@tracecode/harness 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to this project are documented here.
 
 This repo uses Git tags as release boundaries. Version notes below summarize what shipped in each tagged release.
 
+## [0.6.1] - 2026-04-23
+
+### Fixed
+
+- Resolved Dependabot-reported vulnerabilities by moving the example app to patched Vite 7.3.2 and overriding transitive DOMPurify and Picomatch resolutions to patched versions.
+
+## [0.6.0] - 2026-04-23
+
+### Added
+
+- Experimental browser-local Java runtime client and worker support.
+- Java runtime capability profiles, worker asset sync coverage, and packaged browser harness surface.
+- Java trace adapter support for line events, access metadata, visualization payloads, and runtime output normalization.
+
+### Changed
+
+- Runtime trace contract normalization now deduplicates noisy access metadata and enforces shared trace clipping semantics.
+- JavaScript and Python workers now share the same trace budget controls used by the browser harness clients.
+- Browser example app now exercises Java alongside Python, JavaScript, and TypeScript.
+
+### Fixed
+
+- TypeScript `for...of` tracing now delays iterable access metadata to the next executable step while preserving loop-header flushes for body mutations.
+- Java worker asset checks now cover the helper, rewriter, bridge, parser, and compiler jars needed by the Java lane.
+
+### Notes
+
+- `0.6.0` is the first Java runtime preview release. Java remains capability-profiled as experimental.
+
 ## [0.5.0] - 2026-03-14
 
 ### Fixed

package/README.md

@@ -1,6 +1,6 @@
 # TraceCode Harness
 
-Browser-first execution and tracing harness for Python, JavaScript, and TypeScript.
+Browser-first execution and tracing harness for Python, JavaScript, TypeScript, and an experimental Java lane.
 
 `@tracecode/harness` is a browser-consumable runtime SDK for code execution and tracing: explicit browser runtime creation, package-managed worker assets, and no app-specific storage/bootstrap contract in the public API.
 
@@ -13,6 +13,7 @@ This package provides an execution and tracing runtime for browser applications.
 It includes:
 
 - browser-hosted execution for Python, JavaScript, and TypeScript
+- an experimental browser-local Java 17 lane for `function`, `solution-method`, `ops-class`, and `interviewMode` execution
 - trace capture and normalized runtime contracts
 - browser worker assets and asset sync tooling
 - runtime-side structural annotations such as object kinds and hash/map payloads
@@ -40,7 +41,7 @@ Consuming apps are expected to own their own UI, persistence, product logic, and
 ## What You Get
 
 - shared runtime contract types and trace adapters
-- browser runtime clients for Python, JavaScript, and TypeScript
+- browser runtime clients for Python, JavaScript, TypeScript, and Java
 - published worker assets plus a CLI to copy them into your app
 - capability profiles for honest per-language support claims
 - regression coverage for runtime parity, packaging, and consumer smoke tests
@@ -154,7 +155,7 @@ The returned harness exposes:
 Configuration:
 
 - `assetBaseUrl?: string`
-- `assets?: Partial<{ pythonWorker; pythonRuntimeCore; pythonSnippets; javascriptWorker; typescriptCompiler }>`
+- `assets?: Partial<{ pythonWorker; pythonRuntimeCore; pythonSnippets; javascriptWorker; typescriptCompiler; javaWorker; javaHelperJar; javaPracticeRewriterJar; javaRewriteBridgeJar; javaParserJar; javaCompilerJar }>`
 - `debug?: boolean`
 
 Example:
@@ -180,6 +181,12 @@ if (profile.capabilities.tracing.supported) {
 - `pyodide/runtime-core.js`
 - `javascript-worker.js`
 - `vendor/typescript.js`
+- `java-worker.js`
+- `vendor/java-browser-spike-helper.jar`
+- `vendor/java-practice-rewriter.jar`
+- `vendor/java-rewrite-bridge.jar`
+- `vendor/javaparser-core-3.25.10.jar`
+- `vendor/jdk.compiler-17.jar`
 
 By default, `createBrowserHarness({ assetBaseUrl: '/workers' })` resolves those assets as:
 
@@ -188,6 +195,12 @@ By default, `createBrowserHarness({ assetBaseUrl: '/workers' })` resolves those
 - `/workers/pyodide/runtime-core.js`
 - `/workers/javascript-worker.js`
 - `/workers/vendor/typescript.js`
+- `/workers/java-worker.js`
+- `/workers/vendor/java-browser-spike-helper.jar`
+- `/workers/vendor/java-practice-rewriter.jar`
+- `/workers/vendor/java-rewrite-bridge.jar`
+- `/workers/vendor/javaparser-core-3.25.10.jar`
+- `/workers/vendor/jdk.compiler-17.jar`
 
 Advanced consumers can override individual asset URLs through the `assets` option.
 
@@ -211,6 +224,18 @@ Capability domains:
 
 That lets the package be explicit about partial support and fail closed for unsupported requests.
 
+Current language status:
+
+- `python`: stable
+- `javascript`: stable
+- `typescript`: stable
+- `java`: experimental, browser-local Java 17 lane
+
+Current Java scope:
+
+- supported: `function`, `solution-method`, `ops-class`, `interviewMode`, tracing, compile diagnostics, structural visualization payloads
+- not yet supported: `script`
+
 ## Example Consumer
 
 A minimal reference browser IDE lives in [examples/web-ide](./examples/web-ide). It is intentionally small and exists to prove that a third-party app can:
@@ -254,6 +279,8 @@ pnpm generate:python-harness
 
 This repo uses explicit versioned release boundaries.
 
+- `0.6.1` resolves Dependabot-reported vulnerabilities in Vite, DOMPurify, and Picomatch dependency paths
+- `0.6.0` adds an experimental browser-local Java 17 runtime lane for `function`, `solution-method`, `ops-class`, and `interviewMode` execution, plus public asset packaging and browser smoke coverage for Java
 - `0.5.0` improves JavaScript tree/list input hydration, fixes sparse tree deserialization, and trims GitHub CI to the non-browser verification set
 - `0.1.0` introduced the public harness baseline
 - `0.2.0` introduced structured runtime capability profiles