takibibase 1.11.0 → 1.14.0

package/SKILL.md

@@ -41,14 +41,31 @@ error hints.
 - `takibi tasks list | get <id> | claim <id> | status <id> <todo|in_progress|review|done> [--note …]`
   and `takibi tasks artifact add <taskId> <url> [--note …]`. The status
   `--note` is the review handoff note (max 1000 chars); leaving review
-  clears it.
+  clears it. A sent-back card keeps the last handoff as `previousReviewNote`
+  — read it for the last round's feedback without it being pasted into the body.
+- `takibi tasks artifact add <taskId> --markdown <file|-> [--title …] [--note …]`
+  — attach an inline markdown note (content from a file or stdin `-`,
+  max 50000 chars; title max 140 chars);
+  `takibi tasks artifact show <taskId> <artifactId>` prints one note's raw
+  markdown. Prefer inline markdown artifacts for text deliverables —
+  briefs, drafts, debriefs; external Drive/URLs only for sheets, slides,
+  or binary files.
 - `takibi tasks handoff <id> <profile> [--review] [--note "…"]` — hand a
   card you hold to another profile on the same board (name or UUID; an
   unknown name errors with the eligible names — never guess). Use
-  `--review` to move it to review in the same call and `--note` to leave
-  the review note with it: after the handoff you no longer hold the card,
-  so a follow-up `status` call would be refused. You cannot release a card
-  to nobody or hand on done/archived cards.
+  `--review` to submit your work for review in the same call (the inbox
+  credits you as the finisher) and `--note` to leave the review note with
+  it: after the handoff you no longer hold the card, so a follow-up
+  `status` call would be refused. You cannot release a card to nobody or
+  hand on done/archived cards.
+- `takibi tasks follow-up <id> --title "…"` — spin a fresh linked todo
+  off any card, including a finished one (`--body`, `--due <date>`,
+  `--assignee` for an exact board name or UUID — unknown names error
+  with the eligible list, and naming anyone other than yourself needs
+  Orchestrator). The new card lands in the source's project at To do,
+  unassigned unless `--assignee` names someone; the source keeps its
+  status, holder, and history, and nothing carries over. Never move a
+  done card back to To do to continue it — follow up instead.
 - `@name` in a task names the handoff target: when your part is
   finished, run `tasks handoff <id> name` (usually with `--review
   --note`). The mention itself assigns nothing — the handoff does.
@@ -146,12 +163,13 @@ abstains honestly instead of answering halfway.
 - Notes export/keep/remove need owner approval already given in the
   conversation. Export only creates a draft; verify it before adding
   content to Sources.
-- Task claim/status/handoff/artifact/escalation writes only with owner approval
+- Task claim/status/handoff/artifact/escalation/follow-up writes only with owner approval
   already given in conversation. Claim-first: a plain key must claim a card before
   moving or touching it; only orchestrators/owners accept (`review→done`),
   assign or release cards they do not hold, or archive. A holder may hand
   its own card to another eligible profile (`tasks handoff`). Title/body edits need the create cap —
-  claim-only keys can drive a card but cannot rewrite its text.
+  claim-only keys can drive a card but cannot rewrite its text. Follow-ups need
+  the create cap too, and any granted creator may spin one off a card it does not hold.
