From 14483518270b86ebf2155638256dbe44643ae465 Mon Sep 17 00:00:00 2001 From: heggria Date: Thu, 9 Jul 2026 20:48:29 +0800 Subject: [PATCH] release: v0.1.8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Release prep for 0.1.8 — a small patch release shipping the cwd interpolation-placeholder fix (#65) plus the batched dependency bumps (#57, #66). No engine API changes. Bumps all seven packages + root to 0.1.8 in lockstep, including the taskflow-core / taskflow-hosts / taskflow-mcp-core dependency pins and the codex/claude/opencode plugin manifests (.mcp.json npx pins + plugin.json versions), and adds the 0.1.8 CHANGELOG section. Pre-flight: typecheck 0 errors, 1160/1160 unit tests green, build + 7 packages OK, skills drift-guard green. --- CHANGELOG.md | 24 +++++++++++++++++++ package.json | 2 +- packages/claude-taskflow/package.json | 8 +++---- .../plugin/.claude-plugin/plugin.json | 2 +- packages/claude-taskflow/plugin/.mcp.json | 2 +- packages/codex-taskflow/package.json | 8 +++---- .../plugin/.codex-plugin/plugin.json | 2 +- packages/codex-taskflow/plugin/.mcp.json | 2 +- packages/opencode-taskflow/package.json | 8 +++---- .../opencode-taskflow/plugin/opencode.json | 2 +- packages/pi-taskflow/package.json | 4 ++-- packages/taskflow-core/package.json | 2 +- packages/taskflow-hosts/package.json | 4 ++-- packages/taskflow-mcp-core/package.json | 4 ++-- pnpm-lock.yaml | 24 +++++++++---------- 15 files changed, 61 insertions(+), 37 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7db1461..8612b90 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,30 @@ All notable changes to taskflow are documented here. This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format. +## [0.1.8] — 2026-07-09 + +### Fixed +- **`cwd` no longer accepts interpolation placeholders.** A phase's `cwd` field + is a literal path / reserved workspace keyword (`temp` / `dedicated` / + `worktree`), not an interpolated one — but the validator silently accepted + values like `cwd: "{args.workspace}"`, which would then resolve to a literal + directory named `{args.workspace}` at run time (or, worse, be exploitable as + a path-injection vector). `validateTaskflow()` now rejects any `cwd` value + matching a `{placeholder}` pattern with a clear error pointing at the + reserved keywords. (#65) + +### Changed +- **Dependency sweep** (no runtime-API changes — these are CI / dev / website + dependencies; the published packages' runtime surface is unchanged): + - `pnpm/action-setup` 4 → 6 (#57). + - Batched the remaining Dependabot PRs that were stuck behind CI / + workflow-scope gates (#66): GitHub Actions `actions/checkout` v4 → v7, + `actions/upload-pages-artifact` v3 → v5, `actions/deploy-pages` v4 → v5; + dev deps `typescript` ^6 → ^7, `@types/node` ^22 → ^26, `typebox` ^1.3.3 → + ^1.3.6, `@biomejs/biome` 2.5.2 → 2.5.3; website deps `fumadocs-core/ui` + 16.10.7 → 16.11.1, `fumadocs-mdx` 15.0.13 → 15.1.0. Local typecheck + the + full 1160-test unit suite remain green. + ## [0.1.7] — 2026-07-07 ### Added diff --git a/package.json b/package.json index d21e21f..b50f5af 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "pi-taskflow-monorepo", - "version": "0.1.7", + "version": "0.1.8", "private": true, "description": "Monorepo for taskflow-core, taskflow-mcp-core, taskflow-hosts, pi-taskflow, codex-taskflow, claude-taskflow, opencode-taskflow, and the documentation website.", "type": "module", diff --git a/packages/claude-taskflow/package.json b/packages/claude-taskflow/package.json index 0698c4b..18711da 100644 --- a/packages/claude-taskflow/package.json +++ b/packages/claude-taskflow/package.json @@ -1,6 +1,6 @@ { "name": "claude-taskflow", - "version": "0.1.7", + "version": "0.1.8", "description": "Run taskflow on Claude Code: a Claude subagent runner plus an MCP server (and a plug-and-play Claude Code plugin) that exposes the taskflow_* tools to Claude Code users.", "keywords": [ "claude", @@ -54,8 +54,8 @@ "access": "public" }, "dependencies": { - "taskflow-core": "0.1.7", - "taskflow-hosts": "0.1.7", - "taskflow-mcp-core": "0.1.7" + "taskflow-core": "0.1.8", + "taskflow-hosts": "0.1.8", + "taskflow-mcp-core": "0.1.8" } } diff --git