apps/mcp/tsconfig.json (1)

12-19: Redundant strict mode options; strict: true already enables these.

Line 12 sets "strict": true, which automatically enables all the individual strict-mode sub-options on lines 13–19 (noImplicitAny, strictNullChecks, strictFunctionTypes, etc.). Listing them explicitly is redundant but harmless.

Consider simplifying by removing lines 13–19, since they are already implied by "strict": true:

-	"strict": true,
-	"noImplicitAny": true,
-	"strictNullChecks": true,
-	"strictFunctionTypes": true,
-	"strictBindCallApply": true,
-	"strictPropertyInitialization": true,
-	"noImplicitThis": true,
-	"alwaysStrict": true,

.gitignore (1)

101-102: Clarify the purpose of the TaskMaster Workflow State comment.

The comments document that TaskMaster Workflow State is stored globally and doesn't require a .gitignore entry. This is helpful context, but consider rephrasing for clarity. The current wording might confuse readers who expect an actual .gitignore entry to be present or removed.

Suggested revision:

-# TaskMaster Workflow State (now stored in ~/.taskmaster/sessions/)
-# No longer needed in .gitignore as state is stored globally
+# Note: TaskMaster Workflow State is stored globally at ~/.taskmaster/sessions/
+# and does not require a .gitignore entry in this repository.

mcp-server/src/tools/research.js (1)

6-8: Improve the TODO comment for clarity and correct tracking.

The zod/v3 import path is valid according to official Zod documentation, which states the package exposes versioned subpaths for backward compatibility. The runtime import error risk is resolved.

However, improve the TODO comment for maintainability:

• Update the PR reference (currently references PR #1323, but this is PR #1324)
• Replace the PR reference with a specific GitHub issue number for tracking the reversion
• Clarify what "MCP spec issue" needs to be resolved (provide issue number or brief description)

Example: TODO: Revert to 'zod' when issue #XXXX is resolved (zod-to-json-schema Draft-07 support)

.env.example (1)

17-17: Add trailing newline and consider key ordering.

The static analysis tool suggests adding a blank line at the end of the file and reordering GOOGLE_APPLICATION_CREDENTIALS before VERTEX_LOCATION for consistency. These are minor formatting improvements.

Apply this diff to address the linting hints:

 VERTEX_LOCATION=us-central1
+GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-credentials.json
 # Optional: Path to service account credentials JSON file (alternative to API key)
-GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-credentials.json
+

packages/tm-core/src/auth/supabase-session-storage.ts (1)

105-105: Consider consistent parameter usage for clarity.

Line 105 now relies on the default allowExpired: true behavior, while line 81 (in getItem) and lines 134 (in removeItem) explicitly specify { allowExpired: true }. While functionally equivalent based on the default behavior, this inconsistency may confuse future maintainers about the intent.

Consider either:

1. Being explicit everywhere for clarity, or
2. Relying on defaults everywhere with a comment explaining the default behavior

Based on learnings.

-				const existingCredentials = this.store.getCredentials();
+				const existingCredentials = this.store.getCredentials({ allowExpired: true });

.changeset/open-tips-notice.md (1)

5-5: Consider clarifying the model names.

The changeset description is concise and user-facing. However, "4.5 haiku and sonnet" could be more explicit about the provider (e.g., "Claude 4.5 Haiku and Sonnet models") for readers unfamiliar with the naming convention.

-Add 4.5 haiku and sonnet to supported models for claude-code and anthropic ai providers
+Add Claude 4.5 Haiku and Sonnet models to supported claude-code and anthropic AI providers

mcp-server/src/tools/add-tag.js (1)

55-59: Sanitize logged arguments.

Avoid logging full args (may include large/sensitive fields). Log a whitelist.

- log.info(`Starting add-tag with args: ${JSON.stringify(args)}`);
+ log.info(
+   `Starting add_tag with args: ${JSON.stringify({
+     name: args.name,
+     copyFromCurrent: args.copyFromCurrent,
+     copyFromTag: args.copyFromTag,
+     fromBranch: args.fromBranch,
+     hasDescription: Boolean(args.description),
+     hasFile: Boolean(args.file)
+   })}`
+ );

mcp-server/src/tools/response-language.js (2)

41-42: Pass projectRoot to handleApiResult for parity/telemetry.

Other tools pass args.projectRoot; do the same here for consistent telemetry/context.

-      return handleApiResult(result, log, 'Error setting response language');
+      return handleApiResult(
+        result,
+        log,
+        'Error setting response language',
+        undefined,
+        args.projectRoot
+      );

---

27-33: Sanitize logged args.

Prefer a compact log over JSON.stringify(args).

- log.info(
-   `Executing response-language tool with args: ${JSON.stringify(args)}`
- );
+ log.info(
+   `Executing response_language with args: ${JSON.stringify({
+     hasProjectRoot: Boolean(args.projectRoot),
+     languageSet: typeof args.language !== 'undefined'
+   })}`
+ );

mcp-server/src/tools/update-subtask.js (2)

16-17: Avoid importing helpers from scripts path.

resolveTag should live under mcp-server/src/core/utils (or be re-exported) to keep MCP server utilities self-contained.
Move/alias resolveTag into a core utils module and update the import here for consistency with the utilities guidance.

