[github-actions]

Build Info

npx @taskless/cli-nightly@0.13.7-20261108164307xb81c759

Built from: b81c759
Committed at: 2026-11-08 16:43:07

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@taskless/cli@0.13.7

Compare with v0.13.6

Patch Changes

• 374a7b6: taskless detect now recognizes C# repositories and the Roslynator, StyleCop and SonarAnalyzer analyzers. C# comes from a .csproj. Roslynator comes from its NuGet packages in an MSBuild file, packages.config or dotnet-tools.json, its keys in .editorconfig or .globalconfig, a .roslynatorconfig, or a CI or hook command that runs it. StyleCop and SonarAnalyzer are each reported as their own linter, from their NuGet package, their config file, or their diagnostic ids.

• a4e68ba: A project installed with a local development build of the CLI no longer refuses the nightly and release builds afterwards. The CLI now knows whether it is a release, a nightly or a development build from how it was built, instead of guessing from its version number, and the version recorded in install.launchers is the one each project launcher and the version check use. Install advice about pinned CLI versions no longer suggests a nightly version that was never published.

  The .taskless/ scaffold advances to version 13. Its migration moves a version recorded only as install.cliVersion, by a CLI that predates install.launchers, into install.launchers, so the CLI and the project launcher read that field alone. Run init to apply it. A CLI older than this release refuses a migrated project as newer than it understands, so update any pinned CLI in CI along with the migrated files.

• 8cd0269: taskless report --from no longer loses a published report's delete URL when its local record cannot be written. Two publishes in the same second used to collide on the record's file name, leaving the second report live for 30 days with no way to delete it. A taken name now moves to a _2, _3, … suffix, which --delete accepts. If the record still cannot be written, the command exits with REPORT_RECORD_FAILED and prints the report's URL and delete URL, which the --json envelope also carries as url and deleteUrl.

• 666ffe5: rule create and rule improve no longer leave part of a request on disk when one of its rules is refused. Every rule a request produced is now checked (its engine, its paths, and whether its file set is complete) before the first is written, so a refusal leaves .taskless/rules/ as it was. Under --json, these refusals now report RULE_GENERATION_FAILED or RULE_UNSUPPORTED instead of INTERNAL_ERROR.

  An IO failure while the rules are being written (a full disk, a directory the CLI cannot write to) no longer leaves the earlier rules on disk either: every rule is staged under .taskless/ first and moved into place afterwards, and a failure part-way moves back any rule already replaced, so .taskless/rules/ is left as it was and the command reports RULE_GENERATION_FAILED.

• 08e3b3e: taskless onboard and taskless report no longer migrate .taskless/ as a side effect. On a project whose scaffold is behind the CLI they now refuse with SCAFFOLD_MIGRATION_REQUIRED and ask you to run taskless init, the same way check, validate and verify do. Before, fetching the onboarding recipe or drafting a report could move and delete tracked files under .taskless/ without saying so. A project with no .taskless/ yet is set up exactly as before.

  taskless rule create, rule improve, rule restore and rule rollback refuse the same way, before contacting the service. Before, they migrated a behind scaffold on the way to writing the rule.

• 17bfded: taskless init now puts back a Taskless allow rule that was removed from a harness permission file (.claude/settings.json, .cursor/cli.json, and the rest) by a hand edit, a revert, or a merge. Previously the install trusted its own record over the file, so a removed rule stayed removed and the wizard showed no edit. A permission file that was deleted is recreated with the rule.

• 30db133: taskless rule restore and taskless rule rollback no longer leave a half-written rule when a write fails part-way, for example on a full disk or an unwritable file. The rule is written in full under .taskless/ first and then moved over its directory, and a failed move puts the previous version back, so .taskless/rules/ is left as it was. Under --json that failure is now RULE_RESTORE_FAILED, and a served rule that cannot be written is RULE_RESTORE_MISMATCH, rather than INTERNAL_ERROR. The rule directory is replaced as a whole, so files the served rule does not include no longer survive a restore, and the "stale entries could not be removed" notice is gone.

• 70321e8: agent route no longer reads as though a detected linter is missing. It now names every detected tool that can host a rule, and Oxlint gets its own create-legacy-rule --tool=oxlint guide.

• d1a2af2: verify --json now reports a status on each rule: passed, failed, not-run (the rule failed before its tests ran) or refused (the execution policy declined to run them). Branch on it instead of combining ok, ran and refused, where reading ok alone could report a rule that never ran as passing. The change is additive: ok, ran and refused are still reported and are now derived from status, so they always agree with it. validate runs no tests and does not report status.