v0.3.0-beta.1.2

[0.3.0-beta.1.2] — 2026-08-20

Hotfix on 0.3.0-beta.1.1. npm beta dist-tag. Not GA. Does not implement #137 (/tf web) or #95 (adaptive-authority isolation). Does not steal 0.3.0-beta.2.

Added

• taskFile load-time include (issue #143). A phase or parallel branch may declare taskFile instead of task. Trusted loaders (defineFile / saved flow) resolve the literal path against the definition file's directory (same class of source as scriptCwd: "flow"), inline the UTF-8 body into task, and delete taskFile before validate / interpolate / cache / FlowIR. XOR with task; leftover taskFile on inline define is TF_TASKFILE_NO_PROVENANCE; generated sub-flows reject it as TF_DYNAMIC_RESOURCE_FORBIDDEN. Path is not interpolated. Include cap is 256 KiB (taskFile exceeds). TS DSL: agent({ taskFile: "prompts/x.md" }) only — a bare agent({ model }) is not opts-only. Compile XOR keeps both fields. Nested inline def is not inlined. taskflow-dsl check does not read the file.

Chore

• Absorb open Dependabot PRs into this line: pnpm/action-setup 6.0.10 (#129); codeql-action 4.37.7 (#145, #146); Pi 0.84.2 + typebox ^1.3.14 + biome 2.5.8 + @types/node 26.2.0 (#147); next 16.3.1 (#136); lucide-react ^1.31.0 (#135); fumadocs-ui 16.14.4 (#134); fumadocs-mdx 15.2.3 (#133). fumadocs-core stays 16.14.0 (no Dependabot PR). Pin workspace nanoid override 3.3.17 → 3.3.18 (Dependabot alert #33, GHSA-2v37-7h3g-55p8).

Notes

• All publishable surfaces aligned to 0.3.0-beta.1.2.

v0.3.0-beta.1.1

[0.3.0-beta.1.1] — 2026-08-18

Hotfix on 0.3.0-beta.1. npm beta dist-tag. Not GA. Does not implement #137 (/tf web) or #95 (adaptive-authority isolation).

Fixed

• Windows detached runs (issue #139). detached-runner now converts host runnerModule filesystem paths to file:// specifiers before dynamic import(), so a native C:\\…\\runner.js is no longer rejected as protocol c:. The Pi adapter re-enters the installed dist/cli.js via process.execPath (and serializes PI_TASKFLOW_PI_ENTRY into the detached child) instead of spawn("pi") / spawn("pi.cmd"), which are ENOENT/EINVAL on npm's Windows shims.
• Docs search 404 (issue #138). Static GitHub Pages export now pre-renders the Fumadocs search index (/api/search) and the client loads it with type: 'static'.

Notes

• All publishable surfaces aligned to 0.3.0-beta.1.1.

v0.3.0-beta.1

[0.3.0-beta.1] — 2026-08-13

Pre-release candidate: 0.3.0-beta.1 is prepared for npm's beta dist-tag. It is not GA. The 0.3-C Control Plane remains a follow-on candidate track, not part of this beta's shipped product definition.

Added

• Trusted Effects MVP (packages/taskflow-core/src/effects/):
  • EffectIR (EFFECT_KINDS), PathRef reuse, SecretRef/ServiceRef (type-only fail-closed)
  • closed TypeBox EffectIR + confidentiality/integrity source-to-sink validation
  • resource-controlled FS transaction: durable snapshot → persistent lease → journal intent/permit → stage → Commit or Restore+Reject
  • declaration-only bridge in effects/runtime-apply.ts; no second changeset/gateway authority
  • ledger-backed whyAuthorized / whyContext / whyEffect
• Optional phase effects[]; FlowIR translate/compile/hash include effects
• Built-in detectEffectsIssues (category effects) + effectsLintVerifier
• Every imperative phase fast path finalizes declared fs.write through the resource transaction; event-kernel-enabled runs use the same safe imperative path
• Honest host baseline: conformance/workspace/host-support-baseline.json
• Docs: docs/internal/0.3.0-trusted-effects-mvp.md, 0.3.0-agent-goal.md, 0.3.0-ga-scoreboard.md
• Example: examples/trusted-effects-write.json
• Tests: test/effects*.test.ts, test/verify-effects.test.ts

Fixed

• Resource-bearing inline/saved/expanded/ctx_spawn children can no longer be skipped by parent cache or resume reuse.
• Information-flow labels compose across nested flow boundaries; unresolved dynamic definitions remain tainted, malformed non-array effects fail admission/compile, and why-effect follows DAG dependencies.
• Durable commit/abort results survive staging/lease cleanup faults, activation double faults release leases, and clean-terminal/aged-orphan before-images are garbage-collected.

