wood-fired-tasks 2.1.1 → 2.2.0

package/CHANGELOG.md

@@ -11,7 +11,60 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 ## [Unreleased]
 
-_No changes yet._
+## [v2.2.0] - 2026-06-11
+
+### Added
+- **Guaranteed task sizing.** Every task now carries a server-derived job size
+  so the Configurable-Task-Models `resolve_model` size routing (shipped in
+  v2.1.0) engages on the live backlog, while each task stays honestly
+  *unscored* for WSJF ranking: a deterministic `minutesToTier` mapping,
+  `auto_size` / `boot_sweep` history triggers, a server-internal size-only
+  write path, a `decomp-*` submission-contract gate, auto-sizing of WSJF-less
+  creates, a minutes-vs-jobSize conflict gate, recompute on `update_task` when
+  `estimated_minutes` changes (manual sizes are never clobbered), an idempotent
+  **boot sweep** that backfills NULL job sizes on every server start, and a
+  `wsjf_health` auto-sized-pending finding.
+- **`wft list --status all`** explicit sentinel and a `statusFilter` echo in
+  `--json` output (task #1006). The default `wft list` view already returns
+  every status — open, in_progress, blocked, done, and closed — and the
+  `--help` text now states this plainly so machine consumers don't read a
+  status transition (e.g. open → blocked) as a deleted task. `--status all`
+  is accepted as a self-documenting way to ask for "every status", and the
+  JSON envelope's `metadata.statusFilter` names the effective filter
+  (`all` or the requested status). The default view is unchanged.
+
+### Changed
+- **Configurable Task Models hardening** (PR-#55 review follow-ups, #928–#933):
+  `resolve_model` parity hardening for missing-project and foreign/nonexistent
+  `task_id`; single-sourced `PIPELINE_ROLES` / `FAMILY_LADDER` /
+  `DEFAULT_MODEL_MAP` with a code-level `resolveAuto`; the `modelPolicyService`
+  is now wired once in `createApp` with a memoized global policy and a prepared
+  resolver lookup; the model-catalog wire shape, model-tool definitions, and
+  JSON-column parser are single-sourced.
+- **wft-router**: real-event age gauge, start time, by-kind split, debug
+  pings, and stale-subscription resubscribe; plus an opt-in cold-start sweep
+  that dispatches pre-existing open backlogs so a freshly started router does
+  not miss work created while it was down.
+
+### Fixed
+- **SSE**: close the stream on every server-initiated eviction and align the
+  buffer TTL with the connection age window, so long-lived clients no longer
+  silently go deaf at the eviction boundary (#1001).
+- **Claims**: same-assignee renewal, a `task.claim_released` event, and TTL
+  visibility — long-running workers no longer lose their claim without a signal
+  (#1003).
+- **Atomic block-with-dependency** via `update_task blocked_by`: a `blocked`
+  status without a blocking edge is rejected rather than becoming a dead end
+  (#1004).
+- **Non-interactive `tasks create` / `tasks comment-add` default attribution to
+  the logged-in identity** (task #1007). Scripted runs no longer fail with
+  "Missing required field: created-by" (or `author`) when `--created-by` /
+  `--author` is omitted but credentials are present — the value defaults to the
+  credentials display name (email fallback), the same identity `tasks whoami`
+  reports. The original error is preserved only when no identity can be resolved
+  (no credentials file).
+- **wft-router**: spell the NUL label-separator as a `\u0000` escape rather than
+  a raw byte.
 
 ## [v2.1.1] - 2026-06-09
 
@@ -65,8 +118,9 @@ _No changes yet._
 - **Test suite no longer launches the developer's real browser.**
   `setup.remote.test.ts` drove the device flow with `openBrowser: true`, so
   every `npm test` on a DISPLAY-set desktop spawned `xdg-open` at a mock
-  server. `openBrowser()` now honors `WFT_NO_BROWSER`, set for every test via
-  `vitest.setup.ts`.
+  server. `runDeviceLogin` now takes an injectable `opener` seam (defaulting to
+  the real `openBrowser`); tests inject a stub instead of relying on a global
+  env flag that, if leaked, would silently disable browser login for real users.
 - **Documentation counts drift.** README / `docs/INTERFACES.md` / `docs/MCP.md`
   had stale tool (27 vs 31), route (52/45 vs 59/52), and CLI command (42 vs 45)
   counts, plus a stale "model tools are stdio-only" claim from before remote

