@brunosps00/dev-workflow 1.0.5 → 1.1.0

package/README.md

@@ -19,20 +19,20 @@ This will:
 
 > **Compozy-inspired disciplines.** Since 0.5.0, dev-workflow bundles three primitives — `dw-verify`, `dw-memory`, `dw-review-rigor` — adapted from the [Compozy](https://github.com/compozy/compozy) project and invoked internally by existing commands. See [docs/compozy-integration.md](docs/compozy-integration.md) for what was ported and what was not.
 
-Optional dependencies (Playwright browsers, react-doctor, Trivy, Docker):
+Optional dependencies (Playwright browsers, react-doctor, Trivy, Semgrep, gitleaks, Docker):
 ```bash
 npx @brunosps00/dev-workflow install-deps
 ```
 
 ## Commands
 
-dev-workflow v1.0.5 ships **30 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
+dev-workflow v1.0.6 ships **31 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
 
 ### Tier 1 — Gateway (3)
 
 | Command | When |
 |---------|------|
-| **`/dw-autopilot "wish"`** | Default entry point. Full pipeline (PRD → TechSpec → Tasks → Run → QA → Review → Commit → PR) with 3 approval gates. Use `--from-prd <slug>` to resume from an existing PRD (e.g., after a `/dw-bugfix` safety-valve escalation): skips Steps 1–4 and starts at GATE 1. |
+| **`/dw-autopilot "wish"`** | Default entry point in two invocations. First run completes PRD → TechSpec → Tasks and stops. Second run resumes from state, executes `/dw-goal --from-autopilot <slug>` for Run → Review → QA/Fix → Review, then Commit → PR. |
 | **`/dw-bugfix "description"`** | A bug report or pasted error. Triages bug-vs-feature-vs-scope, surgical fix or routes to a PRD. |
 | **`/dw-help [keyword]`** | Discover commands. Pass a keyword for shortcuts; `--advanced` reveals internal commands. |
 
@@ -67,7 +67,7 @@ Use these when you want step-by-step control instead of `/dw-autopilot`.
 | **`/dw-install-azure-skills`** | **Opt-in.** Clones curated Azure skills from [`MicrosoftDocs/Agent-Skills`](https://github.com/MicrosoftDocs/Agent-Skills) (CC-BY-4.0) into `.agents/skills/azure/` and registers the [Microsoft Learn MCP Server](https://learn.microsoft.com/en-us/training/support/mcp-get-started) (HTTP, no-auth). Interactive category selection (Compute / Data & Storage / AI & ML / Networking / Identity & Security / DevOps / Observability / Integration / Architecture / All). Re-run to refresh from upstream. Also available as CLI: `npx @brunosps00/dev-workflow install-azure-skills`. |
 | **`/dw-install-aws-skills`** | **Opt-in.** Clones curated AWS skills from [`aws/agent-toolkit-for-aws`](https://github.com/aws/agent-toolkit-for-aws) (Apache 2.0) into `.agents/skills/aws/` and registers the unified [AWS MCP Server](https://docs.aws.amazon.com/aws-mcp/) (stdio via `uvx mcp-proxy-for-aws@latest`). **Requires `uv`, `aws cli ≥ 2.32.0`, and AWS credentials.** Interactive category selection (Core / Analytics / Database / EC2 / Migration / Networking / Operations / Security / Serverless / Storage / All). The agent gains `aws___call_aws` (executes 15,000+ AWS APIs) and `aws___run_script` (Python sandboxed) — review `.dw/references/aws-mcp-instructions.md` for the destructive-operations protocol. Also available as CLI: `npx @brunosps00/dev-workflow install-aws-skills [--region=<aws-region>]`. |
 
-### Tier 4 — Hidden/Internal (8)
+### Tier 4 — Hidden/Internal (9)
 
 These are auto-invoked by Tier 1-3 commands. Available standalone via `/dw-help --advanced`.
 
