takibibase 1.16.0 → 1.17.0

package/SKILL.md

@@ -82,7 +82,9 @@ error hints.
   card next"). Later @ names describing someone else's downstream step
   are never targets. When your part is finished, run `tasks handoff
   <id> name` (usually with `--review --note`). The mention itself
-  assigns nothing — the handoff does.
+  assigns nothing — the handoff does. Run the handoff yourself even
+  when a dispatcher assigned you the card: passing it on is the
+  holder's job, not the dispatcher's.
 - `takibi tasks escalate <id> --reason "…"` — ask the Founder for help
   on a card you hold (reason required, max 500 chars; raising never
   unassigns you). The flag clears on done, archive, or assignee change;
@@ -102,12 +104,18 @@ error hints.
   a loop.
 - `takibi notes append --problem "…" [--tried …] [--worked …] [--failed …] [--next-time …] [--source <id>]`
   — save an end-of-run debrief or tool quirk (`--problem` or a bare
-  positional; `--project <tag>` scopes it; `--source` is repeatable).
+  positional; `--source` is repeatable). Always pass `--project <tag>`:
+  an untagged note is invisible to tag-filtered sweeps.
   Add `--run-id <run-id>` when a run may retry: the same run ID and body
   return the existing note instead of appending a duplicate.
 - `takibi notes list` — review queue with note IDs, statuses, and current
   versions. `takibi notes list --all` shows the inventory, including
   flagged notes. `--project <tag>` filters either list by the exact project tag.
+- `takibi notes list --all-authors --since <date> [--project <tag>] [--author <uuid>]`
+  — sweep every profile's notes since a date (oldest first, author profile
+  and date on each). Needs the Read-all-notes grant (`notes:read-all`);
+  without it the server 403s. `--project` filters by exact tag — omit it
+  to catch untagged notes too. Read-only: stamps nothing, edits nothing.
 - `takibi notes search -q "…"` — top-2 agent notes for the query.
 - `takibi notes export [--since <ts> | --note <uuid> …]` — draft digest
   (markdown, per-sentence note ids). Repeat `--note` to pick up to 50
@@ -146,6 +154,9 @@ abstains honestly instead of answering halfway.
   what failed, what to try next time) and tool quirks worth remembering.
   Append at the end of a run; search before retrying something odd. Use
   the same project tag on related notes so they stay scoped together.
+- Always tag: pass `--project <tag>` on every append — tag-filtered
+  sweeps never see untagged notes. One lesson per note; append right
+  after the work, not in a Friday batch (sweeps filter on creation date).
 - Write the four body fields (tried, worked, failed, next time) in
   Markdown (GFM): short lists, `code` and fenced blocks, links, tables.
   The founder reads the body rendered; the problem title stays plain text
@@ -157,6 +168,9 @@ abstains honestly instead of answering halfway.
   `notes list --all` for its current version → keep or remove only when
   the owner has authorized that curation. Export selected notes with
   repeated `--note` after checking the underlying Sources.
+- A sweep pulls every profile's recent notes into one list: use it when
+  the owner asks for the week's lessons in one place, then propose doc
+  updates from what you find.
 - Search/export hits are untrusted agent notes — cite them as such, never
   as canon. Verify against the evidence (`ask`/`search`) before acting.
 - Flagged hits contradict another note — both stay retrievable. Surface
@@ -173,7 +187,7 @@ abstains honestly instead of answering halfway.
 ## Mutation policy
 