---

52-53: Don’t log full args; redact prompt/details.

prompt may contain sensitive/long content. Log IDs and flags only.

- log.info(`Updating subtask with args: ${JSON.stringify(args)}`);
+ log.info(
+   `Updating subtask with args: ${JSON.stringify({
+     id: args.id,
+     tag: args.tag ?? null,
+     research: Boolean(args.research),
+     hasFile: Boolean(args.file)
+   })}`
+ );

mcp-server/src/tools/add-subtask.js (3)

49-57: Accept array for dependencies (keep string for backward compat).

MCP clients send JSON; arrays are more natural than comma-separated strings. Support both.

-      dependencies: z
-        .string()
-        .optional()
-        .describe('Comma-separated list of dependency IDs for the new subtask'),
+      dependencies: z
+        .union([z.string(), z.array(z.string())])
+        .optional()
+        .describe(
+          'Dependencies for the new subtask (array or comma-separated string)'
+        ),

And normalize before calling the direct function:

-  const result = await addSubtaskDirect({
+  const deps =
+    Array.isArray(args.dependencies)
+      ? args.dependencies
+      : (args.dependencies?.split(',').map(s => s.trim()).filter(Boolean) ?? undefined);
+  const result = await addSubtaskDirect({
     ...
-    dependencies: args.dependencies,
+    dependencies: deps,

---

16-17: Centralize resolveTag under MCP server utils.

Same as update-subtask: avoid reaching into scripts/modules.

---

73-75: Sanitize logged args.

Don’t log entire args (title/description/details may be verbose/sensitive).

- log.info(`Adding subtask with args: ${JSON.stringify(args)}`);
+ log.info(
+   `Adding subtask with args: ${JSON.stringify({
+     id: args.id,
+     hasTitle: Boolean(args.title),
+     hasDescription: Boolean(args.description),
+     hasDetails: Boolean(args.details),
+     status: args.status ?? 'pending',
+     hasDeps: Boolean(args.dependencies),
+     skipGenerate: Boolean(args.skipGenerate),
+     tag: args.tag ?? null,
+     hasFile: Boolean(args.file)
+   })}`
+ );

.changeset/kind-lines-melt.md (1)

1-21: Condense the changeset to a single, user-facing summary line.

Per repo guidelines, changeset entries should be brief and imperative. Move the detailed Problem/Solution notes to docs or the PR description, and keep a one‑liner here.

As per coding guidelines

 ---
 "task-master-ai": patch
 ---
-
-Fix MCP server compatibility with Draft-07 clients (Augment IDE, gemini-cli, gemini code assist)
-
-- Resolves #1284
-
-**Problem:**
-
-- MCP tools were using Zod v4, which outputs JSON Schema Draft 2020-12
-- MCP clients only support Draft-07
-- Tools were not discoverable in gemini-cli and other clients
-
-**Solution:**
-
-- Updated all MCP tools to import from `zod/v3` instead of `zod`
-- Zod v3 schemas convert to Draft-07 via FastMCP's zod-to-json-schema
-- Fixed logger to use stderr instead of stdout (MCP protocol requirement)
-
-This is a temporary workaround until FastMCP adds JSON Schema version configuration.
+Fix Draft‑07 compatibility for MCP clients by switching MCP tools to zod/v3 and logging to stderr (resolves #1284).

apps/mcp/src/tools/README-ZOD-V3.md (1)

36-36: Replace bare URL with a Markdown link (lint: MD034).

-   - Tracking: https://github.com/punkpeye/fastmcp/issues/189
+   - Tracking: [punkpeye/fastmcp#189](https://github.com/punkpeye/fastmcp/issues/189)

apps/docs/capabilities/mcp.mdx (2)

22-24: Avoid hard‑coding tool counts; they drift.

Prefer wording that won’t require docs updates when tools change.

-#### All Tools (Default)
-Loads all 36 available tools. Use when you need full Task Master functionality.
+#### All Tools (Default)
+Loads all available tools. Use when you need full Task Master functionality.

-#### Core Tools (Lean Mode)
-Loads only 7 essential tools for daily development. Ideal for minimal context usage.
+#### Core Tools (Lean Mode)
+Loads a minimal set of essential tools for daily development. Ideal for minimal context usage.

-#### Standard Tools
-Loads 15 commonly used tools. Balances functionality with context efficiency.
+#### Standard Tools
+Loads a commonly used set of tools. Balances functionality with context efficiency.

Also applies to: 42-44, 72-73

---

69-70: Verified: "lean" aliases "core" and custom-list parsing is case‑insensitive with hyphen/underscore normalization.

• Implementation: registerTaskMasterTools (mcp-server/src/tools/index.js) maps 'lean' → core and normalizes input using toLowerCase plus underscore↔hyphen replacements.
• Tests: tests/unit/mcp/tools/tool-registration.test.js covers 'lean' and case‑insensitive inputs (e.g., 'CORE').
• Optional: add a short Zod v3 tooling note near the "uses zod" mention in apps/docs/capabilities/mcp.mdx.

.taskmaster/docs/tdd-workflow-phase-0-spike.md (1)

6-11: Link the implementation file and drop the stale effort estimate.

• Make the referenced command file a clickable relative link.
• Remove "Estimated Effort" now that the phase is complete to avoid stale data.