package/README.md

@@ -658,7 +658,8 @@ Wood Fired Tasks streams real-time task and project change notifications via Ser
 | task.updated | Task fields modified |
 | task.deleted | Task deleted |
 | task.status_changed | Task status transition |
-| task.claimed | Task claimed by agent |
+| task.claimed | Task claimed by agent (also emitted on a same-assignee claim renewal) |
+| task.claim_released | Stale claim auto-released by the TTL sweep (carries `previous_assignee`, `expired_claimed_at`, `released_at`) |
 | project.created | New project created |
 | project.updated | Project modified |
 | project.deleted | Project deleted |

package/SECURITY.md

@@ -14,11 +14,11 @@ security updates. Older tags are provided as-is.
 | Version           | Supported          |
 | ----------------- | ------------------ |
 | `main` (HEAD)     | :white_check_mark: |
-| `v2.1.1` (latest) | :white_check_mark: |
+| `v2.2.0` (latest) | :white_check_mark: |
 | `v1.0` – `v2.0.6` | :x:                |
 
 "Latest" tracks whichever tag is most recent on GitHub; at the time of
-writing that is `v2.1.1`. If you are reading this on an older checkout,
+writing that is `v2.2.0`. If you are reading this on an older checkout,
 verify the current latest release via
 `git tag --sort=-creatordate | head -1` or the GitHub Releases page.
 

package/dist/api/api-response.d.ts

@@ -94,6 +94,8 @@ export declare function parseTaskResponse(payload: unknown, endpoint: string): {
         verifier_request_id?: string | undefined;
         verified_at?: string | undefined;
     } | null;
+    claim_ttl_minutes?: number | undefined;
+    claim_remaining_seconds?: number | undefined;
 };
 /** Convenience: validate a single project response body. */
 export declare function parseProjectResponse(payload: unknown, endpoint: string): {
@@ -186,6 +188,8 @@ export declare function parseTaskListResponse(payload: unknown, endpoint: string
             verifier_request_id?: string | undefined;
             verified_at?: string | undefined;
         } | null;
+        claim_ttl_minutes?: number | undefined;
+        claim_remaining_seconds?: number | undefined;
     }[];
     total: number;
     limit: number;

package/dist/api/routes/models/index.d.ts

@@ -1,5 +1,21 @@
 import { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
 import { z } from 'zod';
+/**
+ * Configurable Task Models (Task 13) — GET /api/v1/models
+ *
+ * Exposes the runtime-discovered Claude model catalog (task #917's
+ * `model-catalog.service`) over REST so the remote MCP proxy / dashboard /
+ * `set-models` interview can enumerate the available models. The 200 body is
+ * `{ models, stale }` — identical to the service's `ModelCatalog` and the
+ * stdio MCP `list_models` tool's structured output.
+ *
+ * `stale: true` signals the catalog was served from the static fallback (no
+ * ANTHROPIC_API_KEY, non-OK Models API response, or a network error). The
+ * service NEVER throws from `list()`, so this route always returns 200.
+ *
+ * Auth: inherits the standard `/api/v1` auth chain (the parent plugin is
+ * mounted inside the `/api/v1` scope that wires `authPlugin`). No custom guard.
+ */
 /** The `{ models, stale }` envelope returned by GET /models. */
 export declare const ModelCatalogResponseSchema: z.ZodObject<{
     models: z.ZodArray<z.ZodObject<{

package/dist/api/routes/models/index.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { ModelCatalogEntrySchema } from '../../../schemas/model-catalog.schema.js';
 /**
  * Configurable Task Models (Task 13) — GET /api/v1/models
  *
@@ -15,13 +16,6 @@ import { z } from 'zod';
  * Auth: inherits the standard `/api/v1` auth chain (the parent plugin is
  * mounted inside the `/api/v1` scope that wires `authPlugin`). No custom guard.
  */
-/** One discovered model, mirroring `ModelCatalogEntry` from the catalog service. */
-const ModelCatalogEntrySchema = z.object({
-    id: z.string(),
-    display_name: z.string(),
-    family: z.string(),
-    created_at: z.string(),
-});
 /** The `{ models, stale }` envelope returned by GET /models. */
 export const ModelCatalogResponseSchema = z.object({
     models: z.array(ModelCatalogEntrySchema),

