@utsu-ri/cli 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +104 -146
- package/dist/build-manifest.json +14 -10
- package/dist/sbom.spdx.json +14 -14
- package/dist/third-party-licenses.json +2 -2
- package/dist/utsuri.mjs +4311 -3401
- package/package.json +6 -6
package/README.md
CHANGED
|
@@ -1,226 +1,184 @@
|
|
|
1
1
|
<!-- doc-language: en; canonical: true -->
|
|
2
2
|
|
|
3
|
-
[English](https://github.com/hokupod/utsuri/blob/v0.
|
|
3
|
+
[English](https://github.com/hokupod/utsuri/blob/v0.2.0/README.md) | [日本語](https://github.com/hokupod/utsuri/blob/v0.2.0/README.ja.md) | [简体中文](https://github.com/hokupod/utsuri/blob/v0.2.0/README.zh-CN.md)
|
|
4
4
|
|
|
5
5
|
# Utsuri
|
|
6
6
|
|
|
7
7
|
> See what changed. Understand why.
|
|
8
8
|
|
|
9
|
-
<a id="product-
|
|
9
|
+
<a id="product-outcome"></a><!-- section:product-outcome -->
|
|
10
10
|
|
|
11
|
-
##
|
|
11
|
+
## Review a change as evidence, not a green badge
|
|
12
12
|
|
|
13
|
-
Utsuri
|
|
13
|
+
Utsuri turns a Git change into a local review that connects code, browser captures, structural differences, accessibility findings, coverage, and human comments. It keeps missing evidence visible, so a reviewer can distinguish “nothing found” from “not checked.”
|
|
14
14
|
|
|
15
|
-
|
|
15
|
+
Use it when a code or UI change needs a durable report, a clear list of review gaps, or structured questions returned to the coding session that created the report.
|
|
16
16
|
|
|
17
|
-
<a id="
|
|
17
|
+
<a id="availability-requirements"></a><!-- section:availability-requirements -->
|
|
18
18
|
|
|
19
|
-
##
|
|
19
|
+
## Availability and requirements
|
|
20
20
|
|
|
21
|
-
<!-- availability:
|
|
21
|
+
<!-- availability:git-marketplace-source-ready-cli-publication-pending -->
|
|
22
|
+
<!-- support-contract:macos-linux-windows-unsupported -->
|
|
22
23
|
|
|
23
|
-
The
|
|
24
|
+
The source contains a Git Plugin that exact-pins the matching published `@utsu-ri/cli` release. Public Git installation remains gated until that CLI release is published and the Plugin source is merged. The commands below are verified host command shapes; do not substitute `latest`, a range, or another package.
|
|
24
25
|
|
|
25
|
-
|
|
26
|
+
- A Codex or Claude Code release listed in the [runtime compatibility record](https://github.com/hokupod/utsuri/blob/v0.2.0/docs/compatibility/plugin-runtime.json).
|
|
27
|
+
- macOS or Linux, Node.js 22 or later, and `npx` for first MCP startup.
|
|
28
|
+
- An existing compatible Chrome/Chromium installation for browser capture. Utsuri never downloads a browser.
|
|
29
|
+
- Optional Docker or Podman capability for the isolated container capture mode. Utsuri never pulls an image.
|
|
30
|
+
- Network access to GitHub during Marketplace installation and to npm on the first MCP start.
|
|
26
31
|
|
|
27
|
-
|
|
32
|
+
Native Windows is unsupported because no Windows native helper is distributed. Reports, captures, and review state stay in the project unless you separately authorize publication or upload.
|
|
28
33
|
|
|
29
|
-
|
|
34
|
+
<a id="install"></a><!-- section:install -->
|
|
30
35
|
|
|
31
|
-
|
|
32
|
-
- stable structured hunks with rename, delete, binary, submodule, mode, and low-signal metadata;
|
|
33
|
-
- deterministic initial change candidates with complete candidate-or-unclassified coverage;
|
|
34
|
-
- schema-validated annotations and evidence references; and
|
|
35
|
-
- a self-contained code review with summary, three-state queue, Focus mode, evidence drawer, unified/side-by-side diff, deep links, and keyboard focus restoration;
|
|
36
|
-
- separate before/after Browser Contexts with identical viewport, DPR, locale, timezone, color scheme, and reduced-motion settings;
|
|
37
|
-
- full-page and element screenshots plus normalized DOM, ARIA, computed-style, axe, console, network, metadata, and typed failure evidence; and
|
|
38
|
-
- deterministic stabilization, an allowlisted action DSL, blocked external/mutation requests, digest-checked reuse, and partial `INCOMPLETE` reports;
|
|
39
|
-
- prioritized explicit/Storybook/Playwright/route/import/selector/fallback target discovery with structured known, verified, unknown, planned, succeeded, and failed coverage;
|
|
40
|
-
- Pixelmatch counts, ratios, content-addressed diff images, changed regions, and normalized DOM/ARIA/style fingerprints;
|
|
41
|
-
- `new`, `resolved`, `unchanged`, and `incomplete` accessibility/runtime findings plus overflow and obstruction evidence; and
|
|
42
|
-
- side-by-side, wipe, stoppable blink, pixel-diff, and after-only views with crop/full-page selection, synchronized scroll/zoom, region navigation, and code/finding cross-links.
