openmates 0.15.0-alpha.22 → 0.15.0-alpha.24

package/dist/{chunk-47BFVCB4.js → chunk-F4JZMA6W.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-AXNRPVLE.js";
 
 // src/client.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID5 } from "crypto";
 import { arch, platform as platform2, release } from "os";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as stdin2, stdout } from "process";
@@ -3540,9 +3540,11 @@ function stripTimer(job) {
 }
 
 // src/tasksCli.ts
-import { createHash as createHash5, randomBytes as randomBytes2, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash5, createHmac, hkdfSync, randomBytes as randomBytes2, randomUUID as randomUUID4 } from "crypto";
 var TASK_STATUSES2 = ["backlog", "todo", "in_progress", "blocked", "done"];
 var DEFAULT_STANDALONE_PREFIX = "TASK";
+var PRIORITY_LEVELS = ["none", "low", "medium", "high", "urgent"];
+var LABEL_INDEX_INFO = "openmates-task-label-index-v1";
 function normalizeTaskStatus(value) {
   if (value === void 0) return void 0;
   if (TASK_STATUSES2.includes(value)) return value;
@@ -3566,12 +3568,43 @@ function parseDueAt(value) {
   if (Number.isNaN(parsed)) throw new Error(`Invalid --due value '${value}'.`);
   return Math.floor(parsed / 1e3);
 }
+function normalizeLabels(labels) {
+  const output = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const label of labels ?? []) {
+    const normalized = label.trim().toLowerCase().replace(/\s+/g, " ");
+    if (!normalized || seen.has(normalized)) continue;
+    seen.add(normalized);
+    output.push(normalized);
+  }
+  return output;
+}
+function labelHashes(masterKey, labels) {
+  const indexKey = Buffer.from(hkdfSync("sha256", Buffer.from(masterKey), Buffer.alloc(0), LABEL_INDEX_INFO, 32));
+  return normalizeLabels(labels).map((label) => createHmac("sha256", indexKey).update(label).digest("hex"));
+}
+function normalizeTaskPriority(value) {
+  if (value === void 0) return void 0;
+  if (value === null) return 0;
+  if (typeof value === "number") {
+    if (!Number.isInteger(value) || value < 0 || value > 4) throw new Error(`Invalid task priority '${value}'.`);
+    return value;
+  }
+  const normalized = value.trim().toLowerCase();
+  const index = PRIORITY_LEVELS.indexOf(normalized);
+  if (index < 0) throw new Error(`Unknown task priority '${value}'. Expected one of: ${PRIORITY_LEVELS.join(", ")}`);
+  return index;
+}
+function taskPriorityLevel(priority) {
+  return PRIORITY_LEVELS[Math.max(0, Math.min(4, Math.trunc(priority ?? 0)))] ?? "none";
+}
 async function buildCreateUserTaskInput(masterKey, input) {
   const taskKey = randomBytes2(32);
   const encryptedTaskKey = await encryptBytesWithAesGcm(taskKey, masterKey);
   const timestamp = nowSeconds();
   const assignee = parseAssignee(input.assign);
   const linkedProjectIds = input.projectIds ?? [];
+  const labels = normalizeLabels(input.labels ?? input.tags ?? []);
   const status = input.status ?? (assignee.assigneeType === "ai" && !input.dueAt ? "in_progress" : "todo");
   return {
     task_id: randomUUIDCompat(),
@@ -3580,7 +3613,9 @@ async function buildCreateUserTaskInput(masterKey, input) {
     encrypted_task_key: encryptedTaskKey,
     encrypted_title: await encryptWithAesGcmCombined(input.title, taskKey),
     encrypted_description: await encryptWithAesGcmCombined(input.description ?? "", taskKey),
-    encrypted_tags: await encryptWithAesGcmCombined("[]", taskKey),
+    encrypted_labels: await encryptWithAesGcmCombined(JSON.stringify(labels), taskKey),
+    encrypted_tags: await encryptWithAesGcmCombined(JSON.stringify(labels), taskKey),
+    label_hashes: labelHashes(masterKey, labels),
     encrypted_linked_project_ids: await encryptWithAesGcmCombined(JSON.stringify(linkedProjectIds), taskKey),
     status,
     assignee_type: assignee.assigneeType,
@@ -3589,7 +3624,7 @@ async function buildCreateUserTaskInput(masterKey, input) {
     linked_project_ids: linkedProjectIds,
     plan_id: input.planId ?? null,
     due_at: input.dueAt ?? null,
-    priority: 0,
+    priority: normalizeTaskPriority(input.priority) ?? 0,
     position: timestamp,
     created_at: timestamp,
     updated_at: timestamp
@@ -3612,20 +3647,32 @@ async function buildUpdateUserTaskInput(task, masterKey, input) {
     patch.encrypted_linked_project_ids = await encryptWithAesGcmCombined(JSON.stringify(input.projectIds), taskKey);
   }
   if (input.planId !== void 0) patch.plan_id = input.planId;
+  const priority = normalizeTaskPriority(input.priority);
+  if (priority !== void 0) patch.priority = priority;
+  const replaceLabels = input.labels ?? input.tags;
+  if (replaceLabels !== void 0 || input.addLabels !== void 0 || input.addTags !== void 0 || input.removeLabels !== void 0 || input.removeTags !== void 0) {
+    const remove = new Set(normalizeLabels([...input.removeLabels ?? [], ...input.removeTags ?? []]));
+    const base = replaceLabels !== void 0 ? normalizeLabels(replaceLabels) : task.labels;
+    const labels = normalizeLabels([...base.filter((label) => !remove.has(label)), ...input.addLabels ?? [], ...input.addTags ?? []]);
