@taskless/cli 0.10.1 → 0.11.0

package/dist/rules/capabilities.d.ts

@@ -0,0 +1,311 @@
+/**
+ * What the two local engines can actually read.
+ *
+ * PURE DATA, DELIBERATELY. This module is imported by `src/prompts/recipes.ts`,
+ * which is a Worker-safe library surface — no citty, no telemetry, no
+ * filesystem, no network — and `assert-prompts-graph` in `vite.config.ts`
+ * fails the build if the prompts chunk's graph reaches a host capability. So
+ * nothing here may read `package.json`, spawn a binary, or import a node
+ * builtin. The values are transcribed once, here, and pinned by tests that do
+ * spawn the binaries.
+ *
+ * THE BINARIES ARE THE ONLY AUTHORITY, and neither of them can be asked at
+ * render time:
+ *
+ * - `src/generated/ast-grep-rule-schema.json` types `$defs.Language` as a bare
+ *   string with no enum — its only hint is an `example` reading `"typescript"`,
+ *   which is not even the canonical spelling — so the vendored schema cannot
+ *   answer the question. `verify` answers it from the constants below instead
+ *   (see `validateLanguage` in `verify.ts`).
+ * - `detect --json` reports the *repository's* languages in a different
+ *   vocabulary — `C++` where ast-grep says `Cpp` — and says nothing about what
+ *   an engine can parse.
+ * - Vale self-reports nothing at all. Its reach was measured by probing the
+ *   shipped binary, which is why the Vale constants below carry a probe-shaped
+ *   contract test rather than a parsed capability listing.
+ *
+ * BUMPING AN ENGINE IS A ONE-FILE EDIT. Change the version constant and the
+ * list beside it; `test/ast-grep-vendor-contract.test.ts` and
+ * `test/vale-vendor-contract.test.ts` fail until the two agree, which is the
+ * whole point of transcribing rather than describing. See taskless/cli#151 for
+ * the routing miss this exists to prevent: two GitHub Actions workflow rules
+ * were escalated to `runtime` because nothing said ast-grep parses YAML.
+ */
+/**
+ * The ast-grep release pinned in `packages/cli/package.json`, both for
+ * `@ast-grep/cli` and for every `@ast-grep/cli-<platform>` optional dependency.
+ *
+ * Pinned against the binary by `test/ast-grep-vendor-contract.test.ts`
+ * ("engine capabilities" → "reports the pinned version").
+ */
+export declare const AST_GREP_VERSION = "0.45.2";
+/**
+ * Every language ast-grep can parse, verbatim from
+ * `sg run -h` → `Supported languages are: [...]` at
+ * {@link AST_GREP_VERSION}.
+ *
+ * SPELLINGS ARE ast-grep's, NOT ours and not `detect`'s. `Cpp`, `CSharp`,
+ * `JavaScript`, `Tsx` — a rule's `language:` field is handed to ast-grep
+ * unchanged, so the binary has the final opinion. MEASURED at 0.45.2: it
+ * accepts more than this list — case variants and a fixed set of extension
+ * aliases, both enumerated in {@link AST_GREP_LANGUAGE_ALIASES} — so an
+ * off-list spelling is not on its own an error. The two real failures are a
+ * name ast-grep does not know at all (`C#`), which aborts config parsing so
+ * every rule goes unreported, and a valid name for the wrong parser
+ * (`TypeScript` over `.tsx`), which reports nothing and reads as a clean
+ * codebase. `verify` catches both; see `verify.ts`.
+ *
+ * Pinned by set-equality against the binary in
+ * `test/ast-grep-vendor-contract.test.ts`, so a version bump that adds or drops
+ * a language fails there rather than silently narrowing what the router
+ * believes is buildable locally.
+ */
+export declare const AST_GREP_LANGUAGES: readonly ["Bash", "C", "Cpp", "CSharp", "Css", "Dart", "Elixir", "Go", "Haskell", "Hcl", "Html", "Java", "JavaScript", "Json", "Kotlin", "Lua", "Markdown", "Nix", "Php", "Python", "Ruby", "Rust", "Scala", "Solidity", "Swift", "Tsx", "TypeScript", "Yaml"];
+/** One of the spellings {@link AST_GREP_LANGUAGES} lists, canonically cased. */
+export type AstGrepLanguage = (typeof AST_GREP_LANGUAGES)[number];
+/**
+ * The spellings ast-grep also accepts that are not on the canonical list,
+ * mapped to the language each resolves to.
