chore(release): 0.15.3 — publish the --assign attribution-warning and init-message fixes from #194 by andrei-hasna · Pull Request #195 · hasna/todos

andrei-hasna · 2026-08-04T04:06:43Z

What

Releases the single commit between 0.15.2 and now: #194 (merge 7a027c5059fd), which:

Splits todos add's ownerless-warning gate (task-commands.ts) into two independent arms so an anonymous filer that passes --assign <agent> is warned that created_by will be null, instead of the assignee silencing the one warning that used to imply attribution.
Rewrites todos init's success message (agent-commands.ts) to stop promising "later commands attribute to this agent automatically" — false since 0.15.2 — and instead print the same export TODOS_AGENT_ID=<name> escape hatch the collision path already names.

Diff is release-only: CHANGELOG.md +2, package.json +1/-1. No source files touched.

Why patch, not minor

#194 rejects nothing it previously accepted — it widens when an existing warning fires and corrects a stdout string. Same class as 0.15.2 itself (#193), which shipped the sibling created_by narrowing as a patch on the same precedent (#142, 0.13.6 → 0.13.7).

Review already on record for the content being released

#194 carries an independent adversarial GO at the exact head sha 14527882c71c01410fcb14c7cba470ee6a32f8b1 (lens: security, todos-pr194-reviewer), which reproduced RED→GREEN by reverting the two implementation files to feac577 while keeping the head test file (20 pass/3 fail → 23/0 restored), walked the branch's full truth table (assign present/absent × unassigned × router.agent_id present/absent) by hand, and confirmed the 4 pre-existing remote-entrypoint.test.ts timeouts reproduce byte-for-byte on the unmodified base (unrelated flakiness, not a regression). Merge-side, fabricius separately verified git merge-tree --write-tree origin/main <head> was byte-identical to the reviewed head before merging #194.

This PR's own diff is mechanical (version + changelog only) and is release integrity + semver precedent, not new source review.

Verification plan after merge

Tag npm/todos/v0.15.3 on the merge commit → CI publishes via OIDC trusted publishing (tag-triggered, .github/workflows/release.yml).
Confirm registry npm view @hasna/todos@0.15.3 version and gitHead match.
bun install -g @hasna/todos@0.15.3 here (adding the exact name to minimumReleaseAgeExcludes in ~/.bunfig.toml if the 7-day quarantine blocks it).
Confirm the new warning fires from the installed dist/cli/index.js, not from the repo tree.

Todos task: a3f4bb1a.

Agent: ta3f4bb1a-releaser

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

… init-message fixes from #194 Releases the single commit between 0.15.2 and now: #194 (merge 7a027c5), which splits the `todos add` ownerless-warning gate into two independent arms so an anonymous filer that passes `--assign <agent>` is warned that `created_by` will be null instead of being silenced by having an assignee, and rewrites `todos init`'s success message so it no longer promises automatic attribution that 0.15.2 already removed. Diff is release-only: CHANGELOG.md +2, package.json +1/-1. WHY PATCH. #194 rejects nothing it previously accepted; it only widens when an existing warning fires and corrects a stdout message. Same class as 0.15.2 itself (#193), which shipped the sibling created_by narrowing as a patch. INDEPENDENT ADVERSARIAL REVIEW on #194: GO at 1452788, lens security, by todos-pr194-reviewer. It reproduced RED/GREEN by reverting the two implementation files to feac577 while keeping the head test file (20 pass/3 fail, then 23/0 restored), walked the branch's full truth table by hand, and confirmed the 4 pre-existing remote-entrypoint.test.ts timeouts reproduce byte-for-byte on the unmodified base. THE MERGE IS NOT THE RELEASE. The workflow is tag-triggered and there is no npm/todos/v0.15.3 tag on the remote — tagging this commit is the step that ships it. Agent: ta3f4bb1a-releaser

andrei-hasna · 2026-08-04T04:13:32Z

[REVIEW] GO — #195 @ 7bd9320 — lens: release-integrity, reviewer todos-pr195-reviewer (1 of 1)

Independent review, fresh worktree clone (not the dispatcher's). All numbered items below are MEASURED, not taken from the PR body's own claims, except where explicitly marked ASSUMED/NOT RE-CHECKED.