a/packages/claude-taskflow/plugin/.claude-plugin/plugin.json b/packages/claude-taskflow/plugin/.claude-plugin/plugin.json index c8474ef..576d4ba 100644 --- a/packages/claude-taskflow/plugin/.claude-plugin/plugin.json +++ b/packages/claude-taskflow/plugin/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "taskflow", - "version": "0.1.7", + "version": "0.1.8", "description": "Declarative, verifiable DAG orchestration for Claude Code subagents — fan-out, gates, loops, tournaments, approvals, resumable runs, and saveable commands, with intermediate transcripts kept out of your context.", "author": { "name": "heggria", diff --git a/packages/claude-taskflow/plugin/.mcp.json b/packages/claude-taskflow/plugin/.mcp.json index 1491bdf..9ca9820 100644 --- a/packages/claude-taskflow/plugin/.mcp.json +++ b/packages/claude-taskflow/plugin/.mcp.json @@ -2,7 +2,7 @@ "mcpServers": { "taskflow": { "command": "npx", - "args": ["-y", "-p", "claude-taskflow@0.1.7", "claude-taskflow-mcp"] + "args": ["-y", "-p", "claude-taskflow@0.1.8", "claude-taskflow-mcp"] } } } diff --git a/packages/codex-taskflow/package.json b/packages/codex-taskflow/package.json index 86affc4..ef6ff97 100644 --- a/packages/codex-taskflow/package.json +++ b/packages/codex-taskflow/package.json @@ -1,6 +1,6 @@ { "name": "codex-taskflow", - "version": "0.1.7", + "version": "0.1.8", "description": "Run taskflow on OpenAI Codex: a Codex subagent runner plus an MCP server (and a plug-and-play Codex plugin) that exposes the taskflow_* tools to Codex users.", "keywords": [ "codex", @@ -54,8 +54,8 @@ "access": "public" }, "dependencies": { - "taskflow-core": "0.1.7", - "taskflow-hosts": "0.1.7", - "taskflow-mcp-core": "0.1.7" + "taskflow-core": "0.1.8", + "taskflow-hosts": "0.1.8", + "taskflow-mcp-core": "0.1.8" } } diff --git a/packages/codex-taskflow/plugin/.codex-plugin/plugin.json b/packages/codex-taskflow/plugin/.codex-plugin/plugin.json index 38acf6d..afca5b4 100644 --- a/packages/codex-taskflow/plugin/.codex-plugin/plugin.json +++ b/packages/codex-taskflow/plugin/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "taskflow", - "version": "0.1.7", + "version": "0.1.8", "description": "Declarative, verifiable DAG orchestration for Codex subagents — fan-out, gates, loops, tournaments, approvals, resumable runs, and saveable commands, with intermediate transcripts kept out of your context.", "author": { "name": "heggria", diff --git a/packages/codex-taskflow/plugin/.mcp.json b/packages/codex-taskflow/plugin/.mcp.json index b3d23b7..985205d 100644 --- a/packages/codex-taskflow/plugin/.mcp.json +++ b/packages/codex-taskflow/plugin/.mcp.json @@ -2,7 +2,7 @@ "mcpServers": { "taskflow": { "command": "npx", - "args": ["-y", "-p", "codex-taskflow@0.1.7", "codex-taskflow-mcp"], + "args": ["-y", "-p", "codex-taskflow@0.1.8", "codex-taskflow-mcp"], "tool_timeout_sec": 1800 } } diff --git a/packages/opencode-taskflow/package.json b/packages/opencode-taskflow/package.json index 95fb198..9ed452e 100644 --- a/packages/opencode-taskflow/package.json +++ b/packages/opencode-taskflow/package.json @@ -1,6 +1,6 @@ { "name": "opencode-taskflow", - "version": "0.1.7", + "version": "0.1.8", "description": "Run taskflow on OpenCode: an OpenCode subagent runner plus an MCP server (and an opencode.json config scaffold) that exposes the taskflow_* tools to OpenCode users.", "keywords": [ "opencode", @@ -53,8 +53,8 @@ "access": "public" }, "dependencies": { - "taskflow-core": "0.1.7", - "taskflow-hosts": "0.1.7", - "taskflow-mcp-core": "0.1.7" + "taskflow-core": "0.1.8", + "taskflow-hosts": "0.1.8", + "taskflow-mcp-core": "0.1.8" } } diff --git a/packages/opencode-taskflow/plugin/opencode.json b/packages/opencode-taskflow/plugin/opencode.json index f2bf197..331ff0c 100644 --- a/packages/opencode-taskflow/plugin/opencode.json +++ b/packages/opencode-taskflow/plugin/opencode.json @@ -3,7 +3,7 @@ "mcp": { "taskflow": { "type": "local", - "command": ["npx", "-y", "-p", "opencode-taskflow@0.1.7", "opencode-taskflow-mcp"], + "command": ["npx", "-y", "-p", "opencode-taskflow@0.1.8", "opencode-taskflow-mcp"], "enabled": true } }, diff --git a/packages/pi-taskflow/package.json b/packages/pi-taskflow/package.json index b9b39b8..ee0d751 100644 --- a/packages/pi-taskflow/package.json +++ b/packages/pi-taskflow/package.json @@ -1,6 +1,6 @@ { "name": "pi-taskflow", - "version": "0.1.7", + "version": "0.1.8", "description": "A declarative, verifiable graph of task nodes for the Pi coding agent — statically verified before it runs, with dynamic fan-out, gates, isolated subagent context, resumable runs, and saveable commands.", "keywords": [ "pi-package", @@ -53,7 +53,7 @@ "image": "https://raw.githubusercontent.com/heggria/taskflow/main/assets/social-preview.png" }, "dependencies": { - "taskflow-core": "0.1.7" + "taskflow-core": "0.1.8" }, "peerDependencies": { "@earendil-works/pi-agent-core": "*", diff --git a/packages/taskflow-core/package.json b/packages/taskflow-core/package.json index 0033300..cecfe82 100644 --- a/packages/taskflow-core/package.json +++ b/packages/taskflow-core/package.json @@ -1,6 +1,6 @@ { "name": "taskflow-core", - "version": "0.1.7", + "version": "0.1.8", "description": "Host-neutral engine for declarative, verifiable task-DAG orchestration — the runtime, DSL, cache, and verification shared by pi-taskflow, codex-taskflow, claude-taskflow, and opencode-taskflow.", "keywords": [ "taskflow", diff --git a/packages/taskflow-hosts/package.json b/packages/taskflow-hosts/package.json index 0355b13..5ba047a 100644 --- a/packages/taskflow-hosts/package.json +++ b/packages/taskflow-hosts/package.json @@ -1,6 +1,6 @@ { "name": "taskflow-hosts", - "version": "0.1.7", + "version": "0.1.8", "description": "Shared host-runner collection for taskflow — the codex, claude, and opencode SubagentRunner implementations + their argv builders and event-stream parsers. The per-host MCP servers, plugin scaffolds, and bins live in codex-taskflow / claude-taskflow / opencode-taskflow; this package holds just the runners so a new host can be added in one place.", "homepage": "https://github.com/heggria/taskflow#readme", "type": "module", @@ -44,7 +44,7 @@ "build": "rm -rf dist && tsc -p tsconfig.build.json" }, "dependencies": { - "taskflow-core": "0.1.7" + "taskflow-core": "0.1.8" }, "devDependencies": { "typescript": "^7.0.2" diff --git a/packages/taskflow-mcp-core/package.json b/packages/taskflow-mcp-core/package.json index 53d354e..03a9646 100644 --- a/packages/taskflow-mcp-core/package.json +++ b/packages/taskflow-mcp-core/package.json @@ -1,6 +1,6 @@ { "name": "taskflow-mcp-core", - "version": "0.1.7", + "version": "0.1.8", "description": "Host-neutral MCP server for taskflow: a dependency-free stdio JSON-RPC server exposing the taskflow_* tools, plus the DAG SVG/outline renderer. Shared by the codex/claude/opencode adapters — depends only on taskflow-core.", "keywords": [ "taskflow", @@ -60,6 +60,6 @@ "access": "public" }, "dependencies": { - "taskflow-core": "0.1.7" + "taskflow-core": "0.1.8" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 56509d4..5c49765 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -36,37 +36,37 @@ importers: packages/claude-taskflow: dependencies: taskflow-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-core taskflow-hosts: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-hosts taskflow-mcp-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-mcp-core packages/codex-taskflow: dependencies: taskflow-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-core taskflow-hosts: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-hosts taskflow-mcp-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-mcp-core packages/opencode-taskflow: dependencies: taskflow-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-core taskflow-hosts: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-hosts taskflow-mcp-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-mcp-core packages/pi-taskflow: @@ -84,7 +84,7 @@ importers: specifier: '*' version: 0.80.3 taskflow-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-core typebox: specifier: '*' @@ -99,7 +99,7 @@ importers: packages/taskflow-hosts: dependencies: taskflow-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-core devDependencies: typescript: @@ -109,7 +109,7 @@ importers: packages/taskflow-mcp-core: dependencies: taskflow-core: - specifier: 0.1.7 + specifier: 0.1.8 version: link:../taskflow-core website: