@rubytech/taskmaster 1.0.106 → 1.0.108

package/dist/agents/skills-status.js

@@ -1,6 +1,7 @@
+import fs from "node:fs";
 import path from "node:path";
 import { CONFIG_DIR } from "../utils.js";
-import { hasBinary, isBundledSkillAllowed, isConfigPathTruthy, loadWorkspaceSkillEntries, resolveBundledAllowlist, resolveConfigPath, resolveSkillConfig, resolveSkillsInstallPreferences, } from "./skills.js";
+import { hasBinary, isBundledSkillAllowed, isConfigPathTruthy, loadWorkspaceSkillEntries, resolveBundledAllowlist, resolveBundledSkillsDir, resolveConfigPath, resolveSkillConfig, resolveSkillsInstallPreferences, } from "./skills.js";
 function resolveSkillKey(entry) {
     return entry.taskmaster?.skillKey ?? entry.skill.name;
 }
@@ -76,7 +77,7 @@ function normalizeInstallOptions(entry, prefs) {
         return [];
     return [toOption(preferred.spec, preferred.index)];
 }
-function buildSkillStatus(entry, config, prefs, eligibility) {
+function buildSkillStatus(entry, config, prefs, eligibility, bundledSkillNames) {
     const skillKey = resolveSkillKey(entry);
     const skillConfig = resolveSkillConfig(config, skillKey);
     const disabled = skillConfig?.enabled === false;
@@ -145,6 +146,9 @@ function buildSkillStatus(entry, config, prefs, eligibility) {
                 missing.env.length === 0 &&
                 missing.config.length === 0 &&
                 missing.os.length === 0));
+    const preloaded = bundledSkillNames
+        ? bundledSkillNames.has(entry.skill.name)
+        : false;
     return {
         name: entry.skill.name,
         description: entry.skill.description,
@@ -159,6 +163,7 @@ function buildSkillStatus(entry, config, prefs, eligibility) {
         disabled,
         blockedByAllowlist,
         eligible,
+        preloaded,
         requirements: {
             bins: requiredBins,
             anyBins: requiredAnyBins,
@@ -171,13 +176,28 @@ function buildSkillStatus(entry, config, prefs, eligibility) {
         install: normalizeInstallOptions(entry, prefs ?? resolveSkillsInstallPreferences(config)),
     };
 }
+function resolveBundledSkillNames() {
+    const dir = resolveBundledSkillsDir();
+    if (!dir)
+        return new Set();
+    try {
+        return new Set(fs
+            .readdirSync(dir, { withFileTypes: true })
+            .filter((d) => d.isDirectory())
+            .map((d) => d.name));
+    }
+    catch {
+        return new Set();
+    }
+}
 export function buildWorkspaceSkillStatus(workspaceDir, opts) {
     const managedSkillsDir = opts?.managedSkillsDir ?? path.join(CONFIG_DIR, "skills");
     const skillEntries = opts?.entries ?? loadWorkspaceSkillEntries(workspaceDir, opts);
     const prefs = resolveSkillsInstallPreferences(opts?.config);
+    const bundledSkillNames = resolveBundledSkillNames();
     return {
         workspaceDir,
         managedSkillsDir,
-        skills: skillEntries.map((entry) => buildSkillStatus(entry, opts?.config, prefs, opts?.eligibility)),
+        skills: skillEntries.map((entry) => buildSkillStatus(entry, opts?.config, prefs, opts?.eligibility, bundledSkillNames)),
     };
 }

package/dist/agents/skills.js

@@ -1,5 +1,6 @@
 export { hasBinary, isBundledSkillAllowed, isConfigPathTruthy, resolveBundledAllowlist, resolveConfigPath, resolveRuntimePlatform, resolveSkillConfig, } from "./skills/config.js";
 export { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot, } from "./skills/env-overrides.js";
+export { resolveBundledSkillsDir } from "./skills/bundled-dir.js";
 export { buildWorkspaceSkillSnapshot, buildWorkspaceSkillsPrompt, buildWorkspaceSkillCommandSpecs, filterWorkspaceSkillEntries, loadWorkspaceSkillEntries, resolveSkillsPromptForRun, syncSkillsToWorkspace, } from "./skills/workspace.js";
 export function resolveSkillsInstallPreferences(config) {
     const raw = config?.skills?.install;

