chore(release): 0.15.6 — publish the comment-cursor consumer from #200

[andrei-hasna]

Bumps package.json to 0.15.6 and files the pending CHANGELOG entry under a 0.15.6 heading. No source change — --comments-cursor and --comments-limit landed in #200 (merge 612df95093cd1b99ea27e8547d9a5ad1b50cf124).

Why this exists

#200 merged at 2026-08-06T09:05:14Z without a version bump. The newest published artefact predates the merge by sixteen hours:

@hasna/todos 0.15.5 published   2026-08-05T16:33:06Z
PR #200 merged                  2026-08-06T09:05:14Z
main package.json               0.15.5   (merge touched 5 files, package.json not among them)

Registry, installed binary and main's manifest all read 0.15.5 and agree with each other. Three surfaces agreeing is exactly what made this invisible — the fix is merged and reaches nobody.

Measured on the installed 0.15.5 binary, before this bump

Three arms, so the probe is shown to be capable of both outcomes:

todos show <id> --comments-cursor xyz     rc=1  error: unknown option '--comments-cursor'
todos show <id> --json                    rc=0  76520 B          <- probe CAN succeed
todos show <id> --definitely-not-a-flag   rc=1  same error shape <- probe CAN fail

How this publishes

Tag npm/todos/v0.15.6 triggers release.yml, which authenticates by OIDC trusted publishing and generates provenance. No npm token is involved. The workflow re-verifies tag/version agreement, requires the release commit to be contained in protected main, and rejects an already-published version.

Acceptance this release is held to

npm view @hasna/todos version -> 0.15.6; todos --version -> 0.15.6; and the real one — todos show <task-with-more-than-100-comments> --comments-cursor <cursor> returns rc=0 with older comments, walking full history with zero overlap and terminating at has_more: false.

Refs task 65b80fa4.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #202 @ b47a5b3 — lens: release-correctness, reviewer Seneca (1 of 1)

Independent verdict from the artefacts. Station load was 13.63 on 20 cores with 3 bun test processes already in flight (measured before running anything), so no local suite was run; everything below is static reads, registry reads, and cheap installed-binary probes. The release path itself re-runs typecheck, the no-cloud guards, the full suite, the build and the release gate on a clean runner at tag time, so local suite results are not load-bearing for this verdict.

P0 — none

P1 — none

P2 (non-blocking, procedural — honor it or the workflow will refuse the tag)

1. The npm/todos/v0.15.6 tag must go on the post-squash-merge MAIN commit, not on b47a5b3. release.yml requires git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main; after a squash merge the branch commit is not an ancestor of main, so tagging b47a5b3 fails (safely). Precedent measured: npm/todos/v0.15.5 resolves to f4b7416f32a052da6dc214930464e1844227013c — the single-parent squash commit on main (parent a9e7253…, committer GitHub), not a branch commit. The PR body's "Tag npm/todos/v0.15.6 triggers release.yml" is correct but silent on which sha; this is the one way the runbook can go wrong.

P3 (informational, non-blocking)

2. CI test job on this PR was pending at review time (test pending 0, run 31088837242); dashboard pass 12s. Merge is blocked until green, and release.yml re-runs the full suite at tag time regardless, so this cannot silently publish a broken artefact.
3. Strict semver would call two new CLI flags a minor bump; this repo's measured practice is patch-only (0.15.5 shipped the entire todos delegate verb as a patch), so 0.15.6 is consistent with repo convention. CHANGELOG files it under "Fixed", which matches the substance (an advertised cursor had no consumer).
4. Repo squash settings are squash_merge_commit_message: COMMIT_MESSAGES, squash_merge_commit_title: PR_TITLE; with exactly one branch commit the Agent: Silvanus trailer survives the squash singular. No --body-file intervention needed here, though it remains the safe habit.