package/dist/api/routes/projects/resolve-model.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { ErrorResponseSchema } from '../tasks/schemas.js';
+import { PipelineRoleSchema } from '../../../schemas/model-policy.schema.js';
 /**
  * Configurable Task Models (Task #926) — GET /api/v1/projects/:id/resolve-model
  *
@@ -21,10 +22,15 @@ import { ErrorResponseSchema } from '../tasks/schemas.js';
  * wires in-process (project policy ?? global default, per-slot merge, jobSize→
  * category routing when `task_id` is supplied).
  *
- * Project-existence is enforced explicitly so a missing project yields a 404
- * ProblemDetails (mirrors the sibling `/:id/topology` and `/:id/dependency-graph`
- * routes). Without the guard an unknown project would resolve to the global
- * default (or null) silently rather than signalling the bad id.
+ * Project-existence is enforced by the resolver itself (task #928): a missing
+ * project throws NotFoundError → 404 ProblemDetails (mirrors the sibling
+ * `/:id/topology` and `/:id/dependency-graph` routes), so an unknown project
+ * never resolves to the global default (or null) silently. The route carries
+ * no separate pre-fetch guard (task #931): the resolver's single project
+ * fetch doubles as the 404 check. The resolver also validates `task_id`: a
+ * nonexistent one throws NotFoundError (→ 404) and one belonging to a
+ * different project throws ValidationError (→ 400), so size-routing can never
+ * silently use a foreign task's jobSize.
  *
  * Auth: inherits the standard projects-route auth chain (the parent
  * `projectRoutes` plugin is mounted inside the `/api/v1` scope that wires
@@ -43,18 +49,21 @@ const resolveModelRoutes = async (fastify) => {
                 'MCP tool output. Read-only.',
             params: z.object({ id: z.coerce.number().int().positive() }),
             querystring: z.object({
-                role: z.enum(['execution', 'validation', 'planning']),
+                role: PipelineRoleSchema,
                 task_id: z.coerce.number().int().positive().optional(),
             }),
             response: {
                 200: ResolveModelResponseSchema,
+                400: ErrorResponseSchema,
                 404: ErrorResponseSchema,
             },
         },
     }, async (request, reply) => {
-        // Existence guard → 404 on a missing project. getProject throws
-        // NotFoundError, mapped to the 404 ProblemDetails by the error handler.
-        fastify.projectService.getProject(request.params.id);
+        // Existence guard → 404 on a missing project: since task #928 the
+        // resolver itself throws NotFoundError (mapped to the 404
+        // ProblemDetails by the error handler), so the former
+        // `projectService.getProject` pre-fetch here was a redundant second
+        // fetch + full inflation of the same row (task #931 — one shared fetch).
         const resolved = fastify.modelPolicyService.resolveModel(request.params.id, request.query.role, request.query.task_id);
         // `resolved` is `{ model } | { model: 'auto' } | null` — sent verbatim so
         // the remote MCP tool is transport-indistinguishable from the stdio one.

package/dist/api/routes/projects/wsjf.js

@@ -104,6 +104,10 @@ const HealthFindingSchema = z.object({
         'stale-time-criticality',
         'high-fallback-ratio',
         'score-churn',
+        'auto-sized-pending',
+        // Task #1004: emitted by check_health (edge-less blocked lint); part of
+        // the shared HealthCheckId union, never produced by the WSJF linter.
+        'blocked-without-edge',
     ]),
     severity: z.enum(['info', 'warning', 'critical']),
     message: z.string(),

package/dist/api/routes/settings/model-policy.js

@@ -48,10 +48,14 @@ const modelPolicyRoutes = async (fastify) => {
         // the clear path persists SQL NULL rather than tripping the service's
         // non-null Zod parse. A non-null body has already passed the
         // `ModelPolicyNullableSchema` body validator (invalid → 400 upstream).
-        fastify.settingsService.setModelPolicyDefault(request.body ?? null);
-        // Echo the persisted policy back so callers get a post-write confirmation
-        // (and round-trip the canonical stored shape).
-        return reply.send(fastify.settingsService.getModelPolicyDefault());
+        const policy = request.body ?? null;
+        fastify.settingsService.setModelPolicyDefault(policy);
+        // Echo the validated body back. `request.body` has already been parsed
+        // through `ModelPolicyNullableSchema` by the route's body validator —
+        // the SAME canonical shape the service just persisted — so re-reading +
+        // re-validating the singleton row here was a redundant round-trip
+        // (task #931). A write failure throws before this line.
+        return reply.send(policy);
     });
 };
 export default modelPolicyRoutes;

