From 382e3e9b29e160e0d9dd7fce57632dbbc9e3dff2 Mon Sep 17 00:00:00 2001 From: heggria Date: Mon, 6 Jul 2026 22:15:20 +0800 Subject: [PATCH] =?UTF-8?q?chore(release):=20bump=20v0.1.6=20=E2=80=94=20v?= =?UTF-8?q?ersion=20pins,=20CHANGELOG,=20docs=20consistency?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prepare the 0.1.6 release. Version bump (0.1.5 → 0.1.6) across all 9 version surfaces verified by publish.yml's tag-match checks: - root package.json + 7 package.json versions - codex/claude plugin.json versions - codex/claude/opencode .mcp.json / opencode.json @version pins - 12 internal-dependency version pins (taskflow-core/-mcp/-hosts) - pnpm-lock.yaml regenerated (--frozen-lockfile passes) CHANGELOG: promote [Unreleased] → [0.1.6] — 2026-07-06, and add the two feats that shipped but were missing from the notes: defineFile (verify/ compile/run a flow from a path on disk) and JSONC comment support in flow definition files (parseJsonc). Docs consistency sweep (4 scout agents audited README/AGENTS/docs/skills/ per-package READMEs against ground truth): - Test count 1092 → 1140 (root README, all 6 per-package READMEs via copy-readme, RELEASE.md, CONTRIBUTING.md); zh-CN 1045 → 1140. - 'Unreleased (post-v0.1.5)' → 'v0.1.6 (current release)' in README status section (+ defineFile/JSONC added to the feature summary). - Stale 0.1.5 version refs in RELEASE.md, SECURITY.md, docs/codex-mcp.md, docs/claude-mcp.md → 0.1.6. - Fix broken #whats-inside anchor in README.zh-CN.md (heading is 内部构成; added an explicit anchor so the badge links resolve). Pre-flight green: typecheck 0 errors, 1140/1140 tests, build OK, skills no drift. Verified: no stale 1092/1123/1045/0.1.5/'Unreleased' remain. --- CHANGELOG.md | 22 +++++++++++++++-- CONTRIBUTING.md | 2 +- README.md | 8 +++---- README.zh-CN.md | 10 ++++---- RELEASE.md | 6 ++--- SECURITY.md | 2 +- docs/claude-mcp.md | 2 +- docs/codex-mcp.md | 4 ++-- package.json | 2 +- packages/claude-taskflow/package.json | 8 +++---- .../plugin/.claude-plugin/plugin.json | 2 +- packages/claude-taskflow/plugin/.mcp.json | 2 +- packages/codex-taskflow/package.json | 8 +++---- .../plugin/.codex-plugin/plugin.json | 2 +- packages/codex-taskflow/plugin/.mcp.json | 2 +- packages/opencode-taskflow/package.json | 8 +++---- .../opencode-taskflow/plugin/opencode.json | 2 +- packages/pi-taskflow/package.json | 4 ++-- packages/taskflow-core/package.json | 2 +- packages/taskflow-hosts/package.json | 4 ++-- packages/taskflow-mcp/package.json | 4 ++-- pnpm-lock.yaml | 24 +++++++++---------- 22 files changed, 75 insertions(+), 55 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c68565e..8d3f511 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ All notable changes to taskflow are documented here. This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format. -## [Unreleased] +## [0.1.6] — 2026-07-06 ### Changed - **Extracted the MCP server into its own `taskflow-mcp` package** (sixth @@ -73,7 +73,25 @@ All notable changes to taskflow are documented here. This project follows [Keep - Skills are single-sourced for all hosts (`skills-src/taskflow/` with comma-list host blocks, e.g. ``). -## [0.1.5] — 2026-07-03 +- **`defineFile`: verify/compile/run a flow from a path on disk.** `action=run` + (Pi) and `taskflow_run` / `taskflow_verify` / `taskflow_compile` (MCP) accept + a `defineFile` (string) or `{defineFile, name}` in place of an inline + `define`. The engine resolves the path, reads it once, and substitutes it as + the flow definition — so a flow can live in a `.json` file (e.g. + `examples/review-changes.json`) and be invoked by reference without pasting + the JSON into the tool call. Pairs naturally with the JSONC support below. + See `skills-src/taskflow/core.md`. + +- **JSONC comments and trailing commas in flow definition files.