fix: Critical bug fixes for write operations (v0.4.1-v0.4.7) (#48)

This PR includes 7 critical bug fixes discovered through end-to-end testing
of write operations, plus comprehensive documentation updates.

## Bug Fixes

### v0.4.1 - Push Payload Structure
- Fixed Worker API payload structure mismatch
- Changed `tasks` → `operations` array
- Changed `vectorClock` → `clientVectorClock`
- Added `type` field to all operations
- Changed `id` → `taskId`
- Impact: Write operations were 100% non-functional due to 400 errors

### v0.4.2 - JWT Schema Mismatch
- Fixed JWT payload schema to match Worker
- Changed `user_id` → `sub` (RFC 7519 standard)
- Changed `device_id` → `deviceId` (camelCase)
- Added `email` and `jti` fields
- Added `getUserIdFromToken()` helper
- Impact: JWT parsing failed preventing all operations

### v0.4.3 - Missing Checksum
- Added SHA-256 checksum calculation for write operations
- Added `hash()` method to CryptoManager
- Worker requires checksum but schema marked optional
- Impact: Tasks silently rejected by Worker (appeared successful)

### v0.4.4 - Rejection Checking
- Added validation of Worker's `rejected` array
- Tasks could be rejected with HTTP 200 OK
- Now throws detailed errors with rejection reasons
- Impact: Silent failures without error messages

### v0.4.5 - Field Name Mismatches
- Changed `quadrantId` → `quadrant` (frontend uses 'quadrant')
- Changed `createdAt: number` → `createdAt: string` (ISO)
- Changed `updatedAt: number` → `updatedAt: string` (ISO)
- Renamed `deriveQuadrantId()` → `deriveQuadrant()`
- Impact: Zod validation errors in webapp ("unrecognized key 'quadrantId'")

### v0.4.6 - Type Mismatches
- Changed `dueDate: number | null` → `dueDate?: string` (optional ISO)
- Changed `subtasks[].text` → `subtasks[].title`
- Added `completedAt?: string` field
- Added `vectorClock?: Record<string, number>` field
- Impact: "Expected string, received null" errors for dueDate

### v0.4.7 - MCP Tool Schemas
- Fixed MCP tool input schemas to match internal types
- Updated `dueDate` from `type: 'number'` → `type: 'string'`
- Updated subtasks from `text` → `title` field
- Impact: Claude Desktop sent wrong data types

## Documentation Updates

- Updated README to reflect v0.4.7 production-ready status
- Fixed all schema examples (quadrant, subtasks.title, ISO datetimes)
- Updated tool documentation with correct parameter types
- Added comprehensive bug fix history to README
- Updated status section with all 7 bug fixes

## Testing Results

All write operations tested end-to-end and working:
- ✅ Create task (simple)
- ✅ Create task with due date
- ✅ Create task with subtasks
- ✅ Update task
- ✅ Complete task
- ✅ Delete task

## Files Changed

- CHANGELOG.md - Full bug fix history
- README.md - Updated docs and examples
- package.json - Version 0.4.7
- src/index.ts - MCP tool schemas, version
- src/tools.ts - Schema interfaces (quadrant, dueDate, subtasks)
- src/write-ops.ts - All write operation types
- src/analytics.ts - Date handling for ISO strings
- src/crypto.ts - Added hash() method
- src/jwt.ts - Fixed JWT payload schema

