codebyplan 1.13.20 → 1.13.22

package/dist/cli.js

@@ -14,7 +14,7 @@ var VERSION, PACKAGE_NAME;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    VERSION = "1.13.20";
+    VERSION = "1.13.22";
     PACKAGE_NAME = "codebyplan";
   }
 });
@@ -1453,6 +1453,9 @@ function mergeHooksIntoSettings(settings, hooksJson) {
   return settings;
 }
 function mergeBaseSettingsIntoSettings(settings, base) {
+  for (const key of DEPRECATED_BASE_KEYS) {
+    delete settings[key];
+  }
   for (const key of SCALAR_BASE_KEYS) {
     if (base[key] !== void 0 && settings[key] === void 0) {
       settings[key] = base[key];
@@ -1508,6 +1511,9 @@ function mergeBaseSettingsIntoSettings(settings, base) {
   return settings;
 }
 function stripBaseSettingsFromSettings(settings, base) {
+  for (const key of DEPRECATED_BASE_KEYS) {
+    delete settings[key];
+  }
   for (const key of SCALAR_BASE_KEYS) {
     if (base[key] !== void 0 && settings[key] === base[key]) {
       delete settings[key];
@@ -1587,7 +1593,7 @@ function stripOwnedHooksFromSettings(settings) {
   }
   return settings;
 }
-var OWNER, PLACEHOLDER_RE, REPLACEMENT, SCALAR_BASE_KEYS;
+var OWNER, PLACEHOLDER_RE, REPLACEMENT, SCALAR_BASE_KEYS, DEPRECATED_BASE_KEYS;
 var init_settings_merge = __esm({
   "src/lib/settings-merge.ts"() {
     "use strict";
@@ -1599,7 +1605,6 @@ var init_settings_merge = __esm({
       "autoUpdatesChannel",
       "awaySummaryEnabled",
       "disableAgentView",
-      "disableRemoteControl",
       "editorMode",
       "outputStyle",
       "preferredNotifChannel",
@@ -1619,7 +1624,10 @@ var init_settings_merge = __esm({
       "autoMemoryEnabled",
       "effortLevel",
       "showClearContextOnPlanAccept",
-      "syntaxHighlightingDisabled",
+      "syntaxHighlightingDisabled"
+    ];
+    DEPRECATED_BASE_KEYS = [
+      "disableRemoteControl",
       "remoteControlAtStartup",
       "agentPushNotifEnabled"
     ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebyplan",
-  "version": "1.13.20",
+  "version": "1.13.22",
   "description": "CLI for CodeByPlan — AI-powered development planning and tracking",
   "type": "module",
   "bin": {

package/templates/rules/todo-backend.md

@@ -9,7 +9,7 @@ paths:
 
 # Todo backend — queue contract, invariants, and writer obligations
 
-The todos queue is materialised by `apps/todo-worker` (CHK-122) and consumed by `/cbp-todo` + `mcp__codebyplan__get_next_action`. This rule documents what every contributor to the MCP write tools, the worker, or the SQL schema must respect.
+The todos queue is materialised by `apps/todo-worker` (CHK-122) and consumed by `/cbp-todo` (via `mcp__codebyplan__get_todos`). This rule documents what every contributor to the MCP write tools, the worker, or the SQL schema must respect.
 
 ## 1. Six workflow invariants — DB-layer guards, never bypassable
 
@@ -46,7 +46,7 @@ MCP write → enqueueTodoJob → todos_jobs (status='pending')
 
 ## 3. Priority sort_order bands
 
-The worker emits todos with these `sort_order` ranges. Lower = surfaces first in `get_next_action`.
+The worker emits todos with these `sort_order` ranges. Lower = surfaces first in the todo queue.
 
 | Band | sort_order | State |
 |------|-----------|-------|
@@ -59,7 +59,7 @@ The worker emits todos with these `sort_order` ranges. Lower = surfaces first in
 
