@rubytech/taskmaster 1.44.3 → 1.44.5

package/dist/agents/tools/message-tool.js

@@ -208,6 +208,12 @@ function filterActionsForContext(params) {
  * never fall through to the global list, which would leak actions from
  * other channels (e.g. Discord "poll" appearing in webchat sessions).
  */
+/**
+ * Channels where the "broadcast" action must never appear in the agent tool schema.
+ * WhatsApp prohibits automated bulk messaging — exposing the action to agents
+ * would encourage policy-violating behaviour.
+ */
+const BROADCAST_EXCLUDED_CHANNELS = new Set(["whatsapp"]);
 function resolveMessageToolActions(options) {
     if (options?.currentChannel) {
         const channelActions = filterActionsForContext({
@@ -220,6 +226,10 @@ function resolveMessageToolActions(options) {
         });
         // Always include "send"; if the channel plugin reports nothing, send is all we need.
         const allActions = new Set(["send", ...channelActions]);
+        // Never expose broadcast on channels that prohibit automated bulk messaging.
+        if (BROADCAST_EXCLUDED_CHANNELS.has(options.currentChannel.toLowerCase())) {
+            allActions.delete("broadcast");
+        }
         return Array.from(allActions);
     }
     if (options?.config) {

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.44.3",
-  "commit": "32d7a0ee09ae38288deb15bad1d3890ccbe39a0d",
-  "builtAt": "2026-03-20T07:51:26.410Z"
+  "version": "1.44.5",
+  "commit": "414cf5a6f0475e90da9e44c9a38af23eb2662ffa",
+  "builtAt": "2026-03-25T13:57:46.756Z"
 }

package/dist/config/schema.js

@@ -138,7 +138,7 @@ const FIELD_LABELS = {
     "tools.message.crossContext.marker.enabled": "Cross-Context Marker",
     "tools.message.crossContext.marker.prefix": "Cross-Context Marker Prefix",
     "tools.message.crossContext.marker.suffix": "Cross-Context Marker Suffix",
-    "tools.message.broadcast.enabled": "Enable Message Broadcast",
+    "tools.message.broadcast.enabled": "Enable Message Broadcast (excludes WhatsApp)",
     "tools.web.search.enabled": "Enable Web Search Tool",
     "tools.web.search.provider": "Web Search Provider",
     "tools.web.search.apiKey": "Brave Search API Key",
@@ -352,7 +352,7 @@ const FIELD_HELP = {
     "tools.message.crossContext.marker.enabled": "Add a visible origin marker when sending cross-context (default: true).",
     "tools.message.crossContext.marker.prefix": 'Text prefix for cross-context markers (supports "{channel}").',
     "tools.message.crossContext.marker.suffix": 'Text suffix for cross-context markers (supports "{channel}").',
-    "tools.message.broadcast.enabled": "Enable broadcast action (default: true).",
+    "tools.message.broadcast.enabled": "Enable broadcast action (default: false). WhatsApp is always excluded — automated broadcasts violate WhatsApp's Terms of Service.",
     "tools.web.search.enabled": "Enable the web_search tool (requires a provider API key).",
     "tools.web.search.provider": 'Search provider ("brave", "perplexity", or "tavily").',
     "tools.web.search.apiKey": "Brave Search API key (fallback: BRAVE_API_KEY env var).",

package/dist/gateway/server.impl.js

@@ -68,9 +68,10 @@ import { loadGatewayTlsRuntime } from "./server/tls.js";
 import { isLoopbackHost } from "./net.js";
 import { createWizardSessionTracker } from "./server-wizard-sessions.js";
 import { attachGatewayWsHandlers } from "./server-ws-runtime.js";
-import { isLicenseValid } from "../license/validate.js";
+import { isLicenseValid, validateLicenseKey } from "../license/validate.js";
 import { setLicensed } from "../license/state.js";
 import { startLicenseRevalidation, stopLicenseRevalidation } from "../license/revalidation.js";
+import { getDeviceId } from "../license/device-id.js";
 export { __resetModelCatalogCacheForTest } from "./server-model-catalog.js";
 ensureTaskmasterCliOnPath();
 const log = createSubsystemLogger("gateway");
@@ -331,7 +332,29 @@ export async function startGatewayServer(port = 18789, opts = {}) {
     // License check — gateway always starts (so setup UI is reachable),
     // but pages other than /setup will redirect until a license is activated.
     const logLicense = log.child("license");
-    const licenseOk = isLicenseValid(cfgAtStart);
+    let licenseOk = isLicenseValid(cfgAtStart);
+    // If stored state is stale but the token is cryptographically valid,
+    // refresh validatedAt so the license doesn't appear expired on restart.
+    if (!licenseOk && cfgAtStart.license?.key) {
+        const deviceId = getDeviceId();
+        const freshCheck = validateLicenseKey(cfgAtStart.license.key, deviceId);
+        if (freshCheck.valid) {
+            logLicense.info("refreshing stale validatedAt — token is still valid");
+            try {
+                const freshCfg = loadConfig();
+                if (freshCfg.license) {
+                    void writeConfigFile({
+                        ...freshCfg,
+                        license: { ...freshCfg.license, validatedAt: new Date().toISOString() },
+                    });
+                }
+            }
+            catch (err) {
+                logLicense.warn(`failed to refresh validatedAt: ${String(err)}`);
+            }
+            licenseOk = true;
+        }
+    }
     setLicensed(licenseOk);
     if (!licenseOk) {
         logLicense.warn("no valid license — setup wizard will require activation");