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

Author: vscarpenter

packages/mcp-server/CHANGELOG.md

@@ -5,6 +5,119 @@ All notable changes to the GSD MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.7] - 2025-10-27 🐛
+
+### Fixed
+- **CRITICAL**: Fixed MCP tool input schemas to match internal types
+  - Changed `dueDate` schema from `type: 'number'` → `type: 'string'` in all tools
+  - Changed subtasks schema from `text` field → `title` field in all tools
+  - **Impact**: v0.4.6 MCP tools accepted wrong input types, causing validation errors in webapp
+
+### Technical Details
+- Updated `create_task` tool input schema (line 245-265)
+- Updated `update_task` tool input schema (line 307-328)
+- Updated `bulk_update_tasks` tool input schema (line 420-423)
+- MCP tools now correctly describe ISO 8601 datetime strings for dueDate
+- MCP tools now correctly describe subtask.title instead of subtask.text
+- Claude Desktop will now send correct data types when calling tools
+
+### Root Cause
+- Internal types (CreateTaskInput, UpdateTaskInput) were updated in v0.4.6
+- MCP tool schemas in src/index.ts were not updated to match
+- Claude Desktop used tool schemas to construct API calls
+- Resulted in type mismatch: Claude sent numbers, code expected strings
+
+## [0.4.6] - 2025-10-26 🐛
+
+### Fixed
+- **CRITICAL**: Fixed additional schema mismatches preventing task sync
+  - Changed `dueDate: number | null` → `dueDate?: string` (optional ISO datetime)
+  - Changed `subtasks[].text` → `subtasks[].title` (frontend uses 'title')
+  - **Impact**: v0.4.5 tasks failed with "Expected string, received null" error on dueDate field
+- Added missing optional fields:
+  - `completedAt?: string` - ISO datetime when task was completed
+  - `vectorClock?: Record<string, number>` - For sync conflict resolution
+- Updated all write operations to handle optional fields correctly:
+  - `dueDate` only included when set (not null)
+  - `completedAt` set automatically when marking task complete
+  - `vectorClock` initialized with empty object
+- Fixed analytics date sorting to handle ISO datetime strings
+
+### Technical Details
+- Frontend schema expects `dueDate: z.string().datetime().optional()` (can be undefined, NOT null)
+- Frontend subtask schema uses `title`, not `text` (line 19 of lib/schema.ts)
+- Updated CreateTaskInput, UpdateTaskInput, and BulkOperation types
+- Fixed searchTasks to search subtask.title instead of subtask.text
+- Updated date comparisons in analytics to parse ISO strings before sorting
+
+## [0.4.5] - 2025-10-26 🐛
+
+### Fixed
+- **CRITICAL**: Fixed task schema to match frontend expectations
+  - Changed `quadrantId` → `quadrant` (frontend schema uses 'quadrant')
+  - Changed `createdAt` from number → ISO string datetime
+  - Changed `updatedAt` from number → ISO string datetime
+  - **Impact**: v0.4.0-0.4.4 tasks created by MCP failed Zod validation in webapp causing "unrecognized key 'quadrantId'" error
+
+### Technical Details
+- Updated `DecryptedTask` interface in `src/tools.ts`
+- Updated all write operations to use `quadrant` field name
+- Renamed `deriveQuadrantId()` → `deriveQuadrant()`
+- Changed timestamp generation from `Date.now()` → `new Date().toISOString()`
+- Frontend expects ISO 8601 datetime strings, not Unix timestamps
+- Frontend schema in `lib/schema.ts` uses `quadrant: quadrantIdSchema`
+
+## [0.4.4] - 2025-10-26 🐛
+
+### Fixed
+- **CRITICAL**: Added validation of Worker push response rejected array
+  - MCP server was not checking if Worker rejected operations
+  - Only checked HTTP status (200 OK) and conflicts array
+  - Worker can reject operations and still return 200 OK with rejected array
+  - Now throws detailed error if any operations are rejected
+  - **Impact**: v0.4.0-0.4.3 appeared to succeed but tasks were silently rejected
+
+### Technical Details
+- Updated `pushToSync()` to parse full `PushResponse` structure
+- Added check for `rejected` array in Worker response
+- Throws error with detailed rejection reasons (taskId, reason, details)
+- Now properly validates that `accepted` array contains the task IDs
+- This will surface the actual rejection reason from Worker
+
+## [0.4.3] - 2025-10-26 🐛
+
+### Fixed
+- **CRITICAL**: Added missing checksum calculation for write operations
+  - Worker requires SHA-256 checksum of plaintext JSON for create/update operations
+  - Added `hash()` method to `CryptoManager` using Web Crypto API
+  - Updated all write operations to calculate and include checksum
+  - **Impact**: Tasks created without checksum were silently rejected by Worker (appeared successful but not stored)
+
+### Technical Details
+- Added `CryptoManager.hash()` method using `webcrypto.subtle.digest('SHA-256')`
+- Updated `createTask()` to calculate checksum before push
+- Updated `updateTask()` to calculate checksum before push
+- Updated `bulkUpdateTasks()` to calculate checksums for all operations
+- Checksum is SHA-256 hash of plaintext JSON (before encryption)
+- Worker validates checksum on line 125 of `worker/src/handlers/sync.ts`
+- Schema says checksum is optional, but Worker code requires it for create/update
+
+## [0.4.2] - 2025-10-26 🐛
+
+### Fixed
+- **CRITICAL**: Fixed JWT payload schema mismatch between MCP server and Worker
+  - Changed `user_id` → `sub` (JWT standard subject field)
+  - Changed `device_id` → `deviceId` (camelCase to match Worker)
+  - Added `email` and `jti` fields to match Worker's JWT structure
+  - Added `getUserIdFromToken()` helper function
+  - **Impact**: JWT parsing was failing with "user_id and device_id are missing" error, preventing all operations
+
+### Technical Details
+- Updated `jwtPayloadSchema` in `src/jwt.ts` to match `worker/src/utils/jwt.ts`
+- Worker generates JWT with standard `sub` field (RFC 7519), not custom `user_id`
+- Worker uses camelCase `deviceId`, not snake_case `device_id`
+- MCP server now correctly parses tokens from actual Worker OAuth flow
+
 ## [0.4.1] - 2025-10-26 🐛
 