+    patch.encrypted_labels = await encryptWithAesGcmCombined(JSON.stringify(labels), taskKey);
+    patch.encrypted_tags = await encryptWithAesGcmCombined(JSON.stringify(labels), taskKey);
+    patch.label_hashes = labelHashes(masterKey, labels);
+  }
   return patch;
 }
 async function decryptUserTask(record, masterKey) {
   if (record.source === "workflow_run") return workflowProjectionToTask(record);
   if (typeof record.version !== "number") throw new Error(`Task ${record.task_id} is missing version.`);
   const taskKey = await taskKeyFromRecord(record, masterKey);
-  const tags = parseStringArray(await decryptOptional(record.encrypted_tags, taskKey));
+  const labels = parseStringArray(await decryptOptional(record.encrypted_labels || record.encrypted_tags, taskKey));
   const linkedProjectIds = parseStringArray(await decryptOptional(record.encrypted_linked_project_ids, taskKey));
   return {
     taskId: record.task_id,
     shortId: record.short_id || deriveShortId(record),
     title: await decryptOptional(record.encrypted_title, taskKey) || "(untitled task)",
     description: await decryptOptional(record.encrypted_description, taskKey),
-    tags,
+    labels,
+    tags: labels,
     latestInstruction: await decryptOptional(record.encrypted_latest_instruction, taskKey),
     status: record.status,
     assigneeType: record.assignee_type,
@@ -3635,6 +3682,7 @@ async function decryptUserTask(record, masterKey) {
     planId: record.plan_id ?? null,
     dueAt: record.due_at ?? null,
     priority: record.priority ?? 0,
+    priorityLevel: taskPriorityLevel(record.priority),
     position: record.position ?? 0,
     queueState: record.queue_state ?? "none",
     blockedReasonCode: record.blocked_reason_code ?? null,
@@ -3651,6 +3699,7 @@ function workflowProjectionToTask(record) {
     shortId: record.short_id || workflowProjectionShortId(record),
     title: record.title || "Workflow run",
     description: record.blocked_message ?? "",
+    labels: [],
     tags: [],
     latestInstruction: "",
     status: record.status,
@@ -3661,6 +3710,7 @@ function workflowProjectionToTask(record) {
     planId: null,
     dueAt: record.due_at ?? null,
     priority: record.priority ?? 0,
+    priorityLevel: taskPriorityLevel(record.priority),
     position: record.position ?? 0,
     queueState: String(record.run_status ?? "workflow"),
     blockedReasonCode: blockedReason,
@@ -3690,9 +3740,9 @@ function findTask(tasks, id) {
 }
 function renderTaskList(tasks) {
   if (tasks.length === 0) return "No tasks found.";
-  const lines = ["Tasks", "ID        Status       Assignee    Queue       Title"];
+  const lines = ["Tasks", "ID        Status       Priority  Labels              Title"];
   for (const task of tasks) {
-    lines.push(`${pad(task.shortId, 9)} ${pad(task.status, 12)} ${pad(assigneeLabel(task), 11)} ${pad(task.queueState, 11)} ${task.title}`);
+    lines.push(`${pad(task.shortId, 9)} ${pad(task.status, 12)} ${pad(task.priorityLevel, 9)} ${pad(task.labels.join(","), 19)} ${task.title}`);
   }
   return lines.join("\n");
 }
@@ -3701,11 +3751,13 @@ function renderTaskDetail(task) {
     `Task ${task.shortId}`,
     `Title: ${task.title}`,
     `Status: ${task.status}`,
+    `Priority: ${task.priorityLevel}`,
     `Assignee: ${assigneeLabel(task)}`,
     `Queue: ${task.queueState}`,
     `Task ID: ${task.taskId}`
   ];
   if (task.description) lines.push(`Description: ${task.description}`);
+  if (task.labels.length > 0) lines.push(`Labels: ${task.labels.join(", ")}`);
   if (task.primaryChatId) lines.push(`Chat: ${task.primaryChatId}`);
   if (task.linkedProjectIds.length > 0) lines.push(`Projects: ${task.linkedProjectIds.join(", ")}`);
   if (task.planId) lines.push(`Plan: ${task.planId}`);
@@ -3801,7 +3853,8 @@ function normalizeUnixSeconds(value, fallback) {
 }
 function getClientMessagesVersionForSync(cached) {
   if (cached.messages.length === 0) return 0;
-  return typeof cached.details.messages_v === "number" ? cached.details.messages_v : 0;
+  const messagesVersion = typeof cached.details.messages_v === "number" ? cached.details.messages_v : 0;
+  return Math.min(messagesVersion, cached.messages.length);
 }
 var INTEREST_TAG_IDS = [
   "software_development",
@@ -4035,7 +4088,10 @@ function assertTaskPersistPayloadEncrypted(payload) {
     "blocked_reason_code",
     "created_at",
     "key_wrappers",
+    "label_hashes",
     "linked_project_ids",
+    "plan_id",
+    "plan_step_id",
     "position",
     "primary_chat_id",
     "priority",
@@ -4854,7 +4910,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (!userId) {
       throw new Error("Could not resolve current user id for local connected-account connector.");
     }
-    const { createHash: createHash9 } = await import("crypto");
+    const { createHash: createHash10 } = await import("crypto");
     const accountId = randomUUID5();
     const masterKey = this.getMasterKeyBytes();
     const encryptLocalConnectorValue = async (value) => {
@@ -4863,9 +4919,9 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     const payload = {