@@ -75,7 +75,8 @@ These are auto-invoked by Tier 1-3 commands. Available standalone via `/dw-help
 |---------|------|------------|
 | **`/dw-adr "decision"`** | Records an Architecture Decision Record at `.dw/spec/<prd>/adrs/`. | `/dw-plan techspec --council`; deviations from constitution |
 | **`/dw-intel "question"`** | Query codebase intelligence (`.dw/intel/`). `--build` (re)creates the index. | `/dw-plan`, `/dw-review`, `/dw-bugfix` |
-| **`/dw-secure-audit`** | Unified security: OWASP + Trivy SCA/secret/IaC + lockfile + supply-chain check. Hard gate. Flags: `--scan-only`, `--plan`, `--execute`. | `/dw-review`, `/dw-generate-pr` (for TS/Python/C#/Rust) |
+| **`/dw-secure-audit`** | **Security Gate** (phase after review/QA, before commit/PR): OWASP + Semgrep SAST (diff/generated code) + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain + outdated. Rigoroso: secrets/CRITICAL/HIGH block (secrets have no ADR escape). Flags: `--scan-only`, `--plan`, `--execute`. See [docs/security-gate.md](docs/security-gate.md). | `/dw-autopilot` (explicit step), enforced by `/dw-generate-pr` |
+| **`/dw-goal "<objective>"`** | Durable objective contract. Uses Codex native `/goal` when available and `.dw/goals/` everywhere for Codex, Copilot, Claude Code, and OpenCode. | `/dw-autopilot` after planning |
 | **`/dw-find-skills "query"`** | Searches `npx skills` ecosystem, vets, installs. | manual when extending the bundle |
 | **`/dw-update`** | Updates dev-workflow to latest npm release with rollback snapshot. | manual maintenance |
 | **`/dw-subtask-start`** | Creates a minimal input packet for a subagent without injecting the parent transcript. | parent agent before delegation |
@@ -85,20 +86,19 @@ These are auto-invoked by Tier 1-3 commands. Available standalone via `/dw-help
 ## Workflow
 
 ```
-/dw-autopilot "wish"  ------>  Runs entire pipeline automatically
-                                (3 gates: PRD approval, Tasks approval, PR confirmation)
+/dw-autopilot "wish"  ------>  First invocation: PRD → TechSpec → Tasks → STOP
+/dw-autopilot          ------>  Second invocation: /dw-goal → Commit → PR
     --- OR step-by-step ---
 
 /dw-brainstorm  -->  /dw-plan           -->  .dw/spec/prd-{name}/{prd,techspec,tasks}.md
                           |
-                    /dw-run              -->  atomic commits per task, dependency-aware
-                          |
-                    /dw-qa               -->  .dw/spec/prd-{name}/QA/ (UI / API / --ai)
-                          |
-                    /dw-review           -->  L2 PRD coverage + L3 code quality
+                    /dw-goal             -->  /dw-run → /dw-review → /dw-qa → /dw-review
                           |
                     /dw-commit + /dw-generate-pr
 
+Manual alternative after /dw-plan:
+  /dw-run → /dw-review → /dw-qa → /dw-review → /dw-commit → /dw-generate-pr
+
 Shortcuts:
   /dw-intel "question"         Query codebase intelligence
   /dw-redesign-ui "target"     Visual redesign of a page or component
@@ -135,7 +135,7 @@ Customize templates locally without losing dev-workflow updates. Drop a file at
 
 **What's inside:**
 
-- **Trigger Map** — 15 mappings from user intent ("Implement X", "Bug in Y", "Review my PR", ...) to the `dw-*` command the agent should run. `/dw-autopilot` is the safest default for non-trivial feature requests.
+- **Trigger Map** — mappings from user intent ("Implement X", "Bug in Y", "Review my PR", "resume autopilot", ...) to the `dw-*` command the agent should run. `/dw-autopilot` is the safest default for non-trivial feature requests; `/dw-goal` is the durable execution contract after planning.
 - **Hard Gates** — reminders that constitution violations (high/critical), missing `dw-verify` PASS, and security failures block downstream commands.
 - **Escape Hatches** — explicit cases where the agent should NOT auto-trigger (typos, exploration, aesthetic edits, user opt-out).
 
@@ -168,6 +168,10 @@ npx @brunosps00/dev-workflow update
 
 All wrappers point to `.dw/commands/` as the single source of truth.
 
+### Durable Goals
+
+`/dw-goal` gives every supported agent a portable version of Codex's durable goal workflow. In Codex, it may bridge to the native experimental `/goal` command when `features.goals` is enabled. In every platform, the canonical state is still stored under `.dw/goals/<slug>/` so Copilot, Claude Code, OpenCode, and Codex all follow the same objective, checkpoints, progress log, and stopping condition.
+
 ## Project Structure (after init)
 
 ```

package/bin/dev-workflow.js

@@ -5,6 +5,7 @@ const installDeps = require('../lib/install-deps');
 const installAzureSkills = require('../lib/install-azure-skills');
 const installAwsSkills = require('../lib/install-aws-skills');
 const uninstall = require('../lib/uninstall');
+const setupWslBrowser = require('../lib/setup-wsl-browser');
 
 const args = process.argv.slice(2);
 const command = args[0];
@@ -45,6 +46,7 @@ const HELP_TEXT = `
     repair                 Reconcile managed files using the recorded install state
     subtask                Create, complete, consume, and list local subagent handoffs
     install-deps           Install system dependencies (Playwright browsers, MCP servers)
+    setup-wsl-browser      (WSL) Build the CDP relay on Windows + add the Hyper-V firewall rule so flows can drive the real Windows browser
     install-azure-skills   Opt-in: clone curated Azure skills from MicrosoftDocs/Agent-Skills
                            into .agents/skills/azure/ and register the Microsoft Learn MCP
                            server (HTTP, no-auth). Interactive category selection.
@@ -95,6 +97,9 @@ async function main() {
     case 'install-deps':
       installDeps.run();
       break;
+    case 'setup-wsl-browser':
+      setupWslBrowser.run();
+      break;
     case 'install-azure-skills':
       await installAzureSkills.run();
       break;

