@amityco/social-plus-vise 1.8.0 → 1.8.1

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@amityco/social-plus-vise` are documented in this file.
 
 The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 1.8.1 — 2026-07-11
+
+### Added
+- **Complete React Native journey proof.** The deterministic harness now runs the full governed feed journey on TypeScript, React Native, Android, Flutter, and iOS, including every documented exit state, scope-omit recovery, attestation and source-fingerprint lifecycle, contract drift, sensors, and runtime-evidence handoff.
+- **Public-preview measurement contract.** A schema-validated, metadata-only report template defines the SDK custom-UI, UIKit quick-launch, and brownfield/day-2 evaluation tracks while forbidding source upload, recorded secrets, and customer identifiers. Structural, fresh-run, and external-adoption evidence remain explicitly separate.
+
+### Changed
+- **Locked UIKit plans stay on UIKit.** After `solution_path=uikit` is explicitly selected, the plan keeps an actionable UIKit installation/provider/customization step and omits contradictory direct-SDK outcome steps. Hybrid plans retain those steps only for differentiated behavior outside UIKit.
+- **Explicit workplan surfaces are preserved.** An accepted Engagement Intelligence variant may add coherent companion surfaces, but it can no longer erase surfaces named directly by the user; bare plural `communities` is recognized in multi-surface requests.
+
+### Fixed
+- **Safe placeholders no longer mask later hardcoded values.** Literal scanning continues past documented placeholder IDs and API keys, including later matches in the same file or project, so a benign env fallback cannot hide a real committed secret or target.
+- **Public contract wording.** The npm README now reflects the Node.js 20 minimum, fail-closed scan coverage, strict sensor selection, and the `vise check --ci` all-engagement release gate.
+
+### Compatibility
+- This patch changes no sidecar schema or exit code. SDK plans and unresolved UIKit decisions retain their existing branch visibility; only an explicitly locked UIKit route suppresses direct-SDK outcome steps.
+
 ## 1.8.0 — 2026-07-10
 
 ### Added

package/README.md

@@ -66,6 +66,8 @@ It ships as three layers:
 
 > **New to social.plus?** Vise integrates the social.plus SDK. To adopt social.plus, [talk to our team](https://www.social.plus/contact/contact-sales?utm_source=vise&utm_medium=npm-readme&utm_campaign=ga). Existing customers get their **API key + region** from the [social.plus Console](https://console.socialplus.com) and can follow the [SDK getting-started guide](https://learn.social.plus/social-plus-sdk/getting-started/overview). You can install Vise and explore `vise inspect`/`vise plan` before you have credentials.
 
+> **Runtime requirement:** Vise requires Node.js 20 or newer. Run `node --version` before installing if you are unsure which runtime your terminal or CI environment uses.
+
 ```sh
 # 1. Install the CLI
 npm install -g @amityco/social-plus-vise
@@ -202,7 +204,7 @@ Run `vise <command> --help` for full flags. JSON output is the default for agent
 |---|---|
 | `vise explore "<request>"` | Pre-credentials discovery: map a request to what social.plus offers (candidate outcome, capabilities, docs, next command). No project or API key needed |
 | `vise doctor` | Verify install; print version, install path, docs source |
-| `vise inspect [path]` | Detect platform, monorepo surfaces, design signals, available sensors |
+| `vise inspect [path]` | Detect platform, monorepo surfaces, design signals, available sensors, and bounded scan coverage. An incomplete scan cannot initialize or produce a green check; select a concrete app surface in a large monorepo |
 | `vise plan [path] --request "..." [--summary]` | Grounded implementation plan with intake questions and docs citations; `--summary` prints a compact route/intake view |
 | `vise plan --summary "..."` | Shortcut for quick routing or discovery when the current directory is the repo |
 | `vise plan-harness [path] --request "..."` | Pre-planning step: build the harness around the request |
@@ -253,7 +255,7 @@ Everything in this group is local and advisory: no uploads, no `vise check` exit
 | Command | Purpose |
 |---|---|
 | `vise check [path]` | Re-validate against the recorded contract: `green`, `needs-attestation`, `deterministic-failures`, `blocked`, `contract-drift`, `completeness-gap`, `selected-capability-failures`, `no-platform` (no SDK platform detected — reported as a failure, not a vacuous green), or `runtime-proof-waived` |
-| `vise check [path] --ci` | Read-only variant that exits non-zero unless green (for CI) |
+| `vise check [path] --ci` | Read-only release gate for the active contract **and every recorded engagement**. Active non-green keeps its normal exit code; active green with completed-work drift exits `11` |
 | `vise check [path] --allow-proof-waiver` | Accept an honest `runtime-proof-waived` result (from `vise smoke waive`) as passing (exit 0) instead of blocking; without it a waiver blocks CI by default |
 | `vise check [path] --new-only` | **Brownfield gate.** With a recorded baseline, gate only on rule findings introduced *since* the baseline (pre-existing ones are reported but excluded). The outcome's completeness checklist and selected optional capabilities are **never** excluded — they are the engagement's deliverables and gate like a default check. Default `check` always gates on everything |
 | `vise check [path] --engagement <outcome>` | **Re-verdict one recorded engagement** (from `sp-vise/engagements/`) against the current ruleset and code. Exit `11` on drift, `0` when it still holds; never the active engagement's codes. `ruleset_upgraded` discloses when the installed ruleset moved since it was recorded |
@@ -269,7 +271,7 @@ Everything in this group is local and advisory: no uploads, no `vise check` exit
 
 | Command | Purpose |
 |---|---|
-| `vise run-sensors [path] [--dry-run]` | Run detected project scripts (npm, Gradle, Flutter, lint, typecheck, SDK smokes); `--dry-run` lists without executing |
+| `vise run-sensors [path] [--dry-run] [--include "<sensor name>"]` | Run detected project scripts (npm, Gradle, Flutter, lint, typecheck, SDK smokes); `--dry-run` lists without executing. Every explicit include must match a detected sensor or the command fails; output is bounded and timed-out descendants are terminated |
 | `vise smoke [path] --log <file>` | Assess a captured mount-smoke log into a pass/fail verdict + record evidence. `expect: "populated"` requires `loaded count=N` with `N > 0`; this catches session-establish and empty-data gaps that static checks cannot see |
 | `vise smoke waive [path] --reason "..." [--mode declined\|deviceless]` | Record an auditable runtime-proof waiver when proof is declined or no device/emulator is available, instead of faking evidence. `vise check` then reports `runtime-proof-waived` (exit 9; accept with `--allow-proof-waiver`) rather than a red-forever live surface |
 | `vise install-skill --target <host>` | Install the bundled skill into a coding host (see [Quick Start](#quick-start)) |
@@ -321,7 +323,7 @@ jobs:
       - run: vise check . --ci
 ```
 