What was MEASURED (each supports GO)

• The artefact contains the fix(cli): give the comment page cursor a consumer on show and inspect #200 change by construction and by inspection. b47a5b3^ = 612df95093cd… = origin/main = the fix(cli): give the comment page cursor a consumer on show and inspect #200 squash merge. At the release tree: src/cli/commands/task-commands.ts:1354 and :1473 both read .option("--comments-cursor <cursor>", "Read the next OLDER page; pass comments_page.next_cursor") — the flag is registered on both show and inspect.
• The version bump targets the right number. Registry newest: 0.15.5 2026-08-05T16:33:06.231Z; 0.15.6 present: False (npm view time). package.json at the release commit: 0.15.6. So the bump is the next free patch and the workflow's already-published rejection will not trip.
• The gap the PR claims is real, re-verified live on the installed 0.15.5 binary during this review: todos --version → 0.15.5; todos show 65b80fa4 --comments-cursor xyz → rc=1 error: unknown option '--comments-cursor'.
• Every timing/file claim in the PR body checks out: fix(cli): give the comment page cursor a consumer on show and inspect #200 mergedAt 2026-08-06T09:05:14Z, merge commit 612df95…, 5 files changed, package.json not among them (gh pr view 200 --json files).
• CHANGELOG edit is structurally right for this repo. Exactly two lines inserted: ## [0.15.6] - 2026-08-06 plus a blank line under an intact, now-empty [Unreleased] heading — byte-for-byte the same shape as the 0.15.5 release commit (Unreleased at line 8, version heading at line 10). This CHANGELOG carries no link-reference section at the bottom (tail ends at ## [0.3.7] - 2026-02-14), so nothing was orphaned; the heading list at the release commit has no duplicates.
• The claimed publish route is the route this repo actually uses. release.yml at the release commit: trigger push: tags: npm/todos/v*; environment: npm-release; id-token: write; npm publish --provenance --access public with no token; gates in order = npm-version floor (11.5.1), tag↔package.json version binding, ancestor-of-main requirement, already-published rejection, typecheck, test:no-cloud, full bun test, build, clean-tree check. The PR body's description of the route matches the file. prepublishOnly = verify-public-release.ts --mode=publish, and the workflow supplies HASNA_TODOS_EXPECTED_COMMIT: ${{ github.sha }} — publish-mode authority requirements (lifecycle event prepublishOnly, 40-char expected commit, no skip flags) are satisfied by the workflow as written. Direct local npm publish would be the wrong route (no expected-commit env, no OIDC); the PR does not propose it.
• No gate in the release path trips on the new content. I replicated the gate's FORBIDDEN_TEXT_PATTERNS + SECRET_PATTERNS scan in Python: full CHANGELOG.md at the release commit → === CHANGELOG.md @ release commit: 0 hits; all lines added by the fix(cli): give the comment page cursor a consumer on show and inspect #200 merge → 1 hit, TEST_API_KEY = "hasna_todos_test_key" in src/cli/comment-page-cursor.test.ts — a file the gate never reads: .test.ts is excluded from source text surfaces, the path is not in isPublicReleaseTextSurface, and test files are not packed (files: dist, dashboard/dist, LICENSE, README.md). Positive control on the same scanner fired 4/4 on planted terms, so the zero is a measurement, not a blind probe.
• The lane under review is clean: worktree 65b80fa4-release HEAD = b47a5b3, git status --porcelain empty; the PR carries exactly this one commit.

What was NOT checked, stated plainly

• No local run of bun test, typecheck, build, or the release gate (station constraint; the tag-time workflow runs all of them as required gates on a clean runner).
• The npm-side trusted-publisher binding (workflow filename ↔ npm trust config) is unverifiable before a publish attempt — release.yml's own comment says npm only exchanges the OIDC token at publish time. Inference, labeled as such: 0.15.1 through 0.15.5 all published through this path, most recently yesterday, so the binding held as of 2026-08-05.
• The correctness of fix(cli): give the comment page cursor a consumer on show and inspect #200's implementation itself — different lens; it landed through its own reviewed PR.

Verdict: GO. The release commit is minimal (2 files, version + CHANGELOG heading), sits directly on the #200 merge, targets the right free version, matches this repo's release conventions, and the claimed publish route is the real one with every gate accounted for. Honor P2 when tagging.

Agent: Seneca (adversarial reviewer, dispatched)