package/dist/api/routes/tasks/schemas.d.ts

@@ -31,6 +31,8 @@ export declare const TaskResponseSchema: z.ZodObject<{
     updated_at: z.ZodString;
     version: z.ZodNumber;
     claimed_at: z.ZodNullable<z.ZodString>;
+    claim_ttl_minutes: z.ZodOptional<z.ZodNumber>;
+    claim_remaining_seconds: z.ZodOptional<z.ZodNumber>;
     tags: z.ZodArray<z.ZodString>;
     acceptance_criteria: z.ZodNullable<z.ZodString>;
     verification_evidence: z.ZodNullable<z.ZodObject<{
@@ -88,6 +90,8 @@ export declare const TaskListResponseSchema: z.ZodArray<z.ZodObject<{
     updated_at: z.ZodString;
     version: z.ZodNumber;
     claimed_at: z.ZodNullable<z.ZodString>;
+    claim_ttl_minutes: z.ZodOptional<z.ZodNumber>;
+    claim_remaining_seconds: z.ZodOptional<z.ZodNumber>;
     tags: z.ZodArray<z.ZodString>;
     acceptance_criteria: z.ZodNullable<z.ZodString>;
     verification_evidence: z.ZodNullable<z.ZodObject<{
@@ -145,6 +149,8 @@ export declare const TaskListPaginatedResponseSchema: z.ZodObject<{
         updated_at: z.ZodString;
         version: z.ZodNumber;
         claimed_at: z.ZodNullable<z.ZodString>;
+        claim_ttl_minutes: z.ZodOptional<z.ZodNumber>;
+        claim_remaining_seconds: z.ZodOptional<z.ZodNumber>;
         tags: z.ZodArray<z.ZodString>;
         acceptance_criteria: z.ZodNullable<z.ZodString>;
         verification_evidence: z.ZodNullable<z.ZodObject<{
@@ -210,6 +216,8 @@ export declare const ClaimResponseSchema: z.ZodObject<{
     updated_at: z.ZodString;
     version: z.ZodNumber;
     claimed_at: z.ZodNullable<z.ZodString>;
+    claim_ttl_minutes: z.ZodOptional<z.ZodNumber>;
+    claim_remaining_seconds: z.ZodOptional<z.ZodNumber>;
     tags: z.ZodArray<z.ZodString>;
     acceptance_criteria: z.ZodNullable<z.ZodString>;
     verification_evidence: z.ZodNullable<z.ZodObject<{

package/dist/api/routes/tasks/schemas.js

@@ -21,6 +21,16 @@ export const TaskResponseSchema = z.object({
     updated_at: z.string(),
     version: z.number(),
     claimed_at: z.string().nullable(),
+    /**
+     * Task #1003: claim-TTL visibility. Computed at read time by
+     * `TaskService.getTask` for tasks holding an active claim (in_progress +
+     * assignee + claimed_at); absent otherwise. `claim_remaining_seconds` is
+     * the floor-clamped time until the ClaimReleaseService sweep may
+     * auto-release the claim — renew with a same-assignee `claim` call
+     * before it reaches 0.
+     */
+    claim_ttl_minutes: z.number().int().positive().optional(),
+    claim_remaining_seconds: z.number().int().nonnegative().optional(),
     tags: z.array(z.string()),
     /**
      * Wave 1.3 (task #311): optional free-form acceptance criteria (markdown).

package/dist/api/server.d.ts

@@ -9,7 +9,7 @@ import { TopologyService } from '../services/topology.service.js';
 import { CommentService } from '../services/comment.service.js';
 import { SettingsService } from '../services/settings.service.js';
 import { ModelCatalogService } from '../services/model-catalog.service.js';
-import { type ModelPolicyService } from '../services/model-policy.service.js';
+import type { ModelPolicyService } from '../services/model-policy.service.js';
 import { SSEManager } from '../events/sse-manager.js';
 import { IdempotencyService } from '../services/idempotency.service.js';
 /**

