@byh3071/vhk 0.8.1 → 0.9.1

package/README.md

@@ -1,12 +1,12 @@
 ---
 id: vhk-readme
 date: 2026-05-24
-tags: [vhk, cli, readme, v0.8.0]
+tags: [vhk, cli, readme, v0.9.0]
 ---
 
 # 🔧 VHK — Vibe Harness Kit
 
-> AI 코딩 에이전트를 부리는 사람을 위한 **한국어 풀사이클 CLI** (v0.8.0)
+> AI 코딩 에이전트를 부리는 사람을 위한 **한국어 풀사이클 CLI** (v0.9.0)
 >
 > 🍽️ **VHK는 VHK로 부트스트랩됨** — 이 레포의 `docs/`, `CLAUDE.md`, `.cursorrules`도 `vhk init`이 만들었습니다.
 
@@ -99,6 +99,10 @@ vhk 기획 끝났고 바로 시작
 | `vhk design-palette` | `팔레트` | 컬러 팔레트 프리셋 선택 + 적용 |
 | `vhk theme` | `테마` | 다크/라이트 모드 CSS + 토글 유틸리티 생성 |
 | `vhk ref` | `레퍼런스` | 레퍼런스 URL 관리 (`add` / `list` / `open`) |
+| `vhk harness` | `하네스` | 통합 품질 점검 (lint + type-check + test + build 순차 실행 + 리포트) |
+| `vhk audit` | `감사` | npm 보안 취약점 감사 (`--fix`로 자동 수정) |
+| `vhk migrate [target]` | `전환` | 패키지 매니저 전환 (`npm` / `yarn` / `pnpm`, lockfile + node_modules 재구성) |
+| `vhk update` | `업데이트` | VHK CLI 최신 버전으로 셀프 업데이트 |
 
 ### init 옵션
 
@@ -133,6 +137,24 @@ MCP 서버를 수동으로 띄우려면:
 vhk mcp                # stdio 서버 시작 (Cursor가 자동으로 호출)
 ```
 
+## v0.9.0 하이라이트
+
+| 기능 | 설명 |
+|------|------|
+| **harness** | `package.json` scripts 자동 감지 → `lint` / `type-check` / `test` / `build` 순차 실행 + 통합 리포트. 일부 실패해도 끝까지 진행 |
+| **audit** | `npm audit --json` 래핑 + 심각도별 요약. `Critical`/`High` 발견 시 자동 fix 옵션. Windows PowerShell 호환 (`2>/dev/null` 미사용) |
+| **migrate** | npm/yarn/pnpm 전환 — 대상 CLI 존재 확인 → 확인 프롬프트 → 기존 lockfile + node_modules 정리 → `<pm> install` |
+| **update** | npm registry에서 `@byh3071/vhk` 최신 버전 조회 → semver 비교 → `npm update -g` 실행. 현재 버전이 같거나 더 높으면 스킵 |
+| **자연어 확장** | `"품질 점검해줘"` → harness · `"보안 감사 해줘"` / `"취약점 확인"` → audit · `"패키지 매니저 전환"` → migrate · `"vhk 업데이트 해줘"` → update. 키워드 충돌 가드: `점검` 단독은 기존 `check`에 양보, `보안` 단독은 기존 `secure`에 양보 |
+
+```powershell
+vhk harness             # lint + type-check + test + build 순차 실행
+vhk audit               # npm 보안 감사 (Critical/High 발견 시 자동 fix 옵션)
+vhk audit --fix         # 항상 npm audit fix 실행
+vhk migrate pnpm        # npm/yarn → pnpm 전환 (대화형 확인)
+vhk update              # @byh3071/vhk 최신 버전 체크 + 글로벌 업데이트
+```
+
 ## v0.8.0 하이라이트
 
 | 기능 | 설명 |
@@ -224,6 +246,10 @@ vhk ref open 1          # 1번 레퍼런스를 브라우저로 열기
 | 팔레트 골라줘 | `vhk design-palette` |
 | 다크 모드 적용 | `vhk theme` |
 | 레퍼런스 보여줘 | `vhk ref` (list) |
+| 품질 점검해줘 | `vhk harness` |
+| 보안 감사 해줘 / 취약점 확인 | `vhk audit` |
+| 패키지 매니저 전환 | `vhk migrate` |
+| vhk 업데이트 해줘 | `vhk update` |
 
 ## 특징
 

package/dist/{chunk-X3CIIDO2.js → chunk-UPXCLOBF.js}

@@ -310,6 +310,19 @@ var ko = {
     publishing: "npm \uBC30\uD3EC \uC911...",
     publishSuccess: "npm \uBC30\uD3EC \uC131\uACF5!",
     publishFailed: "npm \uBC30\uD3EC \uC2E4\uD328"
+  },
+  harness: {
+    title: "\uD1B5\uD569 \uD488\uC9C8 \uC810\uAC80"
+  },
+  audit: {
+    title: "\uBCF4\uC548 \uAC10\uC0AC"
+  },
+  migrate: {
+    title: "\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658",
+    selectTarget: "\uC5B4\uB5A4 \uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800\uB85C \uC804\uD658\uD560\uAE4C\uC694?"