       id: accountId,
-      hashed_user_id: createHash9("sha256").update(userId).digest("hex"),
+      hashed_user_id: createHash10("sha256").update(userId).digest("hex"),
       encrypted_provider_type: await encryptLocalConnectorValue(input.provider_id),
-      provider_type_hash: createHash9("sha256").update(input.provider_id).digest("hex"),
+      provider_type_hash: createHash10("sha256").update(input.provider_id).digest("hex"),
       encrypted_account_label: await encryptLocalConnectorValue(input.label),
       encrypted_capabilities: await encryptLocalConnectorValue(input.capabilities),
       encrypted_app_permissions: await encryptLocalConnectorValue({
@@ -5306,14 +5362,26 @@ var OpenMatesClient = class _OpenMatesClient {
   async decryptChatKey(encryptedChatKey, masterKey) {
     return decryptBytesWithAesGcm(encryptedChatKey, masterKey);
   }
+  getMasterWrapperEncryptedChatKey(cache, chatId) {
+    const hashedChatId = createHash6("sha256").update(chatId).digest("hex");
+    const wrapper = (cache?.chatKeyWrappers ?? []).find(
+      (entry) => entry.key_type === "master" && entry.hashed_chat_id === hashedChatId && typeof entry.encrypted_chat_key === "string"
+    );
+    return typeof wrapper?.encrypted_chat_key === "string" ? wrapper.encrypted_chat_key : null;
+  }
+  async resolveChatKey(cache, cached, masterKey) {
+    const chatId = String(cached.details.id ?? "");
+    const wrapperKey = chatId ? this.getMasterWrapperEncryptedChatKey(cache, chatId) : null;
+    const encryptedChatKey = wrapperKey ?? (typeof cached.details.encrypted_chat_key === "string" ? cached.details.encrypted_chat_key : null);
+    return encryptedChatKey ? this.decryptChatKey(encryptedChatKey, masterKey) : null;
+  }
   /**
    * Decrypt a single chat record from the sync cache into a ChatListItem.
    */
-  async decryptChatListItem(cached, masterKey) {
+  async decryptChatListItem(cached, masterKey, cache = loadSyncCache()) {
     const d = cached.details;
     const id = String(d.id ?? "");
-    const encKey = typeof d.encrypted_chat_key === "string" ? d.encrypted_chat_key : null;
-    const chatKeyBytes = encKey ? await this.decryptChatKey(encKey, masterKey) : null;
+    const chatKeyBytes = await this.resolveChatKey(cache, cached, masterKey);
     const title = typeof d.encrypted_title === "string" && chatKeyBytes ? await decryptWithAesGcmCombined(d.encrypted_title, chatKeyBytes) : null;
     const summary = typeof d.encrypted_chat_summary === "string" && chatKeyBytes ? await decryptWithAesGcmCombined(
       d.encrypted_chat_summary,
@@ -5338,7 +5406,7 @@ var OpenMatesClient = class _OpenMatesClient {
     const slice = cache.chats.slice(offset, offset + limit);
     const output = [];
     for (const chat of slice) {
-      output.push(await this.decryptChatListItem(chat, masterKey));
+      output.push(await this.decryptChatListItem(chat, masterKey, cache));
     }
     return {
       chats: output,
@@ -5528,7 +5596,7 @@ var OpenMatesClient = class _OpenMatesClient {
    * @param query Full UUID, 8-char short ID, or chat title.
    */
   async getChatMessages(query) {
-    const cache = await this.ensureSynced();
+    const cache = await this.ensureSynced(true);
     const masterKey = this.getMasterKeyBytes();
     const normalized = query.trim().toLowerCase();
     let found;
@@ -5547,7 +5615,7 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     if (!found) {
       for (const cached of cache.chats) {
-        const item = await this.decryptChatListItem(cached, masterKey);
+        const item = await this.decryptChatListItem(cached, masterKey, cache);
         const title = (item.title ?? "").toLowerCase();
         if (title === normalized) {
           found = cached;
@@ -5570,9 +5638,8 @@ var OpenMatesClient = class _OpenMatesClient {
         `Chat '${query}' not found. Try 'openmates chats search "${query}"' to browse matches.`
       );
     }
-    const chatItem = await this.decryptChatListItem(found, masterKey);
-    const encKey = typeof found.details.encrypted_chat_key === "string" ? found.details.encrypted_chat_key : null;
-    const chatKeyBytes = encKey ? await this.decryptChatKey(encKey, masterKey) : null;
+    const chatItem = await this.decryptChatListItem(found, masterKey, cache);
+    const chatKeyBytes = await this.resolveChatKey(cache, found, masterKey);
     const messages = [];
     for (const raw of found.messages) {
       const m = typeof raw === "string" ? JSON.parse(raw) : raw;
@@ -5591,8 +5658,8 @@ var OpenMatesClient = class _OpenMatesClient {
       );
       let msgEmbedIds = [];
       if (clientMsgId && cache.embeds.length > 0) {
-        const { createHash: createHash9 } = await import("crypto");
-        const hashed = createHash9("sha256").update(clientMsgId).digest("hex");
+        const { createHash: createHash10 } = await import("crypto");
+        const hashed = createHash10("sha256").update(clientMsgId).digest("hex");
         msgEmbedIds = cache.embeds.filter(
           (e) => e.hashed_message_id === hashed && // Only include parent embeds (no parent_embed_id).
