(), Date.now(), taskId]);
   }
   const updated = updateTask(taskId, {
     assigned_to: agentId,
@@ -30448,16 +30459,45 @@ function completeTask(taskId, agentId) {
   if (unchecked.length > 0) {
     return { task: null, error: "Not all acceptance criteria are verified", unchecked };
   }
-  if (getReviewRequired() && task.status !== "review") {
-    return {
-      task: null,
-      error: `Review required: submit this task for review first.
+  if (getReviewRequired()) {
+    if (task.status !== "review") {
+      return {
+        task: null,
+        error: `Review required: submit this task for review first.
 ` + `  1. aitasks review <taskId> --agent $AITASKS_AGENT_ID
 ` + `  2. Spawn a review sub-agent to inspect the work
 ` + `  3. Review agent approves: aitasks done <taskId> --agent <review-agent-id>
 ` + `     Review agent rejects: aitasks reject <taskId> --reason "<feedback>"
 ` + "  Tasks cannot be moved to Done without a passing review."
-    };
+      };
+    }
+    if (task.assigned_to && task.assigned_to === agentId) {
+      return {
+        task: null,
+        error: `Self-approval blocked: ${agentId} is the implementing agent and cannot approve their own review.
+` + `  A separate review sub-agent must run: aitasks done ${taskId} --agent <review-agent-id>`
+      };
+    }
+    const events = getTaskEvents(taskId);
+    const reviewEvent = [...events].reverse().find((e2) => e2.event_type === "review_requested");
+    if (reviewEvent?.agent_id && reviewEvent.agent_id === agentId) {
+      return {
+        task: null,
+        error: `Self-approval blocked: ${agentId} submitted this task for review and cannot also approve it.
+` + `  A separate review sub-agent must run: aitasks done ${taskId} --agent <review-agent-id>`
+      };
+    }
+    const reviewerRow = db.query(`SELECT first_seen FROM agents WHERE id = ?`).get(agentId);
+    const reviewSubmittedAt = reviewEvent?.created_at ?? 0;
+    if (!reviewerRow || reviewerRow.first_seen > reviewSubmittedAt) {
+      return {
+        task: null,
+        error: `Review agent '${agentId}' was not active before this review was submitted.
+` + `  A real review sub-agent must be independently spawned \u2014 it cannot be registered
+` + `  moments before approving. The reviewer must have prior activity in the system
+` + `  before the review was submitted.`
+      };
+    }
   }
   const updated = updateTask(taskId, { status: "done", completed_at: Date.now() });
   logEvent({ task_id: taskId, agent_id: agentId, event_type: "completed", payload: {} });
@@ -30589,9 +30629,9 @@ function unclaimTask(taskId, agentId, reason) {
 }
 function heartbeat(agentId, taskId) {
   const db = getDb();
-  db.run(`INSERT INTO agents (id, last_seen, current_task)
-     VALUES (?, ?, ?)
-     ON CONFLICT(id) DO UPDATE SET last_seen = excluded.last_seen`, [agentId, Date.now(), taskId ?? null]);
+  db.run(`INSERT INTO agents (id, first_seen, last_seen, current_task)
+     VALUES (?, ?, ?, ?)
