pi-tasks 0.2.7

Release Notes 0.2.7

Highlights

• Merged PR #6 to make fresh Pi sessions lean: only task_plan and task_resume start active when no pi-tasks state exists.
• Restored the available pi-tasks controls after successful task creation, task-bearing session replay, and session-tree navigation.
• Preserved explicit host ceilings and unrelated tools: Pi allowlists, exclusions, noTools, and foreign task-like tools remain authoritative.
• Upgraded Vitest to 5.0.0 after audit reported the vulnerable @vitest/mocker dependency chain in the previous test stack.

Native Tool Activation

On native Pi hosts that expose getActiveTools, getAllTools, and setActiveTools, pi-tasks now reconciles only the tools it registered for the current extension API instance.

Fresh task-free sessions keep the entrypoint surface compact:

task_plan
task_resume

After a task is persisted or restored, pi-tasks activates the available task controls without adding names outside the host's configured registry or removing unrelated active tools.

Older compatible hosts without native activation APIs keep the previous all-tools behavior and retain full tool guidance in descriptions.

Verification Status

• Passed: security review found no concrete privilege-escalation, allowlist-bypass, denial-of-service, information-leak, prototype-pollution, path-injection, or unsafe-error-propagation issue in the PR #6 activation path.
• Passed: strict implementation review findings were resolved before merge: native test API mismatch, older-host prompt guidance preservation, native test release-gate coverage, package metadata cleanup, and audit failure.
• Passed: targeted native Pi SDK extension test with PI_SDK_ROOT=/tmp/pi-sdk-llLMrY/node_modules/@earendil-works/pi-coding-agent; fresh schema+description surface was 2969 chars and active task-state surface was 9266 chars.
• Passed: npm run release:check with PI_SDK_ROOT=/tmp/pi-sdk-llLMrY/node_modules/@earendil-works/pi-coding-agent after the 0.2.7 version bump; it covered typecheck, Biome check, unit tests, native Pi SDK extension tests, build, source/dist import smoke, pack dry run, clean tarball install smoke, and audit.
• Pending: manual npm publish.