@visulima/vis 1.0.0-alpha.9 → 1.0.0

package/CHANGELOG.md

@@ -1,37 +1,1878 @@
-## @visulima/vis [1.0.0-alpha.9](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.8...@visulima/vis@1.0.0-alpha.9) (2026-04-28)
+## @visulima/vis 1.0.0 (2026-07-03)
+
+### ⚠ BREAKING CHANGES
+
+* **vis:** the following security.* keys were renamed:
+- security.minimumReleaseAge          -> security.policies.first_seen.minutes
+- security.minimumReleaseAgeExclude   -> security.policies.first_seen.exclude
+- security.trustPolicy                -> security.policies.publisher_change.mode
+- security.trustPolicyExclude         -> security.policies.publisher_change.exclude
+- security.trustPolicyIgnoreAfter     -> security.policies.publisher_change.ignoreAfter
+- security.allowBuilds                -> security.policies.install_scripts.allow
+- security.strictDepBuilds            -> security.policies.install_scripts.strict
+- security.socket.minimumScore        -> security.policies.score.minimum
+- security.socket.acceptedRisks       -> security.acceptedRisks
+- security.audit.failOn               -> security.policies.vulnerability.failOn
+- security.audit.usage                -> security.policies.vulnerability.usage
+
+AcceptedRisk now carries optional policies[] and expiresAt fields so
+risks can be scoped per-policy and time-boxed. Native PM sync writers
+keep emitting pnpm-native field names since pnpm owns that schema.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): address coderabbit review feedback
+
+- Add JSDoc to exported items across hook builtins, advisories, audit, docker
+- Document OSV `last_affected` inclusive-upper semantics with a focused test
+- Annotate NAPI u64→u32 truncations with JS Number range rationale
+- Switch vis-mcp tool payloads to zod schemas with `.catchall(z.unknown())`
+  so unknown CLI fields stay forward-compatible
+- Fence RFC code blocks with explicit languages and tidy hook-command
+  formatting (multi-line type, implicit-return arrows)
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): address second-round coderabbit feedback on policies rename
+
+- Drift report labels now reference `security.policies.*` paths so the
+  hint matches the keys users edit
+- `defineConfig` JSDoc examples use the new `security.policies` shape
+- `mergeSecurityDefaults` deep-merges every defaulted sub-policy
+  generically; `mergeVisConfigs` deep-merges `policies` and
+  `acceptedRisks` so presets aren't clobbered
+- Config-writer scopes its `allow:` match to follow an
+  `install_scripts:` opener
+- JSDoc clarifications for `audit.advisories.source` default,
+  `acceptedRisks.expiresAt`/`acceptedScore` ranges, `malware.mode`
+  cross-field default, and the current `policies.score.minimum`
+  wiring gap
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): finish coderabbit round-2 fixes — camelCase policies + wire score.minimum
+
+- Rename `PolicyName` union to camelCase (`firstSeen`, `installScripts`,
+  `publisherChange`, `unexpectedDeps`). Updates every consumer in src/,
+  test fixtures, schemas, and docs. JSON schema regenerated.
+- Add `types` mapping to the `#native` package.json import so TypeScript
+  resolves `index.d.ts` when consumers import the alias.
+- Thread `socketOptions.minimumScore` through `audit`, `doctor`, `check`,
+  `update`, `add`, `formatSecurityOverview`, `formatSummary`, and
+  `applyFilter`. `buildSocketOptions` now resolves the effective minimum
+  once (from `security.policies.score.minimum` or
+  `DEFAULT_LOW_SCORE_THRESHOLD`) so every consumer sees the same value
+  instead of comparing scores against the hard-coded constant.
+- Update the JSDoc on `policies.score.minimum` to reflect the new wiring.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* feat(vis): add Socket-style policy engine with 4 offline-clean policies
+
+Introduce a unified `evaluatePolicies()` engine under `src/security/policies/`
+with four offline-clean modules: license, install_scripts, vulnerability,
+and unexpected_deps (baseline mode). Each policy emits PolicyDecisions
+(block/warn/info) keyed by package, with per-policy accepted-risk scoping
+and expiresAt support reused from the shared matcher.
+
+Wires the engine into `vis audit`: a new `--policies <names>` flag
+(comma-list, `all`, or `none`) narrows evaluation. Block-severity
+decisions feed into `--exit-code` and `--fail-on`. JSON output gains
+`policies[]` + `summary.policyBlocks`. SARIF and HTML formatters render
+policy decisions alongside vulnerabilities; CSAF and CycloneDX-VEX are
+intentionally left untouched (vuln-specific data models).
+
+Adds `readNodeModulesManifests()` to walk `node_modules/` (including the
+pnpm `.pnpm/` content-addressed store) and surface license + scripts +
+maintainers metadata for the offline policies.
+
+33 new unit + integration tests; full vitest suite (3582/3582) green;
+`tsc --noEmit` clean.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* fix(vis): close three audit policy gating gaps surfaced by CodeRabbit
+
+- applyExitGate's fallthrough call to applyFailOnGate was dropping the
+  policyDecisions argument, so `vis audit --format sarif --fail-on high`
+  exited 0 when the only signal was a block-severity policy decision.
+  Forward the argument.
+- Unknown --policies tokens were silently swallowed when format was
+  json/sarif/csaf/cyclonedx-vex, so a typoed CI invocation reduced
+  enforcement with no log. Always emit the warning to stderr and
+  surface the tokens in JSON output as `warnings[]`.
+- Vulnerability-policy block decisions whose advisory was masked by
+  --severity used to exit 1 with no visible reason. Surface those
+  decisions in the human-readable "Policy Decisions" section so the
+  gate is always traceable.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* fix(vis): correct npm/yarn min-release-age native config writers
+
+npm CLI types `min-release-age` as `Number` in days, not a duration string —
+vis wrote `48h`/`15m`, which npm's parseInt would silently read as 48/15 days.
+Write integer days rounded up so the native gate is never weaker than vis-config.
+
+Yarn Berry silently treats day suffixes in `npmMinimalAgeGate` as minutes
+* **vis:** replace prek runner with in-process hook dispatcher
+* **vis:** vis sbom now emits CycloneDX 1.7. Downstream consumers
+pinned to a 1.6 validator must upgrade.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 
 ### Features
 
+* Add @visulima/task-runner , vis and find-ai-runner ([#594](https://github.com/visulima/visulima/issues/594)) ([034b5db](https://github.com/visulima/visulima/commit/034b5db8aadcc02e23abe007208c5196859c7755))
+* add comprehensive `vis create` scaffolding command ([#602](https://github.com/visulima/visulima/issues/602)) ([e029146](https://github.com/visulima/visulima/commit/e0291469fc8c55e76721333a20753c802820d3de))
+* Add comprehensive workspace configuration and command infrastructure ([#609](https://github.com/visulima/visulima/issues/609)) ([f4347bf](https://github.com/visulima/visulima/commit/f4347bfdcdd1b228cd9d842a927e446aaf23f035))
+* Add CycloneDX 1.6 SBOM generation with `vis sbom` command ([#611](https://github.com/visulima/visulima/issues/611)) ([1e95276](https://github.com/visulima/visulima/commit/1e9527630958722a0f0f7e79d18bb23b5a57e0df))
+* Add CycloneDX SBOM schema validation and TypeScript types ([#610](https://github.com/visulima/visulima/issues/610)) ([bd37e64](https://github.com/visulima/visulima/commit/bd37e6454f43116af94b5b6ae59d70d2cbe51d45))
+* Add native Rust bindings for package manager operations ([#596](https://github.com/visulima/visulima/issues/596)) ([2ec22d0](https://github.com/visulima/visulima/commit/2ec22d023eade3fed67fb811696fbd8f7b52569d))
+* add service and tool projectType variants ([61858ad](https://github.com/visulima/visulima/commit/61858ad4c044b5f30318f282615c83f716667053)), closes [#21](https://github.com/visulima/visulima/issues/21)
+* Add Socket.dev security intelligence integration ([#599](https://github.com/visulima/visulima/issues/599)) ([c2e2b8a](https://github.com/visulima/visulima/commit/c2e2b8a55d1688c43b1deed82b8d954bc294fa11))
+* Add sort-package-json command with native Rust implementation ([#601](https://github.com/visulima/visulima/issues/601)) ([8c5d2c3](https://github.com/visulima/visulima/commit/8c5d2c311d30077384df1b9194a870ac6687a0a4))
 * Add toolchain management with version manager detection and delegation ([#617](https://github.com/visulima/visulima/issues/617)) ([548b0e8](https://github.com/visulima/visulima/commit/548b0e8f9d59743be25abb97b5de3fdbeb681bd6))
+* Add typosquat detection for package names ([#603](https://github.com/visulima/visulima/issues/603)) ([16ef5e8](https://github.com/visulima/visulima/commit/16ef5e8acc3670cf1bf883f7a5d9483f331b6133))
+* **cerebro:** add addGlobalOption API for CLI-wide options ([ccc1cc0](https://github.com/visulima/visulima/commit/ccc1cc085ed0189be49ab8da7d9dbbc69ba07c72))
+* Migrate pnpm config from .npmrc to pnpm-workspace.yaml for v11 ([#608](https://github.com/visulima/visulima/issues/608)) ([af9321c](https://github.com/visulima/visulima/commit/af9321ccd2bacefbbda95248aea155c76c5d53ad))
+* **secret-scanner:** regroup ScanOptions, add weak-passwords preset, polish SARIF ([1ddbfac](https://github.com/visulima/visulima/commit/1ddbfac6781408d750856003b5b5f53408afa5b3))
+* **secret-scanner:** rust-native secret scanner with vis integration ([926a583](https://github.com/visulima/visulima/commit/926a5830efca68d9956f053496b0a5efb359eccd))
+* **task-runner, vis:** project constraints, CI partitioning, affected scopes ([29295e9](https://github.com/visulima/visulima/commit/29295e989ecdfe2019469d1917a6c90a92e17bcf))
+* **task-runner,vis:** cache restoration fidelity ([a15cb22](https://github.com/visulima/visulima/commit/a15cb22bde832cfe76ee017722b8b9f9102dac8f))
+* **task-runner,vis:** per-task pty + concurrency weight, abort cache gate, fspy scaffolds ([#656](https://github.com/visulima/visulima/issues/656)) ([ca64010](https://github.com/visulima/visulima/commit/ca64010b236903e08273680ea65dec7046fcd18b))
+* **task-runner:** add REAPI gRPC backend, cacheMode, and cache doctor ([03e6da9](https://github.com/visulima/visulima/commit/03e6da97beb84f6adc4a07a1c7ca4acf28be3b33))
+* **task-runner:** add resolveTurboEnvCompat helper ([a8e73ef](https://github.com/visulima/visulima/commit/a8e73ef324dd8d1bc1f1f471f59f9292f9f01745))
+* **task-runner:** add URI-based input format ([050b583](https://github.com/visulima/visulima/commit/050b5838c15590a3ccba0ca99ad585cbabc36d99))
+* **task-runner:** auto-capture outputs for compound build scripts ([e084434](https://github.com/visulima/visulima/commit/e0844344cf184177999a82b708299f08fbfd31ec))
+* **task-runner:** output globs, auto-writes, parallel cache IO ([137f53f](https://github.com/visulima/visulima/commit/137f53f7f5a4d8c16df511c9d145b2c158025a32))
+* **task-runner:** per-target hashMode "trace" opt-in ([#643](https://github.com/visulima/visulima/issues/643)) ([32353ff](https://github.com/visulima/visulima/commit/32353ff7a760ae9486e23cc4042fab46a2f2cc11))
+* **task-runner:** warn when a cacheable task's inputs resolve to zero files ([3a4ecbb](https://github.com/visulima/visulima/commit/3a4ecbbef46b49afa4cb8b3e0b741fae0de42b3c))
+* **tui:** add TreeView component with keyboard navigation and selection ([f3421e3](https://github.com/visulima/visulima/commit/f3421e36540f8c7a229e0176c683cb94c0d46e0f))
+* **vis, staged:** add env-var concurrency + fast-fail SIGKILL ([8fc5ae3](https://github.com/visulima/visulima/commit/8fc5ae3147901560f4b06848187da61d7a98819d))
+* **vis, staged:** case-insensitive globs, auto-stage, parseConcurrent extraction ([671fa42](https://github.com/visulima/visulima/commit/671fa424f57cb1a94ef3d95be3d60b8632201675))
+* **vis:** [@inherit](https://github.com/inherit) array merge sentinel ([c1334ab](https://github.com/visulima/visulima/commit/c1334ab75a84e12aa972aa1aba57ee74edbcc17d))
+* **vis:** add --json and --describe to vis generate ([396c89b](https://github.com/visulima/visulima/commit/396c89b29ddca99b01394508fda4b3d6b1804a3a))
+* **vis:** add --last-commit shortcut for hook run ([a841c8e](https://github.com/visulima/visulima/commit/a841c8ebfaf69d196cdc3115757c65705204d850))
+* **vis:** add --peer and --include-internal flags to update and check ([900bbbe](https://github.com/visulima/visulima/commit/900bbbed6ec3611e993cf4fcc929c8b9b7cc7d60)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+* **vis:** add --reverse for leaves-first task order ([9d02f37](https://github.com/visulima/visulima/commit/9d02f373ff08ed94c95055725ce43ed42ea8c9aa))
+* **vis:** add --skip-cache for selective per-task cache bypass ([28cfa7a](https://github.com/visulima/visulima/commit/28cfa7afc03ace27a4ff41746e91c70006cb9e9e))
+* **vis:** add `vis add --to <pkg>` auto-conforming to catalogs (syncpack[#285](https://github.com/visulima/visulima/issues/285)) ([03a5641](https://github.com/visulima/visulima/commit/03a56411fe88165395ec081f1d9caee2474fbf2a))
+* **vis:** add `vis migrate kingfisher` for MongoDB Kingfisher users ([d7d8a5e](https://github.com/visulima/visulima/commit/d7d8a5e43c3d1d588180fcbe37e6789f68fa8d74))
+* **vis:** add 33 inferTargets detectors ([b4b4684](https://github.com/visulima/visulima/commit/b4b468436ed2c48484ecbf69539b0121870fd124))
+* **vis:** add ai heal + heal accept commands ([3c6fa32](https://github.com/visulima/visulima/commit/3c6fa323c8133d95a17fe9bc19ffd3d8aeb37c4e))
 * **vis:** add aube as default installer with PM fallback ([79a9933](https://github.com/visulima/visulima/commit/79a99333c0e73e69f375b36c56e40b2693dc4c90))
+* **vis:** add Buildkite CI provider and `vis generate buildkite-ci` builtin ([845ac99](https://github.com/visulima/visulima/commit/845ac99a37dc9f280d5bba11aad4cf196cdaaebc)), closes [#19](https://github.com/visulima/visulima/issues/19)
+* **vis:** add built-in staged-files workflow ([34c005a](https://github.com/visulima/visulima/commit/34c005a2fef371bda48139a5aba8c8858a1c8a42)), closes [#990](https://github.com/visulima/visulima/issues/990) [#1713](https://github.com/visulima/visulima/issues/1713) [#1722](https://github.com/visulima/visulima/issues/1722) [#33](https://github.com/visulima/visulima/issues/33)
+* **vis:** add cache command for task runner cache ([#607](https://github.com/visulima/visulima/issues/607)) ([6752769](https://github.com/visulima/visulima/commit/67527692562b3dd9c03bb6a67c084ff1e694a560))
+* **vis:** add Claude skill for vis-mcp consumption ([434ceb2](https://github.com/visulima/visulima/commit/434ceb2e8d6c49f31a3b7f84d45c35de247a4806))
+* **vis:** add composite s1ngularity supply-chain marshall ([44cdeaf](https://github.com/visulima/visulima/commit/44cdeafb58eefcef061ffaab6822d4628cb06b2c))
+* **vis:** add corepack passthrough + unified dry/silent/env ([0ba38b2](https://github.com/visulima/visulima/commit/0ba38b297385497deb167efd03349f38ef1a7049)), closes [#6](https://github.com/visulima/visulima/issues/6) [#10](https://github.com/visulima/visulima/issues/10) [#11](https://github.com/visulima/visulima/issues/11)
+* **vis:** add custom-types lint for engines/packageManager/volta drift ([149455a](https://github.com/visulima/visulima/commit/149455a114b76c86ea12b7f271450297f38eeff6))
+* **vis:** add dashboard command with browser UI for cache and run metrics ([f94fcd9](https://github.com/visulima/visulima/commit/f94fcd94ef04f74e20ce308769d79cbd21d9fd60))
+* **vis:** add deno as first-class package manager + --auto-install-peers ([90d6d0f](https://github.com/visulima/visulima/commit/90d6d0fd98d531e1f76de42848da27605509f7d3))
+* **vis:** add deprecation + package-age marshalls ([5547840](https://github.com/visulima/visulima/commit/5547840b5aef9689f4080c77c44d3884309b0601))
+* **vis:** add deps.dev as supply-chain security provider alongside Socket ([7f752d2](https://github.com/visulima/visulima/commit/7f752d250fa3c96d2ec01ca58bddf911586ea949))
+* **vis:** add discover-help subcommand, drop --format from ai root ([36d3990](https://github.com/visulima/visulima/commit/36d3990f7ee6368687af8151454a86181f188511))