|
|
43
|
-
- separate static/interactive/iframe CSPs, bounded JSON, empty-sandbox sanitized previews, PNG-only visual evidence, expanded privacy declarations, and strict SHA-256 report validation;
|
|
44
|
-
- fixed Docker/Podman isolation with digest-pinned local images, no network, a read-only root/project mount, dropped capabilities, a non-root user, and PID/CPU/memory/time/artifact limits; and
|
|
45
|
-
- a single Node 22 ESM CLI bundle with source/schema/UI hashes plus deterministic SPDX 2.3 and dependency-license inventories;
|
|
46
|
-
- independently persisted viewed progress, human judgment, and anchored comments with canonical export/import and explicit matched/stale/orphaned re-anchoring;
|
|
47
|
-
- loopback-only static serving plus deterministic `report.zip`, `report.json`, and `ci-summary.json` packaging with policy exit code `10`; and
|
|
48
|
-
- exact CLI/native package contracts, four architecture-matched helper candidates, aggregate Plugin verification, Node 22/24 isolated-tarball smoke tests, and shared Skill evaluations;
|
|
49
|
-
- per-start capability-token interactive serving with exact Origin for mutations, same-origin Fetch Metadata for read-only GET requests, exact Referer validation when present, report-binding, and request-schema checks;
|
|
50
|
-
- explicit Agent-attention selection, Feedback Batch preview, redacted and bounded Context Packs, immutable-generation Review Inbox sidecars, and unread answer state; and
|
|
51
|
-
- fixed-run `feedback` CLI and Review Inbox MCP operations that require the originating host/session/project/report binding and write exactly one answer per item.
|
|
36
|
+
## Install from the Git Marketplace
|
|
52
37
|
|
|
53
|
-
|
|
38
|
+
### Codex
|
|
54
39
|
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
## Quick Start
|
|
58
|
-
|
|
59
|
-
Prerequisites: Nix, Safe-chain 1.5.14 at its standard user location, and an explicitly configured compatible Chrome/Chromium or an existing Playwright-managed browser for capture. The Nix shell supplies Node 24 and Bun; no absolute Safe-chain path is configured. Utsuri never downloads a browser automatically.
|
|
60
|
-
|
|
61
|
-
<!-- sync-command:dev-shell -->
|
|
62
|
-
|
|
63
|
-
```bash
|
|
64
|
-
nix develop
|
|
65
|
-
```
|
|
66
|
-
|
|
67
|
-
<!-- sync-command:dev-env-check -->
|
|
40
|
+
<!-- sync-command:codex-marketplace-add -->
|
|
68
41
|
|
|
69
42
|
```bash
|
|
70
|
-
|
|
43
|
+
codex plugin marketplace add hokupod/utsuri
|
|
71
44
|
```
|
|
72
45
|
|
|
73
|
-
<!-- sync-command:install -->
|
|
46
|
+
<!-- sync-command:codex-plugin-install -->
|
|
74
47
|
|
|
75
48
|
```bash
|
|
76
|
-
|
|
49
|
+
codex plugin add utsuri@utsuri
|
|
77
50
|
```
|
|
78
51
|
|
|
79
|
-
|
|
52
|
+
Installation enables the Plugin. In the Codex app, the Plugin UI is also the supported place to inspect or change its enabled state.
|
|
80
53
|
|
|
81
|
-
|
|
54
|
+
### Claude Code
|
|
82
55
|
|
|
83
|
-
<!-- sync-command:
|
|
56
|
+
<!-- sync-command:claude-marketplace-add -->
|
|
84
57
|
|
|
85
58
|
```bash
|
|
86
|
-
|
|
59
|
+
claude plugin marketplace add hokupod/utsuri
|
|
87
60
|
```
|
|
88
61
|
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
<!-- sync-command:collect-patch -->
|
|
62
|
+
<!-- sync-command:claude-plugin-install -->
|
|
92
63
|
|
|
93
64
|
```bash
|
|
94
|
-
|
|
65
|
+
claude plugin install utsuri@utsuri
|
|
95
66
|
```
|
|
96
67
|
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
<!-- sync-command:capture-run -->
|
|
68
|
+
Restart the host after an install or update when it asks you to do so. The Plugin starts the exact CLI through native `npx`; a global Utsuri installation is neither required nor used.
|
|
100
69
|
|
|
101
|
-
|
|
102
|
-
node skills/utsuri-review/scripts/utsuri.mjs capture --run .artifacts/utsuri/readme-example --config utsuri.yml --json
|
|
103
|
-
```
|
|
70
|
+
<a id="first-review"></a><!-- section:first-review -->
|
|
104
71
|
|
|
105
|
-
|
|
72
|
+
## Run your first review
|
|
106
73
|
|
|
107
|
-
|
|
74
|
+
Open the repository in Codex or Claude Code, start a new session with Utsuri enabled, and use this prompt:
|
|
108
75
|
|
|
109
|
-
<!-- sync-command:
|
|
76
|
+
<!-- sync-command:first-review-prompt -->
|
|
110
77
|
|
|
111
|
-
```
|
|
112
|
-
|
|
78
|
+
```text
|
|
79
|
+
Review the current change with Utsuri. Create a local evidence-backed report and call out every incomplete or uncovered check.