Notes

• SecretRef/ServiceRef have no vault/network backends in this cut.
• Resolve-only is not an OS sandbox. Direct writes to declared targets are detected and restored; writes outside declared targets remain host-policy dependent.
• Historical Control Plane (feat/0.3.0) is not this release definition.
• Beta release; not GA.

v0.2.10

[0.2.10] — 2026-08-12

Added

• Organized saved-flow discovery. Project and user flows may be nested recursively below the bounded flows/ convention directory (for example .pi/taskflows/flows/release/publish.json) while legacy top-level saved flows remain compatible and take same-scope precedence on duplicate names.
• Flow-relative script execution. A file-backed flow can declare scriptCwd: "flow" so script phases without an explicit cwd execute from the definition file's directory. Canonical loader provenance is persisted across foreground, background, resume, saved subflow, Pi, MCP, imperative, and event-kernel paths; inline definitions fail closed because they have no trusted file source.

Changed

• Nested discovery is deterministic and bounded by one shared user/project budget: 1,000 flows, 10,000 entries, 512 directories, 8 MiB total definitions, 1 MiB per definition, and 16 levels. Symlinks below trusted storage boundaries through definition leaves, dot directories, sidecars, and FlowIR artifacts are excluded; duplicate flow names emit diagnostics. A configured user agent-directory boundary may itself be a symlink for home relocation, while project .pi boundaries remain no-follow. Re-saving a discovered nested flow updates its existing definition and adjacent library sidecar in place; listing/search avoids repeated namespace scans.

Fixed

• Legacy top-level hidden JSON flows and flow names ending in .flowir remain discoverable, directory-entry I/O failures remain fail-soft instead of escaping listFlows, and nested flow/sidecar saves revalidate the physical parent at each atomic-write stage so a concurrently replaced directory cannot receive definition/sidecar bytes or a promoted final file.

Security

• Saved-flow and defineFile definitions are read through bounded no-follow descriptors with pre/post file identity checks. Canonical source path plus parent directory identity travel together through run persistence and are revalidated immediately before flow-relative script spawn. New project storage is validated and created one plain directory component at a time before any descendant side effect; flow and sidecar writes recheck the physical target directory before locking and each write. Flow-relative script cwd cannot expand an inherited cwd-bridge boundary.

v0.2.9

[0.2.9] — 2026-08-11

Added

• Hermes Agent host. New hermes-taskflow delivery package and taskflow-hosts Hermes runner, with a stdio MCP scaffold, generated skill, English/Chinese guides, and first-release install pin hermes-taskflow@0.2.9.
• Hermes read-only toolsets. Every child receives an explicit -t; local reads use taskflow_readonly_files, while model-only phases use an empty taskflow_model_only toolset. Read-only web access remains an explicit opt-in.

Fixed

• Pi /tf verify <name>. The slash handler now implements the advertised command and preserves schema-valid flow names containing spaces, matching the tool action and autocomplete surfaces.
• Project flow discovery. Ancestor discovery canonicalizes relative/symlink paths and stops at the user home and shared OS temp root, preventing /tmp/.pi or ~/.pi from being mistaken for project state.
• Hermes plain-text protocol. Blank lines and stdout text beginning with session_id: are preserved as answer content; session metadata is parsed only from stderr. Abort, idle, and empty-output diagnostics remain fail-closed.
• Hermes installation examples. CLI examples use the live hermes mcp add --command … --args … syntax.

Security

• Hermes child isolation. Read-only read_file and search_files paths are canonicalized and confined to the resolved phase cwd, including .., absolute paths, and symlink escapes. The child home receives a filtered inference-provider-only auth.json, an exact provider dotenv allowlist, and non-secret model/fallback routing; unrelated application credentials and parent HERMES_* control-plane state are not copied.
• Mutating authorization. The read-only plugin is loaded only for read-only children. Explicitly authorized PI_TASKFLOW_HERMES_UNSAFE_YOLO=1 phases default to local file,terminal; network requires explicit web aliases, while delegation/skills/memory/browser/cron/control-plane toolsets remain denied.

Changed

• Root, all ten publishable packages, plugin manifests, MCP install pins, server-version contracts, website metadata, and deterministic publish/packed-consumer gates are aligned to 0.2.9.

v0.2.8

[0.2.8] — 2026-08-10

Fixed

• Pi approval confirmation. Approval choices are now selection-only: A / E / R, arrows, and Tab move the pending decision, while Enter confirms it. The dialog starts on Reject, so an accidental Enter fails closed; Escape and Ctrl-C still reject immediately.
• Large approval proposals. Long proposals start collapsed, V toggles an inline scrollable preview, and the decision footer remains visible while reviewing. Short proposals remain expanded by default.
• Kitty keyboard handling. Press, repeat, and release events are decoded explicitly so key-release frames cannot trigger a decision and repeated preview keys cannot double-toggle the proposal.