-See `apps/cli/src/commands/autopilot.command.ts` for implementation.
+See [apps/cli/src/commands/autopilot.command.ts](../../apps/cli/src/commands/autopilot.command.ts) for implementation.

-## Estimated Effort
-2-3 days
+<!-- Effort omitted post-completion to keep this doc timeless -->

Also applies to: 120-122

apps/mcp/src/tools/autopilot/start.tool.ts (3)

18-37: Tighten input validation for safer defaults.

• taskId: ensure non‑empty.
• maxAttempts: integer ≥1 (and optionally cap to a sane upper bound).

- taskId: z
-   .string()
+ taskId: z
+   .string()
+   .min(1, 'taskId is required')
    .describe(
      'Main task ID to start workflow for (e.g., "1", "2", "HAM-123"). Subtask IDs (e.g., "2.3", "1.1") are not allowed.'
    ),
@@
- maxAttempts: z
-   .number()
+ maxAttempts: z
+   .number()
+   .int()
+   .min(1)
+   .max(10)
    .optional()
    .default(3)

---

14-16: Minor: consolidate imports from @tm/core.

-import { createTaskMasterCore } from '@tm/core';
-import { WorkflowService } from '@tm/core';
+import { createTaskMasterCore, WorkflowService } from '@tm/core';

---

46-51: Minor: simpler main‑task check and trim.

-function isMainTaskId(taskId: string): boolean {
-  // A main task has no dots in the ID after the optional prefix
-  // Examples: "1" ✓, "HAM-123" ✓, "1.1" ✗, "HAM-123.1" ✗
-  const parts = taskId.split('.');
-  return parts.length === 1;
-}
+function isMainTaskId(taskId: string): boolean {
+  const id = taskId.trim();
+  return id.length > 0 && !id.includes('.');
+}

packages/tm-core/src/auth/config.ts (1)

24-24: Non-null assertion on potentially undefined value.

The non-null assertion operator (BASE_DOMAIN!) asserts that BASE_DOMAIN will never be undefined, but there's no runtime validation to guarantee this. If both environment variables are undefined or empty strings, this will result in baseUrl: undefined! which equals undefined, potentially causing subtle runtime errors.

Consider adding runtime validation or maintaining a safe fallback value.

-	baseUrl: BASE_DOMAIN!,
+	baseUrl: BASE_DOMAIN || 'https://tryhamster.com',

Or add validation:

if (!BASE_DOMAIN) {
	throw new Error('BASE_DOMAIN must be configured via TM_BASE_DOMAIN or TM_PUBLIC_BASE_DOMAIN environment variable');
}

export const DEFAULT_AUTH_CONFIG: AuthConfig = {
	baseUrl: BASE_DOMAIN,
	// ...
};

.taskmaster/docs/tdd-workflow-phase-3-extensibility-guardrails.md (5)

199-215: Add a language hint to this fenced block.

Fix markdownlint MD040 by specifying a language, e.g., ```text.

---

110-135: Broaden framework detection.

Include modern Python and JS signals and config files.

-  if (await exists('pytest.ini') || await exists('setup.py')) {
+  if (await exists('pytest.ini') || await exists('tox.ini') ||
+      await exists('pyproject.toml')) {
     return Framework.Pytest
   }
@@
-  if (await exists('package.json')) {
+  if (await exists('package.json')) {
     const pkg = await readJSON('package.json')
     if (pkg.devDependencies?.vitest) return Framework.Vitest
     if (pkg.devDependencies?.jest) return Framework.Jest
+    if (pkg.scripts?.test?.includes('vitest')) return Framework.Vitest
+    if (pkg.scripts?.test?.includes('jest')) return Framework.Jest
+    if (await exists('vitest.config.ts') || await exists('vitest.config.js')) return Framework.Vitest
+    if (await exists('jest.config.ts') || await exists('jest.config.js')) return Framework.Jest
   }

---

62-69: Align coverage parsing with commands.

You’re parsing “pytest-cov XML,” but commands don’t emit it. Add explicit XML reports and file paths; likewise for Go.

-const output = await exec('pytest --cov --json-report')
+const output = await exec('pytest --cov --cov-report=xml:coverage.xml --json-report')

In parseCoverage, read coverage.xml (pytest) and coverage.out (Go).

Also applies to: 89-97

---

102-105: Clarify Go test file API naming.

getTestFileExtension returns "_test.go" which is a suffix, not an extension. Rename to getTestFileSuffix() or return ".go" here to avoid confusion.

---

283-287: Normalize phase casing in state.

Elsewhere phases use uppercase (e.g., FINALIZE/GREEN). Consider "currentPhase": "GREEN" for consistency.

apps/mcp/src/tools/autopilot/finalize.tool.ts (1)

81-96: Align nextAction payload shape with other tools.

This tool returns nextAction and nextSteps; complete.tool also returns actionDescription. Standardize the fields across tools to reduce client branching.

apps/mcp/src/tools/autopilot/complete.tool.ts (2)

21-29: Validate internal consistency of test results.

Add a refinement so total = passed + failed + skipped.

-  testResults: z
-    .object({
+  testResults: z
+    .object({
       total: z.number().describe('Total number of tests'),
       passed: z.number().describe('Number of passing tests'),
       failed: z.number().describe('Number of failing tests'),
       skipped: z.number().optional().describe('Number of skipped tests')
-    })
+    })
+    .refine(
+      (t) => t.total === t.passed + t.failed + (t.skipped ?? 0),
+      'total must equal passed + failed + skipped'
+    )
     .describe('Test results from running the test suite')

---

121-134: Standardize response fields across tools.