package/dist/agents/system-prompt.js

@@ -91,6 +91,7 @@ function buildMessagingSection(params) {
                 "- For `action=send`, include `to` and `message`.",
                 `- If multiple channels are configured, pass \`channel\` (${params.messageChannelOptions}).`,
                 `- If you use \`message\` (\`action=send\`) to deliver your user-visible reply, respond with ONLY: ${SILENT_REPLY_TOKEN} (avoid duplicate replies).`,
+                "- CRITICAL: Your text output stays in this session — it does NOT reach end users on WhatsApp, iMessage, or other channels. The `message` tool is the ONLY way to deliver a message to someone outside this session. Never claim you sent a message unless the `message` tool returned a confirmed result.",
                 params.inlineButtonsEnabled
                     ? "- Inline buttons supported. Use `action=send` with `buttons=[[{text,callback_data}]]` (callback_data routes back as a user message)."
                     : params.runtimeChannel
@@ -148,6 +149,7 @@ export function buildAgentSystemPrompt(params) {
         cron: "Manage scheduled events and wake events (use for reminders; when scheduling a reminder, write the systemEvent text as something that will read like a reminder when it fires, and mention that it is a reminder depending on the time gap between setting and firing; include recent context in reminder text if appropriate)",
         message: "Send messages and channel actions",
         gateway: "Restart, apply config, or run updates on the running Taskmaster process",
+        software_update: "Check for software updates, install them, or restart the gateway",
         agents_list: "List agent ids allowed for sessions_spawn",
         sessions_list: "List other sessions (incl. sub-agents) with filters/last",
         sessions_history: "Fetch history for another session/sub-agent",
@@ -176,6 +178,7 @@ export function buildAgentSystemPrompt(params) {
         "cron",
         "message",
         "gateway",
+        "software_update",
         "agents_list",
         "sessions_list",
         "sessions_history",

package/dist/agents/taskmaster-tools.js

@@ -28,6 +28,7 @@ import { createRelayMessageTool } from "./tools/relay-message-tool.js";
 import { createSkillReadTool } from "./tools/skill-read-tool.js";
 import { createApiKeysTool } from "./tools/apikeys-tool.js";
 import { createImageGenerateTool } from "./tools/image-generate-tool.js";
+import { createSoftwareUpdateTool } from "./tools/software-update-tool.js";
 export function createTaskmasterTools(options) {
     const imageTool = options?.agentDir?.trim()
         ? createImageTool({
@@ -86,6 +87,10 @@ export function createTaskmasterTools(options) {
             agentSessionKey: options?.agentSessionKey,
             config: options?.config,
         }),
+        createSoftwareUpdateTool({
+            agentSessionKey: options?.agentSessionKey,
+            config: options?.config,
+        }),
         createAgentsListTool({
             agentSessionKey: options?.agentSessionKey,
             requesterAgentIdOverride: options?.requesterAgentIdOverride,

package/dist/agents/tool-policy.js

@@ -31,7 +31,7 @@ export const TOOL_GROUPS = {
     // UI helpers
     "group:ui": ["browser", "canvas"],
     // Automation + infra
-    "group:automation": ["cron", "gateway", "api_keys"],
+    "group:automation": ["cron", "gateway", "api_keys", "software_update"],
     // Messaging surface
     "group:messaging": ["message"],
     // Nodes + device tools
@@ -61,6 +61,7 @@ export const TOOL_GROUPS = {
         "web_fetch",
         "image",
         "image_generate",
+        "software_update",
         "current_time",
         "authorize_admin",
         "revoke_admin",

package/dist/agents/tools/authorize-admin-tool.js

@@ -7,7 +7,7 @@ import { jsonResult } from "./common.js";
  * Strips spaces, dashes, parens. Ensures leading +.
  */
 function normalizePhoneNumber(input) {
-    const digits = input.replace(/[\s\-\(\)]/g, "");
+    const digits = input.replace(/[\s\-()]/g, "");
     if (digits.startsWith("+"))
         return digits;
     return `+${digits}`;

package/dist/agents/tools/memory-tool.js

@@ -144,7 +144,8 @@ export function createMemoryWriteTool(options) {
         label: "Memory Write",
         name: "memory_write",
         description: "Write or append content to a file in the memory/ directory. " +
-            "Path must be within the session's allowed scope (e.g., memory/users/{phone}/). " +
+            "Path must be within the session's allowed scope. " +
+            "Phone numbers in paths MUST include the + prefix (e.g., memory/users/+447734875155/profile.md). " +
             "Creates parent directories if needed. Use mode='append' to add to existing content.",
         parameters: MemoryWriteSchema,
         execute: async (_toolCallId, params) => {

