@byh3071/vhk 0.8.0 → 0.9.1

package/README.md

@@ -1,12 +1,12 @@
 ---
 id: vhk-readme
 date: 2026-05-24
-tags: [vhk, cli, readme, v0.8.0]
+tags: [vhk, cli, readme, v0.9.0]
 ---
 
 # 🔧 VHK — Vibe Harness Kit
 
-> AI 코딩 에이전트를 부리는 사람을 위한 **한국어 풀사이클 CLI** (v0.8.0)
+> AI 코딩 에이전트를 부리는 사람을 위한 **한국어 풀사이클 CLI** (v0.9.0)
 >
 > 🍽️ **VHK는 VHK로 부트스트랩됨** — 이 레포의 `docs/`, `CLAUDE.md`, `.cursorrules`도 `vhk init`이 만들었습니다.
 
@@ -99,6 +99,10 @@ vhk 기획 끝났고 바로 시작
 | `vhk design-palette` | `팔레트` | 컬러 팔레트 프리셋 선택 + 적용 |
 | `vhk theme` | `테마` | 다크/라이트 모드 CSS + 토글 유틸리티 생성 |
 | `vhk ref` | `레퍼런스` | 레퍼런스 URL 관리 (`add` / `list` / `open`) |
+| `vhk harness` | `하네스` | 통합 품질 점검 (lint + type-check + test + build 순차 실행 + 리포트) |
+| `vhk audit` | `감사` | npm 보안 취약점 감사 (`--fix`로 자동 수정) |
+| `vhk migrate [target]` | `전환` | 패키지 매니저 전환 (`npm` / `yarn` / `pnpm`, lockfile + node_modules 재구성) |
+| `vhk update` | `업데이트` | VHK CLI 최신 버전으로 셀프 업데이트 |
 
 ### init 옵션
 
@@ -133,6 +137,24 @@ MCP 서버를 수동으로 띄우려면:
 vhk mcp                # stdio 서버 시작 (Cursor가 자동으로 호출)
 ```
 
+## v0.9.0 하이라이트
+
+| 기능 | 설명 |
+|------|------|
+| **harness** | `package.json` scripts 자동 감지 → `lint` / `type-check` / `test` / `build` 순차 실행 + 통합 리포트. 일부 실패해도 끝까지 진행 |
+| **audit** | `npm audit --json` 래핑 + 심각도별 요약. `Critical`/`High` 발견 시 자동 fix 옵션. Windows PowerShell 호환 (`2>/dev/null` 미사용) |
+| **migrate** | npm/yarn/pnpm 전환 — 대상 CLI 존재 확인 → 확인 프롬프트 → 기존 lockfile + node_modules 정리 → `<pm> install` |
+| **update** | npm registry에서 `@byh3071/vhk` 최신 버전 조회 → semver 비교 → `npm update -g` 실행. 현재 버전이 같거나 더 높으면 스킵 |
+| **자연어 확장** | `"품질 점검해줘"` → harness · `"보안 감사 해줘"` / `"취약점 확인"` → audit · `"패키지 매니저 전환"` → migrate · `"vhk 업데이트 해줘"` → update. 키워드 충돌 가드: `점검` 단독은 기존 `check`에 양보, `보안` 단독은 기존 `secure`에 양보 |
+
+```powershell
+vhk harness             # lint + type-check + test + build 순차 실행
+vhk audit               # npm 보안 감사 (Critical/High 발견 시 자동 fix 옵션)
+vhk audit --fix         # 항상 npm audit fix 실행
+vhk migrate pnpm        # npm/yarn → pnpm 전환 (대화형 확인)
+vhk update              # @byh3071/vhk 최신 버전 체크 + 글로벌 업데이트
+```
+
 ## v0.8.0 하이라이트
 
 | 기능 | 설명 |
@@ -224,6 +246,10 @@ vhk ref open 1          # 1번 레퍼런스를 브라우저로 열기
 | 팔레트 골라줘 | `vhk design-palette` |
 | 다크 모드 적용 | `vhk theme` |
 | 레퍼런스 보여줘 | `vhk ref` (list) |
+| 품질 점검해줘 | `vhk harness` |
+| 보안 감사 해줘 / 취약점 확인 | `vhk audit` |
+| 패키지 매니저 전환 | `vhk migrate` |
+| vhk 업데이트 해줘 | `vhk update` |
 
 ## 특징
 

package/dist/{chunk-NQ4V3VN4.js → chunk-UPXCLOBF.js}

@@ -310,6 +310,19 @@ var ko = {
     publishing: "npm \uBC30\uD3EC \uC911...",
     publishSuccess: "npm \uBC30\uD3EC \uC131\uACF5!",
     publishFailed: "npm \uBC30\uD3EC \uC2E4\uD328"
+  },
+  harness: {
+    title: "\uD1B5\uD569 \uD488\uC9C8 \uC810\uAC80"
+  },
+  audit: {
+    title: "\uBCF4\uC548 \uAC10\uC0AC"
+  },
+  migrate: {
+    title: "\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658",
+    selectTarget: "\uC5B4\uB5A4 \uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800\uB85C \uC804\uD658\uD560\uAE4C\uC694?"
