Fix grounded follow-up audit findings

.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+"on":
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Check package
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.14"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Check package
+        run: bun run check
+
+      - name: Check packed package
+        run: bun run pack:check

.github/workflows/release.yml

@@ -79,7 +79,7 @@ jobs:
     environment:
       name: npm
     permissions:
-      contents: write
+      contents: read
       id-token: write
 
     steps:
@@ -166,10 +166,21 @@ jobs:
           PACKAGE_FILE: ${{ steps.pack.outputs.filename }}
         run: npm publish "$PACKAGE_FILE" --provenance --access public
 
+  github-release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.repository == '0disoft/laqu'
+    needs: publish
+    permissions:
+      contents: write
+
+    steps:
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh release create "${GITHUB_REF_NAME}" \
+            --repo "${GITHUB_REPOSITORY}" \
             --title "${GITHUB_REF_NAME}" \
             --generate-notes

README.md

@@ -46,11 +46,14 @@ build.setMessage("bundle");
 build.advance(1);
 build.succeed("done");
 
+const optional = progress.createTask("optional cache warmup");
+optional.skip("already warm");
+
 await progress.close();
 ```
 
 The API avoids ambiguous calls such as `update(42)`. Use `setCompleted(42)` for absolute progress and `advance(42)` for a delta.
-Manual tasks also honor `TaskOptions.signal`; aborting the signal marks the task cancelled with the message `aborted`.
+Manual tasks also honor `TaskOptions.signal`; aborting the signal marks the task cancelled with the message `aborted`. Use `task.skip(message)` for intentionally skipped work such as cache hits, disabled feature branches, or already up-to-date steps.
 
 After `progress.close()` starts, the runtime stops accepting new tasks, logs, and task handle updates. Create a new runtime for later progress output.
 

src/events.ts

@@ -58,7 +58,7 @@ export function taskEvent(task: TaskSnapshot): LaquTaskEvent {
     schema: LAQU_EVENT_SCHEMA,
     version: LAQU_EVENT_SCHEMA_VERSION,
     type: "task",
-    createdAt: task.updatedAt,
+    createdAt: Date.now(),
     task: {
       id: task.id,
       title: task.title,

src/runtime.ts

@@ -1,3 +1,5 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
 import { OutputCoordinator } from "./output-coordinator.js";
 import { chooseRenderer } from "./renderer.js";
 import {
@@ -81,6 +83,9 @@ class LaquRuntime implements ProgressRuntime {
   #closed = false;
   #processLifecycle: ProcessLifecycleLease | undefined;
   readonly #handles = new Set<StoreTaskHandle>();
+  readonly #taskCloseContext = new AsyncLocalStorage<StoreTaskHandle>();
+  #activeScopedTasks = 0;
+  #closeRequestedByScopedTask = false;
 
   constructor(
     private readonly store: TaskStore,
@@ -106,9 +111,10 @@ class LaquRuntime implements ProgressRuntime {
       throw new TypeError("task callback is required");
     }
 
-    const handle = this.createTask(title, options);
+    const handle = this.#createRootHandle(title, options);
+    this.#activeScopedTasks += 1;
     try {
-      const result = await callback(handle);
+      const result = await this.#taskCloseContext.run(handle, () => callback(handle));
       if (this.#acceptsMutations()) {
         handle.succeed();
       }
@@ -125,17 +131,18 @@ class LaquRuntime implements ProgressRuntime {
       }
       throw error;
     } finally {
+      handle.dispose();
+      this.#activeScopedTasks -= 1;
       await this.flush();
+      if (this.#shouldRunDeferredScopedClose()) {
+        this.#closeRequestedByScopedTask = false;
+        await this.close();
+      }
     }
   }
 
   createTask(title: string, options: TaskOptions = {}): TaskHandle {
-    this.#assertAcceptsMutations();
-    const id = this.store.createTask(title, options);
-    const handle = this.#createHandle(id);
-    handle.bindSignal(options.signal);
-    this.markDirty(true);
-    return handle;
+    return this.#createRootHandle(title, options);
   }
 
   log(message: string): void {
@@ -152,6 +159,11 @@ class LaquRuntime implements ProgressRuntime {
   }
 
   async close(): Promise<void> {
+    if (this.#shouldDeferScopedClose()) {
+      this.#closeRequestedByScopedTask = true;
+      await this.flush();
+      return;
+    }
     this.#closePromise ??= this.#closeOnce();
     await this.#closePromise;
   }
@@ -223,6 +235,24 @@ class LaquRuntime implements ProgressRuntime {
     });
   }
 
+  #shouldDeferScopedClose(): boolean {
+    return (
+      this.#taskCloseContext.getStore() !== undefined &&
+      this.#activeScopedTasks > 0 &&
+      !this.#closing &&
+      !this.#closed
+    );
+  }
+
+  #shouldRunDeferredScopedClose(): boolean {
+    return (
+      this.#closeRequestedByScopedTask &&
+      this.#activeScopedTasks === 0 &&
+      !this.#closing &&
+      !this.#closed
+    );
+  }
+
   #acceptsMutations(): boolean {
     return !this.#closing && !this.#closed;
   }
@@ -233,6 +263,15 @@ class LaquRuntime implements ProgressRuntime {
     }
   }
 
+  #createRootHandle(title: string, options: TaskOptions): StoreTaskHandle {
+    this.#assertAcceptsMutations();
+    const id = this.store.createTask(title, options);
+    const handle = this.#createHandle(id);
+    handle.bindSignal(options.signal);
+    this.markDirty(true);
+    return handle;
+  }
+
   #createHandle(id: string): StoreTaskHandle {
     let handle: StoreTaskHandle;
     handle = new StoreTaskHandle(
@@ -420,6 +459,16 @@ class StoreTaskHandle implements TaskHandle {
     this.onChange(true);
   }
 
+  skip(message?: string): void {
+    this.assertWritable();
+    this.store.update(this.id, {
+      status: "skipped",
+      ...(message === undefined ? {} : { message }),
+    });
+    this.dispose();
+    this.onChange(true);
+  }
+
   child(title: string, options: TaskOptions = {}): TaskHandle {
     this.assertWritable();
     return this.createChildHandle(this.id, title, options);

src/types.ts

@@ -68,6 +68,7 @@ export interface TaskHandle {
   succeed(message?: string): void;
   fail(error?: unknown): void;
   cancel(message?: string): void;
+  skip(message?: string): void;
   child(title: string, options?: TaskOptions): TaskHandle;
 }