+ *
+ * Keys are lowercase because ast-grep's own matching is case-insensitive:
+ * `TYPESCRIPT`, `Cs` and `GOLANG` all resolve at 0.45.2. That makes the whole
+ * accepted vocabulary "the canonical list plus these, compared lowercased",
+ * which is what {@link resolveAstGrepLanguage} implements.
+ *
+ * Every value here was probed through a real config, because that is the only
+ * thing a rule file is ever fed to. That is deliberate: `sg run --lang` is a
+ * SEPARATE vocabulary and cannot stand in for this one. MEASURED at 0.45.2,
+ * the two agree on `C++` and `cxx` (both accepted) and on `C#` (both
+ * rejected), but `--lang` rejects with clap's own `is not supported!` before
+ * a rule is ever read, so it exercises a different code path and is not
+ * evidence about `language:`. At 0.41.0 they diverged outright: `--lang C++`
+ * was rejected while `language: C++` parsed. Nothing here probes `--lang`.
+ *
+ * THIS IS THE ONE LIST HERE THE BINARY CANNOT BE ASKED TO ENUMERATE. `sg run
+ * -h` prints the canonical list, so `AST_GREP_LANGUAGES` above is checked by
+ * set-equality against it; nothing prints the aliases. Each entry is instead
+ * pinned by *probing*, in the "language aliases" suite of
+ * `test/ast-grep-vendor-contract.test.ts`: every key is fed to the binary in a
+ * config and the resolution is read back out of the scan stream's own
+ * `language` field — ast-grep reports the canonical name it settled on, so the
+ * mapping is the binary's answer rather than ours. The same suite feeds a
+ * sweep of near-misses (`h`, `mjs`, `sh`, `tf`, `csx`) and asserts they are
+ * rejected, so a bump that ADDS an alias fails there too.
+ *
+ * Whitespace is not folded, deliberately: `language: "ts "` is rejected by the
+ * binary, so accepting it here would pass a rule that cannot run.
+ */
+export declare const AST_GREP_LANGUAGE_ALIASES: Readonly<Record<string, AstGrepLanguage>>;
+/**
+ * The language ast-grep would parse `spelling` as, or `undefined` if it would
+ * reject the config outright.
+ *
+ * `undefined` is the fatal case, not a stylistic one: an unrecognized name
+ * fails `SgLang` deserialization, which aborts parsing of the single config
+ * Taskless assembles for the run — so every *other* sg rule goes unreported
+ * with it.
+ */
+export declare function resolveAstGrepLanguage(spelling: string): AstGrepLanguage | undefined;
+/**
+ * The `.ts` / `.tsx` split — the one pair of ast-grep languages that share a
+ * family and read disjoint file extensions.
+ *
+ * MEASURED at 0.45.2: a `TypeScript` rule over a `.tsx` tree exits zero having
+ * matched nothing, and a `Tsx` rule scans `.tsx` only. That is the quiet
+ * failure of the two, because "no findings" is exactly what a clean codebase
+ * looks like. Pinned by "treats Tsx and TypeScript as different parsers, not
+ * aliases" in `test/ast-grep-vendor-contract.test.ts`.
+ *
+ * Kept to this pair deliberately. Every other language's extensions would be a
+ * second vendored table with no measured backing, and the trap only exists
+ * where two languages look like spellings of one thing.
+ */
+export declare const AST_GREP_TSX_SPLIT: Readonly<Partial<Record<AstGrepLanguage, string>>>;
+/**
+ * The Vale release carried by the `@taskless/vale-<platform>` packages pinned
+ * in `packages/cli/package.json`. Their npm versions append a build stamp
+ * (`3.17.1-20260810052605`); this is the version Vale itself reports.
+ *
+ * Pinned against the binary by `test/vale-vendor-contract.test.ts`
+ * ("engine capabilities" → "reports the pinned version").
+ */
+export declare const VALE_VERSION = "3.18.0";
+/**
+ * Which tier Vale routes an extension to.