 ### Fixed

packages/mcp-server/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://badge.fury.io/js/gsd-mcp-server.svg)](https://www.npmjs.com/package/gsd-mcp-server)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-Model Context Protocol (MCP) server for GSD Task Manager. Provides read-only access to your synced tasks through Claude Desktop and other MCP-compatible AI assistants.
+Model Context Protocol (MCP) server for GSD Task Manager. Provides **full task management** capabilities including create, read, update, and delete operations through Claude Desktop and other MCP-compatible AI assistants. All operations maintain end-to-end encryption.
 
 ## Quick Start
 
@@ -75,12 +75,7 @@ See [Installation](#installation) section below for detailed setup instructions.
 - ✅ Filter by quadrant, completion status, tags
 - ✅ Get individual task details
 - 🔒 Privacy-first: Requires user-provided encryption passphrase
-- 🔒 Read-only: Cannot modify or create tasks
-
-**Planned** (Future v0.4.0+)
-- Write operations (create, update, delete tasks)
-- AI-powered task suggestions
-- Bulk operations support
+- ✅ Full CRUD operations: Create, read, update, delete tasks (v0.4.0+)
 
 ## Prerequisites
 
@@ -366,18 +361,19 @@ List all decrypted tasks with optional filtering. **Requires `GSD_ENCRYPTION_PAS
     "description": "Complete Q4 financial analysis",
     "urgent": true,
     "important": true,
-    "quadrantId": "urgent-important",
+    "quadrant": "urgent-important",
     "completed": false,
-    "dueDate": 1735948800000,
+    "dueDate": "2025-01-03T17:00:00.000Z",
     "tags": ["#work", "#finance"],
     "subtasks": [
-      { "id": "sub-1", "text": "Gather data", "completed": true },
-      { "id": "sub-2", "text": "Write analysis", "completed": false }
+      { "id": "sub-1", "title": "Gather data", "completed": true },
+      { "id": "sub-2", "title": "Write analysis", "completed": false }
     ],
     "recurrence": "none",
     "dependencies": [],
-    "createdAt": 1735171200000,
-    "updatedAt": 1735257600000
+    "createdAt": "2024-12-26T00:00:00.000Z",
+    "updatedAt": "2024-12-27T00:00:00.000Z",
+    "vectorClock": {}
   }
 ]
 ```
@@ -539,9 +535,9 @@ Create a new task with natural language input. **Requires `GSD_ENCRYPTION_PASSPH
 - `urgent` (required): Is this task urgent? (time-sensitive)
 - `important` (required): Is this task important? (high-value, strategic)
 - `description` (optional): Task description
-- `dueDate` (optional): Due date as Unix timestamp (milliseconds)
+- `dueDate` (optional): Due date as ISO 8601 datetime string (e.g., `"2025-10-27T17:00:00.000Z"`)
 - `tags` (optional): Array of tags (e.g., `["#work", "#project-alpha"]`)
-- `subtasks` (optional): Array of subtask objects `{text, completed}`
+- `subtasks` (optional): Array of subtask objects `{title, completed}`
 - `recurrence` (optional): `'none'` | `'daily'` | `'weekly'` | `'monthly'`
 - `dependencies` (optional): Array of task IDs that must be completed first
 
@@ -566,9 +562,9 @@ Update an existing task. All fields except ID are optional. **Requires `GSD_ENCR
 - `description` (optional): New description
 - `urgent` (optional): Change urgency (moves between quadrants)
 - `important` (optional): Change importance (moves between quadrants)
-- `dueDate` (optional): New due date (null to clear)