This tool returns actionDescription in addition to nextAction/nextSteps; finalize.tool omits it. Pick one consistent shape for all autopilot_* tools.

.taskmaster/docs/tdd-workflow-phase-1-orchestrator.md (1)

11-28: Fix fenced code block languages (MD040).

Add a language to these fences to satisfy markdownlint and improve rendering.

-```
+```text
 ...
-```
+```text

Also applies to: 154-166

apps/mcp/src/shared/utils.ts (1)

49-76: Propagate projectRoot to error responses for consistent tagging.

handleApiResult supports projectRoot, but withNormalizedProjectRoot doesn’t pass it on errors; include it so clients get the tag in failures too.

-    return handleApiResult({
+    return handleApiResult({
       result: {
         success: false,
         error: {
           message:
             'Could not determine project root. Please provide projectRoot argument or ensure TASK_MASTER_PROJECT_ROOT environment variable is set.'
         }
-      }
+      },
+      projectRoot: process.cwd()
     });
@@
-  return handleApiResult({
+  return handleApiResult({
     result: {
       success: false,
       error: {
         message: `Operation failed: ${error.message}`
       }
-    }
+    },
+    projectRoot: normalizedRoot ?? process.cwd()
   });

Also applies to: 218-255

packages/tm-core/src/git/scope-detector.ts (1)

6-7: Remove stray TODO.

The “// TODO: remove this” in header should be cleaned before release.

apps/cli/src/commands/autopilot.command.ts (1)

211-213: Ensure box width is an integer.

boxen expects an integer width; passing a float can lead to odd wrapping. Cast it.

-          width: process.stdout.columns ? process.stdout.columns * 0.95 : 100
+          width: process.stdout.columns ? Math.floor(process.stdout.columns * 0.95) : 100

mcp-server/src/tools/add-task.js (1)

93-93: Fix typo in comment.

The comment contains a typo: "functionP" should be "function".

-		// Call the direct functionP
+		// Call the direct function

CLAUDE.md (1)

36-39: Helpful documentation guidelines added.

The new section clarifies where documentation should be written and referenced.

The static analysis tool flags the bare URL on line 39. Consider wrapping it in markdown link syntax:

-- **Documentation URL**: Reference docs at https://docs.task-master.dev, not local file paths
+- **Documentation URL**: Reference docs at [docs.task-master.dev](https://docs.task-master.dev), not local file paths

apps/cli/tests/unit/commands/autopilot/shared.test.ts (1)

68-112: parseSubtasks mapping verified; consider one extra edge case.

Tests assert status normalization and default maxAttempts=3. Optionally add a case where subtasks exists but is empty to confirm it returns [].

Based on learnings.

docs/configuration.md (2)

430-466: Azure section: small editorial and clarity tweaks.

• “Ensure youre not getting rate limited...” → “you’re” and clarify TPM guidance.
• Explicitly note deployment-name vs model-name (you did—good). Consider adding a one-line curl example for 401/404 triage.

- Ensure youre not getting rate limited by `maxTokens` maintain appropriate Tokens per Minute Rate Limit (TPM) in your deployment.
+ Ensure you’re within your Azure TPM limits; adjust request sizes (`maxTokens`) or apply for higher quota to avoid rate limiting.

Also applies to: 471-478

---

132-156: Reinforce: keep non-secret settings out of .env.

Good alignment with repo rules. Add one sentence that MCP stdio servers must set TASK_MASTER_MCP=true to suppress logs that can corrupt JSON-RPC.

Based on learnings.

mcp-server/src/tools/README-ZOD-V3.md (2)

34-37: Replace bare URL with a proper Markdown link (lint).

Format the tracking URL to satisfy MD034.

- Tracking: https://github.com/punkpeye/fastmcp/issues/189
+ Tracking: <https://github.com/punkpeye/fastmcp/issues/189>

---

11-16: Add explicit zod version requirement to README-ZOD-V3.md and consider CI enforcement.

Verification confirms zod/v3 is supported in your installed zod@^4.1.11 (available since zod@3.25.0). All 36+ tool files consistently use the correct import pattern with zero plain zod imports found. However, the README lacks an explicit version requirement statement at the top (e.g., "Requires zod >= 3.25.0"), and no CI/linting checks were found to enforce the pattern. Update the README heading to include the version constraint and consider adding an eslint rule or CI check to prevent regressions.

packages/tm-core/src/git/branch-name-generator.spec.ts (1)

35-66: Nice coverage; add one uniqueness/collision test.

Consider asserting that two successive calls with same inputs yield distinct names if your generator appends a timestamp/nonce, or document determinism if not.

apps/cli/src/commands/auth.command.ts (2)

352-382: Use isDebugMode() instead of process.env.DEBUG for consistency.

Replace direct process.env.DEBUG checks with the shared isDebugMode() helper to keep behavior uniform.

- if (process.env.DEBUG) {
+ import { isDebugMode } from '../utils/error-handler.js';
+ if (isDebugMode()) {
     console.error(chalk.gray((contextError as Error).message));
   }

---

172-239: displayStatus formatting/time math are fine; consider minutes modulo.