+ *
+ * `converter:<program>` carries the program's own name in the tier, so one
+ * table row states both the tier and the thing a user would install. The name
+ * is the one Vale prints in its `E100` text, because that is the string a
+ * reader will search for.
+ */
+export type ValeFormatTier = 
+/** Parsed in-process: the document is prose, its own syntax is skipped. */
+"markup"
+/** Parsed in-process: comment text is linted, the code body is invisible. */
+ | "comment"
+/** No parser: the whole file is linted as one block of prose. */
+ | "plaintext"
+/** Vale shells out to a program the `@taskless/vale-*` packages do not ship. */
+ | `converter:${string}`;
+/**
+ * EVERY MEASURED VALE EXTENSION, AND ITS TIER. THE ONLY TABLE.
+ *
+ * Adding an extension is one line here; every list, glob, notice and test below
+ * derives from this record, so there is no second place to keep in step. Two
+ * branches once measured this independently and produced two tables that
+ * disagreed about six extensions — that is what this single record exists to
+ * make impossible.
+ *
+ * MEASURED, NOT DOCUMENTED, AND MEASURED BY A DISCRIMINATING PROBE. Ordinary
+ * prose fires in all three readable tiers, so it can never separate them. Each
+ * tier is pinned by the property only that tier has, in
+ * `test/vale-vendor-contract.test.ts`:
+ *
+ * - **markup** — a construct only a real parser skips yields ZERO (a fenced
+ *   code block, an Org `#` line, an HTML comment).
+ * - **comment** — the token in a comment yields one finding and the same token
+ *   on a bare non-comment line yields ZERO. A type that fires on both is the
+ *   plaintext fallback wearing a code extension.
+ * - **plaintext** — a bare line yields a finding. Listed only where the tier is
+ *   surprising: `.tex`, `.mkd` and `.mkdn` all look like markup and are not.
+ *   Everything unnamed lands here too, which is why this tier does not need to
+ *   be exhaustive.
+ * - **converter** — a non-zero exit whose output carries `E100` and the
+ *   program's name.
+ *
+ * Measured spellings, not families. `.mdown` is native Markdown and `.mkd` and
+ * `.mkdn` are not; `.asc` is a third AsciiDoc spelling that crashes exactly
+ * like `.adoc`; `.ditamap` is plaintext while `.dita` needs `dita`. Case is
+ * part of the key — `.r` and `.R` were both measured, `.PY` was measured and is
+ * not comment-aware. Add a row only after probing it; the contract test refuses
+ * to take one on faith.
+ *
+ * A VERSION BUMP INVALIDATES THIS TABLE — RE-MEASURE THE WHOLE OF IT. The tiers
+ * are a property of {@link VALE_VERSION}'s binary, and the dangerous direction
+ * is a format Vale *learns*: an extension missing from this table is read as
+ * plain text today, but the moment Vale routes it to a converter the same
+ * omission is a crash that takes down every Vale rule in the run.
+ *
+ * The 3.17.1 → 3.18.0 bump is what that warning looks like in practice. Every
+ * row below was re-probed against the 3.18.0 binary, and eight moved, in three
+ * different directions — which is why "re-measure" is not boilerplate here:
+ *
+ * - `.mdx` gained a native parser: `converter:mdx2vast` → `markup`. It is
+ *   supported now, and `[*.{md,mdx}]` is a legitimate matcher again.
+ * - `.typ` gained a parser that shells out to `typst2vast`
+ *   (https://docs.vale.sh/formats/typst): `plaintext` →
+ *   `converter:typst2vast`. That is the dangerous direction — 3.17.1 read it as
+ *   prose, and the same row on 3.18.0 crashes the run. It stays unsupported
+ *   permanently, since we do not support formats needing an external program.
+ * - `.rmd` gained a real Markdown parser, so it left the "looks like markup and
+ *   is not" list above: `plaintext` → `markup`.
+ * - `.qml` and `.scss` gained parsers that see their comments: `plaintext` →
+ *   `comment`. Vale's docs had claimed both for years; on 3.17.1 the claim was
+ *   measurably false and on 3.18.0 it is true.
