@calmo/task-runner 3.7.0 → 3.8.1

package/.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
 
 jobs:
   build:
+    permissions:
+      contents: read
+      checks: write
     runs-on: ubuntu-latest
 
     steps:

package/.jules/nexus.md

@@ -9,3 +9,8 @@
 
 **Insight:** In distributed systems or long-running local scripts, "Retry from scratch" is a naive default. Users fear side effects (double-billing, double-emailing).
 **Action:** Treating the `TaskResult` map as a portable "Save Game" file transforms the library from a simple runner into a resilient engine. The key is separating "Execution State" (which tasks passed) from "Runtime Context" (variables in memory). By persisting only the former, we avoid the nightmare of serializing closures/sockets while still solving the user's primary pain point: "Don't do the hard work twice."
+
+## 2026-01-17 - Performance Visibility
+
+**Insight:** Users' optimization efforts are blind without granular metrics. Users often don't know *which* task is slow, only that the workflow is slow.
+**Action:** Always include telemetry requirements (like start/end times and duration) in execution engine specs to enable data-driven optimization.

package/.jules/sentinel.md

@@ -3,3 +3,9 @@
 **Vulnerability:** Recursive graph traversal (DFS) can lead to Denial of Service via Stack Overflow when processing deep user-supplied graphs.
 **Learning:** Even with large stack limits, recursion is a risk for user-controlled data structures. Node.js stack size is finite.
 **Prevention:** Use iterative algorithms with explicit stacks for graph traversal (e.g., cycle detection).
+
+## 2024-05-22 - Mermaid Graph Sanitization Vulnerability
+
+**Vulnerability:** The Mermaid graph generation logic in `TaskRunner.getMermaidGraph` used a weak sanitization method (only replacing spaces, colons, and quotes) which allowed special characters like `[]`, `()`, `{}` to pass through. This could result in invalid Mermaid syntax or potentially malicious graph structures if user input controlled task names.
+**Learning:** Blocklists (replacing specific characters) are often insufficient because it's hard to predict all problematic characters.
+**Prevention:** Use strict allowlists (e.g., `/[^a-zA-Z0-9_-]/g`) for identifiers that are used in structured output formats like Mermaid, ensuring only safe characters are included.

package/AGENTS.md

@@ -15,6 +15,7 @@ Use `@/openspec/AGENTS.md` to learn:
 - How to create and apply change proposals
 - Spec format and conventions
 - Project structure and guidelines
+- When creating specs or docs, add a prefix "docs:" to your commit to avoid triggering a new module version
 
 Keep this managed block so 'openspec update' can refresh the instructions.
 

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## <small>3.8.1 (2026-01-21)</small>
+
+* fix: Fix missing event emission on task cancellation (#92) ([3d7e7aa](https://github.com/thalesraymond/task-runner/commit/3d7e7aa)), closes [#92](https://github.com/thalesraymond/task-runner/issues/92)
+* refactor: Refactor TaskRunner to reduce cognitive complexity (#89) ([95c67d9](https://github.com/thalesraymond/task-runner/commit/95c67d9)), closes [#89](https://github.com/thalesraymond/task-runner/issues/89)
+* Refactor TaskGraphValidator to address SonarCloud issues (#88) ([77c1538](https://github.com/thalesraymond/task-runner/commit/77c1538)), closes [#88](https://github.com/thalesraymond/task-runner/issues/88)
+
+## 3.8.0 (2026-01-21)
+
+* feat: add task priority for concurrency scheduling (#87) ([43bb6b4](https://github.com/thalesraymond/task-runner/commit/43bb6b4)), closes [#87](https://github.com/thalesraymond/task-runner/issues/87) [#74](https://github.com/thalesraymond/task-runner/issues/74)
+* docs: add link to showcase app in README (#85) ([e4c10ca](https://github.com/thalesraymond/task-runner/commit/e4c10ca)), closes [#85](https://github.com/thalesraymond/task-runner/issues/85)
+* docs: add Task Execution Metrics proposal (#86) ([9a9661f](https://github.com/thalesraymond/task-runner/commit/9a9661f)), closes [#86](https://github.com/thalesraymond/task-runner/issues/86)
+* chore: Add guideline for commit prefix 'docs:' ([99635dc](https://github.com/thalesraymond/task-runner/commit/99635dc))
+* chore: Potential fix for code scanning alert no. 1: Workflow does not contain permissions (#78) ([b8fb2b4](https://github.com/thalesraymond/task-runner/commit/b8fb2b4)), closes [#78](https://github.com/thalesraymond/task-runner/issues/78)
+* chore: update package.json description and keywords (#84) ([757b254](https://github.com/thalesraymond/task-runner/commit/757b254)), closes [#84](https://github.com/thalesraymond/task-runner/issues/84)
+* fix:🛡️ Sentinel: Fix Mermaid graph identifier sanitization (#81) ([a8bebe3](https://github.com/thalesraymond/task-runner/commit/a8bebe3)), closes [#81](https://github.com/thalesraymond/task-runner/issues/81)
+
 ## 3.7.0 (2026-01-19)
 
 * Merge pull request #82 from thalesraymond/nexus-feature-state-persistence-17975676824428491411 ([1137981](https://github.com/thalesraymond/task-runner/commit/1137981)), closes [#82](https://github.com/thalesraymond/task-runner/issues/82)

package/README.md

@@ -7,6 +7,8 @@
 
 A lightweight, type-safe, and domain-agnostic task orchestration engine. It resolves a Directed Acyclic Graph (DAG) of steps, executes independent tasks in parallel, and manages a shared context across the pipeline.
 
+Try the [Showcase App](https://task-runner-mu.vercel.app/) to see the runner in action.
+
 ## Features
 
 - **Domain Agnostic**: Separate your business logic ("What") from the execution engine ("How").