+  },
+  update: {
+    title: "VHK CLI \uC5C5\uB370\uC774\uD2B8"
   }
 };
 function lookup(path) {
@@ -457,8 +470,10 @@ function safeExecFile(cmd, args) {
     }).toString();
     return { ok: true, out: out.trim() };
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, err: msg };
+    const e = err;
+    const stdout = e.stdout ? e.stdout.toString() : "";
+    const msg = e.message ?? String(err);
+    return { ok: false, err: msg, out: stdout.trim() };
   }
 }
 function safeExecFileStream(cmd, args) {

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   safeExecFileStream,
   startMcpServer,
   t
-} from "./chunk-X3CIIDO2.js";
+} from "./chunk-UPXCLOBF.js";
 
 // node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -472,10 +472,10 @@ var require_ignore = __commonJS({
 
 // src/index.ts
 import { Command, Help } from "commander";
-import inquirer12 from "inquirer";
+import inquirer14 from "inquirer";
 import fs16 from "fs";
 import path15 from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/lib/nlp-router.ts
 function normalize(input) {
@@ -543,6 +543,30 @@ var RULES = [
     confidence: "high",
     test: (t2) => /^레퍼런스$|^ref$|레퍼런스.*(보|목록|확인|있|뭐)|참고\s*(사이트|목록|링크)|reference.*list/.test(t2) && !/(add|추가|open|열|https?:\/\/)/.test(t2)
   },
+  {
+    command: "harness",
+    explanation: "\uD1B5\uD569 \uD488\uC9C8 \uC810\uAC80 (vhk harness)",
+    confidence: "high",
+    test: (t2) => /하네스|harness|통합\s*점검|품질\s*점검|빌드\s*테스트|lint.*(test|build)|전체\s*점검|품질\s*확인/.test(t2)
+  },
+  {
+    command: "audit",
+    explanation: "\uBCF4\uC548 \uCDE8\uC57D\uC810 \uAC10\uC0AC (vhk audit)",
+    confidence: "high",
+    test: (t2) => /감사|취약점|audit|vulnerability|보안\s*감사|보안\s*취약|의존성\s*취약/.test(t2)
+  },
+  {
+    command: "migrate",
+    explanation: "\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658 (vhk migrate)",
+    confidence: "high",
+    test: (t2) => /전환|마이그레이트|migrate|패키지\s*매니저|npm.*pnpm|pnpm.*npm|yarn.*전환|npm.*전환|pnpm.*전환/.test(t2)
+  },
+  {
+    command: "update",
+    explanation: "VHK CLI \uCD5C\uC2E0 \uBC84\uC804 \uC5C5\uB370\uC774\uD2B8 (vhk update)",
+    confidence: "high",
+    test: (t2) => /업데이트|update|버전\s*업|최신\s*버전|셀프\s*업데이트|vhk.*최신|vhk.*업데이트/.test(t2)
+  },
   {
     command: "secure",
     explanation: "\uBCF4\uC548 \uC2A4\uCE94 (vhk \uBCF4\uC548)",
@@ -709,6 +733,14 @@ var KNOWN_COMMAND_TOKENS = /* @__PURE__ */ new Set([
   "\uD14C\uB9C8",
   "ref",
   "\uB808\uD37C\uB7F0\uC2A4",
+  "harness",
+  "\uD558\uB124\uC2A4",
+  "audit",
+  "\uAC10\uC0AC",
+  "migrate",
+  "\uC804\uD658",
+  "update",
+  "\uC5C5\uB370\uC774\uD2B8",
   "help"
 ]);
 function isOptionToken(token) {
@@ -732,8 +764,8 @@ function detectNaturalLanguageInput(argv) {
 }
 
 // src/lib/nlp-run.ts
-import chalk21 from "chalk";
-import inquirer11 from "inquirer";
+import chalk25 from "chalk";
+import inquirer13 from "inquirer";
 
 // src/commands/gate.ts
 import inquirer from "inquirer";
@@ -3933,6 +3965,367 @@ async function refOpen(indexStr) {
   }
 }
 
+// src/commands/harness.ts
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