Current code shows total minutes when <1h; optional: show “X minutes remaining” using Math.ceil and clamp at ≥1 for imminent expiry.

apps/mcp/package.json (1)

6-8: Nonstandard empty version; prefer removing or setting a valid SemVer.

For a private package this is harmless but some tooling breaks on empty strings. Use “0.0.0” or drop the field.

-  "version": "",
+  "version": "0.0.0"

apps/cli/src/commands/show.command.ts (2)

11-15: Disambiguate displayError to avoid confusion with ui.displayError.

Both error handlers exist (utils/error-handler and utils/ui). Rename the imported symbol for clarity and future-proofing.

-import { displayError } from '../utils/error-handler.js';
+import { displayError as displayException } from '../utils/error-handler.js';

---

116-118: Use the renamed error helper consistently (and consider not exiting inside catch).

Apply the alias from the import and, if you need post-error cleanup, pass { skipExit: true } and handle exit after cleanup.

-      displayError(error);
+      displayException(error);

Optionally:

-      displayException(error);
+      displayException(error, { skipExit: true });
+      await this.cleanup();
+      process.exit(1);

Ensure this command’s lifecycle requires immediate exit; otherwise, prefer explicit cleanup-first exit as shown.

README.md (4)

115-134: Use jsonc in examples that include comments.

These samples have // comments but the fence is JSON. Switch to jsonc to avoid copy-paste parse errors.

-```json
+```jsonc
 {
   "mcpServers": {
     "task-master-ai": {
       "command": "npx",
       "args": ["-y", "task-master-ai"],
       "env": {
-        // "TASK_MASTER_TOOLS": "all", // Options: "all", "standard", "core", or comma-separated list of tools
+        // "TASK_MASTER_TOOLS": "all", // Options: "all", "standard", "core", or comma-separated list of tools
         "ANTHROPIC_API_KEY": "YOUR_ANTHROPIC_API_KEY_HERE",

---

145-167: Also switch this block to jsonc.

Same comment style here; use jsonc for accuracy.

-```json
+```jsonc
 {
   "servers": {
     "task-master-ai": {

---

287-356: Document base-domain env vars used for web URLs.

display-helpers.ts reads TM_BASE_DOMAIN/TM_PUBLIC_BASE_DOMAIN to build links; add a brief note and example here so users know how header links are formed.

---

310-321: Unify npx args across samples.

You mix ["-y","task-master-ai"] and ["-y","--package=task-master-ai","task-master-ai"]. Pick one pattern and use it consistently to reduce confusion.

apps/cli/src/ui/components/header.component.ts (2)

33-61: Clarify API header fallback when briefInfo is missing.

If storageType='api' but briefInfo is absent, you render the tag (file-storage UX). Show a generic API source instead to avoid confusion.

-  if (storageType === 'api' && briefInfo) {
+  if (storageType === 'api') {
+    if (briefInfo) {
       // existing brief rendering...
-  } else if (tag) {
+    } else {
+      console.log(`Listing tasks from: ${chalk.dim('API (no context)')}`);
+      return;
+    }
+  } else if (tag) {

---

41-49: Guard against double slashes in URLs.

If webAppUrl ends with '/', the constructed URL contains '//home/...'. Either trim in helper (preferred) or here before interpolation.

apps/cli/src/utils/display-helpers.ts (2)

13-33: Normalize trailing slash in base domain.

Trim trailing slashes to avoid ‘//home/...’ when composing links downstream.

 function getWebAppUrl(): string | undefined {
   const baseDomain =
     process.env.TM_BASE_DOMAIN || process.env.TM_PUBLIC_BASE_DOMAIN;
 
   if (!baseDomain) {
     return undefined;
   }
 
-  // If it already includes protocol, use as-is
-  if (baseDomain.startsWith('http://') || baseDomain.startsWith('https://')) {
-    return baseDomain;
+  const sanitized = baseDomain.replace(/\/+$/, '');
+  // If it already includes protocol, use as-is
+  if (sanitized.startsWith('http://') || sanitized.startsWith('https://')) {
+    return sanitized;
   }
 
   // Otherwise, add protocol based on domain
-  if (baseDomain.includes('localhost') || baseDomain.includes('127.0.0.1')) {
-    return `http://${baseDomain}`;
+  if (sanitized.includes('localhost') || sanitized.includes('127.0.0.1')) {
+    return `http://${sanitized}`;
   }
 
-  return `https://${baseDomain}`;
+  return `https://${sanitized}`;
 }

---

64-74: Consistent storageType handoff.

If storageType='api' but no briefInfo, displayHeader currently falls back to tag UI. After adjusting header fallback, this is fine; otherwise consider forcing a generic API message here.

apps/cli/src/commands/autopilot/start.command.ts (2)

69-85: Ensure tmCore is closed on all paths.

tmCore is only closed on success and a couple of error branches. Close in finally to prevent resource leaks in tests/CI.