** Flow + definitions are hand-authored `.json` files; authors can now annotate them + with `//` and `/* */` comments and leave trailing commas (JSONC/JSON5 + style). A new zero-dependency `parseJsonc()` (in `taskflow-core`'s `jsonc.ts`) + strips comments only outside string literals and tolerates trailing commas + before `}` / `]`, used by `readFlowFile()` when loading `defineFile` flows + and saved flows from the library. `safeParse()` for LLM output remains + strict. Re-exported from the `taskflow-core` barrel as `parseJsonc`. + +## [0.1.6] — 2026-07-06 ### Added - **Scoring gates (`score` on `gate` phases).** Deterministic, composable, diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 691a9c7..c6d4fa3 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -9,7 +9,7 @@ git clone git@github.com:heggria/taskflow.git cd taskflow pnpm install pnpm run typecheck # TypeScript checks (no build needed) -pnpm test # ~1090 tests, all passing +pnpm test # ~1140 tests, all passing ``` > The pi end-to-end suites (`packages/pi-taskflow/test/e2e*.mts`) spawn live Pi subagents and are run directly with `node --conditions=development --experimental-strip-types `. They need `pi` installed and model access configured. CI runs the unit tests plus the network-free Codex MCP e2e suites (the live-model e2e stays manual). diff --git a/README.md b/README.md index 4d9fc51..5ea022d 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ MIT license zero runtime dependencies CI status - 1092 tests + 1140 tests dogfooded runs on Pi, Codex, Claude Code, and OpenCode

@@ -861,12 +861,12 @@ Copy one into `.pi/taskflows/.json` (or `~/.pi/agent/taskflows/`) and it r
-**0 runtime dependencies** · **1092 tests** · **10 phase types** · **shared context tree** · **cross-session resume** · **cross-run memoization** · **per-item map caching** · **incremental recompute** · **FlowIR compile seam** · **detached execution** · **`compile` Mermaid renderer** · **~9k LOC runtime** +**0 runtime dependencies** · **1140 tests** · **10 phase types** · **shared context tree** · **cross-session resume** · **cross-run memoization** · **per-item map caching** · **incremental recompute** · **FlowIR compile seam** · **detached execution** · **`compile` Mermaid renderer** · **~9k LOC runtime**
- **Zero runtime dependencies.** No `dependencies` field — the runtime is built entirely on Node built-ins (`fs` / `path` / `os` / `child_process` / `crypto`). The file lock is `fs.openSync("wx")`, not a third-party library. -- **1123 tests across 70 test files** covering concurrency, atomic file locking (8-process race regressions), path-traversal hardening, cross-session resume, cross-run cache freshness (flow/thinking/tools key isolation, fingerprint invalidation, TTL/LRU eviction), backward-compatible cache-key migration (4-tier legacy fallback), per-phase structural sub-fingerprint (v3:phasefp — editing one phase invalidates only it and its dependents), per-item map caching (one changed item re-executes, N−1 cache hits), the `incremental` flag (run-wide cross-run default), reuse reporting, the FlowIR compile seam (determinism, declared-plane synthesis), incremental recompute (early-cutoff propagation, partial cascade strictly < full, observed ∪ declared union frontier), gate verdicts, budget caps, retry/backoff, approval flows, loop termination, tournament judging, sub-flow composition, the shared context tree (blackboard reuse, supervision spawn, subflow validation/nesting), workspace isolation (temp/dedicated/worktree lifecycle, fail-open degrade, dynamic-flow rejection), dynamic sub-flow security hardening, detached execution (PID persistence, stale detection, crash→failed, resume after failure), live run-history refresh, callback isolation, the idle watchdog, model-role init config, parseModelFromLabel with parenthesized-model-name regression, multi-fence `safeParse` recovery, host argv-contract locking (codex/claude/opencode `buildXxxArgs`), the `compile` Mermaid renderer (id-collision disambiguation, markdown-injection hardening, and full verify-overlay category coverage), plus the library Phase 1 metadata/search/store layer (phaseSignature, generality, CJK text scoring, staleness detection, sidecar persistence, A1 ghost-flow guard). +- **1140 tests across 70 test files** covering concurrency, atomic file locking (8-process race