release: v0.2.0 — S0–S4, Grok host, race/expand, DSL, adversarial closure

.claude-plugin/marketplace.json

@@ -10,14 +10,14 @@
   "plugins": [
     {
       "name": "taskflow",
-      "description": "Multi-phase subagent orchestration for Codex: the taskflow_* MCP tools (run/list/show/verify/compile) plus a skill that routes multi-phase or fan-out work to them. The MCP server runs via npx (codex-taskflow) — no separate global install required.",
+      "description": "Multi-phase subagent orchestration for Codex: 12 taskflow_* MCP tools (run/list/show/verify/compile/peek/trace/replay/why_stale/recompute/save/search) plus a routing skill. compile returns SVG + text outline. The server runs via npx (codex-taskflow).",
       "source": "./packages/codex-taskflow/plugin",
       "category": "developer-tools",
       "homepage": "https://github.com/heggria/taskflow"
     },
     {
       "name": "claude-taskflow",
-      "description": "Multi-phase subagent orchestration for Claude Code: the taskflow_* MCP tools (run/list/show/verify/compile/peek) plus a skill that routes multi-phase or fan-out work to them. The MCP server runs via npx (claude-taskflow) — no separate global install required.",
+      "description": "Multi-phase subagent orchestration for Claude Code: 12 taskflow_* MCP tools (run/list/show/verify/compile/peek/trace/replay/why_stale/recompute/save/search) plus a routing skill. compile returns SVG + text outline. The server runs via npx (claude-taskflow).",
       "source": "./packages/claude-taskflow/plugin",
       "category": "developer-tools",
       "homepage": "https://github.com/heggria/taskflow"

.github/workflows/ci.yml

@@ -24,13 +24,13 @@ jobs:
       matrix:
         node: ["22", "24"]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       # pnpm via corepack — the version is pinned by the `packageManager` field
       # in package.json, so every contributor and CI run use the same pnpm.
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ${{ matrix.node }}
           registry-url: "https://registry.npmjs.org"
@@ -49,11 +49,11 @@ jobs:
     name: e2e (codex MCP, network-free)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
           registry-url: "https://registry.npmjs.org"
@@ -93,15 +93,19 @@ jobs:
       - name: OpenCode MCP e2e (stdio handshake + tool calls)
         run: pnpm run test:e2e-opencode-mcp
 
+      # Grok MCP e2e is also stdio-only and does not require a live Grok model.
+      - name: Grok MCP e2e (stdio handshake + tool calls)
+        run: pnpm run test:e2e-grok-mcp
+
   build:
     name: build (dist emit)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
           registry-url: "https://registry.npmjs.org"
@@ -115,15 +119,65 @@ jobs:
       - name: Build all packages
         run: pnpm run build
 
+  packed-consumer:
+    name: packed consumer (9 packages)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --registry https://registry.npmjs.org/
+
+      # Pack with pnpm so workspace:* is rewritten exactly as it will be for
+      # publish. Install only those tarballs into a clean npm project, then
+      # exercise every explicit export and shipped bin.
+      - name: Build, pack, install, and smoke test all published packages
+        run: pnpm run test:pack
+
+  website:
+    name: website (production export)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          # The docs source records last-modified timestamps from git history.
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: "22"
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --registry https://registry.npmjs.org/
+
+      # Match the GitHub Pages deployment settings so base-path-only failures
+      # are caught before merge. `build` runs docs:check before the export.
+      - name: Validate docs and build production export
+        working-directory: website
+        run: pnpm run build
+        env:
+          TASKFLOW_BASE_PATH: /taskflow
+
   codeql:
     name: CodeQL (JS/TS)
     runs-on: ubuntu-latest
     permissions:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         with:
           languages: javascript-typescript
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4

.github/workflows/deploy-website.yml

@@ -9,6 +9,14 @@ on:
       - 'README.md'
       - 'README.zh-CN.md'
       - 'docs/**'
+      - 'packages/taskflow-core/**'
+      - 'packages/taskflow-dsl/**'
+      - 'skills-src/**'
+      - 'scripts/build-skills.mjs'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'tsconfig*.json'
       - '.github/workflows/deploy-website.yml'
   workflow_dispatch:
 
@@ -26,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           # Full history so the lastModified remark plugin can read accurate
           # git timestamps for every docs page (shallow clone would leave
@@ -37,10 +45,10 @@ jobs:
       # in the root package.json, so CI uses the same pnpm as local dev. The
       # website is a pnpm workspace member (pnpm-workspace.yaml), so one
       # `pnpm install` at the root installs every package including the website.
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
           cache: pnpm
@@ -55,7 +63,7 @@ jobs:
           TASKFLOW_BASE_PATH: /taskflow
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: website/dist
 
@@ -68,4 +76,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5