@rubytech/taskmaster 1.44.4 → 1.44.6

package/dist/agents/pi-embedded-subscribe.handlers.tools.js

@@ -166,7 +166,10 @@ export function handleToolExecutionEnd(ctx, evt) {
             isError: isToolError,
         },
     });
-    ctx.log.debug(`embedded run tool end: runId=${ctx.params.runId} tool=${toolName} toolCallId=${toolCallId}`);
+    const errorSuffix = isToolError
+        ? ` error=${extractToolErrorMessage(sanitizedResult) ?? "unknown"}`
+        : "";
+    ctx.log.debug(`embedded run tool end: runId=${ctx.params.runId} tool=${toolName} toolCallId=${toolCallId} isError=${isToolError}${errorSuffix}`);
     if (ctx.params.onToolResult && ctx.shouldEmitToolOutput()) {
         const outputText = extractToolResultText(sanitizedResult);
         if (outputText) {

package/dist/agents/pi-tools.js

@@ -11,7 +11,7 @@ import { assertRequiredParams, CLAUDE_PARAM_GROUPS, createTaskmasterReadTool, cr
 import { cleanToolSchemaForGemini, normalizeToolParameters } from "./pi-tools.schema.js";
 import { buildPluginToolGroups, collectExplicitAllowlist, expandPolicyWithPluginGroups, normalizeToolName, resolveToolProfilePolicy, stripPluginOnlyAllowlist, } from "./tool-policy.js";
 import { getPluginToolMeta } from "../plugins/tools.js";
-import { logWarn } from "../logger.js";
+import { logInfo, logWarn } from "../logger.js";
 function isOpenAIProvider(provider) {
     const normalized = provider?.trim().toLowerCase();
     return normalized === "openai" || normalized === "openai-codex";
@@ -254,33 +254,49 @@ export function createTaskmasterCodingTools(options) {
     const groupPolicyExpanded = resolvePolicy(groupPolicy, "group tools.allow");
     const sandboxPolicyExpanded = expandPolicyWithPluginGroups(sandbox?.tools, pluginGroups);
     const subagentPolicyExpanded = expandPolicyWithPluginGroups(subagentPolicy, pluginGroups);
-    const toolsFiltered = profilePolicyExpanded
-        ? filterToolsByPolicy(tools, profilePolicyExpanded)
-        : tools;
-    const providerProfileFiltered = providerProfileExpanded
-        ? filterToolsByPolicy(toolsFiltered, providerProfileExpanded)
-        : toolsFiltered;
-    const globalFiltered = globalPolicyExpanded
-        ? filterToolsByPolicy(providerProfileFiltered, globalPolicyExpanded)
-        : providerProfileFiltered;
-    const globalProviderFiltered = globalProviderExpanded
-        ? filterToolsByPolicy(globalFiltered, globalProviderExpanded)
-        : globalFiltered;
-    const agentFiltered = agentPolicyExpanded
-        ? filterToolsByPolicy(globalProviderFiltered, agentPolicyExpanded)
-        : globalProviderFiltered;
-    const agentProviderFiltered = agentProviderExpanded
-        ? filterToolsByPolicy(agentFiltered, agentProviderExpanded)
-        : agentFiltered;
-    const groupFiltered = groupPolicyExpanded
-        ? filterToolsByPolicy(agentProviderFiltered, groupPolicyExpanded)
-        : agentProviderFiltered;
-    const sandboxed = sandboxPolicyExpanded
-        ? filterToolsByPolicy(groupFiltered, sandboxPolicyExpanded)
-        : groupFiltered;
-    const subagentFiltered = subagentPolicyExpanded
-        ? filterToolsByPolicy(sandboxed, subagentPolicyExpanded)
-        : sandboxed;
+    // ── Cascading tool filter with diagnostic logging ─────────────────────
+    const filterStage = (input, policy, label) => {
+        if (!policy)
+            return input;
+        const output = filterToolsByPolicy(input, policy);
+        const inputNames = new Set(input.map((t) => normalizeToolName(t.name)));
+        const outputNames = new Set(output.map((t) => normalizeToolName(t.name)));
+        const removed = [...inputNames].filter((n) => !outputNames.has(n));
+        if (removed.length > 0) {
+            const sessionLabel = options?.sessionKey ?? "unknown-session";
+            logInfo(`[tool-filter] ${sessionLabel} | ${label} removed ${removed.length} tools: ${removed.join(", ")}`);
+        }
+        return output;
+    };
+    // When the agent has an explicit allow list, merge it with the profile's
+    // allow list so the agent can grant tools beyond the profile baseline.
+    // The profile sets a default scope; the agent config can expand it.
+    // Deny lists and PROFILE_NEVER_GRANT still restrict regardless.
+    const effectiveProfilePolicy = (() => {
+        if (!profilePolicyExpanded || !agentPolicyExpanded?.allow?.length) {
+            return profilePolicyExpanded;
+        }
+        const mergedAllow = [
+            ...(profilePolicyExpanded.allow ?? []),
+            ...(agentPolicyExpanded.allow ?? []),
+        ];
+        return { ...profilePolicyExpanded, allow: mergedAllow };
+    })();
+    const toolsFiltered = filterStage(tools, effectiveProfilePolicy, `profile(${effectiveProfile ?? "none"})+agent`);
+    const providerProfileFiltered = filterStage(toolsFiltered, providerProfileExpanded, "providerProfile");
+    const globalFiltered = filterStage(providerProfileFiltered, globalPolicyExpanded, "global");
+    const globalProviderFiltered = filterStage(globalFiltered, globalProviderExpanded, "globalProvider");
+    const agentFiltered = filterStage(globalProviderFiltered, agentPolicyExpanded, `agent(${agentId ?? "?"})`);
+    const agentProviderFiltered = filterStage(agentFiltered, agentProviderExpanded, "agentProvider");
+    const groupFiltered = filterStage(agentProviderFiltered, groupPolicyExpanded, "group");
+    const sandboxed = filterStage(groupFiltered, sandboxPolicyExpanded, "sandbox");
+    const subagentFiltered = filterStage(sandboxed, subagentPolicyExpanded, "subagent");
+    // Log final tool set for observability.
+    {
+        const sessionLabel = options?.sessionKey ?? "unknown-session";
+        const finalNames = subagentFiltered.map((t) => normalizeToolName(t.name)).sort();
+        logInfo(`[tool-filter] ${sessionLabel} | profile=${effectiveProfile ?? "none"} | final tools (${finalNames.length}): ${finalNames.join(", ")}`);
+    }
     // Always normalize tool JSON Schemas before handing them to pi-agent/pi-ai.
     // Without this, some providers (notably OpenAI) will reject root-level union schemas.
     const normalized = subagentFiltered.map(normalizeToolParameters);