+import chalk21 from "chalk";
+import ora3 from "ora";
+function detectPM() {
+  if (existsSync7("pnpm-lock.yaml")) return "pnpm";
+  if (existsSync7("yarn.lock")) return "yarn";
+  return "npm";
+}
+function pmRun(pm, script) {
+  return pm === "npm" ? ["run", script] : [script];
+}
+function detectChecks() {
+  const checks = [];
+  let pkg = {};
+  try {
+    pkg = JSON.parse(readFileSync4("package.json", "utf-8"));
+  } catch {
+    return checks;
+  }
+  const s = pkg.scripts ?? {};
+  const pm = detectPM();
+  if (s.lint) {
+    checks.push({ name: "lint", bin: pm, args: pmRun(pm, "lint") });
+  } else if (existsSync7(".eslintrc.js") || existsSync7(".eslintrc.json") || existsSync7("eslint.config.js")) {
+    checks.push({ name: "lint", bin: "npx", args: ["eslint", ".", "--ext", ".ts,.tsx"] });
+  }
+  if (s["type-check"]) {
+    checks.push({ name: "type-check", bin: pm, args: pmRun(pm, "type-check") });
+  } else if (s.typecheck) {
+    checks.push({ name: "type-check", bin: pm, args: pmRun(pm, "typecheck") });
+  } else if (existsSync7("tsconfig.json")) {
+    checks.push({ name: "type-check", bin: "npx", args: ["tsc", "--noEmit"] });
+  }
+  if (s.test) {
+    checks.push({ name: "test", bin: pm, args: pmRun(pm, "test") });
+  }
+  if (s.build) {
+    checks.push({ name: "build", bin: pm, args: pmRun(pm, "build") });
+  }
+  return checks;
+}
+async function harness() {
+  console.log(chalk21.bold("\n\u{1F527} " + t("harness.title")));
+  console.log(chalk21.gray("\u2500".repeat(40)));
+  const checks = detectChecks();
+  if (checks.length === 0) {
+    console.log(chalk21.yellow("\n\u26A0\uFE0F  \uC2E4\uD589\uD560 \uC218 \uC788\uB294 \uC2A4\uD06C\uB9BD\uD2B8\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4."));
+    console.log(chalk21.gray("   package.json\uC5D0 lint, test, build \uC2A4\uD06C\uB9BD\uD2B8\uB97C \uCD94\uAC00\uD574\uC8FC\uC138\uC694."));
+    return;
+  }
+  console.log(chalk21.cyan(`
+\u{1F3C3} ${checks.length}\uAC1C \uC810\uAC80 \uC2DC\uC791:
+`));
+  const results = [];
+  for (const check2 of checks) {
+    const display = `${check2.bin} ${check2.args.join(" ")}`;
+    const spinner = ora3(`${check2.name} \uC2E4\uD589 \uC911...`).start();
+    const start = Date.now();
+    const result = safeExecFile(check2.bin, check2.args);
+    const duration = Date.now() - start;
+    const sec = (duration / 1e3).toFixed(1);
+    if (result.ok) {
+      spinner.succeed(`${check2.name} ${chalk21.gray(`(${sec}s)`)}`);
+      results.push({ name: check2.name, command: display, passed: true, duration });
+    } else {
+      spinner.fail(`${check2.name} ${chalk21.gray(`(${sec}s)`)}`);
+      results.push({
+        name: check2.name,
+        command: display,
+        passed: false,
+        duration,
+        error: result.err.slice(0, 200)
+      });
+    }
+  }
+  console.log(chalk21.bold("\n\u{1F4CA} \uD1B5\uD569 \uB9AC\uD3EC\uD2B8:"));
+  console.log(chalk21.gray("\u2500".repeat(40)));
+  for (const r of results) {
+    const icon = r.passed ? chalk21.green("\u2705") : chalk21.red("\u274C");
+    const sec = (r.duration / 1e3).toFixed(1);
