@pulsarinteractive/geniustasker 0.1.0-beta.2 → 0.1.0-beta.3

package/docs/TESTING.md

@@ -0,0 +1,52 @@
+# Testing
+
+## Run the quality checks
+
+```sh
+npm ci
+npm run verify
+```
+
+`verify` runs formatting, ESLint, tests, package inventory, public-file checks and
+plugin/schema validation. CI runs the same command on Linux and macOS with Node
+22, followed by a dependency vulnerability audit. It has read-only repository
+permissions and no live service credentials.
+
+## Focused checks
+
+```sh
+npm run format:check
+npm run lint
+node --test test/login.test.mjs
+node --test test/process.test.mjs
+npm run check
+npm audit
+```
+
+`npm run format` applies formatting. The generated command catalog and vendored
+schemas are excluded from formatting so their provenance remains stable.
+
+## What the suites cover
+
+| Suite           | Observable guarantees                                                                                           |
+| --------------- | --------------------------------------------------------------------------------------------------------------- |
+| Login           | Consent URL validation, PKCE state/callback handling, denial, cancellation, device-flow deadlines and slow-down |
+| Client/store    | Private file checks, origin binding, serialized renewal and uncertain-token recovery                            |
+| Commands        | Immutable requests, concurrent writes, identity binding, uncertain receipts and conflicts                       |
+| Profiles        | Grant validation, narrowed selection, revision conflicts and rotation uncertainty                               |
+| Changes         | Cursor validation, bounded waits, cancellation and no blind retries after quota or permission failures          |
+| Process         | Real stdio MCP discovery/calls and coordination between separate OS processes                                   |
+| Public boundary | Rejection of excluded files, credentials, symlinks and escaping imports                                         |
+
+Tests create and clean up their own temporary directories and loopback servers.
+They do not require browser sign-in or real project data. Use meaningful scenario
+names, assert behavior at public boundaries and include the failure that motivates
+a regression test. Avoid sleeps as synchronization when an explicit signal works.
+
+## What local tests do not establish
+
+They do not prove admission to the hosted beta, production availability, browser
+provider compatibility on every device or acceptance by each agent host. Release
+verification separately installs the published archive with a fresh cache,
+compares registry integrity and exercises a deliberately authorized test account.
+Record those checks without publishing account data.

package/examples/codex.toml

@@ -1,3 +1,3 @@
 [mcp_servers.geniustasker]
 command = "npx"
-args = ["-y", "@pulsarinteractive/geniustasker@0.1.0-beta.2", "mcp", "--context", "work"]
+args = ["-y", "@pulsarinteractive/geniustasker@0.1.0-beta.3", "mcp", "--context", "work"]

package/examples/mcp.json

@@ -2,13 +2,7 @@
   "mcpServers": {
     "geniustasker": {
       "command": "npx",
-      "args": [
-        "-y",
-        "@pulsarinteractive/geniustasker@0.1.0-beta.2",
-        "mcp",
-        "--context",
-        "work"
-      ]
+      "args": ["-y", "@pulsarinteractive/geniustasker@0.1.0-beta.3", "mcp", "--context", "work"]
     }
   }
 }