package/dist/agents/system-prompt.js

@@ -343,7 +343,7 @@ export function buildAgentSystemPrompt(params) {
         "- `spawn:documents` — read and produce documents: PDFs, spreadsheets, QR codes",
         "- `spawn:contacts` — manage contacts: lookup, create, update, verify",
         "- `spawn:web` — research online: web search, URL fetch, file access",
-        "- `spawn:admin` — system administration and diagnostics: manage admins, status checks, settings, log review, error triage, performance analysis, automation",
+        "- `spawn:admin` — system administration, licensing, and diagnostics: manage admins, generate licenses, status checks, settings, log review, error triage, performance analysis, automation",
         "- `spawn:automation` — scheduled tasks: cron jobs, gateway management, updates, tunnel",
         "- `spawn:ui` — visual work: browser control, canvas",
         "- `spawn:worker` — general-purpose (files, memory, web, docs, images, skills)",

package/dist/agents/tool-policy.js

@@ -68,6 +68,7 @@ export const TOOL_GROUPS = {
         "account_manage",
         "access_manage",
         "license_manage",
+        "license_generate",
     ],
     // All Taskmaster native tools (excludes provider plugins).
     "group:taskmaster": [
@@ -123,6 +124,7 @@ export const TOOL_GROUPS = {
         "account_manage",
         "access_manage",
         "license_manage",
+        "license_generate",
         "tunnel_status",
         "tunnel_enable",
         "tunnel_disable",