+    console.log(`  ${icon} ${r.name.padEnd(15)} ${chalk21.gray(`${sec}s`)}`);
+  }
+  const passed = results.filter((r) => r.passed).length;
+  const all = passed === results.length;
+  console.log(chalk21.gray("\u2500".repeat(40)));
+  if (all) {
+    console.log(chalk21.green.bold(`
+\u{1F389} \uC804\uCCB4 \uD1B5\uACFC! (${passed}/${results.length})`));
+  } else {
+    console.log(
+      chalk21.red.bold(`
+\u26A0\uFE0F  ${results.length - passed}\uAC1C \uC2E4\uD328 (${passed}/${results.length} \uD1B5\uACFC)`)
+    );
+  }
+  printNextStep({
+    message: all ? "\uD488\uC9C8 \uC810\uAC80 \uD1B5\uACFC!" : "\uC2E4\uD328 \uD56D\uBAA9\uC744 \uC218\uC815\uD558\uC138\uC694.",
+    command: all ? "vhk ship" : "vhk doctor",
+    cursorHint: all ? "\uBC30\uD3EC\uD574\uC918" : "\uBB38\uC81C \uC9C4\uB2E8\uD574\uC918"
+  });
+}
+
+// src/commands/audit.ts
+import { existsSync as existsSync8 } from "fs";
+import chalk22 from "chalk";
+import inquirer11 from "inquirer";
+import ora4 from "ora";
+function detectCurrentPM() {
+  if (existsSync8("pnpm-lock.yaml")) return "pnpm";
+  if (existsSync8("yarn.lock")) return "yarn";
+  return "npm";
+}
+function parseAuditOutput(output, pm) {
+  const empty = { critical: 0, high: 0, moderate: 0, low: 0, total: 0 };
+  if (!output) return empty;
+  try {
+    const json = JSON.parse(output);
+    const meta = json.metadata?.vulnerabilities;
+    if (meta) {
+      const summary = {
+        critical: meta.critical ?? 0,
+        high: meta.high ?? 0,
+        moderate: meta.moderate ?? 0,
+        low: meta.low ?? 0,
+        total: meta.total ?? 0
+      };
+      if (!summary.total) {
+        summary.total = summary.critical + summary.high + summary.moderate + summary.low;
+      }
+      return summary;
+    }
+    void pm;
+    return empty;
+  } catch {
+    return empty;
+  }
+}
+function runAuditJson(pm) {
+  const result = safeExecFile(pm, ["audit", "--json"]);
+  return result.out;
+}
+function runAuditFix(pm) {
+  if (pm !== "npm") {
+    return { ok: false, err: `${pm}\uC740 \uC790\uB3D9 fix\uB97C \uC9C0\uC6D0\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4. npm \uD658\uACBD\uC5D0\uC11C\uB9CC \uB3D9\uC791\uD569\uB2C8\uB2E4.` };
+  }
+  const result = safeExecFile("npm", ["audit", "fix"]);
+  return result.ok ? { ok: true } : { ok: false, err: result.err };
+}
+async function audit(autoFix = false) {
+  console.log(chalk22.bold("\n\u{1F6E1}\uFE0F  " + t("audit.title")));
+  console.log(chalk22.gray("\u2500".repeat(40)));
+  const pm = detectCurrentPM();
+  console.log(chalk22.cyan(`\u{1F4E6} \uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800: ${pm}`));
+  const spinner = ora4("\uBCF4\uC548 \uAC10\uC0AC \uC2E4\uD589 \uC911...").start();
+  const output = runAuditJson(pm);
+  spinner.stop();
+  const summary = parseAuditOutput(output, pm);
+  if (summary.total === 0) {
+    console.log(chalk22.green.bold("\n\u{1F389} \uCDE8\uC57D\uC810\uC774 \uBC1C\uACAC\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4!"));
+    return;
+  }
+  console.log(chalk22.bold("\n\u{1F4CA} \uCDE8\uC57D\uC810 \uC694\uC57D:"));