package/lib/constants.js

@@ -2,7 +2,7 @@ const COMMANDS = {
   en: [
     { name: 'dw-adr', description: 'Records an architectural decision and the trade-offs accepted, before they get lost.' },
     { name: 'dw-analyze-project', description: 'Scans the repo to learn its stack and conventions, then writes the rules other commands rely on.' },
-    { name: 'dw-autopilot', description: 'Trigger when user asks to implement, build, create, or add a feature non-trivially. Runs full PRD-to-PR pipeline with three gates. Use --from-prd <slug> to resume from an existing PRD (e.g., after a /dw-bugfix safety-valve escalation), skipping Steps 1-4 and starting at GATE 1.' },
+    { name: 'dw-autopilot', description: 'Trigger when user asks to implement, build, create, or add a feature non-trivially. First invocation plans and stops; second invocation resumes via dw-goal, then commit and PR.' },
     { name: 'dw-brainstorm', description: 'Refine an idea against the product\'s existing features. Modes: default ideation, --research (multi-source cited research), --refactor (Fowler code-smell catalog), --onepager, --council.' },
     { name: 'dw-bugfix', description: 'Trigger when user reports a bug, pastes an error, or describes broken behavior. Triages with three questions, then fixes or routes to PRD.' },
     { name: 'dw-commit', description: 'Trigger when implementation is complete and pending changes need to be committed. Atomic commits with Conventional Commits messages.' },
@@ -10,6 +10,7 @@ const COMMANDS = {
     { name: 'dw-find-skills', description: 'Searches the npx skills ecosystem for a skill matching what you need, vets it, and installs it where you choose.' },
     { name: 'dw-functional-doc', description: 'Maps screens and user flows into a functional doc, validated end-to-end with Playwright.' },
     { name: 'dw-generate-pr', description: 'Trigger when commits are ready and the branch needs a PR. Pushes branch and opens PR with summary + test plan + hard verify gate.' },
+    { name: 'dw-goal', description: 'Trigger when long-running implementation work needs a durable objective. Portable Codex-style goal contract; used by autopilot after planning.' },
     { name: 'dw-help', description: 'Lists primary commands and the flows that connect them. Pass --advanced to see internal/hidden commands.' },
     { name: 'dw-context-budget', description: 'Audits context overhead from commands, skills, agents, instructions, and MCPs; recommends token savings.' },
     { name: 'dw-harness-audit', description: 'Runs a deterministic health scorecard for dev-workflow installation, agents, MCPs, gates, and context discipline.' },
@@ -24,7 +25,7 @@ const COMMANDS = {
     { name: 'dw-resume', description: 'Trigger when user says "resume work", "where did we stop?", or starts a session in a project with an existing .dw/STATE.md. Reads STATE.md, presents a TLDR, and suggests the next dw-* command.' },
     { name: 'dw-review', description: 'Trigger when user asks to review code, check quality, or verify PR readiness. Default runs L2 (PRD coverage) + L3 (code quality). Flags --coverage-only / --code-only / --bugfix <slug>.' },
     { name: 'dw-run', description: 'Trigger when user wants to execute tasks. Default runs all pending in dependency order; \'run <task-id>\' runs one; \'run --resume\' continues an interrupted plan.' },
-    { name: 'dw-secure-audit', description: 'Unified security audit: OWASP + Trivy SCA/secret/IaC + lockfile + supply-chain compromise check. Hidden; auto-invoked by /dw-review and /dw-generate-pr.' },
+    { name: 'dw-secure-audit', description: 'Security Gate: OWASP + Semgrep SAST (diff) + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain + outdated. Rigoroso: secrets/CRITICAL/HIGH block. Auto-invoked by /dw-review and /dw-generate-pr, explicit phase in /dw-autopilot, and runnable standalone.' },
     { name: 'dw-skill-health', description: 'Audits installed skills and agents for bloat, duplication, missing references, and stale or unused modules.' },
     { name: 'dw-subtask-start', description: 'Creates a minimal input packet for a subagent without injecting the parent transcript.' },
     { name: 'dw-subtask-complete', description: 'Records a structured subagent handoff with result, files, decisions, risks, verification, and blockers.' },