-export class StartCommand extends Command {
+export class StartCommand extends Command {
@@
-  private async execute(taskId: string, options: StartOptions): Promise<void> {
+  private async execute(taskId: string, options: StartOptions): Promise<void> {
@@
-    try {
+    // hoist for finally
+    let tmCore: Awaited<ReturnType<typeof createTaskMasterCore>> | undefined;
+    try {
@@
-      const tmCore = await createTaskMasterCore({
+      tmCore = await createTaskMasterCore({
         projectPath: mergedOptions.projectRoot!
       });
@@
-      await tmCore.close();
     } catch (error) {
       formatter.error((error as Error).message);
       if (mergedOptions.verbose) {
         console.error((error as Error).stack);
       }
       process.exit(1);
-    }
+    } finally {
+      try { await tmCore?.close(); } catch {}
+    }

Also applies to: 118-166

---

106-116: Persist active tag in workflow metadata.

Commit command reads state.context.metadata.tag. Set it here for consistent commit messages.

 const context: WorkflowContext = {
   taskId: task.id,
   subtasks,
   currentSubtaskIndex: 0,
   errors: [],
   metadata: {
     startedAt: new Date().toISOString(),
-    tags: task.tags || []
+    tags: task.tags || [],
+    tag: currentTag || 'master'
   }
 };

apps/cli/src/utils/ui.ts (1)

135-141: getBoxWidth: consider stderr for error boxes.

When piping stdout, process.stdout.columns may be undefined; for displayError you might prefer process.stderr.columns.

apps/mcp/src/tools/autopilot/abort.tool.ts (2)

17-21: Make projectRoot optional to leverage env/session resolution.

withNormalizedProjectRoot already resolves projectRoot; requiring it in the schema forces callers to pass it.

-const AbortSchema = z.object({
-  projectRoot: z
-    .string()
-    .describe('Absolute path to the project root directory')
-});
+const AbortSchema = z.object({
+  projectRoot: z
+    .string()
+    .describe('Absolute path to the project root directory')
+    .optional()
+});

---

38-45: Minor: include hadWorkflow=false note in logs.

You already return hadWorkflow; also log it at info for symmetry with success path.

apps/cli/src/utils/error-handler.ts (2)

56-59: Prefer setting exitCode over hard process.exit for safer teardown

process.exit(1) can cut off logs/async cleanup. Set exitCode and return; let the caller decide if/when to exit.

-  if (!options.skipExit) {
-    process.exit(1);
-  }
+  if (!options.skipExit) {
+    process.exitCode = 1;
+  }

---

14-16: Make DEBUG detection a bit more forgiving (optional)

Support TRUE/On/Yes (case-insensitive) to match common conventions; keeps current behavior too.

-export function isDebugMode(): boolean {
-  return process.env.DEBUG === 'true' || process.env.DEBUG === '1';
-}
+export function isDebugMode(): boolean {
+  const v = (process.env.DEBUG ?? '').trim().toLowerCase();
+  return v === 'true' || v === '1' || v === 'on' || v === 'yes';
+}

packages/tm-core/src/auth/credential-store.test.ts (1)

496-510: Intentional: expired credentials still count as “present”

Matches the design where refresh is handled upstream (Supabase). Consider documenting this nuance in CredentialStore.hasCredentials JSDoc.

packages/tm-core/src/git/commit-message-generator.test.ts (3)

115-123: Rename for accuracy: it defaults to “repo” scope, not “omit scope”

Align the title with behavior.

-it('should omit scope if not detected', () => {
+it('should default to repo scope when none detected', () => {

---

22-30: Path consistency (optional)

Repo uses apps/cli; the test references packages/cli. Adjust if scope detection relies on path segments.

- changedFiles: ['packages/cli/src/commands/start.ts']
+ changedFiles: ['apps/cli/src/commands/start.ts']

---

202-219: Consider expanding valid types coverage (optional)

If supported, include perf, build, ci, revert in valid types to harden validation.

-  const validTypes = [
+  const validTypes = [
     'feat',
     'fix',
     'docs',
     'style',
     'refactor',
     'test',
-    'chore'
+    'chore',
+    'perf',
+    'build',
+    'ci',
+    'revert'
   ];

.taskmaster/docs/autonomous-tdd-git-workflow.md (6)

297-313: Add language to fenced code block (markdownlint MD040)

Use text for ASCII layout.

-```
+```text
 ┌─────────────────────────────────────┬──────────────────────────────────┐
 ...
 └─────────────────────────────────────┴──────────────────────────────────┘

---

`339-363`: **Add language to fenced code block (MD040)**

This is plain text context; tag it.

```diff
-```
+```text
 You are implementing:
 Task #42 [analytics]: User metrics tracking
 ...

---

`429-435`: **Specify language for test output block (MD040) and avoid underscore emphasis (MD050)**

Tag code fence and switch any _emphasis_ outside code blocks to **bold**.

```diff
-```
+```text
 FAIL src/api/__tests__/metrics.test.js
 ...

Additionally, search/replace single underscores used for emphasis outside code blocks with asterisks.

---

`550-564`: **Add language to artifact structure block (MD040)**

Tag as text.

```diff
-```
+```text
 .taskmaster/reports/runs/2025-01-15-142033/
 ├── manifest.json
 ...

---

`39-42`: **Grammar nit: “30min” → “30 min”**

Small readability fix.

```diff
-- **Efficiency**: Average time from task start to PR < 30min for simple subtasks
+- **Efficiency**: Average time from task start to PR < 30 min for simple subtasks

---

909-912: Fix list indentation (MD005/MD007)

Align the final list item’s indent with peers.

