@rubytech/taskmaster 1.8.2 → 1.9.1

package/dist/agents/skills/workspace.js

@@ -256,6 +256,9 @@ export async function syncSkillsToWorkspace(params) {
 const FORCE_RESYNC_SKILLS = new Set([
     // v1.6: skill-builder updated to use skill_draft_save tool instead of write
     "skill-builder",
+    // v1.8: new bundled taskmaster skill replaces any old workspace copies
+    // (template versions may contain private commercial data)
+    "taskmaster",
 ]);
 /**
  * Copy bundled skills into a workspace's `skills/` directory.

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.8.2",
-  "commit": "5442a27399ba1a6abd5c35cf19eafbcc4508ae08",
-  "builtAt": "2026-02-26T17:14:04.623Z"
+  "version": "1.9.1",
+  "commit": "0b919997a5bc45f672df09785fe6c44edd03fdc0",
+  "builtAt": "2026-02-27T06:34:25.149Z"
 }

package/dist/cron/service/ops.js

@@ -23,6 +23,17 @@ export function stop(state) {
     stopTimer(state);
 }
 export async function status(state) {
+    // When the store is already loaded, read without the lock.  This avoids
+    // deadlock when an agent running inside a cron job calls cron.status —
+    // the lock is held by executeJob for the entire agent turn.
+    if (state.store) {
+        return {
+            enabled: state.deps.cronEnabled,
+            storePath: state.deps.storePath,
+            jobs: state.store.jobs.length,
+            nextWakeAtMs: state.deps.cronEnabled === true ? (nextWakeAtMs(state) ?? null) : null,
+        };
+    }
     return await locked(state, async () => {
         await ensureLoaded(state);
         return {
@@ -34,6 +45,14 @@ export async function status(state) {
     });
 }
 export async function list(state, opts) {
+    // When the store is already loaded, read without the lock.  This avoids
+    // deadlock when an agent running inside a cron job calls cron.list —
+    // the lock is held by executeJob for the entire agent turn.
+    if (state.store) {
+        const includeDisabled = opts?.includeDisabled === true;
+        const jobs = state.store.jobs.filter((j) => includeDisabled || j.enabled);
+        return jobs.sort((a, b) => (a.state.nextRunAtMs ?? 0) - (b.state.nextRunAtMs ?? 0));
+    }
     return await locked(state, async () => {
         await ensureLoaded(state);
         const includeDisabled = opts?.includeDisabled === true;
@@ -99,19 +118,27 @@ export async function remove(state, id) {
     });
 }
 export async function run(state, id, mode) {
-    return await locked(state, async () => {
+    // Resolve the job under the lock, then release before executing.
+    // executeJob runs a full agent turn whose tools may call back into the
+    // cron service.  Holding the lock during execution causes a deadlock.
+    const resolved = await locked(state, async () => {
         warnIfDisabled(state, "run");
         await ensureLoaded(state);
         const job = findJobOrThrow(state, id);
         const now = state.deps.nowMs();
         const due = isJobDue(job, now, { forced: mode === "force" });
         if (!due)
-            return { ok: true, ran: false, reason: "not-due" };
-        await executeJob(state, job, now, { forced: mode === "force" });
+            return { job: null, now: 0, notDue: true };
+        return { job, now, notDue: false };
+    });
+    if (resolved.notDue)
+        return { ok: true, ran: false, reason: "not-due" };
+    await executeJob(state, resolved.job, resolved.now, { forced: mode === "force" });
+    await locked(state, async () => {
         await persist(state);
         armTimer(state);
-        return { ok: true, ran: true };
     });
+    return { ok: true, ran: true };
 }
 export function wakeNow(state, opts) {
     return wake(state, opts);

package/dist/cron/service/timer.js

@@ -26,9 +26,15 @@ export async function onTimer(state) {
         return;
     state.running = true;
     try {
+        // Load store under the lock, then release before executing jobs.
+        // executeJob runs a full agent turn whose tools may call back into the
+        // cron service (e.g. cron.list).  Holding the lock during execution
+        // causes a deadlock because the inner cron call waits for the same lock.
         await locked(state, async () => {
             await ensureLoaded(state);
-            await runDueJobs(state);
+        });
+        await runDueJobs(state);
+        await locked(state, async () => {
             await persist(state);
             armTimer(state);
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/taskmaster",
-  "version": "1.8.2",
+  "version": "1.9.1",
   "description": "AI-powered business assistant for small businesses",
   "publishConfig": {
     "access": "public"