@@ -34,7 +35,7 @@ const COMMANDS = {
   'pt-br': [
     { name: 'dw-adr', description: 'Registra uma decisao arquitetural e os trade-offs aceitos, antes que se percam.' },
     { name: 'dw-analyze-project', description: 'Escaneia o repo para aprender stack e convencoes, e escreve as regras que os outros commands usam.' },
-    { name: 'dw-autopilot', description: 'Trigger quando usuario pede pra implementar, criar ou adicionar uma feature nao-trivial. Roda pipeline completo PRD-ao-PR com tres gates. Use --from-prd <slug> para retomar de um PRD existente (ex: apos escalacao do safety valve do /dw-bugfix), pulando Etapas 1-4 e comecando no GATE 1.' },
+    { name: 'dw-autopilot', description: 'Trigger quando usuario pede pra implementar, criar ou adicionar uma feature nao-trivial. Primeira invocacao planeja e para; segunda retoma via dw-goal, depois commit e PR.' },
     { name: 'dw-brainstorm', description: 'Refina uma ideia contra features existentes do produto. Modos: ideacao default, --research (research multi-fonte citada), --refactor (catalogo de code smells Fowler), --onepager, --council.' },
     { name: 'dw-bugfix', description: 'Trigger quando usuario reporta bug, cola erro ou descreve comportamento quebrado. Tria com tres perguntas, depois corrige ou roteia pra PRD.' },
     { name: 'dw-commit', description: 'Trigger quando implementacao esta completa e ha mudancas pendentes pra commit. Commits atomicos com mensagens Conventional Commits.' },
@@ -42,6 +43,7 @@ const COMMANDS = {
     { name: 'dw-find-skills', description: 'Busca no ecossistema npx skills uma skill que resolva o que voce precisa, valida e instala onde voce escolher.' },
     { name: 'dw-functional-doc', description: 'Mapeia telas e fluxos em um dossie funcional, validado E2E com Playwright.' },
     { name: 'dw-generate-pr', description: 'Trigger quando commits estao prontos e branch precisa de PR. Push da branch e abre PR com summary + test plan + hard verify gate.' },
+    { name: 'dw-goal', description: 'Trigger quando trabalho longo precisa de objetivo duravel. Contrato portavel estilo Codex goal; usado pelo autopilot apos o planejamento.' },
     { name: 'dw-help', description: 'Lista comandos primarios e fluxos que os conectam. Passe --advanced para ver comandos internos/escondidos.' },
     { name: 'dw-context-budget', description: 'Audita overhead de contexto em comandos, skills, agentes, instrucoes e MCPs; recomenda economia de tokens.' },
     { name: 'dw-harness-audit', description: 'Roda um scorecard deterministico da instalacao dev-workflow, agentes, MCPs, gates e disciplina de contexto.' },
@@ -56,7 +58,7 @@ const COMMANDS = {
     { name: 'dw-resume', description: 'Trigger quando usuario diz "retoma", "onde paramos?" ou comeca sessao num projeto com .dw/STATE.md existente. Le STATE.md, apresenta TLDR e sugere proximo comando dw-*.' },
     { name: 'dw-review', description: 'Trigger quando usuario pede pra revisar codigo, checar qualidade ou validar prontidao pra PR. Default roda L2 (cobertura PRD) + L3 (qualidade). Flags --coverage-only / --code-only / --bugfix <slug>.' },
     { name: 'dw-run', description: 'Trigger quando usuario quer executar tasks. Default roda todas pendentes em ordem de dependencia; \'run <task-id>\' roda uma; \'run --resume\' continua plan interrompido.' },
-    { name: 'dw-secure-audit', description: 'Audit unificado de seguranca: OWASP + Trivy SCA/secret/IaC + lockfile + supply-chain compromise. Hidden; auto-invocado por /dw-review e /dw-generate-pr.' },
+    { name: 'dw-secure-audit', description: 'Security Gate: OWASP + Semgrep SAST (diff) + gitleaks secrets + Trivy SCA/IaC + lockfile + supply-chain + outdated. Rigoroso: secrets/CRITICAL/HIGH bloqueiam. Auto-invocado por /dw-review e /dw-generate-pr, fase explicita no /dw-autopilot, e executavel standalone.' },
     { name: 'dw-skill-health', description: 'Audita skills e agentes instalados por bloat, duplicacao, referencias quebradas e modulos sem uso.' },
     { name: 'dw-subtask-start', description: 'Cria um input packet minimo para subagente sem injetar transcript bruto do parent.' },
     { name: 'dw-subtask-complete', description: 'Registra handoff estruturado do subagente com resultado, arquivos, decisoes, riscos, verificacao e bloqueios.' },