regressions), path-traversal hardening, cross-session resume, cross-run cache freshness (flow/thinking/tools key isolation, fingerprint invalidation, TTL/LRU eviction), backward-compatible cache-key migration (4-tier legacy fallback), per-phase structural sub-fingerprint (v3:phasefp — editing one phase invalidates only it and its dependents), per-item map caching (one changed item re-executes, N−1 cache hits), the `incremental` flag (run-wide cross-run default), reuse reporting, the FlowIR compile seam (determinism, declared-plane synthesis), incremental recompute (early-cutoff propagation, partial cascade strictly < full, observed ∪ declared union frontier), gate verdicts, budget caps, retry/backoff, approval flows, loop termination, tournament judging, sub-flow composition, the shared context tree (blackboard reuse, supervision spawn, subflow validation/nesting), workspace isolation (temp/dedicated/worktree lifecycle, fail-open degrade, dynamic-flow rejection), dynamic sub-flow security hardening, detached execution (PID persistence, stale detection, crash→failed, resume after failure), live run-history refresh, callback isolation, the idle watchdog, model-role init config, parseModelFromLabel with parenthesized-model-name regression, multi-fence `safeParse` recovery, host argv-contract locking (codex/claude/opencode `buildXxxArgs`), the `compile` Mermaid renderer (id-collision disambiguation, markdown-injection hardening, and full verify-overlay category coverage), plus the library Phase 1 metadata/search/store layer (phaseSignature, generality, CJK text scoring, staleness detection, sidecar persistence, A1 ghost-flow guard). - **Hardened by design.** Path-traversal defense (lexical + `realpath` containment check), runId validation, HTML/error sanitization, atomic writes, stale-lock stealing via `rename`, and an idle watchdog that kills wedged subagents (SIGTERM → SIGKILL after 5 minutes of silence). Dynamic sub-flows additionally get breadth caps, `cwd` containment, budget clamping, nesting depth caps, and prototype-pollution defense. - **Dogfooded.** Every new feature has to survive the project's own `self-improve` taskflow before it ships. @@ -891,7 +891,7 @@ Our `self-improve` flow is a 10-phase DAG — it audits the codebase, patches de ## Status & limits -**Unreleased (post-v0.1.5)** — adds **library Phase 1** (search-before-author + reusable-flow sidecar metadata) on top of the v0.1.5 baseline. **v0.1.5** added **Claude Code and OpenCode as hosts**, **extracted the MCP server into its own `taskflow-mcp` package**, and **de-duplicated the three host runners** into a shared `runSubagentProcess`. See [CHANGELOG](./CHANGELOG.md) for the full history. Baseline: **multi-host monorepo of seven packages** — the host-neutral `taskflow-core` engine, the host-neutral `taskflow-mcp` MCP server, the shared host-runner `taskflow-hosts`, plus `pi-taskflow` (Pi adapter), `codex-taskflow`, `claude-taskflow`, and `opencode-taskflow` (the three delivery packages re-export their runners from `taskflow-hosts` and each ships an MCP bin + plugin/config), all sharing the host-neutral MCP server in `taskflow-mcp`. **Library Phase 1**: save flows with `purpose`+`tags` via `taskflow_save` (MCP) or `action=save` (Pi), search them with structural + CJK-aware keyword scoring via `taskflow_search`/`action=search`, and track `reuseCount` via `reusedFromSearch`. **Shared Context Tree**: opt-in (`shareContext` / `contextSharing`) blackboard + supervision tools (`ctx_read`/`ctx_write` horizontal reuse, `ctx_report`/`ctx_spawn` vertical supervision); `ctx_spawn` accepts a flat task **or** a dependency-bearing `subflow` (a runtime-validated nested DAG), depth-capped on a unified nesting counter with budget accounting. **Workspace isolation**: a phase's `cwd` accepts reserved keywords `temp`/`dedicated`/`worktree` — the runtime allocates an isolated dir (or a git worktree on a throwaway branch) and tears it down after the phase, fail-open, rejected in LLM-authored sub-flows. **Detached execution**: runs can execute in the background, detached from the Pi