package/dist/api/server.js

@@ -10,9 +10,6 @@ import fastifyFormbody from '@fastify/formbody';
 import { createApp } from '../index.js';
 import { config } from '../config/env.js';
 import { SESSION_LIFETIME_SECONDS } from '../web/session-constants.js';
-import { createModelPolicyService, } from '../services/model-policy.service.js';
-import { ProjectRepository } from '../repositories/project.repository.js';
-import { TaskRepository } from '../repositories/task.repository.js';
 import { SSEManager } from '../events/sse-manager.js';
 import { IdempotencyService } from '../services/idempotency.service.js';
 import { ClaimReleaseService } from '../services/claim-release.service.js';
@@ -109,22 +106,11 @@ export async function createServer(options) {
     // back the /settings/model-policy and /models routes respectively.
     server.decorate('settingsService', app.settingsService);
     server.decorate('modelCatalogService', app.modelCatalogService);
-    // Configurable Task Models (Task #926): construct the model-policy resolver
-    // behind GET /projects/:id/resolve-model. Its three lookups are injected over
-    // the SAME `app.db` handle every other service shares (db-backed repos are
-    // stateless prepared-statement holders), mirroring how `src/mcp/index.ts`
-    // wires the resolver behind the stdio `resolve_model` tool:
-    //   - getProjectPolicy ← a project's parsed `model_policy` column.
-    //   - getGlobalPolicy  ← the SAME settings service backing get/set defaults.
-    //   - getJobSize       ← a task's WSJF jobSize Fibonacci tier.
-    const modelPolicyProjectRepo = new ProjectRepository(app.db);
-    const modelPolicyTaskRepo = new TaskRepository(app.db);
-    const modelPolicyService = createModelPolicyService({
-        getProjectPolicy: (projectId) => modelPolicyProjectRepo.findById(projectId)?.model_policy ?? null,
-        getGlobalPolicy: () => app.settingsService.getModelPolicyDefault(),
-        getJobSize: (taskId) => modelPolicyTaskRepo.findById(taskId)?.wsjf_job_size ?? null,
-    });
-    server.decorate('modelPolicyService', modelPolicyService);
+    // Configurable Task Models (Task #926 / #931): the model-policy resolver
+    // behind GET /projects/:id/resolve-model. Constructed ONCE in `createApp`
+    // (same instance the stdio MCP server wires behind its `resolve_model`
+    // tool) — see src/index.ts for the dep wiring.
+    server.decorate('modelPolicyService', app.modelPolicyService);
     server.decorate('db', app.db);
     // Task #357: expose OIDC boot state to /health/detailed so a degraded
     // discovery is a queryable signal, not just a one-time boot log line.
@@ -170,6 +156,7 @@ export async function createServer(options) {
         eventBus.subscribe('task.deleted', (event) => sseManager.broadcast(event)),
         eventBus.subscribe('task.status_changed', (event) => sseManager.broadcast(event)),
         eventBus.subscribe('task.claimed', (event) => sseManager.broadcast(event)),
+        eventBus.subscribe('task.claim_released', (event) => sseManager.broadcast(event)),
         eventBus.subscribe('project.created', (event) => sseManager.broadcast(event)),
         eventBus.subscribe('project.updated', (event) => sseManager.broadcast(event)),
         eventBus.subscribe('project.deleted', (event) => sseManager.broadcast(event)),

package/dist/cli/api/client.d.ts

@@ -1,5 +1,6 @@
 import type { TaskResponse, CreateTaskInput, UpdateTaskInput, TaskFilters, ApiErrorResponse, ProjectResponse, CreateProjectInput, UpdateProjectInput, DependencyResponse, DependencyListResponse, CreateDependencyInput, CommentResponse, CreateCommentInput, HealthResponse, PaginatedResponse, PaginationParams } from './types.js';
 import type { ModelPolicyNullable } from '../../schemas/model-policy.schema.js';
+import type { ModelCatalogEntry } from '../../schemas/model-catalog.schema.js';
 /**
  * Custom error class for API client errors.
  * Includes HTTP status code, parsed API error response, and optional request ID for tracing.
@@ -115,13 +116,12 @@ export declare function getSubtasksPaginated(parentTaskId: number, pagination?:
  * Sets assignee and transitions status to in_progress in a single operation.
  */
 export declare function claimTask(taskId: number, assignee: string, idempotencyKey?: string): Promise<TaskResponse>;
-/** One discovered catalog model, mirroring the server's `GET /models` row. */
-export interface ModelCatalogEntry {
-    id: string;
-    display_name: string;
-    family: string;
-    created_at: string;
-}
+/**
+ * One discovered catalog model — the server's `GET /models` row (task #930:
+ * the shape is declared once in `src/schemas/model-catalog.schema.ts` and
+ * re-exported here for CLI consumers).
+ */
+export type { ModelCatalogEntry };
 /** The `{ models, stale }` envelope returned by `GET /models`. */
 export interface ModelCatalogResponse {
     models: ModelCatalogEntry[];

