@utsu-ri/cli 0.1.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +112 -144
- package/dist/build-manifest.json +26 -22
- package/dist/sbom.spdx.json +14 -14
- package/dist/third-party-licenses.json +2 -2
- package/dist/utsuri.mjs +4608 -3428
- package/package.json +6 -6
package/README.md
CHANGED
|
@@ -1,226 +1,194 @@
|
|
|
1
1
|
<!-- doc-language: en; canonical: true -->
|
|
2
2
|
|
|
3
|
-
[English](https://github.com/hokupod/utsuri/blob/v0.
|
|
3
|
+
[English](https://github.com/hokupod/utsuri/blob/v0.3.0/README.md) | [日本語](https://github.com/hokupod/utsuri/blob/v0.3.0/README.ja.md) | [简体中文](https://github.com/hokupod/utsuri/blob/v0.3.0/README.zh-CN.md)
|
|
4
4
|
|
|
5
5
|
# Utsuri
|
|
6
6
|
|
|
7
7
|
> See what changed. Understand why.
|
|
8
8
|
|
|
9
|
-
<a id="product-
|
|
9
|
+
<a id="product-outcome"></a><!-- section:product-outcome -->
|
|
10
10
|
|
|
11
|
-
##
|
|
11
|
+
## Review a change as evidence, not a green badge
|
|
12
12
|
|
|
13
|
-
Utsuri
|
|
13
|
+
Utsuri turns a Git change into a local review that connects code, browser captures, structural differences, accessibility findings, coverage, and human comments. It keeps missing evidence visible, so a reviewer can distinguish “nothing found” from “not checked.”
|
|
14
14
|
|
|
15
|
-
|
|
15
|
+
Use it when a code or UI change needs a durable report, a clear list of review gaps, or structured questions returned to the coding session that created the report.
|
|
16
16
|
|
|
17
|
-
<
|
|
17
|
+
<p align="center">
|
|
18
|
+
<img src="https://raw.githubusercontent.com/hokupod/utsuri/main/docs/assets/utsuri.jpg" alt="Two figures facing each other across a folded mirror" width="480">
|
|
19
|
+
</p>
|
|
18
20
|
|
|
19
|
-
|
|
21
|
+
<a id="availability-requirements"></a><!-- section:availability-requirements -->
|
|
20
22
|
|
|
21
|
-
|
|
23
|
+
## Availability and requirements
|
|
22
24
|
|
|
23
|
-
|
|
25
|
+
<!-- availability:git-marketplace-source-ready-cli-publication-pending -->
|
|
26
|
+
<!-- support-contract:macos-linux-windows-unsupported -->
|
|
24
27
|
|
|
25
|
-
|
|
28
|
+
The source contains a Git Plugin that exact-pins its matching `@utsu-ri/cli` release. When the source version is newer than the latest verified public release, Git installation of that source remains gated until the exact CLI is published and the Plugin source is publicly reachable. The commands below are verified host command shapes; do not substitute `latest`, a range, or another package.
|
|
26
29
|
|
|
27
|
-
|
|
30
|
+
- A Codex or Claude Code release listed in the [runtime compatibility record](https://github.com/hokupod/utsuri/blob/v0.3.0/docs/compatibility/plugin-runtime.json).
|
|
31
|
+
- macOS or Linux, Node.js 22 or later, and `npx` for first MCP startup.
|
|
32
|
+
- An existing compatible Chrome/Chromium installation for browser capture. Utsuri never downloads a browser.
|
|
33
|
+
- Optional Docker or Podman capability for the isolated container capture mode. Utsuri never pulls an image.
|
|
34
|
+
- Network access to GitHub during Marketplace installation and to npm on the first MCP start.
|
|
28
35
|
|
|
29
|
-
|
|
36
|
+
Native Windows is unsupported because no Windows native helper is distributed. Reports, captures, and review state stay in the project unless you separately authorize publication or upload.
|
|
30
37
|
|
|
31
|
-
|
|
32
|
-
- stable structured hunks with rename, delete, binary, submodule, mode, and low-signal metadata;
|
|
33
|
-
- deterministic initial change candidates with complete candidate-or-unclassified coverage;
|
|
34
|
-
- schema-validated annotations and evidence references; and
|
|
35
|
-
- a self-contained code review with summary, three-state queue, Focus mode, evidence drawer, unified/side-by-side diff, deep links, and keyboard focus restoration;
|
|
36
|
-
- separate before/after Browser Contexts with identical viewport, DPR, locale, timezone, color scheme, and reduced-motion settings;
|
|
37
|
-
- full-page and element screenshots plus normalized DOM, ARIA, computed-style, axe, console, network, metadata, and typed failure evidence; and
|
|
38
|
-
- deterministic stabilization, an allowlisted action DSL, blocked external/mutation requests, digest-checked reuse, and partial `INCOMPLETE` reports;
|
|
39
|
-
- prioritized explicit/Storybook/Playwright/route/import/selector/fallback target discovery with structured known, verified, unknown, planned, succeeded, and failed coverage;
|
|
40
|
-
- Pixelmatch counts, ratios, content-addressed diff images, changed regions, and normalized DOM/ARIA/style fingerprints;
|
|
41
|
-
- `new`, `resolved`, `unchanged`, and `incomplete` accessibility/runtime findings plus overflow and obstruction evidence; and
|
|
42
|
-
- side-by-side, wipe, stoppable blink, pixel-diff, and after-only views with crop/full-page selection, synchronized scroll/zoom, region navigation, and code/finding cross-links.
|
|
43
|
-
- separate static/interactive/iframe CSPs, bounded JSON, empty-sandbox sanitized previews, PNG-only visual evidence, expanded privacy declarations, and strict SHA-256 report validation;
|
|
44
|
-
- fixed Docker/Podman isolation with digest-pinned local images, no network, a read-only root/project mount, dropped capabilities, a non-root user, and PID/CPU/memory/time/artifact limits; and
|
|
45
|
-
- a single Node 22 ESM CLI bundle with source/schema/UI hashes plus deterministic SPDX 2.3 and dependency-license inventories;
|
|
46
|
-
- independently persisted viewed progress, human judgment, and anchored comments with canonical export/import and explicit matched/stale/orphaned re-anchoring;
|
|
47
|
-
- loopback-only static serving plus deterministic `report.zip`, `report.json`, and `ci-summary.json` packaging with policy exit code `10`; and
|
|
48
|
-
- exact CLI/native package contracts, four architecture-matched helper candidates, aggregate Plugin verification, Node 22/24 isolated-tarball smoke tests, and shared Skill evaluations;
|
|
49
|
-
- per-start capability-token interactive serving with exact Origin for mutations, same-origin Fetch Metadata for read-only GET requests, exact Referer validation when present, report-binding, and request-schema checks;
|
|
50
|
-
- explicit Agent-attention selection, Feedback Batch preview, redacted and bounded Context Packs, immutable-generation Review Inbox sidecars, and unread answer state; and
|
|
51
|
-
- fixed-run `feedback` CLI and Review Inbox MCP operations that require the originating host/session/project/report binding and write exactly one answer per item.
|
|
38
|
+
<a id="install"></a><!-- section:install -->
|
|
52
39
|
|
|
53
|
-
|
|
40
|
+
## Install from the Git Marketplace
|
|
54
41
|
|
|
55
|
-
|
|
42
|
+
### Codex
|
|
56
43
|
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
Prerequisites: Nix, Safe-chain 1.5.14 at its standard user location, and an explicitly configured compatible Chrome/Chromium or an existing Playwright-managed browser for capture. The Nix shell supplies Node 24 and Bun; no absolute Safe-chain path is configured. Utsuri never downloads a browser automatically.
|
|
60
|
-
|
|
61
|
-
<!-- sync-command:dev-shell -->
|
|
62
|
-
|
|
63
|
-
```bash
|
|
64
|
-
nix develop
|
|
65
|
-
```
|
|
66
|
-
|
|
67
|
-
<!-- sync-command:dev-env-check -->
|
|
44
|
+
<!-- sync-command:codex-marketplace-add -->
|
|
68
45
|
|
|
69
46
|
```bash
|
|
70
|
-
|
|
47
|
+
codex plugin marketplace add hokupod/utsuri
|
|
71
48
|
```
|
|
72
49
|
|
|
73
|
-
<!-- sync-command:install -->
|
|
50
|
+
<!-- sync-command:codex-plugin-install -->
|
|
74
51
|
|
|
75
52
|
```bash
|
|
76
|
-
|
|
53
|
+
codex plugin add utsuri@utsuri
|
|
77
54
|
```
|
|
78
55
|
|
|
79
|
-
|
|
56
|
+
Installation enables the Plugin. In the Codex app, the Plugin UI is also the supported place to inspect or change its enabled state. Codex uses the Utsuri product illustration as both the composer icon and Plugin logo.
|
|
80
57
|
|
|
81
|
-
|
|
58
|
+
### Claude Code
|
|
82
59
|
|
|
83
|
-
<!-- sync-command:
|
|
60
|
+
<!-- sync-command:claude-marketplace-add -->
|
|
84
61
|
|
|
85
62
|
```bash
|
|
86
|
-
|
|
63
|
+
claude plugin marketplace add hokupod/utsuri
|
|
87
64
|
```
|
|
88
65
|
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
<!-- sync-command:collect-patch -->
|
|
66
|
+
<!-- sync-command:claude-plugin-install -->
|
|
92
67
|
|
|
93
68
|
```bash
|
|
94
|
-
|
|
69
|
+
claude plugin install utsuri@utsuri
|
|
95
70
|
```
|
|
96
71
|
|
|
97
|
-
|
|
72
|
+
Claude Code's current Plugin manifest does not expose an icon or logo field, so Utsuri does not add unsupported image metadata there.
|
|
98
73
|
|
|
99
|
-
|
|
74
|
+
Restart the host after an install or update when it asks you to do so. The Plugin starts the exact CLI through native `npx`; a global Utsuri installation is neither required nor used.
|
|
100
75
|
|
|
101
|
-
|
|
102
|
-
node skills/utsuri-review/scripts/utsuri.mjs capture --run .artifacts/utsuri/readme-example --config utsuri.yml --json
|
|
103
|
-
```
|
|
76
|
+
<a id="first-review"></a><!-- section:first-review -->
|
|
104
77
|
|
|
105
|
-
|
|
78
|
+
## Run your first review
|
|
106
79
|
|
|
107
|
-
|
|
80
|
+
Open the repository in Codex or Claude Code, start a new session with Utsuri enabled, and use this prompt:
|
|
108
81
|
|
|
109
|
-
<!-- sync-command:
|
|
82
|
+
<!-- sync-command:first-review-prompt -->
|
|
110
83
|
|
|
111
|
-
```
|
|
112
|
-
|
|
84
|
+
```text
|
|
85
|
+
Review the current change with Utsuri. Create and validate an evidence-backed report, explain each change in my language, start the local report viewer, verify that the diff loads, and return its live URL with every incomplete or uncovered check.
|
|
113
86
|
```
|
|
114
87
|
|
|
115
|
-
|
|
88
|
+
Utsuri first checks available capabilities without installing anything. It can produce a code-only report when browser evidence was not requested or is unavailable. For browser evidence, start any required before/after application yourself and approve only explicit commands you trust.
|
|
116
89
|
|
|
117
|
-
|
|
90
|
+
In a human conversation, the Agent authors the evidence-backed interpretation in your selected language, strictly validates the report, starts the appropriate persistent loopback viewer, verifies that the report and diff load, and returns the live URL with confirmed coverage, findings, failures, and gaps. A filesystem path alone is not a completed handoff. Serving is skipped only for an explicitly requested artifact-only or CI workflow.
|
|
118
91
|
|
|
119
|
-
|
|
120
|
-
node skills/utsuri-review/scripts/utsuri.mjs compare --run .artifacts/utsuri/readme-example --json
|
|
121
|
-
```
|
|
92
|
+
<a id="how-it-works"></a><!-- section:how-it-works -->
|
|
122
93
|
|
|
123
|
-
|
|
94
|
+
## How it works
|
|
124
95
|
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
96
|
+
1. **Collect** — reads the requested patch, worktree, range, or merge base into a bounded run.
|
|
97
|
+
2. **Interpret** — the current Agent uses the conversation, diff, and indexed evidence to group causally related hunks across files into semantic changes, explains each change, and adds a concise purpose and meaning for every hunk without inventing unsupported intent.
|
|
98
|
+
3. **Capture** — records separately isolated before/after browser evidence only when configured and authorized.
|
|
99
|
+
4. **Discover and compare** — maps changed code to targets, then compares pixels, DOM, ARIA, styles, accessibility, runtime, network, and overflow evidence.
|
|
100
|
+
5. **Finalize** — publishes an immutable, hash-validated local `report/` with the Agent-authored annotations; failed or partial evidence is preserved.
|
|
101
|
+
6. **Serve and verify** — keeps the appropriate loopback viewer alive, confirms that the review brief, first semantic change, code diff, and Agent interpretation load, then returns the live URL.
|
|
102
|
+
7. **Review and return feedback** — stores viewed state, human judgment, and comments outside `report/`. Agent questions can return only to the registered originating project and session.
|
|
128
103
|
|
|
129
|
-
|
|
104
|
+
[The detailed design](https://github.com/hokupod/utsuri/blob/v0.3.0/docs/design.md) defines the data model and security boundaries. [The CLI contract](https://github.com/hokupod/utsuri/blob/v0.3.0/skills/utsuri-review/references/cli-contract.md) documents machine-facing behavior.
|
|
130
105
|
|
|
131
|
-
|
|
132
|
-
node skills/utsuri-review/scripts/utsuri.mjs validate .artifacts/utsuri/readme-example/report --strict --json
|
|
133
|
-
```
|
|
106
|
+
<a id="understand-report"></a><!-- section:understand-report -->
|
|
134
107
|
|
|
135
|
-
|
|
108
|
+
## Understand the report
|
|
136
109
|
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
110
|
+
- **Review brief** combines the Agent-authored overview, deterministic evidence posture, and a prioritized map of semantic changes. One semantic change may span several files; file and hunk links are evidence, not review boundaries.
|
|
111
|
+
- **Hunk explanations** put the Agent-authored purpose and meaning immediately before each annotated code hunk. New annotations that omit or duplicate a collected hunk are rejected; `unclassifiedHunkRefs` is reserved for deterministic fallback reports created without annotations. Older reports without these fields remain viewable and omit the panel.
|
|
112
|
+
- **Findings** are evidence-backed observations, not automatic proof of a regression.
|
|
113
|
+
- **`INCOMPLETE`** means required evidence failed, was malformed, exceeded a limit, or was unavailable. It is never converted to pass.
|
|
114
|
+
- **`UNCOVERED`** means changed code has no verified target or the coverage denominator is unknown.
|
|
115
|
+
- **No finding** means only that the completed checks found none; it is not a global `PASS` badge.
|
|
116
|
+
- **Human judgment** is independent state. Agent answers never mark an item accepted, rejected, or resolved for the reviewer.
|
|
141
117
|
|
|
142
|
-
|
|
118
|
+
The report preserves source identity, evidence hashes, and review gaps so another reviewer can audit what was and was not checked.
|
|
143
119
|
|
|
144
|
-
|
|
145
|
-
node skills/utsuri-review/scripts/utsuri.mjs serve .artifacts/utsuri/readme-example/report --interactive
|
|
146
|
-
node skills/utsuri-review/scripts/utsuri.mjs feedback list --run .artifacts/utsuri/readme-example --status ready --json
|
|
147
|
-
node skills/utsuri-review/scripts/utsuri.mjs feedback get --run .artifacts/utsuri/readme-example --batch fb_example --json
|
|
148
|
-
node skills/utsuri-review/scripts/utsuri.mjs feedback answer --run .artifacts/utsuri/readme-example --batch fb_example --input answers.json --json
|
|
149
|
-
```
|
|
150
|
-
|
|
151
|
-
The current implementation intentionally uses `return-to-session`. If session binding is absent it uses `export-only`; it never invents a direct bridge or falls back to another conversation.
|
|
152
|
-
|
|
153
|
-
Create local CI artifacts without uploading them:
|
|
120
|
+
<a id="security-privacy"></a><!-- section:security-privacy -->
|
|
154
121
|
|
|
155
|
-
|
|
156
|
-
node skills/utsuri-review/scripts/utsuri.mjs pack .artifacts/utsuri/readme-example/report --config utsuri.yml --output .artifacts/utsuri/ci-output --json
|
|
157
|
-
```
|
|
122
|
+
## Security and privacy
|
|
158
123
|
|
|
159
|
-
|
|
124
|
+
**Never give a capture production credentials, production browser state, unrestricted network access, inferred setup commands, host sockets, or an unreviewed project command.** Repository content, pages, diffs, SVG, comments, and captured text are untrusted input.
|
|
160
125
|
|
|
161
|
-
|
|
126
|
+
- `dual-url` starts no project command. `worktree` requires explicit argv plus your opt-in. `static-fragment` disables scripts and network. `container` accepts only an already-present digest-pinned image.
|
|
127
|
+
- Generated `report/` files are immutable. Mutable review and feedback records live under the run's `review/` directory.