+     ON CONFLICT(id) DO UPDATE SET last_seen = excluded.last_seen`, [agentId, Date.now(), Date.now(), taskId ?? null]);
 }
 function listAgents() {
   const db = getDb();
@@ -30689,7 +30729,7 @@ function exitError(msg, json) {
 }
 
 // src/commands/create.ts
-var createCommand2 = new Command("create").description("Create a new task").option("-t, --title <title>", "Task title").option("-d, --desc <description>", "Task description").option("-a, --ac <criterion>", "Acceptance criterion (repeatable)", collect, []).option("-p, --priority <priority>", "Priority: critical|high|medium|low", "medium").option("--type <type>", "Type: feature|bug|chore|spike", "feature").option("--parent <taskId>", "Parent task ID for subtasks").option("--json", "Output as JSON").action(async (opts) => {
+var createCommand2 = new Command("create").description("Create a new task").option("-t, --title <title>", "Task title").option("-d, --desc <description>", "Task description").option("-a, --ac <criterion>", "Acceptance criterion (repeatable)", collect, []).option("-p, --priority <priority>", "Priority: critical|high|medium|low", "medium").option("--type <type>", "Type: feature|bug|chore|spike", "feature").option("--parent <taskId>", "Parent task ID for subtasks").option("--agent <agentId>", "Agent ID creating this task (or set AITASKS_AGENT_ID)").option("--json", "Output as JSON").action(async (opts) => {
   requireInitialized();
   const json = isJsonMode(opts.json);
   if (opts.title) {
@@ -30714,13 +30754,15 @@ var createCommand2 = new Command("create").description("Create a new task").opti
         process.exit(1);
       }
     }
+    const aid = agentId(opts.agent) ?? undefined;
     const task2 = createTask({
       title: opts.title,
       description: opts.desc ?? "",
       acceptance_criteria: opts.ac,
       priority: opts.priority,
       type: opts.type,
-      parent_id: opts.parent
+      parent_id: opts.parent,
+      created_by: aid
     });
     if (json)
       return jsonOut(true, task2);
@@ -41322,10 +41364,10 @@ var reviewCommand = new Command("review").description("Request human review for
         id: taskId,
         success: true,
         status: "review",
-        next_action: "REQUIRED: Spawn a review sub-agent immediately. This task is NOT complete until the review agent approves it.",
+        next_action: `REQUIRED: Spawn a review sub-agent immediately with a DIFFERENT agent ID (e.g. review-${taskId.toLowerCase()}). Do NOT call aitasks done yourself \u2014 the system will block self-approval.`,
         review_commands: {
-          approve: `aitasks done ${taskId} --agent <review-agent-id>`,
-          reject: `aitasks reject ${taskId} --reason "<specific feedback>" --agent <review-agent-id>`
+          approve: `aitasks done ${taskId} --agent review-${taskId.toLowerCase()}`,
+          reject: `aitasks reject ${taskId} --reason "<specific feedback>" --agent review-${taskId.toLowerCase()}`
         }
       });
     } else {
@@ -41340,10 +41382,16 @@ var reviewCommand = new Command("review").description("Request human review for
         console.log(`  You MUST ${source_default.bold("immediately spawn a review sub-agent")} to inspect the implementation.`);
         console.log(source_default.dim("  The task remains incomplete until the review agent moves it to done."));
         console.log("");
+        console.log(source_default.yellow("  \u2716 ") + source_default.bold("STOP \u2014 do NOT run `aitasks done` yourself."));
+        console.log(source_default.dim("  The system will block self-approval. A separate agent must do the review."));
+        console.log("");
         console.log(source_default.dim("  Review sub-agent steps:"));
-        console.log(source_default.dim(`  1. Examine implementation and verify all acceptance criteria`));
-        console.log(source_default.dim(`  2. Approve:  aitasks done ${task.id} --agent <review-agent-id>`));
-        console.log(source_default.dim(`     Reject:   aitasks reject ${task.id} --reason "<feedback>" --agent <review-agent-id>`));
+        console.log(source_default.dim(`  1. Spawn a sub-agent with a unique agent ID, e.g. review-${task.id.toLowerCase()}`));
+        console.log(source_default.dim(`  2. Sub-agent registers:  aitasks heartbeat --agent review-${task.id.toLowerCase()}`));
+        console.log(source_default.dim(`  3. Sub-agent examines implementation and verifies all acceptance criteria`));
+        console.log(source_default.dim(`  4. Approve:  aitasks done ${task.id} --agent review-${task.id.toLowerCase()}`));
+        console.log(source_default.dim(`     Reject:   aitasks reject ${task.id} --reason "<feedback>" --agent review-${task.id.toLowerCase()}`));
+        console.log(source_default.dim(`  The system will reject approval from unregistered or self-approving agents.`));
       } else {
         console.log(source_default.dim(`     Approve: aitasks done ${task.id} --agent <review-agent-id>`));
         console.log(source_default.dim(`     Reject:  aitasks reject ${task.id} --reason "<feedback>"`));
@@ -43280,4 +43328,4 @@ program2.parseAsync(process.argv).catch((err) => {
   process.exit(1);
 });
 
-//# debugId=3AB57D11F115EBBB64756E2164756E21
+//# debugId=6CE8123AAE8C303564756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aitasks",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "CLI task management tool built for AI agents",
   "type": "module",
   "bin": {