+ * - `.qmd` (Quarto) and `.myst` (MyST) measured as `markup`, and `.qdoc` as
+ *   `comment` — QDoc documentation lives in a doc-comment block, so it is
+ *   comment extraction rather than the markup tier a first reading of the
+ *   release notes suggests, and probing it with bare prose reads as no support
+ *   at all. All three are new rows, none of them reachable on 3.17.1.
+ *
+ * PHP also changed without the release notes saying so: comment extraction now
+ * needs a real `<?php` tag, where 3.17.1 linted a bare `//` comment without
+ * one. The tier did not move, but the probe had to. Re-probe every row on the
+ * next bump, by the discriminating property and by each language's own comment
+ * syntax — a wrong delimiter reads exactly like absent support.
+ */
+export declare const VALE_FORMAT_TIERS: Readonly<Record<string, ValeFormatTier>>;
+/**
+ * Extensions Vale parses as markup: the whole document is prose, and the
+ * format's own non-prose constructs are excluded.
+ *
+ * The HTML entries carry a consequence worth stating to an author: prose
+ * outside an element is not linted, so a bare sentence in a `.html` file yields
+ * nothing.
+ */
+export declare const VALE_MARKUP_EXTENSIONS: readonly string[];
+/**
+ * Extensions where Vale lints **comment text only** and ignores the code body.
+ */
+export declare const VALE_COMMENT_EXTENSIONS: readonly string[];
+/**
+ * Extensions measured into the plaintext fallback whose spelling suggests
+ * otherwise.
+ *
+ * Not exhaustive and not meant to be — every unnamed extension is plaintext
+ * too. These are the ones an author would reasonably assume were parsed, so
+ * they are worth naming in a recipe rather than leaving to "everything else".
+ */
+export declare const VALE_PLAINTEXT_EXTENSIONS: readonly string[];
+/**
+ * The converter each converter-dependent extension needs, keyed by extension.
+ *
+ * The lookup `rules/vale/formats.ts` uses to name a converter in the skip
+ * notice. Keys are lowercase because every measured converter format is; a
+ * caller comparing an extension off the filesystem must lowercase it first, or
+ * `README.RST` becomes a crash on case-insensitive platforms only.
+ */
+export declare const VALE_CONVERTER_BY_EXTENSION: Readonly<Record<string, string>>;
+/** A format Vale supports upstream but cannot read without an external tool. */
+export interface ValeConverterFormat {
+    /** Extensions Vale routes through this converter. */
+    extensions: readonly string[];
+    /** The executable or artifact Vale looks for, named in its own E100 text. */
+    converter: string;
+}
+/**
+ * Formats that fail rather than lint, because Vale shells out to a converter
+ * this CLI does not ship.
+ *
+ * SAY THIS ACCURATELY: Vale supports these formats. What is missing is the
+ * external program it delegates the parse to. The failure is environmental, and
+ * describing it as "Vale does not support reStructuredText" sends an author
+ * looking for the wrong fix.
+ *
+ * The blast radius is what makes this worth surfacing at routing time rather
+ * than at authoring time: Vale exits 2 with an `E100` runtime error and
+ * abandons the run, and `--no-exit` does not suppress it. One `.typ` file
+ * caught by a rule's glob takes down the entire Vale pass, including every
+ * other rule and every other file — so `[*.{md,typ}]` is not a slightly wider
+ * matcher than `[*.md]`, it is a broken one. (`[*.{md,mdx}]` was that example
+ * until 3.18.0 gave MDX a native parser — the membership of this tier is a
+ * property of {@link VALE_VERSION}, and so is the worked example.)
+ */
+export declare const VALE_CONVERTER_DEPENDENT: readonly ValeConverterFormat[];
+/**
+ * Vale's checker tag per converter-dependent extension, from the `E100` text.
+ *
+ * This is the host-independent half of the failure. The prose after the tag is
+ * not: `.xml` reports `xsltproc not found` where the program is absent and
+ * `no XSLT transform provided` where it is present, and the two are split by
+ * platform — macOS ships `/usr/bin/xsltproc`, the Linux CI image does not. A
+ * contract test that matched on the program name therefore passed locally and
+ * failed in CI, which is how this list came to exist.
+ *
+ * `.xml` is also the one entry whose converter is not sufficient on its own. An
+ * XSLT transform is document-specific, so there is no default to ship and
+ * installing `xsltproc` does not make `.xml` lintable — unlike `asciidoctor`,
+ * which genuinely fixes `.adoc`. That is why its `converter` names the
+ * stylesheet as well as the program.