|
|
128
|
+
- The Marketplace MCP exposes no arbitrary path, working directory, command, provider, model, destination, or raw session input.
|
|
129
|
+
- MCP tools can use only schema-valid reports registered for the canonical current project and the same Origin Session. Cross-project, cross-host, cross-session, stale, or swapped registrations fail closed.
|
|
130
|
+
- Raw host session values are used only for equality checking and opaque hashing. They are not persisted, logged, diagnosed, or returned by tools.
|
|
131
|
+
- The Marketplace broker accepts only `CODEX_THREAD_ID` or the `CLAUDE_CODE_SESSION_ID` + `CLAUDE_PROJECT_DIR` host contract. Fixed-run `finalize`, `feedback`, and `review-mcp` also retain `UTSURI_CODEX_SESSION_ID` and `CLAUDE_SESSION_ID` compatibility; conflicting legacy/new values are rejected. Claude Plugin finalization always binds to the canonical host project root, including when launched from a child directory.
|
|
162
132
|
|
|
163
|
-
|
|
133
|
+
Claude Code may pass other ambient variables to MCP subprocesses. Utsuri does not use them as identity or expose them. `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1` is optional host hardening when supported by your Claude Code installation; the Plugin cannot enforce host-wide environment scrubbing.
|
|
164
134
|
|
|
165
|
-
|
|
135
|
+
See the [threat model](https://github.com/hokupod/utsuri/blob/v0.3.0/docs/threat-model.md), [capture boundaries](https://github.com/hokupod/utsuri/blob/v0.3.0/skills/utsuri-review/references/capture-modes.md), and [feedback boundary](https://github.com/hokupod/utsuri/blob/v0.3.0/skills/utsuri-review/references/feedback.md) before handling untrusted projects.
|
|
166
136
|
|
|
167
|
-
|
|
168
|
-
node scripts/safe-chain.mjs bun run check
|
|
169
|
-
```
|
|
137
|
+
<a id="troubleshooting-lifecycle"></a><!-- section:troubleshooting-lifecycle -->
|
|
170
138
|
|
|
171
|
-
|
|
139
|
+
## Troubleshooting and lifecycle
|
|
172
140
|
|
|
173
|
-
|
|
141
|
+
- **First start cannot reach npm:** allow access to the npm registry, then retry. The exact package is fetched on first use; Utsuri does not fall back to an ambient executable or floating version.
|
|
142
|
+
- **Browser capability is missing:** install or explicitly configure a compatible browser yourself, or continue with a code-only report. No Utsuri command downloads one.
|
|
143
|
+
- **`MCP_RUN_UNAVAILABLE`:** finalize a bound report in this same host session and project, then retry. An unbound or different-session report is intentionally invisible.
|
|
144
|
+
- **`MCP_RUN_AMBIGUOUS`:** more than one same-session report is registered. Ask the Agent to use the desired opaque `report_id` listed in the error; Utsuri never silently picks the newest run.
|
|
145
|
+
- **Run path rejected:** use a contained project-relative POSIX path. Spaces and Unicode names are supported; absolute paths, `.` or `..` components, duplicate separators, backslashes, NUL, symlinks, and paths outside the project are rejected.
|
|
146
|
+
- **Origin Session mismatch:** return to the session that created the report. Utsuri never redirects feedback to another Agent or session.
|
|
147
|
+
- **Windows:** use a supported macOS or Linux environment; Marketplace visibility does not imply native Windows support.
|
|
174
148
|
|
|
175
|
-
|
|
149
|
+
Refresh and reinstall on Codex when a new Plugin version is announced:
|
|
176
150
|
|
|
177
151
|
```bash
|
|
178
|
-
|
|
152
|
+
codex plugin marketplace upgrade utsuri
|
|
153
|
+
codex plugin remove utsuri@utsuri
|
|
154
|
+
codex plugin add utsuri@utsuri
|
|
179
155
|
```
|
|
180
156
|
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
## Security and privacy
|
|
184
|
-
|
|
185
|
-
Utsuri treats repository content, diffs, HTML, SVG, comments, Context Packs, and captured text as untrusted evidence.
|
|
186
|
-
|
|
187
|
-
**Security warning:** never provide production credentials, production browser state, unrestricted external network access, inferred setup commands, or parent-process environment variables to a capture. Before and after use separate Browser Contexts; external requests and Service Workers are blocked by default. External HTTP redirects and WebSocket handshakes use the same origin policy, and persisted textual evidence removes credentials, queries, and fragments from absolute and relative URLs.
|
|
188
|
-
|
|
189
|
-
`dual-url` never starts project code. `worktree` requires trusted input, explicit argv and separate working directories for both sides, plus the user's `--allow-project-code` opt-in. Child environments use only a minimal baseline and allowlisted non-secret names. `static-fragment` disables JavaScript and HTTP requests, sanitizes active markup, uses an empty-sandbox iframe, and is not equivalent to real-application rendering.
|
|
157
|
+
On Claude Code:
|
|
190
158
|
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
Generated `report/` content is immutable. Referenced capture and comparison evidence is independently digest-checked, copied into the report, restricted to validated PNG bytes for images, and covered by the report asset manifest. The stored `index.html` always has the offline static CSP. A local interactive server may replace exactly that canonical CSP boundary with the interactive CSP; static-fragment previews have a separate no-script/no-connect CSP. Strict validation rejects active HTML, direct SVG, unsafe references, unlisted files, missing files, and hash drift. Manifests declare that absolute paths, cookies, raw environment, raw DOM, raw headers, and traces are excluded.