session. Prior: loop-until-done (`loop`), tournament (best-of-N with a judge), cross-run memoization (content-addressed cache with git/file/glob/env fingerprints and TTL), interactive `/tf init`, configurable built-in agents, 18 built-in agents with 6 model roles. Full control-flow & reliability layer (`when` guards, `join: any`, `retry`/backoff, `approval`, `flow` composition, `budget` caps, `onBlock: "retry"`, `eval` machine gates, idle watchdog) on top of the DSL + DAG runtime (`agent`/`parallel`/`map`/`gate`/`reduce`). Inline + saved flows, cross-session resume, live progress, and isolated context. A run executes as one streaming tool call. +**v0.1.6** (current release) — adds **library Phase 1** (search-before-author + reusable-flow sidecar metadata), the **`defineFile`** parameter (verify/compile/run a flow from a path on disk), and **JSONC comment support** in flow definition files (`//` and `/* */` comments + trailing commas, parsed by the new zero-dependency `parseJsonc`). **v0.1.5** added **Claude Code and OpenCode as hosts**, **extracted the MCP server into its own `taskflow-mcp` package**, and **de-duplicated the three host runners** into a shared `runSubagentProcess`. See [CHANGELOG](./CHANGELOG.md) for the full history. Baseline: **multi-host monorepo of seven packages** — the host-neutral `taskflow-core` engine, the host-neutral `taskflow-mcp` MCP server, the shared host-runner `taskflow-hosts`, plus `pi-taskflow` (Pi adapter), `codex-taskflow`, `claude-taskflow`, and `opencode-taskflow` (the three delivery packages re-export their runners from `taskflow-hosts` and each ships an MCP bin + plugin/config), all sharing the host-neutral MCP server in `taskflow-mcp`. **Library Phase 1**: save flows with `purpose`+`tags` via `taskflow_save` (MCP) or `action=save` (Pi), search them with structural + CJK-aware keyword scoring via `taskflow_search`/`action=search`, and track `reuseCount` via `reusedFromSearch`. **`defineFile`**: pass a `defineFile` path (or `{defineFile, name}`) to `action=run` (Pi) or `taskflow_run`/`taskflow_verify`/`taskflow_compile` (MCP) instead of an inline `define`, and the engine reads the flow from disk — pair it with JSONC comments to annotate saved flows. **JSONC**: flow-definition `.json` files may now carry `//` and `/* */` comments and trailing commas (parsed by `parseJsonc`, re-exported from the `taskflow-core` barrel); LLM-output parsing via `safeParse` stays strict. **Shared Context Tree**: opt-in (`shareContext` / `contextSharing`) blackboard + supervision tools (`ctx_read`/`ctx_write` horizontal reuse, `ctx_report`/`ctx_spawn` vertical supervision); `ctx_spawn` accepts a flat task **or** a dependency-bearing `subflow` (a runtime-validated nested DAG), depth-capped on a unified nesting counter with budget accounting. **Workspace isolation**: a phase's `cwd` accepts reserved keywords `temp`/`dedicated`/`worktree` — the runtime allocates an isolated dir (or a git worktree on a throwaway branch) and tears it down after the phase, fail-open, rejected in LLM-authored sub-flows. **Detached execution**: runs can execute in the background, detached from the Pi session. Prior: loop-until-done (`loop`), tournament (best-of-N with a judge), cross-run memoization (content-addressed cache with git/file/glob/env fingerprints and TTL), interactive `/tf init`, configurable built-in agents, 18 built-in agents with 6 model roles. Full control-flow & reliability layer (`when` guards, `join: any`, `retry`/backoff, `approval`, `flow` composition, `budget` caps, `onBlock: "retry"`, `eval` machine gates, idle watchdog) on top of the DSL + DAG runtime (`agent`/`parallel`/`map`/`gate`/`reduce`). Inline + saved flows, cross-session resume, live progress, and isolated context. A run executes as one streaming tool call. Known boundaries (tracked, bounded — no surprises mid-flow): diff --git a/README.zh-CN.md b/README.zh-CN.md index d15d4d5..03a3db5 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -8,7 +8,7 @@ MIT license zero runtime dependencies CI status - 1092 tests + 1140 tests dogfooded runs on Pi, Codex, Claude Code, and OpenCode