Changed

• Root, all nine publishable packages, plugin manifests, MCP install pins, and server-version contracts are aligned to 0.2.8.

Security

• Force patched transitive versions of brace-expansion@5.0.9 and nanoid@3.3.17 via pnpm overrides; the production dependency audit is clean.

v0.2.7

[0.2.7] — 2026-08-06

Added

• Preflight plan (taskflow_plan / action=plan / /tf plan). Zero-token dry-run: bind typed invocation args, run structural verify + optional lint verifiers, project topo-ordered phase plan with bound/unresolved/dynamic bindings, and compute a worst-case agent-call bound (loops use maxIterations; dynamic maps report unbounded). No subagent is spawned.
• Budget upper bound in plan. PreflightResult.budget.maxAgentCalls (number or "unbounded") with explicit assumptions — the static cost spine for “plan before spend”.
• Incremental savings summary. Shared formatSavingsLine / formatRecomputeSavingsHeader / formatRunCacheLine: recompute MCP/Pi output leads with reused N · rerun M · cutoff K · saved ~P% phases; run/background status can show cache-hit counts.
• Flow hooks (hooks.onComplete / onFail / onBlocked). Fire-and-forget webhook | file | command (argv only) with summary payload taskflow.hook.v1 (never transcripts). https and http://127.0.0.1|localhost allowed. Hook failure never changes run status. Dispatched from imperative and event-kernel terminal paths.
• Approval timeoutMs + onExpire. Optional HITL wait bound (>= 1000 ms). onExpire: reject (default) | fail | approve (explicit footgun). Infinite wait when omitted (backward compatible).
• Read-only analytics (taskflow_analytics / action=analytics / /tf analytics). Last-N run aggregation: status histogram, p50/p95 duration, per-phase fail/cache rates. No writes, no auto-tune.
• Templates: examples/templates/plan-first.json, examples/templates/background-with-hooks.json.
• MCP tool roster is now 19 (taskflow_plan, taskflow_analytics added).

Security

• Force undici@8.9.0 via pnpm override (Dependabot high/medium: CRLF, cache directives, cookie attributes, retry desync).
• Bump pinned CodeQL Action init/analyze to the v4.37.4 commit SHA.

Changed (maintenance)

• Website: fumadocs-core/ui 16.14.0, fumadocs-mdx 15.2.2, lucide-react ^1.28.0, biome 2.5.6, @types/* patch bumps.
• Dev peers: Pi SDK 0.83.0, typebox ^1.3.10.
• Plugin manifests and MCP install pins aligned to 0.2.7.

Notes

• Shell CLI taskflow plan is intentionally not in this cut (taskflow-cli remains control-plane oriented). Use MCP or Pi surfaces.
• Control-plane / daemon packages are unchanged by this release narrative (0.3 work stays separate).

v0.2.6

[0.2.6] — 2026-07-27

Fixed

• Pi oversized terminal history handling. After a complete final assistant message_end, the Pi runner can now discard an oversized redundant agent_end.messages record without retaining its full history payload, then continue waiting for the compact authoritative agent_settled event. Oversized records still fail closed before a valid final message, for other event types, or when the discarded record is unterminated.
• Deterministic process-supervisor CI checks. Replaced sub-second wall-clock assertions with outcome-based checks and wider watchdog windows, avoiding false failures on loaded Windows runners while preserving process-tree and terminal-grace coverage.

Security

• Upgraded Next.js to 16.2.12 and forced patched transitive versions of sharp 0.35.3, postcss 8.5.23, and brace-expansion 5.0.8. The production dependency audit is clean.
• Updated pinned GitHub Actions revisions to actions/checkout 7.0.1 and github/codeql-action 4.37.3.

Changed

• Refreshed Pi development dependencies to 0.82.1, TypeBox to 1.3.8, React/React DOM to 19.2.8, Lucide React to 1.27.0, Tailwind CSS to 4.3.3, and Biome to 2.5.5.
• Upgraded the repository package manager to pnpm 11.17.0 so root workspace overrides are enforced and recorded reproducibly in the lockfile.

v0.2.5

[0.2.5] — 2026-07-27

Changed

• Four responsibility-based model roles. The built-in agent roster now uses steward, expert, builder, and scout instead of coupling workflow responsibilities to six model capability labels. The recommended OpenRouter bindings are Claude Fable 5 for long-horizon goal stewardship, Claude Opus 5 for deep specialist judgment, Claude Sonnet 5 for default implementation and review, and Claude Haiku 4.5 for fast reconnaissance and mechanically checkable work.
• Role ownership is separate from expertise and authority. Planning/final synthesis use steward; analysis, critique, plan gates, risk, and security use expert; implementation, UI, review, testing, docs, and recovery use builder; discovery, trivial execution, and mechanical verification use scout. Tool permissions, phase side effects, gates, budgets, and approvals remain runtime/agent concerns rather than model-tier concerns.

