
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
Visual markup tool for web apps. Annotate your UI in the browser — pins, arrows, drawn sections, notes — and Annotask generates structured tasks that AI coding agents apply to your source code. Supports Vue, React, Svelte, Astro, and plain HTML/htmx with Vite and Webpack.
You (in browser) Your coding agent
───────────────── ──────────────────
Open Annotask shell
Annotate the UI:
pin elements, draw
sections, add notes, ──> /annotask-apply
describe what you want Reads tasks from Annotask API
Edits source files
Marks tasks as "ready for review"
Review changes in <──
Annotask shell:
Accept ✓ or Deny ✗
(denied tasks return
with your feedback
for the agent to retry)
You mark up the UI — Use the Annotask shell to annotate elements: pin a component and describe what you want changed, draw a section where new content should go, highlight text that needs editing, or drop arrows showing where things should move.
Tasks are created — Each annotation becomes a structured task with full context: source file, line number, component name, element tag, surrounding layout, and your intent in plain language.
Your coding agent applies the tasks — Invoke /annotask-apply in Claude Code (or the equivalent skill in your agent). It fetches pending tasks from the Annotask API, edits the source files, and marks each task as ready for review.
You review — Back in the Annotask shell, accept or deny each change. Denied tasks return to the queue with your feedback so the agent can retry with corrections.
Annotask ships skills for AI coding agents. Install them into your project:
npx annotask init-skills
This copies skill files to .claude/skills/ and .agents/skills/ so your agent can discover them.
| Agent | Skill directory | Notes |
|---|---|---|
| Claude Code | .claude/skills/ | Invoke with /annotask-apply, /annotask-init, /annotask-watch |
| GitHub Copilot | .agents/skills/ | Auto-discovered by Copilot agents |
| OpenAI Codex | .agents/skills/ | Uses the same .agents/ convention |
| Other agents | .agents/skills/ | Any agent that reads .agents/skills/ |
| Skill | What it does |
|---|---|
/annotask-init | Scans your project and generates .annotask/design-spec.json with detected tokens, fonts, colors, and component library. Run once per project. |
/annotask-apply | Fetches pending tasks from the Annotask API, applies changes to source files, and marks them for review. |
/annotask-watch | Streams live changes from the Annotask WebSocket so your agent can narrate what you're doing in real time. |
npm install -D annotask
import { annotask } from 'annotask'
export default defineConfig({
plugins: [
vue(), // or react() or svelte() — omit for plain HTML/htmx
annotask(),
],
})
import { defineConfig } from 'astro/config'
import { annotask } from 'annotask'
export default defineConfig({
vite: {
plugins: [annotask()],
},
})
Astro source mapping uses Astro's native data-astro-source-* attributes — no extra configuration needed.
import { AnnotaskWebpackPlugin } from 'annotask/webpack'
// Add to your webpack config plugins (dev only):
plugins: [new AnnotaskWebpackPlugin()]
For MFE architectures where multiple apps load into a single root shell:
MFE child (Vite) — adds data-annotask-mfe attribute to all elements:
import { annotask } from 'annotask'
export default defineConfig({
plugins: [
vue(),
annotask({
mfe: '@myorg/my-mfe', // MFE identity tag
server: 'http://localhost:24678', // Root's annotask server URL
}),
],
})
Root shell (Webpack) — runs the annotask server, bridge, and shell UI:
import { AnnotaskWebpackPlugin } from 'annotask/webpack'
plugins: [new AnnotaskWebpackPlugin({ port: 24678 })]
When server is set, the MFE's local annotask server is skipped — the root handles it. When only mfe is set (no server), annotask runs normally for standalone development.
Tasks created from MFE elements carry the mfe field. Filter them with GET /__annotask/api/tasks?mfe=@myorg/my-mfe or use the CLI:
annotask report --mfe=@myorg/my-mfe
Start your dev server, then open:
http://localhost:5173/ (Vite) or http://localhost:8090/ (Webpack)http://localhost:5173/__annotask/annotask watch for live streaming, annotask report for current stateannotask watch # Live stream of changes
annotask report # Fetch current report JSON
annotask status # Check connection
annotask init-skills # Install agent skills into your project
Options: --port=N, --host=H, --server=URL (override server.json), --mfe=NAME (filter by MFE).
GET /__annotask/api/report — Current change reportGET /__annotask/api/tasks — Task list (supports ?mfe=NAME filter)POST /__annotask/api/tasks — Create a taskPATCH /__annotask/api/tasks/:id — Update task statusGET /__annotask/api/status — Health checkws://localhost:5173/__annotask/ws — Live WebSocket stream| Framework | Vite | Webpack |
|---|---|---|
| Vue 3 | Yes | Yes |
| React | Yes | Yes |
| Svelte | Yes | Yes |
| Astro | Yes | — |
| Plain HTML | Yes | — |
| htmx | Yes | — |
.vue, .tsx, .svelte, .astro, .html); dynamic components and render functions may not map correctlypnpm install
pnpm build # Build shell + plugin + CLI
pnpm dev:vue-vite # Start Vue test app with Annotask
pnpm test # Run tests
pnpm test:e2e # Run E2E tests (all frameworks)
src/plugin/ — Vite plugin (multi-framework transform, toggle button, bridge client)src/server/ — HTTP API, WebSocket server, shell serving, project statesrc/webpack/ — Webpack plugin and transform loadersrc/shell/ — Design tool UI (Vue 3 app, pre-built into dist/shell/)src/shared/ — Shared types (postMessage bridge protocol)src/schema.ts — TypeScript types for change reportssrc/cli/ — CLI tool for terminal interactionskills/ — Agent skill definitions (shipped with the npm package)playgrounds/ — Test apps (vue-vite, vue-webpack, react-vite, svelte-vite, html-vite, astro, htmx-vite, mfe-vite)Elements don't show source info: Make sure your framework plugin (Vue, React, or Svelte) is installed and the Annotask plugin is listed after it in your Vite config. The transform needs to run before the framework compiler processes the source. For Astro, source mapping is automatic via Astro's native attributes. For plain HTML/htmx, source mapping is injected via transformIndexHtml.
WebSocket not connecting: Ensure the dev server is running. The CLI and shell connect to /__annotask/ws on the same port as your dev server.
Changes not appearing in report: Only style and class changes that differ from computed values are included. If before and after are identical, the change is filtered out.
FAQs
Visual UI design tool for web apps. Make changes in the browser and generate structured reports that AI agents can apply to source code. Works with Vue, React, Svelte, SolidJS, and plain HTML via Vite or Webpack.
The npm package annotask receives a total of 37 weekly downloads. As such, annotask popularity was classified as not popular.
We found that annotask demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.