+* **vis:** add git-history secret scanning via --history ([bf8b26c](https://github.com/visulima/visulima/commit/bf8b26c5990a7cc4f3630504f18c7cbc7c2e9372))
+* **vis:** add GitLab and JUnit audit report formats ([18e8bc2](https://github.com/visulima/visulima/commit/18e8bc204cc5ce2bac8e83a043ede9cf51d57a70))
+* **vis:** add HTML graph report ([92865a2](https://github.com/visulima/visulima/commit/92865a2973a36f8c43adaf023ecd68e3859d0c68))
+* **vis:** add ignore option to update config and check non-catalog package.json deps ([27e22dd](https://github.com/visulima/visulima/commit/27e22dd7efa30b7d77b8360b9eac9c7245de92a7))
 * **vis:** add ignore/sortOrder/unsorted/finalNewline/lineEnding to sort-package-json ([50f68df](https://github.com/visulima/visulima/commit/50f68dfc2bc31c082ef98b3ddcf73d3dee0cc080))
+* **vis:** add includeLocked, packageMode, depFields, maturity period to update command ([4cf85e1](https://github.com/visulima/visulima/commit/4cf85e163e392d9dd48c3119c13d3e7a7c9a782e))
+* **vis:** add info command for registry metadata lookup ([6e9c43d](https://github.com/visulima/visulima/commit/6e9c43d480445ff5b932193c44bbd9556cca3180))
+* **vis:** add interactive devcontainer command for creating/editing .devcontainer/devcontainer.json ([9e1665f](https://github.com/visulima/visulima/commit/9e1665fb5a8cee7979a15d6b0a4ba7fa10cfe27c))
+* **vis:** add interactive progress bar and replace CI detection with is-in-ci ([255a1b1](https://github.com/visulima/visulima/commit/255a1b100d0dd4bc614094f292b61fc88bc4ad62))
+* **vis:** add interactive TUI for update and check commands ([3e96e7e](https://github.com/visulima/visulima/commit/3e96e7e68c444368ed91bc0654bbbfb9b857e7c5))
+* **vis:** add LavaMoat allow-scripts parity (run/tripwire/--write/allowBins) ([84218d3](https://github.com/visulima/visulima/commit/84218d392abcde8d76b9b92de7d220be2b08e854))
+* **vis:** add lockfile supply-chain verification ([a8c741d](https://github.com/visulima/visulima/commit/a8c741d80b52b275cde11be188ab22c41a11f5f4))
+* **vis:** add manual typosquat list and scoped brand-jacks ([1eaef11](https://github.com/visulima/visulima/commit/1eaef1154bb3ca18f09cebee290a9857c5171339))
+* **vis:** add migrate verify-graph equivalence verification ([697e2c0](https://github.com/visulima/visulima/commit/697e2c0888c596e4bcee0a12922db76937a29175))
+* **vis:** add navigation and scrollbar to run command task list ([83abf11](https://github.com/visulima/visulima/commit/83abf11670ea924e9df0a966bd9ce1049dcdcb5e))
+* **vis:** add quiet-on-success run mode and harden spawn/history/hadolint ([9b6e3bf](https://github.com/visulima/visulima/commit/9b6e3bf7c764c0962d633bebdd6f16d2e3ae73ed))
+* **vis:** add replay + strict env, finish service registry ([c6db6d5](https://github.com/visulima/visulima/commit/c6db6d54688c43960b5aef9650b3bbc0292c0a58)), closes [#10](https://github.com/visulima/visulima/issues/10) [#16](https://github.com/visulima/visulima/issues/16) [#20](https://github.com/visulima/visulima/issues/20)
+* **vis:** add run --hash-mode override flag ([b9c5efa](https://github.com/visulima/visulima/commit/b9c5efa05b9e9f142e8d52fa9d88ddac10d2d4f0))
+* **vis:** add runtime detection abstraction (phase 0) ([8dca5b2](https://github.com/visulima/visulima/commit/8dca5b235e3f7427937f60e8ec13ab90e4c698af)), closes [#native](https://github.com/visulima/visulima/issues/native)
+* **vis:** add Snyk security provider ([aba3571](https://github.com/visulima/visulima/commit/aba35710719d1325b311bf80d81a91c91e75aa1f))
+* **vis:** add split and import workspace commands ([#680](https://github.com/visulima/visulima/issues/680)) ([4077e1c](https://github.com/visulima/visulima/commit/4077e1c2d018c9e92f820f339967c1c583afd9b5))
+* **vis:** add sponsor notice after successful commands ([86ebd1c](https://github.com/visulima/visulima/commit/86ebd1c3270c3241c76577eae8bb889690b71e53))
+* **vis:** add syncpack migrate adapter and audit ([6e07ae8](https://github.com/visulima/visulima/commit/6e07ae86401f374d76206c81d1c6131bc08618e2))
+* **vis:** add task-level runner tags for capability-gated CI lanes ([8980e03](https://github.com/visulima/visulima/commit/8980e0319e99b4f79c5e049509d7dc2039f2092d))
+* **vis:** add terminal links, use cerebro performance helpers ([abc7f89](https://github.com/visulima/visulima/commit/abc7f8937ce43c8446e422f48e5e307b7d0843b0))
+* **vis:** add toolbox-fs helper utilities ([f34f2aa](https://github.com/visulima/visulima/commit/f34f2aa7a38fec0e13b3b991a3221905d736c1da))
+* **vis:** add TUI lifecycles with dynamic and static terminal output ([d7eeae1](https://github.com/visulima/visulima/commit/d7eeae1e51c4ffa707f7506ef0ed2f7860f37faf))
+* **vis:** add vis generate scaffolding command ([5e0bea1](https://github.com/visulima/visulima/commit/5e0bea179dd93bac8a5663e9d51a843c8f626c1b))
+* **vis:** add vis x file runner (phase 2) ([213fadf](https://github.com/visulima/visulima/commit/213fadf99f2de8126749c317ae3f002f174f39cc))
+* **vis:** add vis-mcp post-command promotion nudge ([9244fad](https://github.com/visulima/visulima/commit/9244fad8a8f9164ce99b2ab3cb771d53f926e788))
+* **vis:** add visx/vx npx-style entry point ([3802695](https://github.com/visulima/visulima/commit/3802695f3a0cf2776aaf706183ed2032324532bd))
+* **vis:** add write guard, watchman backend, vcs hints ([5127d79](https://github.com/visulima/visulima/commit/5127d79ad2aa523760517601f71fdf38571ca4d3))
+* **vis:** added --ignore-release-age ([1767805](https://github.com/visulima/visulima/commit/1767805cb2a46c135a33429edf764f6760737ffc))
+* **vis:** attested keyless-signed remote cache (Sigstore) ([4732610](https://github.com/visulima/visulima/commit/47326103a668ab99fcfc4e21f2c9efeaa5892944))
+* **vis:** audit hardening — ca-cert flag, dep-path walker, report parity ([eb187ab](https://github.com/visulima/visulima/commit/eb187ab4e9ee04357d142c438f428b556a68ff79))
+* **vis:** auto-generate JSON schemas from TypeScript types ([391a3f0](https://github.com/visulima/visulima/commit/391a3f0d253b3b55d02346bbb0dbeb061d8ec06f))
+* **vis:** auto-recover orphaned runners via doctor --fix ([7c68a6e](https://github.com/visulima/visulima/commit/7c68a6e1fd163fdcfb2f4f663f78b5b81cf4df09))
+* **vis:** auto-start declared service deps for vis run with TUI dock ([adeb316](https://github.com/visulima/visulima/commit/adeb3164d29aec6da2eeed03d46fc0502aec5d6a))
+* **vis:** auto-update GitHub Actions, Docker, and GitLab CI references ([9a3c767](https://github.com/visulima/visulima/commit/9a3c7679c1aa981eb889250ddd841b6feb213b55))
+* **vis:** breaking-change UI + interactive picker for ecosystem updates ([75b7e33](https://github.com/visulima/visulima/commit/75b7e33eb9a460036cf8f8feff5197b1fb2db010))
+* **vis:** bump sbom to cyclonedx 1.7 ([904075f](https://github.com/visulima/visulima/commit/904075fd9353e40b593d5a13f53307c584e31da7))
+* **vis:** cache diagnostics, retention, and quiet output style ([9ec307b](https://github.com/visulima/visulima/commit/9ec307b06cec5c3114a6e70abbf1f2346ce61910))
+* **vis:** changelog URLs, docker min-age gate, action advisories, TUI sort ([23d65e1](https://github.com/visulima/visulima/commit/23d65e1f020dd723b900c5d25f9eb384be0bece8))
+* **vis:** clean --empty-packages and staged per-package/cwd tasks ([cdba002](https://github.com/visulima/visulima/commit/cdba002af4714e3e74c1f832919855d0dd7f3a72)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+* **vis:** close 7 syncpack-parity gaps ([85bc6b1](https://github.com/visulima/visulima/commit/85bc6b169fbc75cc4cc1b43b5bea85e673253f06)), closes [pnpm-workspace.yaml#overrides](https://github.com/visulima/pnpm-workspace.yaml/issues/overrides) [#623](https://github.com/visulima/visulima/issues/623) [#624](https://github.com/visulima/visulima/issues/624) [#625](https://github.com/visulima/visulima/issues/625) [#626](https://github.com/visulima/visulima/issues/626) [#627](https://github.com/visulima/visulima/issues/627) [#628](https://github.com/visulima/visulima/issues/628) [#629](https://github.com/visulima/visulima/issues/629)
+* **vis:** cross-PM dispatch for vis pm (yarn berry, pnpm 11, bun pm) ([fd56b86](https://github.com/visulima/visulima/commit/fd56b86317f4141227814504845f03ce777c0b88))
+* **vis:** declarative task arguments + per-target script mode ([#662](https://github.com/visulima/visulima/issues/662)) ([417ca53](https://github.com/visulima/visulima/commit/417ca5395728a0776cbfcd0122ae21e3159a4c48))
+* **vis:** default inferTargets on with guarded script enrichment ([29cabd1](https://github.com/visulima/visulima/commit/29cabd1763ce915cbfa6aaa85b1c29a020d72b01))
+* **vis:** docker lint/init + ignore-file commands ([#675](https://github.com/visulima/visulima/issues/675)) ([f22c9f3](https://github.com/visulima/visulima/commit/f22c9f34304a41e257f9f0371d1aaa312f90df25))
+* **vis:** docker lint/init, ci-ignore, hadolint + toolbox DI ([#677](https://github.com/visulima/visulima/issues/677)) ([e5b5bd1](https://github.com/visulima/visulima/commit/e5b5bd164ed648341d4e1d655098b72bd040e4ed))
+* **vis:** doctor checks for watch/signal runtime ([d7d53a7](https://github.com/visulima/visulima/commit/d7d53a7f520b64e72aa193e0beacf2722a82a6f4))
+* **vis:** expand devcontainer command with templates, validation, and config properties ([807e730](https://github.com/visulima/visulima/commit/807e730a43f0ea644d016b4f5506706972d2ff41))
+* **vis:** expand nx migrator and add --force overwrite ([d6e5a91](https://github.com/visulima/visulima/commit/d6e5a91c4bc44a34dd770dd0b8298b5017bdd6df))
+* **vis:** expand secrets.config.presets to tag selectors ([77b8d2b](https://github.com/visulima/visulima/commit/77b8d2bbc951d5180753f37a45d2313c01fcf47f))
+* **vis:** expand typed plugin hook surface ([d0784df](https://github.com/visulima/visulima/commit/d0784df2b0c422002ec21c3c8da0002e0ff70dee))
+* **vis:** finish vis-side when:/always:/tokens migration ([3c3c759](https://github.com/visulima/visulima/commit/3c3c75946d716efa5971f6cf1fa9ae8d139d9652))
+* **vis:** first-run info gate for visx/dlx ([53dd31e](https://github.com/visulima/visulima/commit/53dd31e39659d1281d8e94e174475e209bcb8b11))
+* **vis:** group CLI commands into logical categories for help output ([0a4cac8](https://github.com/visulima/visulima/commit/0a4cac859c8edf7aacdacca7b9a03219967d525a))
+* **vis:** harden bootstrap installers + add lint CI ([49ec0a2](https://github.com/visulima/visulima/commit/49ec0a25e76ab5865cd2a2dce49413311fcf389c))
+* **vis:** honor editorconfig in all JSON writers ([859e925](https://github.com/visulima/visulima/commit/859e92533d0349be37c1a750cb80582c14acb715))
+* **vis:** honor project.json[#name](https://github.com/visulima/visulima/issues/name) as the workspace identity ([4a97c92](https://github.com/visulima/visulima/commit/4a97c9203df1398265196161213f1aa5736ea4c0)), closes [package.json#dependencies](https://github.com/visulima/package.json/issues/dependencies)
+* **vis:** honour TURBO_API/TURBO_TOKEN/TURBO_TEAM env vars ([0d4fc8c](https://github.com/visulima/visulima/commit/0d4fc8c1ad617ba27c436e40e520ddcbb19ebeca))
+* **vis:** implement vis sync package-json-fields ([87e1fa1](https://github.com/visulima/visulima/commit/87e1fa11f2be741a768fe0c6c04238427823623a))
+* **vis:** inferred targets, preflight, services ([9697571](https://github.com/visulima/visulima/commit/96975719f12ccaf051452ecc60f07f1df0b5bc69)), closes [#11](https://github.com/visulima/visulima/issues/11) [#21](https://github.com/visulima/visulima/issues/21)
+* **vis:** integrate aube package manager + offline OSV bloom prefilter ([9513e09](https://github.com/visulima/visulima/commit/9513e0930c6fbcdb00e42df2ab9c650194a35eb4))
 * **vis:** interactive TUI for bare `vis migrate` ([2171441](https://github.com/visulima/visulima/commit/217144190520447ba9fbe66a9a8f0c452469151e))
+* **vis:** interactive TUI graph viewer, enriched sample workspace ([b821f34](https://github.com/visulima/visulima/commit/b821f34b5b125aef107c7bca1b2aab7d84826651))
+* **vis:** lint + fmt orchestrator ([3a78ed7](https://github.com/visulima/visulima/commit/3a78ed709922e6a35648e0d0eb3f41cc49f89b7a))
+* **vis:** list --targets table with type, cache, description ([a480e27](https://github.com/visulima/visulima/commit/a480e27a8d9a938a5225b9ebfda918de6c569f21)), closes [#22](https://github.com/visulima/visulima/issues/22) [#23](https://github.com/visulima/visulima/issues/23)
+* **vis:** migrate command handlers to toolbox.fs and toolbox.process ([c582c74](https://github.com/visulima/visulima/commit/c582c740150a7eab6b34e4eabe68f521471186c1))
+* **vis:** migrate prek hooks to vis ([92fec22](https://github.com/visulima/visulima/commit/92fec22f61d1882eecd78ff139e4632f55ee3e00))
+* **vis:** multi-source codeowners aggregation ([d22df81](https://github.com/visulima/visulima/commit/d22df81214899209be3fd9fa4d83372be97552ef))
+* **vis:** native Rust CLI front-end + nub-parity for x/run ([#697](https://github.com/visulima/visulima/issues/697)) ([88d505b](https://github.com/visulima/visulima/commit/88d505bef74f08a895849e41f26682e684aa67be))
+* **vis:** nx migrator hardening + smart --affected SHA resolution ([631351e](https://github.com/visulima/visulima/commit/631351ef32b9367a37c6ca0931673f0e08c103a9)), closes [VisConfig#defaultBase](https://github.com/visulima/VisConfig/issues/defaultBase)
+* **vis:** offline OSV scanner + unified security.policies ([#632](https://github.com/visulima/visulima/issues/632)) ([6461902](https://github.com/visulima/visulima/commit/646190243bf51bb6df172665d70fd501644e7bc3)), closes [#631](https://github.com/visulima/visulima/issues/631) [#631](https://github.com/visulima/visulima/issues/631) [yarnpkg/berry#6991](https://github.com/yarnpkg/berry/issues/6991)
+* **vis:** OTel plugin, --last-details, per-instance hook errors ([79c660f](https://github.com/visulima/visulima/commit/79c660f92e6982248dacd5e2bba0f113df338baf))
+* **vis:** parse prek.toml via @visulima/fs/toml ([4599680](https://github.com/visulima/visulima/commit/459968089e8968f58edea35c5e2d801cdfbd2913))
+* **vis:** per-package vis.task.ts overlay ([14f6adf](https://github.com/visulima/visulima/commit/14f6adfc37b7ff552629309bd555d1fd3dd317f9)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+* **vis:** plugin API, task metadata, watch ergonomics, and run polish ([065c0dc](https://github.com/visulima/visulima/commit/065c0dc646f7e2769dcab9c01e0db52b401fcf99)), closes [#324](https://github.com/visulima/visulima/issues/324)
+* **vis:** port sherif lint rules and add migrate sherif command ([243324b](https://github.com/visulima/visulima/commit/243324b440a31831b6c6d93219d8cb3a3ab48495))
+* **vis:** prune workspace lockfile in docker scaffold ([d1c0904](https://github.com/visulima/visulima/commit/d1c090425d130b3e18b6e64e44fe81eb1e08b923))
+* **vis:** rebuild dashboard with Hono SSE + Vite + shadcn/ui ([f9df814](https://github.com/visulima/visulima/commit/f9df814683c6a1c967d8cbe15bee1b13959b5ab7))
+* **vis:** redesign audit HTML report + add --explain AI helper ([6b0ab9f](https://github.com/visulima/visulima/commit/6b0ab9ffe36c732a4ac0c05a4ad9453d51fbe89b))
+* **vis:** redesign dashboard with Nothing-inspired UI ([7cfc81d](https://github.com/visulima/visulima/commit/7cfc81d8592cdfda0086700363dbeac39650d1d7))
+* **vis:** redesign TUI with 3-view architecture and NX-style layout ([72da46f](https://github.com/visulima/visulima/commit/72da46fd9dac1227c0abc80709196e7c9b89c017))
+* **vis:** release features + npm pretrust ([#719](https://github.com/visulima/visulima/issues/719)) ([c19a814](https://github.com/visulima/visulima/commit/c19a8142ccf0bc86ce232c9aaa7f79f3bf7c21f2))
+* **vis:** release manager subsystem ([#679](https://github.com/visulima/visulima/issues/679)) ([0a41889](https://github.com/visulima/visulima/commit/0a418897062a164ad7e8034eab77a7f70a3817e1)), closes [#620](https://github.com/visulima/visulima/issues/620)
+* **vis:** replace inline TUI with full-screen Nx-style interactive task runner ([1409aad](https://github.com/visulima/visulima/commit/1409aad879c713051bba12298a3feb1d5ba852f2))