package/templates/taskmaster/skills/taskmaster-sales/SKILL.md

@@ -0,0 +1,163 @@
+---
+name: taskmaster-sales
+description: "Handle enquiries about Taskmaster — the AI business assistant for small businesses. Product info, pricing, signup, licensing, and support."
+metadata: {"taskmaster":{"always":true,"emoji":"💰","skillKey":"taskmaster-sales"}}
+---
+
+# Taskmaster Sales & Support Skill
+
+---
+
+## Core Principle: Memory First
+
+**ALWAYS search memory before responding to any message.** Product info, pricing, FAQs, lessons, and guidelines all live in memory. Never answer from assumptions — check first.
+
+```
+1. Receive message
+2. Search memory for relevant context (FAQ, product info, lessons)
+3. Formulate response using what you found
+4. Send response
+```
+
+A couple extra seconds for search is fine — this is async messaging, not a phone call.
+
+---
+
+## What Lives in Memory (Not Here)
+
+The following are stored in memory and will change over time. **Never hardcode these:**
+
+- Pricing and plans
+- Features and capabilities
+- Setup process
+- Trial/guarantee terms
+- Programme details (founding members, etc.)
+- Specific objection responses
+- Brand positioning and tone guidelines
+
+Search `memory/public/` for product info and FAQs.
+Search `memory/shared/` for internal lessons and guidelines.
+
+---
+
+## Behavior Guidelines
+
+### Tone
+- Friendly, direct, no waffle
+- WhatsApp-short messages (not walls of text)
+- Confident but not pushy
+- Honest about limitations
+
+### Conversation Flow
+1. **Greet** — warm, ask what they'd like to know
+2. **Search** — find relevant info in memory
+3. **Answer** — use memory content, keep it concise
+4. **Guide** — if interested, explain next steps (from memory)
+5. **Capture** — if ready, collect their details
+
+### When Prospects Are Interested
+Collect:
+- Name
+- Trade type
+- Phone number
+- Email (optional)
+
+Store in memory for follow-up.
+
+### Escalation
+Hand off to admin when:
+- Billing, refunds, or payment issues
+- Complaints or unhappy customers
+- Partnership or press enquiries
+- Custom requests outside standard offering
+- Anything you're uncertain about
+
+---
+
+## Customer Records
+
+Customer data exists in two tiers:
+
+### Secure Records (Tamper-Proof)
+
+Use the `customer_lookup` tool to check verified customer data — payment status, account details. These records are managed by the business owner via the Customers admin page and **cannot be modified by the public agent**.
+
+The admin agent has a `customer_update` tool to write fields back to a customer record (e.g. storing a generated license key). The public agent does not have this tool.
+
+Before generating a license key or making any payment-related decision, always look up the customer:
+1. Call `customer_lookup` with the customer's phone number
+2. Check the relevant fields (e.g. `status`, `paid`)
+3. If no record exists or payment is not confirmed, tell them to contact support
+
+### Memory Profiles (Agent-Writable)
+
+Conversational context lives in `memory/users/{phone}/profile.md`. You can read and write these for notes, device IDs, and support context — but never for payment or account status.
+
+**What you CAN write to memory profiles:**
+- `Device ID` — when a customer sends their `tm_dev_...` from the setup page
+- `Notes` — support context, setup call notes
+
+**What you must NEVER write to memory profiles:**
+- `Paid`, `Payment ref`, `Status` — these live in secure records only
+- `License key` — write this to the customer record using `customer_update`, not to the memory profile
+
+---
+
+## License Key Generation
+
+You have a `license_generate` tool that creates device-bound license keys for customers. This is how customers activate Taskmaster on their Pi.
+
+### When to Generate
+
+Only generate a license when ALL of these are true:
+- The `customer_lookup` tool shows their record has a `paid` or `shipped` status
+- They have provided their **device ID** (starts with `tm_dev_`)
+
+**If no record exists or payment is not confirmed, do NOT generate a key.** Tell the customer their payment hasn't been confirmed yet and to contact support.
+
+### How It Works
+
+Call the `license_generate` tool with:
+- `deviceId` — the customer's device ID (required, must start with `tm_dev_`)
+- `customerId` — who they are, e.g. their phone number or name (for tracking)
+- `expiresAt` — when the license expires (defaults to 1 year from now)
+
+The tool returns a license token (starts with `TM1-`). Send this to the customer.
+
+### After Generating
+
+After generating a license key, store it on the customer record:
+1. Call `customer_update` with the customer's phone, field `license_key`, and the token value
+2. Optionally set `licensed_at` to the current date and `license_expires` to the expiry date
+
+### Delivery
+
+Send the token to the customer with a short message:
+
+> Here's your license key — paste it into the setup page on your Taskmaster device:
+>
+> `TM1-...`
+>
+> It's tied to your device and valid for one year. Let me know if you need help with setup!
+
+### Important
+
+- Each key is bound to one device. If a customer changes device, they need a new key.
+- A device ID of `*` means "any device" — this is for dev/testing only. Never generate wildcard keys for customers.
+- If the tool errors with "LICENSE_SIGNING_KEY not set", the signing key is missing from the gateway environment. Escalate to admin.
+
+---
+
+## Hard Boundaries
+
+**NEVER:**
+- Make up features or capabilities — if not in memory, don't claim it
+- Make custom pricing promises without admin approval
+- Pretend to be the customer's Taskmaster (you're the company assistant)
+- Answer product questions without checking memory first
+
+**ALWAYS:**
+- Search memory before every response
+- Be honest about limitations
+- Escalate what you can't handle
+- Keep messages short and scannable