           // Child embeds inherit the parent's key and are loaded
@@ -5639,8 +5706,8 @@ var OpenMatesClient = class _OpenMatesClient {
       );
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const { createHash: createHash9 } = await import("crypto");
-    const hashedEmbedId = createHash9("sha256").update(embedId).digest("hex");
+    const { createHash: createHash10 } = await import("crypto");
+    const hashedEmbedId = createHash10("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -5748,7 +5815,7 @@ var OpenMatesClient = class _OpenMatesClient {
   async resolveEmbedKey(cache, masterKey, embed, embedId, hashedEmbedId, visited = /* @__PURE__ */ new Set()) {
     if (visited.has(embedId)) return null;
     visited.add(embedId);
-    const { createHash: createHash9 } = await import("crypto");
+    const { createHash: createHash10 } = await import("crypto");
     const masterKeyEntry = cache.embedKeys.find(
       (ek) => ek.hashed_embed_id === hashedEmbedId && String(ek.key_type) === "master"
     );
@@ -5765,7 +5832,7 @@ var OpenMatesClient = class _OpenMatesClient {
     if (chatKeyEntry && typeof chatKeyEntry.encrypted_embed_key === "string") {
       const hashedChatId = String(chatKeyEntry.hashed_chat_id ?? "");
       const owningChat = cache.chats.find((c) => {
-        const chatHash = createHash9("sha256").update(String(c.details.id ?? "")).digest("hex");
+        const chatHash = createHash10("sha256").update(String(c.details.id ?? "")).digest("hex");
         return chatHash === hashedChatId;
       });
       if (owningChat) {
@@ -5794,7 +5861,7 @@ var OpenMatesClient = class _OpenMatesClient {
         const parentFullId = String(
           parentEmbed2.embed_id ?? parentEmbed2.id ?? ""
         );
-        const parentHashedId = createHash9("sha256").update(parentFullId).digest("hex");
+        const parentHashedId = createHash10("sha256").update(parentFullId).digest("hex");
         const parentKey = await this.resolveEmbedKey(
           cache,
           masterKey,
@@ -5886,9 +5953,7 @@ var OpenMatesClient = class _OpenMatesClient {
       (c) => String(c.details.id ?? "") === chatId || String(c.details.id ?? "").startsWith(chatId)
     );
     if (!found) return [];
-    const encKey = typeof found.details.encrypted_chat_key === "string" ? found.details.encrypted_chat_key : null;
-    if (!encKey) return [];
-    const chatKeyBytes = await this.decryptChatKey(encKey, masterKey);
+    const chatKeyBytes = await this.resolveChatKey(cache, found, masterKey);
     if (!chatKeyBytes) return [];
     const encSuggestions = typeof found.details.encrypted_follow_up_request_suggestions === "string" ? found.details.encrypted_follow_up_request_suggestions : null;
     if (!encSuggestions) return [];
@@ -7783,6 +7848,8 @@ var OpenMatesClient = class _OpenMatesClient {
     if (filters.status) params.set("status", filters.status);
     if (filters.chatId) params.set("chat_id", filters.chatId);
     if (filters.projectId) params.set("project_id", filters.projectId);
+    for (const labelHash of filters.labelHashes ?? []) params.append("label_hash", labelHash);
+    if (filters.priority !== void 0) params.set("priority", String(filters.priority));
     const limit = filters.limit;
     if (Number.isSafeInteger(limit) && limit !== void 0 && limit > 0) params.set("limit", String(limit));
     const query = params.toString();
@@ -8837,7 +8904,7 @@ Required: ${schema.required.join(", ")}`
     const session = this.requireSession();
     const masterKey = base64ToBytes(session.masterKeyExportedB64);
     const cache = await this.ensureSynced();
-    const { createHash: createHash9 } = await import("crypto");
+    const { createHash: createHash10 } = await import("crypto");
     const embed = cache.embeds.find(
       (e) => String(e.embed_id ?? "").startsWith(embedIdOrShort) || String(e.id ?? "").startsWith(embedIdOrShort)
     );
@@ -8845,7 +8912,7 @@ Required: ${schema.required.join(", ")}`
       throw new Error(`Embed '${embedIdOrShort}' not found in local cache.`);
     }
     const embedId = String(embed.embed_id ?? embed.id ?? "");
-    const hashedEmbedId = createHash9("sha256").update(embedId).digest("hex");
+    const hashedEmbedId = createHash10("sha256").update(embedId).digest("hex");
     const embedKeyBytes = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -8953,8 +9020,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash9 } = await import("crypto");
-    const hashedEmbedId = createHash9("sha256").update(embedId).digest("hex");
+    const { createHash: createHash10 } = await import("crypto");
+    const hashedEmbedId = createHash10("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -9048,8 +9115,8 @@ Required: ${schema.required.join(", ")}`
     if (!embed) {
       throw new Error(`Embed '${embedId}' not found in local cache. Run 'openmates chats list' to sync first.`);
     }
-    const { createHash: createHash9 } = await import("crypto");
-    const hashedEmbedId = createHash9("sha256").update(embedId).digest("hex");
+    const { createHash: createHash10 } = await import("crypto");
+    const hashedEmbedId = createHash10("sha256").update(embedId).digest("hex");
     const embedKey = await this.resolveEmbedKey(
       cache,
       masterKey,
@@ -9321,6 +9388,7 @@ Required: ${schema.required.join(", ")}`
     const chats = [];
     const embeds = [];
     const embedKeys = [];
+    const chatKeyWrappers = [];
     let newChatSuggestions = [];
     let totalChatCount = 0;
     let reconciliation = { authoritative: false };
@@ -9348,6 +9416,7 @@ Required: ${schema.required.join(", ")}`
           }
           if (p.embeds) embeds.push(...p.embeds);
           if (p.embed_keys) embedKeys.push(...p.embed_keys);