@@ -730,16 +730,18 @@ provided files. Report violations grouped by file. No fixes. 将其中一份复制到 `.pi/taskflows/.json`（或 `~/.pi/agent/taskflows/`），它就会注册为 `/tf:`——或者直接让模型指向它。 + + ## 内部构成
-**0 个运行时依赖** · **1045 个测试** · **10 种阶段类型** · **共享上下文树** · **跨会话恢复** · **跨运行记忆化** · **逐项 map 缓存** · **增量重算** · **后台（detached）执行** · **`compile` Mermaid 渲染** · **~9k LOC 运行时** +**0 个运行时依赖** · **1140 个测试** · **10 种阶段类型** · **共享上下文树** · **跨会话恢复** · **跨运行记忆化** · **逐项 map 缓存** · **增量重算** · **后台（detached）执行** · **`compile` Mermaid 渲染** · **~9k LOC 运行时**
- **零运行时依赖。** 没有 `dependencies` 字段——运行时完全基于 Node 内置模块（`fs` / `path` / `os` / `child_process` / `crypto`）。文件锁是 `fs.openSync("wx")`，不是第三方库。 -- **1045 个测试分布在 64 个测试文件中**，涵盖并发、原子文件锁定（8 进程竞争回归测试）、路径穿越防御、跨会话恢复、跨运行缓存新鲜度（流程/推理/工具键隔离、指纹失效、TTL/LRU 淘汰）、逐项 map 缓存、增量重算、FlowIR 编译接缝、门控判决、预算上限、重试/回退、审批流程、循环终止、锦标赛评判、子流程组合、共享上下文树、工作区隔离、后台执行、回调隔离、空闲看门狗、模型角色 init 配置，以及 `compile` Mermaid 渲染器。 +- **1140 个测试分布在 70 个测试文件中**，涵盖并发、原子文件锁定（8 进程竞争回归测试）、路径穿越防御、跨会话恢复、跨运行缓存新鲜度（流程/推理/工具键隔离、指纹失效、TTL/LRU 淘汰）、逐项 map 缓存、增量重算、FlowIR 编译接缝、门控判决、预算上限、重试/回退、审批流程、循环终止、锦标赛评判、子流程组合、共享上下文树、工作区隔离、后台执行、回调隔离、空闲看门狗、模型角色 init 配置，以及 `compile` Mermaid 渲染器。 - **经过强化的设计。** 路径穿越防御（词法 + `realpath`）、runId 验证、HTML/错误净化、原子写入、通过 `rename` 实现的过期锁窃取，以及杀死卡死子代理的空闲看门狗。 - **自产自用（dogfooded）。** 每个新功能必须在发布前通过项目自身的 `self-improve` taskflow 的考验。 @@ -764,7 +766,7 @@ provided files. Report violations grouped by file. No fixes. ## 状态与边界 -**v0.1.5**——当前发布版。完整历史详见 [CHANGELOG](./CHANGELOG.md)。本版新增 **Claude Code 与 OpenCode 两个宿主**、**将 MCP 服务器拆为独立的 `taskflow-mcp` 包**，并**将三个宿主运行器去重**为共享的 `runSubagentProcess`。基线：**七个包的多宿主 monorepo**——宿主无关的 `taskflow-core` 引擎、宿主无关的 `taskflow-mcp` MCP 服务器、共享宿主运行器的 `taskflow-hosts`，加上 `pi-taskflow`（Pi 适配器）、`codex-taskflow`、`claude-taskflow`、`opencode-taskflow`（后三者为交付包，通过 `taskflow-hosts` 复用 runner + MCP bin + 插件/配置），共享 `taskflow-mcp` 中的宿主无关 MCP 服务器。**共享上下文树**：可选开启（`shareContext` / `contextSharing`）的黑板 + 监督工具（`ctx_read`/`ctx_write` 水平复用、`ctx_report`/`ctx_spawn` 垂直监督）。**工作区隔离**：阶段的 `cwd` 接受保留关键字 `temp`/`dedicated`/`worktree`，运行时分配隔离目录（或一条一次性分支上的 git worktree）并在阶段结束后拆除。**后台（detached）执行**：运行可脱离会话后台执行。早期功能：循环至完成（`loop`）、锦标赛（best-of-N 带评判者）、跨运行记忆化（基于 git/文件/glob/环境指纹和 TTL 的内容寻址缓存）、交互式 `/tf init`、18 个内置代理及模型角色。完整的控制流与可靠性层（`when` 守卫、`join: any`、`retry`/回退、`approval`、`flow` 组合、`budget` 上限、`eval` 机器门控、空闲看门狗）构建在 DSL + DAG 运行时（`agent`/`parallel`/`map`/`gate`/`reduce`）之上。支持内联 + 已保存流程、跨会话恢复、实时进度和上下文隔离。一次运行作为一个流式工具调用执行。 +**v0.1.6**——当前发布版。完整历史详见 [CHANGELOG](./CHANGELOG.md)。本版新增 **库 Phase 1**（先搜后写 + 可复用流程资产）、**`defineFile` 参数**（从磁盘路径 verify/compile/run 流程）、以及流程定义文件的 **JSONC 注释支持**（`//` 与 `/* */` 注释 + 尾逗号，由零依赖的 `parseJsonc` 解析）。**v0.1.5** 新增了 **Claude Code 与 OpenCode 两个宿主**、**将 MCP 服务器拆为独立的 `taskflow-mcp` 包**，并**将三个宿主运行器去重**为共享的 `runSubagentProcess`。基线：**七个包的多宿主 monorepo**——宿主无关的 `taskflow-core` 引擎、宿主无关的 `taskflow-mcp` MCP 服务器、共享宿主运行器的 `taskflow-hosts`，加上 `pi-taskflow`（Pi 适配器）、`codex-taskflow`、`claude-taskflow`、`opencode-taskflow`（后三者为交付包，通过 `taskflow-hosts` 复用 runner + MCP bin + 插件/配置），共享 `taskflow-mcp` 中的宿主无关 MCP 服务器。**共享上下文树**：可选开启（`shareContext` / `contextSharing`）的黑板 + 监督工具（`ctx_read`/`ctx_write` 水平复用、`ctx_report`/`ctx_spawn` 垂直监督）。**工作区隔离**：阶段的 `cwd` 接受保留关键字 `temp`/`dedicated`/`worktree`，运行时分配隔离目录（或一条一次性分支上的 git worktree）并在阶段结束后拆除。**后台（detached）执行**：运行可脱离会话后台执行。早期功能：循环至完成（`loop`）、锦标赛（best-of-N 带评判者）、跨运行记忆化（基于 git/文件/glob/环境指纹和 TTL 的内容寻址缓存）、交互式 `/tf init`、18 个内置代理及模型角色。完整的控制流与可靠性层（`when` 守卫、`join: any`、`retry`/回退、`approval`、`flow` 组合、`budget` 上限、`eval` 机器门控、空闲看门狗）构建在 DSL + DAG 运行时（`agent`/`parallel`/`map`/`gate`/`reduce`）之上。支持内联 + 已保存流程、跨会话恢复、实时进度和上下文隔离。一次运行作为一个流式工具调用执行。 已知边界（已追踪、有限定——不会在流程中途出现意外）： diff --git a/RELEASE.md b/RELEASE.md index fd6eac9..ab63c11 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -33,7 +33,7 @@ pnpm whoami --registry=https://registry.npmjs.org/ # expect: heggria (or the o ```sh pnpm install # links the workspaces pnpm run typecheck # 0 errors (resolves taskflow-core to src via the dev condition) -pnpm test # 1092/1092 green +pnpm test # 1140/1140 green pnpm run build # emit dist/ for all seven packages (tsc → .js + .d.ts) ``` @@ -81,7 +81,7 @@ pnpm publish --filter opencode-taskflow --registry=https://registry.npmjs.org/ - > **Note on `taskflow-core` as a dependency.