 ## 4. Command + args mapping
 
-`get_next_action` returns one row mapping to one of these slash commands. The worker stamps `command` + `metadata.context` based on workflow state:
+The queue head (`get_todos` `rows[0]`) maps to one of these slash commands. The worker stamps `command` + `metadata.context` based on workflow state:
 
 | State | Command | Required context |
 |-------|---------|------------------|

package/templates/settings.project.base.json

@@ -3,7 +3,6 @@
   "autoUpdatesChannel": "latest",
   "awaySummaryEnabled": true,
   "disableAgentView": false,
-  "disableRemoteControl": false,
   "editorMode": "normal",
   "outputStyle": "default",
   "preferredNotifChannel": "notifications_disabled",
@@ -24,8 +23,6 @@
   "disableSkillShellExecution": false,
   "skipWebFetchPreflight": false,
   "fastModePerSessionOptIn": false,
-  "remoteControlAtStartup": true,
-  "agentPushNotifEnabled": true,
   "effortLevel": "xhigh",
   "statusLine": {
     "type": "command",
@@ -64,19 +61,11 @@
       "Skill(cbp-standalone-task-create)",
       "Skill(cbp-standalone-task-start)",
       "Skill(cbp-standalone-task-complete)",
-      "mcp__codebyplan__accept_invite",
-      "mcp__codebyplan__change_role",
-      "mcp__codebyplan__create_launch",
-      "mcp__codebyplan__update_launch",
-      "mcp__codebyplan__delete_launch",
       "mcp__codebyplan__create_organization",
       "mcp__codebyplan__create_project",
       "mcp__codebyplan__create_repo",
       "mcp__codebyplan__delete_session_log",
       "mcp__codebyplan__delete_worktree",
-      "mcp__codebyplan__invite_member",
-      "mcp__codebyplan__remove_member",
-      "mcp__codebyplan__revoke_invite",
       "mcp__codebyplan__release_assignment",
       "Bash(codebyplan setup:*)",
       "Bash(npx codebyplan setup:*)",
@@ -148,10 +137,7 @@
       "mcp__codebyplan__get_eslint_presets",
       "mcp__codebyplan__get_eslint_repo_config",
       "mcp__codebyplan__get_file_changes",
-      "mcp__codebyplan__get_launch",
-      "mcp__codebyplan__get_launches",
       "mcp__codebyplan__get_library_doc_job",
-      "mcp__codebyplan__get_next_action",
       "mcp__codebyplan__get_repos",
       "mcp__codebyplan__get_rounds",
       "mcp__codebyplan__get_server_config",
@@ -162,7 +148,6 @@
       "mcp__codebyplan__get_task_templates",
       "mcp__codebyplan__get_tasks",
       "mcp__codebyplan__get_todos",
-      "mcp__codebyplan__get_work_plan",
       "mcp__codebyplan__get_worktrees",
       "mcp__codebyplan__list_tech_stack_sync_sessions",
       "mcp__codebyplan__get_chunk",
@@ -187,8 +172,6 @@
       "mcp__codebyplan__update_session_state",
       "mcp__codebyplan__create_worktree",
       "mcp__codebyplan__flag_stale_chunk",
-      "mcp__codebyplan__list_invites",
-      "mcp__codebyplan__list_members",
       "mcp__codebyplan__update_eslint_repo_config",
       "mcp__codebyplan__update_server_config",
       "mcp__codebyplan__update_task_template",

package/templates/settings.user.base.json

@@ -3,7 +3,6 @@
   "autoUpdatesChannel": "latest",
   "awaySummaryEnabled": true,
   "disableAgentView": false,
-  "disableRemoteControl": false,
   "editorMode": "normal",
   "outputStyle": "default",
   "preferredNotifChannel": "notifications_disabled",

package/templates/skills/cbp-build-cc-settings/reference/cbp-permission-policy.md

@@ -31,7 +31,7 @@ Precedence is `deny > ask > allow`; arrays union across scopes (managed/user/pro
 