+          if (p.chat_key_wrappers) chatKeyWrappers.push(...p.chat_key_wrappers);
         } else if (frame.type === "phase_2_last_20_chats_ready") {
           const p = frame.payload;
           totalChatCount = p.total_chat_count ?? 0;
@@ -9361,6 +9430,7 @@ Required: ${schema.required.join(", ")}`
             if (!details || typeof details.id !== "string") continue;
             chats.push({ details, messages: [] });
           }
+          if (p.chat_key_wrappers) chatKeyWrappers.push(...p.chat_key_wrappers);
         } else if (frame.type === "background_message_sync") {
           const p = frame.payload;
           for (const c of p.chats ?? []) {
@@ -9370,6 +9440,7 @@ Required: ${schema.required.join(", ")}`
           }
           if (p.embeds) embeds.push(...p.embeds);
           if (p.embed_keys) embedKeys.push(...p.embed_keys);
+          if (p.chat_key_wrappers) chatKeyWrappers.push(...p.chat_key_wrappers);
         } else if (frame.type === "pending_ai_response") {
           pendingAIResponses.push(frame.payload);
         }
@@ -9435,18 +9506,29 @@ Required: ${schema.required.join(", ")}`
           embedKeys.push(cached);
         }
       }
+      const serverChatKeyWrapperIds = new Set(
+        chatKeyWrappers.map((entry) => String(entry.id ?? ""))
+      );
+      for (const cached of existingCache.chatKeyWrappers ?? []) {
+        const cachedId = String(cached.id ?? "");
+        if (cachedId && !serverChatKeyWrapperIds.has(cachedId)) {
+          chatKeyWrappers.push(cached);
+        }
+      }
     }
     const reconciledChats = reconcileAuthoritativeChats(chats, reconciliation);
     chats.splice(0, chats.length, ...reconciledChats);
     if (reconciliation.deleted_chat_ids?.length) {
-      const { createHash: createHash9 } = await import("crypto");
+      const { createHash: createHash10 } = await import("crypto");
       const deletedHashes = new Set(
-        reconciliation.deleted_chat_ids.map((id) => createHash9("sha256").update(id).digest("hex"))
+        reconciliation.deleted_chat_ids.map((id) => createHash10("sha256").update(id).digest("hex"))
       );
       const keptEmbeds = embeds.filter((embed) => !deletedHashes.has(String(embed.hashed_chat_id ?? "")));
       const keptKeys = embedKeys.filter((key) => !deletedHashes.has(String(key.hashed_chat_id ?? "")));
+      const keptChatKeyWrappers = chatKeyWrappers.filter((key) => !deletedHashes.has(String(key.hashed_chat_id ?? "")));
       embeds.splice(0, embeds.length, ...keptEmbeds);
       embedKeys.splice(0, embedKeys.length, ...keptKeys);
+      chatKeyWrappers.splice(0, chatKeyWrappers.length, ...keptChatKeyWrappers);
     }
     chats.sort(
       (a, b) => (typeof b.details.last_edited_overall_timestamp === "number" ? b.details.last_edited_overall_timestamp : 0) - (typeof a.details.last_edited_overall_timestamp === "number" ? a.details.last_edited_overall_timestamp : 0)
@@ -9478,6 +9560,7 @@ Required: ${schema.required.join(", ")}`
       chats,
       embeds,
       embedKeys,
+      chatKeyWrappers,
       newChatSuggestions
     };
     saveSyncCache(cache);
@@ -9509,9 +9592,7 @@ Required: ${schema.required.join(", ")}`
         } catch {
         }
       }
-      const encryptedChatKey = typeof chat.details.encrypted_chat_key === "string" ? chat.details.encrypted_chat_key : null;
-      if (!encryptedChatKey) continue;
-      const chatKeyBytes = await this.decryptChatKey(encryptedChatKey, masterKey);
+      const chatKeyBytes = await this.resolveChatKey(loadSyncCache(), chat, masterKey);
       if (!chatKeyBytes) continue;
       const completedAt = normalizeUnixSeconds(
         pending.fired_at,
@@ -13625,7 +13706,7 @@ var GeneratedAppSkills = class {
 
 // src/sdk.ts
 import { decode as toonDecode } from "@toon-format/toon";
-import { createHash as createHash6, randomBytes as randomBytes3, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash7, randomBytes as randomBytes3, randomUUID as randomUUID6 } from "crypto";
 import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir4 } from "os";
 import { dirname, join as join3 } from "path";
@@ -13763,15 +13844,11 @@ var OpenMates = class {
   }
   async resolveEmbedKeyForShare(embedKeys, embedId) {
     const masterKey = await this.getMasterKey();
-    const hashedEmbedId = createHash6("sha256").update(embedId).digest("hex");
+    const hashedEmbedId = createHash7("sha256").update(embedId).digest("hex");
     return this.resolveLoadedEmbedKey(embedKeys, hashedEmbedId, masterKey, masterKey);
   }
-  async decryptChatMetadata(chat) {
-    if (typeof chat.encrypted_chat_key !== "string") {
-      return chat;
-    }
-    const masterKey = await this.getMasterKey();
-    const chatKey = await decryptBytesWithAesGcm(chat.encrypted_chat_key, masterKey);
+  async decryptChatMetadata(chat, chatKeyWrappers) {
+    const chatKey = await this.resolveLoadedChatKey(chat, chatKeyWrappers);
     if (!chatKey) {
       return chat;
     }
@@ -13793,8 +13870,9 @@ var OpenMates = class {
       return payload;
     }
     const chatMetadata = chat;
-    const decryptedChat = await this.decryptChatMetadata(chatMetadata);
-    const chatKey = typeof chatMetadata.encrypted_chat_key === "string" ? await decryptBytesWithAesGcm(chatMetadata.encrypted_chat_key, await this.getMasterKey()) : null;
+    const chatKeyWrappers = Array.isArray(payload.chat_key_wrappers) ? payload.chat_key_wrappers : Array.isArray(chatMetadata.chat_key_wrappers) ? chatMetadata.chat_key_wrappers : [];
+    const decryptedChat = await this.decryptChatMetadata(chatMetadata, chatKeyWrappers);
+    const chatKey = await this.resolveLoadedChatKey(chatMetadata, chatKeyWrappers);
     if (!chatKey || !Array.isArray(payload.messages)) {