 - Boards need a whole-collection grant: folder-only or tag-only keys 403
   on every task route (the full-collection server message says so verbatim
   when the key holds the required cap; keys lacking the cap get the generic

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "takibibase",
-  "version": "1.11.0",
+  "version": "1.14.0",
   "description": "Thin CLI for the Takibi API: ask, search, tasks, docs, notes. Single file, zero dependencies.",
   "type": "module",
   "bin": {

package/takibi.mjs

@@ -37,7 +37,7 @@ import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 
 /** Baked fallback; the published package re-reads package.json next door. */
-const BAKED_VERSION = '1.11.0';
+const BAKED_VERSION = '1.14.0';
 const CLI_INFO = (() => {
   try {
     const pkg = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8'));
@@ -364,9 +364,12 @@ Commands:
   tasks claim <id>        Claim an open to-do card (atomic, one winner)
   tasks status <id> <st>  Move a card: todo | in_progress | review | done [--note <text>]
   tasks handoff <id> <profile>  Hand a card you hold to another profile [--review --note <text>]
+  tasks follow-up <id>  Spin a fresh linked todo off any card [--title/--body/--assignee/--due]
   tasks escalate <id>       Ask the Founder for help on a held card [--reason <text>]
   tasks deescalate <id>     Clear your escalation ("never mind")
-  tasks artifact add <taskId> <url>   Attach a link-only artifact
+  tasks artifact add <taskId> <url>   Attach a link artifact [--note/--size/--hash]
+  tasks artifact add <taskId> --markdown <file|->  Attach an inline markdown note [--title/--note]
+  tasks artifact show <taskId> <artifactId>  Print one markdown note's content
   doc list                Documents (metadata)
   doc get <id>            One document's metadata
   doc text <id>           Converted text of one document
@@ -398,10 +401,15 @@ Per-command options:
   ask/search: -q, --query <text> (or a bare positional), -k <n> (ask 1-12, search 1-20)
   tasks list: --all (include archived)
   tasks status: --note <text> (review handoff note; cleared when the card leaves review)
-  tasks handoff: <profile> is a name or UUID on this board; --review moves the card to
-                 review in the same call, --note <text> leaves the review note with it
+  tasks handoff: <profile> is a name or UUID on this board; --review submits your work
+                 for review in the same call, --note <text> leaves the review note with it
   tasks escalate: --reason <text> (required, max 500 chars — what do you need from the Founder?)
-  tasks artifact add: --note <text> --size <bytes> --hash <hex>
+  tasks follow-up: --title <text> (required, max 300 chars), --body <text> (max 20000 chars),
+                 --assignee <name-or-uuid>, --due <date>; the source card is never modified
+  tasks get: sent-back cards carry previousReviewNote, the last handoff note
+  tasks artifact add <url>: --note <text> --size <bytes> --hash <hex> (links only)
+  tasks artifact add --markdown <file|->: --title <text> --note <text> (content from file or stdin -, max 50000 chars; title max 140 chars)
+  tasks artifact show: prints the raw markdown (links carry no content)
   doc list: --limit <n> (1-100)   doc text: --max-chars <n>
   doc upload: <file> (pdf, md, txt, docx, max 10MB)
   notes append: --problem <text> (or a bare positional),
@@ -424,7 +432,7 @@ to probe the API and \`takibi projects\` to see this key's scope
 Agents: \`takibi skill --install\` puts the takibi-use skill where
 assistants look for it.
 
-Reads are free. Export stamps included notes. Task claim/status/handoff/artifact/escalation writes and doc uploads
+Reads are free. Export stamps included notes. Task claim/status/handoff/artifact/escalation/follow-up writes and doc uploads
 need owner approval in conversation (uploads also need the Uploads grant on the key).
 Account-only routes (delete, retry, download originals, PATCH docs/projects)
 are never the agent's to call — ask the account owner.