|
|
196
|
-
|
|
197
|
-
Viewed progress, human judgment, comments, Agent attention, batch state, and answers are separate mutable records. Static mode uses Web Locks plus optimistic revisions, stores state per report in browser storage, and exports schema-validated, catalog-bound review and feedback documents; a stale tab never overwrites newer state. CLI state uses immutable generations and atomic hard-linked revision records under `run/review/`, including bounded inbox, batch, context, and answer sidecars. Import never rewrites `report/`, requires explicit re-anchoring for another report, never activates probable anchors automatically, and keeps changed or missing anchors explicitly stale or orphaned. Phase 5 pixel-coordinate visual anchors migrate to normalized anchors before persisted state, browser storage, or review bundles are validated; unmappable cross-report comments remain orphaned.
|
|
159
|
+
```bash
|
|
160
|
+
claude plugin marketplace update utsuri
|
|
161
|
+
claude plugin update utsuri@utsuri
|
|
162
|
+
```
|
|
198
163
|
|
|
199
|
-
|
|
164
|
+
Disable or uninstall:
|
|
200
165
|
|
|
201
|
-
|
|
166
|
+
<!-- sync-command:codex-plugin-remove -->
|
|
202
167
|
|
|
203
|
-
|
|
168
|
+
```bash
|
|
169
|
+
codex plugin remove utsuri@utsuri
|
|
170
|
+
```
|
|
204
171
|
|
|
205
|
-
|
|
172
|
+
<!-- sync-command:claude-plugin-disable -->
|
|
206
173
|
|
|
207
|
-
|
|
174
|
+
```bash
|
|
175
|
+
claude plugin disable utsuri@utsuri
|
|
176
|
+
```
|
|
208
177
|
|
|
209
|
-
|
|
178
|
+
<!-- sync-command:claude-plugin-uninstall -->
|
|
210
179
|
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
- [UI guidelines and HIG/WCAG traceability](https://github.com/hokupod/utsuri/blob/v0.1.0/docs/ui-guidelines.md)
|
|
215
|
-
- [Capture modes and runtime boundary](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/capture-modes.md)
|
|
216
|
-
- [CLI contract](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/cli-contract.md)
|
|
217
|
-
- [Origin Session feedback workflow](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/feedback.md)
|
|
218
|
-
- [v1 implementation plan](https://github.com/hokupod/utsuri/blob/v0.1.0/ai/plans/active/v1-%E5%AE%9F%E8%A3%85/README.md)
|
|
180
|
+
```bash
|
|
181
|
+
claude plugin uninstall utsuri@utsuri
|
|
182
|
+
```
|
|
219
183
|
|
|
220
|
-
|
|
184
|
+
<a id="documentation-contributing-license"></a><!-- section:documentation-contributing-license -->
|
|
221
185
|
|
|
222
|
-
|
|
186
|
+
## Documentation, contributing, and license
|
|
223
187
|
|
|
224
|
-
|
|
188
|
+
- [Contributing and developer setup](https://github.com/hokupod/utsuri/blob/v0.3.0/CONTRIBUTING.md)
|
|
189
|
+
- [Detailed design](https://github.com/hokupod/utsuri/blob/v0.3.0/docs/design.md)
|
|
190
|
+
- [Release and distribution operations](https://github.com/hokupod/utsuri/blob/v0.3.0/docs/release.md)
|
|
191
|
+
- [UI guidelines](https://github.com/hokupod/utsuri/blob/v0.3.0/docs/ui-guidelines.md)
|
|
192
|
+
- [Skill contract](https://github.com/hokupod/utsuri/blob/v0.3.0/skills/utsuri-review/SKILL.md)
|
|
225
193
|
|
|
226
|
-
|
|
194
|
+
Utsuri is licensed under `AGPL-3.0-or-later`. The publisher is `hokupod`. CLI publication, Git Plugin promotion, Git push, tags, and releases are separate operator-authorized actions; source changes alone perform none of them.
|
package/dist/build-manifest.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": "1.1",
|
|
3
|
-
"toolVersion": "0.
|
|
4
|
-
"sourceHash": "
|
|
3
|
+
"toolVersion": "0.3.0",
|
|
4
|
+
"sourceHash": "ac154c621f3b9f963ea7c831cee9403f37bb0e6f271d7cea9e7593b9e6ceee09",
|
|
5
5
|
"sourceHashes": {
|
|
6
6
|
"packages/adapters/generic/src/index.ts": "0fb851c88f14187773d97373b9d848e831abb629bb4b1834c4393f29917c4169",
|
|
7
7
|
"packages/adapters/playwright/src/index.ts": "7714950f8fbcc160493e649a13e2c96d2843530307150357c30b9155c42b6081",
|
|
@@ -23,12 +23,13 @@
|
|
|
23
23
|
"packages/capture/src/runtime/container.ts": "d6f53ec8d03dcf2f9774436c533fc0cd6dd72c85fe7f1d60f4f3daf5f3c18452",
|
|
24
24
|
"packages/capture/src/server-runtime.ts": "8b4055dad80efa008548c9efcd502f80ca29abcfae062c63fa3cf701a41a0472",
|
|
25
25
|