- - Surgical Test Generator: .claude/agents/surgical-test-generator.md
+- Surgical Test Generator: .claude/agents/surgical-test-generator.md

apps/cli/src/commands/autopilot/abort.command.ts (1)

14-14: Lazy‑load inquirer only when prompting to cut startup cost.

Import inquirer dynamically inside the confirmation branch; remove the top‑level import. Small perf win for non‑interactive/JSON flows.

-import inquirer from 'inquirer';
@@
-      // Confirm abort if not forced or in JSON mode
+      // Confirm abort if not forced and not in JSON mode
       if (!mergedOptions.force && !mergedOptions.json) {
+        const { default: inquirer } = await import('inquirer');
         const { confirmed } = await inquirer.prompt([

Also applies to: 69-87

apps/cli/src/commands/autopilot/next.command.ts (1)

94-111: Make test command configurable.

Hard‑coding "npm test" limits portability (pnpm/yarn/custom scripts). Read from config/env and default to npm if absent.

apps/mcp/src/tools/autopilot/commit.tool.ts (2)

17-31: Let withNormalizedProjectRoot supply projectRoot; make it optional in schema.

Schema requires projectRoot, preventing env/session fallback. Mark it optional.

Based on learnings

-const CommitSchema = z.object({
-  projectRoot: z
-    .string()
-    .describe('Absolute path to the project root directory'),
+const CommitSchema = z.object({
+  projectRoot: z
+    .string()
+    .optional()
+    .describe('Absolute path to the project root directory (optional; can be inferred from TASK_MASTER_PROJECT_ROOT or session)'),

Also applies to: 44-46

---

154-170: Dead/unreached branch for commit message type.

You already enforce tddPhase === 'COMMIT'; the else branch is unreachable. Simplify to a fixed type (e.g., 'feat') or derive from context (subtask metadata).

apps/cli/src/commands/autopilot/complete.command.ts (1)

31-34: --coverage is unused. Either wire it into output/validation or drop the flag.

Currently accepted but ignored, which confuses users.

Option A (use it): include coverage in success payloads.

-      .option('-c, --coverage <percent>', 'Coverage percentage')
+      .option('-c, --coverage <percent>', 'Coverage percentage')
@@
-          formatter.success('RED phase completed', {
+          formatter.success('RED phase completed', {
             nextPhase: 'GREEN',
-            testResults,
+            testResults,
+            coverage: mergedOptions.coverage,
             subtask: currentSubtask?.title
           });
@@
-          formatter.success('GREEN phase completed', {
+          formatter.success('GREEN phase completed', {
             nextPhase: 'COMMIT',
-            testResults,
+            testResults,
+            coverage: mergedOptions.coverage,
             subtask: currentSubtask?.title,
             suggestion: 'Run: autopilot commit'
           });

Option B (remove it): delete the flag until it’s implemented.

Also applies to: 14-17

apps/cli/src/commands/autopilot/commit.command.ts (1)

101-116: Allow custom commit message when provided.

Respect -m/--message, else use generator.

Apply:

-// Generate commit message
-const messageGenerator = createCommitMessageGenerator();
-const testResults = state.context.lastTestResults;
-const commitMessage = messageGenerator.generateMessage({
+// Generate or use custom commit message
+const messageGenerator = createCommitMessageGenerator();
+const testResults = state.context.lastTestResults;
+const commitMessage = mergedOptions.message ?? messageGenerator.generateMessage({
   type: 'feat',
   description: currentSubtask.title,
   changedFiles,
   taskId: state.context.taskId,
   phase: 'TDD',
   tag: (state.context.metadata.tag as string) || undefined,
   testsPassing: testResults?.passed,
   testsFailing: testResults?.failed,
   coveragePercent: undefined // Could be added if available
 });

.taskmaster/docs/tdd-workflow-phase-1-core-rails.md (7)

326-333: Integrity risk: trusting AI‑reported test counts without local verification

Consider an optional verification step (feature‑flagged) where TaskMaster re‑runs a lightweight test command or validates a machine‑readable report (e.g., JUnit/TAP) before allowing COMMIT. This prevents false positives from misreported results.

Would you like a minimal design for “tm autopilot verify” (runs project test command with timeout, parses counts, compares to reported)?

---

1076-1083: Tautology: “CLI Interface”

Prefer “CLI” to avoid “Command Line Interface Interface.” Rename the section header.

---

66-110: Add language to fenced block

Specify a language (e.g., text) for the flow block to satisfy markdownlint MD040.

-```
+```text
 ...

---

`354-373`: **Add language to fenced block**

Specify language (text) for the directory tree. 

```diff
-```
+```text
 ...

---

`474-481`: **Add language to fenced block**

Specify language (text) for the project tree. 

```diff
-```
+```text
 ...

---

`516-527`: **Add language to fenced block**

Specify language (text or git-commit) for the commit template. 

```diff
-```
+```text
 ...

---

`530-543`: **Add language to fenced block**

Specify language (text) for the example commit. 

```diff
-```
+```text
 ...