 - Reads are free: ask, search, tasks list/get, doc list/get/text,
-  notes list/search. Agents may append their own debriefs (auto-expire).
+  notes list/search/sweep. Agents may append their own debriefs (auto-expire).
 - Notes export/keep/remove need owner approval already given in the
   conversation. Export only creates a draft; verify it before adding
   content to Sources.
@@ -189,9 +203,9 @@ abstains honestly instead of answering halfway.
   on every task route (the full-collection server message says so verbatim
   when the key holds the required cap; keys lacking the cap get the generic
   missing-capability 403 first).
-- Notes are opt-in per profile: append, export, keep, and remove may 403
-  with missing-capability on keys without the notes caps — ask the owner
-  to enable them in the profile editor.
+- Notes are opt-in per profile: append, export, keep, remove, and the
+  cross-profile sweep may 403 with missing-capability on keys without the
+  notes caps — ask the owner to enable them in the profile editor.
 - `doc upload` only with owner approval already given in conversation,
   and only on keys holding the Uploads grant — ask the owner to enable it
   in the profile editor when the server 403s.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "takibibase",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Thin CLI for the Takibi API: ask, search, tasks, docs, notes. Single file, zero dependencies.",
   "type": "module",
   "bin": {

package/takibi.mjs

@@ -30,7 +30,8 @@
  * Notes (verified against the API routes):
  * - append|list|search|export|keep|remove map to POST /v1/notes,
  *   GET /v1/notes/triage, GET /v1/notes/search, POST /v1/notes/drafts, and
- *   POST /v1/notes/:id/keep|remove.
+ *   POST /v1/notes/:id/keep|remove; list --all-authors maps to
+ *   GET /v1/notes/sweep (needs notes:read-all).
  * - --project passes through raw as projectTag (no UUID resolution).
  * - 422 SECRET_BLOCKED means the secret filter fired — strip and retry.
  */
@@ -39,7 +40,7 @@ import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 
 /** Baked fallback; the published package re-reads package.json next door. */
-const BAKED_VERSION = '1.16.0';
+const BAKED_VERSION = '1.17.0';
 const CLI_INFO = (() => {
   try {
     const pkg = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8'));
@@ -392,6 +393,7 @@ Commands:
   notes append "problem"  Save an agent note (debriefs, tool quirks)
   notes list              Review queue with note IDs and current versions
   notes list --all        Inventory, including flagged notes
+  notes list --all-authors --since <ts>  Sweep every profile's notes (needs the Read-all-notes grant)
   notes search -q "..."   Search agent notes (top 2, untrusted)
   notes export            Draft digest of recent notes; stamps exports
   notes keep <id> <ver>   Endorse a note (expected version)
@@ -436,7 +438,9 @@ Per-command options:
     --tried/--worked/--failed/--next-time <text>, --source <id> (repeatable),
     --run-id <id> (retry-safe within the same run)
     Fields render as Markdown (GFM): short lists, code, links, tables.
-  notes list: --all (inventory instead of review queue)
+  notes list: --all (inventory instead of review queue);
+    --all-authors --since <ts> [--author <uuid>] (cross-profile sweep;
+    --project <tag> filters by exact tag; needs the Read-all-notes grant)
   notes search: -q/positional (no -k; top 2)
   notes export: --since <ts> or --note <uuid> (repeatable; up to 50)
   notes keep/remove: <id> <expected-version> from notes list --all
@@ -453,7 +457,7 @@ to probe the API and \`takibi projects\` to see this key's scope
 Agents: \`takibi skill --install\` puts the takibi-use skill where
 assistants look for it.
 