+* **vis:** replace prek runner with in-process hook dispatcher ([659ba07](https://github.com/visulima/visulima/commit/659ba07fc311c36783e8900188b9753276a961fe))
+* **vis:** rewrite doctor with TUI store and live scan progress ([84f4923](https://github.com/visulima/visulima/commit/84f492376ef9129781464b26a50b1954b7e3b206))
+* **vis:** route dlx/exec through the runtime resolver (phase 1) ([5186df4](https://github.com/visulima/visulima/commit/5186df43a850bc8b0642608643095faa8b1ebc6f))
+* **vis:** route install/add/remove/dedupe through runtime resolver (phase 1) ([8aaa3e1](https://github.com/visulima/visulima/commit/8aaa3e1d8f9ac73debfd6fc81808b570a25a1337))
+* **vis:** route remaining pm verbs through runtime resolver (phase 1) ([e18a44f](https://github.com/visulima/visulima/commit/e18a44f975ce6b744c5e6a9237e056de8a5f230e))
+* **vis:** runtime multi-tool ([#683](https://github.com/visulima/visulima/issues/683)) ([ee84daa](https://github.com/visulima/visulima/commit/ee84daa56434bfb487abccd27e9e2661c0492132))
+* **vis:** scan npm-shrinkwrap.json with precedence ([ae907f1](https://github.com/visulima/visulima/commit/ae907f18e560eed7c80c7738650330909a254148))
+* **vis:** scope banned-deps rules with packages/paths globs ([82fbaf2](https://github.com/visulima/visulima/commit/82fbaf2ffac946f032fc872ee2a428989ebf8c57))
+* **vis:** secure-by-default install/add and lint cleanup ([28df4c4](https://github.com/visulima/visulima/commit/28df4c40504b7414460c57ef563593cfe14c5eeb))
+* **vis:** security check on by default for update, add --no-security ([e8db4c8](https://github.com/visulima/visulima/commit/e8db4c88a4c64038ca00c46b2a63083fee224637))
+* **vis:** set terminal title to project name on startup ([204622a](https://github.com/visulima/visulima/commit/204622acd943ccad738b33f5e945190e38f5839f))
+* **vis:** show flakiness table on successful runs too ([085b219](https://github.com/visulima/visulima/commit/085b219a4472ceb0fd2f507c7bc3b3b1780a014a))
+* **vis:** skip ignored paths in sort-package-json ([74215c0](https://github.com/visulima/visulima/commit/74215c06fd0e0f562b97e803a95b9e662e9980e2)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+* **vis:** source-mapped, code-framed task failure rendering ([95b2343](https://github.com/visulima/visulima/commit/95b2343d7299ab8537c5a4ef0205ddeee9146c58))
+* **vis:** split ai into nested subcommands, add discovery, unify cache type filter ([51d2b5e](https://github.com/visulima/visulima/commit/51d2b5ee9fdfcee0cbd4d5e5b9f2f1d08f9ef2ea))
+* **vis:** support extends in vis.config.ts ([70d7b36](https://github.com/visulima/visulima/commit/70d7b36b362b0a7340e4717bdae12db355bf05e9))
+* **vis:** surface leftover migration references in vis doctor ([ebd3a48](https://github.com/visulima/visulima/commit/ebd3a4841a736209cdbf2641ac6e27ec2e69f886))
+* **vis:** surface peer-dependency hint after install ([4a140b0](https://github.com/visulima/visulima/commit/4a140b0d8e80f3dda82d0af645272e1149867d02))
+* **vis:** surface retried-but-passed tasks and add CI log grouping ([2bdceaa](https://github.com/visulima/visulima/commit/2bdceaacf3f69c99a08c9e1b3b6eda0ee3528cd2))
+* **vis:** task-runner feedback fixes + CI hook skip ([#696](https://github.com/visulima/visulima/issues/696)) ([450412c](https://github.com/visulima/visulima/commit/450412cb92eee1397edaa46447128b1487d06369))
+* **vis:** translate remote prek hooks, file filters, and deps ([2705c8f](https://github.com/visulima/visulima/commit/2705c8f99e287bb93d0865361f376bafa8043736))
+* **vis:** translate syncpack isBanned versionGroups to policy.bannedDeps ([f95d01b](https://github.com/visulima/visulima/commit/f95d01bda6a5add3f7fa0d48c1c955942b5c7fc3))
+* **vis:** typed errors for vis config loader ([0dce143](https://github.com/visulima/visulima/commit/0dce143247ba695eb7fa46f3b59c709c473bdc57))
+* **vis:** update secrets command for new scanner API + docs ([00bb0f0](https://github.com/visulima/visulima/commit/00bb0f057237e0ce88043f2c120d23b84f59d818))
+* **vis:** use concurrent process runner with bounded output buffering ([901c02f](https://github.com/visulima/visulima/commit/901c02fc5a5e131c1d3316c869b321390de901a4))
+* **vis:** user-defined customTypes for vis lint ([51fa21f](https://github.com/visulima/visulima/commit/51fa21f4193913f64e4abcd1dc9f97322dd21553))
+* **vis:** validate runtime selection in run (phase 1) ([efaa952](https://github.com/visulima/visulima/commit/efaa95251519ad4ed3db77ed42421fd85756dbb2))
+* **vis:** vis hook run/list/validate, migrate --dry-run, runner extras ([bce23d9](https://github.com/visulima/visulima/commit/bce23d912790f9fc2eafa7ce4596e66d0a70e97e))
+* **vis:** watch keybinds and timeout escalation ([3181bb5](https://github.com/visulima/visulima/commit/3181bb50986b4d7e924a2d5b053a9883228ab08f))
+* **vis:** wire marshall env-var matrix into install/audit/check + add keys-refresh ([e1e2d6c](https://github.com/visulima/visulima/commit/e1e2d6c2dc81cfdf442b6f75b6497150b368565f))
+* **vis:** worktree-aware shared task cache with --scope flag ([4328542](https://github.com/visulima/visulima/commit/4328542a9abfa16a40fa62cfe9e8d688eb0d9d81))
+* **web:** auto-generate packages page from workspace metadata ([623e520](https://github.com/visulima/visulima/commit/623e5207693a7fe720f5f2f179593a3654c880e3))
 
 ### Bug Fixes
 
+* add tabular to dep ([92d578e](https://github.com/visulima/visulima/commit/92d578e7e2ce558f5e8947bd1d9c2b1da879e351))
+* added [@bomb](https://github.com/bomb).sh/tab ([8be4063](https://github.com/visulima/visulima/commit/8be40636caff4e7eb4776869bb71e11cc6c76298))
+* added missing deps ([de0522f](https://github.com/visulima/visulima/commit/de0522f18286b23489cf6a51007ef3a4e7c5fd76))
+* added tabular to the excluded packges ([20799d6](https://github.com/visulima/visulima/commit/20799d66f3cf73381b7fd3e7bd8776401eef399f))
+* **ci:** address review findings — injection, perms, defaults, fetch hardening ([0192278](https://github.com/visulima/visulima/commit/0192278b63a0178262c08a3d77fa0e832d085147))
+* **ci:** publish native addons via local semantic-release plugin ([974beb2](https://github.com/visulima/visulima/commit/974beb2d021e7b2afc86b958bd2137be88d2f464))
+* declare libc on linux binding subpackages ([078b31f](https://github.com/visulima/visulima/commit/078b31f1a9029487c86651e75ecdad70f02b37e8)), closes [npm/cli#4828](https://github.com/npm/cli/issues/4828)
 * fixed spacing ([1544af2](https://github.com/visulima/visulima/commit/1544af21294edaaf5799846e6c6063c86def3d29))
+* moved deps to dev dep ([62a47f2](https://github.com/visulima/visulima/commit/62a47f29b182b202c9956819f3b4a32da38c14cd))
+* **release:** patch NAPI version-check string and ship fresh loader on release ([0676e33](https://github.com/visulima/visulima/commit/0676e336f453c9ae38c9f3a5fbbb675f9bff7ea0))
+* resolve eslint errors in fmt, jsdoc-open-api, vis ([43bf450](https://github.com/visulima/visulima/commit/43bf45081e46b042a08b555c3fcb60391b82d06f))
+* resolve failing tests across multiple packages ([2b4b6f0](https://github.com/visulima/visulima/commit/2b4b6f04169b60fdc4cf77b293015436a272c0fb))
+* **storage-client:** percent-encode user fields in defaultFingerprint ([7c78a0f](https://github.com/visulima/visulima/commit/7c78a0f9512e2a673b941d80839e9f1e86b7b5d0))
+* **task-runner:** resolve workspace .bin binaries in spawned tasks ([69bd30c](https://github.com/visulima/visulima/commit/69bd30c95fb1e70aba1f7c5b4d3d17b8f0465c11))
+* **task-runner:** tolerate dev-only dependency cycles ([#664](https://github.com/visulima/visulima/issues/664)) ([9ad384e](https://github.com/visulima/visulima/commit/9ad384e34927b40823ae104d6b05a581dcd05705)), closes [#411](https://github.com/visulima/visulima/issues/411)
+* **tooling:** resolve eslint and formatting issues ([399d292](https://github.com/visulima/visulima/commit/399d29282be5b29bb26b4e5b24d45e2a6cdeeca3))
+* **tsconfig:** add node types and fix implicit any parameter ([1744d82](https://github.com/visulima/visulima/commit/1744d82a07fca03f2e6ff660b918e9b2623acf69))
+* **tui:** apply upstream ResizeObserver NaN guard and measurement extraction ([bcd4fd1](https://github.com/visulima/visulima/commit/bcd4fd16e7e0fda7d3de09657dfe76ce46fa370a))
+* **tui:** inline component and hook barrel exports in ink entry ([1cf8dd2](https://github.com/visulima/visulima/commit/1cf8dd25c91a2001268fb9d964d95df649bf7832))
+* **tui:** prevent interactive apps from exiting on beforeExit ([449e84c](https://github.com/visulima/visulima/commit/449e84ca739d9dd48728f40ad9514359306f9527))
+* **vis,secret-scanner:** windows absolute-path handling ([b1a3d67](https://github.com/visulima/visulima/commit/b1a3d673b3fe4f918c44b1cd33b62bf15d3687fc))
+* **vis,tui:** fix 10 code review issues across TUI components ([3410347](https://github.com/visulima/visulima/commit/34103473cb661cca4187661e59b396eecff1bdec))
+* **vis,tui:** validate directory in detectPm and use useLayoutEffect in StaticRender ([de53e9b](https://github.com/visulima/visulima/commit/de53e9b7a944a3778f0d10f1daa1653a1063d9b3))
+* **vis:** 1 bug fix + 2 perf ([fdf3eb8](https://github.com/visulima/visulima/commit/fdf3eb86c19b471fd9891721e83fff7578df1da0))
+* **vis:** add explicit type annotation for isolatedDeclarations compatibility ([235d389](https://github.com/visulima/visulima/commit/235d389f8fd3ffa4de2d867eaff781dccd99be20))
+* **vis:** add explicit type annotations for isolatedDeclarations compatibility ([5a5f35c](https://github.com/visulima/visulima/commit/5a5f35cd0e92aff38f4c7bd8f31dda5e813ff568))
+* **vis:** add missing space and drop extra line in update progress UI ([db1bac1](https://github.com/visulima/visulima/commit/db1bac1ecff50eac682a5cb33958cd30e4da2bf6))
+* **vis:** address audit findings on dashboard + visx + defineConfig refactor ([1eb8ae5](https://github.com/visulima/visulima/commit/1eb8ae5820d425780b9f5c05f153b68fe74a8a36))
+* **vis:** address coderabbit feedback on ecosystem updates ([#654](https://github.com/visulima/visulima/issues/654)) ([049f0b4](https://github.com/visulima/visulima/commit/049f0b40aa890978b43104cd15f238800d62d981))
+* **vis:** address dlx first-run gate review comments ([6b833d1](https://github.com/visulima/visulima/commit/6b833d105f0827a3a41140e646d3b548509ccd2d))
+* **vis:** address ecosystem-update review findings ([88ac870](https://github.com/visulima/visulima/commit/88ac8703eaab7ad9741aa94a4addf77d618a2464))
+* **vis:** address review findings on services + inference ([c191cbc](https://github.com/visulima/visulima/commit/c191cbc3661a2885488daa44554b642e64785e52))
+* **vis:** address review findings on watch UX bundle ([edee703](https://github.com/visulima/visulima/commit/edee7038fe23a488791682dd8ce5c469b40a3e8c))
+* **vis:** align native binding version check with package version ([4075bae](https://github.com/visulima/visulima/commit/4075bae7c37a4e34fc1416cba7bad1436e3f8090))
+* **vis:** apply pnpm !-exclusions and root .gitignore in workspace resolver ([b08a1be](https://github.com/visulima/visulima/commit/b08a1be4391e362dca4f935541362bae01b859d9)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+* **vis:** bump stale workspace dep versions so Nx links them ([448ce87](https://github.com/visulima/visulima/commit/448ce87dd146bd696fd0cb0b5ad6deabb7ffc9d6))
+* **vis:** bundle react stack to dedupe react copies ([#672](https://github.com/visulima/visulima/issues/672)) ([fc35522](https://github.com/visulima/visulima/commit/fc35522a8414922c0b99a60c2f13d73e4767a6ac))
+* **vis:** clean up dashboard audit nits — typos, dead code, redundant calls ([46a5c0e](https://github.com/visulima/visulima/commit/46a5c0ed8116f79c0307d51a1eb7c9d8ae419dde))
+* **vis:** clear lint findings in hook dispatch, builtins, and util ([d05204c](https://github.com/visulima/visulima/commit/d05204c9a88d300b2b4ba3c2dd4169a9860a1d86))
+* **vis:** coalesce wheel-burst input and group sort-package-json TUI ([97aa78b](https://github.com/visulima/visulima/commit/97aa78bc445fc234e1473986a867e70f8d15d7b4))
+* **vis:** correct flag name in conflicting-schema error (--projects) ([#667](https://github.com/visulima/visulima/issues/667)) ([c56122b](https://github.com/visulima/visulima/commit/c56122bc6bc654e4a9e118e96b9ba852bc9b784f))
+* **vis:** declare missing editorconfig field on VisConfig type ([4a33428](https://github.com/visulima/visulima/commit/4a334285b396ee41a1dbe507eb27fb2894055463))
+* **vis:** disable class-methods-use-this for tui lifecycle ([182c972](https://github.com/visulima/visulima/commit/182c9727dcbef66a8609a864133fb2869bd2d9c4))
+* **vis:** drop duplicate --no-color global option ([c50879a](https://github.com/visulima/visulima/commit/c50879a7ab2b195b4decf81d2cca5d3a39b8f137))
+* **vis:** drop pinned packageManager from release test fixtures ([d8c6a35](https://github.com/visulima/visulima/commit/d8c6a35326b12d5785cc8060a5aadb4cdc3d75be))
+* **vis:** dump successful task output after TUI exit ([ab51784](https://github.com/visulima/visulima/commit/ab517843910dadf543575c57466c5da01ef9401d))
+* **vis:** enhance PATH inside ephemeral service bootstrap config ([30c6364](https://github.com/visulima/visulima/commit/30c6364cceff0d3c48fe5e7e4a996b77a1ed224c))
+* **vis:** escape control chars in shell history ([86471d2](https://github.com/visulima/visulima/commit/86471d27d68d9790eae005e5d2dfe561efbae700))
+* **vis:** exclude native binding deps from unused dependency check ([0e8409e](https://github.com/visulima/visulima/commit/0e8409e66676803fb1494fa32df64cdc44969966))
+* **vis:** exit explicitly after cli.run settles ([2dc28e2](https://github.com/visulima/visulima/commit/2dc28e2d0d735526c9c551aeae72af63a2deee4d))
+* **vis:** expand {projectRoot}/{projectName} tokens in task outputs ([d32a206](https://github.com/visulima/visulima/commit/d32a206dde082276f3fe06c032d07373a0c9a59e))
+* **vis:** expand StagedConfig type and support Bun object-form workspaces ([af810bc](https://github.com/visulima/visulima/commit/af810bc10a512ec0ed390152e9d59ece681f7360))
+* **vis:** expand windows 8.3 short names in workspace containment ([dbfe9b1](https://github.com/visulima/visulima/commit/dbfe9b152154b1f7526d7e0cbfd48cd0d94e6cc0))
+* **vis:** fall back to package.json deps when pnpm/bun have no catalogs ([8da8e19](https://github.com/visulima/visulima/commit/8da8e190a40abc22e18e3af740a594edc8cc382d))
+* **vis:** filter truncated SBOM hashes that fail CycloneDX 1.6 schema validation ([34c7b22](https://github.com/visulima/visulima/commit/34c7b2268f68eac1095835aa65e21f998c3a63dc))
+* **vis:** fix broken lib-a dep in sample workspace example ([538b7d4](https://github.com/visulima/visulima/commit/538b7d42d0b09313ff87342143f0c7502788092b))
+* **vis:** fix failing tests across tui, catalog, and pm-runner modules ([1c29189](https://github.com/visulima/visulima/commit/1c29189ad39061085cc10ca316d1128d52e88811))
+* **vis:** fix tips CI test by resetting modules before doMock ([c578ef5](https://github.com/visulima/visulima/commit/c578ef55c1176397448136c8e190992cdf50eb08))
+* **vis:** fix Windows-only release test failures ([158a6a3](https://github.com/visulima/visulima/commit/158a6a39a69d3a59bba9503c1fbcde19048378fc))
+* **vis:** fixed types ([ff39190](https://github.com/visulima/visulima/commit/ff39190d92644bf592cbb1df81d69c224ede2bff))
+* **vis:** forward config.namedInputs to the task runner ([02201de](https://github.com/visulima/visulima/commit/02201ded24b2881df8d6f7f0e6c573f4bd3123dc))
+* **vis:** group failed tasks in ci log output ([0fb8678](https://github.com/visulima/visulima/commit/0fb8678d9b66c6b587fb113310cfe9abce9aa6d0))
+* **vis:** harden dashboard server, metrics, and live UI ([be4c6a1](https://github.com/visulima/visulima/commit/be4c6a134410ef9e2b893d57ee6e2c1b163c4b88))
+* **vis:** harden dlx first-run gate per review ([a370a57](https://github.com/visulima/visulima/commit/a370a579c4df1f6852bd9591701ce85ff674401c))
+* **vis:** harden extraTypes per review ([8b56f48](https://github.com/visulima/visulima/commit/8b56f48fce55ac133bd20f181133ad17e06a9825))