package/lib/install-deps.js

@@ -6,9 +6,9 @@ function run() {
 
   const deps = [
     {
-      name: 'Playwright browsers',
+      name: 'Playwright browsers (Chromium + deps)',
       check: 'npx playwright --version',
-      install: 'npx playwright install --with-deps',
+      install: 'npx playwright install --with-deps chromium',
     },
     {
       name: 'Context7 MCP',
@@ -31,7 +31,44 @@ function run() {
         '  Windows:  choco install trivy   (or: scoop install trivy)',
         '  Docker:   docker pull aquasec/trivy:latest   (use via alias or wrapper)',
         '',
-        'Once installed, /dw-security-check will use it for CVE, secret, and IaC scanning.',
+        'Once installed, /dw-secure-audit will use it for CVE, secret, and IaC scanning.',
+      ],
+    },
+    {
+      name: 'Semgrep (SAST)',
+      check: 'semgrep --version',
+      install: null,
+      instructions: [
+        'Semgrep powers the SAST layer of /dw-secure-audit (semantic analysis of generated code).',
+        '  pipx:     pipx install semgrep   (recommended — isolated)',
+        '  pip:      python3 -m pip install --user semgrep',
+        '  macOS:    brew install semgrep',
+        '  Docker:   docker pull semgrep/semgrep:latest   (use via alias or wrapper)',
+        '',
+        'The gate runs pinned rulesets (p/security-audit, p/owasp-top-ten, p/secrets) on the diff.',
+      ],
+    },
+    {
+      name: 'gitleaks (secret scanner)',
+      check: 'gitleaks version',
+      install: null,
+      instructions: [
+        'gitleaks is the dedicated secret scanner for /dw-secure-audit (any hit blocks the gate).',
+        '  macOS:    brew install gitleaks',
+        '  Linux:    download from https://github.com/gitleaks/gitleaks/releases (or: go install github.com/gitleaks/gitleaks/v8@latest)',
+        '  Windows:  scoop install gitleaks   (or: choco install gitleaks)',
+        '  Docker:   docker pull zricethezav/gitleaks:latest',
+      ],
+    },
+    {
+      name: 'syft (SBOM, optional)',
+      check: 'syft version',
+      install: null,
+      instructions: [
+        'syft generates the SBOM for the advisory SBOM/license layer of /dw-secure-audit (optional, non-blocking).',
+        '  macOS:    brew install syft',
+        '  Linux:    curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin',
+        '  Windows:  scoop install syft',
       ],
     },
     {
@@ -93,6 +130,54 @@ function run() {
   if (failed) parts.push(`${failed} failed`);
   console.log(`  Done! ${parts.join(', ')}`);
   console.log();
+
+  checkPlaywrightVersion();
+  printBrowserGuidance();
+}
+
+// page.screencast (used by /dw-functional-doc to record video, including over CDP) needs
+// Playwright >= 1.60. Warn if the installed version is older.
+function checkPlaywrightVersion() {
+  try {
+    const raw = execSync('npx playwright --version', { stdio: 'pipe', timeout: 15000 }).toString();
+    const match = raw.match(/(\d+)\.(\d+)\.(\d+)/);
+    if (!match) return;
+    const [, major, minor] = match.map(Number);
+    if (major < 1 || (major === 1 && minor < 60)) {
+      console.log(`  \x1b[33m⚠ Playwright ${match[0]} detected.\x1b[0m /dw-functional-doc video needs >= 1.60 (page.screencast).`);
+      console.log('    Upgrade in your project:  npm i -D @playwright/test@latest');
+      console.log();
+    }
+  } catch {
+    // playwright not resolvable here; the flow runner reports it at runtime
+  }
+}
+
+function isWsl() {
+  if (process.env.WSL_DISTRO_NAME) return true;
+  try {
+    return /microsoft/i.test(require('fs').readFileSync('/proc/version', 'utf8'));
+  } catch {
+    return false;
+  }
+}
+
+function printBrowserGuidance() {
+  if (!isWsl()) return;
+  const mirrored = require('fs').existsSync('/sys/class/net/loopback0');
+  console.log('  Browser automation on WSL (dw-qa / dw-functional-doc / dw-redesign-ui):');
+  console.log('    Default: full headless Chromium (desktop-faithful, no WSLg) — works out of the box.');
+  console.log('    To drive the real Windows browser, set BROWSER_TEST to its exe path, e.g.');
+  console.log('    BROWSER_TEST="/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe".');
+  if (mirrored) {
+    console.log('    Mirrored networking detected — connects to the Windows browser on 127.0.0.1 directly.');
+  } else {
+    console.log('    NAT networking — run `npx @brunosps00/dev-workflow setup-wsl-browser` once to build the');
+    console.log('    cdp-relay.exe (needs Rust on Windows) and add the Hyper-V firewall rule. Otherwise flows');
+    console.log('    fall back to the local headless Chromium (faithful video, no Windows browser).');
+  }
+  console.log('    Details: .dw/skills/dw-testing-discipline/references/playwright-recipes.md ("Browser on WSL").');
+  console.log();
 }
 
 module.exports = { run };