"packages/cli/src/arguments.ts": "0ab06574a833531cb6084b555d11847d6deca4fd082fa3035c5e2a72a8870005",
|
|
26
|
-
"packages/cli/src/cli.ts": "
|
|
26
|
+
"packages/cli/src/cli.ts": "7cd4022fb99315fe221a8ebe73cf89ce8d934dcde985322723af5e9544f87430",
|
|
27
27
|
"packages/cli/src/doctor.ts": "fdf26a40387b433878e257c3f857348e6bbe510e63b56a6a9623c1a5b6876287",
|
|
28
|
-
"packages/cli/src/feedback.ts": "
|
|
28
|
+
"packages/cli/src/feedback.ts": "5c85a25385d488b8813edf10ab16f9a071128e67bd3c97aa792820ab54f68892",
|
|
29
29
|
"packages/cli/src/init.ts": "5250d75ae8de6a7471bce58ff4f1b27b830cbf090bc55a8ec16c9125376cfb65",
|
|
30
|
-
"packages/cli/src/main.ts": "
|
|
31
|
-
"packages/cli/src/
|
|
30
|
+
"packages/cli/src/main.ts": "d399e4b4a8a951cbb18fb6244ffa789dd3ed16cc49d6b7edb4f62078ab9a18fe",
|
|
31
|
+
"packages/cli/src/mcp.ts": "e91ff3ad919cace034def51486eaa3d9f10089d88399e3fbfe8ce3334e59e0f6",
|
|
32
|
+
"packages/cli/src/pack.ts": "d6963c6a5a1186b42abca311bd212cc5f4a560cc8284193e06f09b810d04c63b",
|
|
32
33
|
"packages/cli/src/review.ts": "6dd667da53cd5efae84899e23d2381ab3a04193b3ca0590a3c39802e69187709",
|
|
33
34
|
"packages/cli/src/serve.ts": "0a3a302b5b2630354464b3fc6c15ac838649879a820a3a4db0df09f033e4cf88",
|
|
34
35
|
"packages/clipboard-handoff/src/index.ts": "87e3bd52dee66181afadca1c36cd8cbb1472c2a21933a16b1a72721496aeca90",
|
|
@@ -50,32 +51,34 @@
|
|
|
50
51
|
"packages/git-collector/src/index.ts": "c8686ef8faa57f1fa17a105a57f7306ff8372de171f9469ae6e22aa1b278f86d",
|
|
51
52
|
"packages/git-collector/src/patch.ts": "2ad71151ca382bc5be3b9396e60aeb36394151e5ae5670687414f967fa893e96",
|
|
52
53
|
"packages/interactive-server/src/index.ts": "66bac04d327797d4d57a594f7032b87f0a32dd8ccd3c1ed1647bcf1b6a87b5b1",
|
|
53
|
-
"packages/report-builder/src/generated-ui-assets.ts": "
|
|
54
|
-
"packages/report-builder/src/index.ts": "
|
|
54
|
+
"packages/report-builder/src/generated-ui-assets.ts": "03ee2cc57c8a80c319813711907d6f952e5ab5040d7f69e0749e8b2bbcff3141",
|
|
55
|
+
"packages/report-builder/src/index.ts": "785ee8a37295077ec710c4c030aeaf0f26404f13cc1e33ea3a28155a575301e4",
|
|
55
56
|
"packages/report-builder/src/native-publish.ts": "1476a27dfbb7172caf656b996b7aa71ca8c7ec3ddf1d85ee0028d11a3029f222",
|
|
56
57
|
"packages/report-builder/src/schema-assets.ts": "ef080b08889e19f291d92f260fc4f731b1505552c5f3481734de9c6414d0c23a",
|
|
57
|
-
"packages/report-model/src/index.ts": "
|
|
58
|
-
"packages/report-model/src/validator.ts": "
|
|
58
|
+
"packages/report-model/src/index.ts": "38ba6c90d0404cacc4d738adccbfd7daf0a2c5cfef40178842c776945db226f2",
|
|
59
|
+
"packages/report-model/src/validator.ts": "c6944b0bb97942e2332634b0fded31f7bfadde2612e4531314202d5415332f25",
|
|
59
60
|
"packages/review-inbox/src/index.ts": "f05a3f004952c5752b842eb0c3b5cae5abcf7ad9c38c3d628a4a18ac42745832",
|
|
60
|
-
"packages/review-mcp-server/src/index.ts": "
|
|
61
|
+
"packages/review-mcp-server/src/index.ts": "47a058e2fb5fd8af47ac03938a7b97e8ac74061446c3fd3afbe5b939d2ea943c",
|
|
62
|
+
"packages/review-mcp-server/src/run-registry.ts": "7bdb8aa633b7757bce50652ae8a64636b805622ab9b85de8e5a1c94d2a5809ca",
|
|
61
63
|
"packages/review-state/src/anchors.ts": "5e1488281d5fc2ce64bda08649f8fd14b9993ad0d48b667a07d2e1587b314a42",
|
|
62
64
|
"packages/review-state/src/canonical.ts": "844b47cee854771c920f55e24d25d1487551dd4edff80ce90b7914bb4b63c434",
|
|
63
65
|
"packages/review-state/src/index.ts": "f886a53f98cf9de1ab3b3172417c319f9edf8ca2dc37a5cbad78647acdb685d5",
|
|
64
66
|
"packages/review-state/src/model.ts": "523b4f5ab2cc1ead45e272285b93835b29846b74ae1ae9458d5149c4550c2926",
|
|
65
67
|
"packages/review-state/src/persistence.ts": "e825604b9cafac8d22137075e9846fea53d5ea924faaac2aeb6dfbe246f1520f",
|
|
66
68
|
"packages/security/src/index.ts": "a161e28fc3cc3e62f75fed63d3ad8eca363af6f255f27197882c2b2398e2ca50",
|
|
67
|
-
"packages/security/src/native-helper.ts": "
|
|
68
|
-
"packages/security/src/report.ts": "
|
|
69
|
+
"packages/security/src/native-helper.ts": "80421da92bdc6dc8939c2281fab4acd3dad4ac27e3385d1cadda2a2920443d5c",
|
|
70
|
+
"packages/security/src/report.ts": "9ae014c99c36b548fe3b18a37ca3e284270d2155fdb313bc75617b95ffbe2533",
|
|
69
71
|
"packages/session-binding/src/index.ts": "57221d67fcff2d6922287a1efbcef7074e7c1df847b09466a43e3310b075825b",