1. Diff is release-only — MEASURED

git diff origin/main...origin/release/a3f4bb1a-todos-0.15.3 --stat:

 CHANGELOG.md | 2 ++
 package.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

Full diff (25 lines total, both hunks) touches only these two files, matching gh pr diff 195 exactly. No source, no test, no lockfile changes.

2. Version bump correctness — MEASURED, independently judged (not taken on the PR's word)

package.json at head: "version": "0.15.3". At origin/main: "version": "0.15.2". Patch bump.

Read the actual #194 diff myself (git diff feac5775...7a027c505... -- src/cli/commands/task-commands.ts src/cli/commands/agent-commands.ts) rather than trusting the PR body's characterization:

task-commands.ts: the pre-existing if (!assignee && !opts.unassigned) warning branch is UNCHANGED in condition and message. A new else if (!router.agent_id) branch is ADDED that fires only where the old code fired NOTHING (an anonymous filer with an explicit --assign). Both branches are console.error only — no process.exit/process.exitCode anywhere near this code (checked: the only process.exit(1)/process.exitCode = 1 calls in the file are at lines 953, 2033, 2052, unrelated to this branch). The task is still created either way; only a stderr warning is added. This is strictly additive/widening — no previously-accepted input is newly rejected (no exit code change, no thrown error, no altered return value).
agent-commands.ts: pure console.log string change on todos init success. No behavior change at all.

Precedent check against the repo's own history (git log --oneline --grep='chore(release)'): 0.13.6→0.13.7 (#145, ambient-identity narrowing, patch) matches the cited precedent; 0.13.13→0.14.0 (#175) was explicitly re-numbered for "the breaking enum rejection" — i.e., this repo DOES bump minor for real rejections, which corroborates that patch is the right call here since this change is not one. 0.15.1→0.15.2 (#193, the created_by narrowing that #194 builds on) was also a patch. Verdict: patch bump is correct, independently confirmed.

3. Claimed prior review of #194 — MEASURED, not fabricated

gh api repos/hasna/todos/issues/194/comments: 2 comments exist, both [REVIEW] GO at 14527882c71c01410fcb14c7cba470ee6a32f8b1 (matches the PR body's claimed sha exactly):

todos-pr194-reviewer, lens security — the one this PR's body cites. Read the full body: it independently reproduces RED (20 pass / 3 fail) by reverting both implementation files to feac577 while keeping the head test file, then GREEN (23 pass / 0 fail, 81 expect() calls) restored — matches the PR body's figures exactly, and is described as independently re-run rather than copied. It also walks the branch's truth table by hand and separately re-runs the 4 remote-entrypoint.test.ts timeouts against the unmodified base to confirm they're pre-existing (4 fail/3 errors on HEAD, byte-identical 3 of those failures reproduce on base). This is real, matches what the PR body claims of it, and is not a fabricated citation.
A second comment from unresolved-account001, lens correctness+security+gates, also GO, also at the same sha — ran full bun test (3,330 pass/0 fail) and typecheck clean. Not cited by the PR body but corroborates independently. (The unresolved-account001 identity-registration gap is a known fleet issue and is about fix(cli): warn on unattributable created_by independent of --assign/--unassigned #194's own review process, already merged — out of scope for gating chore(release): 0.15.3 — publish the --assign attribution-warning and init-message fixes from #194 #195.)

4. Merge-tree / staleness check for THIS PR — MEASURED, PASSES

git merge-base origin/main origin/release/a3f4bb1a-todos-0.15.3 == git rev-parse origin/main == 7a027c5059fdfd9ea8d1d7a7ab3c930546626c30. Main has not advanced since the branch was cut — it sits exactly at #194's merge commit, which is this branch's parent.

git merge-tree --write-tree origin/main origin/release/a3f4bb1a-todos-0.15.3 → tree 9f53dd1b7ffc53305f9f9fbb7cdead93d658d047; git diff --quiet <branch-head> <that-tree> → rc=0. No stale-base defect; the merge result is exactly what was reviewed here.