+  },
+  update: {
+    title: "VHK CLI \uC5C5\uB370\uC774\uD2B8"
   }
 };
 function lookup(path) {
@@ -442,21 +455,31 @@ function platformCmd(cmd) {
   }
   return cmd;
 }
+function resolveCmd(cmd, args) {
+  if (process.platform === "win32" && SHIM_BINARIES.has(cmd)) {
+    return { bin: "cmd.exe", argv: ["/d", "/s", "/c", `${cmd}.cmd`, ...args] };
+  }
+  return { bin: platformCmd(cmd), argv: args };
+}
 function safeExecFile(cmd, args) {
+  const { bin, argv } = resolveCmd(cmd, args);
   try {
-    const out = execFileSync(platformCmd(cmd), args, {
+    const out = execFileSync(bin, argv, {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).toString();
     return { ok: true, out: out.trim() };
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, err: msg };
+    const e = err;
+    const stdout = e.stdout ? e.stdout.toString() : "";
+    const msg = e.message ?? String(err);
+    return { ok: false, err: msg, out: stdout.trim() };
   }
 }
 function safeExecFileStream(cmd, args) {
+  const { bin, argv } = resolveCmd(cmd, args);
   try {
-    execFileSync(platformCmd(cmd), args, {
+    execFileSync(bin, argv, {
       encoding: "utf-8",
       stdio: "inherit"
     });

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   safeExecFileStream,
   startMcpServer,
   t
-} from "./chunk-NQ4V3VN4.js";
+} from "./chunk-UPXCLOBF.js";
 
 // node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -310,7 +310,7 @@ var require_ignore = __commonJS({
       //   path matching.
       // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
       // @returns {TestResult} true if a file is ignored
-      test(path15, checkUnignored, mode) {
+      test(path16, checkUnignored, mode) {
         let ignored = false;
         let unignored = false;
         let matchedRule;
@@ -319,7 +319,7 @@ var require_ignore = __commonJS({
           if (unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored) {
             return;
           }
-          const matched = rule[mode].test(path15);
+          const matched = rule[mode].test(path16);
           if (!matched) {
             return;
           }
@@ -340,17 +340,17 @@ var require_ignore = __commonJS({
     var throwError = (message, Ctor) => {
       throw new Ctor(message);
     };
-    var checkPath = (path15, originalPath, doThrow) => {
-      if (!isString(path15)) {
+    var checkPath = (path16, originalPath, doThrow) => {
+      if (!isString(path16)) {
         return doThrow(
           `path must be a string, but got \`${originalPath}\``,
           TypeError
         );
       }
-      if (!path15) {
+      if (!path16) {
         return doThrow(`path must not be empty`, TypeError);
       }
-      if (checkPath.isNotRelative(path15)) {
+      if (checkPath.isNotRelative(path16)) {
         const r = "`path.relative()`d";
         return doThrow(
           `path should be a ${r} string, but got "${originalPath}"`,
@@ -359,7 +359,7 @@ var require_ignore = __commonJS({
       }
       return true;
     };
-    var isNotRelative = (path15) => REGEX_TEST_INVALID_PATH.test(path15);
+    var isNotRelative = (path16) => REGEX_TEST_INVALID_PATH.test(path16);
     checkPath.isNotRelative = isNotRelative;
     checkPath.convert = (p) => p;
     var Ignore = class {
@@ -389,19 +389,19 @@ var require_ignore = __commonJS({
       }
       // @returns {TestResult}
       _test(originalPath, cache, checkUnignored, slices) {
-        const path15 = originalPath && checkPath.convert(originalPath);
+        const path16 = originalPath && checkPath.convert(originalPath);
         checkPath(
-          path15,
+          path16,
           originalPath,
           this._strictPathCheck ? throwError : RETURN_FALSE
         );
-        return this._t(path15, cache, checkUnignored, slices);
+        return this._t(path16, cache, checkUnignored, slices);
       }
-      checkIgnore(path15) {
-        if (!REGEX_TEST_TRAILING_SLASH.test(path15)) {
-          return this.test(path15);
+      checkIgnore(path16) {
+        if (!REGEX_TEST_TRAILING_SLASH.test(path16)) {
+          return this.test(path16);
         }
-        const slices = path15.split(SLASH).filter(Boolean);
+        const slices = path16.split(SLASH).filter(Boolean);
         slices.pop();
         if (slices.length) {
           const parent = this._t(
@@ -414,18 +414,18 @@ var require_ignore = __commonJS({
             return parent;
           }
         }
-        return this._rules.test(path15, false, MODE_CHECK_IGNORE);
+        return this._rules.test(path16, false, MODE_CHECK_IGNORE);
       }
-      _t(path15, cache, checkUnignored, slices) {
-        if (path15 in cache) {
-          return cache[path15];
+      _t(path16, cache, checkUnignored, slices) {
+        if (path16 in cache) {
+          return cache[path16];
         }
         if (!slices) {
-          slices = path15.split(SLASH).filter(Boolean);
+          slices = path16.split(SLASH).filter(Boolean);
         }
         slices.pop();
         if (!slices.length) {
-          return cache[path15] = this._rules.test(path15, checkUnignored, MODE_IGNORE);
+          return cache[path16] = this._rules.test(path16, checkUnignored, MODE_IGNORE);
         }
         const parent = this._t(
           slices.join(SLASH) + SLASH,
@@ -433,29 +433,29 @@ var require_ignore = __commonJS({
           checkUnignored,
           slices
         );
-        return cache[path15] = parent.ignored ? parent : this._rules.test(path15, checkUnignored, MODE_IGNORE);
+        return cache[path16] = parent.ignored ? parent : this._rules.test(path16, checkUnignored, MODE_IGNORE);
       }
-      ignores(path15) {
-        return this._test(path15, this._ignoreCache, false).ignored;
+      ignores(path16) {
+        return this._test(path16, this._ignoreCache, false).ignored;
       }
       createFilter() {
-        return (path15) => !this.ignores(path15);
+        return (path16) => !this.ignores(path16);
       }
       filter(paths) {
         return makeArray(paths).filter(this.createFilter());
       }
       // @returns {TestResult}
-      test(path15) {
-        return this._test(path15, this._testCache, true);
+      test(path16) {
+        return this._test(path16, this._testCache, true);
       }
     };
     var factory = (options) => new Ignore(options);
-    var isPathValid = (path15) => checkPath(path15 && checkPath.convert(path15), path15, RETURN_FALSE);
+    var isPathValid = (path16) => checkPath(path16 && checkPath.convert(path16), path16, RETURN_FALSE);
     var setupWindows = () => {
       const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
       checkPath.convert = makePosix;
       const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
-      checkPath.isNotRelative = (path15) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path15) || isNotRelative(path15);
+      checkPath.isNotRelative = (path16) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path16) || isNotRelative(path16);
     };
     if (
       // Detect `process` so that it can run in browsers.