+* **vis:** harden marshall pipeline and failure-render ANSI stripping ([22dc431](https://github.com/visulima/visulima/commit/22dc431ac3e841a2a342f297673b4d5f1a0a8a43))
+* **vis:** harden vis generate edge cases and migrate moon templates ([ed37000](https://github.com/visulima/visulima/commit/ed3700059e34c2fb563890edf49fd6050ddfad37))
+* **vis:** hash expanded command so token-driven cache keys vary per affected set ([636b1ac](https://github.com/visulima/visulima/commit/636b1ac843381cf7df3fec844431ec0123b5f565))
+* **vis:** improve devcontainer TUI scrolling, mount suggestions, and review fixes ([6bb03da](https://github.com/visulima/visulima/commit/6bb03dae9f48d9a6461bdfce2ad29da3f16c4ecf))
+* **vis:** isolate git env vars in staged integration tests ([18900a1](https://github.com/visulima/visulima/commit/18900a126bfb16f6d70ab81cbe5248720b03ac40))
+* **vis:** isolate loadNpmrc test from host ~/.npmrc ([a7016d6](https://github.com/visulima/visulima/commit/a7016d6ce8770c1d462ebfb9b2dab530fcedac5d))
+* **vis:** key doctor cache on the resolved npm lockfile ([628a21d](https://github.com/visulima/visulima/commit/628a21d62285d6299fe399409783c297c64f9e1b))
+* **vis:** make write guard github/gitlab asymmetry explicit ([0202fd9](https://github.com/visulima/visulima/commit/0202fd99e920173cbbb5e9711bb2df9528d25e42))
+* **vis:** measure update list viewport for scrollbar ([4451cd3](https://github.com/visulima/visulima/commit/4451cd3726598ad1848c61800410f6d3146ec817))
+* **vis:** move default task cache out of source-bearing .vis/ ([b76ee30](https://github.com/visulima/visulima/commit/b76ee303c94eb69cccb40fe2f49afb8c7569630b))
+* **vis:** name the actual lockfile in npm pruner messages ([c783683](https://github.com/visulima/visulima/commit/c78368392930c3eafdb6e0c056535217665b2f07))
+* **vis:** narrow secret-scanner baseline to string path in secrets handler ([9bc36e9](https://github.com/visulima/visulima/commit/9bc36e9e780a25d542417361d31403613d4c2c5a))
+* **vis:** overhaul TUI with pail InteractiveManager and tabular layout ([ecab9ff](https://github.com/visulima/visulima/commit/ecab9ffc61531b76a58b89202401f1266a5decea))
+* **vis:** parse pnpm v11 multi-document lockfiles ([94024b6](https://github.com/visulima/visulima/commit/94024b65310ab70ef4a3d4fed93f4987203f4a57))
+* **vis:** preserve probe error on close failure and clamp formatAge ([f1d71d6](https://github.com/visulima/visulima/commit/f1d71d63a5432fc2ed8c09c9a0a87e4e59b83b0b))
+* **vis:** prune npm-shrinkwrap.json into the Docker context ([ecfb54c](https://github.com/visulima/visulima/commit/ecfb54c7c515a14509c71458468c99c000b07d21))
+* **vis:** raise timeout for exposed-files preset tests to 15s ([433db73](https://github.com/visulima/visulima/commit/433db7319ecf4720664bc199582d571ea6a3630b))
+* **vis:** read bun minimumReleaseAge from bunfig.toml, not package.json ([78fe9f4](https://github.com/visulima/visulima/commit/78fe9f40452ddfc93d4bd3d66ec49f269b6085e6))
+* **vis:** reconcile run status-line task counts ([8ebee32](https://github.com/visulima/visulima/commit/8ebee32912227176ff1f361f37b2ea856d780895))
+* **vis:** recover -- passthrough in generate and create commands ([688e6a9](https://github.com/visulima/visulima/commit/688e6a9b58766b341cc510d048669b753a30345a))
+* **vis:** regenerate vis-config schema for the runtime field ([1de4ef0](https://github.com/visulima/visulima/commit/1de4ef0f50b6620f981b081b6ff746306b948a76))
+* **vis:** release stdin and label persistent quits in dynamic TUI ([7350547](https://github.com/visulima/visulima/commit/7350547363fcbd4ec4d845d2194c22188605f34f))
+* **vis:** render task failure block lazily at the consumer ([cb35aa7](https://github.com/visulima/visulima/commit/cb35aa78550408b462e9a1ec2af3eddb65a27b87))
+* **vis:** replace editorconfig with ec4rs binding ([3a83ed0](https://github.com/visulima/visulima/commit/3a83ed0f9de3e4202dfa51cf9bf4e6d8c3b0134d))
+* **vis:** require explicit opt-in to apply ecosystem updates ([#663](https://github.com/visulima/visulima/issues/663)) ([90cf12d](https://github.com/visulima/visulima/commit/90cf12dffa9dd53cc21849e9a41488dfbe2c8221))
+* **vis:** resolve eslint errors ([b9ee58b](https://github.com/visulima/visulima/commit/b9ee58b179588fa9f3c08178f26dac7cc8e7f6c5))
+* **vis:** resolve lint + Windows test failures from [#655](https://github.com/visulima/visulima/issues/655) ([#673](https://github.com/visulima/visulima/issues/673)) ([de2586d](https://github.com/visulima/visulima/commit/de2586dd1e04b8c61cc9f6fff05ecb666881253d))
+* **vis:** resolve test failures across multiple modules ([5728d8a](https://github.com/visulima/visulima/commit/5728d8aabae0fb0bb8c64527f61b8663b73148f2))
+* **vis:** resolve tsc errors in create handler and watch keybinds ([033760d](https://github.com/visulima/visulima/commit/033760d83c8a7252dadbd716ecd04f80f54816e9))
+* **vis:** resolve type errors across commands, tui and utils ([187d460](https://github.com/visulima/visulima/commit/187d4607732799ac1711d2097f90666674850c75))
+* **vis:** run persistent tasks under a PTY in the live TUI ([77b2a26](https://github.com/visulima/visulima/commit/77b2a263b9563f8ee894671f910e013f2c95077a))
+* **vis:** stop corepack prompt hanging release pm probes ([ddb5f2d](https://github.com/visulima/visulima/commit/ddb5f2de908ffe187162ad13d3f1cd7024a4b6c8))
+* **vis:** stop Windows test hangs; start fallow dead-code cleanup ([e87ca70](https://github.com/visulima/visulima/commit/e87ca708223560775c2bd9ec7a59e1aa5853b5de))
+* **vis:** support Bun object-form workspaces in migration catalog handling ([f44a17f](https://github.com/visulima/visulima/commit/f44a17fe7836febfac4012f744438df70f36af6b))
+* **vis:** tighten update command view and reduce duplicated security warnings ([4002b43](https://github.com/visulima/visulima/commit/4002b4379aadd00bac5c5e3d9c4eb5796b9d7b3d))
+* **vis:** TUI polish - compact split, responsive layout, double output fix ([e0487ea](https://github.com/visulima/visulima/commit/e0487ea735ecc2734046ccaedc9588a8ca165674)), closes [#1e1e1e](https://github.com/visulima/visulima/issues/1e1e1e)
+* **vis:** unbreak full build — exclude variable-import modules from dynamic-import-vars ([#712](https://github.com/visulima/visulima/issues/712)) ([29d46eb](https://github.com/visulima/visulima/commit/29d46eb719de11ab8f09e5303748264607b04fe3)), closes [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697)
+* **vis:** use camelCase option names for cerebro CLI flags ([7f187a5](https://github.com/visulima/visulima/commit/7f187a557eb85ced5e2995b4e1a7cebc61484c45))
 * **vis:** use default colorize import ([2b95ad2](https://github.com/visulima/visulima/commit/2b95ad28207e699161ed201a43f175a630a06c61))
+* **vis:** use platform-aware PATH delimiter in toolchain detection ([0a1294f](https://github.com/visulima/visulima/commit/0a1294f3bcf9265e6908e15dfdcffb439b5f0e81))
+* **vis:** version the packument cache so stale entries can't blind marshalls ([6741f55](https://github.com/visulima/visulima/commit/6741f551ed9c1a28a2184672ed644dd06344c93b))
+* **vis:** warm default ruleset for exposed-files preset tests ([9c76250](https://github.com/visulima/visulima/commit/9c76250d2ee6e8e2be878e5dcfb149d38126d60d))
+* **vis:** wire s1ngularity into the vis inspect dispatch ([0e355eb](https://github.com/visulima/visulima/commit/0e355eb44acfcf50caf09f7b0954038def735278))
+* **vis:** wrap native crate-type array to satisfy toml lint rule ([9470654](https://github.com/visulima/visulima/commit/94706547342291197afb8babd5d2929ae9e0bb9b))
+
+### Performance Improvements
+
+* **vis:** fast-path local .bin in exec command ([#716](https://github.com/visulima/visulima/issues/716)) ([dec9d37](https://github.com/visulima/visulima/commit/dec9d37829ded30c7be0c0c9d4649f726b8fbe94))
+* **vis:** skip heap-tuning re-exec for light commands (~290ms) ([885aebe](https://github.com/visulima/visulima/commit/885aebe0993210727f82918cb0474e14a8414ae6))
+* **vis:** wrap immutable TUI components with StaticRender ([00e47e9](https://github.com/visulima/visulima/commit/00e47e9f7a6c562570e0b090b7940389451aa1ef))
+
+### Documentation
+
+* re-scope RFCs against what task-runner/vis already ship ([d6cf42c](https://github.com/visulima/visulima/commit/d6cf42c964b738c9872fb205b8c90b99bc7655e0))
+* **task-runner,vis:** add nub MIT attribution to ported native code ([9305f59](https://github.com/visulima/visulima/commit/9305f592da38dd13a179ef1af75fb0c8f5d84693))
+* **vis:** add AI integration guide ([a6dbbe0](https://github.com/visulima/visulima/commit/a6dbbe0bf8c03519764ff41da9efdd4cb4439b77))
+* **vis:** add ai/list pages, stub 18 commands, refresh flags ([71b81ca](https://github.com/visulima/visulima/commit/71b81ca8704548bca0ec33437854476eb425c411))
+* **vis:** add MARSHALL_DISABLE_S1NGULARITY to shell-alias guide ([fee4979](https://github.com/visulima/visulima/commit/fee4979338cd255ee5c4ff1e52e99e545695e4d7))
+* **vis:** add migration sources to credits section ([2caddce](https://github.com/visulima/visulima/commit/2caddcea6755bdc73780b559243cc27d4f2d48f7))
+* **vis:** add vltpkg/security-archive attribution ([019d6fd](https://github.com/visulima/visulima/commit/019d6fd4d4426991f2fb31450f72616b14874aff))
+* **vis:** correct and complete command reference ([b8c6c11](https://github.com/visulima/visulima/commit/b8c6c11e289c509a7d479e2371d8df63b710ce9b))
+* **vis:** correct cold-start profile with measured findings ([d02a8c1](https://github.com/visulima/visulima/commit/d02a8c1f2212ce61a5ecf9f396976f1031996557))
+* **vis:** correct vis generate partial detection and lock CLI surface ([45b40a0](https://github.com/visulima/visulima/commit/45b40a072ffd61274309b3dbe63a3413e764cb9d))
+* **vis:** cover template introspection in AI guide and skill ([7763283](https://github.com/visulima/visulima/commit/7763283dfd0f94dc8ef25800fa9f48e6d7888c8e))
+* **vis:** document --last-commit and nested hook/migrate/cache commands ([a1f14d7](https://github.com/visulima/visulima/commit/a1f14d7ff5c1bfa2b038501f3c83c458746d3f31))
+* **vis:** document doctor command and Phase 2 watch/signal flow ([4e66350](https://github.com/visulima/visulima/commit/4e663505be135666757d9e90bbfd033f66466220)), closes [doctor#runtime](https://github.com/visulima/doctor/issues/runtime)
+* **vis:** document json deps, sync fields, post-sort flags ([d244ddd](https://github.com/visulima/visulima/commit/d244ddd2b2e88d53e756fef57e4024cd46a57430))
+* **vis:** document layered configuration ([9a0f303](https://github.com/visulima/visulima/commit/9a0f3037f94992887e3551fbcd72f2dc73260305))
+* **vis:** document lockfile supply-chain verification ([05c338f](https://github.com/visulima/visulima/commit/05c338f55f7069ed59018e64be3d24016ab3fb66))
+* **vis:** document missing cache subcommands and run flags ([cf093a1](https://github.com/visulima/visulima/commit/cf093a1879ff414d0500ac91d76bba98352ed97e))
+* **vis:** document new update command options and configuration ([3e72240](https://github.com/visulima/visulima/commit/3e72240dbddebb3abf896a6c941e713ba460a73d))
+* **vis:** document patchedDependencies supply-chain check ([b373960](https://github.com/visulima/visulima/commit/b373960d6d7dc38db9eeb8437cec33d47f9102ab))
+* **vis:** document s1ngularity marshall in add/update/inspect ([6a14d5c](https://github.com/visulima/visulima/commit/6a14d5c190a6125817abe9c3e35afde87893228a))
+* **vis:** document vis lint and mark syncpack item 6 shipped ([73cbd44](https://github.com/visulima/visulima/commit/73cbd4457810a91ecce99856522904885e80c4d6))
+* **vis:** mark `${affected.files}` token wiring as shipped ([e4d306e](https://github.com/visulima/visulima/commit/e4d306e5ddd1eba30a404bf3d03efc5d976f0e9a)), closes [#6](https://github.com/visulima/visulima/issues/6)
+* **vis:** mark syncpack ports shipped, link [#622](https://github.com/visulima/visulima/issues/622) ([2fdb8de](https://github.com/visulima/visulima/commit/2fdb8de9d1b6946208a34a4da491918820f8c815))
+* **vis:** mention ecosystem updates in README and ci-cd guide ([1577e95](https://github.com/visulima/visulima/commit/1577e95accc4a91a67ece2c7a25ad1a8b26bc784))
+* **vis:** mention TURBO_API fallback in help text and migrate hint ([f9bd7ac](https://github.com/visulima/visulima/commit/f9bd7acd7a53837e40376f9b0dcf54040bbc50a1))
+* **vis:** spec for layered configuration ([bcd830d](https://github.com/visulima/visulima/commit/bcd830dc9f1ed7e9dfc39f91649f839afe29bd87))
+
+### Styles
+
+* cs fixes ([2a960bb](https://github.com/visulima/visulima/commit/2a960bb1772c9dc70080e2d75d3a0d827034e294))
+* cs fixs ([0666662](https://github.com/visulima/visulima/commit/066666293c50cde41c796dc38b4b62c48531a3c0))
+* **vis:** clear pre-existing eslint findings in run handler ([ba423ad](https://github.com/visulima/visulima/commit/ba423adad677c2a9ffb6051743e463a33cb44541))
+* **vis:** prettier/eslint conformance sweep ([dd200bd](https://github.com/visulima/visulima/commit/dd200bd84c022f5fd8819ce23bab2c1c4cace1ed))
 
 ### Miscellaneous Chores
 
+* add fallow code-intelligence across all packages ([a3b4821](https://github.com/visulima/visulima/commit/a3b48215002e86fed20f2973038b5d4a0aa1ce04))
+* added [@bomb](https://github.com/bomb).sh/tab to exclude ([6e3839e](https://github.com/visulima/visulima/commit/6e3839e5973bac479d6b2e0cb2c3d3c59db3d416))
+* added fixtures to prettier ignore ([13bda29](https://github.com/visulima/visulima/commit/13bda2942d5d95fedeec7c07937fdfc37cf960c7))
 * added missing version key ([036d86e](https://github.com/visulima/visulima/commit/036d86e6cfa078e4f651327f630cec721f1bbc47))
+* added og images ([02d9d1e](https://github.com/visulima/visulima/commit/02d9d1e47be3ce75679ea89e857dc4e4bfe4946b))
+* **api-platform:** apply pending lint and source updates ([3fb0043](https://github.com/visulima/visulima/commit/3fb0043a4cf35f752ca89a09a077100ae0142da8))
+* apply linting and formatting fixes across packages ([5d150a5](https://github.com/visulima/visulima/commit/5d150a578f9ce861c791843c683deeb849b774a9))
+* bump engines.node to ^22.14.0 || >=24.10.0 ([c3d0931](https://github.com/visulima/visulima/commit/c3d0931d1504e4f21ebf50ea680cfa7ce4ba15ce))
+* catalog refresh + task-runner binding bump to 1.0.0-alpha.8 ([ff4548a](https://github.com/visulima/visulima/commit/ff4548a5678c992048a57e73c310757733c04756))
+* **ci-stability:** green CI across vis, native, lint, tests, attw ([#651](https://github.com/visulima/visulima/issues/651)) ([d4eb684](https://github.com/visulima/visulima/commit/d4eb684b5f75c818c9251048c605a0ed54a268e3))
+* commit pnpm-lock and vis syncpack roadmap ([5138981](https://github.com/visulima/visulima/commit/5138981ee04b45900c6cf1ba41f8e18025d4ba63))
+* **deps:** bump rust crates to current majors ([3a1d9bb](https://github.com/visulima/visulima/commit/3a1d9bb7f6e2c6b2d3862e212ae62707d60815cc))
+* **fallow:** resolve dead-code findings ([c4125d5](https://github.com/visulima/visulima/commit/c4125d53e03ac9d90115399634535991927a96cc))
+* fixed build ([ec156bf](https://github.com/visulima/visulima/commit/ec156bf08859e81186b74533610357d85c38f64e))
+* ignore sample-workspace .vis dirs and refresh license artifact ([0f88438](https://github.com/visulima/visulima/commit/0f884380bcc7b25ac0beec5994256cc5b956a167))
+* prettier sweep + catalog refresh ([5c7a610](https://github.com/visulima/visulima/commit/5c7a610d9b33d6df3eb3d3ba77b79759241ee1a4))
+* re-enable antfu/if-newline in vis and secret-scanner ([bcd84de](https://github.com/visulima/visulima/commit/bcd84de019b60f6bc474852e7ae6b7da822a9185))
+* re-enable jsdoc/match-description in api-platform and tighten config docs ([4ecaa31](https://github.com/visulima/visulima/commit/4ecaa315064cdd798af1ea1296be1fe52967bf9a))
+* refresh generated license bundles and disposable-domain stats ([a389f38](https://github.com/visulima/visulima/commit/a389f38484788aafa8ba9b698e2dd5805a982d98))
+* **release:** @visulima/vis@1.0.0-alpha.1 [skip ci]\n\n## @visulima/vis 1.0.0-alpha.1 (2026-03-26) ([2c8eb1e](https://github.com/visulima/visulima/commit/2c8eb1ede395c612fddd31317c518215f1e4ccf9))