package/mcp.json

@@ -4,13 +4,7 @@
     "geniustasker": {
       "type": "stdio",
       "command": "npx",
-      "args": [
-        "-y",
-        "@pulsarinteractive/geniustasker@0.1.0-beta.2",
-        "mcp",
-        "--context",
-        "work"
-      ]
+      "args": ["-y", "@pulsarinteractive/geniustasker@0.1.0-beta.3", "mcp", "--context", "work"]
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulsarinteractive/geniustasker",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "private": false,
   "description": "GeniusTasker delegated CLI and local agent tools",
   "type": "module",
@@ -21,13 +21,20 @@
     "CONTRIBUTING.md",
     "SECURITY.md",
     "plugin.json",
-    "mcp.json"
+    "mcp.json",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md",
+    "LICENSES/"
   ],
   "scripts": {
     "test": "node --test test/*.test.mjs",
     "check": "node tools/check-package.mjs && node tools/check-public.mjs && node tools/check-plugin.mjs",
-    "prepublishOnly": "npm test && npm run check",
-    "check:public": "node tools/check-public.mjs"
+    "prepublishOnly": "npm run verify",
+    "check:public": "node tools/check-public.mjs",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "lint": "eslint .",
+    "verify": "npm run format:check && npm run lint && npm test && npm run check"
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.1.0",
@@ -35,10 +42,14 @@
     "zod": "4.6.5"
   },
   "devDependencies": {
+    "@eslint/js": "10.0.1",
     "@modelcontextprotocol/client": "2.1.0",
-    "ajv": "8.20.0"
+    "ajv": "8.20.0",
+    "eslint": "10.11.0",
+    "globals": "17.12.0",
+    "prettier": "3.9.9"
   },
-  "license": "UNLICENSED",
+  "license": "MIT",
   "publishConfig": {
     "access": "public",
     "tag": "beta",
@@ -46,11 +57,11 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/alexisnaud/geniustasker-agent-tools.git"
+    "url": "https://github.com/PulsarInteractive/geniustasker-agent-tools.git"
   },
-  "homepage": "https://github.com/alexisnaud/geniustasker-agent-tools#readme",
+  "homepage": "https://github.com/PulsarInteractive/geniustasker-agent-tools#readme",
   "bugs": {
-    "url": "https://github.com/alexisnaud/geniustasker-agent-tools/issues"
+    "url": "https://github.com/PulsarInteractive/geniustasker-agent-tools/issues"
   },
   "keywords": [
     "geniustasker",

package/plugin.json

@@ -1,18 +1,14 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "geniustasker",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "description": "Track project work and independent product memories with your own agents.",
   "author": {
     "name": "Pulsar Interactive"
   },
-  "repository": "https://github.com/alexisnaud/geniustasker-agent-tools",
-  "license": "UNLICENSED",
-  "keywords": [
-    "productivity",
-    "projects",
-    "memory"
-  ],
+  "repository": "https://github.com/PulsarInteractive/geniustasker-agent-tools",
+  "license": "MIT",
+  "keywords": ["productivity", "projects", "memory"],
   "extensions": {
     "com.openai": {
       "interface": {
@@ -20,13 +16,8 @@
         "shortDescription": "Projects, progress and memory for your agents",
         "developerName": "Pulsar Interactive",
         "category": "Productivity",
-        "capabilities": [
-          "Read",
-          "Write"
-        ],
-        "defaultPrompt": [
-          "Use GeniusTasker to review my project progress and next tasks."
-        ]
+        "capabilities": ["Read", "Write"],
+        "defaultPrompt": ["Use GeniusTasker to review my project progress and next tasks."]
       }
     }
   }

package/skills/geniustasker/SKILL.md

@@ -99,8 +99,6 @@ to evade quotas. If the requested capability is unavailable, say what is pending
 and preserve the useful findings. Final progress should identify the actual
 project/ticket and distinguish completed work, validation and remaining work.
 
-
-
 ## Specialized workflows
 
 - To create, switch or restrict an agent identity, read [Profiles](references/profiles.md).

package/skills/geniustasker/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
-  display_name: "GeniusTasker"
-  short_description: "Work on shared projects with your own agents"
-  default_prompt: "Use $geniustasker to review my project and record the next useful step."
+  display_name: 'GeniusTasker'
+  short_description: 'Work on shared projects with your own agents'
+  default_prompt: 'Use $geniustasker to review my project and record the next useful step.'

package/skills/geniustasker/references/collaboration.md

@@ -22,7 +22,6 @@ agent policy. Use `question.close` only for this profile's own question, with it
 current revision. If no answer arrives, record the blocker and proceed only with
 independent authorized work; do not invent approval or repeatedly poll rapidly.
 
-
 ## Leave a useful handoff
 
 Use the discovered `task.report` command with `tasks:write`, an open unarchived
@@ -42,7 +41,6 @@ is not an invitation to recreate its text. Completing/reopening the task clears
 its current work phase and retains the report as history. A report does not grant
 permission or count as approval. Use a question when a human answer is needed.
 