** `taskflow-mcp`, `taskflow-hosts`, and the host adapters > (`pi-taskflow` / `codex-taskflow` / `claude-taskflow` / `opencode-taskflow`) -> declare `"taskflow-core": "0.1.5"` (an exact version, not `workspace:*`), so the +> declare `"taskflow-core": "0.1.6"` (an exact version, not `workspace:*`), so the > published tarballs resolve the real npm package once it exists. Always publish > `taskflow-core` first and bump all seven in lockstep. (`taskflow-mcp` and `taskflow-hosts` are the > other internal dependencies: the MCP host adapters pin `"taskflow-mcp"`; the codex/claude/opencode @@ -94,7 +94,7 @@ seven package versions match the tag, publishes them in order, and cuts a GitHub Release from the matching `CHANGELOG.md` section. ```sh -git tag v0.1.5 && git push origin v0.1.5 +git tag v0.1.6 && git push origin v0.1.6 ``` ## Verify after publish diff --git a/SECURITY.md b/SECURITY.md index 6e7fc4b..6f62545 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -27,7 +27,7 @@ The runtime has intentional hardening: `realpath`-based path containment, runId | Version | Support | |---------|---------| -| v0.1.5 (latest) | ✅ Active | +| v0.1.6 (latest) | ✅ Active | | Earlier versions | ❌ Unsupported — upgrade to latest | ## Disclosure diff --git a/docs/claude-mcp.md b/docs/claude-mcp.md index 74f554a..e51ae70 100644 --- a/docs/claude-mcp.md +++ b/docs/claude-mcp.md @@ -35,7 +35,7 @@ Verify: ```sh claude plugin list # → claude-taskflow@taskflow installed, enabled -claude mcp list # → taskflow … (npx -y -p claude-taskflow@0.1.5 claude-taskflow-mcp) +claude mcp list # → taskflow … (npx -y -p claude-taskflow@0.1.6 claude-taskflow-mcp) ``` The bundled skill tells Claude Code *when* to reach for the tools (multi-phase diff --git a/docs/codex-mcp.md b/docs/codex-mcp.md index d120f1e..6e5a02b 100644 --- a/docs/codex-mcp.md +++ b/docs/codex-mcp.md @@ -31,7 +31,7 @@ globally, and the plugin version binds the exact code that runs. Verify: ```sh codex plugin list # → taskflow@taskflow installed, enabled -codex mcp list # → taskflow … enabled (npx -y -p codex-taskflow@0.1.5 codex-taskflow-mcp) +codex mcp list # → taskflow … enabled (npx -y -p codex-taskflow@0.1.6 codex-taskflow-mcp) ``` The bundled skill tells Codex *when* to reach for the tools (multi-phase or @@ -53,7 +53,7 @@ To stop large flows from being cut off, the plugin's `.mcp.json` ships a "mcpServers": { "taskflow": { "command": "npx", - "args": ["-y", "-p", "codex-taskflow@0.1.5", "codex-taskflow-mcp"], + "args": ["-y", "-p", "codex-taskflow@0.1.6", "codex-taskflow-mcp"], "tool_timeout_sec": 1800 } } diff --git a/package.json b/package.json index ca1adc8..d5e8ffd 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "pi-taskflow-monorepo", - "version": "0.1.5", + "version": "0.1.6", "private": true, "description": "Monorepo for taskflow-core, taskflow-mcp, taskflow-hosts, pi-taskflow, codex-taskflow, claude-taskflow, opencode-taskflow, and the documentation website.", "type": "module", diff --git a/packages/claude-taskflow/package.json b/packages/claude-taskflow/package.json index 5914305..f6fedcd 100644 --- a/packages/claude-taskflow/package.json +++ b/packages/claude-taskflow/package.json @@ -1,6 +1,6 @@ { "name": "claude-taskflow", - "version": "0.1.5", + "version": "0.1.6", "description": "Run taskflow on Claude Code: a Claude subagent runner plus an MCP server (and a plug-and-play Claude Code plugin) that exposes the taskflow_* tools to Claude Code users.", "keywords": [ "claude", @@ -54,8 +54,8 @@ "access": "public" }, "dependencies": { - "taskflow-core": "0.1.5", - "taskflow-hosts": "0.1.5", - "taskflow-mcp": "0.1.5" + "taskflow-core": "0.1.6", + "taskflow-hosts": "0.1.6", + "taskflow-mcp": "0.1.6" } } diff --git a/packages/claude-taskflow/plugin/.claude-plugin/plugin.json b/packages/claude-taskflow/plugin/.claude-plugin/plugin.json index 2050c92..ecdc756 100644 --- a/packages/claude-taskflow/plugin/.claude-plugin/plugin.json +++ b/packages/claude-taskflow/plugin/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "taskflow", - "version": "0.1.5", + "version": "0.1.6", "description": "Declarative, verifiable DAG orchestration for Claude Code subagents — fan-out, gates, loops, tournaments, approvals, resumable runs, and saveable commands, with intermediate transcripts kept out of your context.", "author": { "name": "heggria", diff --git a/packages/claude-taskflow/plugin/.mcp.json b/packages/claude-taskflow/plugin/.mcp.json index 678494b..e4c0d95 100644 --- a/packages/claude-taskflow/plugin/.mcp.json +++ b/packages/claude-taskflow/plugin/.mcp.json @@ -2,7 +2,7 @@ "mcpServers": { "taskflow": { "command": "npx", - "args": ["-y", "-p", "claude-taskflow@0.1.5", "claude-taskflow-mcp"] + "args": ["-y", "-p", "claude-taskflow@0.1.6", "claude-taskflow-mcp"] } } } diff --git a/packages/codex-taskflow/package.json b/packages/codex-taskflow/package.json index 69e7f0f..8d9c2b2 100644 --- a/packages/codex-taskflow/package.json +++ b/packages/codex-taskflow/package.json @@ -1,6 +1,6 @@ { "name": "codex-taskflow", - "version": "0.1.5", + "version": "0.1.6", "description": "Run taskflow on OpenAI Codex: a Codex subagent runner plus an MCP server (and a plug-and-play Codex plugin) that exposes the taskflow_* tools to Codex users.", "keywords": [ "codex", @@ -54,8 +54,8 @@ "access": "public" }, "dependencies": { - "taskflow-core": "0.1.5", - "taskflow-hosts": "0.1.5", - "taskflow-mcp": "0.1.5" + "taskflow-core": "0.1.6", + "taskflow-hosts": "0.1.6", + "taskflow-mcp": "0.1.6" } } diff --git a/packages/codex-taskflow/plugin/.codex-plugin/plugin.json b/packages/codex-taskflow/plugin/.codex-plugin/plugin.json index 9b7ba37..b35a41e 100644 --- a/packages/codex-taskflow/plugin/.codex-plugin/plugin.json +++ b/packages/codex-taskflow/plugin/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "taskflow", - "version": "0.1.5", + "version": "0.1.6", "description": "Declarative, verifiable DAG orchestration for Codex subagents — fan-out, gates, loops, tournaments, approvals, resumable runs, and saveable commands, with intermediate transcripts kept out of your context.", "author": { "name": "heggria", diff --git a/packages/codex-taskflow/plugin/.mcp.json b/packages/codex-taskflow/plugin/.mcp.json index e8bfb65..7fd3978 100644 --- a/packages/codex-taskflow/plugin/.mcp.json +++ b/packages/codex-taskflow/plugin/.mcp.json @@ -2,7 +2,7 @@ "mcpServers": { "taskflow": { "command": "npx", - "args": ["-y", "-p", "codex-taskflow@0.1.5", "codex-taskflow-mcp"], + "args": ["-y", "-p", "codex-taskflow@0.1.6", "codex-taskflow-mcp"], "tool_timeout_sec": 1800 } } diff --git a/packages/opencode-taskflow/package.json b/packages/opencode-taskflow/package.json index cb28154..c2d2c57 100644 --- a/packages/opencode-taskflow/package.json +++ b/packages/opencode-taskflow/package.json @@ -1,6 +1,6 @@ { "name": "opencode-taskflow", - "version": "0.1.5", + "version": "0.1.6", "description": "Run taskflow on OpenCode: an OpenCode subagent runner plus an MCP server (and an opencode.json config scaffold) that exposes the taskflow_* tools to OpenCode users.", "keywords": [ "opencode", @@ -53,8 +53,8 @@ "access": "public" }, "dependencies": { - "taskflow-core": "0.1.5", - "taskflow-hosts": "0.1.5", - "taskflow-mcp": "0.1.5" + "taskflow-core": "0.1.6", + "taskflow-hosts": "0.1.6", + "taskflow-mcp": "0.1.6" } } diff --git a/packages/opencode-taskflow/plugin/opencode.json b/packages/opencode-taskflow/plugin/opencode.json index 3b25b82..a4015ea 100644 --- a/packages/opencode-taskflow/plugin/opencode.json +++ b/packages/opencode-taskflow/plugin/opencode.json @@ -3,7 +3,7 @@ "mcp": { "taskflow": { "type": "local", - "command": ["npx", "-y", "-p", "opencode-taskflow@0.1.5", "opencode-taskflow-mcp"], + "command": ["npx", "-y", "-p", "opencode-taskflow@0.1.6", "opencode-taskflow-mcp"], "enabled": true } }, diff --git a/packages/pi-taskflow/package.json b/packages/pi-taskflow/package.json index 64856d3..e99e61f 100644 --- a/packages/pi-taskflow/package.json +++ b/packages/pi-taskflow/package.json @@ -1,6 +1,6 @@ { "name": "pi-taskflow", - "version": "0.1.5", + "version": "0.1.6", "description": "A declarative, verifiable graph of task nodes for the Pi coding agent — statically verified before it runs, with dynamic fan-out, gates, isolated subagent context, resumable runs, and saveable commands.", "keywords": [ "pi-package", @@ -53,7 +53,7 @@ "image": "https://raw.githubusercontent.com/heggria/taskflow/main/assets/social-preview.png" }, "dependencies": { - "taskflow-core": "0.1.5" + "taskflow-core": "0.1.6" }, "peerDependencies": { "@earendil-works/pi-agent-core": "*", diff --git a/packages/taskflow-core/package.json b/packages/taskflow-core/package.json index 060a21a..b87ea68 100644 --- a/packages/taskflow-core/package.json +++ b/packages/taskflow-core/package.json @@ -1,6 +1,6 @@ { "name": "taskflow-core", - "version": "0.1.5", + "version": "0.1.6", "description": "Host-neutral engine for declarative, verifiable task-DAG orchestration — the runtime, DSL, cache, and verification shared by pi-taskflow, codex-taskflow, claude-taskflow, and opencode-taskflow.", "keywords": [ "taskflow", diff --git a/packages/taskflow-hosts/package.json b/packages/taskflow-hosts/package.json index 5aef1cb..03abc41 100644 --- a/packages/taskflow-hosts/package.json +++ b/packages/taskflow-hosts/package.json @@ -1,6 +1,6 @@ { "name": "taskflow-hosts", - "version": "0.1.5", + "version": "0.1.6", "description": "Shared host-runner collection for taskflow — the codex, claude, and opencode SubagentRunner implementations + their argv builders and event-stream parsers. The per-host MCP servers, plugin scaffolds, and bins live in codex-taskflow / claude-taskflow / opencode-taskflow; this package holds just the runners so a new host can be added in one place.", "type": "module", "engines": { @@ -43,7 +43,7 @@ "build": "rm -rf dist && tsc -p tsconfig.build.json" }, "dependencies": { - "taskflow-core": "0.1.5" + "taskflow-core": "0.1.6" }, "devDependencies": { "typescript": "^6.0.3" diff --git a/packages/taskflow-mcp/package.json b/packages/taskflow-mcp/package.json index 6099560..d7646ce 100644 --- a/packages/taskflow-mcp/package.json +++ b/packages/taskflow-mcp/package.json @@ -1,6 +1,6 @@ { "name": "taskflow-mcp", - "version": "0.1.5", + "version": "0.1.6", "description": "Host-neutral MCP server for taskflow: a dependency-free stdio JSON-RPC server exposing the taskflow_* tools, plus the DAG SVG/outline renderer. Shared by the codex/claude/opencode adapters — depends only on taskflow-core.", "keywords": [ "taskflow", @@ -60,6 +60,6 @@ "access": "public" }, "dependencies": { - "taskflow-core": "0.1.5" + "taskflow-core": "0.1.6" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0a63549..106fa6d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -33,37 +33,37 @@ importers: packages/claude-taskflow: dependencies: taskflow-core: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-core taskflow-hosts: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-hosts taskflow-mcp: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-mcp packages/codex-taskflow: dependencies: taskflow-core: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-core taskflow-hosts: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-hosts taskflow-mcp: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-mcp packages/opencode-taskflow: dependencies: taskflow-core: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-core taskflow-hosts: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-hosts taskflow-mcp: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-mcp packages/pi-taskflow: @@ -81,7 +81,7 @@ importers: specifier: '*' version: 0.80.3 taskflow-core: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-core typebox: specifier: '*' @@ -96,7 +96,7 @@ importers: packages/taskflow-hosts: dependencies: taskflow-core: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-core devDependencies: typescript: @@ -106,7 +106,7 @@ importers: packages/taskflow-mcp: dependencies: taskflow-core: - specifier: 0.1.5 + specifier: 0.1.6 version: link:../taskflow-core website: