
Product
PHP and Composer Support Is Now in Beta
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
taskflow-sdk
Advanced tools
Multi-agent orchestration harness for AI coding agents (claude-code, codex, cursor, opencode, pi). Async-await TypeScript API; lifecycle hooks; auto-todos with verify-loop.
Multi-agent orchestration harness for AI coding agents (claude-code, codex, cursor, opencode, pi). Async-await TypeScript API; lifecycle hooks; auto-todos with verify-loop.
npm install taskflow-sdk
import { taskflow } from 'taskflow-sdk';
await taskflow('hello').run(async ({ phase, session }) => {
await phase('greet', async () => {
await session('say-hi', { with: 'claude-code', task: 'Print hello world' });
});
});
.agents/taskflow/config.tsimport { defineConfig } from 'taskflow-sdk/config';
export default defineConfig({
events: {
afterTaskDone: async (ctx, { spec, result }) => {
// post-task hook
},
},
todos: { autoExtract: true, maxRetries: 3 },
});
Sessions with a zod schema return typed results. claude-code uses native tool-use. codex (on gpt-5 / gpt-5.4 models) uses --output-schema; gpt-5-codex variants fall back to prompt-engineered JSON pending openai/codex#4181. Other adapters (cursor, opencode, pi) use prompt-engineered JSON. Override codex behavior with HARNESS_CODEX_SCHEMA=0|1.
import { z } from 'zod';
const result = await session('summary', {
with: 'codex:gpt-5.4',
task: 'Summarize the repo',
schema: z.object({ title: z.string(), bullets: z.array(z.string()) }),
});
// result is typed: { title: string; bullets: string[] }
A plugin contributes hooks, a ctx.plugins.<name> namespace, and optional config fragments:
import type { Plugin } from 'taskflow-sdk/core';
export const myPlugin: Plugin = () => ({
name: 'my-plugin',
events: {
afterTaskDone: async (ctx, { spec }) => { /* ... */ },
},
ctx: () => ({ hello: () => 'world' }),
});
To get typed access to ctx.plugins.myPlugin.hello() in downstream hooks, module-augment the plugin namespace registry:
declare module 'taskflow-sdk/core' {
interface PluginNamespaces {
'my-plugin': { hello: () => string };
}
}
See examples/omai-plugin-starter/ for a fuller scaffold (screen capture + UI-TARS wiring stubs).
| Var | Purpose |
|---|---|
ANTHROPIC_API_KEY | Required for claude-code sessions and pi:anthropic/*. |
OPENAI_API_KEY, GROQ_API_KEY, CEREBRAS_API_KEY, GEMINI_API_KEY | Required per-session for the respective providers. |
HARNESS_PI_BIN | Override the pi binary name (default pi). Use omp with @oh-my-pi/pi-coding-agent. |
HARNESS_CODEX_SCHEMA | 0 forces prompt-engineered JSON for codex; 1 forces native --output-schema. |
HARNESS_ADAPTER_OVERRIDE=mock | Swap every agent for the mock adapter — smoke runs with zero token cost. |
HARNESS_NO_TTY=1 | Force headless JSONL output even when a TTY is attached. |
HARNESS_RUNS_DIR=... | Override the runs archive directory (default data/runs). |
HARNESS_REAL_TESTS=1 | Enable integration tests that make real LLM calls (default-skipped). |
See .claude/skills/taskflow/SKILL.md for the authoring guide.
FAQs
Multi-agent orchestration harness for AI coding agents (claude-code, codex, cursor, opencode, pi). Async-await TypeScript API; lifecycle hooks; auto-todos with verify-loop.
The npm package taskflow-sdk receives a total of 0 weekly downloads. As such, taskflow-sdk popularity was classified as not popular.
We found that taskflow-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.