-
 ## Request and consume a precise human decision
 
 Use `approval.request` with `approvals:write` when a concrete action needs a

package/skills/geniustasker-memory/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
-  display_name: "GeniusTasker Memory"
-  short_description: "Navigate and maintain independent product knowledge"
-  default_prompt: "Use $geniustasker-memory to find the relevant product knowledge and update it with verified results."
+  display_name: 'GeniusTasker Memory'
+  short_description: 'Navigate and maintain independent product knowledge'
+  default_prompt: 'Use $geniustasker-memory to find the relevant product knowledge and update it with verified results.'

package/src/changes.mjs

@@ -5,26 +5,73 @@ import { Transport } from './transport.mjs';
 import catalog from './command-catalog.mjs';
 import { fail } from './errors.mjs';
 
-export const changesSchema = z.object({ scope: z.string().max(256).regex(/^(project|memory):[^\u0000-\u001f]+$/u),
-  collection: z.string().min(1).max(32), cursor: z.string().min(1).max(4096) }).strict();
-export const watchSchema = changesSchema.extend({ waitSeconds: z.number().int().min(1).max(catalog.changes.maxWatchSeconds).optional() }).strict();
-const revision = z.string().max(16).regex(/^(0|[1-9][0-9]*)$/).refine(value => BigInt(value) <= 9007199254740991n);
-const changePageSchema = z.object({ scope: z.string(), collection: z.string(), epoch: z.string().min(1), checkpoint: revision,
-  items: z.array(z.discriminatedUnion('kind', [
-    z.object({ kind: z.literal('upsert'), id: z.string().min(1), revision, data: z.record(z.string(), z.unknown()) }).strict(),
-    z.object({ kind: z.literal('remove'), id: z.string().min(1), revision, data: z.null() }).strict(),
-  ])), omittedIds: z.array(z.string().min(1)), nextCursor: z.string().min(1).max(4096), hasMore: z.boolean(),
-  pollAfterSeconds: z.number().int().min(1).max(86400),
-}).strict();
+export const changesSchema = z
+  .object({
+    scope: z
+      .string()
+      .max(256)
+      // eslint-disable-next-line no-control-regex -- Reject control characters in untrusted input.
+      .regex(/^(project|memory):[^\u0000-\u001f]+$/u),
+    collection: z.string().min(1).max(32),
+    cursor: z.string().min(1).max(4096),
+  })
+  .strict();
+export const watchSchema = changesSchema
+  .extend({ waitSeconds: z.number().int().min(1).max(catalog.changes.maxWatchSeconds).optional() })
+  .strict();
+const revision = z
+  .string()
+  .max(16)
+  .regex(/^(0|[1-9][0-9]*)$/)
+  .refine((value) => BigInt(value) <= 9007199254740991n);
+const changePageSchema = z
+  .object({
+    scope: z.string(),
+    collection: z.string(),
+    epoch: z.string().min(1),
+    checkpoint: revision,
+    items: z.array(
+      z.discriminatedUnion('kind', [
+        z
+          .object({
+            kind: z.literal('upsert'),
+            id: z.string().min(1),
+            revision,
+            data: z.record(z.string(), z.unknown()),
+          })
+          .strict(),
+        z
+          .object({ kind: z.literal('remove'), id: z.string().min(1), revision, data: z.null() })
+          .strict(),
+      ]),
+    ),
+    omittedIds: z.array(z.string().min(1)),
+    nextCursor: z.string().min(1).max(4096),
+    hasMore: z.boolean(),
+    pollAfterSeconds: z.number().int().min(1).max(86400),
+  })
+  .strict();
 function query(input, schema) {
   const parsed = schema.safeParse(input);
-  if (!parsed.success) fail('invalid_arguments', 'Use a project or memory scope, collection and unchanged change cursor; waitSeconds must be within the supported bound.');
+  if (!parsed.success) {
+    fail(
+      'invalid_arguments',
+      'Use a project or memory scope, collection and unchanged change cursor; waitSeconds must be within the supported bound.',
+    );
+  }
   return parsed.data;
 }
+/** Validate the entire bounded page before a caller can adopt its next cursor. */
 export async function readChanges(client, input) {