+* **release:** @visulima/vis@1.0.0-alpha.10 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.10](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.9...@visulima/vis@1.0.0-alpha.10) (2026-04-30) ([b50bc57](https://github.com/visulima/visulima/commit/b50bc577c90122fd780bd1950f5fbc8519f5d44d))
+* **release:** @visulima/vis@1.0.0-alpha.11 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.11](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.10...@visulima/vis@1.0.0-alpha.11) (2026-05-04) ([4ce09cd](https://github.com/visulima/visulima/commit/4ce09cdab8c130f7902ff2678685762d2b106172))
+* **release:** @visulima/vis@1.0.0-alpha.12 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.12](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.11...@visulima/vis@1.0.0-alpha.12) (2026-05-06) ([f7ab813](https://github.com/visulima/visulima/commit/f7ab8138dc971295989a0329ed89fb8ad734cc81))
+* **release:** @visulima/vis@1.0.0-alpha.13 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.13](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.12...@visulima/vis@1.0.0-alpha.13) (2026-05-06) ([8b4573a](https://github.com/visulima/visulima/commit/8b4573acc970312cc02b5ad6dcd01095cb773676))
+* **release:** @visulima/vis@1.0.0-alpha.14 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.14](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.13...@visulima/vis@1.0.0-alpha.14) (2026-05-07) ([976451c](https://github.com/visulima/visulima/commit/976451c45456f66e70fe4d69afd7559bbb32cc47))
+* **release:** @visulima/vis@1.0.0-alpha.15 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.15](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.14...@visulima/vis@1.0.0-alpha.15) (2026-05-07) ([ded99ef](https://github.com/visulima/visulima/commit/ded99ef83cb6d142ab58832030af9e655a781618))
+* **release:** @visulima/vis@1.0.0-alpha.16 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.16](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.15...@visulima/vis@1.0.0-alpha.16) (2026-05-10) ([43ab07d](https://github.com/visulima/visulima/commit/43ab07d46fdc2bf3773b36fb7b84d0cd428a722b))
+* **release:** @visulima/vis@1.0.0-alpha.17 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.17](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.16...@visulima/vis@1.0.0-alpha.17) (2026-05-10) ([719cb1a](https://github.com/visulima/visulima/commit/719cb1a8af6dc3d7bf91f1e8c568fde9e59526ff))
+* **release:** @visulima/vis@1.0.0-alpha.18 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.18](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.17...@visulima/vis@1.0.0-alpha.18) (2026-05-11) ([5fd25a7](https://github.com/visulima/visulima/commit/5fd25a7f6f4b6d36ecf86c86d299517a05d9b07e))
+* **release:** @visulima/vis@1.0.0-alpha.19 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.19](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.18...@visulima/vis@1.0.0-alpha.19) (2026-05-11) ([cb4b86d](https://github.com/visulima/visulima/commit/cb4b86dbc42414e6a854e74c14b7a8c60ec10780))
+* **release:** @visulima/vis@1.0.0-alpha.2 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.2](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.1...@visulima/vis@1.0.0-alpha.2) (2026-03-26) ([69adbdf](https://github.com/visulima/visulima/commit/69adbdff41d82ff96820a19eb32af533e63025d0))
+* **release:** @visulima/vis@1.0.0-alpha.20 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.20](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.19...@visulima/vis@1.0.0-alpha.20) (2026-05-14) ([ed353ab](https://github.com/visulima/visulima/commit/ed353ab62cb9f689d62570b10217e2338fdc3e03))
+* **release:** @visulima/vis@1.0.0-alpha.21 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.21](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.20...@visulima/vis@1.0.0-alpha.21) (2026-05-16) ([38b6046](https://github.com/visulima/visulima/commit/38b60468af0d43977a103404e6928f9347a46a19))
+* **release:** @visulima/vis@1.0.0-alpha.22 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.22](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.21...@visulima/vis@1.0.0-alpha.22) (2026-05-19) ([3fe5332](https://github.com/visulima/visulima/commit/3fe5332f2d4b515f514cfe8ed2e7bde53fb7e7ad))
+* **release:** @visulima/vis@1.0.0-alpha.23 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.23](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.22...@visulima/vis@1.0.0-alpha.23) (2026-05-20) ([8e64a66](https://github.com/visulima/visulima/commit/8e64a66b3a77c53580306d04a22b1b0a2f21c78c))
+* **release:** @visulima/vis@1.0.0-alpha.24 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.24](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.23...@visulima/vis@1.0.0-alpha.24) (2026-05-26) ([b1f5502](https://github.com/visulima/visulima/commit/b1f5502306f002d3a444884df3a83d9c9fbd89c5))
+* **release:** @visulima/vis@1.0.0-alpha.25 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.25](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.24...@visulima/vis@1.0.0-alpha.25) (2026-05-27) ([687f31f](https://github.com/visulima/visulima/commit/687f31fdf30b5789e97f6725dbf68c7b44755ef6))
+* **release:** @visulima/vis@1.0.0-alpha.26 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.26](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.25...@visulima/vis@1.0.0-alpha.26) (2026-05-29) ([ed3da66](https://github.com/visulima/visulima/commit/ed3da66f33825060c9862d03359f132fb57390a2))
+* **release:** @visulima/vis@1.0.0-alpha.27 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.27](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.26...@visulima/vis@1.0.0-alpha.27) (2026-06-02) ([9d2a668](https://github.com/visulima/visulima/commit/9d2a66893fe580811747c3cbe4d7f12841ad9a11))
+* **release:** @visulima/vis@1.0.0-alpha.28 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.28](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.27...@visulima/vis@1.0.0-alpha.28) (2026-06-03) ([e25b5dd](https://github.com/visulima/visulima/commit/e25b5dd895258748984d842464ccff6a42ea344d))
+* **release:** @visulima/vis@1.0.0-alpha.29 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.29](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.28...@visulima/vis@1.0.0-alpha.29) (2026-06-04) ([2b642d9](https://github.com/visulima/visulima/commit/2b642d9539915cb13e0fdf6ccdbc5d9c462e61dd))
+* **release:** @visulima/vis@1.0.0-alpha.3 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.3](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.2...@visulima/vis@1.0.0-alpha.3) (2026-03-26) ([7658db7](https://github.com/visulima/visulima/commit/7658db7ee798a1b1a0203d4945b07760c9eae721))
+* **release:** @visulima/vis@1.0.0-alpha.30 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.30](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.29...@visulima/vis@1.0.0-alpha.30) (2026-06-04) ([2467e20](https://github.com/visulima/visulima/commit/2467e20954e2fecc4d354b4d7dd4a733ab04f05e))
+* **release:** @visulima/vis@1.0.0-alpha.31 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.31](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.30...@visulima/vis@1.0.0-alpha.31) (2026-06-06) ([227a3d4](https://github.com/visulima/visulima/commit/227a3d4903ef2f9bd1d2a9b3410f80aaeadaf764))
+* **release:** @visulima/vis@1.0.0-alpha.32 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.32](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.31...@visulima/vis@1.0.0-alpha.32) (2026-06-07) ([62c9bc5](https://github.com/visulima/visulima/commit/62c9bc52b767fa33ccf548148fd3f7694061fb13))
+* **release:** @visulima/vis@1.0.0-alpha.33 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.33](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.32...@visulima/vis@1.0.0-alpha.33) (2026-06-07) ([840bea1](https://github.com/visulima/visulima/commit/840bea18aa9fb1b74a403e789175fa6dc6adf2b3))
+* **release:** @visulima/vis@1.0.0-alpha.34 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.34](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.33...@visulima/vis@1.0.0-alpha.34) (2026-06-08) ([00475c7](https://github.com/visulima/visulima/commit/00475c7d1b93287e796af0dfea12956bf13ad2c3))
+* **release:** @visulima/vis@1.0.0-alpha.35 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.35](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.34...@visulima/vis@1.0.0-alpha.35) (2026-06-09) ([618bc19](https://github.com/visulima/visulima/commit/618bc199b57dc7b80f1ccf1e1ab2ce70e47b5061))
+* **release:** @visulima/vis@1.0.0-alpha.36 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.36](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.35...@visulima/vis@1.0.0-alpha.36) (2026-06-13) ([7a84281](https://github.com/visulima/visulima/commit/7a842813b2904cdb85a09d0533ca5fc767331114))
+* **release:** @visulima/vis@1.0.0-alpha.37 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.37](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.36...@visulima/vis@1.0.0-alpha.37) (2026-06-15) ([1d94b65](https://github.com/visulima/visulima/commit/1d94b65c9333caf5e9314e753a97a34c13c03d01))
+* **release:** @visulima/vis@1.0.0-alpha.38 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.38](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.37...@visulima/vis@1.0.0-alpha.38) (2026-06-16) ([c66c1a8](https://github.com/visulima/visulima/commit/c66c1a89770d98591591c8e9a8072f2ad6d063af))
+* **release:** @visulima/vis@1.0.0-alpha.39 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.39](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.38...@visulima/vis@1.0.0-alpha.39) (2026-06-16) ([2dbfb22](https://github.com/visulima/visulima/commit/2dbfb2257ecfc10dd1711807b7d1493ed2fd9244))
+* **release:** @visulima/vis@1.0.0-alpha.4 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.4](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.3...@visulima/vis@1.0.0-alpha.4) (2026-04-08) ([a6d2d79](https://github.com/visulima/visulima/commit/a6d2d7902dc27c11c015f64bb19d9bc62cd4fce3))
+* **release:** @visulima/vis@1.0.0-alpha.40 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.40](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.39...@visulima/vis@1.0.0-alpha.40) (2026-06-17) ([b2f49e4](https://github.com/visulima/visulima/commit/b2f49e48ca74316cf01199cfd9f522ba1864ff08))
+* **release:** @visulima/vis@1.0.0-alpha.41 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.41](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.40...@visulima/vis@1.0.0-alpha.41) (2026-06-19) ([653e217](https://github.com/visulima/visulima/commit/653e217e7b37c7289ddc249ef5fc006785094ccd))
+* **release:** @visulima/vis@1.0.0-alpha.42 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.42](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.41...@visulima/vis@1.0.0-alpha.42) (2026-06-19) ([ece2dad](https://github.com/visulima/visulima/commit/ece2dad9a4a805283df520614d80dcaab806e30d))
+* **release:** @visulima/vis@1.0.0-alpha.43 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.43](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.42...@visulima/vis@1.0.0-alpha.43) (2026-06-20) ([06a4d58](https://github.com/visulima/visulima/commit/06a4d58900e6baefd398c7cb1978c163d3a1c46e))
+* **release:** @visulima/vis@1.0.0-alpha.44 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.44](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.43...@visulima/vis@1.0.0-alpha.44) (2026-06-23) ([37881a2](https://github.com/visulima/visulima/commit/37881a2e7066edebf8321a3430d7889af26f13f2))
+* **release:** @visulima/vis@1.0.0-alpha.45 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.45](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.44...@visulima/vis@1.0.0-alpha.45) (2026-06-30) ([c6ce72e](https://github.com/visulima/visulima/commit/c6ce72e7313156f11f77714aeee6915e99e2fb4c))
+* **release:** @visulima/vis@1.0.0-alpha.46 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.46](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.45...@visulima/vis@1.0.0-alpha.46) (2026-07-01) ([59ee55c](https://github.com/visulima/visulima/commit/59ee55ce10bd6df2ef98cd69392ab443ff9b83aa))
+* **release:** @visulima/vis@1.0.0-alpha.47 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.47](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.46...@visulima/vis@1.0.0-alpha.47) (2026-07-03) ([d13d861](https://github.com/visulima/visulima/commit/d13d861669bcee008755789d55c1f337faa7131b))
+* **release:** @visulima/vis@1.0.0-alpha.5 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.5](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.4...@visulima/vis@1.0.0-alpha.5) (2026-04-09) ([d9ef946](https://github.com/visulima/visulima/commit/d9ef946ee2be81c7393b0feec9cb1b101e879d7c))
+* **release:** @visulima/vis@1.0.0-alpha.6 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.6](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.5...@visulima/vis@1.0.0-alpha.6) (2026-04-22) ([2304040](https://github.com/visulima/visulima/commit/23040404a41d480aa0e73e80d248044e8a5c719d))
+* **release:** @visulima/vis@1.0.0-alpha.7 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.7](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.6...@visulima/vis@1.0.0-alpha.7) (2026-04-22) ([e44d81b](https://github.com/visulima/visulima/commit/e44d81b6934a5301578287fddd7b33d0279608ea))
+* **release:** @visulima/vis@1.0.0-alpha.8 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.8](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.7...@visulima/vis@1.0.0-alpha.8) (2026-04-22) ([23187f1](https://github.com/visulima/visulima/commit/23187f1dd1b09dd4287d4e96b55bfbeba7554649))
+* **release:** @visulima/vis@1.0.0-alpha.9 [skip ci]\n\n## @visulima/vis [1.0.0-alpha.9](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.8...@visulima/vis@1.0.0-alpha.9) (2026-04-28) ([d97453e](https://github.com/visulima/visulima/commit/d97453e29b91e87c2a93b19c3f00dbbe8d714bd3))
+* remove unused deprecated aliases ([#612](https://github.com/visulima/visulima/issues/612)) ([24ee546](https://github.com/visulima/visulima/commit/24ee546bcb2c17b8915622e4878797c00aa1d813))
+* **repo:** apply eslint --fix and prettier --fix across packages ([#650](https://github.com/visulima/visulima/issues/650)) ([2e26a84](https://github.com/visulima/visulima/commit/2e26a84774f218f21345e9a8ecd68236b6542743)), closes [#620](https://github.com/visulima/visulima/issues/620)
+* **repo:** sort package.json keys across all packages ([e1fd9ab](https://github.com/visulima/visulima/commit/e1fd9ab467ef96a98c777da1572ff6a50fcf7e71))
+* sorted package.json ([b47c545](https://github.com/visulima/visulima/commit/b47c545591600fdab17d5cd3a3fbc68b61e199da))
+* sorted package.json v2 ([70f0116](https://github.com/visulima/visulima/commit/70f01166709d5db1bd8cb309758e86edd4127eb5))
+* update git ignore ([67ac9cf](https://github.com/visulima/visulima/commit/67ac9cfd5969f54fbbbb426b3277472f75b0d520))
+* update license file ([8a84e10](https://github.com/visulima/visulima/commit/8a84e10f2077779159f2f1e186be1d461c47e043))
+* update license.md ([d4fb70e](https://github.com/visulima/visulima/commit/d4fb70ec954722345967ef2c607322402d25f2d9))
+* update lock file ([e58ef7c](https://github.com/visulima/visulima/commit/e58ef7c5764fc262e72504f31b4d97def449ee89))
+* **vis:** add .gitignore for cache, update changelog and lint fixes ([32d5ae8](https://github.com/visulima/visulima/commit/32d5ae841e79cb436273a73003ca42e610e912a5))
+* **vis:** alphabetize VisConfig members in workspace.ts ([b7869a6](https://github.com/visulima/visulima/commit/b7869a650641a55d895dbf135bfec1a94f9f50e7))
+* **vis:** apply auto-fix formatting ([098aa0f](https://github.com/visulima/visulima/commit/098aa0fabf17efee373987006a9ed9bad150f69d))
+* **vis:** apply eslint and formatter sweep ([d3a48c5](https://github.com/visulima/visulima/commit/d3a48c577a77864b1aae52e6061a8aad1554f273))
+* **vis:** apply linter auto-fixes ([c6ca2aa](https://github.com/visulima/visulima/commit/c6ca2aa6b648fcb90ef16a24502bbc753cdce712))
+* **vis:** apply pending eslint autofixes and regenerate bundled licenses ([742c613](https://github.com/visulima/visulima/commit/742c61358fcc6b07a62f3c4f688320335aeca27b))