-`vise check --ci` is read-only — it never updates `sp-vise/` — and its JSON output includes a structured `ci` block for pipeline logs.
+`vise check --ci` is read-only — it never updates `sp-vise/` — and its JSON output includes a structured `ci` block for pipeline logs. It automatically re-verdicts every recorded engagement, so CI holds previously completed surfaces green without a second `--all-engagements` command.
 
 | Exit code | Meaning |
 |---|---|
@@ -334,7 +336,7 @@ jobs:
 | `6` | An explicitly selected optional capability failed its source sensors |
 | `8` | No SDK platform detected (`no-platform`) — reported as a failure, never a vacuous green |
 | `9` | Runtime proof waived (`runtime-proof-waived`) — accept explicitly with `--allow-proof-waiver` |
-| `11` | Engagement drift (`--engagement` / `--all-engagements` only): the active gate is green but a recorded engagement re-verdicts non-green — a previously finished surface no longer holds |
+| `11` | Engagement drift (`--ci`, `--engagement`, or `--all-engagements`): the active gate is green but a recorded engagement re-verdicts non-green — a previously finished surface no longer holds |
 
 ## Compliance Contract
 

package/dist/server.js

@@ -1595,7 +1595,12 @@ async function activeBlueprint(repoRoot, request, plan) {
     const planSequence = socialWorkplanSequence(plan);
     const flowFallback = await socialWorkplanSequenceFromFlow(repoRoot, request);
     const canonicalRequest = flowFallback?.request ?? request;
-    const full = planSequence.length ? planSequence : flowFallback?.sequence ?? [];
+    const isCanonicalRequest = normalizeWorkflowRequest(request) === normalizeWorkflowRequest(canonicalRequest);
+    const full = flowFallback && !isCanonicalRequest
+        ? flowFallback.sequence
+        : planSequence.length
+            ? planSequence
+            : flowFallback?.sequence ?? [];
     const omitted = await readOmittedSurfaces(repoRoot, canonicalRequest);
     const omittedIds = new Set(omitted.map((item) => item.id));
     return { sequence: full.filter((surface) => !omittedIds.has(surface.id)), omitted, canonicalRequest };