|
|
113
80
|
```
|
|
114
81
|
|
|
115
|
-
|
|
82
|
+
Utsuri first checks available capabilities without installing anything. It can produce a code-only report when browser evidence was not requested or is unavailable. For browser evidence, start any required before/after application yourself and approve only explicit commands you trust.
|
|
116
83
|
|
|
117
|
-
|
|
84
|
+
The final response gives you the local report location, confirmed coverage, findings, failures, and gaps. Opening or serving the report remains a separate explicit action.
|
|
118
85
|
|
|
119
|
-
|
|
120
|
-
node skills/utsuri-review/scripts/utsuri.mjs compare --run .artifacts/utsuri/readme-example --json
|
|
121
|
-
```
|
|
122
|
-
|
|
123
|
-
<!-- sync-command:finalize-report -->
|
|
124
|
-
|
|
125
|
-
```bash
|
|
126
|
-
node skills/utsuri-review/scripts/utsuri.mjs finalize --run .artifacts/utsuri/readme-example --json
|
|
127
|
-
```
|
|
86
|
+
<a id="how-it-works"></a><!-- section:how-it-works -->
|
|
128
87
|
|
|
129
|
-
|
|
88
|
+
## How it works
|
|
130
89
|
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
90
|
+
1. **Collect** — reads the requested patch, worktree, range, or merge base into a bounded run.
|
|
91
|
+
2. **Capture** — records separately isolated before/after browser evidence only when configured and authorized.
|
|
92
|
+
3. **Discover and compare** — maps changed code to targets, then compares pixels, DOM, ARIA, styles, accessibility, runtime, network, and overflow evidence.
|
|
93
|
+
4. **Finalize** — publishes an immutable, hash-validated local `report/`; failed or partial evidence is preserved.
|
|
94
|
+
5. **Review and return feedback** — stores viewed state, human judgment, and comments outside `report/`. Agent questions can return only to the registered originating project and session.
|
|
134
95
|
|
|
135
|
-
|
|
96
|
+
[The detailed design](https://github.com/hokupod/utsuri/blob/v0.2.0/docs/design.md) defines the data model and security boundaries. [The CLI contract](https://github.com/hokupod/utsuri/blob/v0.2.0/skills/utsuri-review/references/cli-contract.md) documents machine-facing behavior.
|
|
136
97
|
|
|
137
|
-
|
|
138
|
-
node skills/utsuri-review/scripts/utsuri.mjs review export --run .artifacts/utsuri/readme-example --output .artifacts/utsuri/review-bundle.json --json
|
|
139
|
-
node skills/utsuri-review/scripts/utsuri.mjs review import --run .artifacts/utsuri/updated-run --input .artifacts/utsuri/review-bundle.json --reanchor --json
|
|
140
|
-
```
|
|
98
|
+
<a id="understand-report"></a><!-- section:understand-report -->
|
|
141
99
|
|
|
142
|
-
|
|
100
|
+
## Understand the report
|
|
143
101
|
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
```
|
|
102
|
+
- **Findings** are evidence-backed observations, not automatic proof of a regression.
|
|
103
|
+
- **`INCOMPLETE`** means required evidence failed, was malformed, exceeded a limit, or was unavailable. It is never converted to pass.
|
|
104
|
+
- **`UNCOVERED`** means changed code has no verified target or the coverage denominator is unknown.
|
|
105
|
+
- **No finding** means only that the completed checks found none; it is not a global `PASS` badge.
|
|
106
|
+
- **Human judgment** is independent state. Agent answers never mark an item accepted, rejected, or resolved for the reviewer.
|
|
150
107
|
|
|
151
|
-
The
|
|
108
|
+
The report preserves source identity, evidence hashes, and review gaps so another reviewer can audit what was and was not checked.
|
|
152
109
|
|
|
153
|
-
|
|
110
|
+
<a id="security-privacy"></a><!-- section:security-privacy -->
|
|
154
111
|
|
|
155
|
-
|
|
156
|
-
node skills/utsuri-review/scripts/utsuri.mjs pack .artifacts/utsuri/readme-example/report --config utsuri.yml --output .artifacts/utsuri/ci-output --json
|
|
157
|
-
```
|
|
112
|
+
## Security and privacy
|
|
158
113
|
|
|
159
|
-
|
|
114
|
+
**Never give a capture production credentials, production browser state, unrestricted network access, inferred setup commands, host sockets, or an unreviewed project command.** Repository content, pages, diffs, SVG, comments, and captured text are untrusted input.
|
|
160
115
|
|
|
161
|
-
|
|
116
|
+
- `dual-url` starts no project command. `worktree` requires explicit argv plus your opt-in. `static-fragment` disables scripts and network. `container` accepts only an already-present digest-pinned image.