package/dist/agents/tools/software-update-tool.js

@@ -0,0 +1,114 @@
+import { Type } from "@sinclair/typebox";
+import { loadConfig } from "../../config/io.js";
+import { resolveStorePath, loadSessionStore } from "../../config/sessions.js";
+import { scheduleGatewaySigusr1Restart } from "../../infra/restart.js";
+import { formatDoctorNonInteractiveHint, writeRestartSentinel, } from "../../infra/restart-sentinel.js";
+import { stringEnum } from "../schema/typebox.js";
+import { jsonResult, readStringParam } from "./common.js";
+import { callGatewayTool } from "./gateway.js";
+const SOFTWARE_UPDATE_ACTIONS = ["check", "run", "restart"];
+const SoftwareUpdateToolSchema = Type.Object({
+    action: stringEnum(SOFTWARE_UPDATE_ACTIONS),
+    // restart
+    reason: Type.Optional(Type.String()),
+    // run
+    note: Type.Optional(Type.String()),
+    sessionKey: Type.Optional(Type.String()),
+});
+/**
+ * Narrowly scoped tool for software updates and gateway restarts.
+ * Unlike the full `gateway` tool, this exposes NO config mutation —
+ * only version checking, update execution, and restart.
+ */
+export function createSoftwareUpdateTool(opts) {
+    return {
+        label: "Software Update",
+        name: "software_update",
+        description: "Check for software updates, install them, or restart the gateway. " +
+            "Use 'check' to see if an update is available, 'run' to install it, " +
+            "or 'restart' to restart the gateway process.",
+        parameters: SoftwareUpdateToolSchema,
+        execute: async (_toolCallId, args) => {
+            const params = args;
+            const action = readStringParam(params, "action", { required: true });
+            if (action === "check") {
+                const result = await callGatewayTool("update.status", {}, {});
+                return jsonResult({ ok: true, result });
+            }
+            if (action === "run") {
+                const sessionKey = typeof params.sessionKey === "string" && params.sessionKey.trim()
+                    ? params.sessionKey.trim()
+                    : opts?.agentSessionKey?.trim() || undefined;
+                const note = typeof params.note === "string" && params.note.trim() ? params.note.trim() : undefined;
+                const result = await callGatewayTool("update.run", {}, {
+                    sessionKey,
+                    note,
+                });
+                return jsonResult({ ok: true, result });
+            }
+            if (action === "restart") {
+                if (opts?.config?.commands?.restart !== true) {
+                    throw new Error("Gateway restart is disabled. Set commands.restart=true to enable.");
+                }
+                const sessionKey = typeof params.sessionKey === "string" && params.sessionKey.trim()
+                    ? params.sessionKey.trim()
+                    : opts?.agentSessionKey?.trim() || undefined;
+                const reason = typeof params.reason === "string" && params.reason.trim()
+                    ? params.reason.trim().slice(0, 200)
+                    : undefined;
+                // Resolve delivery context for routing after restart
+                let deliveryContext;
+                let threadId;
+                if (sessionKey) {
+                    const threadMarker = ":thread:";
+                    const threadIndex = sessionKey.lastIndexOf(threadMarker);
+                    const baseSessionKey = threadIndex === -1 ? sessionKey : sessionKey.slice(0, threadIndex);
+                    const threadIdRaw = threadIndex === -1 ? undefined : sessionKey.slice(threadIndex + threadMarker.length);
+                    threadId = threadIdRaw?.trim() || undefined;
+                    try {
+                        const cfg = loadConfig();
+                        const storePath = resolveStorePath(cfg.session?.store);
+                        const store = loadSessionStore(storePath);
+                        let entry = store[sessionKey];
+                        if (!entry?.deliveryContext && threadIndex !== -1 && baseSessionKey) {
+                            entry = store[baseSessionKey];
+                        }
+                        if (entry?.deliveryContext) {
+                            deliveryContext = {
+                                channel: entry.deliveryContext.channel,
+                                to: entry.deliveryContext.to,
+                                accountId: entry.deliveryContext.accountId,
+                            };
+                        }
+                    }
+                    catch {
+                        // best-effort
+                    }
+                }
+                const payload = {
+                    kind: "restart",
+                    status: "ok",
+                    ts: Date.now(),
+                    sessionKey,
+                    deliveryContext,
+                    threadId,
+                    message: reason ?? null,
+                    doctorHint: formatDoctorNonInteractiveHint(),
+                    stats: {
+                        mode: "gateway.restart",
+                        reason,
+                    },
+                };
+                try {
+                    await writeRestartSentinel(payload);
+                }
+                catch {
+                    // sentinel is best-effort
+                }
+                const scheduled = scheduleGatewaySigusr1Restart({ reason });
+                return jsonResult(scheduled);
+            }
+            throw new Error(`Unknown action: ${action}`);
+        },
+    };
+}

