claude task master - Moses Yebei

The Problem

AI-driven development workflows need structured task management that persists across sessions and editors. Existing solutions either lack integration points for tooling or impose heavy framework constraints. This repo addresses that gap by providing a task-management system designed to work with any AI chat interface, but the codebase shows signs of architectural debt that affect maintainability.

What This Does

The repository is a collection of 6 self-contained projects (packages, apps, mcp-server, src, scripts, bin) totaling 1253 files. Core functionality lives in packages/tm-core/src and is consumed by 372 package files and 262 app files. Entry point run at packages/tm-core/src/modules/loop/loop-domain.ts:60 reaches 191 functions, while start at apps/cli/src/utils/auth-ui.ts:50 reaches 225 functions. The system touches filesystem via 40 functions (reads/writes) and makes outbound network calls through 1 function. Key data flows include execute -> handleApiResult (43 times), register -> addCommand (16 times), and getContext called from 44 places. Hub module scripts/modules/utils.js has 117 dependents and 1340 lines across 7 high cognitive-load findings.

How It Is Wired

Control flows through established entry points: run initiates the main loop, start handles CLI authentication, execute in apps/cli/src/commands/autopilot/abort.command.ts:29 reaches 242 functions and is the primary command execution path. Import cycles affect 38 modules across scripts/modules/utils.js, scripts/modules/config-manager.js, and scripts/modules/task-manager.js — these cycles increase blast radius when modifying shared logic. The most connected module scripts/modules/utils.js has Ca=117, Ce=3 and participates in a cycle, meaning changes ripple widely. packages/tm-core/src/index has instability 0.95 (Ca=2, Ce=41), making it a high-risk consolidation point. Paths from entry to filesystem: run -> finalize -> finalizeWorkflow -> getContext [fs.readFileSync]; start -> doGenerate -> getApiKey [fs.readFile].

How To Use It

Setup: No Dockerfile present. Project uses npm as package manager (4 package.json files in apps/cli, apps/docs, apps/extension, apps/mcp). Install with npm install at repo root.

Configuration: Required environment variables defined in .env.example. No committed secrets found, but configure API keys per editor integration guide.

Running it: CLI entry via npm run scripts defined in apps/cli/package.json. For Cursor integration, add Taskmaster MCP server using the Claude Code deeplink. For CLI use: npx task-master after installation.

Real-World Use

In a typical AI development workflow, a user runs task-master create --title "Implement auth" to persist a task. The execute command routes through handleApiResult to update storage via api-storage.ts constructor functions (validateConfig, initialize, getStorageType). Tags and workstreams are managed through packages/tm-core/src/modules/tags and workstreams domains. The system writes task state to .taskmaster/ directory, preserving context across editor restarts. Team collaboration uses the shared brief infrastructure in packages/tm-core/src/modules/briefs/.

Code Health & Issues

HIGH: Pin third-party GitHub Actions to commit SHA — .github/workflows uses dorny/paths-filter@v3, changesets/action@v1, stefanzweifel/git-auto-commit-action@v5 without SHAs; tags can move and leak secrets.
MEDIUM: Declare least-privilege permissions for GITHUB_TOKEN — 1 workflow declares no permissions, inheriting repository defaults.
MEDIUM: Enable Dependabot or Renovate — 11 manifest(s) with no update bot configured; advisories remain unpatched.
MEDIUM: Gate pull requests on dependency vulnerability scan — no dependency scan in CI; vulnerable packages can reach build.
MEDIUM: Set persist-credentials: false on checkout — checkout keeps token in .git/config, enabling malicious postinstall scripts to read pushable credentials.
LOW: Set timeout-minutes on workflow jobs — 1 workflow has no job timeout, risking overlap on two-hourly schedule.
LOW: Missing convention files — absent .editorconfig, .gitattributes, formatter config.

The Bottom Line

This repo delivers a functional task-management system that integrates with multiple AI editors and provides genuine cross-session persistence. The architecture spans 6 semi-independent projects, which offers flexibility but creates integration surface area. High-priority code health items center on CI/CD hardening (pinning action SHAs, adding dependency scanning, tightening token permissions). Teams already invested in the Taskmaster ecosystem will find immediate value; others should weigh the integration overhead against the benefit of editor-agnostic task tracking. The cognitive-load findings (oversized files, import cycles, deep nesting) suggest refactoring effort if long-term maintenance is a priority.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,253 files

TypeScript451
JavaScript367
Markdown149
JSON67
TSX37
YAML18

ReactExpressTransformers

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["packages 296 modules"] g1["apps 192 modules"] g2["tests 143 modules"] g3["mcp-server 88 modules"] g4["src 74 modules"] g5["scripts 50 modules"] g6["(root) 11 modules"] g3 -->|96| g5 g2 -->|76| g4 g5 -->|47| g4 g2 -->|27| g5 g4 -->|23| g5 g3 -->|20| g4 g2 -->|6| g3 g1 -->|3| g5 g6 -->|3| g5 g1 -->|2| g6 g0 -->|1| g6 g5 -->|1| g3

Module dependencies

The 10 most depended-upon modules of 865, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_scripts_modules_utils["utils"] n1_src_slash_commands_factories["factories"] n2_ripts_modules_config_manager["config-manager"] n3_er_src_core_utils_path_utils["path-utils"] n4__core_src_common_types_index["index"] n5_er_src_core_task_master_core["task-master-core"] n6_core_src_common_logger_index["index"] n7_scripts_modules_task_manager["task-manager"] n8_src_utils_rule_transformer["rule-transformer"] n9_mcp_server_src_tools_utils["utils"] n5_er_src_core_task_master_core --> n3_er_src_core_utils_path_utils n9_mcp_server_src_tools_utils --> n0_scripts_modules_utils n9_mcp_server_src_tools_utils --> n3_er_src_core_utils_path_utils n2_ripts_modules_config_manager --> n0_scripts_modules_utils n7_scripts_modules_task_manager --> n0_scripts_modules_utils n0_scripts_modules_utils --> n2_ripts_modules_config_manager n8_src_utils_rule_transformer --> n0_scripts_modules_utils classDef cyc stroke:#ef4444,stroke-width:2px; class n0_scripts_modules_utils,n2_ripts_modules_config_manager,n7_scripts_modules_task_manager cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium4

low2

Pin third-party GitHub Actions to a commit SHAhigh3 occurrences

.github/workflows

dorny/paths-filter@v3, changesets/action@v1, stefanzweifel/git-auto-commit-action@v5

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/release-check.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

11 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow

.github/workflows/release-check.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.