|
|
117
|
+
- Generated `report/` files are immutable. Mutable review and feedback records live under the run's `review/` directory.
|
|
118
|
+
- The Marketplace MCP exposes no arbitrary path, working directory, command, provider, model, destination, or raw session input.
|
|
119
|
+
- MCP tools can use only schema-valid reports registered for the canonical current project and the same Origin Session. Cross-project, cross-host, cross-session, stale, or swapped registrations fail closed.
|
|
120
|
+
- Raw host session values are used only for equality checking and opaque hashing. They are not persisted, logged, diagnosed, or returned by tools.
|
|
121
|
+
- The Marketplace broker accepts only `CODEX_THREAD_ID` or the `CLAUDE_CODE_SESSION_ID` + `CLAUDE_PROJECT_DIR` host contract. Fixed-run `finalize`, `feedback`, and `review-mcp` also retain `UTSURI_CODEX_SESSION_ID` and `CLAUDE_SESSION_ID` compatibility; conflicting legacy/new values are rejected. Claude Plugin finalization always binds to the canonical host project root, including when launched from a child directory.
|
|
162
122
|
|
|
163
|
-
|
|
123
|
+
Claude Code may pass other ambient variables to MCP subprocesses. Utsuri does not use them as identity or expose them. `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1` is optional host hardening when supported by your Claude Code installation; the Plugin cannot enforce host-wide environment scrubbing.
|
|
164
124
|
|
|
165
|
-
|
|
125
|
+
See the [threat model](https://github.com/hokupod/utsuri/blob/v0.2.0/docs/threat-model.md), [capture boundaries](https://github.com/hokupod/utsuri/blob/v0.2.0/skills/utsuri-review/references/capture-modes.md), and [feedback boundary](https://github.com/hokupod/utsuri/blob/v0.2.0/skills/utsuri-review/references/feedback.md) before handling untrusted projects.
|
|
166
126
|
|
|
167
|
-
|
|
168
|
-
node scripts/safe-chain.mjs bun run check
|
|
169
|
-
```
|
|
127
|
+
<a id="troubleshooting-lifecycle"></a><!-- section:troubleshooting-lifecycle -->
|
|
170
128
|
|
|
171
|
-
|
|
129
|
+
## Troubleshooting and lifecycle
|
|
172
130
|
|
|
173
|
-
|
|
131
|
+
- **First start cannot reach npm:** allow access to the npm registry, then retry. The exact package is fetched on first use; Utsuri does not fall back to an ambient executable or floating version.
|
|
132
|
+
- **Browser capability is missing:** install or explicitly configure a compatible browser yourself, or continue with a code-only report. No Utsuri command downloads one.
|
|
133
|
+
- **`MCP_RUN_UNAVAILABLE`:** finalize a bound report in this same host session and project, then retry. An unbound or different-session report is intentionally invisible.
|
|
134
|
+
- **`MCP_RUN_AMBIGUOUS`:** more than one same-session report is registered. Ask the Agent to use the desired opaque `report_id` listed in the error; Utsuri never silently picks the newest run.
|
|
135
|
+
- **Run path rejected:** use a contained project-relative POSIX path. Spaces and Unicode names are supported; absolute paths, `.` or `..` components, duplicate separators, backslashes, NUL, symlinks, and paths outside the project are rejected.
|
|
136
|
+
- **Origin Session mismatch:** return to the session that created the report. Utsuri never redirects feedback to another Agent or session.
|
|
137
|
+
- **Windows:** use a supported macOS or Linux environment; Marketplace visibility does not imply native Windows support.
|
|
174
138
|
|
|
175
|
-
|
|
139
|
+
Refresh and reinstall on Codex when a new Plugin version is announced:
|
|
176
140
|
|
|
177
141
|
```bash
|
|
178
|
-
|
|
142
|
+
codex plugin marketplace upgrade utsuri
|
|
143
|
+
codex plugin remove utsuri@utsuri
|
|
144
|
+
codex plugin add utsuri@utsuri
|
|
179
145
|
```
|
|
180
146
|
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
## Security and privacy
|
|
184
|
-
|
|
185
|
-
Utsuri treats repository content, diffs, HTML, SVG, comments, Context Packs, and captured text as untrusted evidence.
|
|
186
|
-
|
|
187
|
-
**Security warning:** never provide production credentials, production browser state, unrestricted external network access, inferred setup commands, or parent-process environment variables to a capture. Before and after use separate Browser Contexts; external requests and Service Workers are blocked by default. External HTTP redirects and WebSocket handshakes use the same origin policy, and persisted textual evidence removes credentials, queries, and fragments from absolute and relative URLs.
|
|
188
|
-
|
|
189
|
-
`dual-url` never starts project code. `worktree` requires trusted input, explicit argv and separate working directories for both sides, plus the user's `--allow-project-code` opt-in. Child environments use only a minimal baseline and allowlisted non-secret names. `static-fragment` disables JavaScript and HTTP requests, sanitizes active markup, uses an empty-sandbox iframe, and is not equivalent to real-application rendering.