       return { ...payload, chat: decryptedChat };
     }
@@ -13821,6 +13899,15 @@ var OpenMates = class {
     ) : payload.embeds;
     return { ...payload, chat: decryptedChat, messages, embeds };
   }
+  async resolveLoadedChatKey(chat, chatKeyWrappers) {
+    const masterKey = await this.getMasterKey();
+    const hashedChatId = createHash7("sha256").update(chat.id).digest("hex");
+    const wrapper = (chatKeyWrappers ?? []).find(
+      (entry) => entry.key_type === "master" && entry.hashed_chat_id === hashedChatId && typeof entry.encrypted_chat_key === "string"
+    );
+    const encryptedChatKey = typeof wrapper?.encrypted_chat_key === "string" ? wrapper.encrypted_chat_key : typeof chat.encrypted_chat_key === "string" ? chat.encrypted_chat_key : null;
+    return encryptedChatKey ? decryptBytesWithAesGcm(encryptedChatKey, masterKey) : null;
+  }
   async decryptLoadedChatEmbeds(embeds, embedKeys, chatKey) {
     const masterKey = await this.getMasterKey();
     return Promise.all(embeds.map(async (embed) => {
@@ -13828,7 +13915,7 @@ var OpenMates = class {
       if (!embedId) {
         return { ...embed };
       }
-      const hashedEmbedId = createHash6("sha256").update(embedId).digest("hex");
+      const hashedEmbedId = createHash7("sha256").update(embedId).digest("hex");
       const embedKey = await this.resolveLoadedEmbedKey(embedKeys, hashedEmbedId, masterKey, chatKey);
       if (!embedKey) {
         return { ...embed };
@@ -13951,7 +14038,12 @@ function loadOrCreateDeviceId(customPath) {
 function withQuery(path, query = {}) {
   const params = new URLSearchParams();
   for (const [key, value] of Object.entries(query)) {
-    if (value !== void 0 && value !== null) params.set(key, String(value));
+    if (value === void 0 || value === null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) params.append(key, String(item));
+    } else {
+      params.set(key, String(value));
+    }
   }
   const serialized = params.toString();
   return serialized ? `${path}?${serialized}` : path;
@@ -14705,10 +14797,13 @@ var OpenMatesTasks = class {
     return this.reorder(id, move, filters);
   }
   async listRaw(filters = {}) {
+    const masterKey = filters.labels || filters.tags ? await this.client.masterKey() : void 0;
     const response = await this.client.get(withQuery("/v1/user-tasks", {
       status: filters.status,
       chat_id: filters.chatId,
-      project_id: filters.projectId
+      project_id: filters.projectId,
+      label_hash: masterKey ? labelHashes(masterKey, normalizeLabels(filters.labels ?? filters.tags ?? [])) : void 0,
+      priority: normalizeTaskPriority(filters.priority)
     }));
     return response.tasks ?? [];
   }
@@ -15906,7 +16001,7 @@ var OutputRedactor = class {
 import { readFileSync as readFileSync5, statSync, existsSync as existsSync6 } from "fs";
 import { basename, extname, resolve as resolve2 } from "path";
 import { homedir as homedir5 } from "os";
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 var MAX_PER_FILE_SIZE = 100 * 1024 * 1024;
 var BLOCKED_EXTENSIONS = /* @__PURE__ */ new Set([
   ".pem",
@@ -16216,7 +16311,7 @@ function processCodeFile(filePath, filename, redactor) {
       line_count: lineCount
     });
     const textPreview = `${filename} (${language}, ${lineCount} lines)`;
-    const contentHash = createHash7("sha256").update(content).digest("hex");
+    const contentHash = createHash8("sha256").update(content).digest("hex");
     const embed = {
       embedId,
       embedRef,
@@ -17771,7 +17866,7 @@ function formatTs(ts) {
 
 // src/server.ts
 import { execFileSync as execFileSync2, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
-import { createHash as createHash8, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash9, randomBytes as randomBytes4 } from "crypto";
 import { chmodSync as chmodSync3, closeSync, copyFileSync, cpSync, existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, openSync, readFileSync as readFileSync6, readSync, readdirSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { createInterface as createInterface3 } from "readline";
 import { createInterface as createPromptInterface } from "readline/promises";
@@ -18436,7 +18531,7 @@ function packagedCaddyTemplatePath(role) {
 }
 function fileHash(path) {
   if (!existsSync7(path)) return null;
-  return createHash8("sha256").update(readFileSync6(path)).digest("hex");
+  return createHash9("sha256").update(readFileSync6(path)).digest("hex");
 }
 async function loadSelfHostComposeTemplate(templateRef, role) {
   const templateDir = process.env.OPENMATES_SELFHOST_TEMPLATE_DIR;
@@ -18822,7 +18917,7 @@ function formatSecretPreflight(preflight) {
   return parts.join("; ");
 }
 function hashFile(path) {
-  const hash = createHash8("sha256");
+  const hash = createHash9("sha256");
   const fd = openSync(path, "r");
   const buffer = Buffer.allocUnsafe(CHECKSUM_BUFFER_BYTES);
   try {
@@ -43031,7 +43126,7 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
         text: "@skill:tasks:create Do not ask follow-up questions. Create exactly these three tasks for a public OpenMates demo release checklist. Task 1 title: Review transcript for private data. Description: Confirm the source chat does not contain secrets, personal data, or private account details before publishing. Assign to me. Task 2 title: Verify Tasks and Workflows embeds. Description: Open the public example pages and confirm both parent embeds and child previews render and open fullscreen. Assign to me. Task 3 title: Write public release note. Description: Draft a short release note for developers explaining that the examples come from real CLI-created app-skill chats. Assign to OpenMates."