package/dist/cli/api/types.d.ts

@@ -53,6 +53,12 @@ export interface UpdateTaskInput {
     tags?: string[];
     /** Wave 1.3 (#311): patch acceptance criteria; null clears, string sets. */
     acceptance_criteria?: string | null;
+    /**
+     * Task #1004: atomic block-with-dependency. Only valid alongside
+     * `status: 'blocked'` — the server adds the blocking edge(s) and sets the
+     * status in one transaction (an invalid edge rolls back the whole call).
+     */
+    blocked_by?: number[];
 }
 export interface TaskFilters {
     project_id?: number;

package/dist/cli/auth/browser-open.js

@@ -69,17 +69,6 @@ function isSafeBrowserUrl(url) {
     return true;
 }
 export function openBrowser(url) {
-    // Test/automation guard. When WFT_NO_BROWSER is set we never spawn a real
-    // browser — the caller still prints the URL as its fallback. The linux
-    // `!DISPLAY` branch below already covers headless CI, but it does NOT cover a
-    // developer DESKTOP running the suite (DISPLAY is set there): an in-process
-    // device-flow/login test (e.g. setup.remote.test.ts's "real device flow"
-    // case) would otherwise spawn the developer's actual browser at the mock
-    // server's verification_uri and 404. vitest.setup.ts sets this for every test
-    // file; browser-open.test.ts opts out locally to exercise the real spawn path.
-    if (process.env['WFT_NO_BROWSER']) {
-        return false;
-    }
     // WR-03 (Phase 30 review) — validate the URL BEFORE selecting the
     // platform spawn args. A malformed/suspicious URL → false so the caller
     // falls back to printing the URL for the user to paste manually.

package/dist/cli/auth/credentials.d.ts

@@ -21,4 +21,23 @@ export declare function getCredentialsPath(): string;
 export declare function readCredentials(filePath?: string): Credentials | null;
 export declare function writeCredentials(creds: Credentials, filePath?: string): void;
 export declare function deleteCredentials(filePath?: string): boolean;
+/**
+ * Resolve the logged-in identity's display name for attribution defaults
+ * (e.g. `tasks create --created-by`, `tasks comment-add --author`).
+ *
+ * Source of truth is the on-disk credentials file (`readCredentials`) — the
+ * SAME file `tasks whoami` reads. We prefer `display_name`; if it is empty
+ * (service accounts may have a blank display name) we fall back to `email`.
+ *
+ * Returns `null` when no identity can be resolved (no credentials file, or
+ * a credentials file with neither a display name nor an email). Callers then
+ * fall back to their existing "missing required field" behaviour so scripted
+ * runs without any identity still surface an actionable error.
+ *
+ * NOTE: this is intentionally a thin, synchronous read of the local file —
+ * it does NOT hit the network. The credentials file is written by
+ * `tasks login` from the server's identity envelope, so the cached
+ * display_name/email already reflect the authenticated user.
+ */
+export declare function resolveIdentityName(filePath?: string): string | null;
 export declare function resolveAuth(): Promise<AuthSource>;

package/dist/cli/auth/credentials.js

@@ -154,6 +154,36 @@ export function deleteCredentials(filePath = getCredentialsPath()) {
     unlinkSync(filePath);
     return true;
 }
+/**
+ * Resolve the logged-in identity's display name for attribution defaults
+ * (e.g. `tasks create --created-by`, `tasks comment-add --author`).
+ *
+ * Source of truth is the on-disk credentials file (`readCredentials`) — the
+ * SAME file `tasks whoami` reads. We prefer `display_name`; if it is empty
+ * (service accounts may have a blank display name) we fall back to `email`.
+ *
+ * Returns `null` when no identity can be resolved (no credentials file, or
+ * a credentials file with neither a display name nor an email). Callers then
+ * fall back to their existing "missing required field" behaviour so scripted
+ * runs without any identity still surface an actionable error.
+ *
+ * NOTE: this is intentionally a thin, synchronous read of the local file —
+ * it does NOT hit the network. The credentials file is written by
+ * `tasks login` from the server's identity envelope, so the cached
+ * display_name/email already reflect the authenticated user.
+ */
+export function resolveIdentityName(filePath = getCredentialsPath()) {
+    const creds = readCredentials(filePath);
+    if (creds === null)
+        return null;
+    const { display_name, email } = creds.active;
+    const name = display_name.trim();
+    if (name.length > 0)
+        return name;
+    if (email && email.trim().length > 0)
+        return email.trim();
+    return null;
+}
 export async function resolveAuth() {
     // 1. --token flag wins unconditionally.
     if (currentTokenOverride !== null) {