|
|
147
|
+
On Claude Code:
|
|
190
148
|
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
Generated `report/` content is immutable. Referenced capture and comparison evidence is independently digest-checked, copied into the report, restricted to validated PNG bytes for images, and covered by the report asset manifest. The stored `index.html` always has the offline static CSP. A local interactive server may replace exactly that canonical CSP boundary with the interactive CSP; static-fragment previews have a separate no-script/no-connect CSP. Strict validation rejects active HTML, direct SVG, unsafe references, unlisted files, missing files, and hash drift. Manifests declare that absolute paths, cookies, raw environment, raw DOM, raw headers, and traces are excluded.
|
|
196
|
-
|
|
197
|
-
Viewed progress, human judgment, comments, Agent attention, batch state, and answers are separate mutable records. Static mode uses Web Locks plus optimistic revisions, stores state per report in browser storage, and exports schema-validated, catalog-bound review and feedback documents; a stale tab never overwrites newer state. CLI state uses immutable generations and atomic hard-linked revision records under `run/review/`, including bounded inbox, batch, context, and answer sidecars. Import never rewrites `report/`, requires explicit re-anchoring for another report, never activates probable anchors automatically, and keeps changed or missing anchors explicitly stale or orphaned. Phase 5 pixel-coordinate visual anchors migrate to normalized anchors before persisted state, browser storage, or review bundles are validated; unmappable cross-report comments remain orphaned.
|
|
149
|
+
```bash
|
|
150
|
+
claude plugin marketplace update utsuri
|
|
151
|
+
claude plugin update utsuri@utsuri
|
|
152
|
+
```
|
|
198
153
|
|
|
199
|
-
|
|
154
|
+
Disable or uninstall:
|
|
200
155
|
|
|
201
|
-
|
|
156
|
+
<!-- sync-command:codex-plugin-remove -->
|
|
202
157
|
|
|
203
|
-
|
|
158
|
+
```bash
|
|
159
|
+
codex plugin remove utsuri@utsuri
|
|
160
|
+
```
|
|
204
161
|
|
|
205
|
-
|
|
162
|
+
<!-- sync-command:claude-plugin-disable -->
|
|
206
163
|
|
|
207
|
-
|
|
164
|
+
```bash
|
|
165
|
+
claude plugin disable utsuri@utsuri
|
|
166
|
+
```
|
|
208
167
|
|
|
209
|
-
|
|
168
|
+
<!-- sync-command:claude-plugin-uninstall -->
|
|
210
169
|
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
- [UI guidelines and HIG/WCAG traceability](https://github.com/hokupod/utsuri/blob/v0.1.0/docs/ui-guidelines.md)
|
|
215
|
-
- [Capture modes and runtime boundary](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/capture-modes.md)
|
|
216
|
-
- [CLI contract](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/cli-contract.md)
|
|
217
|
-
- [Origin Session feedback workflow](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/feedback.md)
|
|
218
|
-
- [v1 implementation plan](https://github.com/hokupod/utsuri/blob/v0.1.0/ai/plans/active/v1-%E5%AE%9F%E8%A3%85/README.md)
|
|
170
|
+
```bash
|
|
171
|
+
claude plugin uninstall utsuri@utsuri
|
|
172
|
+
```
|
|
219
173
|
|
|
220
|
-
|
|
174
|
+
<a id="documentation-contributing-license"></a><!-- section:documentation-contributing-license -->
|
|
221
175
|
|
|
222
|
-
|
|
176
|
+
## Documentation, contributing, and license
|
|
223
177
|
|
|
224
|
-
|
|
178
|
+
- [Contributing and developer setup](https://github.com/hokupod/utsuri/blob/v0.2.0/CONTRIBUTING.md)
|
|
179
|
+
- [Detailed design](https://github.com/hokupod/utsuri/blob/v0.2.0/docs/design.md)
|
|
180
|
+
- [Release and distribution operations](https://github.com/hokupod/utsuri/blob/v0.2.0/docs/release.md)
|
|
181
|
+
- [UI guidelines](https://github.com/hokupod/utsuri/blob/v0.2.0/docs/ui-guidelines.md)
|
|
182
|
+
- [Skill contract](https://github.com/hokupod/utsuri/blob/v0.2.0/skills/utsuri-review/SKILL.md)
|
|
225
183
|
|
|
226
|
-
|
|
184
|
+
Utsuri is licensed under `AGPL-3.0-or-later`. The publisher is `hokupod`. CLI publication, Git Plugin promotion, Git push, tags, and releases are separate operator-authorized actions; source changes alone perform none of them.
|
package/dist/build-manifest.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": "1.1",
|
|
3
|
-
"toolVersion": "0.