package/lib/setup-wsl-browser.js

@@ -0,0 +1,149 @@
+const { execSync, spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// Builds the Rust CDP relay (cdp-relay.exe) on Windows and adds the one-time Hyper-V firewall
+// rule so WSL (NAT networking) can drive the real Windows browser over CDP. Idempotent.
+//
+// Why: Chromium binds its debug port to Windows loopback only, and the WSL Hyper-V firewall
+// defaults inbound to Block. A fixed-port relay + one Hyper-V allow rule bridges WSL -> browser.
+// The relay is a tiny static .exe — no Node/Python/PowerShell runtime dependency at run time.
+
+const RELAY_PORT = 39222;
+const WSL_VM_CREATOR_ID = '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}'; // standard WSL VM creator id
+const RULE_NAME = 'dw-cdp-relay';
+
+function isWsl() {
+  if (process.env.WSL_DISTRO_NAME) return true;
+  try {
+    return /microsoft/i.test(fs.readFileSync('/proc/version', 'utf8'));
+  } catch {
+    return false;
+  }
+}
+
+function winEnv(name) {
+  try {
+    const out = execSync(`cmd.exe /c "echo %${name}%"`, { stdio: 'pipe' }).toString().split(/\r?\n/)[0].trim();
+    return /^[A-Za-z]:\\/.test(out) ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+function findWindowsCargo() {
+  try {
+    const line = execSync('cmd.exe /c where cargo', { stdio: 'pipe' })
+      .toString()
+      .split(/\r?\n/)
+      .map((s) => s.trim())
+      .find((s) => /cargo\.exe$/i.test(s));
+    if (!line) return null;
+    const wsl = execSync(`wslpath -u "${line}"`, { stdio: 'pipe' }).toString().trim();
+    return fs.existsSync(wsl) ? { winPath: line, wslPath: wsl } : null;
+  } catch {
+    return null;
+  }
+}
+
+function copyCrate(srcDir, destWslDir) {
+  fs.mkdirSync(path.join(destWslDir, 'src'), { recursive: true });
+  fs.copyFileSync(path.join(srcDir, 'Cargo.toml'), path.join(destWslDir, 'Cargo.toml'));
+  fs.copyFileSync(path.join(srcDir, 'src', 'main.rs'), path.join(destWslDir, 'src', 'main.rs'));
+}
+
+function run() {
+  console.log('\n  dev-workflow setup-wsl-browser');
+  console.log(`  ${'='.repeat(40)}\n`);
+
+  if (!isWsl()) {
+    console.log('  This command is only needed on WSL. On native Windows/macOS/Linux, flows use the local browser directly.');
+    return;
+  }
+
+  const localAppData = winEnv('LOCALAPPDATA');
+  if (!localAppData) {
+    console.log('  \x1b[31m✗\x1b[0m Could not resolve %LOCALAPPDATA% on Windows. Is Windows interop enabled?');
+    return;
+  }
+  const destWin = `${localAppData}\\dev-workflow`;
+  const destWsl = execSync(`wslpath -u "${destWin}"`, { stdio: 'pipe' }).toString().trim();
+  const srcWslDir = `${destWsl}/cdp-relay-src`;
+  const srcWinDir = `${destWin}\\cdp-relay-src`;
+
+  // 1) Build the relay with the Windows Rust toolchain.
+  const cargo = findWindowsCargo();
+  if (!cargo) {
+    console.log('  \x1b[33m—\x1b[0m No Windows `cargo` found (where cargo). Install Rust on Windows: https://rustup.rs');
+    console.log('    Without the relay, WSL flows fall back to the local headless Chromium (faithful, no Windows browser).');
+    return;
+  }
+
+  const crateSrc = path.join(__dirname, '..', 'scaffold', 'scripts', 'cdp-relay');
+  if (!fs.existsSync(path.join(crateSrc, 'Cargo.toml'))) {
+    console.log(`  \x1b[31m✗\x1b[0m Relay crate source not found at ${crateSrc}`);
+    return;
+  }
+
+  process.stdout.write('  Building cdp-relay.exe (Windows cargo, release)...');
+  try {
+    fs.mkdirSync(destWsl, { recursive: true });
+    copyCrate(crateSrc, srcWslDir);
+    execSync(`"${cargo.wslPath}" build --release --manifest-path "${srcWinDir}\\Cargo.toml"`, {
+      stdio: 'pipe',
+      timeout: 180000,
+    });
+    fs.copyFileSync(path.join(srcWslDir, 'target', 'release', 'cdp-relay.exe'), path.join(destWsl, 'cdp-relay.exe'));
+    console.log(' \x1b[32m✓\x1b[0m');
+    console.log(`    ${destWin}\\cdp-relay.exe`);
+  } catch (err) {
+    console.log(' \x1b[31m✗\x1b[0m');
+    console.log(`    ${String(err.message).split('\n')[0]}`);
+    return;
+  }
+
+  // 2) Add the Hyper-V firewall inbound rule (one-time, elevated -> UAC prompt).
+  console.log(`\n  Adding Hyper-V firewall rule for TCP ${RELAY_PORT} (a UAC prompt will appear — accept it)...`);
+  const inner = [
+    `Remove-NetFirewallHyperVRule -Name '${RULE_NAME}' -ErrorAction SilentlyContinue;`,
+    `New-NetFirewallHyperVRule -Name '${RULE_NAME}' -DisplayName 'dev-workflow cdp-relay'`,
+    `-Direction Inbound -Action Allow -VMCreatorId '${WSL_VM_CREATOR_ID}' -Protocol TCP -LocalPorts ${RELAY_PORT}`,
+  ].join(' ');
+  try {
+    execSync(
+      `powershell.exe -NoProfile -Command "Start-Process powershell -Verb RunAs -WindowStyle Hidden -ArgumentList '-NoProfile','-Command',\\"${inner}\\""`,
+      { stdio: 'pipe', timeout: 60000 },
+    );
+  } catch {
+    // Start-Process returns before the elevated process finishes; verify below regardless.
+  }
+
+  // 3) Verify.
+  let ok = false;
+  for (let i = 0; i < 10 && !ok; i += 1) {
+    try {
+      const out = execSync(
+        `powershell.exe -NoProfile -c "Get-NetFirewallHyperVRule -Name '${RULE_NAME}' -ErrorAction SilentlyContinue | Select-Object -Expand Action"`,
+        { stdio: 'pipe', timeout: 15000 },
+      ).toString();
+      ok = /Allow/i.test(out);
+    } catch {
+      ok = false;
+    }
+    if (!ok) execSync('sleep 1');
+  }
+
+  console.log(`  ${'='.repeat(40)}`);
+  if (ok) {
+    console.log('  \x1b[32m✓ Done.\x1b[0m The Windows browser is reachable from WSL over CDP.');
+    console.log(`    Set BROWSER_TEST to a Windows browser exe to use it, e.g.`);
+    console.log('    BROWSER_TEST="/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"');
+  } else {
+    console.log('  \x1b[33m⚠ Hyper-V firewall rule not confirmed.\x1b[0m UAC may have been declined, or this Windows lacks');
+    console.log('    Hyper-V firewall cmdlets. Flows will fall back to the local headless Chromium (faithful video, no');
+    console.log('    Windows browser). You can also enable mirrored networking instead. Re-run to retry.');
+  }
+  console.log();
+}
+
+module.exports = { run, RELAY_PORT };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "1.0.5",
+  "version": "1.1.0",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"