+ */
+export declare const VALE_CONVERTER_CHECKERS: Readonly<Record<string, string>>;
+/** Every converter-dependent extension, flattened. */
+export declare const VALE_CONVERTER_DEPENDENT_EXTENSIONS: readonly string[];
+/** `Bash, C, Cpp, …` — the ast-grep language list as recipe prose. */
+export declare function astGrepLanguageList(): string;
+/** `.htm, .html, …` — Vale's markup extensions as recipe prose. */
+export declare function valeMarkupList(): string;
+/** `.c, .c++, …` — Vale's comment-only extensions as recipe prose. */
+export declare function valeCommentList(): string;
+/**
+ * `.mkd, .mkdn, …` — the plaintext extensions worth naming, as recipe prose.
+ *
+ * Rendered rather than written into the recipe because the surprising cases are
+ * exactly the ones a hand-written list gets wrong.
+ */
+export declare function valePlaintextList(): string;
+/**
+ * `.rst (needs rst2html), …` — Vale's converter-dependent formats as recipe
+ * prose, each naming the tool whose absence is the actual failure.
+ */
+export declare function valeConverterList(): string;

package/dist/schemas/rules-create.d.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+/** Input schema for `taskless rule create --from` JSON file */
+export declare const inputSchema: z.ZodObject<{
+    prompt: z.ZodString;
+    successCases: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    failureCases: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** Output schema for `taskless rule create --json` on success */
+export declare const outputSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    ruleId: z.ZodString;
+    rules: z.ZodArray<z.ZodString>;
+    files: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/** Error schema for `taskless rule create --json` on failure */
+export declare const errorSchema: z.ZodObject<{
+    error: z.ZodString;
+}, z.core.$strip>;

package/dist/schemas/rules-improve.d.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+/** Input schema for `taskless rule improve --from` JSON file */
+export declare const inputSchema: z.ZodObject<{
+    ruleId: z.ZodString;
+    guidance: z.ZodString;
+    references: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        filename: z.ZodString;
+        content: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/** Output schema for `taskless rule improve --json` on success */
+export declare const outputSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    requestId: z.ZodString;
+    rules: z.ZodArray<z.ZodString>;
+    files: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/** Error schema for `taskless rule improve --json` on failure */
+export declare const errorSchema: z.ZodObject<{
+    error: z.ZodString;
+}, z.core.$strip>;

package/dist/util/invocation.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The published CLI invocation baked into skill, command, and recipe source.
+ * Build targets other than prod rewrite it: to a repo-root-relative path so a
+ * locally built CLI can be dogfooded in this repo (`build:self`), and to
+ * `npx @taskless/cli-nightly@<version>` for a nightly, whose shipped
+ * instructions must name the package the reader actually installed rather than
+ * the released one. There is no target that emits a path usable from outside
+ * this checkout; a nightly covers that. See `scripts/build-target.ts`,
+ * `vite.config.ts`, and the root `package.json` scripts.
+ */
+export declare const PROD_INVOCATION = "npx @taskless/cli";
+/**
+ * Whether this build's invocation is the released one.
+ *
+ * `false` means the build knows exactly what it is — a `nightly` pinned to its
+ * published version, or a `self` path — and its instructions must say so
+ * rather than naming `@taskless/cli`. `true` means the build is the released
+ * package and has no idea how it was launched, which is a different situation
+ * from knowing it was launched as `npx @taskless/cli`.
+ */
+export declare function isProductionInvocation(): boolean;
+/** This build's invocation, whatever the target. */
+export declare function buildInvocation(): string;
+/**
+ * Rewrite the canonical `npx @taskless/cli` invocation to the build-target
+ * invocation (`__TASKLESS_CLI__`).
+ *
+ * A no-op for prod builds, where the define equals {@link PROD_INVOCATION}, so
+ * emitted content stays byte-identical to source. For `dev`/`self`/`nightly`
+ * builds it swaps both the bare form and the `@latest`-pinned form (the
+ * version-pinned form first, so the bare replacement can't leave a dangling
+ * `@latest` — which for a nightly would read
+ * `npx @taskless/cli-nightly@<version>@latest`).