package/dist/auto-reply/reply/commands-status.js

@@ -7,7 +7,6 @@ import { getCustomProviderApiKey, resolveEnvApiKey } from "../../agents/model-au
 import { resolveDefaultModelForAgent } from "../../agents/model-selection.js";
 import { resolveInternalSessionKey, resolveMainSessionAlias, } from "../../agents/tools/sessions-helpers.js";
 import { normalizeProviderId } from "../../agents/model-selection.js";
-import { loadConfig } from "../../config/config.js";
 import { logVerbose } from "../../globals.js";
 import { formatUsageWindowSummary, loadProviderUsageSummary, resolveUsageProviderId, } from "../../infra/provider-usage.js";
 import { normalizeGroupActivation } from "../group-activation.js";
@@ -74,21 +73,18 @@ export async function buildStatusReply(params) {
         logVerbose(`Ignoring /status from unauthorized sender: ${command.senderId || "<unknown>"}`);
         return undefined;
     }
-    // Resolve model directly from config — fresh read, not from the passed-in cfg.
-    // Config is the single source of truth. No passed objects, no cache.
-    const freshCfg = loadConfig();
     const statusAgentId = sessionKey
-        ? resolveSessionAgentId({ sessionKey, config: freshCfg })
-        : resolveDefaultAgentId(freshCfg);
-    const configModel = resolveDefaultModelForAgent({ cfg: freshCfg, agentId: statusAgentId });
+        ? resolveSessionAgentId({ sessionKey, config: cfg })
+        : resolveDefaultAgentId(cfg);
+    const configModel = resolveDefaultModelForAgent({ cfg, agentId: statusAgentId });
     const provider = configModel.provider;
     const model = configModel.model;
-    const contextTokens = freshCfg.agents?.defaults?.contextTokens ??
+    const contextTokens = cfg.agents?.defaults?.contextTokens ??
         lookupContextTokens(model) ??
         DEFAULT_CONTEXT_TOKENS;
     // Diagnostic: log what status is resolving so we can trace mismatches
     console.log(`[status-resolve] agentId=${statusAgentId} sessionKey=${sessionKey} model=${provider}/${model}` +
-        ` agentList=${(freshCfg.agents?.list ?? []).map((a) => `${a.id}:${a.model ?? "default"}`).join(",")}`);
+        ` agentList=${(cfg.agents?.list ?? []).map((a) => `${a.id}:${typeof a.model === "string" ? a.model : (a.model?.primary ?? "default")}`).join(",")}`);
     const statusAgentDir = resolveAgentDir(cfg, statusAgentId);
     const currentUsageProvider = (() => {
         try {

package/dist/auto-reply/reply/get-reply-run.js

@@ -23,7 +23,7 @@ import { ensureSkillSnapshot, prependSystemEvents } from "./session-updates.js";
 import { resolveTypingMode } from "./typing-mode.js";
 const BARE_SESSION_RESET_PROMPT = "A new session was started via /new or /reset. Say hi briefly (1-2 sentences) and ask what the user wants to do next. If the runtime model differs from default_model in the system prompt, mention the default model in the greeting. Do not mention internal steps, files, tools, or reasoning.";
 export async function runPreparedReply(params) {
-    const { ctx, sessionCtx, cfg, agentId, agentDir, agentCfg, sessionCfg, commandAuthorized, command, commandSource, allowTextCommands, directives, defaultActivation, elevatedEnabled, elevatedAllowed, blockStreamingEnabled, blockReplyChunking, resolvedBlockStreamingBreak, modelState, perMessageQueueMode, perMessageQueueOptions, typing, opts, defaultProvider, defaultModel, timeoutMs, isNewSession, resetTriggered, systemSent, sessionKey, sessionId, storePath, workspaceDir, sessionStore, } = params;
+    const { ctx, sessionCtx, cfg, agentId: _agentId, agentDir, agentCfg, sessionCfg, commandAuthorized, command, commandSource, allowTextCommands, directives, defaultActivation, elevatedEnabled, elevatedAllowed, blockStreamingEnabled, blockReplyChunking, resolvedBlockStreamingBreak, modelState, perMessageQueueMode, perMessageQueueOptions, typing, opts, defaultProvider, defaultModel, timeoutMs, isNewSession, resetTriggered, systemSent, sessionKey, sessionId, storePath, workspaceDir, sessionStore, } = params;
     // Model comes from config. Two params: config + agentId. Read fresh every time.
     const llmCfg = loadConfig();
     const llmAgentId = resolveSessionAgentId({ sessionKey, config: llmCfg });