package/scaffold/en/agent-instructions.md

@@ -13,7 +13,7 @@ Before picking a command from the Trigger Map, gauge the change's actual scope.
 |------|---------------------|----------|
 | **Small** | ≤3 files, no migration, no new endpoint, can be summarized in one sentence. Examples: typo, log message, single-line config, dependency bump, version pin. | Just do it inline. No `dw-*` command. |
 | **Medium** | Clear feature or bug, <10 numbered tasks expected, single component or single service, no architectural decisions. Examples: add a form field with validation, fix a regression in a known module, wire a new API endpoint into an existing handler. | `/dw-bugfix` (for bugs) or `/dw-plan` (for features) — straight, not via `/dw-autopilot`. |
-| **Large** | Multi-component feature, ≥10 tasks expected, touches multiple modules, has user-visible UX surface AND backend. Examples: add a new entity end-to-end (model + migration + API + UI), introduce a third-party integration, redesign a flow. | `/dw-autopilot "<wish>"` — full PRD → TechSpec → Tasks → Run → QA → Review → Commit → PR pipeline with three gates. |
+| **Large** | Multi-component feature, ≥10 tasks expected, touches multiple modules, has user-visible UX surface AND backend. Examples: add a new entity end-to-end (model + migration + API + UI), introduce a third-party integration, redesign a flow. | `/dw-autopilot "<wish>"` — first invocation plans and stops; second invocation resumes via `/dw-goal` for Run → Review → QA/Fix → Review, then Commit → PR. |
 | **Complex** | New domain, ambiguous requirements, architectural decision required, regulatory or compliance surface, or scope that spans multiple PRDs. Examples: introduce event sourcing, rebuild auth, multi-tenancy, a new product line. | `/dw-brainstorm "<idea>"` first (auto-dispatches research/council modes), then `/dw-plan --council` so the techspec stage runs the multi-advisor debate. |
 
 **Safety valve:** if you start in Small or Medium but the work reveals it's actually Large (the inline listing exceeds 5 steps, or `/dw-bugfix` triggers its `Step 5.0` valve), STOP and escalate. There is no flag to bypass. Escalation is the correct outcome.
@@ -26,6 +26,7 @@ Before picking a command from the Trigger Map, gauge the change's actual scope.
 |--------------------------------------|--------------|
 | "Implement X" / "Build Y" / "Add feature Z" / "I need ..." / "Create ..." | `/dw-autopilot "X"` |
 | "Autopilot this PRD" / "Take this PRD to PR" / continue a bugfix escalation autonomously | `/dw-autopilot --from-prd <slug>` (existing PRD at `.dw/spec/<slug>/`) |
+| "Resume autopilot" / "continue after plan" / `autopilot-state.json` has `status: plan_complete` | `/dw-autopilot` (or `/dw-goal --from-autopilot <slug>` if the user specifically asks for the goal step) |
 | Pasted error / "X is broken" / "Bug in Y" / failing test screenshot | `/dw-bugfix "X"` |
 | "Plan this feature" / "Write a PRD + techspec + tasks" | `/dw-plan "X"` |
 | "Write a PRD for X" / "Spec out Y" | `/dw-plan prd "X"` |
@@ -33,6 +34,7 @@ Before picking a command from the Trigger Map, gauge the change's actual scope.
 | "Break this into tasks" | `/dw-plan tasks` |
 | "Run this task" (with task ID) | `/dw-run <ID>` |
 | "Run all pending tasks" / "Execute the plan" | `/dw-run` |
+| "Run this as a goal" / "durable goal" / "long-running objective" | `/dw-goal "<objective>"` |
 | "Continue where I left off" | `/dw-run --resume` |
 | "Pause work" / "End the session" / "Save where we are" | `/dw-pause` |
 | "Resume" / "Where did we stop?" / "Pick up where we left off" | `/dw-resume` |
@@ -63,7 +65,7 @@ Before picking a command from the Trigger Map, gauge the change's actual scope.
 | "Install Azure skills" / "Setup Microsoft docs MCP" / "Add Azure expertise" / "I'm going to work on Azure" | `/dw-install-azure-skills` |
 | "Install AWS skills" / "Setup AWS MCP" / "Add AWS expertise" / "I'm going to work on AWS" | `/dw-install-aws-skills` |
 
-**Priority:** when in doubt between two commands, `/dw-autopilot` is the safest default for any non-trivial feature request — it composes the rest.
+**Priority:** when in doubt between two commands, `/dw-autopilot` is the safest default for any non-trivial feature request. If a planned autopilot has already stopped with `status: plan_complete`, resume it instead of starting a new plan; the execution phase is owned by `/dw-goal`.
 
 ## Hard Gates (the commands enforce these — don't bypass)
 
@@ -131,12 +133,12 @@ Skills are compact protocols first. Read the `SKILL.md` entrypoint, then load fi
 ## Workflow Reference
 
 ```
-/dw-autopilot "wish"  ────►  Runs entire pipeline automatically
-                              (3 gates: PRD approval, Tasks approval, PR confirmation)
+/dw-autopilot "wish"  ────►  First invocation plans: PRD → TechSpec → Tasks → STOP
+/dw-autopilot         ────►  Second invocation resumes: /dw-goal → Commit → PR
 
   --- OR step-by-step ---
 
-/dw-brainstorm ─► /dw-plan ─► /dw-run ─► /dw-qa ─► /dw-review ─► /dw-commit ─► /dw-generate-pr
+/dw-brainstorm ─► /dw-plan ─► /dw-goal ─► /dw-commit ─► /dw-generate-pr
 ```
 
 Full command list and contextual help: `/dw-help`.

package/scaffold/en/commands/dw-analyze-project.md

@@ -827,6 +827,27 @@ If after the heuristics nothing crosses the bar (small codebase, low churn, no i
 
 **Refresh cadence:** users re-run `/dw-analyze-project` whenever rules drift. Step 9 refreshes auto sections while keeping preserved entries. There is no separate refresh-only command.
 
+### Step 10: Design authority (DESIGN.md) — frontend projects only
+
+Run this when a frontend was detected (React/Vue/Angular/Svelte/Tailwind/CSS) so `dw-ui-discipline`'s
+grounding question 1 ("where do design decisions come from?") has a project authority to defer to. This
+closes the loop the grounding only *reads* today.
+
+1. **Check for an existing authority first.** If `DESIGN.md`, `BRAND.md`, or `STYLE_GUIDE.md` already
+   exists at the project (or a frontend module) root, do NOT overwrite — note its location and stop.
+2. **Detect design tokens** in priority order: Tailwind `theme`/`@theme` (colors, fontFamily, spacing,
+   radius), CSS custom properties in `globals.css`/`theme.css`/`tokens.css`, MUI/Chakra theme exports,
+   shadcn `components.json`, Storybook theme. Read the real values — do not invent.
+3. **If tokens exist:** synthesize `DESIGN.md` at the frontend root capturing what the project ALREADY
+   uses — palette (with the actual hex/oklch values and token names), typography (families, scale,
+   weights), spacing/radius scale, and any component conventions observed. Head it with:
+   `> Generated by /dw-analyze-project from existing tokens on <date>. Curate before treating as canon.`
+4. **If no tokens exist:** do NOT fabricate a palette. Recommend bootstrapping from
+   `dw-ui-discipline/references/curated-defaults.md` and record that recommendation in the rules index.
+5. Reference the new `DESIGN.md` from `.dw/rules/<frontend-module>.md` so downstream commands find it.
+
+This step is additive and reversible; it never edits component code, only documents what is there.
+
 ## Quality Checklist
 
 Before declaring the analysis complete, verify:
@@ -850,6 +871,7 @@ Before declaring the analysis complete, verify:
 - [ ] All file paths in rules reference real, existing files
 - [ ] Step 8 (constitution) offered and resolved (A/B/C)
 - [ ] Step 9 (concerns map) presented candidates, awaited approval, wrote `.dw/rules/concerns.md` (or noted no signals)
+- [ ] Step 10 (design authority) ran for frontend projects: existing authority respected, or `DESIGN.md` generated from real tokens, or curated-defaults bootstrap recommended
 - [ ] Preserved-marker blocks in concerns.md kept verbatim on refresh
 - [ ] Topology analysis completed (god nodes, coupling metrics, dependency graph)
 - [ ] Critical nodes table generated with Ca, Ce, instability