- Move validateMcpMetadata to @tm/mcp shared utils (TypeScript)
- Remove duplicate implementation from mcp-server/src/tools/utils.js
- Add comprehensive unit tests for validateMcpMetadata function
- Fix dependencies type in metadata-preservation test (number → string)
- Fix TypeScript union type handling in test assertions
- Add useResearch and metadata to UpdateBridgeParams interface
- Pass both parameters through to tmCore.tasks.updateWithPrompt
- Update both update-task-by-id.js and update-subtask-by-id.js
- Improve error message in validateMcpMetadata to include parse error
Fixes CodeRabbit outside-diff concern about silently lost parameters.
Addresses CodeRabbit nitpick about error message detail.
Critical fixes for update-subtask-by-id.js:
1. Added 'metadata' to context destructuring (was causing ReferenceError)
2. Updated prompt validation to allow metadata-only updates
Without these fixes, subtask metadata updates would fail at runtime.
Fixes Cursor Bugbot HIGH severity issues.
Changed from replacing metadata to merging it:
- Preserves existing metadata keys from original subtask
- Adds/overrides with new metadata keys from update
- Supports both AI updates (no metadata) and direct updates (with metadata)
Addresses CodeRabbit nitpick about metadata replacement.
Clarifies that these tests focus on validation logic while end-to-end
behavior is covered by FileStorage and AI operation tests.
Addresses CodeRabbit nitpick about test structure.
Use String(st.id) === String(updatedSubtask.id) instead of strict
equality to handle type mismatches (AI may return string IDs vs numeric).
Also add title-based fallback matching.
Addresses CodeRabbit duplicate comment about FileStorage ID matching.
When both prompt and metadata are provided to update-subtask, the
metadata was being ignored. Now metadata is merged after AI update,
similar to how update-task handles it.
Fixes Cursor Bugbot review comment about ignored metadata.
Add optional `metadata` field to tasks and subtasks for storing
arbitrary user-defined JSON data (external IDs, workflow data,
integration references, etc.).
Key features:
- AI-Safe: Metadata excluded from AI schemas, preserved through all operations
- MCP Support: update_task/update_subtask tools accept metadata parameter
- Safety Flag: MCP updates require TASK_MASTER_ALLOW_METADATA_UPDATES=true
- Metadata Merge: New metadata merges with existing, preserving unmodified fields
Closes#1555🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace risky position-based fallback with:
- Type-coerced ID comparison (handles string vs number)
- Title-based fallback (subtask titles are typically unique)
This prevents metadata from being assigned to wrong subtask if AI
reorders subtasks or returns IDs with type mismatches.
- Add subtask metadata preservation in FileStorage.updateTask
- Add subtask metadata preservation in legacy update-task-by-id.js
- Add test for subtask metadata preservation during AI updates
Fixes Cursor Bugbot review comment about subtask metadata loss
Move validation check before object spread to properly catch null/malformed
task responses. Previously crashed with "Cannot read properties of null"
instead of the intended "Received invalid task object from AI" error.
Fixes#1552
OpenAI's structured outputs API requires all properties to be in the
'required' array of JSON Schema. Zod's .default() makes fields optional,
causing codex-cli provider to fail with 'Missing dependencies' error.
Changes:
- Removed .default() from SubtaskSchema, BaseTaskSchema, UpdatedTaskSchema
- Added application-level default handling in expand-task, update-task-by-id,
update-tasks, and parse-prd-streaming
- Ensures all schema properties are marked as required for OpenAI compatibility
- Maintains backward compatibility by applying defaults when AI doesn't provide values
Co-authored-by: Ralph Khreish <Crunchyman-ralph@users.noreply.github.com>