@@ -464,7 +472,7 @@ function parseArgv(argv) {
       i = ni;
     }
     else if (a.startsWith('--folder=')) globals.folder = a.slice('--folder='.length);
-    else if (a === '--query' || a === '-q' || a === '--q' || a === '-k' || a === '--limit' || a === '--max-chars' || a === '--all' || a === '--review' || a === '--add' || a === '--note' || a === '--reason' || a === '--size' || a === '--hash' || a === '--problem' || a === '--tried' || a === '--worked' || a === '--failed' || a === '--next-time' || a === '--source' || a === '--since' || a === '--run-id' || a === '--install' || a === '--force' || a === '--agents' || a === '--claude' || a === '--codex' || a === '--dir') {
+    else if (a === '--query' || a === '-q' || a === '--q' || a === '-k' || a === '--limit' || a === '--max-chars' || a === '--all' || a === '--review' || a === '--add' || a === '--note' || a === '--reason' || a === '--size' || a === '--hash' || a === '--markdown' || a === '--title' || a === '--body' || a === '--assignee' || a === '--due' || a === '--problem' || a === '--tried' || a === '--worked' || a === '--failed' || a === '--next-time' || a === '--source' || a === '--since' || a === '--run-id' || a === '--install' || a === '--force' || a === '--agents' || a === '--claude' || a === '--codex' || a === '--dir') {
       rest.push(a);
       if (a !== '--all' && a !== '--review' && a !== '--install' && a !== '--force' && a !== '--agents' && a !== '--claude' && a !== '--codex') {
         const [v, ni] = takeValue(a, i);
@@ -543,18 +551,48 @@ const taskLine = (t) => {
   if (t.escalationReason) bits.push(`· escalated: ${t.escalationReason}`);
   if (t.blocked) bits.push(`· blocked: ${t.blockedReason || 'no reason given'}`);
   if (t.artifacts?.length) bits.push(`· ${t.artifacts.length} artifact${t.artifacts.length === 1 ? '' : 's'}`);
+  if (t.followups?.length) bits.push(`· ${t.followups.length} follow-up${t.followups.length === 1 ? '' : 's'}`);
   if (t.archivedAt) bits.push('· archived');
   if (t.dueAt) bits.push(`· due ${t.dueAt}`);
   return bits.join(' ');
 };
 
+/**
+ * Display title for a task artifact: the explicit title when set, else
+ * the content's first ATX heading, else a fixed fallback. Local duplicate
+ * of artifactTitle in apps/web/src/tasks/artifacts.ts — this file ships
+ * standalone and cannot import TS.
+ */
+function artifactTitle(title, content) {
+  const explicit = title?.trim() ?? '';
+  if (explicit !== '') return explicit;
+  for (const line of (content ?? '').split('\n')) {
+    const text = /^#{1,6}\s+(.*)$/.exec(line.trim())?.[1] ?? '';
+    if (text !== '') return text;
+  }
+  return 'Untitled note';
+}
+
+/** One artifact row: links print the URL exactly as before; markdown
+ * notes (null URL) print the display title — never the literal null. */
+const artifactRow = (a) =>
+  a.kind === 'markdown' || a.url == null
+    ? `${artifactTitle(a.title, a.content ?? null)}${a.note ? ` — ${a.note}` : ''} [${a.id}]`
+    : `${a.url}${a.note ? ` — ${a.note}` : ''} [${a.id}]`;
+
 function renderTask(t) {
   out(taskLine(t));
   if (t.reviewNote) out(`review: ${t.reviewNote}`);
+  if (t.previousReviewNote) out(`previous review note: ${t.previousReviewNote}`);
   if (t.body) out(`\n${t.body}`);
+  if (t.followsUpOn) out(`follow-up of: ${t.followsUpOn.title} [${t.followsUpOn.id}]`);
+  if (t.followups?.length) {
+    out('follow-ups:');
+    for (const f of t.followups) out(`  - ${f.title} · ${f.status}${f.assigneeName ? ` · ${f.assigneeName}` : ''}${f.archivedAt ? ' · archived' : ''} [${f.id}]`);
+  }
   if (t.artifacts?.length) {
     out('');
-    for (const a of t.artifacts) out(`  - ${a.url}${a.note ? ` — ${a.note}` : ''} [${a.id}]`);
+    for (const a of t.artifacts) out(`  - ${artifactRow(a)}`);
   }
   err(`created ${t.createdAt} · updated ${t.updatedAt}`);
 }
@@ -648,13 +686,13 @@ async function listTasks(ctx, includeArchived) {
  * eligibility); names resolve exactly against GET /v1/tasks/assignees for
  * this board — same exact-match-or-error rule as --project names.
