@calmo/task-runner 3.4.0 → 3.5.0

package/.github/dependabot.yml

@@ -5,12 +5,12 @@
 
 version: 2
 updates:
-  - package-ecosystem: 'npm' # See documentation for possible values
-    directory: '/' # Location of package manifests
-    versioning-strategy: 'lockfile-only'
+  - package-ecosystem: "npm" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    versioning-strategy: "lockfile-only"
     schedule:
-      interval: 'weekly'
-  - package-ecosystem: 'github-actions'
-    directory: '/'
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
     schedule:
-      interval: 'weekly'
+      interval: "weekly"

package/.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 jobs:
   build:
@@ -24,8 +24,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '22'
-          cache: 'pnpm'
+          node-version: "22"
+          cache: "pnpm"
 
       - name: Install dependencies
         run: pnpm install

package/.jules/backlog_maniac.md

@@ -1,3 +1,4 @@
 ## 2026-01-18 - TaskGraphValidationError
+
 **Learning:** Generic errors hide structured validation data, forcing consumers to parse strings or guess what went wrong.
 **Action:** Introduced `TaskGraphValidationError` which encapsulates the `ValidationResult`, allowing programmatic access to specific validation failures (e.g., missing dependencies, cycles).

package/.jules/nexus.md

@@ -1,5 +1,6 @@
 # Nexus Journal
 
 ## 2024-05-23 - Reliability via Granularity
+
 **Insight:** Users often confuse "Workflow Timeout" with "Task Timeout". A workflow might allow 5 minutes, but a single HTTP request shouldn't hang for 4 minutes.
 **Action:** By pushing timeout logic down to the `TaskStep` level (and the Strategy layer), we remove the burden of "cooperative cancellation" from the user's business logic, enforcing it at the runner level. This makes the system "secure by default" against zombie tasks.

package/.jules/sentinel.md

@@ -1,4 +1,5 @@
 ## 2026-06-15 - Graph Traversal DoS
+
 **Vulnerability:** Recursive graph traversal (DFS) can lead to Denial of Service via Stack Overflow when processing deep user-supplied graphs.
 **Learning:** Even with large stack limits, recursion is a risk for user-controlled data structures. Node.js stack size is finite.
 **Prevention:** Use iterative algorithms with explicit stacks for graph traversal (e.g., cycle detection).

package/.releaserc.json

@@ -1,7 +1,5 @@
 {
-  "branches": [
-    "main"
-  ],
+  "branches": ["main"],
   "plugins": [
     [
       "@semantic-release/commit-analyzer",
@@ -21,10 +19,7 @@
     [
       "@semantic-release/git",
       {
-        "assets": [
-          "package.json",
-          "CHANGELOG.md"
-        ],
+        "assets": ["package.json", "CHANGELOG.md"],
         "message": "chore(release): ${nextRelease.version} [skip ci]"
       }
     ]

package/AGENTS.md

@@ -1,14 +1,17 @@
 <!-- OPENSPEC:START -->
+
 # OpenSpec Instructions
 
 These instructions are for AI assistants working in this project.
 
 Always open `@/openspec/AGENTS.md` when the request:
+
 - Mentions planning or proposals (words like proposal, spec, change, plan)
 - Introduces new capabilities, breaking changes, architecture shifts, or big performance/security work
 - Sounds ambiguous and you need the authoritative spec before coding
 
 Use `@/openspec/AGENTS.md` to learn:
+
 - How to create and apply change proposals
 - Spec format and conventions
 - Project structure and guidelines
@@ -18,16 +21,33 @@ Keep this managed block so 'openspec update' can refresh the instructions.
 <!-- OPENSPEC:END -->
 
 ## Additional Rules
+
 - Never edit CHANGELOG.md manually. This file is for semantic release and is filled automatically.
 - Avoid using 'any' type at all costs.
 - Always prefer to add more tests instead of simply bypassing coverage validation with comments.
 - Its forbidden to have coverage drop below 100%, thats non negotiable.
 
+## Operational Protocols
+
+- **Critic-First Generation**: Every code block you generate must undergo an internal "Reflection" pass. Explicitly flag potential race conditions, security flaws (OWASP Top 10), or architectural debt.
+- **Verification Gatekeeping**: You are STRICTLY FORBIDDEN from claiming a task is "finished" until you provide terminal output of a passing test suite, a successful build log and a successful lint log.
+- **Planning Sparring**: For any task >20 lines, you must first output a blueprint and validate it. You will not write implementation code until the user approves the blueprint.
+- **Tool-Augmented Research**: Use `/search` and `/read` to understand the entire context of the project. Do not assume; verify existing utility functions to ensure DRY (Don't Repeat Yourself) compliance.
+- **The Confession Rule**: If you hit a logic error or a hallucination, you must immediately halt and state: "I have identified an inconsist- - **Atomic Commits for Complex Features:** When working on complex multi-task features, you MUST commit after completing each distinct task. Before each commit, ensure that `pnpm build`, `pnpm lint`, and `pnpm test` pass. This creates safe rollback points and prevents restarting the entire feature if issues arise.
+
+## Style & Tone
+
+- **Tone**: Professional, technical, and high-density.
+- **Zero Politeness Fluff**: No "I'd be happy to," "Great question," etc.
+- **Architectural Comparisons**: Use markdown tables for comparing architectural trade-offs.
+- **Hypothesis Labeling**: Label speculative thoughts clearly as `[ARCHITECTURAL_HYPOTHESIS]`.
+
 # task-runner Development Guidelines
 
 Auto-generated from all feature plans. Last updated: 2026-01-17
 
 ## Active Technologies
+
 - TypeScript 5.9.3 + vitest 4.0.17 (for testing) (004-pre-execution-validation)
 - TypeScript 5.9.3 + vitest 4.0.17, AbortSignal/AbortController (standard Web APIs) (002-task-cancellation)
 - N/A (in-memory context object) (002-task-cancellation)
@@ -53,22 +73,7 @@ tests/
 : Follow standard conventions
 
 ## Recent Changes
+
 - 005-concurrency-control: Added TypeScript 5.9.3 + vitest 4.0.17
 - 002-task-cancellation: Added TypeScript 5.9.3 + vitest 4.0.17, AbortSignal/AbortController (standard Web APIs)
 - 004-pre-execution-validation: Added TypeScript 5.9.3 + vitest 4.0.17 (for testing)
-
-
-
-<!-- MANUAL ADDITIONS START -->
-- **Atomic Commits for Complex Features:** When working on complex multi-task features, you MUST commit after completing each distinct task. Before each commit, ensure that `pnpm build`, `pnpm lint`, and `pnpm test` pass. This creates safe rollback points and prevents restarting the entire feature if issues arise.
-- Never edit CHANGELOG.md manually. This file is for semantic release and is filled automatically.
-
-Before marking a task as concluded, YOU MUST:
-
-1. run pnpm install
-2. run pnpm build
-3. run pnpm test
-4. run pnpm lint
-
-If any of those command fail, review your changes.
-<!-- MANUAL ADDITIONS END -->