+* **vis:** apply pending lint and source updates ([f1f3a92](https://github.com/visulima/visulima/commit/f1f3a92c952d129cdcedae137de4b0e77ea787b4))
+* **vis:** apply prettier and declare staged killSignal option ([23af135](https://github.com/visulima/visulima/commit/23af1357f19c22f3d4a67962ab2e28ac2ce64af1))
+* **vis:** apply prettier and eslint --fix sweep ([ec64552](https://github.com/visulima/visulima/commit/ec645524984f0e767ba63b3fcaaf60e184d31edf))
+* **vis:** apply prettier and eslint quote-style auto-fix ([f477246](https://github.com/visulima/visulima/commit/f47724629e5708ca45bb7891fdc03411088f0d00))
+* **vis:** apply prettier and eslint quote-style auto-fix ([915d80b](https://github.com/visulima/visulima/commit/915d80b4eca4e8da8ca36154a994f9048d1c1e28))
+* **vis:** apply prettier formatting ([05476bc](https://github.com/visulima/visulima/commit/05476bc9d9c1fd8a34423081159558576bfa6490))
+* **vis:** bump @eslint-react/eslint-plugin + fix revealed issues ([1c19670](https://github.com/visulima/visulima/commit/1c1967040e627d29857768150a992ff1e77fd3c1))
+* **vis:** bump example setup-wizard @inquirer/prompts to v8 ([1974734](https://github.com/visulima/visulima/commit/1974734c34d49c61ce62b663a999a6161e679251))
+* **vis:** bundle internal deps as devDeps and extend packem hoisted exclude ([9cd6cba](https://github.com/visulima/visulima/commit/9cd6cba0ed89e26b6def141433d024c7a5851578))
+* **vis:** clear all eslint warnings across vis package ([f0c513e](https://github.com/visulima/visulima/commit/f0c513ead5761ebba35379099bcfa50ee006e44f))
+* **vis:** clear remaining ESLint findings across marshalls and tests ([29f87c5](https://github.com/visulima/visulima/commit/29f87c56d8c4aadfe5e270e67901435af31b8eae))
+* **vis:** commit pending lint+tsc fixes ([3d7a519](https://github.com/visulima/visulima/commit/3d7a5193f729e70444bdac983afdcf39828b4ad6))
+* **vis:** destructure runtime to satisfy prefer-destructuring in custom-types tests ([4802c91](https://github.com/visulima/visulima/commit/4802c912dda97ffd04182c1d9d4169c58b3c5aac))
+* **vis:** drop redundant section banners and pure-WHAT docblocks ([745844b](https://github.com/visulima/visulima/commit/745844b601cf111d362718611fa7021c19f2e939))
+* **vis:** drop stale planning doc and exclude sherif-lint fixtures ([6002fd2](https://github.com/visulima/visulima/commit/6002fd273242f357eb8884a1d3cfe2526c769d61))
+* **vis:** enforce @stylistic/quotes — auto-fix 333 single→double quote sites ([b33bdcb](https://github.com/visulima/visulima/commit/b33bdcbb52ecba14b8088053df5653adba0b5b6e))
+* **vis:** enforce curly braces and apply lint fixes ([9cf1d21](https://github.com/visulima/visulima/commit/9cf1d21f53bdb09fd93b30c7f9de758f16f8960d))
+* **vis:** expand braceless if/else statements to block syntax ([85f2595](https://github.com/visulima/visulima/commit/85f259532872b6d478e96a42b8122db6730ef280))
+* **vis:** expand inline if-return to block syntax ([69a6c77](https://github.com/visulima/visulima/commit/69a6c7778eb40c33fd945e85a1c11607ae8c62c5))
+* **vis:** finish .vis/ cutover for stragglers ([3053347](https://github.com/visulima/visulima/commit/30533478e084b9ae84aefe191d57c672ca0797fa))
+* **vis:** fix indent-binary-ops and silence default-log no-console ([9c8d5e1](https://github.com/visulima/visulima/commit/9c8d5e1cc07e6e5f3c01d0b79715f074dbda9b0b))
+* **vis:** fix lint errors ([0898454](https://github.com/visulima/visulima/commit/0898454c6119b2eaf77836015bc078a8afd2a1c0))
+* **vis:** housekeeping cleanup ([59a33fb](https://github.com/visulima/visulima/commit/59a33fba3ed65ae965b227d1e860e05e1b707bfa))
+* **vis:** make sample-workspace tasks cacheable ([a1db143](https://github.com/visulima/visulima/commit/a1db143b57a594470b9bf5695c60a0ced18344e3))
+* **vis:** merge clean/staged/hooks/docs feature branch ([f61821d](https://github.com/visulima/visulima/commit/f61821d9fb0e7f36769025edaa1d73993bf91c54))
+* **vis:** migrate .prettierrc.cjs to prettier.config.js ([2caed59](https://github.com/visulima/visulima/commit/2caed5911cd31a89f4db68c570a11cc74080820a))
+* **vis:** regenerate vis-config.schema.json for defaultBase ([4a847e9](https://github.com/visulima/visulima/commit/4a847e9a7e193880546c295920c29b2c67265a16)), closes [VisConfig#defaultBase](https://github.com/visulima/VisConfig/issues/defaultBase)
+* **vis:** remove ~10 eslint disables and fix mid-tier violations ([6a8a960](https://github.com/visulima/visulima/commit/6a8a960289c31d495cd3d37d2b28022516c02cd5))
+* **vis:** remove ~10 stale-zero/trivial eslint disables ([ffda729](https://github.com/visulima/visulima/commit/ffda72972a7d44d3b6eb2d1942897ff211811172))
+* **vis:** remove ~21 eslint disables and fix the violations ([6aec6e8](https://github.com/visulima/visulima/commit/6aec6e830c6e8816036f5dce8c6f57178f1e1af6))
+* **vis:** remove competitive-analysis and priority-roadmap docs ([3116348](https://github.com/visulima/visulima/commit/3116348a5f76772ace9f285d136d352a815c3f0a))
+* **vis:** rename PascalCase TUI components to kebab-case ([3aaa398](https://github.com/visulima/visulima/commit/3aaa398125f722770c1b44d0edb45ddfec2d0802))
+* **vis:** sort docker example api/package.json deps ([28fdbd7](https://github.com/visulima/visulima/commit/28fdbd780fb3384dcfc3f06db4145fafaeef52d2))
+* **vis:** style normalization sweep + scopedTasks/allowBins config fields ([ff97758](https://github.com/visulima/visulima/commit/ff977584da0afdf61d619b7a5fb7536f80c782a6))
+* **vis:** tighten toolbox, cache, and TUI typings ([a761ad7](https://github.com/visulima/visulima/commit/a761ad76d9200e1751e4ac1c7efd6619d1d1cde0))
 * **vis:** upgrade packem to 2.0.0-alpha.76 ([9753759](https://github.com/visulima/visulima/commit/97537598a23a4f680e332ca2ea73ad64f301252a))
 
 ### Code Refactoring
 
+* address thermos code-quality findings ([392ed96](https://github.com/visulima/visulima/commit/392ed96b489b1c4df30157ad2f33fc9b3fd82fef))
+* replace execa with tinyexec ([56ec776](https://github.com/visulima/visulima/commit/56ec776908fe0c068c54542f3885cb29f061fea7))
+* replace inline import() types with top-level imports ([4569a4c](https://github.com/visulima/visulima/commit/4569a4ca04723da069f985855dcfab292f7347e1))
+* **task-runner,vis:** consolidate helpers and tighten branches ([d1290d1](https://github.com/visulima/visulima/commit/d1290d1f614036902c6803d8ff51df100fdd07ab))
+* **task-runner,vis:** expose worktree helpers from task-runner ([12468d7](https://github.com/visulima/visulima/commit/12468d76bb03278ec56691ba0c6d9821c9482f94))
+* **vis, staged:** move env-var concurrency fallback to the CLI layer ([31cb567](https://github.com/visulima/visulima/commit/31cb56767158e53f02ce2c5602a0221a774995b0))
+* **vis:** address review findings across optimize and audit ([317dca8](https://github.com/visulima/visulima/commit/317dca88a16f6604c267f9240556d7e15a563a95))
 * **vis:** adopt cerebro lazy commands; split each command into folder ([e1efc0f](https://github.com/visulima/visulima/commit/e1efc0fe57e39433c33c50b1ad2c9e971ea596ba))
+* **vis:** apply Nothing design system to TUI components ([3d0517d](https://github.com/visulima/visulima/commit/3d0517d6225f75ea2e2ccf6170efdfa7911bf0c2))
+* **vis:** centralize per-user filesystem layout in vis-paths helpers ([9a06751](https://github.com/visulima/visulima/commit/9a0675131e7da5bc338bcaf438574a4a5930d239))
+* **vis:** consolidate workspace state under .vis/ ([9e89d52](https://github.com/visulima/visulima/commit/9e89d52f03cc8b3a6a51c13a2359e9b93532c1dd))
+* **vis:** drop --json alias from vis list, use --format=json ([30251b0](https://github.com/visulima/visulima/commit/30251b016c5631bb200d580ece891ff783d67930))
 * **vis:** drop native-binding wrapper; preserve indent in sort-package-json ([efcccb8](https://github.com/visulima/visulima/commit/efcccb8bedac2f7e7e0819b8eb12277e5bf71312))
+* **vis:** expose /config via folder barrel ([0cd155a](https://github.com/visulima/visulima/commit/0cd155a872dda22d201fd86f16f056dced9886be))
+* **vis:** expose VisConfig types and move RFC under rfc/ ([3baa115](https://github.com/visulima/visulima/commit/3baa1151b6ec5d611135cc77e1b39911a4592470))
+* **vis:** extract definePlugin and fix jiti temp config path under pnpm hoisting ([8cda079](https://github.com/visulima/visulima/commit/8cda079c22686121c966befb25295bc3511bf29b))
+* **vis:** extract tryLoadSourceMap helper ([5b06bb6](https://github.com/visulima/visulima/commit/5b06bb69876e4870e75985a75ff22e299c8cf583))
+* **vis:** fold vis json deps into vis list --deps --format=ndjson ([1d0c859](https://github.com/visulima/visulima/commit/1d0c85981b9b1db1a49a6932dd4986e1862f4725))
+* **vis:** humanizer formatBytes + remaining dlx gate review nits ([7e1495b](https://github.com/visulima/visulima/commit/7e1495b9ca962d2e4b4adbabf2f150830a1d3bda))
+* **vis:** import @visulima/tui components and hooks from subpaths ([2d9245d](https://github.com/visulima/visulima/commit/2d9245d81c9555b87c3803a428b1a306ae242da0))
+* **vis:** make defineConfig a pure typed-identity ([28f6f3f](https://github.com/visulima/visulima/commit/28f6f3f909a89103b972ca50a502fb6145d87794))
+* **vis:** migrate five pilot handlers to toolbox.fs ([97ca31c](https://github.com/visulima/visulima/commit/97ca31c9afa94a69449b03a4ba848104e9bd1ea3))
+* **vis:** migrate handlers to toolbox.fs ([e545a1e](https://github.com/visulima/visulima/commit/e545a1ee56b0464b8c90dfa42b7179400af58e83))
+* **vis:** migrate otel plugin to @opentelemetry/api types ([6440f20](https://github.com/visulima/visulima/commit/6440f201e5c15013a941f014fc4a979c80314bcf))
+* **vis:** mirror src/ layout in __tests__/ and lift __fixtures__ ([ddedc1b](https://github.com/visulima/visulima/commit/ddedc1bbf87d8e572e40cb6ad65452a947dac148))
+* **vis:** move git hooks dir from .vis-hooks to .vis/hooks ([b3cc45b](https://github.com/visulima/visulima/commit/b3cc45b9dd82bea9ab60fcd387a6c95833555a39))
+* **vis:** polish derivations across vis-* TUI apps ([47a7945](https://github.com/visulima/visulima/commit/47a79456341282f945689e40c8b174e92b8dc6df))
+* **vis:** read negative flags via cerebro's options.X === false idiom ([c52f39f](https://github.com/visulima/visulima/commit/c52f39f9294c42e69be2e4e3c327330875aef37b))
+* **vis:** read passthrough from toolbox.rawUnknown ([8d73d9c](https://github.com/visulima/visulima/commit/8d73d9c00924e02b98965d4cd89c8672a4fdffb8))
+* **vis:** reformat source for prettier line-length rules ([3809217](https://github.com/visulima/visulima/commit/3809217337a14f42220cfb48e3f5f75fa9c72163))
+* **vis:** regroup src into folders and reuse visulima primitives ([18250d7](https://github.com/visulima/visulima/commit/18250d7bd39bccfdccc9737e13a8b0e7c28ffca2))
+* **vis:** resolve fallow dead-code findings ([fd0c8ae](https://github.com/visulima/visulima/commit/fd0c8aed0126db0d4bfa6fb0acfcad2780d7f615))
+* **vis:** split hook/migrate/cache into nested cerebro commands ([42c04fc](https://github.com/visulima/visulima/commit/42c04fc90b16b1538eddb77cf00b1d5d20372dba))
+* **vis:** tighten verify+syncpack types from audit feedback ([277bf93](https://github.com/visulima/visulima/commit/277bf93f810e034c98b83c53a5ff09b7b4fe8688))
+* **vis:** tighten versionGroups remainder filter ([9965d34](https://github.com/visulima/visulima/commit/9965d34e5425d9307f1a2207058c3916d2b76cfb))
+* **vis:** unify path imports on @visulima/path ([06632ab](https://github.com/visulima/visulima/commit/06632aba64e0985bb24d476cbba7bebeebe08724))
+* **vis:** unify TUI style across run and update commands ([2c85520](https://github.com/visulima/visulima/commit/2c855204a1972596e079a42e12b3a79aba6c657c))
+* **vis:** update commands, TUI components, and project scaffolding ([26b40fb](https://github.com/visulima/visulima/commit/26b40fb3521411f750d176ad638c353bd7e36f44))
+* **vis:** use @visulima/fs helpers, remove compiled artifacts from src ([dc03e7c](https://github.com/visulima/visulima/commit/dc03e7c053e8d7fb747cde38924efce6f489ca7f))
 
 ### Tests
 
+* added more tests ([33f3f19](https://github.com/visulima/visulima/commit/33f3f191332ff9590d94ae543f3b7ef0b82de291))
+* fix failing and flaky package tests ([3f2894e](https://github.com/visulima/visulima/commit/3f2894e816e99f465abb0d3b7d5161af69bbb4ec))
+* **repo:** add dist runtime + types integration tests ([32ee300](https://github.com/visulima/visulima/commit/32ee300b7184117a0ddf9f9d390f75f8932d5ed9))
+* **repo:** cover bin entry points in dist integration suite ([7479ef1](https://github.com/visulima/visulima/commit/7479ef113cf5ccef25692619082afb1b6a0eecab))
+* **vis,task-runner:** address review on native benches ([f89dd33](https://github.com/visulima/visulima/commit/f89dd335d103744308a48568e49577d2019aca35))
+* **vis:** add 50 sample workspace packages for TUI testing ([579d05b](https://github.com/visulima/visulima/commit/579d05b46e2f5bad73297dfab823016663d3041e))
+* **vis:** add cli benchmark harness + codspeed wiring ([c3b1a79](https://github.com/visulima/visulima/commit/c3b1a79cc1814276e95b946d2d227f56942a48cf))
+* **vis:** add criterion transpile bench + harness docs ([fb34159](https://github.com/visulima/visulima/commit/fb341597b498916afb398bfc1be66944f2967c98)), closes [nubjs/nub#17](https://github.com/nubjs/nub/issues/17)
+* **vis:** add gated remote template integration test ([a626e56](https://github.com/visulima/visulima/commit/a626e5675630db044230400794a02d37ecbc0d31)), closes [visulima/visulima#alpha](https://github.com/visulima/visulima/issues/alpha)
+* **vis:** add tests for update command features and fix config tests ([52635db](https://github.com/visulima/visulima/commit/52635db43243e47f781bc8bd3e79d620b72ecfb5))
+* **vis:** align task-store tests with lazy failure rendering ([9ddf5de](https://github.com/visulima/visulima/commit/9ddf5de95a41d89b4c9a33bbb88e777b909b6aee))
+* **vis:** assert index excludes unstaged hunk on modify ([371063e](https://github.com/visulima/visulima/commit/371063ebc5fb2c4a90a3aa3cb377fdcc3d2d34ea))
+* **vis:** bump docker-lockfile prune test timeout for CI ([ef57ec2](https://github.com/visulima/visulima/commit/ef57ec21799b1158b972ff92568db111daa2e74f))
+* **vis:** bump loader-resolution timeout to 30s to survive suite contention ([17d738d](https://github.com/visulima/visulima/commit/17d738db8aee272fb9abbb40d0f2a094f16c5eae))
+* **vis:** cover custom-types format outputs ([b99ea50](https://github.com/visulima/visulima/commit/b99ea50a7b270bbc56984adf8a3f3c7b154559bb))
+* **vis:** cover dlx gatherPackageInfo ([f998e0b](https://github.com/visulima/visulima/commit/f998e0b3bb66042aac60eff312e948ab6604b837))
+* **vis:** cover docker scaffold with example workspace and real-lockfile fixture ([9104638](https://github.com/visulima/visulima/commit/910463861d1200773b163acdc8bff919e37d6b97))
+* **vis:** cover highlight-preservation on sort + symmetric newRef on min-age skip ([5d383c7](https://github.com/visulima/visulima/commit/5d383c70a16c1a3b2243cb3d4503a547036a0d7c))
+* **vis:** cover syncpack-parity features and wire --query into --deps ([f913f51](https://github.com/visulima/visulima/commit/f913f51ba78e427c57099c9819f3013c5c88231d)), closes [pnpm-workspace.yaml#overrides](https://github.com/visulima/pnpm-workspace.yaml/issues/overrides)
+* **vis:** fix toolchain corepack-suppression test on Windows ([32d532c](https://github.com/visulima/visulima/commit/32d532cc191d274f920e7b7ca3d0c90b0590abc1))
+* **vis:** fix two windows-only test failures ([6fd8467](https://github.com/visulima/visulima/commit/6fd84671a63d7ae2483bdc8db05fc65c0d9e30ab))
+* **vis:** fix windows timeout/EBUSY in release command suites ([a822cf7](https://github.com/visulima/visulima/commit/a822cf79a719fd0005ff7cda9ba81c9a2c9b7462))
+* **vis:** guard command-definition laziness against regressions ([25f438f](https://github.com/visulima/visulima/commit/25f438f5eda837ce63c2abacd8e5eb0561e7cabb))
 * **vis:** isolate host env in toolchain tests, fix assertion count ([d472635](https://github.com/visulima/visulima/commit/d4726350c3a68d574b08aff88369751f07216137))