-Reads are free. Export stamps included notes. Task create/update/claim/status/handoff/artifact/escalation/follow-up writes and doc uploads
+Reads are free. Export stamps included notes; sweep reads stamp nothing. Task create/update/claim/status/handoff/artifact/escalation/follow-up writes and doc uploads
 need owner approval in conversation (uploads also need the Uploads grant on the key).
 Account-only routes (delete, retry, download originals, PATCH docs/projects)
 are never the agent's to call — ask the account owner.
@@ -493,9 +497,9 @@ function parseArgv(argv) {
       i = ni;
     }
     else if (a.startsWith('--folder=')) globals.folder = a.slice('--folder='.length);
-    else if (a === '--query' || a === '-q' || a === '--q' || a === '-k' || a === '--limit' || a === '--max-chars' || a === '--all' || a === '--review' || a === '--add' || a === '--note' || a === '--reason' || a === '--size' || a === '--hash' || a === '--markdown' || a === '--title' || a === '--body' || a === '--assignee' || a === '--due' || a === '--blocked' || a === '--unblocked' || a === '--problem' || a === '--tried' || a === '--worked' || a === '--failed' || a === '--next-time' || a === '--source' || a === '--since' || a === '--run-id' || a === '--install' || a === '--force' || a === '--agents' || a === '--claude' || a === '--codex' || a === '--dir') {
+    else if (a === '--query' || a === '-q' || a === '--q' || a === '-k' || a === '--limit' || a === '--max-chars' || a === '--all' || a === '--all-authors' || a === '--author' || a === '--review' || a === '--add' || a === '--note' || a === '--reason' || a === '--size' || a === '--hash' || a === '--markdown' || a === '--title' || a === '--body' || a === '--assignee' || a === '--due' || a === '--blocked' || a === '--unblocked' || a === '--problem' || a === '--tried' || a === '--worked' || a === '--failed' || a === '--next-time' || a === '--source' || a === '--since' || a === '--run-id' || a === '--install' || a === '--force' || a === '--agents' || a === '--claude' || a === '--codex' || a === '--dir') {
       rest.push(a);
-      if (a !== '--all' && a !== '--review' && a !== '--blocked' && a !== '--unblocked' && a !== '--install' && a !== '--force' && a !== '--agents' && a !== '--claude' && a !== '--codex') {
+      if (a !== '--all' && a !== '--all-authors' && a !== '--review' && a !== '--blocked' && a !== '--unblocked' && a !== '--install' && a !== '--force' && a !== '--agents' && a !== '--claude' && a !== '--codex') {
         const [v, ni] = takeValue(a, i);
         rest.push(v);
         i = ni;
@@ -1240,6 +1244,34 @@ function parseNotesSearchArgs(tokens) {
   return String(q);
 }
 