|
|
4
|
-
"sourceHash": "
|
|
3
|
+
"toolVersion": "0.2.0",
|
|
4
|
+
"sourceHash": "6acebe5922d7f2e718eaf999578a56664a579886b57691cf0c154a67f8524ad0",
|
|
5
5
|
"sourceHashes": {
|
|
6
6
|
"packages/adapters/generic/src/index.ts": "0fb851c88f14187773d97373b9d848e831abb629bb4b1834c4393f29917c4169",
|
|
7
7
|
"packages/adapters/playwright/src/index.ts": "7714950f8fbcc160493e649a13e2c96d2843530307150357c30b9155c42b6081",
|
|
@@ -23,11 +23,12 @@
|
|
|
23
23
|
"packages/capture/src/runtime/container.ts": "d6f53ec8d03dcf2f9774436c533fc0cd6dd72c85fe7f1d60f4f3daf5f3c18452",
|
|
24
24
|
"packages/capture/src/server-runtime.ts": "8b4055dad80efa008548c9efcd502f80ca29abcfae062c63fa3cf701a41a0472",
|
|
25
25
|
"packages/cli/src/arguments.ts": "0ab06574a833531cb6084b555d11847d6deca4fd082fa3035c5e2a72a8870005",
|
|
26
|
-
"packages/cli/src/cli.ts": "
|
|
26
|
+
"packages/cli/src/cli.ts": "94a61922650a3e2c9b0b5f4b55882524de8e8787dd5084269696f0eef2c6a7e8",
|
|
27
27
|
"packages/cli/src/doctor.ts": "fdf26a40387b433878e257c3f857348e6bbe510e63b56a6a9623c1a5b6876287",
|
|
28
|
-
"packages/cli/src/feedback.ts": "
|
|
28
|
+
"packages/cli/src/feedback.ts": "5c85a25385d488b8813edf10ab16f9a071128e67bd3c97aa792820ab54f68892",
|
|
29
29
|
"packages/cli/src/init.ts": "5250d75ae8de6a7471bce58ff4f1b27b830cbf090bc55a8ec16c9125376cfb65",
|
|
30
|
-
"packages/cli/src/main.ts": "
|
|
30
|
+
"packages/cli/src/main.ts": "d399e4b4a8a951cbb18fb6244ffa789dd3ed16cc49d6b7edb4f62078ab9a18fe",
|
|
31
|
+
"packages/cli/src/mcp.ts": "e37e4188db24534133e83c373c0539537735861cf4d7e0585ecaed881f10d782",
|
|
31
32
|
"packages/cli/src/pack.ts": "2e59a6fd8c28adaa34219eb1b7f2467d1f742f8fc3cf6c55925dc002cc2be2fc",
|
|
32
33
|
"packages/cli/src/review.ts": "6dd667da53cd5efae84899e23d2381ab3a04193b3ca0590a3c39802e69187709",
|
|
33
34
|
"packages/cli/src/serve.ts": "0a3a302b5b2630354464b3fc6c15ac838649879a820a3a4db0df09f033e4cf88",
|
|
@@ -54,17 +55,18 @@
|
|
|
54
55
|
"packages/report-builder/src/index.ts": "9b3822c279dd29cbbf5fbda74f294d00f93ad0d7cc432ed06506a7eaae7fcc17",
|
|
55
56
|
"packages/report-builder/src/native-publish.ts": "1476a27dfbb7172caf656b996b7aa71ca8c7ec3ddf1d85ee0028d11a3029f222",
|
|
56
57
|
"packages/report-builder/src/schema-assets.ts": "ef080b08889e19f291d92f260fc4f731b1505552c5f3481734de9c6414d0c23a",
|
|
57
|
-
"packages/report-model/src/index.ts": "
|
|
58
|
-
"packages/report-model/src/validator.ts": "
|
|
58
|
+
"packages/report-model/src/index.ts": "38ba6c90d0404cacc4d738adccbfd7daf0a2c5cfef40178842c776945db226f2",
|
|
59
|
+
"packages/report-model/src/validator.ts": "1d0b77a813bb2f2323de3791a9f76d5f390cf89148ffcc4c30c759ea47a568e1",
|
|
59
60
|
"packages/review-inbox/src/index.ts": "f05a3f004952c5752b842eb0c3b5cae5abcf7ad9c38c3d628a4a18ac42745832",
|
|
60
|
-
"packages/review-mcp-server/src/index.ts": "
|
|
61
|
+
"packages/review-mcp-server/src/index.ts": "560c00d3c5113b7a467735f3b0f1a8d062fbb18471ae75f5acf3350652f2674d",
|
|
62
|
+
"packages/review-mcp-server/src/run-registry.ts": "7bdb8aa633b7757bce50652ae8a64636b805622ab9b85de8e5a1c94d2a5809ca",
|
|
61
63
|
"packages/review-state/src/anchors.ts": "5e1488281d5fc2ce64bda08649f8fd14b9993ad0d48b667a07d2e1587b314a42",
|
|
62
64
|
"packages/review-state/src/canonical.ts": "844b47cee854771c920f55e24d25d1487551dd4edff80ce90b7914bb4b63c434",
|
|
63
65
|
"packages/review-state/src/index.ts": "f886a53f98cf9de1ab3b3172417c319f9edf8ca2dc37a5cbad78647acdb685d5",
