v1.4.2

Bug fixes

• Match Things app visibility by excluding pending tasks whose heading or project is completed, canceled, or trashed from active, Today, Upcoming, overview, and diagnostic counts.
• Reject task and heading creation or moves into inactive containers before any Things Cloud write is sent.
• Keep overdue pending tasks consistently classified as Today/Tonight across filters and tool output.
• Prevent invalid sort indexes from triggering an EXC_BREAKPOINT crash in Things.
• Ignore versioned Settings<digits> account metadata during sync so settings-only schema bumps do not block the task graph.

Reliability and security

• Harden Things Cloud synchronization with authoritative-history selection, schema and relationship validation, atomic cursor/state updates, and fail-closed pagination.
• Reconcile uncertain commits through authoritative history without automatically retrying POST requests.
• Encrypt persisted Things passwords with AES-GCM, hash refresh tokens, bind cached sessions to credential digests, and fail startup when encrypted data cannot be decrypted safely.
• Return schema-validated structured MCP output for all 23 tools while retaining JSON text compatibility.

Documentation

• Synchronize the landing-page tool reference and AGENTS.md safety/deployment guidance with current server behavior.
• Add the MIT license and refresh self-hosting guidance for persistent OAuth data and credential keys.