|
|
70
|
-
"schemas/annotations.schema.json": "
|
|
72
|
+
"schemas/annotations.schema.json": "15de4590de967a253a598418c0577b5e9ae3edda8246ea2dcc51f308e233abd3",
|
|
71
73
|
"schemas/capture-action.schema.json": "9639715c364b0ea8791523a3bc7206d0c5f67acb81380324f25ba22eed79fc05",
|
|
72
|
-
"schemas/config.schema.json": "
|
|
74
|
+
"schemas/config.schema.json": "d664131a7ddf9eebedc98125017849e426752a8946a97f0c292f11ed59486ca9",
|
|
73
75
|
"schemas/context-pack.schema.json": "9e2b7f19ca6db78f72de6f4ce0acb287c8ed64b94e8dca32fee194e6f5e26fa3",
|
|
74
76
|
"schemas/diff.schema.json": "be0188f12c5b4ed65957d9ac1401007f8e31912a0f21ed2af8e33ce274e9ebef",
|
|
75
77
|
"schemas/evidence-index.schema.json": "2d907acba09f208673849354afc8cb5aa788b8b213658e04641b3ccdeafd7c4e",
|
|
76
78
|
"schemas/feedback-batch.schema.json": "1da68f409506fd1a1f999785f666f15883e7c8d51a57b7996ba73b61eb3c24ef",
|
|
79
|
+
"schemas/mcp-run-registration.schema.json": "7bbf67677302463fd01ee157f13885340dbb624aeca4260be6aca1e8c2098320",
|
|
77
80
|
"schemas/origin-session.schema.json": "39e49ff5cfa7fa033cca453048a1e8b0ae631ddc98ca10e9d1bcd8ecb9b33538",
|
|
78
|
-
"schemas/report.schema.json": "
|
|
81
|
+
"schemas/report.schema.json": "b107789650aeb84496287a7a95675bbcd08029ba26fe61598324e62542c685d3",
|
|
79
82
|
"schemas/review-answer.schema.json": "fd7765261d2c71c0cf9fcd604f0607beeff6d21d59402468cf2ff84a57b4c42b",
|
|
80
83
|
"schemas/review-bundle.schema.json": "5f445f745da093f565669ce13a3eb59e182eabe98c3df1b51f8b49e4b67b33d6",
|
|
81
84
|
"schemas/review-event.schema.json": "57c75a0383645435e20e752cb24de9517929381cf2d3b684575dd8d053e12ad3",
|
|
@@ -263,15 +266,16 @@
|
|
|
263
266
|
"yaml@2.8.3/dist/visit.js": "a757e3b924af184b25e2386d1678b1fe341805a516ebf9bccee219b47aebd5e7"
|
|
264
267
|
},
|
|
265
268
|
"schemaHashes": {
|
|
266
|
-
"annotations.schema.json": "
|
|
269
|
+
"annotations.schema.json": "15de4590de967a253a598418c0577b5e9ae3edda8246ea2dcc51f308e233abd3",
|
|
267
270
|
"capture-action.schema.json": "9639715c364b0ea8791523a3bc7206d0c5f67acb81380324f25ba22eed79fc05",
|
|
268
|
-
"config.schema.json": "
|
|
271
|
+
"config.schema.json": "d664131a7ddf9eebedc98125017849e426752a8946a97f0c292f11ed59486ca9",
|
|
269
272
|
"context-pack.schema.json": "9e2b7f19ca6db78f72de6f4ce0acb287c8ed64b94e8dca32fee194e6f5e26fa3",
|
|
270
273
|
"diff.schema.json": "be0188f12c5b4ed65957d9ac1401007f8e31912a0f21ed2af8e33ce274e9ebef",
|
|
271
274
|
"evidence-index.schema.json": "2d907acba09f208673849354afc8cb5aa788b8b213658e04641b3ccdeafd7c4e",
|
|
272
275
|
"feedback-batch.schema.json": "1da68f409506fd1a1f999785f666f15883e7c8d51a57b7996ba73b61eb3c24ef",
|
|
276
|
+
"mcp-run-registration.schema.json": "7bbf67677302463fd01ee157f13885340dbb624aeca4260be6aca1e8c2098320",
|
|
273
277
|
"origin-session.schema.json": "39e49ff5cfa7fa033cca453048a1e8b0ae631ddc98ca10e9d1bcd8ecb9b33538",
|
|
274
|
-
"report.schema.json": "
|
|
278
|
+
"report.schema.json": "b107789650aeb84496287a7a95675bbcd08029ba26fe61598324e62542c685d3",
|
|
275
279
|
"review-answer.schema.json": "fd7765261d2c71c0cf9fcd604f0607beeff6d21d59402468cf2ff84a57b4c42b",
|
|
276
280
|
"review-bundle.schema.json": "5f445f745da093f565669ce13a3eb59e182eabe98c3df1b51f8b49e4b67b33d6",
|
|
277
281
|
"review-event.schema.json": "57c75a0383645435e20e752cb24de9517929381cf2d3b684575dd8d053e12ad3",
|
|
@@ -280,8 +284,8 @@
|
|
|
280
284
|
"review-thread.schema.json": "6c5957f14b964dfaf1601ac45870b7f3fae013209dd4964aa3831dd753f06fc1"
|
|
281
285
|
},
|
|
282
286
|
"uiAssetHashes": {
|
|
283
|
-
"app.css": "
|
|
284
|
-
"app.js": "
|
|
287
|
+
"app.css": "26db3b18b936af3b1cf306bbc984db50d7144d1706712bcad400e5e3af3d485a",
|
|
288
|
+
"app.js": "4874583e6dc717bf4d7fab0744b758627312f5b7397c1e4cb86463a13c9c891d"
|
|
285
289
|
},
|
|
286
|
-
"bundleSha256": "
|
|
290
|
+
"bundleSha256": "db5cf998f5c41b08be30d23394f131de1fcbdcef8715a7d77e09deeeb717fc99"
|
|
287
291
|
}
|
package/dist/sbom.spdx.json
CHANGED
|
@@ -5,15 +5,15 @@
|
|
|
5
5
|
"creators": ["Tool: Utsuri SBOM generator 1"]
|
|
6
6
|
},
|
|
7
7
|
"dataLicense": "CC0-1.0",
|
|
8
|
-
"documentNamespace": "https://github.com/hokupod/utsuri/sbom/0.