  */
-async function resolveAssignee(value, ctx) {
+async function resolveAssignee(value, ctx, label = 'tasks handoff') {
   const v = String(value).trim();
   if (UUID_RE.test(v)) return { id: v };
   const data = await api('GET', '/v1/tasks/assignees', {
     ...ctx,
     query: qparams([['projectId', ctx.projectId]]),
-    label: 'tasks handoff',
+    label,
   });
   const eligible = data?.assignees ?? [];
   const matches = eligible.filter((a) => a.name === v);
@@ -766,13 +804,73 @@ async function cmdTasks(tokens, globals) {
     return;
   }
   if (sub === 'artifact' || sub === 'artifacts') {
-    const [verb, taskId, url, ...flagTokens] = rest;
-    if (verb !== 'add' || !taskId || !url) throw usageError('Usage: takibi tasks artifact add <taskId> <url> [--note <t> --size <n> --hash <h>]');
+    const LINK_USAGE = 'Usage: takibi tasks artifact add <taskId> <url> [--note <t> --size <n> --hash <h>]';
+    const MD_USAGE = 'Usage: takibi tasks artifact add <taskId> --markdown <file|-> [--title <t>] [--note <t>]';
+    const [verb, taskId, ...after] = rest;
+    if (verb === 'show') {
+      const [artifactId, extra] = after;
+      if (!taskId || !artifactId || extra) throw usageError('Usage: takibi tasks artifact show <taskId> <artifactId>');
+      const ctx = await ctxFor(globals, { needKey: true });
+      const data = await api('GET', `/v1/tasks/${taskId}/artifacts/${artifactId}`, {
+        ...ctx,
+        query: qparams([['projectId', ctx.projectId]]),
+        label: 'tasks artifact show',
+      });
+      // --json prints the server envelope even for links (content null);
+      // human output refuses instead of printing an empty page.
+      if (ctx.json) {
+        out(JSON.stringify(data, null, 2));
+        return;
+      }
+      if (data.artifact.content == null) {
+        throw new CliError('That artifact is a link — it carries no stored content to print.');
+      }
+      out(data.artifact.content);
+      return;
+    }
+    const [url, ...flagTokens] = after;
+    if (verb !== 'add' || !taskId || !url) throw usageError(LINK_USAGE);
+    if (url === '--markdown') {
+      const [file, ...mdFlags] = flagTokens;
+      if (!file) throw usageError(MD_USAGE);
+      const md = {};
+      for (let i = 0; i < mdFlags.length; i++) {
+        const f = mdFlags[i];
+        if (f === '--title' || f === '--note') md[f.slice(2)] = mdFlags[++i];
+        else throw usageError(`Unexpected ${JSON.stringify(f)}. ${MD_USAGE}`);
+      }
+      if (md.title !== undefined && md.title === '') throw usageError(`--title needs non-empty text. ${MD_USAGE}`);
+      if (md.note !== undefined && md.note === '') throw usageError(`--note needs non-empty text. ${MD_USAGE}`);
+      let content;
+      if (file === '-') {
+        content = readFileSync(0, 'utf8');
+      } else {
+        try {
+          content = readFileSync(file, 'utf8');
+        } catch {
+          throw usageError(`No such file: ${file}.`);
+        }
+      }
+      if (!content.trim()) throw usageError(`${file === '-' ? 'That stdin' : file} is empty — nothing to attach.`);
+      const ctx = await ctxFor(globals, { needKey: true });
+      const data = await api('POST', `/v1/tasks/${taskId}/artifacts`, {
+        ...ctx,
+        query: qparams([['projectId', ctx.projectId]]),
+        body: { kind: 'markdown', title: md.title, content, note: md.note },
+        label: 'tasks artifact add',
+      });
+      if (ctx.json) out(JSON.stringify(data, null, 2));
+      else {