package/dist/tools/integration.js

@@ -218,7 +218,7 @@ async function buildIntegrationPlan(repoPath, request, surfacePath, answers = {}
             ...solutionPathImplementationSteps(solutionPath),
             ...uikitCustomizationImplementationSteps(uikitCustomization),
             ...crossPlatformHandoffSteps,
-            ...definition.implementationSteps(ctx),
+            ...outcomeImplementationStepsForSolutionPath(solutionPath, definition.implementationSteps(ctx)),
         ],
         validation: ["validate_setup", "run_sensors", ...definition.validation(platform)],
         ...(clarify ? { clarify } : {}),
@@ -442,18 +442,30 @@ function solutionPathDecisions(solutionPath, answers) {
     ];
 }
 function solutionPathImplementationSteps(solutionPath) {
-    if (!solutionPath.decision.requiredBeforeHandRolledUi) {
+    const unresolved = solutionPath.decision.requiredBeforeHandRolledUi;
+    if (solutionPath.recommendation === "sdk" && !unresolved) {
         return [];
     }
+    const step = solutionPath.recommendation === "uikit"
+        ? unresolved
+            ? "Confirm the social.plus UIKit path before building standard social UI from SDK primitives; use UIKit install/auth/customization docs as the primary implementation source. The SDK feed/chat/profile steps that follow apply ONLY to the direct-SDK (or hybrid SDK-side) route — do not hand-roll the standard surface from them when the customer is using UIKit."
+            : "Implement the explicitly selected social.plus UIKit path as the primary artifact: follow UIKit installation, authentication, provider/page, behavior, and customization guidance. Direct-SDK outcome steps are intentionally omitted for this locked UIKit route; do not hand-roll the standard social surface from SDK primitives."
+        : solutionPath.recommendation === "hybrid" && !unresolved
+            ? "Implement the explicitly selected hybrid path: use UIKit for standard social surfaces, and apply the direct-SDK outcome steps only to the differentiated app-specific behavior that UIKit does not cover. Do not rebuild UIKit-covered surfaces from SDK primitives."
+            : "Resolve whether this is a UIKit, SDK, or hybrid build before starting UI implementation; the SDK implementation steps that follow apply to the SDK/hybrid route, not to a UIKit build. Do not let mixed speed/customization signals collapse into a hand-rolled SDK UI by default.";
     return [
         {
-            step: solutionPath.recommendation === "uikit"
-                ? "Confirm the social.plus UIKit path before building standard social UI from SDK primitives; use UIKit install/auth/customization docs as the primary implementation source. The SDK feed/chat/profile steps that follow apply ONLY to the direct-SDK (or hybrid SDK-side) route — do not hand-roll the standard surface from them when the customer is using UIKit."
-                : "Resolve whether this is a UIKit, SDK, or hybrid build before starting UI implementation; the SDK implementation steps that follow apply to the SDK/hybrid route, not to a UIKit build. Do not let mixed speed/customization signals collapse into a hand-rolled SDK UI by default.",
+            step,
             evidence: ["solutionPath", ...solutionPath.evidence],
         },
     ];
 }
+function outcomeImplementationStepsForSolutionPath(solutionPath, outcomeSteps) {
+    if (solutionPath.recommendation === "uikit" && !solutionPath.decision.requiredBeforeHandRolledUi) {
+        return [];
+    }
+    return outcomeSteps;
+}
 function solutionPathImplementationRules(solutionPath) {
     if (solutionPath.recommendation === "sdk" && !solutionPath.decision.requiredBeforeHandRolledUi) {
         return [];
@@ -719,7 +731,11 @@ const SOCIAL_SURFACE_SEQUENCE = [
         id: "community",
         outcome: "add-community",
         label: "Community management",
-        aliases: [/\b(create|manage|join|leave|membership|members?|roles?|invitations?|categories?)\s+(?:a\s+|the\s+)?communit/i, /\bcommunity\s+(creation|management|members?|roles?|invitations?|categories|settings|moderation)\b/i],
+        aliases: [
+            /\bcommunities\b/i,
+            /\b(create|manage|join|leave|membership|members?|roles?|invitations?|categories?)\s+(?:a\s+|the\s+)?communit/i,
+            /\bcommunity\s+(creation|management|members?|roles?|invitations?|categories|settings|moderation)\b/i,
+        ],
     },
     {
         id: "notifications",
@@ -743,6 +759,13 @@ async function socialWorkplanFor(args) {
         const surface = SOCIAL_SURFACE_SEQUENCE.find((item) => item.id === hint.id);
         return surface ? [{ surface, creativeHint: hint }] : [];
     });
+    const selectedIds = new Set(selected.map((entry) => entry.surface.id));
+    for (const surface of matched) {
+        if (!selectedIds.has(surface.id)) {
+            selected.push({ surface });
+            selectedIds.add(surface.id);
+        }
+    }
     if (selected.length <= 1) {
         return undefined;
     }

package/dist/tools/project.js

@@ -2966,11 +2966,19 @@ function firstLiteralAssignment(contents, patterns, platform) {
     for (const [file, rawContent] of contents) {
         const content = commentStripped(file, platform, rawContent);
         for (const pattern of patterns) {
-            pattern.lastIndex = 0;
-            const match = pattern.exec(content);
-            if (match?.[1]) {
+            const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+            const matcher = new RegExp(pattern.source, flags);
+            let match;
+            while ((match = matcher.exec(content)) !== null) {
+                if (!match[1]) {
+                    continue;
+                }
+                const value = match[1].trim();
+                if (isAllowedPlaceholder(value)) {
+                    continue;
+                }
                 const name = match[0].split(/[=:]/)[0]?.trim() ?? "literal";
-                return { file, name, value: match[1].trim() };
+                return { file, name, value };
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amityco/social-plus-vise",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Skill-guided deterministic CLI for social.plus SDK integration assistance.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",