What changed in TaskMaster and when. Dates are when a change merged; TaskMaster deploys on every merge and has no numbered releases.
2026-10-25
Service accounts, audit trails and a safer key workflow
Service accounts can use the task tools as a named user, through an explicit binding an admin creates. Nothing is bound implicitly (tm service-bindings).
Every API key mint and revoke, and every change to a service binding, is now recorded with who did it. Read it with tm key events and tm service-bindings events.
Boards remember the forge-biz project they were made for, and creating one twice returns the same board instead of a duplicate.
New tm whoami shows which key you are using and what it can do. --auth-key-file now works on every tm command, and tm users find shows which user an email maps to.
MCP list_tasks always pages (50 by default, up to 200) instead of returning every task at once.
Admins can read projects across owners (tm projects list|get --any-owner), so "not found" no longer has to mean "not yours". Read only.
GET /federation/health?migrations=true reports applied versus pending database migrations.
Fixed: revoking or rotating a key by a name that contains hyphens no longer fails with a server error.
2026-10-17 to 2026-10-19
Apps on tasks, project commands, and MCP fixes
A task can belong to several apps, and a board can carry default apps that new tasks copy.
New tm projects and tm workspaces commands, with the REST and MCP gaps under them filled in.
MCP clients can connect cleanly: the server answers initialize and ping, and every tool declares a valid input schema. Bulk update and delete tools now work; bulk create takes apps per task.
The event feed reports app and milestone changes. tm key refuses to overwrite an existing output file.
Paid plans show as "coming soon" until billing is switched on, and billing routes answer 401 instead of 500 when signed out.
2026-10-14
A task API for agents, and the Portfolio hub
File, assign, depend, attach evidence to and claim tasks over REST or MCP, with a change feed. Filing is idempotent, and a claim is a lease that expires on its own.
Agents can be assignees. Tasks can depend on each other and report whether they are blocked.
Task routes and tools accept forge-auth keys as well as tmk_ keys.
The Portfolio hub links repos, apps and packages with milestones, rollups and releases.
2026-10-12
Task detail view, and tighter tenant scoping
Open any task in a detail sheet from the board or the list, with its linked work.
Tasks, projects, MCP, API keys and agent routes are now scoped to their owner or workspace. Signing in no longer makes everyone an owner, and the unauthenticated checkout and portal routes are gone.
2026-10-07
Sign-in through forge-auth
Sign-in moved to the BlueForge single sign-in. TaskMaster no longer holds credentials of its own.
The full end-to-end browser suite now runs in CI. Fixed a background cleanup job that failed every five minutes.
2026-06-28
Plain Postgres
The Supabase dependency was removed. TaskMaster runs on its own Postgres through Drizzle.