+  if (summary.critical > 0) console.log(chalk22.red(`  \u{1F534} Critical: ${summary.critical}`));
+  if (summary.high > 0) console.log(chalk22.red(`  \u{1F7E0} High: ${summary.high}`));
+  if (summary.moderate > 0) console.log(chalk22.yellow(`  \u{1F7E1} Moderate: ${summary.moderate}`));
+  if (summary.low > 0) console.log(chalk22.gray(`  \u26AA Low: ${summary.low}`));
+  console.log(chalk22.bold(`
+  \uCD1D ${summary.total}\uAC1C\uC758 \uCDE8\uC57D\uC810`));
+  const shouldRunFix = autoFix ? true : summary.critical > 0 || summary.high > 0 ? (await inquirer11.prompt([
+    {
+      type: "confirm",
+      name: "shouldFix",
+      message: "\uC790\uB3D9 \uC218\uC815\uC744 \uC2DC\uB3C4\uD560\uAE4C\uC694? (npm audit fix)",
+      default: true
+    }
+  ])).shouldFix : false;
+  if (shouldRunFix) {
+    const fixSpinner = ora4("\uC790\uB3D9 \uC218\uC815 \uC911...").start();
+    const result = runAuditFix(pm);
+    if (result.ok) {
+      fixSpinner.succeed("\uC790\uB3D9 \uC218\uC815 \uC644\uB8CC!");
+    } else {
+      fixSpinner.warn(result.err ?? "\uC77C\uBD80 \uCDE8\uC57D\uC810\uC740 \uC218\uB3D9 \uC218\uC815\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.");
+    }
+  }
+  printNextStep({
+    message: "\uBCF4\uC548 \uAC10\uC0AC \uC644\uB8CC.",
+    command: "vhk harness",
+    cursorHint: "\uD488\uC9C8 \uC810\uAC80\uD574\uC918"
+  });
+}
+
+// src/commands/migrate.ts
+import { existsSync as existsSync9, unlinkSync, rmSync } from "fs";
+import chalk23 from "chalk";
+import inquirer12 from "inquirer";
+import ora5 from "ora";
+var LOCK_FILES = {
+  npm: "package-lock.json",
+  yarn: "yarn.lock",
+  pnpm: "pnpm-lock.yaml"
+};
+function detectCurrentPM2() {
+  if (existsSync9("pnpm-lock.yaml")) return "pnpm";
+  if (existsSync9("yarn.lock")) return "yarn";
+  if (existsSync9("package-lock.json")) return "npm";
+  return null;
+}
+function isCLIAvailable2(pm) {
+  return safeExecFile(pm, ["--version"]).ok;
+}
+async function migrate(target) {
+  console.log(chalk23.bold("\n\u{1F504} " + t("migrate.title")));
+  console.log(chalk23.gray("\u2500".repeat(40)));
+  const current = detectCurrentPM2();
+  console.log(chalk23.cyan(`
+\uD604\uC7AC \uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800: ${current ?? "\uAC10\uC9C0 \uBD88\uAC00"}`));
+  let targetPM;
+  if (target && ["npm", "yarn", "pnpm"].includes(target)) {
+    targetPM = target;
+  } else {
+    const choices = ["npm", "yarn", "pnpm"].filter((pm) => pm !== current).map((pm) => ({ name: pm, value: pm }));
+    const { selected } = await inquirer12.prompt([
+      {
+        type: "list",
+        name: "selected",
+        message: t("migrate.selectTarget"),
+        choices
+      }
+    ]);
+    targetPM = selected;
+  }
+  if (targetPM === current) {
+    console.log(chalk23.yellow(`
+\u26A0\uFE0F  \uC774\uBBF8 ${targetPM}\uC744 \uC0AC\uC6A9 \uC911\uC785\uB2C8\uB2E4.`));
+    return;
+  }
+  if (!isCLIAvailable2(targetPM)) {
+    console.log(chalk23.red(`
+\u274C ${targetPM}\uC774 \uC124\uCE58\uB418\uC5B4 \uC788\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.`));
+    console.log(chalk23.yellow(`   npm i -g ${targetPM}`));
+    return;
+  }
+  const { confirm } = await inquirer12.prompt([
+    {
+      type: "confirm",
+      name: "confirm",
+      message: `${current ?? "\uD604\uC7AC"} \u2192 ${targetPM}\uC73C\uB85C \uC804\uD658\uD560\uAE4C\uC694? (node_modules \uC7AC\uC124\uCE58)`,
+      default: true
+    }
+  ]);
+  if (!confirm) {
+    console.log(chalk23.gray("\uCDE8\uC18C\uB428"));
+    return;
+  }
+  const cleanup = ora5("\uAE30\uC874 lock \uD30C\uC77C \uC815\uB9AC \uC911...").start();
+  for (const lockFile of Object.values(LOCK_FILES)) {
+    if (existsSync9(lockFile)) {
+      unlinkSync(lockFile);
+    }
+  }
+  if (existsSync9("node_modules")) {
+    cleanup.text = "node_modules \uC0AD\uC81C \uC911...";
+    rmSync("node_modules", { recursive: true, force: true });
+  }
+  cleanup.succeed("\uAE30\uC874 \uD30C\uC77C \uC815\uB9AC \uC644\uB8CC");
+  const install = ora5(`${targetPM} install \uC2E4\uD589 \uC911...`).start();
+  const installResult = safeExecFile(targetPM, ["install"]);
+  if (installResult.ok) {
+    install.succeed(`${targetPM} install \uC644\uB8CC!`);
+  } else {
+    install.fail(`${targetPM} install \uC2E4\uD328`);
+    console.log(chalk23.red(installResult.err.slice(0, 300)));
+    return;
+  }
+  console.log(chalk23.green.bold(`
+\u{1F389} ${current ?? "\uC774\uC804"} \u2192 ${targetPM} \uC804\uD658 \uC644\uB8CC!`));
+  printNextStep({
+    message: "\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658 \uC644\uB8CC!",
+    command: "vhk harness",
+    cursorHint: "\uD488\uC9C8 \uC810\uAC80\uD574\uC918"
+  });
+}
+
+// src/commands/update.ts
+import { execSync as execSync3 } from "child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync5 } from "fs";
+import { dirname, join as join2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import chalk24 from "chalk";
+import ora6 from "ora";
+var PACKAGE = "@byh3071/vhk";
+function getCurrentVersion() {
+  const dir = dirname(fileURLToPath3(import.meta.url));
+  for (const pkgPath of [join2(dir, "../package.json"), join2(dir, "../../package.json")]) {
+    try {
+      if (existsSync10(pkgPath)) {
+        const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
+        if (pkg.version) return pkg.version;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return "0.0.0";
+}
+function getLatestVersion() {
+  try {
+    const out = execSync3(`npm view ${PACKAGE} version`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).toString();
+    return out.trim();
+  } catch {
+    return null;
+  }
+}
+function isUpToDate(current, latest) {
+  const parse = (v) => v.split(".").map((n) => parseInt(n, 10) || 0);
+  const [ca, cb, cc] = parse(current);
+  const [la, lb, lc] = parse(latest);
+  if (ca !== la) return ca > la;
+  if (cb !== lb) return cb > lb;
+  return cc >= lc;
+}
+async function update() {
+  console.log(chalk24.bold("\n\u2B06\uFE0F  " + t("update.title")));
+  console.log(chalk24.gray("\u2500".repeat(40)));
+  const current = getCurrentVersion();