 - **Production-shipment skills**: `cbp-ship`, `cbp-ship-main`, `cbp-checkpoint-end` — these promote/deploy to production, so they prompt even in an otherwise auto-allowed setup.
 - **Lifecycle / state-transition skills**: `cbp-checkpoint-start`, `cbp-checkpoint-create`, `cbp-checkpoint-check`, `cbp-checkpoint-complete`, `cbp-round-update`, `cbp-session-end`, `cbp-task-complete`, `cbp-standalone-task-create`, `cbp-standalone-task-start`, `cbp-standalone-task-complete` — these open or close checkpoints, tasks, rounds, and sessions (advancing workflow state in the database), so they stop for explicit confirmation rather than running autonomously.
-- **Destructive / admin / external MCP tools**: `delete_session_log`, `delete_worktree`, `delete_launch`, `create_repo`, `create_launch`, `update_launch`, `release_assignment`, and the membership tools `invite_member`, `remove_member`, `change_role`, `accept_invite`, `revoke_invite`.
+- **Destructive / admin MCP tools**: `delete_session_log`, `delete_worktree`, `create_repo`, `release_assignment`. (The launch and member-admin tools were dropped from the MCP surface in CHK-180 — those concerns are web-app only now.)
 - **Mutating / external / clobber-risk CLI commands** (both prefixes): `setup`, `login`, `logout`, `upgrade-auth`, `config` (can overwrite committed `.codebyplan/` files), `branch` (rewrites branch config), `ship`, `claude` (`install`/`update`/`uninstall` overwrite `.claude/`).
 
 ### `deny` — unchanged

package/templates/skills/cbp-checkpoint-create/SKILL.md

@@ -20,7 +20,7 @@ Runs INLINE. This is the **mechanical** stage only: capture raw user input, infe
 
 ### Step 1: Check for Existing Checkpoint Data
 
-Source `repo_id` from `.codebyplan/repo.json`. If `$ARGUMENTS` contains a checkpoint number, or MCP `get_next_action` returns one, load it via MCP `get_checkpoints`. If the checkpoint already has `ideas[]` with descriptions, reuse `ideas[].description` (do not re-ask) and skip Step 2.
+Source `repo_id` from `.codebyplan/repo.json`. If `$ARGUMENTS` contains a checkpoint number, load it via MCP `get_checkpoints`. If the checkpoint already has `ideas[]` with descriptions, reuse `ideas[].description` (do not re-ask) and skip Step 2.
 
 ### Step 2: Get Checkpoint Description
 
@@ -113,6 +113,6 @@ Auto-trigger `/cbp-checkpoint-plan {NNN}` in the same context. This skill create
 ## Integration
 
 - **Runs inline**: mechanical setup only — no assessment, research, Q&A, plan, or tasks
-- **Reads**: MCP `get_next_action`, `get_checkpoints`; `.codebyplan/repo.json`, `.codebyplan/git.json`; `npx codebyplan resolve-worktree`
+- **Reads**: MCP `get_checkpoints`; `.codebyplan/repo.json`, `.codebyplan/git.json`; `npx codebyplan resolve-worktree`
 - **Writes**: MCP `create_checkpoint` (description-only ideas + deadline + optional worktree_id), `update_checkpoint` (branch_name)
 - **Triggers**: `/cbp-checkpoint-plan` (auto)

package/templates/skills/cbp-session-end/SKILL.md

@@ -27,18 +27,21 @@ Always write a session log for this session — **even if empty**. `/cbp-session
 
 Snapshot the current next-action so the next `/cbp-session-start` (Step 4.5) can auto-resume. The handoff write-path + payload shape are specified inline here and in `/cbp-session-start` Step 4.5 (freshness gate).
 
-1. Call MCP `get_next_action({ repo_id, worktree_id })`.
-2. If the returned `command` is non-empty (active work in flight):
+1. Call MCP `get_todos({ repo_id, worktree_id })` and take the queue head `rows[0]` (rows are ordered by `sort_order`; `rows[0]` is the current next-action). The worker stamps `command`, `instructions`, `state`, and the entity ids `checkpoint_id` / `task_id` / `round_id` on every row.
+2. If `rows[0]` exists and its `command` is non-empty (active work in flight):
    ```yaml
    handoff:
-     command: <result.command> # e.g. "/cbp-round-update"
-     instructions: <result.instructions> # human-readable trigger reason
-     state: <result.state> # workflow state label
-     context: <result.context> # entity ids (checkpoint_id / task_id / round_id) used by freshness probe
+     command: <rows[0].command> # e.g. "/cbp-round-update"
+     instructions: <rows[0].instructions> # human-readable trigger reason
+     state: <rows[0].state> # workflow state label
+     context: # entity ids used by the Step 4.5 freshness probe
+       checkpoint_id: <rows[0].checkpoint_id>
+       task_id: <rows[0].task_id>
+       round_id: <rows[0].round_id>
      captured_at: <ISO now> # for entity-drift freshness comparison
      captured_session_log_id: <current session log id>
    ```
-3. If `command` is empty / idle / queue-empty: set `handoff = null` so the next session's probe falls through to `/cbp-todo`.
+3. If the queue is empty or `rows[0].command` is empty / idle: set `handoff = null` so the next session's probe falls through to `/cbp-todo`.
 4. Hold `handoff` in context for Step 1's `update_session_log` call below — it ships in the same write as `ended_at` and `summary`.
 