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.44.4",
-  "commit": "b8d7b214abfbb7854ac8d717f1d474cda32f8bf2",
-  "builtAt": "2026-03-22T15:16:51.871Z"
+  "version": "1.44.6",
+  "commit": "31dc9e5ff41b22999649e64f27616ee768700bba",
+  "builtAt": "2026-03-26T15:26:35.627Z"
 }

package/dist/gateway/server.impl.js

@@ -68,9 +68,10 @@ import { loadGatewayTlsRuntime } from "./server/tls.js";
 import { isLoopbackHost } from "./net.js";
 import { createWizardSessionTracker } from "./server-wizard-sessions.js";
 import { attachGatewayWsHandlers } from "./server-ws-runtime.js";
-import { isLicenseValid } from "../license/validate.js";
+import { isLicenseValid, validateLicenseKey } from "../license/validate.js";
 import { setLicensed } from "../license/state.js";
 import { startLicenseRevalidation, stopLicenseRevalidation } from "../license/revalidation.js";
+import { getDeviceId } from "../license/device-id.js";
 export { __resetModelCatalogCacheForTest } from "./server-model-catalog.js";
 ensureTaskmasterCliOnPath();
 const log = createSubsystemLogger("gateway");
@@ -331,7 +332,29 @@ export async function startGatewayServer(port = 18789, opts = {}) {
     // License check — gateway always starts (so setup UI is reachable),
     // but pages other than /setup will redirect until a license is activated.
     const logLicense = log.child("license");
-    const licenseOk = isLicenseValid(cfgAtStart);
+    let licenseOk = isLicenseValid(cfgAtStart);
+    // If stored state is stale but the token is cryptographically valid,
+    // refresh validatedAt so the license doesn't appear expired on restart.
+    if (!licenseOk && cfgAtStart.license?.key) {
+        const deviceId = getDeviceId();
+        const freshCheck = validateLicenseKey(cfgAtStart.license.key, deviceId);
+        if (freshCheck.valid) {
+            logLicense.info("refreshing stale validatedAt — token is still valid");
+            try {
+                const freshCfg = loadConfig();
+                if (freshCfg.license) {
+                    void writeConfigFile({
+                        ...freshCfg,
+                        license: { ...freshCfg.license, validatedAt: new Date().toISOString() },
+                    });
+                }
+            }
+            catch (err) {
+                logLicense.warn(`failed to refresh validatedAt: ${String(err)}`);
+            }
+            licenseOk = true;
+        }
+    }
     setLicensed(licenseOk);
     if (!licenseOk) {
         logLicense.warn("no valid license — setup wizard will require activation");

package/dist/license/revalidation.js

@@ -15,6 +15,22 @@ function revalidate(log, onChange) {
     const result = validateLicenseKey(lic.key, deviceId);
     if (result.valid) {
         log.info("license still valid");
+        // Refresh validatedAt so the 30-day staleness window doesn't expire
+        try {
+            const freshConfig = loadConfig();
+            if (freshConfig.license) {
+                void writeConfigFile({
+                    ...freshConfig,
+                    license: {
+                        ...freshConfig.license,
+                        validatedAt: new Date().toISOString(),
+                    },
+                });
+            }
+        }
+        catch (err) {
+            log.warn(`failed to refresh validatedAt: ${String(err)}`);
+        }
         return;
     }
     // Token is no longer valid (expired, wrong device, bad signature)