@@ -472,7 +472,10 @@ var require_ignore = __commonJS({
 
 // src/index.ts
 import { Command, Help } from "commander";
-import inquirer12 from "inquirer";
+import inquirer14 from "inquirer";
+import fs16 from "fs";
+import path15 from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/lib/nlp-router.ts
 function normalize(input) {
@@ -508,7 +511,7 @@ var RULES = [
     command: "init",
     explanation: "\uD504\uB85C\uC81D\uD2B8 \uC2DC\uC791 (vhk \uC2DC\uC791)",
     confidence: "high",
-    test: (t2) => /프로젝트.*(만들|시작)|폴더.*만들|만들고\s*싶|하네스|초기화/.test(t2) || /^시작$/.test(t2)
+    test: (t2) => (/프로젝트.*(만들|시작)|폴더.*만들|만들고\s*싶|하네스|초기화/.test(t2) || /^시작$/.test(t2)) && !/디자인|design|팔레트|palette|테마|theme|레퍼런스|reference|다크\s*모드|라이트\s*모드|색상\s*모드/.test(t2)
   },
   {
     command: "mcp-init",
@@ -526,13 +529,13 @@ var RULES = [
     command: "design",
     explanation: "\uB514\uC790\uC778 \uD1A0\uD070 \uC0DD\uC131 (vhk design)",
     confidence: "high",
-    test: (t2) => /디자인\s*(토큰|시스템|만들|생성|셋업|설정)|design\s*(token|system|setup)|토큰\s*만들|css\s*변수.*만들|tailwind\s*(컬러|설정)/.test(t2)
+    test: (t2) => /디자인\s*(토큰|시스템|만들|생성|셋업|설정)|design\s*(token|system|setup)|토큰\s*만들|css\s*변수.*만들|tailwind\s*(컬러|설정)/.test(t2) && !/배포|deploy|vercel|netlify|cloudflare|wrangler|출시|publish|npm/.test(t2)
   },
   {
     command: "theme",
     explanation: "\uB2E4\uD06C/\uB77C\uC774\uD2B8 \uD14C\uB9C8 \uC801\uC6A9 (vhk theme)",
     confidence: "high",
-    test: (t2) => /테마(?!\s*(파일|이름))|theme|다크\s*모드|라이트\s*모드|dark\s*mode|light\s*mode|색상\s*모드|모드\s*전환/.test(t2)
+    test: (t2) => /테마(?!\s*(파일|이름))|theme|다크\s*모드|라이트\s*모드|dark\s*mode|light\s*mode|색상\s*모드|모드\s*전환/.test(t2) && !/보안|시크릿|비밀|키\s*유출|secure|scan|스캔|배포|deploy/.test(t2)
   },
   {
     command: "ref",
@@ -540,6 +543,30 @@ var RULES = [
     confidence: "high",
     test: (t2) => /^레퍼런스$|^ref$|레퍼런스.*(보|목록|확인|있|뭐)|참고\s*(사이트|목록|링크)|reference.*list/.test(t2) && !/(add|추가|open|열|https?:\/\/)/.test(t2)
   },
+  {
+    command: "harness",
+    explanation: "\uD1B5\uD569 \uD488\uC9C8 \uC810\uAC80 (vhk harness)",
+    confidence: "high",
+    test: (t2) => /하네스|harness|통합\s*점검|품질\s*점검|빌드\s*테스트|lint.*(test|build)|전체\s*점검|품질\s*확인/.test(t2)
+  },
+  {
+    command: "audit",
+    explanation: "\uBCF4\uC548 \uCDE8\uC57D\uC810 \uAC10\uC0AC (vhk audit)",
+    confidence: "high",
+    test: (t2) => /감사|취약점|audit|vulnerability|보안\s*감사|보안\s*취약|의존성\s*취약/.test(t2)
+  },
+  {
+    command: "migrate",
+    explanation: "\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658 (vhk migrate)",
+    confidence: "high",
+    test: (t2) => /전환|마이그레이트|migrate|패키지\s*매니저|npm.*pnpm|pnpm.*npm|yarn.*전환|npm.*전환|pnpm.*전환/.test(t2)
+  },
+  {
+    command: "update",
+    explanation: "VHK CLI \uCD5C\uC2E0 \uBC84\uC804 \uC5C5\uB370\uC774\uD2B8 (vhk update)",
+    confidence: "high",
+    test: (t2) => /업데이트|update|버전\s*업|최신\s*버전|셀프\s*업데이트|vhk.*최신|vhk.*업데이트/.test(t2)
+  },
   {
     command: "secure",
     explanation: "\uBCF4\uC548 \uC2A4\uCE94 (vhk \uBCF4\uC548)",
@@ -706,6 +733,14 @@ var KNOWN_COMMAND_TOKENS = /* @__PURE__ */ new Set([
   "\uD14C\uB9C8",
   "ref",
   "\uB808\uD37C\uB7F0\uC2A4",
+  "harness",
+  "\uD558\uB124\uC2A4",
+  "audit",
+  "\uAC10\uC0AC",
+  "migrate",
+  "\uC804\uD658",
+  "update",
+  "\uC5C5\uB370\uC774\uD2B8",
   "help"
 ]);
 function isOptionToken(token) {
@@ -729,8 +764,8 @@ function detectNaturalLanguageInput(argv) {
 }
 
 // src/lib/nlp-run.ts
-import chalk21 from "chalk";
-import inquirer11 from "inquirer";
+import chalk25 from "chalk";
+import inquirer13 from "inquirer";
 
 // src/commands/gate.ts
 import inquirer from "inquirer";
@@ -3567,17 +3602,21 @@ async function publish() {
     console.log(chalk17.gray("\uCDE8\uC18C\uB428. \uBC84\uC804\uC774 \uC6D0\uB798\uB300\uB85C \uBCF5\uAD6C\uB429\uB2C8\uB2E4."));
     return;
   }
-  const pubSpinner = ora2(t("publish.publishing")).start();
-  const pubResult = safeExecFile("npm", ["publish", "--access", "public"]);
+  console.log(chalk17.cyan(`
+\u{1F4E4} ${t("publish.publishing")}`));
+  console.log(chalk17.gray("   2FA \uD65C\uC131\uD654 \uC2DC: OTP 6\uC790\uB9AC \uC785\uB825 \uB610\uB294 \uBE0C\uB77C\uC6B0\uC800 \uC778\uC99D URL \uD074\uB9AD (Windows Hello / PIN \uC9C0\uC6D0)"));
+  const pubResult = safeExecFileStream("npm", ["publish", "--access", "public"]);
   if (!pubResult.ok) {
-    pubSpinner.fail(t("publish.publishFailed"));
+    console.log(chalk17.red(`
+\u2716 ${t("publish.publishFailed")}`));