+        out(`attached ${data.artifact.id}`);
+        out(`  ${artifactTitle(data.artifact.title, content)}${data.artifact.note ? ` — ${data.artifact.note}` : ''}`);
+      }
+      return;
+    }
     const flags = {};
     for (let i = 0; i < flagTokens.length; i++) {
       const f = flagTokens[i];
       if (f === '--note' || f === '--size' || f === '--hash') flags[f.slice(2)] = flagTokens[++i];
-      else throw usageError(`Unexpected ${JSON.stringify(f)}. Usage: takibi tasks artifact add <taskId> <url> [--note <t> --size <n> --hash <h>]`);
+      else throw usageError(`Unexpected ${JSON.stringify(f)}. ${LINK_USAGE}`);
     }
     if (flags.note !== undefined && flags.note === '') throw usageError('--note needs non-empty text.');
     if (flags.size !== undefined) {
@@ -828,7 +926,51 @@ async function cmdTasks(tokens, globals) {
     else renderTask(data.task);
     return;
   }
-  throw usageError(`Unknown tasks command ${JSON.stringify(sub)}. Use list | get | claim | status | handoff | escalate | deescalate | artifact add.`);
+  if (sub === 'follow-up') {
+    const usage = 'Usage: takibi tasks follow-up <id> --title <text> [--body <text>] [--assignee <name-or-uuid>] [--due <date>]';
+    const [id, ...flagTokens] = rest;
+    if (!id || id.startsWith('--')) throw usageError(usage);
+    let title;
+    let body;
+    let assignee;
+    let due;
+    for (let i = 0; i < flagTokens.length; i++) {
+      const f = flagTokens[i];
+      if (f === '--title') title = flagTokens[++i];
+      else if (f === '--body') body = flagTokens[++i];
+      else if (f === '--assignee') assignee = flagTokens[++i];
+      else if (f === '--due') due = flagTokens[++i];
+      else throw usageError(`Unexpected ${JSON.stringify(f)}. ${usage}`);
+    }
+    // Validate everything before touching the key or network, mirroring
+    // the server limits so failures name the flag instead of 400ing.
+    if (title === undefined || title.trim() === '') throw usageError('--title needs non-empty text.');
+    if (title.length > 300) throw usageError('--title is max 300 chars.');
+    if (body !== undefined && body.length > 20000) throw usageError('--body is max 20000 chars.');
+    if (due !== undefined && due.trim() === '') throw usageError('--due needs a date.');
+    if (assignee !== undefined && String(assignee).trim() === '') throw usageError('--assignee needs a profile name or UUID.');
+    // No --project: the endpoint scopes by the source card's own project.
+    const ctx = await ctxFor(globals, { needKey: true, resolveProject: false });
+    if (assignee !== undefined) {
+      const v = String(assignee).trim();
+      if (!UUID_RE.test(v)) {
+        // Names resolve against the source card's own board.
+        const src = await api('GET', `/v1/tasks/${id}`, { ...ctx, label: 'tasks follow-up' });
+        assignee = (await resolveAssignee(v, { ...ctx, projectId: src.task.projectId }, 'tasks follow-up')).id;
+      } else {
+        assignee = v;
+      }
+    }
+    const data = await api('POST', `/v1/tasks/${id}/follow-ups`, {
+      ...ctx,
+      body: { title: title.trim(), body, assigneeProfileId: assignee, dueAt: due },
+      label: 'tasks follow-up',
+    });
+    if (ctx.json) out(JSON.stringify(data, null, 2));
+    else renderTask(data.task);
+    return;
+  }
+  throw usageError(`Unknown tasks command ${JSON.stringify(sub)}. Use list | get | claim | status | handoff | follow-up | escalate | deescalate | artifact add | artifact show.`);
 }
 
 async function cmdDoc(tokens, globals) {