package/dist/cli/commands/comment-add.js

@@ -4,6 +4,7 @@ import { colorError, colorSuccess } from '../output/formatters.js';
 import { handleError } from '../output/error-handler.js';
 import { jsonOutput } from '../output/json-output.js';
 import { promptForMissing } from '../prompts/interactive.js';
+import { resolveIdentityName } from '../auth/credentials.js';
 export const commentAddCommand = new Command('comment-add')
     .description('Add a comment to a task')
     .argument('<id>', 'Task ID')
@@ -22,8 +23,14 @@ export const commentAddCommand = new Command('comment-add')
         const program = commentAddCommand.parent;
         const globalOpts = program?.optsWithGlobals() || {};
         const isJsonMode = globalOpts['json'] || false;
+        // When --author is omitted, default to the logged-in identity
+        // (credentials PAT user) so scripted, non-interactive runs no longer
+        // have to hardcode an author (papercut #1007). promptForMissing then
+        // short-circuits — interactive prompting / the "Missing required field:
+        // author" error remain ONLY when no identity can be resolved.
+        const authorOverride = options.author ?? resolveIdentityName() ?? undefined;
         // Prompt for missing required fields
-        const author = await promptForMissing('author', options.author);
+        const author = await promptForMissing('author', authorOverride);
         const content = await promptForMissing('content', options.content);
         // Add comment via API
         const comment = await addComment(id, {

package/dist/cli/commands/create.js

@@ -4,6 +4,7 @@ import { formatTaskDetail, colorSuccess, colorError } from '../output/formatters
 import { handleError } from '../output/error-handler.js';
 import { jsonOutput } from '../output/json-output.js';
 import { promptForMissing } from '../prompts/interactive.js';
+import { resolveIdentityName } from '../auth/credentials.js';
 const VALID_PRIORITIES = ['low', 'medium', 'high', 'urgent'];
 export const createCommand = new Command('create')
     .description('Create a new task')
@@ -27,10 +28,17 @@ export const createCommand = new Command('create')
         const program = createCommand.parent;
         const globalOpts = program?.optsWithGlobals() || {};
         const isJsonMode = globalOpts['json'] || false;
+        // When --created-by is omitted, default to the logged-in identity
+        // (credentials PAT user) so scripted, non-interactive runs no longer
+        // have to hardcode an email (papercut #1007). promptForMissing then
+        // short-circuits (value is defined) — interactive prompting and the
+        // "Missing required field: created-by" error remain ONLY when no
+        // identity can be resolved (no credentials).
+        const createdByOverride = options.createdBy ?? resolveIdentityName() ?? undefined;
         // Prompt for missing required fields (interactive mode only)
         const title = await promptForMissing('title', options.title);
         const projectStr = await promptForMissing('project', options.project);
-        const createdBy = await promptForMissing('created-by', options.createdBy);
+        const createdBy = await promptForMissing('created-by', createdByOverride);
         // Parse and validate project ID
         const project = typeof projectStr === 'number' ? projectStr : parseInt(projectStr, 10);
         if (isNaN(project)) {

