Todoist workflows

Use the official CLI for routine operations. Use the public API only for a specific integration or a gap confirmed in installed CLI help. Do not maintain another complete client or silently switch the user's account/connection.

Establish the surface

1. Prefer an already authorised Todoist connector when it exposes the requested operation. Otherwise inspect td --version, td --help, and td auth status.
2. The official package is @doist/todoist-cli, executable td. Installation and authentication change the host/account state; do them only as authorised.
3. Use OS credential storage, not a token in a command argument, report, or repo. TODOIST_API_TOKEN overrides stored credentials: check its presence without printing its value when the apparent account or permissions are wrong.
4. For read-only work, prefer read-only OAuth. CLI auth metadata is not proof that an externally supplied token has a particular scope.
5. Read the exact subcommand's help before use. Prefer its structured output; do not parse a human-formatted table or assume a flag exists across commands.