package/extensions/.npmignore

@@ -0,0 +1 @@
+node_modules/

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/taskmaster",
-  "version": "1.44.4",
+  "version": "1.44.6",
   "description": "AI-powered business assistant for small businesses",
   "publishConfig": {
     "access": "public"
@@ -79,64 +79,12 @@
     "dist/license/**",
     "dist/suggestions/**"
   ],
-  "scripts": {
-    "dev": "node scripts/run-node.mjs",
-    "postinstall": "node scripts/postinstall.js",
-    "prepack": "pnpm build && pnpm ui:build",
-    "docs:list": "node scripts/docs-list.js",
-    "docs:bin": "node scripts/build-docs-list.mjs",
-    "build": "tsc -p tsconfig.json && node --import tsx scripts/canvas-a2ui-copy.ts && node --import tsx scripts/copy-hook-metadata.ts && node --import tsx scripts/write-build-info.ts",
-    "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",
-    "release:check": "node --import tsx scripts/release-check.ts",
-    "ui:install": "node scripts/ui.js install",
-    "ui:dev": "node scripts/ui.js dev",
-    "ui:build": "node scripts/ui.js build",
-    "start": "node scripts/run-node.mjs",
-    "taskmaster": "node scripts/run-node.mjs",
-    "gateway:watch": "node scripts/watch-node.mjs gateway --force",
-    "logs": "npx tsx scripts/session-viewer.ts",
-    "gateway:dev": "TASKMASTER_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway",
-    "gateway:dev:reset": "TASKMASTER_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway --reset",
-    "tui": "node scripts/run-node.mjs tui",
-    "tui:dev": "TASKMASTER_PROFILE=dev node scripts/run-node.mjs tui",
-    "taskmaster:rpc": "node scripts/run-node.mjs agent --mode rpc --json",
-    "lint": "oxlint --type-aware src test",
-    "lint:fix": "pnpm format:fix && oxlint --type-aware --fix src test",
-    "format": "oxfmt --check src test",
-    "format:fix": "oxfmt --write src test",
-    "test": "node scripts/test-parallel.mjs",
-    "test:watch": "vitest",
-    "test:ui": "pnpm --dir ui test",
-    "test:force": "node --import tsx scripts/test-force.ts",
-    "test:coverage": "vitest run --coverage",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "test:live": "TASKMASTER_LIVE_TEST=1 vitest run --config vitest.live.config.ts",
-    "test:docker:onboard": "bash scripts/e2e/onboard-docker.sh",
-    "test:docker:gateway-network": "bash scripts/e2e/gateway-network-docker.sh",
-    "test:docker:live-models": "bash scripts/test-live-models-docker.sh",
-    "test:docker:live-gateway": "bash scripts/test-live-gateway-models-docker.sh",
-    "test:docker:qr": "bash scripts/e2e/qr-import-docker.sh",
-    "test:docker:doctor-switch": "bash scripts/e2e/doctor-install-switch-docker.sh",
-    "test:docker:plugins": "bash scripts/e2e/plugins-docker.sh",
-    "test:docker:cleanup": "bash scripts/test-cleanup-docker.sh",
-    "test:docker:all": "pnpm test:docker:live-models && pnpm test:docker:live-gateway && pnpm test:docker:onboard && pnpm test:docker:gateway-network && pnpm test:docker:qr && pnpm test:docker:doctor-switch && pnpm test:docker:plugins && pnpm test:docker:cleanup",
-    "test:all": "pnpm lint && pnpm build && pnpm test && pnpm test:e2e && pnpm test:live && pnpm test:docker:all",
-    "test:install:e2e": "bash scripts/test-install-sh-e2e-docker.sh",
-    "test:install:smoke": "bash scripts/test-install-sh-docker.sh",
-    "test:install:e2e:openai": "TASKMASTER_E2E_MODELS=openai bash scripts/test-install-sh-e2e-docker.sh",
-    "test:install:e2e:anthropic": "TASKMASTER_E2E_MODELS=anthropic bash scripts/test-install-sh-e2e-docker.sh",
-    "protocol:gen": "node --import tsx scripts/protocol-gen.ts",
-    "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",
-    "canvas:a2ui:bundle": "bash scripts/bundle-a2ui.sh",
-    "check:loc": "node --import tsx scripts/check-ts-max-loc.ts --max 500"
-  },
   "keywords": [],
   "author": "",
   "license": "MIT",
   "engines": {
     "node": ">=22.12.0"
   },
-  "packageManager": "pnpm@10.23.0",
   "dependencies": {
