
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
taskflow-hosts
Advanced tools
Shared host-runner collection for taskflow — the codex, claude, opencode, grok, and hermes SubagentRunner implementations + their argv builders and event-stream parsers. The per-host MCP servers, plugin scaffolds, and bins live in codex-taskflow / claude-
Shared host-runner collection for taskflow.
This package holds the SubagentRunner implementations for taskflow's non-pi
hosts — codex, claude, opencode, grok, and hermes — plus their pure argv
builders (buildCodexArgs / buildClaudeArgs / buildOpencodeArgs /
buildGrokArgs / buildHermesArgs) and event-stream parsers. It is the single place host
runners live; a new host adds a <host>-runner.ts here.
Each host has two halves:
RunResult, classify the outcome. + the pure argv builder +
permission/model helpers.codex plugin add, claude plugin install, OpenCode config, grok plugin install, Hermes mcp_servers).Half #1 is nearly identical in shape across hosts and changes for the same
reasons (a taskflow-core contract change, or a host CLI flag change). Half #2
is genuinely host-specific (different install mechanisms, different plugin
manifests). So #1 is collected here; #2 stays in codex-taskflow /
claude-taskflow / opencode-taskflow / grok-taskflow / hermes-taskflow, which import their
runner from this package.
You usually don't install this directly — install the host delivery package:
npm install -g codex-taskflow # or claude-taskflow / opencode-taskflow / grok-taskflow / hermes-taskflow
For code-level use:
npm install taskflow-hosts
// one host, tree-shaken:
import { codexSubagentRunner, buildCodexArgs } from "taskflow-hosts/codex";
import { grokSubagentRunner, buildGrokArgs } from "taskflow-hosts/grok";
import { hermesSubagentRunner, buildHermesArgs } from "taskflow-hosts/hermes";
// or the barrel:
import {
claudeSubagentRunner,
opencodeSubagentRunner,
grokSubagentRunner,
hermesSubagentRunner,
} from "taskflow-hosts";
Each runner export includes: the SubagentRunner (codexSubagentRunner / …),
the runXxxAgentTask function, the pure buildXxxArgs builder, the
foldXxxEventLine parser + newXxxAccumulator, and the permission/model
helpers (sandboxForTools, permissionArgsForTools / permissionArgsForGrokTools,
isReadOnlyPhase, resolveXxxModel, xxxBin).
| Host | CLI spawn | Delivery package |
|---|---|---|
| Codex | codex exec --json | codex-taskflow |
| Claude Code | claude -p --output-format stream-json | claude-taskflow |
| OpenCode | opencode run --format json | opencode-taskflow |
| Grok Build | grok -p --output-format streaming-json | grok-taskflow |
| Hermes Agent | hermes chat -q -Q --source tool | hermes-taskflow |
<host>-runner.ts in src/ (model it on an existing one — a pure
buildXxxArgs + the event parser + a SubagentRunner export).src/index.ts (watch for name collisions on shared
helper names like permissionArgsForTools).*-runner.test.ts (event-stream parser) + *-args.test.ts (argv
contract — CI-locked) in test/.taskflow-hosts-depending package of its own.See AGENTS.md and DECISIONS.md in
the repo root for the full architecture and the packaging decision.
MIT
FAQs
Shared host-runner collection for taskflow — the codex, claude, opencode, grok, and hermes SubagentRunner implementations + their argv builders and event-stream parsers. The per-host MCP servers, plugin scaffolds, and bins live in codex-taskflow / claude-
The npm package taskflow-hosts receives a total of 18 weekly downloads. As such, taskflow-hosts popularity was classified as not popular.
We found that taskflow-hosts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.