package/dist/cli/commands/list.js

@@ -4,11 +4,22 @@ import { formatTaskTable, colorError, colorWarn, colorInfo } from '../output/for
 import { handleError } from '../output/error-handler.js';
 import { jsonOutput } from '../output/json-output.js';
 const VALID_STATUSES = ['open', 'in_progress', 'done', 'closed', 'blocked'];
+// `all` is a CLI-only sentinel meaning "no server-side status filter" — it is
+// NOT a real task status, so it is accepted by the CLI but never forwarded as
+// `?status=` to the API. Listing every status (including blocked + closed) is
+// exactly what omitting the filter already does server-side.
+const STATUS_ALL = 'all';
 const MAX_LIMIT = 500;
 export const listCommand = new Command('list')
     .description('List tasks with optional filters')
     .option('-p, --project <id>', 'Filter by project ID', parseInt)
-    .option('-s, --status <status>', 'Filter by status')
+    .option('-s, --status <status>', 
+// Default (no --status): the server applies NO status filter, so every
+// status is returned — open, in_progress, blocked, done, AND closed. None
+// are hidden. Pass a single status to narrow, or the explicit sentinel
+// `all` to make "every status (incl. blocked + closed)" self-documenting
+// in scripts. Valid values: open | in_progress | blocked | done | closed | all.
+`Filter by status (default: all statuses shown, incl. blocked + closed). Use 'all' to be explicit.`)
     .option('-a, --assignee <name>', 'Filter by assignee')
     .option('--search <query>', 'Search tasks by title/description')
     .option('--tags <tags>', 'Filter by tags (comma-separated)')
@@ -18,9 +29,12 @@ export const listCommand = new Command('list')
     .option('--offset <n>', 'Zero-based offset for pagination (default 0)', (v) => parseInt(v, 10))
     .action(async (options) => {
     try {
-        // Validate status if provided
-        if (options.status && !VALID_STATUSES.includes(options.status)) {
-            console.error(colorError(`Invalid status: ${options.status}. Valid options: ${VALID_STATUSES.join(', ')}`));
+        // Validate status if provided. `all` is the explicit "every status"
+        // sentinel and is accepted alongside the real statuses.
+        if (options.status &&
+            options.status !== STATUS_ALL &&
+            !VALID_STATUSES.includes(options.status)) {
+            console.error(colorError(`Invalid status: ${options.status}. Valid options: ${[...VALID_STATUSES, STATUS_ALL].join(', ')}`));
             process.exitCode = 1;
             return;
         }
@@ -50,7 +64,9 @@ export const listCommand = new Command('list')
         if (options.project !== undefined) {
             filters.project_id = options.project;
         }
-        if (options.status) {
+        // `all` means "no server-side status filter" — every status (incl.
+        // blocked + closed) is returned. Any other value narrows to that status.
+        if (options.status && options.status !== STATUS_ALL) {
             filters.status = options.status;
         }
         if (options.assignee) {
@@ -81,10 +97,17 @@ export const listCommand = new Command('list')
         const program = listCommand.parent;
         const globalOpts = program?.optsWithGlobals() || {};
         const isJsonMode = globalOpts['json'] || false;
+        // Effective status filter, echoed so machine consumers can detect
+        // exactly what they asked for. `all` is reported when no status was
+        // requested (or `--status all` was passed) — i.e. blocked + closed are
+        // included rather than silently filtered out.
+        const statusFilter = options.status && options.status !== STATUS_ALL ? options.status : STATUS_ALL;
         // Display results
         if (isJsonMode) {
-            // JSON mode: output envelope to stdout
-            jsonOutput(tasks, { count: tasks.length });
+            // JSON mode: output envelope to stdout. `statusFilter` names the
+            // effective filter so scripts never mistake a status transition
+            // (e.g. open → blocked) for a deleted task.
+            jsonOutput(tasks, { count: tasks.length, statusFilter });
         }
         else {
             // Terminal mode: formatted output

package/dist/cli/commands/login.d.ts

@@ -11,6 +11,9 @@ import type { PromptIO } from '../util/prompt.js';
  * - `hostname`    — local hostname, surfaced to the server for PAT auto-naming.
  * - `tokenName`   — optional advisory PAT name (`--token-name`).
  * - `openBrowser` — when `true`, best-effort auto-open the verification URL.
+ * - `opener`      — injectable browser-launch seam. Defaults to the real
+ *                   {@link openBrowser}. Tests pass a stub so the suite never
+ *                   spawns a real browser; production never overrides it.
  * - `isJson`      — when `true`, emit newline-separated JSON envelopes on stdout
  *                   instead of human-friendly text on stderr.
  */
@@ -20,6 +23,13 @@ export interface RunDeviceLoginArgs {
     hostname: string;
     tokenName?: string;
     openBrowser: boolean;
+    /**
+     * Injectable browser opener (defaults to {@link openBrowser}). This is the
+     * seam that replaces the former no-browser env bandaid: tests inject a
+     * stub instead of relying on a global env flag that, if leaked, would
+     * silently disable browser login for real users.
+     */
+    opener?: (url: string) => boolean;
     isJson: boolean;
 }
 /** Outcome of {@link runDeviceLogin}. `ok: false` means the flow already emitted