+* **vis:** make 8.3 containment mock separator-agnostic ([c2cf820](https://github.com/visulima/visulima/commit/c2cf8208e43ad38f526b16f0546e5c45fddc94d6))
+* **vis:** make release path/shell-quote assertions OS-aware ([8280b28](https://github.com/visulima/visulima/commit/8280b288ccf63fe7181ace194c22390501d5e7b1))
+* **vis:** raise audit-offline gate to 5× budget for CI hosts ([345b159](https://github.com/visulima/visulima/commit/345b1590cd5f0fbe432855aafde8e7cb3ab19c84))
+* **vis:** raise testTimeout for Windows integration suites ([88117ba](https://github.com/visulima/visulima/commit/88117baa741da21a45698489d37855872db2cfa4))
+* **vis:** remove native binding guard from tests ([40e8707](https://github.com/visulima/visulima/commit/40e870700930b1284701d0a33a72e589e1d3facd))
 * **vis:** scope PATH in ensureToolchain engines-pnpm test ([ced1571](https://github.com/visulima/visulima/commit/ced157139ba8c6140b85a11d6c3655b2412620ac))
+* **vis:** scrub leaked GIT_* env vars in worktree fixture tests ([f066775](https://github.com/visulima/visulima/commit/f0667756c16cd3ad4e25541113e481966606fe62))
+* **vis:** skip docker-lockfile fixture suite in CI ([af7503e](https://github.com/visulima/visulima/commit/af7503eea3d76ace9b9703332456b771bfd91380))
+* **vis:** skip flaky windows-only release/staged suites with TODO ([c568088](https://github.com/visulima/visulima/commit/c5680882df82341ce2cca220972a09e1b030f2de))
+* **vis:** skip windows-deadlock release/commands suites ([1d48a62](https://github.com/visulima/visulima/commit/1d48a6272228629d95ec9620c6b7d0860a184cd3))
+* **vis:** split catalog.test.ts into per-area suites ([bedd877](https://github.com/visulima/visulima/commit/bedd877afa7efaf03586a8dff3037b5cb240f27f))
+* **vis:** use camelCase cacheDir key in cache verify tests ([5b08c11](https://github.com/visulima/visulima/commit/5b08c1116d97c45dd9eb2728b25bfd4b446614bf))
+* **vis:** use median-of-11 samples for audit-offline perf gate ([3225515](https://github.com/visulima/visulima/commit/3225515f9bf67149b8e0cb42812bc21729b6d750))
+
+### Build System
+
+* **deps:** update vis dependencies ([afac044](https://github.com/visulima/visulima/commit/afac044fecd71956199e0203e1e5a3d988c8a966))
+* regenerate bundled-license manifests and types ordering ([af26588](https://github.com/visulima/visulima/commit/af26588d75aaa937fd4862800560bd4070a4878c))
+* regenerate NAPI-RS bindings as ESM ([f202caf](https://github.com/visulima/visulima/commit/f202caf3dc383a2ec24815c4935d8d68c29f33d0))
+* switch NAPI-RS native builds to ESM output ([3d7cd61](https://github.com/visulima/visulima/commit/3d7cd615ad830392005915735c11771e0247ef3f))
+
+### Continuous Integration
+
+* distribute native artifacts for all three packages (task-runner, tui, vis) ([78760ec](https://github.com/visulima/visulima/commit/78760ec805ee4ed38a134ab18fa39b398527cef9))
+* **fallow:** make fallow:health advisory (--report-only) ([d57148e](https://github.com/visulima/visulima/commit/d57148ea0e3556b4c24d8d336b9fa14987f5dc7d))
+* tighten workflow yaml + restore missing publint dep ([b478f9a](https://github.com/visulima/visulima/commit/b478f9a9329d9c7243e694e3f360d385cc34567c))
+* **vis:** move schemas drift check out of vitest ([6da612b](https://github.com/visulima/visulima/commit/6da612bf459095777c163707747f6f0a29bf2fec))
+* **vis:** track index.d.ts so loader artifact survives cache hits ([b9a439f](https://github.com/visulima/visulima/commit/b9a439f178f1849cc14233ad76e51fe38e5d180f))
+
+
+### Dependencies
+
+* **@visulima/error:** upgraded to 6.0.0
+* **@visulima/secret-scanner:** upgraded to 1.0.0
+* **@visulima/source-map:** upgraded to 3.0.0
+* **@visulima/tabular:** upgraded to 4.0.0
+* **@visulima/task-runner:** upgraded to 1.0.0
+* **@visulima/tui:** upgraded to 1.0.0
+* **@visulima/ansi:** upgraded to 4.0.0
+* **@visulima/cerebro:** upgraded to 3.0.0
+* **@visulima/colorize:** upgraded to 2.0.0
+* **@visulima/find-ai-runner:** upgraded to 1.0.0
+* **@visulima/find-cache-dir:** upgraded to 3.0.0
+* **@visulima/fs:** upgraded to 5.0.0
+* **@visulima/humanizer:** upgraded to 3.0.0
+* **@visulima/interactive-manager:** upgraded to 1.0.0
+* **@visulima/package:** upgraded to 5.0.0
+* **@visulima/pail:** upgraded to 4.0.0
+* **@visulima/path:** upgraded to 3.0.0
+* **@visulima/redact:** upgraded to 3.0.0
+* **@visulima/spinner:** upgraded to 1.0.0
+* **@visulima/string:** upgraded to 3.0.0
+* **@visulima/tsconfig:** upgraded to 3.0.0
+
+## @visulima/vis [1.0.0-alpha.47](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.46...@visulima/vis@1.0.0-alpha.47) (2026-07-03)
+
+### Bug Fixes
+
+* **vis:** move default task cache out of source-bearing .vis/ ([b76ee30](https://github.com/visulima/visulima/commit/b76ee303c94eb69cccb40fe2f49afb8c7569630b))
+
+### Tests
+
+* **vis:** use camelCase cacheDir key in cache verify tests ([5b08c11](https://github.com/visulima/visulima/commit/5b08c1116d97c45dd9eb2728b25bfd4b446614bf))
+
+
+### Dependencies
+
+* **@visulima/secret-scanner:** upgraded to 1.0.0-alpha.8
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.26
+* **@visulima/find-ai-runner:** upgraded to 1.0.0-alpha.9
+
+## @visulima/vis [1.0.0-alpha.46](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.45...@visulima/vis@1.0.0-alpha.46) (2026-07-01)
+
+### Features
+
+* **vis:** release features + npm pretrust ([#719](https://github.com/visulima/visulima/issues/719)) ([c19a814](https://github.com/visulima/visulima/commit/c19a8142ccf0bc86ce232c9aaa7f79f3bf7c21f2))
+
+## @visulima/vis [1.0.0-alpha.45](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.44...@visulima/vis@1.0.0-alpha.45) (2026-06-30)
+
+### Bug Fixes
+
+* resolve eslint errors in fmt, jsdoc-open-api, vis ([43bf450](https://github.com/visulima/visulima/commit/43bf45081e46b042a08b555c3fcb60391b82d06f))
+* **vis:** disable class-methods-use-this for tui lifecycle ([182c972](https://github.com/visulima/visulima/commit/182c9727dcbef66a8609a864133fb2869bd2d9c4))
+* **vis:** drop pinned packageManager from release test fixtures ([d8c6a35](https://github.com/visulima/visulima/commit/d8c6a35326b12d5785cc8060a5aadb4cdc3d75be))
+* **vis:** stop corepack prompt hanging release pm probes ([ddb5f2d](https://github.com/visulima/visulima/commit/ddb5f2de908ffe187162ad13d3f1cd7024a4b6c8))
+* **vis:** stop Windows test hangs; start fallow dead-code cleanup ([e87ca70](https://github.com/visulima/visulima/commit/e87ca708223560775c2bd9ec7a59e1aa5853b5de))
+
+### Performance Improvements
+
+* **vis:** fast-path local .bin in exec command ([#716](https://github.com/visulima/visulima/issues/716)) ([dec9d37](https://github.com/visulima/visulima/commit/dec9d37829ded30c7be0c0c9d4649f726b8fbe94))
+
+### Styles
+
+* cs fixes ([2a960bb](https://github.com/visulima/visulima/commit/2a960bb1772c9dc70080e2d75d3a0d827034e294))
+
+### Miscellaneous Chores
+
+* add fallow code-intelligence across all packages ([a3b4821](https://github.com/visulima/visulima/commit/a3b48215002e86fed20f2973038b5d4a0aa1ce04))
+* **fallow:** resolve dead-code findings ([c4125d5](https://github.com/visulima/visulima/commit/c4125d53e03ac9d90115399634535991927a96cc))
+
+### Code Refactoring
+
+* address thermos code-quality findings ([392ed96](https://github.com/visulima/visulima/commit/392ed96b489b1c4df30157ad2f33fc9b3fd82fef))
+* **vis:** resolve fallow dead-code findings ([fd0c8ae](https://github.com/visulima/visulima/commit/fd0c8aed0126db0d4bfa6fb0acfcad2780d7f615))
+
+### Tests
+
+* fix failing and flaky package tests ([3f2894e](https://github.com/visulima/visulima/commit/3f2894e816e99f465abb0d3b7d5161af69bbb4ec))
+* **vis:** fix windows timeout/EBUSY in release command suites ([a822cf7](https://github.com/visulima/visulima/commit/a822cf79a719fd0005ff7cda9ba81c9a2c9b7462))
+
+### Continuous Integration
+
+* **fallow:** make fallow:health advisory (--report-only) ([d57148e](https://github.com/visulima/visulima/commit/d57148ea0e3556b4c24d8d336b9fa14987f5dc7d))
+
+
+### Dependencies
+
+* **@visulima/error:** upgraded to 6.0.0-alpha.35
+* **@visulima/tui:** upgraded to 1.0.0-alpha.27
+* **@visulima/ansi:** upgraded to 4.0.0-alpha.18
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.33
+* **@visulima/colorize:** upgraded to 2.0.0-alpha.15
+* **@visulima/fs:** upgraded to 5.0.0-alpha.33
+* **@visulima/package:** upgraded to 5.0.0-alpha.32
+* **@visulima/pail:** upgraded to 4.0.0-alpha.23
+* **@visulima/string:** upgraded to 3.0.0-alpha.18
+* **@visulima/tsconfig:** upgraded to 3.0.0-alpha.32
+
+## @visulima/vis [1.0.0-alpha.44](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.43...@visulima/vis@1.0.0-alpha.44) (2026-06-23)
+
+### Features
+
+* **vis:** native Rust CLI front-end + nub-parity for x/run ([#697](https://github.com/visulima/visulima/issues/697)) ([88d505b](https://github.com/visulima/visulima/commit/88d505bef74f08a895849e41f26682e684aa67be))
+* **vis:** task-runner feedback fixes + CI hook skip ([#696](https://github.com/visulima/visulima/issues/696)) ([450412c](https://github.com/visulima/visulima/commit/450412cb92eee1397edaa46447128b1487d06369))
+
+### Bug Fixes
+
+* **vis:** group failed tasks in ci log output ([0fb8678](https://github.com/visulima/visulima/commit/0fb8678d9b66c6b587fb113310cfe9abce9aa6d0))
+* **vis:** unbreak full build — exclude variable-import modules from dynamic-import-vars ([#712](https://github.com/visulima/visulima/issues/712)) ([29d46eb](https://github.com/visulima/visulima/commit/29d46eb719de11ab8f09e5303748264607b04fe3)), closes [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697) [#697](https://github.com/visulima/visulima/issues/697)
+* **vis:** wrap native crate-type array to satisfy toml lint rule ([9470654](https://github.com/visulima/visulima/commit/94706547342291197afb8babd5d2929ae9e0bb9b))
+
+### Documentation
+
+* **task-runner,vis:** add nub MIT attribution to ported native code ([9305f59](https://github.com/visulima/visulima/commit/9305f592da38dd13a179ef1af75fb0c8f5d84693))
+
+### Tests
+
+* **vis,task-runner:** address review on native benches ([f89dd33](https://github.com/visulima/visulima/commit/f89dd335d103744308a48568e49577d2019aca35))
+* **vis:** add criterion transpile bench + harness docs ([fb34159](https://github.com/visulima/visulima/commit/fb341597b498916afb398bfc1be66944f2967c98)), closes [nubjs/nub#17](https://github.com/nubjs/nub/issues/17)
+
+
+### Dependencies
+
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.25
+
+## @visulima/vis [1.0.0-alpha.43](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.42...@visulima/vis@1.0.0-alpha.43) (2026-06-20)
+
+### Features
+
+* **vis:** first-run info gate for visx/dlx ([53dd31e](https://github.com/visulima/visulima/commit/53dd31e39659d1281d8e94e174475e209bcb8b11))
+
+### Bug Fixes
+
+* **vis,secret-scanner:** windows absolute-path handling ([b1a3d67](https://github.com/visulima/visulima/commit/b1a3d673b3fe4f918c44b1cd33b62bf15d3687fc))
+* **vis:** address dlx first-run gate review comments ([6b833d1](https://github.com/visulima/visulima/commit/6b833d105f0827a3a41140e646d3b548509ccd2d))
+* **vis:** align native binding version check with package version ([4075bae](https://github.com/visulima/visulima/commit/4075bae7c37a4e34fc1416cba7bad1436e3f8090))
+* **vis:** expand windows 8.3 short names in workspace containment ([dbfe9b1](https://github.com/visulima/visulima/commit/dbfe9b152154b1f7526d7e0cbfd48cd0d94e6cc0))
+* **vis:** fix Windows-only release test failures ([158a6a3](https://github.com/visulima/visulima/commit/158a6a39a69d3a59bba9503c1fbcde19048378fc))
+* **vis:** harden dlx first-run gate per review ([a370a57](https://github.com/visulima/visulima/commit/a370a579c4df1f6852bd9591701ce85ff674401c))
+
+### Code Refactoring
+
+* **vis:** humanizer formatBytes + remaining dlx gate review nits ([7e1495b](https://github.com/visulima/visulima/commit/7e1495b9ca962d2e4b4adbabf2f150830a1d3bda))
+
+### Tests
+
+* **vis:** cover dlx gatherPackageInfo ([f998e0b](https://github.com/visulima/visulima/commit/f998e0b3bb66042aac60eff312e948ab6604b837))
+* **vis:** make 8.3 containment mock separator-agnostic ([c2cf820](https://github.com/visulima/visulima/commit/c2cf8208e43ad38f526b16f0546e5c45fddc94d6))
+* **vis:** make release path/shell-quote assertions OS-aware ([8280b28](https://github.com/visulima/visulima/commit/8280b288ccf63fe7181ace194c22390501d5e7b1))
+* **vis:** skip flaky windows-only release/staged suites with TODO ([c568088](https://github.com/visulima/visulima/commit/c5680882df82341ce2cca220972a09e1b030f2de))
+* **vis:** skip windows-deadlock release/commands suites ([1d48a62](https://github.com/visulima/visulima/commit/1d48a6272228629d95ec9620c6b7d0860a184cd3))
+
+## @visulima/vis [1.0.0-alpha.42](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.41...@visulima/vis@1.0.0-alpha.42) (2026-06-19)
+
+### Features
+
+* **vis:** runtime multi-tool ([#683](https://github.com/visulima/visulima/issues/683)) ([ee84daa](https://github.com/visulima/visulima/commit/ee84daa56434bfb487abccd27e9e2661c0492132))
+
+
+### Dependencies
+
+* **@visulima/error:** upgraded to 6.0.0-alpha.34
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.24
+* **@visulima/tui:** upgraded to 1.0.0-alpha.26
+* **@visulima/humanizer:** upgraded to 3.0.0-alpha.15
+
+## @visulima/vis [1.0.0-alpha.41](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.40...@visulima/vis@1.0.0-alpha.41) (2026-06-19)
+
+### Features
+
+* **vis:** add runtime detection abstraction (phase 0) ([8dca5b2](https://github.com/visulima/visulima/commit/8dca5b235e3f7427937f60e8ec13ab90e4c698af)), closes [#native](https://github.com/visulima/visulima/issues/native)
+* **vis:** add vis x file runner (phase 2) ([213fadf](https://github.com/visulima/visulima/commit/213fadf99f2de8126749c317ae3f002f174f39cc))
+* **vis:** route dlx/exec through the runtime resolver (phase 1) ([5186df4](https://github.com/visulima/visulima/commit/5186df43a850bc8b0642608643095faa8b1ebc6f))
+* **vis:** route install/add/remove/dedupe through runtime resolver (phase 1) ([8aaa3e1](https://github.com/visulima/visulima/commit/8aaa3e1d8f9ac73debfd6fc81808b570a25a1337))
+* **vis:** route remaining pm verbs through runtime resolver (phase 1) ([e18a44f](https://github.com/visulima/visulima/commit/e18a44f975ce6b744c5e6a9237e056de8a5f230e))
+* **vis:** validate runtime selection in run (phase 1) ([efaa952](https://github.com/visulima/visulima/commit/efaa95251519ad4ed3db77ed42421fd85756dbb2))
+
+### Bug Fixes
+
+* **vis:** regenerate vis-config schema for the runtime field ([1de4ef0](https://github.com/visulima/visulima/commit/1de4ef0f50b6620f981b081b6ff746306b948a76))
+
+### Performance Improvements
+
+* **vis:** skip heap-tuning re-exec for light commands (~290ms) ([885aebe](https://github.com/visulima/visulima/commit/885aebe0993210727f82918cb0474e14a8414ae6))
+
+### Documentation
+
+* **vis:** correct cold-start profile with measured findings ([d02a8c1](https://github.com/visulima/visulima/commit/d02a8c1f2212ce61a5ecf9f396976f1031996557))
+
+### Tests
+
+* **vis:** add cli benchmark harness + codspeed wiring ([c3b1a79](https://github.com/visulima/visulima/commit/c3b1a79cc1814276e95b946d2d227f56942a48cf))
+
+## @visulima/vis [1.0.0-alpha.40](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.39...@visulima/vis@1.0.0-alpha.40) (2026-06-17)
+
+### Features
+
+* **vis:** added --ignore-release-age ([1767805](https://github.com/visulima/visulima/commit/1767805cb2a46c135a33429edf764f6760737ffc))
+
+## @visulima/vis [1.0.0-alpha.39](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.38...@visulima/vis@1.0.0-alpha.39) (2026-06-16)
+
+### Bug Fixes
+
+* **vis:** reconcile run status-line task counts ([8ebee32](https://github.com/visulima/visulima/commit/8ebee32912227176ff1f361f37b2ea856d780895))
+
+## @visulima/vis [1.0.0-alpha.38](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.37...@visulima/vis@1.0.0-alpha.38) (2026-06-16)
+
+### Features
+
+* **vis:** release manager subsystem ([#679](https://github.com/visulima/visulima/issues/679)) ([0a41889](https://github.com/visulima/visulima/commit/0a418897062a164ad7e8034eab77a7f70a3817e1)), closes [#620](https://github.com/visulima/visulima/issues/620)