     console.log(chalk17.red(pubResult.err.slice(0, 500)));
     pkg.version = currentVersion;
     writeFileSync2("package.json", JSON.stringify(pkg, null, 2) + "\n", "utf-8");
     console.log(chalk17.gray(`\u{1F4E6} package.json \uBC84\uC804\uC744 v${currentVersion}\uB85C \uBCF5\uAD6C\uD588\uC2B5\uB2C8\uB2E4.`));
     return;
   }
-  pubSpinner.succeed(t("publish.publishSuccess"));
+  console.log(chalk17.green(`
+\u2714 ${t("publish.publishSuccess")}`));
   const addResult = safeExecFile("git", ["add", "package.json"]);
   if (addResult.ok) {
     safeExecFile("git", ["commit", "-m", `chore: release v${newVersion}`]);
@@ -3926,6 +3965,367 @@ async function refOpen(indexStr) {
   }
 }
 
+// src/commands/harness.ts
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
+import chalk21 from "chalk";
+import ora3 from "ora";
+function detectPM() {
+  if (existsSync7("pnpm-lock.yaml")) return "pnpm";
+  if (existsSync7("yarn.lock")) return "yarn";
+  return "npm";
+}
+function pmRun(pm, script) {
+  return pm === "npm" ? ["run", script] : [script];
+}
+function detectChecks() {
+  const checks = [];
+  let pkg = {};
+  try {
+    pkg = JSON.parse(readFileSync4("package.json", "utf-8"));
+  } catch {
+    return checks;
+  }
+  const s = pkg.scripts ?? {};
+  const pm = detectPM();
+  if (s.lint) {
+    checks.push({ name: "lint", bin: pm, args: pmRun(pm, "lint") });
+  } else if (existsSync7(".eslintrc.js") || existsSync7(".eslintrc.json") || existsSync7("eslint.config.js")) {
+    checks.push({ name: "lint", bin: "npx", args: ["eslint", ".", "--ext", ".ts,.tsx"] });
+  }
+  if (s["type-check"]) {
+    checks.push({ name: "type-check", bin: pm, args: pmRun(pm, "type-check") });
+  } else if (s.typecheck) {
+    checks.push({ name: "type-check", bin: pm, args: pmRun(pm, "typecheck") });
+  } else if (existsSync7("tsconfig.json")) {
+    checks.push({ name: "type-check", bin: "npx", args: ["tsc", "--noEmit"] });
+  }
+  if (s.test) {
+    checks.push({ name: "test", bin: pm, args: pmRun(pm, "test") });
+  }
+  if (s.build) {
+    checks.push({ name: "build", bin: pm, args: pmRun(pm, "build") });
+  }
+  return checks;
+}
+async function harness() {
+  console.log(chalk21.bold("\n\u{1F527} " + t("harness.title")));
+  console.log(chalk21.gray("\u2500".repeat(40)));
+  const checks = detectChecks();
+  if (checks.length === 0) {
+    console.log(chalk21.yellow("\n\u26A0\uFE0F  \uC2E4\uD589\uD560 \uC218 \uC788\uB294 \uC2A4\uD06C\uB9BD\uD2B8\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4."));
+    console.log(chalk21.gray("   package.json\uC5D0 lint, test, build \uC2A4\uD06C\uB9BD\uD2B8\uB97C \uCD94\uAC00\uD574\uC8FC\uC138\uC694."));
+    return;
+  }
+  console.log(chalk21.cyan(`
+\u{1F3C3} ${checks.length}\uAC1C \uC810\uAC80 \uC2DC\uC791:
+`));
+  const results = [];
+  for (const check2 of checks) {
+    const display = `${check2.bin} ${check2.args.join(" ")}`;
+    const spinner = ora3(`${check2.name} \uC2E4\uD589 \uC911...`).start();
+    const start = Date.now();
+    const result = safeExecFile(check2.bin, check2.args);
+    const duration = Date.now() - start;
+    const sec = (duration / 1e3).toFixed(1);
+    if (result.ok) {
+      spinner.succeed(`${check2.name} ${chalk21.gray(`(${sec}s)`)}`);
+      results.push({ name: check2.name, command: display, passed: true, duration });
+    } else {
+      spinner.fail(`${check2.name} ${chalk21.gray(`(${sec}s)`)}`);
+      results.push({
+        name: check2.name,
+        command: display,
+        passed: false,
+        duration,
+        error: result.err.slice(0, 200)
+      });
+    }
+  }
+  console.log(chalk21.bold("\n\u{1F4CA} \uD1B5\uD569 \uB9AC\uD3EC\uD2B8:"));
+  console.log(chalk21.gray("\u2500".repeat(40)));
+  for (const r of results) {
+    const icon = r.passed ? chalk21.green("\u2705") : chalk21.red("\u274C");
+    const sec = (r.duration / 1e3).toFixed(1);
+    console.log(`  ${icon} ${r.name.padEnd(15)} ${chalk21.gray(`${sec}s`)}`);
+  }
+  const passed = results.filter((r) => r.passed).length;
+  const all = passed === results.length;
+  console.log(chalk21.gray("\u2500".repeat(40)));
+  if (all) {
+    console.log(chalk21.green.bold(`
+\u{1F389} \uC804\uCCB4 \uD1B5\uACFC! (${passed}/${results.length})`));
+  } else {
+    console.log(
+      chalk21.red.bold(`
+\u26A0\uFE0F  ${results.length - passed}\uAC1C \uC2E4\uD328 (${passed}/${results.length} \uD1B5\uACFC)`)
+    );
+  }
+  printNextStep({
+    message: all ? "\uD488\uC9C8 \uC810\uAC80 \uD1B5\uACFC!" : "\uC2E4\uD328 \uD56D\uBAA9\uC744 \uC218\uC815\uD558\uC138\uC694.",
+    command: all ? "vhk ship" : "vhk doctor",
+    cursorHint: all ? "\uBC30\uD3EC\uD574\uC918" : "\uBB38\uC81C \uC9C4\uB2E8\uD574\uC918"
+  });
+}
+
+// src/commands/audit.ts
+import { existsSync as existsSync8 } from "fs";
+import chalk22 from "chalk";
+import inquirer11 from "inquirer";
+import ora4 from "ora";
+function detectCurrentPM() {
+  if (existsSync8("pnpm-lock.yaml")) return "pnpm";
+  if (existsSync8("yarn.lock")) return "yarn";
+  return "npm";
+}
+function parseAuditOutput(output, pm) {
+  const empty = { critical: 0, high: 0, moderate: 0, low: 0, total: 0 };
+  if (!output) return empty;
+  try {
+    const json = JSON.parse(output);
+    const meta = json.metadata?.vulnerabilities;
+    if (meta) {
+      const summary = {
+        critical: meta.critical ?? 0,
+        high: meta.high ?? 0,
+        moderate: meta.moderate ?? 0,
+        low: meta.low ?? 0,
+        total: meta.total ?? 0
+      };
+      if (!summary.total) {
+        summary.total = summary.critical + summary.high + summary.moderate + summary.low;
+      }
+      return summary;
+    }
+    void pm;
+    return empty;
+  } catch {
+    return empty;
+  }
+}
+function runAuditJson(pm) {
+  const result = safeExecFile(pm, ["audit", "--json"]);
+  return result.out;
+}
+function runAuditFix(pm) {
+  if (pm !== "npm") {
+    return { ok: false, err: `${pm}\uC740 \uC790\uB3D9 fix\uB97C \uC9C0\uC6D0\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4. npm \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791\uD569\uB2C8\uB2E4.` };
+  }
+  const result = safeExecFile("npm", ["audit", "fix"]);
+  return result.ok ? { ok: true } : { ok: false, err: result.err };
+}
+async function audit(autoFix = false) {
+  console.log(chalk22.bold("\n\u{1F6E1}\uFE0F  " + t("audit.title")));
+  console.log(chalk22.gray("\u2500".repeat(40)));
+  const pm = detectCurrentPM();
+  console.log(chalk22.cyan(`\u{1F4E6} \uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800: ${pm}`));
+  const spinner = ora4("\uBCF4\uC548 \uAC10\uC0AC \uC2E4\uD589 \uC911...").start();
+  const output = runAuditJson(pm);
+  spinner.stop();
+  const summary = parseAuditOutput(output, pm);
+  if (summary.total === 0) {
+    console.log(chalk22.green.bold("\n\u{1F389} \uCDE8\uC57D\uC810\uC774 \uBC1C\uACAC\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4!"));
+    return;
+  }
+  console.log(chalk22.bold("\n\u{1F4CA} \uCDE8\uC57D\uC810 \uC694\uC57D:"));
+  if (summary.critical > 0) console.log(chalk22.red(`  \u{1F534} Critical: ${summary.critical}`));
+  if (summary.high > 0) console.log(chalk22.red(`  \u{1F7E0} High: ${summary.high}`));
+  if (summary.moderate > 0) console.log(chalk22.yellow(`  \u{1F7E1} Moderate: ${summary.moderate}`));
+  if (summary.low > 0) console.log(chalk22.gray(`  \u26AA Low: ${summary.low}`));
+  console.log(chalk22.bold(`
+  \uCD1D ${summary.total}\uAC1C\uC758 \uCDE8\uC57D\uC810`));
+  const shouldRunFix = autoFix ? true : summary.critical > 0 || summary.high > 0 ? (await inquirer11.prompt([
+    {
+      type: "confirm",
+      name: "shouldFix",
+      message: "\uC790\uB3D9 \uC218\uC815\uC744 \uC2DC\uB3C4\uD560\uAE4C\uC694? (npm audit fix)",
+      default: true
+    }
+  ])).shouldFix : false;
+  if (shouldRunFix) {
+    const fixSpinner = ora4("\uC790\uB3D9 \uC218\uC815 \uC911...").start();
+    const result = runAuditFix(pm);
+    if (result.ok) {
+      fixSpinner.succeed("\uC790\uB3D9 \uC218\uC815 \uC644\uB8CC!");
+    } else {
+      fixSpinner.warn(result.err ?? "\uC77C\uBD80 \uCDE8\uC57D\uC810\uC740 \uC218\uB3D9 \uC218\uC815\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.");
+    }
+  }
+  printNextStep({
+    message: "\uBCF4\uC548 \uAC10\uC0AC \uC644\uB8CC.",
+    command: "vhk harness",
+    cursorHint: "\uD488\uC9C8 \uC810\uAC80\uD574\uC918"
+  });
+}
+
+// src/commands/migrate.ts
+import { existsSync as existsSync9, unlinkSync, rmSync } from "fs";
+import chalk23 from "chalk";
+import inquirer12 from "inquirer";
+import ora5 from "ora";
+var LOCK_FILES = {
+  npm: "package-lock.json",
+  yarn: "yarn.lock",
+  pnpm: "pnpm-lock.yaml"
+};
+function detectCurrentPM2() {
+  if (existsSync9("pnpm-lock.yaml")) return "pnpm";
+  if (existsSync9("yarn.lock")) return "yarn";
+  if (existsSync9("package-lock.json")) return "npm";
+  return null;
+}
+function isCLIAvailable2(pm) {
+  return safeExecFile(pm, ["--version"]).ok;
+}
+async function migrate(target) {
+  console.log(chalk23.bold("\n\u{1F504} " + t("migrate.title")));
+  console.log(chalk23.gray("\u2500".repeat(40)));
+  const current = detectCurrentPM2();
+  console.log(chalk23.cyan(`
+\uD604\uC7AC \uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800: ${current ?? "\uAC10\uC9C0 \uBD88\uAC00"}`));
+  let targetPM;
+  if (target && ["npm", "yarn", "pnpm"].includes(target)) {
+    targetPM = target;
+  } else {
+    const choices = ["npm", "yarn", "pnpm"].filter((pm) => pm !== current).map((pm) => ({ name: pm, value: pm }));
+    const { selected } = await inquirer12.prompt([
+      {
+        type: "list",
+        name: "selected",
+        message: t("migrate.selectTarget"),
+        choices
+      }
+    ]);
+    targetPM = selected;
+  }
+  if (targetPM === current) {
+    console.log(chalk23.yellow(`
+\u26A0\uFE0F  \uC774\uBBF8 ${targetPM}\uC744 \uC0AC\uC6A9 \uC911\uC785\uB2C8\uB2E4.`));
+    return;
+  }
+  if (!isCLIAvailable2(targetPM)) {
+    console.log(chalk23.red(`
+\u274C ${targetPM}\uC774 \uC124\uCE58\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.`));
+    console.log(chalk23.yellow(`   npm i -g ${targetPM}`));
+    return;
+  }
+  const { confirm } = await inquirer12.prompt([
+    {
+      type: "confirm",
+      name: "confirm",
+      message: `${current ?? "\uD604\uC7AC"} \u2192 ${targetPM}\uC73C\uB85C \uC804\uD658\uD560\uAE4C\uC694? (node_modules \uC7AC\uC124\uCE58)`,
+      default: true
+    }
+  ]);
+  if (!confirm) {
+    console.log(chalk23.gray("\uCDE8\uC18C\uB428"));
+    return;
+  }
+  const cleanup = ora5("\uAE30\uC874 lock \uD30C\uC77C \uC815\uB9AC \uC911...").start();
+  for (const lockFile of Object.values(LOCK_FILES)) {
+    if (existsSync9(lockFile)) {
+      unlinkSync(lockFile);
+    }
+  }
+  if (existsSync9("node_modules")) {
+    cleanup.text = "node_modules \uC0AD\uC81C \uC911...";
+    rmSync("node_modules", { recursive: true, force: true });
+  }
+  cleanup.succeed("\uAE30\uC874 \uD30C\uC77C \uC815\uB9AC \uC644\uB8CC");
+  const install = ora5(`${targetPM} install \uC2E4\uD589 \uC911...`).start();
+  const installResult = safeExecFile(targetPM, ["install"]);
+  if (installResult.ok) {
+    install.succeed(`${targetPM} install \uC644\uB8CC!`);
+  } else {
+    install.fail(`${targetPM} install \uC2E4\uD328`);
+    console.log(chalk23.red(installResult.err.slice(0, 300)));
+    return;
+  }
+  console.log(chalk23.green.bold(`
+\u{1F389} ${current ?? "\uC774\uC804"} \u2192 ${targetPM} \uC804\uD658 \uC644\uB8CC!`));
+  printNextStep({
+    message: "\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658 \uC644\uB8CC!",
+    command: "vhk harness",
+    cursorHint: "\uD488\uC9C8 \uC810\uAC80\uD574\uC918"
+  });
+}
+
+// src/commands/update.ts
+import { execSync as execSync3 } from "child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync5 } from "fs";
+import { dirname, join as join2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import chalk24 from "chalk";
+import ora6 from "ora";
+var PACKAGE = "@byh3071/vhk";
+function getCurrentVersion() {
+  const dir = dirname(fileURLToPath3(import.meta.url));
+  for (const pkgPath of [join2(dir, "../package.json"), join2(dir, "../../package.json")]) {
+    try {
+      if (existsSync10(pkgPath)) {
+        const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+        if (pkg.version) return pkg.version;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return "0.0.0";
+}
+function getLatestVersion() {
+  try {
+    const out = execSync3(`npm view ${PACKAGE} version`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).toString();
+    return out.trim();
+  } catch {
+    return null;
+  }
+}
+function isUpToDate(current, latest) {
+  const parse = (v) => v.split(".").map((n) => parseInt(n, 10) || 0);
+  const [ca, cb, cc] = parse(current);
+  const [la, lb, lc] = parse(latest);
+  if (ca !== la) return ca > la;
+  if (cb !== lb) return cb > lb;
+  return cc >= lc;
+}
+async function update() {
+  console.log(chalk24.bold("\n\u2B06\uFE0F  " + t("update.title")));
+  console.log(chalk24.gray("\u2500".repeat(40)));
+  const current = getCurrentVersion();
+  console.log(chalk24.cyan(`
+\u{1F4CC} \uD604\uC7AC \uBC84\uC804: v${current}`));
+  const spinner = ora6("\uCD5C\uC2E0 \uBC84\uC804 \uD655\uC778 \uC911...").start();
+  const latest = getLatestVersion();
+  if (!latest) {
+    spinner.fail("\uCD5C\uC2E0 \uBC84\uC804\uC744 \uD655\uC778\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.");
+    console.log(chalk24.yellow("   \uB124\uD2B8\uC6CC\uD06C\uB97C \uD655\uC778\uD558\uAC70\uB098 \uC218\uB3D9\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8\uD558\uC138\uC694:"));
+    console.log(chalk24.gray(`   npm update -g ${PACKAGE}`));
+    return;
+  }
+  spinner.stop();
+  console.log(chalk24.cyan(`\u{1F195} \uCD5C\uC2E0 \uBC84\uC804: v${latest}`));
+  if (isUpToDate(current, latest)) {
+    console.log(chalk24.green("\n\u2705 \uC774\uBBF8 \uCD5C\uC2E0 \uBC84\uC804\uC785\uB2C8\uB2E4!"));
+    return;
+  }
+  const updateSpinner = ora6(`v${latest}\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8 \uC911...`).start();
+  try {
+    execSync3(`npm update -g ${PACKAGE}`, { stdio: ["pipe", "pipe", "pipe"] });
+    updateSpinner.succeed(`v${latest}\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8 \uC644\uB8CC!`);
+    console.log(chalk24.green.bold(`
+\u{1F389} VHK CLI v${latest} \uC5C5\uB370\uC774\uD2B8 \uC644\uB8CC!`));
+    console.log(chalk24.gray("   \uBCC0\uACBD \uC0AC\uD56D\uC740 GitHub Releases\uB97C \uD655\uC778\uD558\uC138\uC694."));
+  } catch (err) {
+    updateSpinner.fail("\uC5C5\uB370\uC774\uD2B8 \uC2E4\uD328");
+    const msg = err instanceof Error ? err.message.slice(0, 300) : String(err);
+    console.log(chalk24.red(msg));
+    console.log(chalk24.yellow("\n\uC218\uB3D9\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8\uD558\uC138\uC694:"));
+    console.log(chalk24.gray(`   npm update -g ${PACKAGE}`));
+  }
+}
+
 // src/lib/nlp-run.ts
 async function dispatchNlpRoute(route, input) {
   switch (route.command) {
@@ -3974,28 +4374,36 @@ async function dispatchNlpRoute(route, input) {
       return theme();
     case "ref":
       return refList();
+    case "harness":
+      return harness();
+    case "audit":
+      return audit();
+    case "migrate":
+      return migrate();
+    case "update":
+      return update();
   }
 }
 async function runNaturalLanguageRoute(input) {
   const route = routeNaturalLanguage(input);
   if (!route) {
-    console.log(chalk21.yellow(`
+    console.log(chalk25.yellow(`
   \u2753 "${input}" \u2014 ${ko.nlp.notMatched}
 `));
     return;
   }
   console.log("");
-  console.log(chalk21.cyan(`  \u{1F4AC} "${input}"`));
-  console.log(chalk21.cyan(`  \u2192 ${route.explanation}`));
+  console.log(chalk25.cyan(`  \u{1F4AC} "${input}"`));
+  console.log(chalk25.cyan(`  \u2192 ${route.explanation}`));
   if (route.confidence === "low") {
-    const { confirm } = await inquirer11.prompt([{
+    const { confirm } = await inquirer13.prompt([{
       type: "confirm",
       name: "confirm",
       message: `${route.explanation} \u2014 ${ko.nlp.matched}`,
       default: true
     }]);
     if (!confirm) {
-      console.log(chalk21.dim(`  ${ko.nlp.menuHint}`));
+      console.log(chalk25.dim(`  ${ko.nlp.menuHint}`));
       return;
     }
   }
@@ -4004,6 +4412,20 @@ async function runNaturalLanguageRoute(input) {
 }
 
 // src/index.ts
+function getVersion() {
+  const dir = path15.dirname(fileURLToPath4(import.meta.url));
+  for (const pkgPath of [path15.join(dir, "../package.json"), path15.join(dir, "../../package.json")]) {
+    try {
+      if (fs16.existsSync(pkgPath)) {
+        const pkg = JSON.parse(fs16.readFileSync(pkgPath, "utf-8"));
+        if (pkg.version) return pkg.version;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return "0.0.0";
+}
 var program = new Command();
 var defaultHelp = new Help();
 var KO_ALIASES = {
@@ -4026,9 +4448,13 @@ var KO_ALIASES = {
   design: "\uB514\uC790\uC778",
   "design-palette": "\uD314\uB808\uD2B8",
   theme: "\uD14C\uB9C8",
-  ref: "\uB808\uD37C\uB7F0\uC2A4"
+  ref: "\uB808\uD37C\uB7F0\uC2A4",
+  harness: "\uD558\uB124\uC2A4",
+  audit: "\uAC10\uC0AC",
+  migrate: "\uC804\uD658",
+  update: "\uC5C5\uB370\uC774\uD2B8"
 };
-program.name("vhk").description("VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58 (\uD55C\uAD6D\uC5B4\uB85C \uC548\uB0B4\uD569\uB2C8\uB2E4)").version("0.8.0");
+program.name("vhk").description("VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58 (\uD55C\uAD6D\uC5B4\uB85C \uC548\uB0B4\uD569\uB2C8\uB2E4)").version(getVersion());
 program.configureHelp({
   formatHelp(cmd, helper) {
     if (cmd.parent) {
@@ -4110,6 +4536,18 @@ refCmd.command("list").alias("\uBAA9\uB85D").description("\uC800\uC7A5\uB41C \uB
