v0.3.4

What changed

• Harden public-release privacy validation for credential-like URL query parameters.
• Detect covered parameters in raw, HTML-escaped, and percent-encoded forms.
• Cover common token, secret, password, signature, and provider-signed URL parameter names without echoing their values.
• Preserve ordinary query parameters, similar non-credential names, and empty values.

Verification

• 47 automated tests passed.
• The executable synthetic demo passed.
• Public-release validation passed on the merged release commit.
• Clean consumer installation and CLI invocation passed.
• The npm dry run contained 33 intended files.
• The official Codex plugin validator and all six bundled Skill validators passed.
• GitHub Actions passed on Ubuntu/Node 18, Ubuntu/Node 22, Windows/Node 20, and macOS/Node 20.

This release adds no runtime dependencies, hosted services, telemetry, or automatic permission grants.

Full Changelog: v0.3.3...v0.3.4

v0.3.3

Adds a 38-second README demo generated from the real CLI with synthetic data, showing task initialization, deterministic stall detection, evidence verification, and privacy-safe handoff generation. The reviewed GIF is protected by an exact binary allowlist while all other public files remain covered by fail-closed UTF-8 and privacy scans.

v0.3.2 - npm distribution and trusted publishing

Highlights

• Added npm CLI distribution with npx and global-install onboarding.
• Added tokenless GitHub Actions trusted publishing through npm OIDC.
• Expanded English and Chinese documentation, compatibility guidance, and the maintainer case study.
• Added release and publish orchestration coverage.

Verification

• 45/45 automated tests passed.
• GitHub CI passed on Ubuntu, Windows, and macOS.
• Privacy scan passed across 61 repository files.
• Fresh consumer install and npm package dry-run passed.

Try it

npx --yes codex-task-control-tower@0.3.2 --help

v0.3.1 - Deterministic task health and portable installs

Highlights

• Adds deterministic inactivity assessment with warning and stalled states.
• Adds five machine-readable synthetic task timelines for repeatable testing.
• Verifies clean npm consumer installation on Windows, macOS, and Ubuntu.
• Documents Codex plugin and six Skill compatibility checks.
• Strengthens release privacy scanning and package validation.

Verification

• 43/43 automated tests passed.
• Public privacy scan passed across 58 files.
• GitHub Actions passed on Ubuntu Node 18/22, macOS Node 20, and Windows Node 20.
• Official Codex plugin validator and all six Skill validators passed.
• npm consumer-install smoke test and npm publish dry-run passed.

Download

The release includes codex-task-control-tower-0.3.1.tgz for direct local installation.

SHA-256: a583563c9f33ae5714336bd6cabbdd235a7133fd69e58b943fb14923ef4fb692

Full details: see CHANGELOG.md and docs/compatibility.md.

v0.3.0 - Runnable evidence ledger

This release turns the project into an executable local control tower while preserving the existing Codex Skill workflow.

Highlights:

• zero-dependency local state engine and codex-control-tower CLI
• dependency-ready task selection and evidence-backed completion
• repeated-failure stop and explicit resume semantics
• verification gate with machine-readable exit codes
• sanitized Markdown handoffs and stronger public-release scanning
• executable synthetic demo and cross-platform CI

Verified with 35 automated tests, the real CLI demo, a 50-file privacy scan, npm packaging, and the official Codex plugin and Skill validators.

v0.2.1 - Verifiable OSS release

Highlights

• Evidence-based long-task status and stall detection
• Privacy-safe handoff and public-release scanning
• Bilingual 60-second quick-start documentation
• GitHub Actions validation and contribution templates

Verification

• 18/18 automated tests passed
• 43 public files passed the privacy scan
• npm audit reported 0 vulnerabilities
• plugin validator and all six Skill validators passed

The six core Skills remain behaviorally unchanged in this release.

v0.2.0 - Bounded Development Orchestration

What changed

• Added execution-controller as one end-to-end entry point for bounded software objectives.
• Added development-planner for smallest-sufficient dependency graphs.
• Added skill-router for honest routing to currently available Skills.
• Added verification-gate for behavior, focused-test, regression, privacy, and release evidence.
• Preserved evidence-backed task monitoring and privacy-safe handoffs.

Safety boundary

This remains a local-first, Skills-only plugin. It is not a background daemon, does not install missing Skills, and does not authorize credentials, production data, deployment, publishing, or destructive operations.

Verification

• 18/18 tests passed
• Public privacy validation passed for 34 files
• Official Codex plugin validator passed
• All 6 bundled Skills passed the official Skill validator

v0.1.0 - Initial public release

Initial public release of Codex Task Control Tower. Includes evidence-backed task status reporting, sanitized handoff workflows, privacy-safe public-release validation, reusable templates, and automated tests. Verified with 11 passing tests, public privacy validation, and the official Codex plugin validator.