-  const requested = query(input, changesSchema), page = await client.get('changes', requested);
-  if (!changePageSchema.safeParse(page).success || page.scope !== requested.scope || page.collection !== requested.collection)
+  const requested = query(input, changesSchema),
+    page = await client.get('changes', requested);
+  if (
+    !changePageSchema.safeParse(page).success ||
+    page.scope !== requested.scope ||
+    page.collection !== requested.collection
+  ) {
     fail('invalid_response', 'The change page was invalid; keep the previous cursor.');
+  }
   return page;
 }
 /** One bounded wait, not a daemon. Each poll spends the same account budget as
@@ -32,32 +79,61 @@ export async function readChanges(client, input) {
  * quotas, expired history and revocation never trigger a blind retry loop. */
 export async function watchChanges(client, input, requestSignal) {
   const { waitSeconds = 30, ...requested } = query(input, watchSchema);
-  const deadline = new AbortController(), parents = [client.transport.signal, requestSignal].filter(Boolean);
+  const deadline = new AbortController(),
+    parents = [client.transport.signal, requestSignal].filter(Boolean);
   const parent = parents.length ? AbortSignal.any(parents) : undefined;
   const signal = parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal;
   const timer = setTimeout(() => deadline.abort(), waitSeconds * 1000);
-  const bounded = new AgentClient(new Transport(client.transport.origin, {
-    fetchImpl: client.transport.fetch, timeoutMs: client.transport.timeoutMs, signal,
-  }), client.store);
-  let page = null, polls = 0, cursor = requested.cursor;
+  const bounded = new AgentClient(
+    new Transport(client.transport.origin, {
+      fetchImpl: client.transport.fetch,
+      timeoutMs: client.transport.timeoutMs,
+      signal,
+    }),
+    client.store,
+  );
+  let page = null,
+    polls = 0,
+    cursor = requested.cursor;
   const timedOut = () => ({ reason: 'timeout', polls, page, nextCursor: cursor });
   try {
-    if (parent?.aborted) fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
+    if (parent?.aborted) {
+      fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
+    }
     while (!signal.aborted) {
-      page = await readChanges(bounded, { ...requested, cursor }); polls++;
+      page = await readChanges(bounded, { ...requested, cursor });
+      polls++;
       cursor = page.nextCursor;
-      if (page.items.length || page.omittedIds.length || page.hasMore)
+      if (page.items.length || page.omittedIds.length || page.hasMore) {
         return { reason: 'changes', polls, page, nextCursor: cursor };
-      await sleep(Math.max(catalog.changes.pollIntervalSeconds, page.pollAfterSeconds) * 1000, undefined, { signal });
+      }
+      await sleep(
+        Math.max(catalog.changes.pollIntervalSeconds, page.pollAfterSeconds) * 1000,
+        undefined,
+        { signal },
+      );
+    }
+    if (parent?.aborted) {
+      fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
     }
-    if (parent?.aborted) fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
     return timedOut();
   } catch (error) {
-    if (parent?.aborted) fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
-    if (deadline.signal.aborted && (error?.name === 'AbortError' || error?.code === 'network_unavailable')) return timedOut();
+    if (parent?.aborted) {
+      fail('cancelled', 'The wait was cancelled.', { nextCursor: cursor });
+    }
+    if (
+      deadline.signal.aborted &&
+      (error?.name === 'AbortError' || error?.code === 'network_unavailable')
+    ) {
+      return timedOut();
+    }
     // Completed empty polls may advance the cursor. Preserve it on an error,
     // but do not claim that a failed final request was an empty successful read.
-    if (error?.details) error.details.nextCursor = cursor;
+    if (error?.details) {
+      error.details.nextCursor = cursor;
+    }
     throw error;
-  } finally { clearTimeout(timer); }
+  } finally {
+    clearTimeout(timer);
+  }
 }