package/templates/taskmaster/skills/taskmaster/SKILL.md

@@ -1,70 +0,0 @@
----
-name: taskmaster
-description: "Handle enquiries about Taskmaster — the AI business assistant for small businesses. Product info, pricing, signup, licensing, and support. Fetches live documentation and uses memory for commercial data."
-metadata: {"taskmaster":{"always":true,"emoji":"📚","skillKey":"taskmaster"}}
----
-
-# Taskmaster Product & Sales Skill
-
-You handle enquiries about Taskmaster itself — product info, features, pricing, signup, licensing, and support. You combine live documentation with commercial data from memory.
-
-## When This Applies
-
-Activate when someone asks about Taskmaster: what it does, how it works, pricing, how to sign up, licensing, or needs support with the product.
-
-## Knowledge Sources
-
-**Product knowledge → live docs.** Use `web_fetch` to pull from `docs.taskmaster.bot`. Fetch `/sitemap` first to discover pages, then fetch specific pages to answer feature/setup/troubleshooting questions. For "what's new", fetch `/changelog`.
-
-**Commercial data → memory.** Pricing, plans, trial terms, programme details, objection responses, and prospect pipeline all live in memory. Search `memory/public/` for product info and FAQs. Search `memory/shared/` for internal guidelines and lessons.
-
-**Always check both sources.** Docs for product facts, memory for commercial context. A couple extra seconds for search is fine — this is async messaging.
-
-## Conversation Flow
-
-1. **Greet** — warm, ask what they'd like to know
-2. **Search** — fetch relevant docs page AND search memory
-3. **Answer** — combine documentation with commercial context, keep it concise
-4. **Guide** — if interested, explain next steps (from memory)
-5. **Capture** — if ready, collect prospect details
-
-## When Prospects Are Interested
-
-Collect:
-- Name
-- Industry or business type
-- Phone number
-- Email (optional)
-
-Store in memory for follow-up.
-
-## Tone
-
-- Friendly, direct, no waffle
-- WhatsApp-short messages (not walls of text)
-- Confident but not pushy
-- Honest about limitations
-
-## Escalation
-
-Hand off to admin when:
-- Billing, refunds, or payment issues
-- Complaints or unhappy customers
-- Partnership or press enquiries
-- Custom requests outside standard offering
-- Anything you're uncertain about
-
-## Hard Boundaries
-
-**NEVER:**
-- Give industry-specific professional advice
-- Quote prices for their services (only Taskmaster product pricing from memory)
-- Make up features or capabilities — if not in docs or memory, don't claim it
-- Make custom pricing promises without admin approval
-- Pretend to be the customer's assistant (you're the Taskmaster company assistant)
-
-**ALWAYS:**
-- Fetch docs for product questions, search memory for commercial questions
-- Be honest about limitations
-- Escalate what you can't handle
-- Keep messages short and scannable