 refCmd.command("open <index>").alias("\uC5F4\uAE30").description("\uB808\uD37C\uB7F0\uC2A4\uB97C \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uAE30").action(async (index) => {
   await refOpen(index);
 });
+program.command("harness").alias("\uD558\uB124\uC2A4").description("\uD1B5\uD569 \uD488\uC9C8 \uC810\uAC80 (lint + type-check + test + build)").action(async () => {
+  await harness();
+});
+program.command("audit").alias("\uAC10\uC0AC").option("--fix", "\uC790\uB3D9 \uC218\uC815 \uC2DC\uB3C4").description("\uBCF4\uC548 \uCDE8\uC57D\uC810 \uAC10\uC0AC (npm audit \uB798\uD551)").action(async (opts) => {
+  await audit(opts.fix);
+});
+program.command("migrate [target]").alias("\uC804\uD658").description("\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658 (npm/yarn/pnpm)").action(async (target) => {
+  await migrate(target);
+});
+program.command("update").alias("\uC5C5\uB370\uC774\uD2B8").description("VHK CLI \uCD5C\uC2E0 \uBC84\uC804 \uC5C5\uB370\uC774\uD2B8").action(async () => {
+  await update();
+});
 program.on("command:*", async (operands) => {
   const unknown = operands[0] ?? "";
   const rest = operands.slice(1);
@@ -4118,7 +4556,7 @@ program.on("command:*", async (operands) => {
 });
 program.action(async () => {
   console.log("\n\u{1F3AF} VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58\n");
-  const { choice } = await inquirer12.prompt([{
+  const { choice } = await inquirer14.prompt([{
     type: "list",
     name: "choice",
     message: "\uBB58 \uB3C4\uC640\uB4DC\uB9B4\uAE4C\uC694?",

package/dist/mcp/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "../chunk-NQ4V3VN4.js";
+} from "../chunk-UPXCLOBF.js";
 
 // src/mcp/index.ts
 startMcpServer().catch((err) => {

package/package.json

@@ -1,65 +1,65 @@
-{
-  "name": "@byh3071/vhk",
-  "version": "0.8.0",
-  "description": "Vibe Harness Kit — 바이브코딩 풀사이클 CLI",
-  "bin": {
-    "vhk": "dist/index.js",
-    "vhk-mcp": "dist/mcp/index.js"
-  },
-  "type": "module",
-  "scripts": {
-    "dev": "tsx src/index.ts",
-    "build": "tsup",
-    "test": "vitest",
-    "test:run": "vitest --run",
-    "prepublishOnly": "pnpm build && pnpm test:run",
-    "save": "vhk save",
-    "check": "vhk check",
-    "scan": "vhk secure scan",
-    "recap": "vhk recap",
-    "ship": "vhk ship",
-    "doctor": "vhk doctor"
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
-  "keywords": [
-    "vibe-coding",
-    "harness",
-    "cli",
-    "scaffold",
-    "session-log",
-    "rules-sync"
-  ],
-  "author": "byh3071 <byh3071@gmail.com>",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/byh3071-cpu/vhk.git"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@notionhq/client": "^5.22.0",
-    "chalk": "^5.6.2",
-    "commander": "^14.0.3",
-    "handlebars": "^4.7.9",
-    "inquirer": "^9.3.8",
-    "ora": "^9.4.0",
-    "simple-git": "^3.36.0",
-    "zod": "^4.4.3"
-  },
-  "devDependencies": {
-    "@types/inquirer": "^9.0.9",
-    "@types/node": "^25.9.1",
-    "ignore": "^7.0.5",
-    "tsup": "^8.5.1",
-    "tsx": "^4.22.3",
-    "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
-  }
-}
+{
+  "name": "@byh3071/vhk",
+  "version": "0.9.1",
+  "description": "Vibe Harness Kit — 바이브코딩 풀사이클 CLI",
+  "bin": {
+    "vhk": "dist/index.js",
+    "vhk-mcp": "dist/mcp/index.js"
+  },
+  "type": "module",
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsup",
+    "test": "vitest",
+    "test:run": "vitest --run",
+    "prepublishOnly": "pnpm build && pnpm test:run",
+    "save": "vhk save",
+    "check": "vhk check",
+    "scan": "vhk secure scan",
+    "recap": "vhk recap",
+    "ship": "vhk ship",
+    "doctor": "vhk doctor"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "vibe-coding",
+    "harness",
+    "cli",
+    "scaffold",
+    "session-log",
+    "rules-sync"
+  ],
+  "author": "byh3071 <byh3071@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/byh3071-cpu/vhk.git"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@notionhq/client": "^5.22.0",
+    "chalk": "^5.6.2",
+    "commander": "^14.0.3",
+    "handlebars": "^4.7.9",
+    "inquirer": "^9.3.8",
+    "ora": "^9.4.0",
+    "simple-git": "^3.36.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/inquirer": "^9.0.9",
+    "@types/node": "^25.9.1",
+    "ignore": "^7.0.5",
+    "tsup": "^8.5.1",
+    "tsx": "^4.22.3",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.7"
+  }
+}