|
|
64
66
|
"packages/review-state/src/model.ts": "523b4f5ab2cc1ead45e272285b93835b29846b74ae1ae9458d5149c4550c2926",
|
|
65
67
|
"packages/review-state/src/persistence.ts": "e825604b9cafac8d22137075e9846fea53d5ea924faaac2aeb6dfbe246f1520f",
|
|
66
68
|
"packages/security/src/index.ts": "a161e28fc3cc3e62f75fed63d3ad8eca363af6f255f27197882c2b2398e2ca50",
|
|
67
|
-
"packages/security/src/native-helper.ts": "
|
|
69
|
+
"packages/security/src/native-helper.ts": "7940b4eece17827bb41cf39d60bda82bb9955e437c787836647c7a71dddef967",
|
|
68
70
|
"packages/security/src/report.ts": "61d67acfeb62d4b86fdd56c9f054fbeeba545a394cb683dfba47710ddfc83add",
|
|
69
71
|
"packages/session-binding/src/index.ts": "57221d67fcff2d6922287a1efbcef7074e7c1df847b09466a43e3310b075825b",
|
|
70
72
|
"schemas/annotations.schema.json": "463cd4ca0baeca7c17624d9b7a260471713c1f2e3a0380a1f21643c40ecc6061",
|
|
@@ -74,6 +76,7 @@
|
|
|
74
76
|
"schemas/diff.schema.json": "be0188f12c5b4ed65957d9ac1401007f8e31912a0f21ed2af8e33ce274e9ebef",
|
|
75
77
|
"schemas/evidence-index.schema.json": "2d907acba09f208673849354afc8cb5aa788b8b213658e04641b3ccdeafd7c4e",
|
|
76
78
|
"schemas/feedback-batch.schema.json": "1da68f409506fd1a1f999785f666f15883e7c8d51a57b7996ba73b61eb3c24ef",
|
|
79
|
+
"schemas/mcp-run-registration.schema.json": "7bbf67677302463fd01ee157f13885340dbb624aeca4260be6aca1e8c2098320",
|
|
77
80
|
"schemas/origin-session.schema.json": "39e49ff5cfa7fa033cca453048a1e8b0ae631ddc98ca10e9d1bcd8ecb9b33538",
|
|
78
81
|
"schemas/report.schema.json": "8eb9f70ea1ae6897bf48891d67ab1245f6ef3a3a177bb212633a6546f3fb12dd",
|
|
79
82
|
"schemas/review-answer.schema.json": "fd7765261d2c71c0cf9fcd604f0607beeff6d21d59402468cf2ff84a57b4c42b",
|
|
@@ -270,6 +273,7 @@
|
|
|
270
273
|
"diff.schema.json": "be0188f12c5b4ed65957d9ac1401007f8e31912a0f21ed2af8e33ce274e9ebef",
|
|
271
274
|
"evidence-index.schema.json": "2d907acba09f208673849354afc8cb5aa788b8b213658e04641b3ccdeafd7c4e",
|
|
272
275
|
"feedback-batch.schema.json": "1da68f409506fd1a1f999785f666f15883e7c8d51a57b7996ba73b61eb3c24ef",
|
|
276
|
+
"mcp-run-registration.schema.json": "7bbf67677302463fd01ee157f13885340dbb624aeca4260be6aca1e8c2098320",
|
|
273
277
|
"origin-session.schema.json": "39e49ff5cfa7fa033cca453048a1e8b0ae631ddc98ca10e9d1bcd8ecb9b33538",
|
|
274
278
|
"report.schema.json": "8eb9f70ea1ae6897bf48891d67ab1245f6ef3a3a177bb212633a6546f3fb12dd",
|
|
275
279
|
"review-answer.schema.json": "fd7765261d2c71c0cf9fcd604f0607beeff6d21d59402468cf2ff84a57b4c42b",
|
|
@@ -283,5 +287,5 @@
|
|
|
283
287
|
"app.css": "24367977f02573eef337192857d07e9cc3d237d7870a9607cd7c7d1ae9b71c92",
|
|
284
288
|
"app.js": "68aeb0d987d16e181dba7570570bf3a0409b09464401f6c11d0dde881e33f9bc"
|
|
285
289
|
},
|
|
286
|
-
"bundleSha256": "
|
|
290
|
+
"bundleSha256": "4181c72ff425175ac297220c665daf1dc35e5927f46150dd9ea79bf7bdac767d"
|
|
287
291
|
}
|
package/dist/sbom.spdx.json
CHANGED
|
@@ -5,15 +5,15 @@
|
|
|
5
5
|
"creators": ["Tool: Utsuri SBOM generator 1"]
|
|
6
6
|
},
|
|
7
7
|
"dataLicense": "CC0-1.0",
|
|
8
|
-
"documentNamespace": "https://github.com/hokupod/utsuri/sbom/0.
|
|
9
|
-
"name": "utsuri-0.
|
|
8
|
+
"documentNamespace": "https://github.com/hokupod/utsuri/sbom/0.2.0/de680198df088328333bfc628c92f876890fdd9ec6bc12d4f583607c843f1660",
|
|
9
|
+
"name": "utsuri-0.2.0",
|
|
10
10
|
"packages": [
|
|
11
11
|
{
|
|
12
|
-
"SPDXID": "SPDXRef-Package-utsuri-workspace-0.