       },
       message_2: {
-        text: '```json\n{"type": "app_skill_use", "embed_id": "7996e3b5-8d25-46bd-b527-8da6f9c65ecf", "app_id": "tasks", "skill_id": "create"}\n```\n\nI\'ve created the three tasks for the OpenMates demo release checklist:\n\n1.  **Review transcript for private data** (Assigned to you)\n2.  **Verify Tasks and Workflows embeds** (Assigned to you)\n3.  **Write public release note** (Assigned to OpenMates)'
+        text: '```json\n{"type": "app_skill_use", "embed_id": "7996e3b5-8d25-46bd-b527-8da6f9c65ecf", "app_id": "tasks", "skill_id": "create"}\n```\n\nIch habe die drei Aufgaben f\xFCr die OpenMates-Demo-Release-Checkliste erstellt:\n\n1.  **Transkript auf private Daten pr\xFCfen** (dir zugewiesen)\n2.  **Tasks- und Workflows-Embeds pr\xFCfen** (dir zugewiesen)\n3.  **\xD6ffentliche Release-Notiz schreiben** (OpenMates zugewiesen)'
       }
     },
     family_stays_kyoto: {
@@ -43415,7 +43510,7 @@ How are you leaning personally on this issue heading into the dinner? Are you ho
         text: "@skill:workflows:create-or-modify Do not ask follow-up questions. Create a simple manual workflow titled Library Book Return Checklist. It should have a manual trigger and three manual steps: gather borrowed books from the shelf, check due dates in the library account, and pack books in a tote bag before leaving home. Keep it concise and suitable for a public demo."
       },
       message_2: {
-        text: '```json\n{"type": "app_skill_use", "embed_id": "cda4695f-7f68-42d7-9cfe-d719aa08dc3e", "app_id": "workflows", "skill_id": "create-or-modify"}\n```\n\nI have created the **Library Book Return Checklist** workflow. This manual automation includes the following steps:\n\n1.  **Gather books**: Gather borrowed books from the shelf.\n2.  **Check due dates**: Check due dates in the library account.\n3.  **Pack tote bag**: Pack books in a tote bag before leaving home.\n\nYou can view and manage this checklist in the [Workflows app](/#settings/apps/workflows).'
+        text: '```json\n{"type": "app_skill_use", "embed_id": "cda4695f-7f68-42d7-9cfe-d719aa08dc3e", "app_id": "workflows", "skill_id": "create-or-modify"}\n```\n\nIch habe den Workflow **Bibliotheksb\xFCcher-R\xFCckgabe-Checkliste** erstellt. Diese manuelle Automatisierung enth\xE4lt die folgenden Schritte:\n\n1.  **B\xFCcher zusammensuchen**: Ausgeliehene B\xFCcher aus dem Regal nehmen.\n2.  **F\xE4lligkeitsdaten pr\xFCfen**: F\xE4lligkeitsdaten im Bibliothekskonto pr\xFCfen.\n3.  **Stofftasche packen**: B\xFCcher vor dem Verlassen des Hauses in eine Stofftasche packen.\n\nDu kannst diese Checkliste in der [Workflows-App](/#settings/apps/workflows) ansehen und verwalten.'
       }
     },
     mastodon_account_recent_posts: {
@@ -61220,11 +61315,11 @@ function decodeBase32(input) {
   return Buffer.from(bytes);
 }
 async function generateTotpCode(secret) {
-  const { createHmac } = await import("crypto");
+  const { createHmac: createHmac2 } = await import("crypto");
   const counter = Math.floor(Date.now() / 1e3 / 30);
   const counterBuffer = Buffer.alloc(8);
   counterBuffer.writeBigUInt64BE(BigInt(counter));
-  const hmac = createHmac("sha1", decodeBase32(secret)).update(counterBuffer).digest();
+  const hmac = createHmac2("sha1", decodeBase32(secret)).update(counterBuffer).digest();
   const offset = hmac[hmac.length - 1] & 15;
   const code = (hmac.readUInt32BE(offset) & 2147483647) % 1e6;
   return String(code).padStart(6, "0");

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   getExtForLang,
   serializeToYaml
-} from "./chunk-47BFVCB4.js";
+} from "./chunk-F4JZMA6W.js";
 import "./chunk-AXNRPVLE.js";
 export {
   getExtForLang,

package/dist/index.d.ts

@@ -31,6 +31,9 @@ interface CachedEmbed {
 interface CachedEmbedKey {
     [key: string]: unknown;
 }
+interface CachedChatKeyWrapper {
+    [key: string]: unknown;
+}
 interface CachedNewChatSuggestion {
     [key: string]: unknown;
 }
@@ -47,6 +50,8 @@ interface SyncCache {
     embeds: CachedEmbed[];
     /** Embed keys for embed decryption */
     embedKeys: CachedEmbedKey[];
+    /** Chat key wrappers for wrapper-first chat decryption */
+    chatKeyWrappers?: CachedChatKeyWrapper[];
     /**
      * New chat suggestions from the last sync.