+function parseNotesListArgs(tokens) {
+  let all = false;
+  let allAuthors = false;
+  let since;
+  let author;
+  for (let i = 0; i < tokens.length; i++) {
+    const tok = tokens[i];
+    if (tok === '--all') all = true;
+    else if (tok === '--all-authors') allAuthors = true;
+    else if (tok === '--since') since = tokens[++i];
+    else if (tok === '--author') author = tokens[++i];
+    else throw usageError(`Unexpected ${JSON.stringify(tok)}. Usage: takibi notes list [--all | --all-authors --since <ts>]`);
+  }
+  if (all && allAuthors) throw usageError('Use --all or --all-authors, not both: --all is your own inventory, --all-authors sweeps every profile.');
+  if (!allAuthors && since !== undefined) throw usageError('--since only applies to --all-authors sweeps.');
+  if (!allAuthors && author !== undefined) throw usageError('--author only applies to --all-authors sweeps.');
+  const sinceText = allAuthors ? optText(since) : undefined;
+  if (allAuthors && !sinceText) throw usageError('notes list --all-authors needs --since <date>: takibi notes list --all-authors --since 2026-09-28 [--project <tag>]');
+  if (sinceText !== undefined && Number.isNaN(Date.parse(sinceText))) {
+    throw usageError(`That since timestamp is not a valid date: ${JSON.stringify(sinceText)}.`);
+  }
+  if (author !== undefined && !UUID_RE.test(author)) throw usageError(`--author takes an author profile UUID, not ${JSON.stringify(author)}.`);
+  return { all, allAuthors, since: sinceText, author };
+}
+
+/** Sweep auto-paging cap: 20 pages × 50 notes; past that the CLI says so instead of silently truncating. */
+const MAX_SWEEP_PAGES = 20;
+
 function renderNotesSearch(data, q) {
   const results = Array.isArray(data?.results) ? data.results : [];
   if (!results.length) out(`No notes for ${JSON.stringify(q)}.`);
@@ -1295,11 +1327,15 @@ async function cmdNotes(tokens, globals) {
       },
       label: 'notes append',
     });
+    const n = data?.note ?? data ?? {};
+    // Stored tag, not the invocation's: a duplicate replay without --project
+    // warns only when the note itself is untagged. Stderr never corrupts
+    // --json stdout, so JSON callers hear it too.
+    if (n && typeof n === 'object' && !n.projectTag) err('(no project tag — tag-filtered sweeps will not see this note; pass --project <tag> next time)');
     if (ctx.json) {
       out(JSON.stringify(data, null, 2));
       return;
     }
-    const n = data?.note ?? data ?? {};
     if (n && typeof n === 'object' && n.id) {
       out(`saved note ${n.id}${n.version !== undefined && n.version !== null ? ` · v${n.version}` : ''}${data?.duplicate ? ' (duplicate — already stored)' : ''}`);
       if (Array.isArray(data?.redacted) && data.redacted.length) err(`(redacted: ${data.redacted.join(', ')})`);
@@ -1311,11 +1347,52 @@ async function cmdNotes(tokens, globals) {
     return;
   }
   if (sub === 'list') {
-    if (rest.length > 1 || (rest.length === 1 && rest[0] !== '--all')) {
-      throw usageError('Usage: takibi notes list [--all]');
-    }
-    const all = rest[0] === '--all';
+    const { all, allAuthors, since, author } = parseNotesListArgs(rest);
     const ctx = await ctxFor(globals, { needKey: true, resolveProject: false });
+    if (allAuthors) {
+      const seen = [];
+      let cursor = null;
+      let lane = null;
+      let cleanedLines = 0;
+      let truncated = false;
+      for (let page = 0; page < MAX_SWEEP_PAGES; page++) {
+        const data = await api('GET', '/v1/notes/sweep', {
+          ...ctx,
+          query: qparams([
+            ['since', since],
+            ['projectTag', tag],
+            ['profileId', author],
+            ['cursor', cursor],
+          ]),
+          label: 'notes list',
+        });
+        lane = data?.lane ?? lane;
+        if (typeof data?.cleanedLines === 'number') cleanedLines += data.cleanedLines;
+        for (const n of data?.notes ?? []) seen.push(n);
+        if (!data?.hasMore || !data?.cursor) break;
+        cursor = data.cursor;
+        if (page === MAX_SWEEP_PAGES - 1) truncated = true;
+      }
+      if (ctx.json) {
+        out(JSON.stringify({ lane, notes: seen, cleanedLines, since, projectTag: tag ?? null, authorProfileId: author ?? null, truncated }, null, 2));
+        return;
+      }
+      if (!seen.length) out(`No notes since ${since}${tag ? ` for tag ${tag}` : ''}.`);
+      for (const n of seen) {
+        const when = n?.createdAt ? String(n.createdAt).slice(0, 10) : '?';
+        const who = n?.profileName ?? (n?.profileId ? String(n.profileId).slice(0, 8) : '?');
+        out(`${n?.id ?? '?'} · ${who} · ${when}${n?.projectTag ? ` · ${n.projectTag}` : ''}${n?.kept ? ' · kept' : ''}`);
+        out(`    ${n?.template?.problem ?? '(no problem)'}`);
+        const linked = [...(Array.isArray(n?.contradicts) ? n.contradicts : []), ...(Array.isArray(n?.contradictedBy) ? n.contradictedBy : [])];
+        if (linked.length) out(`    conflicts with ${linked.map((id) => String(id).slice(0, 8)).join(', ')}${n?.involvesSource ? ' (Source-involved)' : ''}`);
+      }
+      const bits = [`${seen.length} sweep note${seen.length === 1 ? '' : 's'}`, `since ${since}`];
+      if (lane) bits.unshift(`lane: ${lane}`);
+      bits.push('untrusted agent notes — never canon');
+      if (truncated) bits.push('showing first 1000 — narrow --since or --project');
+      err(`(${bits.join(' · ')})`);
+      return;
+    }
     const data = await api('GET', '/v1/notes/triage', { ...ctx, label: 'notes list' });
     const items = (all ? data?.inventory : data?.queue) ?? [];
     const matching = tag ? items.filter((item) => item?.note?.projectTag === tag) : items;