chore: version packages

[github-actions]

Build Info

npx @taskless/cli-nightly@0.13.0-20261015004851x9a220c0

Built from: 9a220c0
Committed at: 2026-10-15 00:48:51

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@taskless/cli@0.13.0

Compare with v0.12.0

Minor Changes

• 6c661e9: Breaking: the two rule-checking commands are renamed for the question each one answers.

  0.13	before 0.13	question
  validate	verify	Is the rule well formed? Decided from its files alone.
  verify	test	Does the rule check what you want? Runs validate, then the fixtures.

  What to change:

  • A call to taskless test fails as an unknown command. Call taskless verify. The output is the same.
  • A call to taskless verify still runs, but it now runs the rule's fixtures as well, so it is stricter and slower. For the old quick check, call taskless validate. The JSON envelope is unchanged.
  • A pre-commit hook installed from the hooks recipe runs taskless test and fails after the upgrade until it says taskless verify.
  • The verify-rule agent topic is now validate-rule.
  • The ./schemas export verifyTestOutputSchema is renamed ruleCheckOutputSchema, with no alias. The schema itself is unchanged.
  • @taskless/cli/reference.json moves to version 3. Its shape is unchanged, but enforcedBy now reads "validate" or "verify", so each value names a different command than it did in version 2. The corpus's own version is the signal a consumer should refuse on, not the package version.

  validate also catches more on an ast-grep rule:

  • It has ast-grep load the rule on its own, so a kind the grammar does not have (a keyword such as readonly, a Markdown inline construct such as link) is rejected under that rule's name, in ast-grep's own words. Before, it passed and then broke every sg rule's report in check.
  • A top-level strictness: is rejected under the new constraint sg-no-top-level-strictness. ast-grep ignores the key there, so the pattern stayed narrowed while the rule read as fixed.
  • It reports three silent authoring traps from create-sg-rule as notices, which never fail a rule: $$$ beside a comma, follows/precedes without stopBy: end, and a callee regex that misses awaited generic calls in TypeScript and Tsx.

  verify runs an ast-grep rule's fixtures against a config holding only that rule, so another rule ast-grep refuses no longer fails it under the wrong name.

  Installed skills pin their CLI version, so a project keeps the old names until it upgrades, and the upgrade rewrites the skill with the new ones.

Patch Changes

• 7140552: check no longer reports a clean result for paths it never scanned. A path outside the project, existing or not, is refused with INVALID_INPUT and exit 1. A path that does not exist is still skipped with exit 0, so raw git diff --name-only output can still be piped in, but the skipped paths are now named in a notice (notices under --json).

• eaa4061: An agent can now send the Taskless team general feedback (taskless agent feedback) or a bug report (taskless agent bug-report) on the user's behalf, without a GitHub account. Both show the user the exact payload and send only on their explicit yes, and both appear in the taskless agent index. A bug report's version information is filled in by the CLI from local state. The invited rule-authoring survey's recipe is renamed to taskless agent rule-feedback; its questions, invite, and cadence are unchanged. feedback send payloads now carry a required kind (rule, general, or bug). With telemetry disabled, nothing is sent and the CLI points to https://github.com/taskless/cli/issues instead.

• 1339697: The rule-authoring recipes now tell the agent where a rule's test cases should come from. create-sg-rule, create-vale-rule, create-runtime-rule, and improve-rule --anonymous have it copy cases from real code in the repository before inventing any, and name the cases it invented in its report. They also have it read the linters detect --json finds and write cases those linters would accept. Apart from the construct the rule checks, cases stay in the repository's idiom, with no placeholder types such as Record<string, never> and no nesting a reviewer would send back. create-remote-rule and improve-rule apply the same standard to the cases and references they send to the generator. verify is unchanged and does not judge fixture style.

• 60763fb: The line taskless init prints after a successful install now points only at the Taskless skill: ask your AI tool to onboard with Taskless. It no longer mentions /tskl onboard or a terminal onboard command.

• a36bab1: taskless verify (formerly taskless test) now says when an ast-grep rule's files:/ignores: globs match no file in the project. A fixture snippet has no path, so the globs never apply to it, and a rule scoped to lib/** in a project that keeps its code in src/ used to pass taskless test while check never ran it. The rule still passes; the result carries a notice naming the globs, on the human output and in notices under --json. Rules scoped by language: alone are not checked, since a project with no code in that language is honestly clean.

• 7f66001: taskless agent create-sg-rule now collects its ast-grep authoring traps into one Quirks section, and the recipe moves to topic v7. Each entry gives the symptom (a config error that aborts the scan, or a rule that silently matches nothing), a minimal repro, and the workaround, and the table says which ones validate reports. Two new entries: a keyword such as readonly is not a valid kind (read kinds from --debug-query=ast, not the CST dump), and in TypeScript and Tsx await f<T>(...) parses as a call of the await expression, so a rule keyed on the callee silently skips every awaited generic call. Both workarounds cover the common shapes (private readonly x, optional and decorated parameters, method callees) and pass verify.

• c50b899: taskless detect --json now reports ast-grep and Vale configurations as linters (Taskless's own configuration under .taskless/ excluded), the command-line tools on the host's PATH (gh, git, jq, and now glab for GitLab repositories) under hostTools, and an agent section of commands an agent may choose to run to check whether a source is usable, such as gh auth status. Detection still runs nothing and stays offline. taskless info lists glab among its tools too.

  New taskless report publishes an unlisted Taskless report to tskl.es: a page showing the rules in this repository, what they find in the code today, and how often review raised each one's pattern. The CLI counts what the rules find itself, by running the same scan as check --anonymous, and an agent cannot supply or change those numbers. When the CLI could not run every rule (a rule written into another linter, a runtime rule, or a scan that failed), it publishes no counts rather than a partial total. With no flags it prints a draft of what the CLI knows, including those counts, and the facts an agent still has to supply; --from <facts.json> checks there are at least three working Taskless rules, withholds any fixture that looks like it holds a secret or contact detail, validates against the tskl.es schema, publishes, and records the report in .taskless/reports/ (gitignored, since each record holds the URL that deletes it); --delete <record> takes a report down. The new report agent topic walks an agent through it. Migration 11 creates .taskless/reports/.

  Onboarding now asks one question, "Do you want me to set up Taskless for you?", and does the rest: it mines every source it can reach, writes every rule the repository can enforce locally (always logged out), marks onboarding complete, publishes a report, sends Taskless onboarding feedback, and ends by strongly encouraging running the rules in CI. It asks anything else only when it cannot find enough rules for a report. GitLab merge requests are mined through glab the way GitHub pull requests are through gh.