package/dist/auto-reply/reply/get-reply.js

@@ -36,7 +36,7 @@ export async function getReplyFromConfig(ctx, opts, configOverride) {
     let model = defaultModel;
     // Diagnostic: log agent/model resolution for every message so we can trace mismatches
     console.log(`[model-resolve] agentId=${agentId} sessionKey=${agentSessionKey} model=${provider}/${model}` +
-        ` agentList=${(cfg.agents?.list ?? []).map((a) => `${a.id}:${a.model ?? "default"}`).join(",")}`);
+        ` agentList=${(cfg.agents?.list ?? []).map((a) => `${a.id}:${typeof a.model === "string" ? a.model : (a.model?.primary ?? "default")}`).join(",")}`);
     if (opts?.isHeartbeat) {
         const heartbeatRaw = agentCfg?.heartbeat?.model?.trim() ?? "";
         const heartbeatRef = heartbeatRaw

package/dist/auto-reply/reply/model-selection.js

@@ -124,7 +124,7 @@ function scoreFuzzyMatch(params) {
     };
 }
 export async function createModelSelectionState(params) {
-    const { cfg, agentCfg, sessionEntry, sessionStore, sessionKey, parentSessionKey, storePath, defaultProvider, defaultModel, } = params;
+    const { cfg, agentCfg, sessionEntry, sessionStore, sessionKey, parentSessionKey: _parentSessionKey, storePath, defaultProvider, defaultModel, } = params;
     // Model always comes from config (per-agent or global default).
     // No session-level model overrides — the config is the single source of truth,
     // applied to all conversations for the agent from that point forward.

package/dist/browser/routes/screencast.js

@@ -99,7 +99,7 @@ export function registerBrowserScreencastRoutes(app, ctx) {
             res.json({ ok: true, sessionId: session.id, label });
         }
         catch (err) {
-            log.error(`screencast start failed: ${err}`);
+            log.error(`screencast start failed: ${String(err)}`);
             jsonError(res, 500, String(err));
         }
     });

package/dist/browser/screencast.js

@@ -108,7 +108,7 @@ export async function startScreencast(opts) {
         send("Page.stopScreencast").catch(() => { });
         pollInterval = setInterval(pollOnce, POLL_INTERVAL_MS);
         // Fire one immediately so the UI gets a frame right away
-        pollOnce();
+        void pollOnce();
     };
     ws.on("message", (raw) => {
         try {

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.106",
-  "commit": "6c7e43fa0df93753260cac243239df6d5d8fc554",
-  "builtAt": "2026-02-23T08:24:09.270Z"
+  "version": "1.0.108",
+  "commit": "efdfa6024c29f8a32d86ed0fd3b3b7a56410e868",
+  "builtAt": "2026-02-23T14:27:19.021Z"
 }

package/dist/commands/agent.js

@@ -191,7 +191,7 @@ export async function agentCommand(opts, runtime = defaultRuntime, deps = create
         // Model always comes from config (per-agent or global default).
         // No session-level model overrides.
         const hasAllowlist = !!(agentCfg?.models && Object.keys(agentCfg.models).length > 0);
-        let allowedModelKeys = new Set();
+        let _allowedModelKeys = new Set();
         let allowedModelCatalog = [];
         let modelCatalog = null;
         if (hasAllowlist) {
@@ -202,7 +202,7 @@ export async function agentCommand(opts, runtime = defaultRuntime, deps = create
                 defaultProvider,
                 defaultModel,
             });
-            allowedModelKeys = allowed.allowedKeys;
+            _allowedModelKeys = allowed.allowedKeys;
             allowedModelCatalog = allowed.allowedCatalog;
         }
         if (sessionEntry) {

package/dist/config/zod-schema.js

@@ -538,7 +538,18 @@ export const TaskmasterSchema = z
         .strict()
         .optional(),
     workspaces: z
-        .record(z.string(), z.object({ displayName: z.string().optional() }).strict())
+        .record(z.string(), z
+        .object({
+        displayName: z.string().optional(),
+        brand: z
+            .object({
+            accentColor: HexColorSchema.optional(),
+            backgroundColor: HexColorSchema.optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict())
         .optional(),
     apiKeys: z.record(z.string(), z.string()).optional(),
     access: z