|
|
9
|
-
"name": "utsuri-0.
|
|
8
|
+
"documentNamespace": "https://github.com/hokupod/utsuri/sbom/0.3.0/de680198df088328333bfc628c92f876890fdd9ec6bc12d4f583607c843f1660",
|
|
9
|
+
"name": "utsuri-0.3.0",
|
|
10
10
|
"packages": [
|
|
11
11
|
{
|
|
12
|
-
"SPDXID": "SPDXRef-Package-utsuri-workspace-0.
|
|
12
|
+
"SPDXID": "SPDXRef-Package-utsuri-workspace-0.3.0",
|
|
13
13
|
"checksums": [
|
|
14
14
|
{
|
|
15
15
|
"algorithm": "SHA256",
|
|
16
|
-
"checksumValue": "
|
|
16
|
+
"checksumValue": "7830188d0171dc696c366d53e35f06e01e82c53cec0862171503522013b85c7e"
|
|
17
17
|
}
|
|
18
18
|
],
|
|
19
19
|
"downloadLocation": "NOASSERTION",
|
|
@@ -21,7 +21,7 @@
|
|
|
21
21
|
"licenseConcluded": "AGPL-3.0-or-later",
|
|
22
22
|
"licenseDeclared": "AGPL-3.0-or-later",
|
|
23
23
|
"name": "utsuri-workspace",
|
|
24
|
-
"versionInfo": "0.
|
|
24
|
+
"versionInfo": "0.3.0"
|
|
25
25
|
},
|
|
26
26
|
{
|
|
27
27
|
"SPDXID": "SPDXRef-Package-ajv-8.18.0",
|
|
@@ -242,7 +242,7 @@
|
|
|
242
242
|
],
|
|
243
243
|
"relationships": [
|
|
244
244
|
{
|
|
245
|
-
"relatedSpdxElement": "SPDXRef-Package-utsuri-workspace-0.
|
|
245
|
+
"relatedSpdxElement": "SPDXRef-Package-utsuri-workspace-0.3.0",
|
|
246
246
|
"relationshipType": "DESCRIBES",
|
|
247
247
|
"spdxElementId": "SPDXRef-DOCUMENT"
|
|
248
248
|
},
|
|
@@ -279,42 +279,42 @@
|
|
|
279
279
|
{
|
|
280
280
|
"relatedSpdxElement": "SPDXRef-Package-ajv-8.18.0",
|
|
281
281
|
"relationshipType": "DEPENDS_ON",
|
|
282
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
282
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.3.0"
|
|
283
283
|
},
|
|
284
284
|
{
|
|
285
285
|
"relatedSpdxElement": "SPDXRef-Package-ajv-formats-3.0.1",
|
|
286
286
|
"relationshipType": "DEPENDS_ON",
|
|
287
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
287
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.3.0"
|
|
288
288
|
},
|
|
289
289
|
{
|
|
290
290
|
"relatedSpdxElement": "SPDXRef-Package-axe-core-4.10.3",
|
|
291
291
|
"relationshipType": "DEPENDS_ON",
|
|
292
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
292
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.3.0"
|
|
293
293
|
},
|
|
294
294
|
{
|
|
295
295
|
"relatedSpdxElement": "SPDXRef-Package-fflate-0.8.2",
|
|
296
296
|
"relationshipType": "DEPENDS_ON",
|
|
297
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
297
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.3.0"
|
|
298
298
|
},
|
|
299
299
|
{
|
|
300
300
|
"relatedSpdxElement": "SPDXRef-Package-pixelmatch-7.1.0",
|
|
301
301
|
"relationshipType": "DEPENDS_ON",
|
|
302
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
302
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.3.0"
|
|
303
303
|
},
|
|
304
304
|
{
|
|
305
305
|
"relatedSpdxElement": "SPDXRef-Package-playwright-core-1.61.1",
|
|
306
306
|
"relationshipType": "DEPENDS_ON",
|
|
307
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
307
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.3.0"
|
|
308
308
|
},
|
|
309
309
|
{
|
|
310
310
|
"relatedSpdxElement": "SPDXRef-Package-pngjs-7.0.0",
|
|
311
311
|
"relationshipType": "DEPENDS_ON",
|
|
312
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
312
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.3.0"
|
|
313
313
|
},
|
|
314
314
|
{
|
|
315
315
|
"relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
|
|
316
316
|
"relationshipType": "DEPENDS_ON",
|
|
317
|
-
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.
|
|
317
|
+
"spdxElementId": "SPDXRef-Package-utsuri-workspace-0.3.0"
|
|
318
318
|
}
|
|
319
319
|
],
|
|
320
320
|
"spdxVersion": "SPDX-2.3"
|
|
@@ -4,11 +4,11 @@
|
|
|
4
4
|
"lockfileSha256": "de680198df088328333bfc628c92f876890fdd9ec6bc12d4f583607c843f1660",
|
|
5
5
|
"packages": [
|
|
6
6
|
{
|
|
7
|
-
"checksum": "SHA256:
|
|
7
|
+
"checksum": "SHA256:7830188d0171dc696c366d53e35f06e01e82c53cec0862171503522013b85c7e",
|
|
8
8
|
"license": "AGPL-3.0-or-later",
|
|
9
9
|
"name": "utsuri-workspace",
|
|
10
10
|
"packageVerificationCode": null,
|
|
11
|
-
"version": "0.
|
|
11
|
+
"version": "0.3.0"
|
|
12
12
|
},
|
|
13
13
|
{
|
|
14
14
|
"checksum": "SHA512:3e55cf78458c5cc67bb0f60e1ea983c8227371f36b52bddf18d2ad7b35f5e3291738422fc8af3577eab2771f3d298e4eef514a30f690daf05f04523934747adc",
|