      * Each entry has id, chat_id, encrypted_suggestion, created_at.
@@ -559,7 +564,9 @@ interface UserTaskRecord {
     encrypted_task_key?: string | null;
     encrypted_title: string;
     encrypted_description?: string | null;
+    encrypted_labels?: string | null;
     encrypted_tags?: string | null;
+    label_hashes?: string[] | null;
     encrypted_linked_project_ids?: string | null;
     encrypted_activity_summary?: string | null;
     encrypted_latest_instruction?: string | null;
@@ -1283,6 +1290,8 @@ declare class OpenMatesClient {
      * encrypt/decrypt the chat's title, category, messages, etc.
      */
     private decryptChatKey;
+    private getMasterWrapperEncryptedChatKey;
+    private resolveChatKey;
     /**
      * Decrypt a single chat record from the sync cache into a ChatListItem.
      */
@@ -1582,6 +1591,8 @@ declare class OpenMatesClient {
         status?: UserTaskStatus;
         chatId?: string;
         projectId?: string;
+        labelHashes?: string[];
+        priority?: number;
         limit?: number;
     }): Promise<UserTaskRecord[]>;
     createUserTask(input: UserTaskCreateInput): Promise<UserTaskRecord>;
@@ -4800,12 +4811,15 @@ declare class GeneratedAppSkills {
     readonly workflows: WorkflowsAppSkills;
 }
 
+declare const PRIORITY_LEVELS: readonly ["none", "low", "medium", "high", "urgent"];
+type TaskPriorityLevel = typeof PRIORITY_LEVELS[number];
 interface DecryptedUserTask {
     taskId: string;
     source?: string;
     shortId: string;
     title: string;
     description: string;
+    labels: string[];
     tags: string[];
     latestInstruction: string;
     status: UserTaskStatus;
@@ -4816,6 +4830,7 @@ interface DecryptedUserTask {
     planId: string | null;
     dueAt: number | null;
     priority: number;
+    priorityLevel: TaskPriorityLevel;
     position: number;
     queueState: string;
     blockedReasonCode: string | null;
@@ -4827,21 +4842,31 @@ interface DecryptedUserTask {
 interface TaskCreateOptions {
     title: string;
     description?: string;
+    labels?: string[];
+    tags?: string[];
     status?: UserTaskStatus;
     assign?: string;
     chatId?: string | null;
     projectIds?: string[];
     planId?: string | null;
     dueAt?: number | null;
+    priority?: TaskPriorityLevel | number | null;
 }
 interface TaskUpdateOptions {
     title?: string;
     description?: string;
+    labels?: string[];
+    tags?: string[];
+    addLabels?: string[];
+    addTags?: string[];
+    removeLabels?: string[];
+    removeTags?: string[];
     status?: UserTaskStatus;
     assign?: string;
     chatId?: string | null;
     projectIds?: string[];
     planId?: string | null;
+    priority?: TaskPriorityLevel | number | null;
 }
 
 interface OpenMatesOptions {
@@ -4938,6 +4963,7 @@ interface EncryptedChatMetadata {
     id: string;
     encrypted_title?: string;
     encrypted_chat_key?: string;
+    chat_key_wrappers?: ChatKeyWrapperRecord[];
     encrypted_chat_summary?: string;
     encrypted_category?: string;
     title?: string;
@@ -4961,6 +4987,9 @@ type TaskListFilters = {
     status?: UserTaskStatus;
     chatId?: string;
     projectId?: string;
+    labels?: string[];
+    tags?: string[];
+    priority?: TaskPriorityLevel | number | null;
 };
 type TaskPlainCreateOptions = TaskCreateOptions;
 type TaskPlainUpdateOptions = TaskUpdateOptions;
@@ -4986,6 +5015,12 @@ interface EmbedKeyRecord {
     encrypted_embed_key?: string;
     [key: string]: unknown;
 }
+interface ChatKeyWrapperRecord {
+    hashed_chat_id?: string;
+    key_type?: string;
+    encrypted_chat_key?: string;
+    [key: string]: unknown;
+}
 interface FocusModeSelection {
     appId: string;
     focusModeId: string;
@@ -5043,8 +5078,9 @@ declare class OpenMates {
     masterKey(): Promise<Uint8Array>;
     sdkSession(): Promise<SdkSessionResponse>;
     resolveEmbedKeyForShare(embedKeys: EmbedKeyRecord[], embedId: string): Promise<Uint8Array | null>;
-    decryptChatMetadata<T extends EncryptedChatMetadata>(chat: T): Promise<T>;
+    decryptChatMetadata<T extends EncryptedChatMetadata>(chat: T, chatKeyWrappers?: ChatKeyWrapperRecord[]): Promise<T>;
     decryptLoadedChatPayload<T extends Record<string, unknown>>(payload: T): Promise<T>;
+    private resolveLoadedChatKey;
     private decryptLoadedChatEmbeds;
     private resolveLoadedEmbedKey;
     private requestWithMethod;

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   reconcileAuthoritativeChats,
   renderSupportInfo,
   serializeToYaml
-} from "./chunk-47BFVCB4.js";
+} from "./chunk-F4JZMA6W.js";
 import "./chunk-AXNRPVLE.js";
 export {
   APP_SKILL_METADATA,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.15.0-alpha.22",
+  "version": "0.15.0-alpha.24",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",