+ */
+export declare function applyCliInvocation(content: string): string;
+/**
+ * Prepend the build-target notice (`__TASKLESS_CLI_NOTICE__`) to a canonical
+ * skill/command body. A no-op for prod, where the notice is empty. For
+ * `dev`/`self` builds the banner is inserted immediately after the frontmatter
+ * block so it renders as the first body line without corrupting the YAML.
+ */
+export declare function withCliBuildNotice(content: string): string;

package/package.json

@@ -1,20 +1,21 @@
 {
   "name": "@taskless/cli",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/taskless/skills.git",
+    "url": "https://github.com/taskless/cli.git",
     "directory": "packages/cli"
   },
   "scripts": {
-    "prebuild": "tsx scripts/fetch-rule-hash-vectors.ts",
-    "build": "vite build",
-    "build:dev": "TASKLESS_BUILD_TARGET=dev vite build",
+    "build": "vite build && tsc -p tsconfig.prompts.json",
+    "build:nightly": "TASKLESS_BUILD_TARGET=nightly vite build && tsc -p tsconfig.prompts.json",
     "build:self": "TASKLESS_BUILD_TARGET=self vite build",
     "generate:api": "openapi-typescript https://app.taskless.io/cli/api/__schema -o src/generated/api.d.ts",
     "generate:ast-grep-schema": "tsx scripts/fetch-ast-grep-schema.ts",
     "generate:rule-hash-vectors": "tsx scripts/fetch-rule-hash-vectors.ts",
+    "generate:vale-schema": "tsx scripts/generate-vale-schema.ts",
+    "prebuild": "tsx scripts/fetch-rule-hash-vectors.ts",
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   },
@@ -23,6 +24,10 @@
   "exports": {
     ".": {
       "import": "./dist/index.js"
+    },
+    "./prompts": {
+      "types": "./dist/prompts/index.d.ts",
+      "import": "./dist/prompts.js"
     }
   },
   "files": [
@@ -32,7 +37,6 @@
     "node": ">=22.22.0"
   },
   "dependencies": {
-    "@ast-grep/cli": "^0.41.0",
     "@clack/prompts": "^1.2.0",
     "chalk": "^5.6.2",
     "citty": "^0.1.6",
@@ -47,6 +51,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@ast-grep/cli": "0.45.2",
     "@types/sprintf-js": "^1.1.4",
     "openapi-typescript": "^7.13.0",
     "typescript": "^5.7.2",
@@ -58,12 +63,18 @@
     "taskless": "./dist/index.js"
   },
   "optionalDependencies": {
-    "@ast-grep/cli-darwin-arm64": "^0.41.0",
-    "@ast-grep/cli-darwin-x64": "^0.41.0",
-    "@ast-grep/cli-linux-arm64-gnu": "^0.41.0",
-    "@ast-grep/cli-linux-x64-gnu": "^0.41.0",
-    "@ast-grep/cli-win32-arm64-msvc": "^0.41.0",
-    "@ast-grep/cli-win32-ia32-msvc": "^0.41.0",
-    "@ast-grep/cli-win32-x64-msvc": "^0.41.0"
+    "@ast-grep/cli-darwin-arm64": "0.45.2",
+    "@ast-grep/cli-darwin-x64": "0.45.2",
+    "@ast-grep/cli-linux-arm64-gnu": "0.45.2",
+    "@ast-grep/cli-linux-x64-gnu": "0.45.2",
+    "@ast-grep/cli-win32-arm64-msvc": "0.45.2",
+    "@ast-grep/cli-win32-ia32-msvc": "0.45.2",
+    "@ast-grep/cli-win32-x64-msvc": "0.45.2",
+    "@taskless/vale-darwin-arm64": "3.18.0-20260824195610",
+    "@taskless/vale-darwin-x64": "3.18.0-20260824195610",
+    "@taskless/vale-linux-arm64": "3.18.0-20260824195610",
+    "@taskless/vale-linux-x64": "3.18.0-20260824195610",
+    "@taskless/vale-win32-arm64": "3.18.0-20260824195610",
+    "@taskless/vale-win32-x64": "3.18.0-20260824195610"
   }
 }