 Continuing Step 1:
@@ -157,7 +160,7 @@ You can close this window.
 ## Integration
 
 - **Triggered by**: user invocation (prompted by `/cbp-todo` when no work remains)
-- **Reads**: `.codebyplan/repo.json`, `.codebyplan/git.json` (`branch_config.production` for the Step 1.6 home-branch fast-forward), MCP `get_session_logs` (resolve current log), MCP `get_current_task`, MCP `get_rounds`, MCP `get_next_action` (Step 1.3 handoff snapshot); `npx codebyplan version-status` (Step 1.7 package-freshness gate)
+- **Reads**: `.codebyplan/repo.json`, `.codebyplan/git.json` (`branch_config.production` for the Step 1.6 home-branch fast-forward), MCP `get_session_logs` (resolve current log), MCP `get_current_task`, MCP `get_rounds`, MCP `get_todos` (Step 1.3 handoff snapshot — queue head `rows[0]`); `npx codebyplan version-status` (Step 1.7 package-freshness gate)
 - **Writes**: MCP `update_session_log` (with `ended_at` + `handoff` per TASK-2 alias surface; or `create_session_log` fallback), MCP `update_session_state` (deactivate)
 - **Spawns**: none
 - **Triggers**: none at the skill-contract level. Step 1.5 may invoke `/cbp-git-commit` inline on user approval; Step 1.7 may invoke `/cbp-git-commit` on the `newer:true AND guarded:false` update path (committing changed `.claude/` and `.codebyplan/` paths).

package/templates/skills/cbp-todo/SKILL.md

@@ -44,7 +44,7 @@ With `USER_ID` resolved, call MCP `get_todos({ repo_id, user_id, worktree_id })`
 
 - The head carries `command`, `instructions`, `state`, `metadata`, `worktree_id`, `checkpoint_id`, `task_id`.
 - The routing context (checkpoint/task) lives in **`rows[0].metadata`**.
-- `get_todos` is **pure-read** — `apps/todo-worker` is the sole regen authority. NEVER call `get_next_action` or `regenerate_todos_for_repo`.
+- `get_todos` is **pure-read** — `apps/todo-worker` is the sole regen authority. NEVER call `regenerate_todos_for_repo`.
 - Empty array, or `USER_ID` unavailable → go to Step 3 (empty-queue fallback).
 
 Queue `command` values may use the `/codebyplan:<name>` plugin-namespace form (e.g. `/codebyplan:round-start`); treat each as the matching `/cbp-<name>` skill for the Step 2 matrix.

package/templates/skills/cbp-todo/qa-regression.md

@@ -12,7 +12,7 @@ Repo under test: `2ff6d405-39c5-47b8-a6d1-59f998ac0537`. Resolve a real `user_id
 
 ## Preconditions
 
-- `get_todos` is the only Step 1 read — confirm no `get_next_action` / `regenerate_todos_for_repo` call remains (`grep -n 'get_next_action\|regenerate_todos_for_repo' SKILL.md` → no hits).
+- `get_todos` is the only Step 1 read — confirm no `regenerate_todos_for_repo` call remains (`grep -n 'regenerate_todos_for_repo' SKILL.md` → no hits).
 - Step 0 uses `resolve-worktree --json` and `whoami --json`.
 
 ## Scenario A — caller owns the work → auto-trigger