Compatibility

• Existing 0.2.4 model-role settings remain valid. The legacy fast, strong, thinker, arbiter, vision, and reasoner keys are preserved. Until a new semantic role is configured, each built-in agent falls back to the exact legacy key it used in 0.2.4; new keys always take precedence. User and project agents that still reference legacy keys continue to resolve them normally.

Documentation

• Updated generated host skills plus English and Chinese agent/model-role guides for the four-role contract, current defaults, upgrade behavior, and model-neutral rebinding guidance.

v0.2.4

[0.2.4] — 2026-07-20

Added

• Event kernel concurrent DAG layers. The event kernel now executes phases within a topological layer concurrently via Promise.all with atomic layer-boundary commit. Gate and budget decisions are checked between layers, not within. This removes the single largest blocker to kernel default-ON: previously any flow with independent parallel phases (the common case) was forced to the imperative runtime.
• Kernel retry support. phase.retry = { max, backoffMs, factor } is now honored on the event kernel path for ALL failures (not just transient errors), matching the imperative contract. Both runOneAgent (step.ts) and runAgentCall (step-kinds.ts) implement the full retry curve with budget-aware admission.
• Kernel context pre-read. phase.context files are now read and prepended to the prompt as <context file="..."> blocks on the event kernel path, matching the imperative runtime's resolvePhaseContext behavior.
• Kernel per-phase literal cwd. Literal string phase.cwd values (absolute or relative to the flow cwd) are now resolved and passed to runTask on the event kernel path. Interpolation placeholder cwds ({args.*}, {steps.*}) and workspace keywords (temp/dedicated/worktree) remain imperative-only.
• Built-in script-lint verifier. New scriptLintVerifier (exported from taskflow-core/verifiers) statically analyzes script phase run commands for common shell mistakes: grep patterns starting with - without a -- separator, unbalanced regex brackets/parens in grep/sed, and pipelines ending with a filter (grep/awk/head/tail/wc/sort) without set -o pipefail or PIPESTATUS. Auto-included by compileTaskflow (opt out with lint: false). Motivated by issue #82.
• Verifier discovery. New discoverVerifiers(cwd) API loads project-local verifiers from .pi/taskflows/verifiers/ (project scope, shadows user) and ~/.pi/taskflows/verifiers/ (user scope). Each .ts/.js/.mjs file is dynamically imported; default, verifier, and verifiers exports are collected. Fail-open: broken modules are skipped with a warning. Convention over configuration — no config file needed.
• MCP taskflow_lint tool. The 17th MCP tool. Runs built-in and discovered pluggable verifiers on a flow without executing it. Exposes the verifier ecosystem to all MCP hosts (Codex, Claude Code, OpenCode, Grok Build). Provide name, define, or defineFile.
• Compile subgraph visualization. Inline flow definitions (phase.def) now render as Mermaid subgraph blocks showing child phases and their dependency edges. Saved-use flows (phase.use) remain plain nodes. The subgraph title shows the child flow's name.
• S5.0 kernel parity harness. New kernel-parity.test.ts: 11 golden fixture flows run on BOTH engines (imperative + event kernel) with a deterministic mock runner, asserting status, per-phase output, error, and gate-decision parity. Covers: linear chain, concurrent independent agents, gate, reduce, when-guard skip, join-any with optional dep, script, loop, three-layer wide DAG, retry, and gate-in-concurrent-layer. This is the differential gate that must stay green before the kernel can be flipped to default ON (S5.2).

Changed

• MCP tool count is now 17. taskflow_lint joins the existing 16 tools. Marketplace metadata, host adapter tool-roster tests, and skill discovery assertions are synchronized.
• Kernel admission expanded. canUseEventKernel now admits flows with: concurrent DAG layers, explicit retry, context pre-read, and literal per-phase cwd. Remaining imperative-only features: score gates, expect contracts, reflexion, onBlock:retry, reduceStrategy:"tree", cross-run cache, shareContext, per-branch cwd, script stdin input, interpolated script argv, budgeted fan-out, and budgeted loop/tournament.

Fixed

• Gate parity normalization. The kernel parity harness normalizes gate objects to strip reason: undefined vs absent-key serialization differences between the two engines.