|
|
12
|
+
"SPDXID": "SPDXRef-Package-utsuri-workspace-0.2.0",
|
|
13
13
|
"checksums": [
|
|
14
14
|
{
|
|
15
15
|
"algorithm": "SHA256",
|
|
16
|
-
"checksumValue": "
|
|
16
|
+
"checksumValue": "f3b2dca16cf624803df096347b3d03fa0a2bda04d2c3b4b6f9af1f2b3ace78b0"
|
|
17
17
|
}
|
|
18
18
|
],
|
|
19
19
|
"downloadLocation": "NOASSERTION",
|
|
@@ -21,7 +21,7 @@
|
|
|
21
21
|
"licenseConcluded": "AGPL-3.0-or-later",
|
|
22
22
|
"licenseDeclared": "AGPL-3.0-or-later",
|
|
23
23
|
"name": "utsuri-workspace",
|
|
24
|
-
"versionInfo": "0.
|
|
24
|
+
"versionInfo": "0.2.0"
|
|
25
25
|
},
|
|
26
26
|
{
|
|
27
27
|
"SPDXID": "SPDXRef-Package-ajv-8.18.0",
|
|
@@ -242,7 +242,7 @@
|
|
|
242
242
|
],
|
|
243
243
|
"relationships": [
|
|
244
244
|
{
|
|
245
|
-
"relatedSpdxElement": "SPDXRef-Package-utsuri-workspace-0.
|
|
245
|
+
"relatedSpdxElement": "SPDXRef-Package-utsuri-workspace-0.2.0",
|
|
246
246
|
"relationshipType": "DESCRIBES",
|
|
247
247
|
"spdxElementId": "SPDXRef-DOCUMENT"
|
|
248
248
|
},
|
|
@@ -279,42 +279,42 @@
|
|
|
279
279
|
{
|
|
280
280
|
"relatedSpdxElement": "SPDXRef-Package-ajv-8.18.0",
|
|
281
281
|
"relationshipType": "DEPENDS_ON",
|
|
282
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
282
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.2.0"
|
|
283
283
|
},
|
|
284
284
|
{
|
|
285
285
|
"relatedSpdxElement": "SPDXRef-Package-ajv-formats-3.0.1",
|
|
286
286
|
"relationshipType": "DEPENDS_ON",
|
|
287
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
287
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.2.0"
|
|
288
288
|
},
|
|
289
289
|
{
|
|
290
290
|
"relatedSpdxElement": "SPDXRef-Package-axe-core-4.10.3",
|
|
291
291
|
"relationshipType": "DEPENDS_ON",
|
|
292
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
292
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.2.0"
|
|
293
293
|
},
|
|
294
294
|
{
|
|
295
295
|
"relatedSpdxElement": "SPDXRef-Package-fflate-0.8.2",
|
|
296
296
|
"relationshipType": "DEPENDS_ON",
|
|
297
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
297
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.2.0"
|
|
298
298
|
},
|
|
299
299
|
{
|
|
300
300
|
"relatedSpdxElement": "SPDXRef-Package-pixelmatch-7.1.0",
|
|
301
301
|
"relationshipType": "DEPENDS_ON",
|
|
302
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
302
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.2.0"
|
|
303
303
|
},
|
|
304
304
|
{
|
|
305
305
|
"relatedSpdxElement": "SPDXRef-Package-playwright-core-1.61.1",
|
|
306
306
|
"relationshipType": "DEPENDS_ON",
|
|
307
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
307
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.2.0"
|
|
308
308
|
},
|
|
309
309
|
{
|
|
310
310
|
"relatedSpdxElement": "SPDXRef-Package-pngjs-7.0.0",
|
|
311
311
|
"relationshipType": "DEPENDS_ON",
|
|
312
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
312
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.2.0"
|
|
313
313
|
},
|
|
314
314
|
{
|
|
315
315
|
"relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
|
|
316
316
|
"relationshipType": "DEPENDS_ON",
|
|
317
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
317
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.2.0"
|
|
318
318
|
}
|
|
319
319
|
],
|
|
320
320
|
"spdxVersion": "SPDX-2.3"
|
|
@@ -4,11 +4,11 @@
|
|
|
4
4
|
"lockfileSha256": "de680198df088328333bfc628c92f876890fdd9ec6bc12d4f583607c843f1660",
|
|
5
5
|
"packages": [
|
|
6
6
|
{
|
|
7
|
-
"checksum": "SHA256:
|
|
7
|
+
"checksum": "SHA256:f3b2dca16cf624803df096347b3d03fa0a2bda04d2c3b4b6f9af1f2b3ace78b0",
|
|
8
8
|
"license": "AGPL-3.0-or-later",
|
|
9
9
|
"name": "utsuri-workspace",
|
|
10
10
|
"packageVerificationCode": null,
|
|
11
|
-
"version": "0.
|
|
11
|
+
"version": "0.2.0"
|
|
12
12
|
},
|
|
13
13
|
{
|
|
14
14
|
"checksum": "SHA512:3e55cf78458c5cc67bb0f60e1ea983c8227371f36b52bddf18d2ad7b35f5e3291738422fc8af3577eab2771f3d298e4eef514a30f690daf05f04523934747adc",
|