+  console.log(chalk24.cyan(`
+\u{1F4CC} \uD604\uC7AC \uBC84\uC804: v${current}`));
+  const spinner = ora6("\uCD5C\uC2E0 \uBC84\uC804 \uD655\uC778 \uC911...").start();
+  const latest = getLatestVersion();
+  if (!latest) {
+    spinner.fail("\uCD5C\uC2E0 \uBC84\uC804\uC744 \uD655\uC778\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.");
+    console.log(chalk24.yellow("   \uB124\uD2B8\uC6CC\uD06C\uB97C \uD655\uC778\uD558\uAC70\uB098 \uC218\uB3D9\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8\uD558\uC138\uC694:"));
+    console.log(chalk24.gray(`   npm update -g ${PACKAGE}`));
+    return;
+  }
+  spinner.stop();
+  console.log(chalk24.cyan(`\u{1F195} \uCD5C\uC2E0 \uBC84\uC804: v${latest}`));
+  if (isUpToDate(current, latest)) {
+    console.log(chalk24.green("\n\u2705 \uC774\uBBF8 \uCD5C\uC2E0 \uBC84\uC804\uC785\uB2C8\uB2E4!"));
+    return;
+  }
+  const updateSpinner = ora6(`v${latest}\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8 \uC911...`).start();
+  try {
+    execSync3(`npm update -g ${PACKAGE}`, { stdio: ["pipe", "pipe", "pipe"] });
+    updateSpinner.succeed(`v${latest}\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8 \uC644\uB8CC!`);
+    console.log(chalk24.green.bold(`
+\u{1F389} VHK CLI v${latest} \uC5C5\uB370\uC774\uD2B8 \uC644\uB8CC!`));
+    console.log(chalk24.gray("   \uBCC0\uACBD \uC0AC\uD56D\uC740 GitHub Releases\uB97C \uD655\uC778\uD558\uC138\uC694."));
+  } catch (err) {
+    updateSpinner.fail("\uC5C5\uB370\uC774\uD2B8 \uC2E4\uD328");
+    const msg = err instanceof Error ? err.message.slice(0, 300) : String(err);
+    console.log(chalk24.red(msg));
+    console.log(chalk24.yellow("\n\uC218\uB3D9\uC73C\uB85C \uC5C5\uB370\uC774\uD2B8\uD558\uC138\uC694:"));
+    console.log(chalk24.gray(`   npm update -g ${PACKAGE}`));
+  }
+}
+
 // src/lib/nlp-run.ts
 async function dispatchNlpRoute(route, input) {
   switch (route.command) {
@@ -3981,28 +4374,36 @@ async function dispatchNlpRoute(route, input) {
       return theme();
     case "ref":
       return refList();
+    case "harness":
+      return harness();
+    case "audit":
+      return audit();
+    case "migrate":
+      return migrate();
+    case "update":
+      return update();
   }
 }
 async function runNaturalLanguageRoute(input) {
   const route = routeNaturalLanguage(input);
   if (!route) {
-    console.log(chalk21.yellow(`
+    console.log(chalk25.yellow(`
   \u2753 "${input}" \u2014 ${ko.nlp.notMatched}
 `));
     return;
   }
   console.log("");
-  console.log(chalk21.cyan(`  \u{1F4AC} "${input}"`));
-  console.log(chalk21.cyan(`  \u2192 ${route.explanation}`));
+  console.log(chalk25.cyan(`  \u{1F4AC} "${input}"`));
+  console.log(chalk25.cyan(`  \u2192 ${route.explanation}`));
   if (route.confidence === "low") {
-    const { confirm } = await inquirer11.prompt([{
+    const { confirm } = await inquirer13.prompt([{
       type: "confirm",
       name: "confirm",
       message: `${route.explanation} \u2014 ${ko.nlp.matched}`,
       default: true
     }]);
     if (!confirm) {
-      console.log(chalk21.dim(`  ${ko.nlp.menuHint}`));