+- `dueDate` (optional): New due date as ISO 8601 datetime string (empty string to clear)
 - `tags` (optional): Replace all tags
-- `subtasks` (optional): Replace all subtasks
+- `subtasks` (optional): Replace all subtasks (objects with `{id, title, completed}`)
 - `recurrence` (optional): Change recurrence pattern
 - `dependencies` (optional): Replace all dependencies
 - `completed` (optional): Mark as complete/incomplete
@@ -627,7 +623,7 @@ Update multiple tasks at once. Limited to 50 tasks per operation for safety. **R
   - `type: 'remove_tags'` - Remove tags from all tasks
     - `tags`: string[]
   - `type: 'set_due_date'` - Set due date for all tasks
-    - `dueDate`: number | null
+    - `dueDate`: ISO 8601 datetime string (empty string to clear)
   - `type: 'delete'` - Delete all tasks
 - `maxTasks` (optional): Safety limit (default: 50)
 
@@ -753,21 +749,15 @@ npm publish --access public --otp=YOUR_CODE
 
 ## Future Enhancements
 
-**Write Operations** (v0.4.0)
-- Create new tasks via natural language
-- Update existing tasks (title, description, quadrant, etc.)
-- Complete/uncomplete tasks
-- Delete tasks
-- Conflict resolution for concurrent edits
-- Batch operations support
-
 **Advanced Features** (v0.5.0+)
 - AI-powered task suggestions based on patterns
 - Priority recommendations using AI
 - Deadline predictions
 - Historical trend analysis (7/30/90 day views)
 - Cross-integration with calendar/email (MCP chaining)
 - Custom analytics queries
+- Conflict resolution UI for concurrent edits
+- Task templates and quick creation workflows
 
 ## Architecture
 
@@ -827,21 +817,34 @@ MIT - Same as GSD Task Manager
 
 ---
 
-**Status**: v0.4.0 (Write Operations) 🔥
-**New in v0.4.0**:
+**Status**: v0.4.7 (Production Ready) ✅🔥
+
+**Current Release (v0.4.7)**:
 - ✍️ **Full task management** - Create, update, delete tasks
-- 🔄 **Bulk operations** - Update up to 50 tasks at once
+- 🔄 **Bulk operations** - Update up to 50 tasks at once (complete, move, tag, delete)
 - 🔐 **Encrypted writes** - All changes encrypted before sync
 - 🛡️ **Safety features** - Bulk limits, validation, clear errors
 - 📊 **18 total MCP tools** (13 read + 5 write)
-
-**Previous Releases**:
+- ✅ **Production tested** - All write operations verified end-to-end
+- 🐛 **Bug fixes** - 7 critical schema and sync issues resolved (v0.4.1-v0.4.7)
+
+**Bug Fixes (v0.4.1-v0.4.7)**:
+- v0.4.1: Fixed Worker API payload structure
+- v0.4.2: Fixed JWT token schema (sub, deviceId)
+- v0.4.3: Added SHA-256 checksum calculation
+- v0.4.4: Added Worker rejection array checking
+- v0.4.5: Fixed field names (quadrant, timestamps)
+- v0.4.6: Fixed type mismatches (dueDate, subtasks.title)
+- v0.4.7: Fixed MCP tool input schemas
+
+**Previous Feature Releases**:
+- v0.4.0 - Write operations (create, update, delete)
 - v0.3.2 - Built-in prompts, help tool
 - v0.3.0 - Interactive setup, analytics, validation
 - v0.2.0 - Decrypted task access
 - v0.1.0 - Metadata-only access
 
 **Privacy**: Opt-in decryption with local passphrase
 **Security**: E2E encryption maintained, zero-knowledge server
-**Capabilities**: Full task management (create, read, update, delete)
-**Deployment**: Published to npm ✅ | Ready for production ✅
+**Capabilities**: Full CRUD task management with natural language interface
+**Deployment**: Published to npm ✅ | Production ready ✅ | All tests passed ✅