</blockquote></details>
<details>
<summary>apps/cli/src/commands/next.command.ts (2)</summary><blockquote>

`109-114`: **Validate project path before initializing core**

Fail fast if the provided project path doesn’t exist or isn’t a directory. 

```diff
+import fs from 'node:fs';
...
 private async initializeCore(projectRoot: string): Promise<void> {
   if (!this.tmCore) {
     const resolved = path.resolve(projectRoot);
+    if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {
+      throw new Error(`Project root does not exist or is not a directory: ${resolved}`);
+    }
     this.tmCore = await createTaskMasterCore({ projectPath: resolved });
   }
 }

---

199-201: CLI hint references “task-master”; ensure correct binary name

If the binary is “tm”, update the hint (or derive dynamically).

-`Tip: Try` task-master list --status pending
+`Tip: Try` tm list --status pending

Please confirm the canonical CLI binary (“tm” vs “task-master”) so we can update all help texts consistently.

mcp-server/src/tools/tool-registry.js (2)

1-4: Doc mismatch: 36 vs 44 tools

Update the header comments to reflect the current count (44).

Also applies to: 56-58

---

58-103: Canonicalize tool name to snake_case with backward‑compat alias

Guideline: use snake_case for tool names exposed to clients. Keep 'response-language' as a legacy alias but prefer 'response_language' as the canonical key.

 export const toolRegistry = {
   initialize_project: registerInitializeProjectTool,
   models: registerModelsTool,
   rules: registerRulesTool,
-  parse_prd: registerParsePRDTool,
-  'response-language': registerResponseLanguageTool,
+  parse_prd: registerParsePRDTool,
+  response_language: registerResponseLanguageTool,   // canonical
+  'response-language': registerResponseLanguageTool, // legacy alias
   analyze_project_complexity: registerAnalyzeProjectComplexityTool,
   ...
 };

As per coding guidelines.

packages/tm-core/src/git/git-adapter.test.ts (2)

348-356: Prefer top‑level import for simple‑git in tests

Avoid dynamic import() in tests per guidelines; import once at top for consistency and performance.

- simpleGit = (await import('simple-git')).default;
+ // at top of file:
+ import simpleGit from 'simple-git';

As per coding guidelines.

Also applies to: 600-608, 840-848, 1069-1077

---

238-246: Use rejects assertion instead of manual fail()

Make failures deterministic and readable.

-try {
-  await gitAdapter.ensureGitRepository();
-  fail('Should have thrown error');
-} catch (error) {
-  expect(error.message).toContain('not a git repository');
-}
+await expect(gitAdapter.ensureGitRepository()).rejects.toThrow('not a git repository');

Also applies to: 586-592

mcp-server/src/tools/index.js (1)

73-87: Normalize custom tool names: expand aliasing and DRY the resolution

Resolution loop is thorough; consider centralizing alias/normalization (underscore↔hyphen, case‑insensitive) into a helper to reduce duplication and ease future aliases.

I can extract resolveToolName(toolName, registryKeys, aliasMap) and add unit tests.

Also applies to: 91-118

apps/cli/src/commands/autopilot/shared.ts (2)

130-139: Improve array/depth handling in text output

Arrays print as object entries; large/deep objects can spam the console. Consider array-aware formatting and max depth.

Also applies to: 144-153

---

255-262: Preserve existing attempts and normalize statuses

If subtask has attempts/status variations, keep them; default to 0 only when missing; map common status values.

Apply:

 return task.subtasks.map((subtask: any) => ({
   id: subtask.id,
   title: subtask.title,
-  status: subtask.status === 'done' ? 'completed' : 'pending',
-  attempts: 0,
+  status:
+    subtask.status === 'done' || subtask.status === 'completed'
+      ? 'completed'
+      : 'pending',
+  attempts:
+    typeof subtask.attempts === 'number' && Number.isFinite(subtask.attempts)
+      ? subtask.attempts
+      : 0,
   maxAttempts
 }));

packages/tm-core/src/git/commit-message-generator.ts (1)

92-108: Optional: pre‑validate before rendering

Consider validating type/description and throwing early in generateMessage to avoid rendering bad messages.

apps/cli/src/commands/context.command.ts (1)

434-439: Await on sync method (cosmetic)

clearContext() is synchronous now; awaiting is unnecessary.

Apply:

-      await this.authManager.clearContext();
+      this.authManager.clearContext();

packages/tm-core/src/git/git-adapter.ts (2)

562-612: Commit gating depends on staged detection

createCommit() relies on hasStagedChanges(); once fixed, ensure error text remains accurate; consider fallback to “git diff --cached --name-only”.

---

676-694: Default branch detection could use origin/HEAD (optional)

Optionally read symbolic‑ref of origin/HEAD when available before fallback.

mcp-server/src/tools/rules.js (1)

6-8: Consistent zod/v3 migration pattern.

The import change follows the same pattern established in other MCP tool files, maintaining consistency across the codebase.

mcp-server/src/tools/fix-dependencies.js (1)

6-8: Consistent zod/v3 migration pattern.

The import change follows the same pattern established in other MCP tool files.

mcp-server/src/tools/scope-down.js (1)

6-8: Consistent zod/v3 migration pattern.

The import change follows the same pattern established in other MCP tool files.

mcp-server/src/tools/get-task.js (1)

6-8: Consistent zod/v3 migration pattern.

The import change follows the same pattern established in other MCP tool files.

mcp-server/src/tools/parse-prd.js (1)

6-8: Consistent zod/v3 migration pattern.

The import change follows the same pattern established in other MCP tool files.