+      console.log(chalk25.dim(`  ${ko.nlp.menuHint}`));
       return;
     }
   }
@@ -4012,7 +4413,7 @@ async function runNaturalLanguageRoute(input) {
 
 // src/index.ts
 function getVersion() {
-  const dir = path15.dirname(fileURLToPath3(import.meta.url));
+  const dir = path15.dirname(fileURLToPath4(import.meta.url));
   for (const pkgPath of [path15.join(dir, "../package.json"), path15.join(dir, "../../package.json")]) {
     try {
       if (fs16.existsSync(pkgPath)) {
@@ -4047,7 +4448,11 @@ var KO_ALIASES = {
   design: "\uB514\uC790\uC778",
   "design-palette": "\uD314\uB808\uD2B8",
   theme: "\uD14C\uB9C8",
-  ref: "\uB808\uD37C\uB7F0\uC2A4"
+  ref: "\uB808\uD37C\uB7F0\uC2A4",
+  harness: "\uD558\uB124\uC2A4",
+  audit: "\uAC10\uC0AC",
+  migrate: "\uC804\uD658",
+  update: "\uC5C5\uB370\uC774\uD2B8"
 };
 program.name("vhk").description("VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58 (\uD55C\uAD6D\uC5B4\uB85C \uC548\uB0B4\uD569\uB2C8\uB2E4)").version(getVersion());
 program.configureHelp({
@@ -4131,6 +4536,18 @@ refCmd.command("list").alias("\uBAA9\uB85D").description("\uC800\uC7A5\uB41C \uB
 refCmd.command("open <index>").alias("\uC5F4\uAE30").description("\uB808\uD37C\uB7F0\uC2A4\uB97C \uBE0C\uB77C\uC6B0\uC800\uC5D0\uC11C \uC5F4\uAE30").action(async (index) => {
   await refOpen(index);
 });
+program.command("harness").alias("\uD558\uB124\uC2A4").description("\uD1B5\uD569 \uD488\uC9C8 \uC810\uAC80 (lint + type-check + test + build)").action(async () => {
+  await harness();
+});
+program.command("audit").alias("\uAC10\uC0AC").option("--fix", "\uC790\uB3D9 \uC218\uC815 \uC2DC\uB3C4").description("\uBCF4\uC548 \uCDE8\uC57D\uC810 \uAC10\uC0AC (npm audit \uB798\uD551)").action(async (opts) => {
+  await audit(opts.fix);
+});
+program.command("migrate [target]").alias("\uC804\uD658").description("\uD328\uD0A4\uC9C0 \uB9E4\uB2C8\uC800 \uC804\uD658 (npm/yarn/pnpm)").action(async (target) => {
+  await migrate(target);
+});
+program.command("update").alias("\uC5C5\uB370\uC774\uD2B8").description("VHK CLI \uCD5C\uC2E0 \uBC84\uC804 \uC5C5\uB370\uC774\uD2B8").action(async () => {
+  await update();
+});
 program.on("command:*", async (operands) => {
   const unknown = operands[0] ?? "";
   const rest = operands.slice(1);
@@ -4139,7 +4556,7 @@ program.on("command:*", async (operands) => {
 });
 program.action(async () => {
   console.log("\n\u{1F3AF} VHK \u2014 \uBC14\uC774\uBE0C\uCF54\uB529 \uD504\uB85C\uC81D\uD2B8 \uCF54\uCE58\n");
-  const { choice } = await inquirer12.prompt([{
+  const { choice } = await inquirer14.prompt([{
     type: "list",
     name: "choice",
     message: "\uBB58 \uB3C4\uC640\uB4DC\uB9B4\uAE4C\uC694?",

package/dist/mcp/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   startMcpServer
-} from "../chunk-X3CIIDO2.js";
+} from "../chunk-UPXCLOBF.js";
 
 // src/mcp/index.ts
 startMcpServer().catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byh3071/vhk",
-  "version": "0.8.1",
+  "version": "0.9.1",
   "description": "Vibe Harness Kit — 바이브코딩 풀사이클 CLI",
   "bin": {
     "vhk": "dist/index.js",