package/dist/infra/outbound/message-action-runner.js

@@ -350,24 +350,43 @@ function resolveGateway(input) {
         mode: input.gateway.mode,
     };
 }
+/**
+ * Channels where automated broadcast is prohibited by the provider's Terms of Service.
+ * WhatsApp explicitly forbids automated bulk/broadcast messaging — violating this policy
+ * risks permanent number bans and account termination.
+ */
+const BROADCAST_BLOCKED_CHANNELS = new Set(["whatsapp"]);
 async function handleBroadcastAction(input, params) {
     throwIfAborted(input.abortSignal);
-    const broadcastEnabled = input.cfg.tools?.message?.broadcast?.enabled !== false;
+    const broadcastEnabled = input.cfg.tools?.message?.broadcast?.enabled === true;
     if (!broadcastEnabled) {
-        throw new Error("Broadcast is disabled. Set tools.message.broadcast.enabled to true.");
+        throw new Error("Broadcast is disabled. Set tools.message.broadcast.enabled to true in config. " +
+            "Note: WhatsApp is always excluded — automated broadcasts violate WhatsApp's Terms of Service.");
     }
     const rawTargets = readStringArrayParam(params, "targets", { required: true }) ?? [];
     if (rawTargets.length === 0) {
         throw new Error("Broadcast requires at least one target in --targets.");
     }
     const channelHint = readStringParam(params, "channel");
+    // Hard block: reject broadcast requests that explicitly target a blocked channel.
+    if (channelHint) {
+        const normalizedHint = channelHint.trim().toLowerCase();
+        if (normalizedHint !== "all" && BROADCAST_BLOCKED_CHANNELS.has(normalizedHint)) {
+            throw new Error(`Broadcast to ${channelHint} is blocked. Automated broadcast messaging violates ${channelHint}'s Terms of Service and risks permanent account bans.`);
+        }
+    }
     const configured = await listConfiguredMessageChannels(input.cfg);
     if (configured.length === 0) {
         throw new Error("Broadcast requires at least one configured channel.");
     }
-    const targetChannels = channelHint && channelHint.trim().toLowerCase() !== "all"
+    const allTargetChannels = channelHint && channelHint.trim().toLowerCase() !== "all"
         ? [await resolveChannel(input.cfg, { channel: channelHint })]
         : configured;
+    // Silently exclude blocked channels from broadcast fan-out.
+    const targetChannels = allTargetChannels.filter((ch) => !BROADCAST_BLOCKED_CHANNELS.has(ch));
+    if (targetChannels.length === 0) {
+        throw new Error("No eligible channels for broadcast. WhatsApp is excluded — automated broadcasts violate WhatsApp's Terms of Service.");
+    }
     const results = [];
     const isAbortError = (err) => err instanceof Error && err.name === "AbortError";
     for (const targetChannel of targetChannels) {

package/dist/license/revalidation.js

@@ -15,6 +15,22 @@ function revalidate(log, onChange) {
     const result = validateLicenseKey(lic.key, deviceId);
     if (result.valid) {
         log.info("license still valid");
+        // Refresh validatedAt so the 30-day staleness window doesn't expire
+        try {
+            const freshConfig = loadConfig();
+            if (freshConfig.license) {
+                void writeConfigFile({
+                    ...freshConfig,
+                    license: {
+                        ...freshConfig.license,
+                        validatedAt: new Date().toISOString(),
+                    },
+                });
+            }
+        }
+        catch (err) {
+            log.warn(`failed to refresh validatedAt: ${String(err)}`);
+        }
         return;
     }
     // Token is no longer valid (expired, wrong device, bad signature)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/taskmaster",
-  "version": "1.44.3",
+  "version": "1.44.5",
   "description": "AI-powered business assistant for small businesses",
   "publishConfig": {
     "access": "public"