CloudBlogDocs

Taskless v0.13.0: Smoother Setup and Shareable Reports

Jakob Heuser

Things move fast when making tools for Agents! Since this post was written, we released 0.13.1 with even better support for Claude's auto permissioning mode.

0.13.0 gets you from nothing to working rules with one command and one question. When it's done, you get a report page that shows what those rules find in your code today, ready to send to whoever needs convincing.

npx @taskless/cli

The setup wizard handles your agent's permissions

Agent harnesses have gotten stricter about download-and-run commands, and npx @taskless/cli was sort of our jam... deterministic recipes and skills surfaced only when the agent needed them. Claude's auto-classifier had different opinions though. Before 0.13.0 an agent could start onboarding and get stopped partway through by a permission prompt, or by a classifier that refused the call outright.

Running npx @taskless/cli with no arguments starts the setup wizard, and it now sets this up for you. It finds the harnesses in your project and allows exactly the installed CLI version in each one:

  • Claude Code, in .claude/settings.json
  • Cursor, in .cursor/permissions.json and .cursor/cli.json
  • OpenCode, in opencode.json or opencode.jsonc
  • Codex, in .codex/rules/taskless.rules

Every rule names one version and can't match any other. Each file ends up with exactly one Taskless rule. Older Taskless allow rules are removed, and deny rules and rules for anything else are left alone.

Claude Code's auto mode needed one more step. Its classifier can refuse downloaded code even when the project allows that exact command, and it only reads its own exceptions from your user settings. So the wizard also offers one entry for autoMode.allow in ~/.claude/settings.json. It covers a Taskless call only when the call names an exact version.

You see all of it before anything is written. The wizard lists every edit as an ALLOW (project):, REMOVE (project): or ALLOW (global): line, naming the command and the file, and asks one question: "Make these changes to your settings?"

The tool list got simpler too. Codex, Gemini CLI, Crush and the other harnesses that read .agents/ now share one row, labelled with the ones it found.

0.13.1 makes auto mode smoother still

0.13.1 follows right behind with two fixes for Claude Code's auto mode.

Agents like to wrap a call in shell plumbing, something like S=<scratchpad> && mkdir -p $S && npx @taskless/cli@0.13.0 ..., and the classifier refused those lines even with the autoMode.allow entry in place. The skill now has the agent run every Taskless command as its own call with nothing chained around it, which also fixes a zsh quirk where a chained echo ====== quietly skipped the next command. The entry itself now covers a call that sets a variable, changes or creates a directory, or redirects its output to a file on the same line.

The wizard also keeps that entry current. If ~/.claude/settings.json has an older Taskless entry, running npx @taskless/cli shows a REPLACE (global): line and swaps it in place under the same one question. If auto mode still refuses a call while the current entry is there, the agent says so and stops asking you to add it.

Onboarding is one question

Once the CLI is installed, ask your agent to onboard with Taskless. It asks you one thing:

Do you want me to set up Taskless for you?

Say yes and it does the rest. It mines every source it can reach for corrections that keep coming back: pull request review comments through gh, GitLab merge requests through glab, and your commit history. Commits matter more than you'd expect. In a repository that's reviewed before the PR opens, or written mostly by agents, the fix-up commits are often the only place a recurring pattern shows up.

Then it writes every rule your repository can enforce locally, with no account needed, publishes a report, and finishes by strongly encouraging you to run the rules in CI. It only comes back with more questions if it couldn't find enough rules to report on.

Taskless reports

taskless report publishes an unlisted page to tskl.es showing the rules in your repository, what each one finds in the code today, and how often review raised its pattern. Every rule carries a sentence or two on why it's worth holding in this codebase. Here's the report for getsentry/sentry:

The CLI counts the findings itself, running the same scan as check --anonymous. An agent can't supply or change those numbers. If the CLI couldn't run every rule, the page shows no counts instead of a partial total.

The page also prices it. Each prevented review comment is worth 15 minutes of reviewer time at $110 an hour by default, which is a $210k engineer's base plus a little overhead, and both are sliders on the page so the reader can plug in their own team's numbers.

Onboarding publishes one for you. To run it yourself, ask your agent for a Taskless report, or drive it directly:

taskless report
taskless report --from facts.json
taskless report --delete <record>

With no flags it prints a draft of what the CLI knows and the facts an agent still has to fill in. --from needs at least three working rules, holds back any fixture that looks like it contains a secret or contact detail, and publishes. Each report is recorded in .taskless/reports/, which is gitignored since the record holds the URL that deletes the page. --delete takes a report down.

validate and verify replace verify and test

This is the breaking change. The two rule-checking commands are renamed for the question each one answers:

  • validate, formerly verify, asks whether the rule is well formed. It decides from the rule's files alone.
  • verify, formerly test, asks whether the rule checks what you want. It runs validate, then the fixtures.

What to change:

  • taskless test fails as an unknown command. Call taskless verify, which gives the same output.
  • taskless verify still runs, but it now runs the fixtures too, so it's stricter and slower. For the old quick check, call taskless validate.
  • A pre-commit hook installed from the hooks recipe runs taskless test, and fails until it says taskless verify.

validate also catches more on ast-grep rules. It has ast-grep load the rule on its own, so a kind the grammar doesn't have (like readonly) is rejected under that rule's name, where before it passed and then broke every ast-grep rule's report in check. A top-level strictness: is rejected, since ast-grep ignores it there. Three silent authoring traps show up as notices that never fail a rule.

Released builds pin their own version

The installed skill and every agent recipe now name npx @taskless/cli@<version>, so an agent runs exactly the version your project installed. Commands the CLI prints for you are pinned the same way. To upgrade, run the wizard again.

init also reports stale Taskless pins in CI and git hook files (GitHub Actions, GitLab CI, CircleCI, husky, lefthook, pre-commit and the rest) by file and line, with the version to move to. It never edits those files.

/tskl is gone

The /tskl slash command is removed, and upgrading deletes the copies an earlier install wrote. Ask your agent in plain language instead, like "set up Taskless" or "add Taskless to CI". The Taskless skill picks that up the same way /tskl did.

Also in this release

  • The skill runs taskless agent ok once per session before anything else, so a harness that blocks the CLI stops the agent before it starts work. When that happens the agent names the exact command and offers a way forward, and never proposes an allow rule that wildcards the package or version.
  • Your agent can send us general feedback (taskless agent feedback) or a bug report (taskless agent bug-report) for you, without a GitHub account. You see the exact payload and nothing is sent without your yes.
  • check refuses a path outside the project with exit 1. Missing paths inside it are still skipped, so piping git diff --name-only keeps working, but they're now named in a notice.
  • verify tells you when an ast-grep rule's files: or ignores: globs match nothing in the project, which used to pass quietly while check never ran the rule.
  • Rule-authoring recipes copy test cases from real code in your repository before inventing any, and write cases your existing linters would accept.
  • taskless detect --json reports ast-grep and Vale configurations as linters, lists host tools like gh, git, jq and glab, and suggests commands an agent can use to check a source is usable.

The full changelog is on taskless/cli#484, and the 0.13.1 fixes are in v0.13.0...v0.13.1.

Getting it

npx @taskless/cli