     "@agentclientprotocol/sdk": "0.13.1",
     "@aws-sdk/client-bedrock": "^3.975.0",
@@ -231,14 +179,6 @@
     "vitest": "^4.0.18",
     "wireit": "^0.14.12"
   },
-  "pnpm": {
-    "minimumReleaseAge": 2880,
-    "overrides": {
-      "@sinclair/typebox": "0.34.47",
-      "hono": "4.11.4",
-      "tar": "7.5.4"
-    }
-  },
   "vitest": {
     "coverage": {
       "provider": "v8",
@@ -267,5 +207,55 @@
       "**/vendor/**",
       "dist/Taskmaster.app/**"
     ]
+  },
+  "scripts": {
+    "dev": "node scripts/run-node.mjs",
+    "postinstall": "node scripts/postinstall.js",
+    "docs:list": "node scripts/docs-list.js",
+    "docs:bin": "node scripts/build-docs-list.mjs",
+    "build": "tsc -p tsconfig.json && node --import tsx scripts/canvas-a2ui-copy.ts && node --import tsx scripts/copy-hook-metadata.ts && node --import tsx scripts/write-build-info.ts",
+    "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",
+    "release:check": "node --import tsx scripts/release-check.ts",
+    "ui:install": "node scripts/ui.js install",
+    "ui:dev": "node scripts/ui.js dev",
+    "ui:build": "node scripts/ui.js build",
+    "start": "node scripts/run-node.mjs",
+    "taskmaster": "node scripts/run-node.mjs",
+    "gateway:watch": "node scripts/watch-node.mjs gateway --force",
+    "logs": "npx tsx scripts/session-viewer.ts",
+    "gateway:dev": "TASKMASTER_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway",
+    "gateway:dev:reset": "TASKMASTER_SKIP_CHANNELS=1 node scripts/run-node.mjs --dev gateway --reset",
+    "tui": "node scripts/run-node.mjs tui",
+    "tui:dev": "TASKMASTER_PROFILE=dev node scripts/run-node.mjs tui",
+    "taskmaster:rpc": "node scripts/run-node.mjs agent --mode rpc --json",
+    "lint": "oxlint --type-aware src test",
+    "lint:fix": "pnpm format:fix && oxlint --type-aware --fix src test",
+    "format": "oxfmt --check src test",
+    "format:fix": "oxfmt --write src test",
+    "test": "node scripts/test-parallel.mjs",
+    "test:watch": "vitest",
+    "test:ui": "pnpm --dir ui test",
+    "test:force": "node --import tsx scripts/test-force.ts",
+    "test:coverage": "vitest run --coverage",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "test:live": "TASKMASTER_LIVE_TEST=1 vitest run --config vitest.live.config.ts",
+    "test:docker:onboard": "bash scripts/e2e/onboard-docker.sh",
+    "test:docker:gateway-network": "bash scripts/e2e/gateway-network-docker.sh",
+    "test:docker:live-models": "bash scripts/test-live-models-docker.sh",
+    "test:docker:live-gateway": "bash scripts/test-live-gateway-models-docker.sh",
+    "test:docker:qr": "bash scripts/e2e/qr-import-docker.sh",
+    "test:docker:doctor-switch": "bash scripts/e2e/doctor-install-switch-docker.sh",
+    "test:docker:plugins": "bash scripts/e2e/plugins-docker.sh",
+    "test:docker:cleanup": "bash scripts/test-cleanup-docker.sh",
+    "test:docker:all": "pnpm test:docker:live-models && pnpm test:docker:live-gateway && pnpm test:docker:onboard && pnpm test:docker:gateway-network && pnpm test:docker:qr && pnpm test:docker:doctor-switch && pnpm test:docker:plugins && pnpm test:docker:cleanup",
+    "test:all": "pnpm lint && pnpm build && pnpm test && pnpm test:e2e && pnpm test:live && pnpm test:docker:all",
+    "test:install:e2e": "bash scripts/test-install-sh-e2e-docker.sh",
+    "test:install:smoke": "bash scripts/test-install-sh-docker.sh",
+    "test:install:e2e:openai": "TASKMASTER_E2E_MODELS=openai bash scripts/test-install-sh-e2e-docker.sh",
+    "test:install:e2e:anthropic": "TASKMASTER_E2E_MODELS=anthropic bash scripts/test-install-sh-e2e-docker.sh",
+    "protocol:gen": "node --import tsx scripts/protocol-gen.ts",
+    "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",
+    "canvas:a2ui:bundle": "bash scripts/bundle-a2ui.sh",
+    "check:loc": "node --import tsx scripts/check-ts-max-loc.ts --max 500"
   }
-}
+}

package/templates/maxy/.gitignore

@@ -0,0 +1 @@
+.DS_Store

package/templates/taskmaster/.gitignore

@@ -0,0 +1 @@
+.DS_Store