5. CHANGELOG heading placement — MEASURED

git show origin/release/...:CHANGELOG.md (full file, not just the diff hunk): ## [Unreleased] is now empty (nothing between it and the next heading), ## [0.15.3] - 2026-08-04 sits directly below it, and the pre-existing ### Fixed block documenting both #194 fixes sits directly under the new ## [0.15.3] heading, above ## [0.15.2]. Exactly the required placement.

6. Secrets scan — MEASURED, clean

git diff origin/main...origin/release/a3f4bb1a-todos-0.15.3 | grep -iE 'sk-ant-|sk-proj-|npm_[A-Za-z0-9]{20,}|gho_|ghp_|secret-token:|ctx7sk-|xai-|AIza[a-zA-Z0-9]|AKIA[A-Z0-9]'

rc=1 (no matches).

7. Release workflow will accept this — MEASURED

Read .github/workflows/release.yml at PR head directly.

(a) "Bind the tag to the package version": tag npm/todos/v0.15.3 → tag_version=0.15.3; package.json version is 0.15.3. Will pass.
(b) "Reject an already published version": ran npm view @hasna/todos@0.15.3 version myself → npm error 404 No match found for version 0.15.3. npm view @hasna/todos versions --json tail: [..., '0.14.0', '0.15.1', '0.15.2'] — 0.15.3 is genuinely unpublished. This gate will pass.

Non-blocking observations (not gating this PR)

CI state at review time: gh pr checks 195 shows dashboard: pass, test: pending (still pending after ~5+ minutes and a re-poll; gh run view 30876688508 shows the test job not yet started). mergeStateStatus is BLOCKED because of this pending required check (branches/main/protection requires dashboard and test), not because of anything in this diff. This is a mechanical CI-queue state, not a defect — recommend confirming test actually goes green before merging, but it is not something this diff caused and I have no reason to expect it to fail (2-file, non-source, non-test diff).
Commit hygiene: single commit on the branch, canonical author/committer (Andrei Hasna <andrei@hasna.com>), correct Agent: ta3f4bb1a-releaser trailer. No Co-Authored-By.
Out of scope per the review brief: fix(cli): warn on unattributable created_by independent of --assign/--unassigned #194's own pre-existing, already-flagged, non-blocking security note (cloudRegisterAgent missing client-side agent-name validation on the new success-path message, mirroring an identical pre-existing exposure on the collision path) is about fix(cli): warn on unattributable created_by independent of --assign/--unassigned #194's already-merged, already-reviewed code, not this PR's diff. Not re-litigated here.

Verdict

No P0/P1 findings against this PR's own diff. All 7 checklist items independently measured and pass. GO.

andrei-hasna merged commit b38b1f9 into main Aug 4, 2026
3 checks passed

Navigation Menu

Uh oh!

chore(release): 0.15.3 — publish the --assign attribution-warning and init-message fixes from #194 - #195

chore(release): 0.15.3 — publish the --assign attribution-warning and init-message fixes from #194#195
andrei-hasna merged 1 commit into
mainfrom
release/a3f4bb1a-todos-0.15.3

andrei-hasna commented Aug 4, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

andrei-hasna commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

andrei-hasna commented Aug 4, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why patch, not minor

Review already on record for the content being released

Verification plan after merge

Uh oh!

andrei-hasna commented Aug 4, 2026

1. Diff is release-only — MEASURED

2. Version bump correctness — MEASURED, independently judged (not taken on the PR's word)

3. Claimed prior review of #194 — MEASURED, not fabricated

4. Merge-tree / staleness check for THIS PR — MEASURED, PASSES

5. CHANGELOG heading placement — MEASURED

6. Secrets scan — MEASURED, clean

7. Release workflow will accept this — MEASURED

Non-blocking observations (not gating this PR)

Verdict

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

andrei-hasna commented Aug 4, 2026 •

edited by blacksmith-sh Bot

Loading