+
+## @visulima/vis [1.0.0-alpha.37](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.36...@visulima/vis@1.0.0-alpha.37) (2026-06-15)
+
+
+### Dependencies
+
+* **@visulima/tui:** upgraded to 1.0.0-alpha.25
+
+## @visulima/vis [1.0.0-alpha.36](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.35...@visulima/vis@1.0.0-alpha.36) (2026-06-13)
+
+### Features
+
+* **vis:** add git-history secret scanning via --history ([bf8b26c](https://github.com/visulima/visulima/commit/bf8b26c5990a7cc4f3630504f18c7cbc7c2e9372))
+* **vis:** add quiet-on-success run mode and harden spawn/history/hadolint ([9b6e3bf](https://github.com/visulima/visulima/commit/9b6e3bf7c764c0962d633bebdd6f16d2e3ae73ed))
+* **vis:** add split and import workspace commands ([#680](https://github.com/visulima/visulima/issues/680)) ([4077e1c](https://github.com/visulima/visulima/commit/4077e1c2d018c9e92f820f339967c1c583afd9b5))
+* **vis:** add toolbox-fs helper utilities ([f34f2aa](https://github.com/visulima/visulima/commit/f34f2aa7a38fec0e13b3b991a3221905d736c1da))
+
+### Bug Fixes
+
+* **vis:** dump successful task output after TUI exit ([ab51784](https://github.com/visulima/visulima/commit/ab517843910dadf543575c57466c5da01ef9401d))
+* **vis:** escape control chars in shell history ([86471d2](https://github.com/visulima/visulima/commit/86471d27d68d9790eae005e5d2dfe561efbae700))
+* **vis:** narrow secret-scanner baseline to string path in secrets handler ([9bc36e9](https://github.com/visulima/visulima/commit/9bc36e9e780a25d542417361d31403613d4c2c5a))
+* **vis:** use platform-aware PATH delimiter in toolchain detection ([0a1294f](https://github.com/visulima/visulima/commit/0a1294f3bcf9265e6908e15dfdcffb439b5f0e81))
+
+### Documentation
+
+* re-scope RFCs against what task-runner/vis already ship ([d6cf42c](https://github.com/visulima/visulima/commit/d6cf42c964b738c9872fb205b8c90b99bc7655e0))
+
+### Styles
+
+* **vis:** clear pre-existing eslint findings in run handler ([ba423ad](https://github.com/visulima/visulima/commit/ba423adad677c2a9ffb6051743e463a33cb44541))
+
+### Code Refactoring
+
+* **vis:** migrate five pilot handlers to toolbox.fs ([97ca31c](https://github.com/visulima/visulima/commit/97ca31c9afa94a69449b03a4ba848104e9bd1ea3))
+* **vis:** migrate handlers to toolbox.fs ([e545a1e](https://github.com/visulima/visulima/commit/e545a1ee56b0464b8c90dfa42b7179400af58e83))
+* **vis:** reformat source for prettier line-length rules ([3809217](https://github.com/visulima/visulima/commit/3809217337a14f42220cfb48e3f5f75fa9c72163))
+
+### Tests
+
+* **vis:** fix toolchain corepack-suppression test on Windows ([32d532c](https://github.com/visulima/visulima/commit/32d532cc191d274f920e7b7ca3d0c90b0590abc1))
+* **vis:** fix two windows-only test failures ([6fd8467](https://github.com/visulima/visulima/commit/6fd84671a63d7ae2483bdc8db05fc65c0d9e30ab))
+* **vis:** guard command-definition laziness against regressions ([25f438f](https://github.com/visulima/visulima/commit/25f438f5eda837ce63c2abacd8e5eb0561e7cabb))
+* **vis:** raise testTimeout for Windows integration suites ([88117ba](https://github.com/visulima/visulima/commit/88117baa741da21a45698489d37855872db2cfa4))
+* **vis:** split catalog.test.ts into per-area suites ([bedd877](https://github.com/visulima/visulima/commit/bedd877afa7efaf03586a8dff3037b5cb240f27f))
+
+### Build System
+
+* **deps:** update vis dependencies ([afac044](https://github.com/visulima/visulima/commit/afac044fecd71956199e0203e1e5a3d988c8a966))
+* regenerate bundled-license manifests and types ordering ([af26588](https://github.com/visulima/visulima/commit/af26588d75aaa937fd4862800560bd4070a4878c))
+
+
+### Dependencies
+
+* **@visulima/secret-scanner:** upgraded to 1.0.0-alpha.6
+* **@visulima/tabular:** upgraded to 4.0.0-alpha.14
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.23
+* **@visulima/tui:** upgraded to 1.0.0-alpha.24
+* **@visulima/ansi:** upgraded to 4.0.0-alpha.17
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.32
+* **@visulima/colorize:** upgraded to 2.0.0-alpha.14
+* **@visulima/error:** upgraded to 6.0.0-alpha.33
+* **@visulima/find-ai-runner:** upgraded to 1.0.0-alpha.8
+* **@visulima/find-cache-dir:** upgraded to 3.0.0-alpha.12
+* **@visulima/fs:** upgraded to 5.0.0-alpha.32
+* **@visulima/humanizer:** upgraded to 3.0.0-alpha.14
+* **@visulima/interactive-manager:** upgraded to 1.0.0-alpha.5
+* **@visulima/package:** upgraded to 5.0.0-alpha.31
+* **@visulima/pail:** upgraded to 4.0.0-alpha.22
+* **@visulima/path:** upgraded to 3.0.0-alpha.13
+* **@visulima/redact:** upgraded to 3.0.0-alpha.14
+* **@visulima/source-map:** upgraded to 3.0.0-alpha.12
+* **@visulima/spinner:** upgraded to 1.0.0-alpha.4
+* **@visulima/string:** upgraded to 3.0.0-alpha.17
+
+## @visulima/vis [1.0.0-alpha.35](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.34...@visulima/vis@1.0.0-alpha.35) (2026-06-09)
+
+### Features
+
+* **vis:** add run --hash-mode override flag ([b9c5efa](https://github.com/visulima/visulima/commit/b9c5efa05b9e9f142e8d52fa9d88ddac10d2d4f0))
+
+
+### Dependencies
+
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.22
+
+## @visulima/vis [1.0.0-alpha.34](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.33...@visulima/vis@1.0.0-alpha.34) (2026-06-08)
+
+### Features
+
+* **vis:** clean --empty-packages and staged per-package/cwd tasks ([cdba002](https://github.com/visulima/visulima/commit/cdba002af4714e3e74c1f832919855d0dd7f3a72)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+
+### Documentation
+
+* **vis:** correct and complete command reference ([b8c6c11](https://github.com/visulima/visulima/commit/b8c6c11e289c509a7d479e2371d8df63b710ce9b))
+
+### Miscellaneous Chores
+
+* **vis:** merge clean/staged/hooks/docs feature branch ([f61821d](https://github.com/visulima/visulima/commit/f61821d9fb0e7f36769025edaa1d73993bf91c54))
+
+### Code Refactoring
+
+* **vis:** move git hooks dir from .vis-hooks to .vis/hooks ([b3cc45b](https://github.com/visulima/visulima/commit/b3cc45b9dd82bea9ab60fcd387a6c95833555a39))
+
+## @visulima/vis [1.0.0-alpha.33](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.32...@visulima/vis@1.0.0-alpha.33) (2026-06-07)
+
+### Features
+
+* **task-runner:** warn when a cacheable task's inputs resolve to zero files ([3a4ecbb](https://github.com/visulima/visulima/commit/3a4ecbbef46b49afa4cb8b3e0b741fae0de42b3c))
+
+
+### Dependencies
+
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.21
+
+## @visulima/vis [1.0.0-alpha.32](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.31...@visulima/vis@1.0.0-alpha.32) (2026-06-07)
+
+### Bug Fixes
+
+* **vis:** forward config.namedInputs to the task runner ([02201de](https://github.com/visulima/visulima/commit/02201ded24b2881df8d6f7f0e6c573f4bd3123dc))
+
+## @visulima/vis [1.0.0-alpha.31](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.30...@visulima/vis@1.0.0-alpha.31) (2026-06-06)
+
+### Bug Fixes
+
+* **vis:** expand {projectRoot}/{projectName} tokens in task outputs ([d32a206](https://github.com/visulima/visulima/commit/d32a206dde082276f3fe06c032d07373a0c9a59e))
+
+
+### Dependencies
+
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.20
+
+## @visulima/vis [1.0.0-alpha.30](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.29...@visulima/vis@1.0.0-alpha.30) (2026-06-04)
+
+
+### Dependencies
+
+* **@visulima/tui:** upgraded to 1.0.0-alpha.23
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.31
+* **@visulima/fs:** upgraded to 5.0.0-alpha.31
+* **@visulima/package:** upgraded to 5.0.0-alpha.30
+* **@visulima/pail:** upgraded to 4.0.0-alpha.21
+* **@visulima/string:** upgraded to 3.0.0-alpha.16
+
+## @visulima/vis [1.0.0-alpha.29](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.28...@visulima/vis@1.0.0-alpha.29) (2026-06-04)
+
+### Features
+
+* **vis:** docker lint/init + ignore-file commands ([#675](https://github.com/visulima/visulima/issues/675)) ([f22c9f3](https://github.com/visulima/visulima/commit/f22c9f34304a41e257f9f0371d1aaa312f90df25))
+* **vis:** docker lint/init, ci-ignore, hadolint + toolbox DI ([#677](https://github.com/visulima/visulima/issues/677)) ([e5b5bd1](https://github.com/visulima/visulima/commit/e5b5bd164ed648341d4e1d655098b72bd040e4ed))
+
+### Bug Fixes
+
+* **vis:** 1 bug fix + 2 perf ([fdf3eb8](https://github.com/visulima/visulima/commit/fdf3eb86c19b471fd9891721e83fff7578df1da0))
+
+
+### Dependencies
+
+* **@visulima/secret-scanner:** upgraded to 1.0.0-alpha.5
+* **@visulima/tabular:** upgraded to 4.0.0-alpha.13
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.19
+* **@visulima/tui:** upgraded to 1.0.0-alpha.22
+* **@visulima/ansi:** upgraded to 4.0.0-alpha.16
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.30
+* **@visulima/colorize:** upgraded to 2.0.0-alpha.13
+* **@visulima/error:** upgraded to 6.0.0-alpha.32
+* **@visulima/find-ai-runner:** upgraded to 1.0.0-alpha.7
+* **@visulima/find-cache-dir:** upgraded to 3.0.0-alpha.11
+* **@visulima/fs:** upgraded to 5.0.0-alpha.30
+* **@visulima/humanizer:** upgraded to 3.0.0-alpha.13
+* **@visulima/interactive-manager:** upgraded to 1.0.0-alpha.4
+* **@visulima/package:** upgraded to 5.0.0-alpha.29
+* **@visulima/pail:** upgraded to 4.0.0-alpha.20
+* **@visulima/path:** upgraded to 3.0.0-alpha.12
+* **@visulima/redact:** upgraded to 3.0.0-alpha.13
+* **@visulima/source-map:** upgraded to 3.0.0-alpha.11
+* **@visulima/spinner:** upgraded to 1.0.0-alpha.3
+* **@visulima/string:** upgraded to 3.0.0-alpha.15
+
+## @visulima/vis [1.0.0-alpha.28](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.27...@visulima/vis@1.0.0-alpha.28) (2026-06-03)
+
+### Bug Fixes
+
+* **vis:** bundle react stack to dedupe react copies ([#672](https://github.com/visulima/visulima/issues/672)) ([fc35522](https://github.com/visulima/visulima/commit/fc35522a8414922c0b99a60c2f13d73e4767a6ac))
+* **vis:** resolve lint + Windows test failures from [#655](https://github.com/visulima/visulima/issues/655) ([#673](https://github.com/visulima/visulima/issues/673)) ([de2586d](https://github.com/visulima/visulima/commit/de2586dd1e04b8c61cc9f6fff05ecb666881253d))
+
+## @visulima/vis [1.0.0-alpha.27](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.26...@visulima/vis@1.0.0-alpha.27) (2026-06-02)
+
+### Features
+
+* **task-runner,vis:** per-task pty + concurrency weight, abort cache gate, fspy scaffolds ([#656](https://github.com/visulima/visulima/issues/656)) ([ca64010](https://github.com/visulima/visulima/commit/ca64010b236903e08273680ea65dec7046fcd18b))
+* **vis:** declarative task arguments + per-target script mode ([#662](https://github.com/visulima/visulima/issues/662)) ([417ca53](https://github.com/visulima/visulima/commit/417ca5395728a0776cbfcd0122ae21e3159a4c48))
+* **vis:** lint + fmt orchestrator ([3a78ed7](https://github.com/visulima/visulima/commit/3a78ed709922e6a35648e0d0eb3f41cc49f89b7a))
+
+### Bug Fixes
+
+* **task-runner:** tolerate dev-only dependency cycles ([#664](https://github.com/visulima/visulima/issues/664)) ([9ad384e](https://github.com/visulima/visulima/commit/9ad384e34927b40823ae104d6b05a581dcd05705)), closes [#411](https://github.com/visulima/visulima/issues/411)
+* **vis:** correct flag name in conflicting-schema error (--projects) ([#667](https://github.com/visulima/visulima/issues/667)) ([c56122b](https://github.com/visulima/visulima/commit/c56122bc6bc654e4a9e118e96b9ba852bc9b784f))
+* **vis:** require explicit opt-in to apply ecosystem updates ([#663](https://github.com/visulima/visulima/issues/663)) ([90cf12d](https://github.com/visulima/visulima/commit/90cf12dffa9dd53cc21849e9a41488dfbe2c8221))
+
+
+### Dependencies
+
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.18
+* **@visulima/tui:** upgraded to 1.0.0-alpha.21
+* **@visulima/error:** upgraded to 6.0.0-alpha.31
+* **@visulima/fs:** upgraded to 5.0.0-alpha.29
+* **@visulima/package:** upgraded to 5.0.0-alpha.28
+
+## @visulima/vis [1.0.0-alpha.26](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.25...@visulima/vis@1.0.0-alpha.26) (2026-05-29)
+
+### Bug Fixes
+
+* **vis:** isolate git env vars in staged integration tests ([18900a1](https://github.com/visulima/visulima/commit/18900a126bfb16f6d70ab81cbe5248720b03ac40))
+* **vis:** run persistent tasks under a PTY in the live TUI ([77b2a26](https://github.com/visulima/visulima/commit/77b2a263b9563f8ee894671f910e013f2c95077a))
+
+### Tests
+
+* **vis:** assert index excludes unstaged hunk on modify ([371063e](https://github.com/visulima/visulima/commit/371063ebc5fb2c4a90a3aa3cb377fdcc3d2d34ea))
+
+
+### Dependencies
+
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.29
+* **@visulima/pail:** upgraded to 4.0.0-alpha.19
+
+## @visulima/vis [1.0.0-alpha.25](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.24...@visulima/vis@1.0.0-alpha.25) (2026-05-27)
+
+### Features
+
+* **vis:** add GitLab and JUnit audit report formats ([18e8bc2](https://github.com/visulima/visulima/commit/18e8bc204cc5ce2bac8e83a043ede9cf51d57a70))
+* **vis:** audit hardening — ca-cert flag, dep-path walker, report parity ([eb187ab](https://github.com/visulima/visulima/commit/eb187ab4e9ee04357d142c438f428b556a68ff79))
+* **vis:** auto-update GitHub Actions, Docker, and GitLab CI references ([9a3c767](https://github.com/visulima/visulima/commit/9a3c7679c1aa981eb889250ddd841b6feb213b55))
+* **vis:** breaking-change UI + interactive picker for ecosystem updates ([75b7e33](https://github.com/visulima/visulima/commit/75b7e33eb9a460036cf8f8feff5197b1fb2db010))
+* **vis:** changelog URLs, docker min-age gate, action advisories, TUI sort ([23d65e1](https://github.com/visulima/visulima/commit/23d65e1f020dd723b900c5d25f9eb384be0bece8))
+* **vis:** honor project.json[#name](https://github.com/visulima/visulima/issues/name) as the workspace identity ([4a97c92](https://github.com/visulima/visulima/commit/4a97c9203df1398265196161213f1aa5736ea4c0)), closes [package.json#dependencies](https://github.com/visulima/package.json/issues/dependencies)
+* **vis:** migrate command handlers to toolbox.fs and toolbox.process ([c582c74](https://github.com/visulima/visulima/commit/c582c740150a7eab6b34e4eabe68f521471186c1))
+* **vis:** nx migrator hardening + smart --affected SHA resolution ([631351e](https://github.com/visulima/visulima/commit/631351ef32b9367a37c6ca0931673f0e08c103a9)), closes [VisConfig#defaultBase](https://github.com/visulima/VisConfig/issues/defaultBase)
+
+### Bug Fixes
+
+* add tabular to dep ([92d578e](https://github.com/visulima/visulima/commit/92d578e7e2ce558f5e8947bd1d9c2b1da879e351))
+* added tabular to the excluded packges ([20799d6](https://github.com/visulima/visulima/commit/20799d66f3cf73381b7fd3e7bd8776401eef399f))
+* **storage-client:** percent-encode user fields in defaultFingerprint ([7c78a0f](https://github.com/visulima/visulima/commit/7c78a0f9512e2a673b941d80839e9f1e86b7b5d0))
+* **task-runner:** resolve workspace .bin binaries in spawned tasks ([69bd30c](https://github.com/visulima/visulima/commit/69bd30c95fb1e70aba1f7c5b4d3d17b8f0465c11))
+* **vis:** address coderabbit feedback on ecosystem updates ([#654](https://github.com/visulima/visulima/issues/654)) ([049f0b4](https://github.com/visulima/visulima/commit/049f0b40aa890978b43104cd15f238800d62d981))
+* **vis:** address ecosystem-update review findings ([88ac870](https://github.com/visulima/visulima/commit/88ac8703eaab7ad9741aa94a4addf77d618a2464))
+* **vis:** bump stale workspace dep versions so Nx links them ([448ce87](https://github.com/visulima/visulima/commit/448ce87dd146bd696fd0cb0b5ad6deabb7ffc9d6))
+* **vis:** enhance PATH inside ephemeral service bootstrap config ([30c6364](https://github.com/visulima/visulima/commit/30c6364cceff0d3c48fe5e7e4a996b77a1ed224c))
+
+### Documentation
+
+* **vis:** mention ecosystem updates in README and ci-cd guide ([1577e95](https://github.com/visulima/visulima/commit/1577e95accc4a91a67ece2c7a25ad1a8b26bc784))
+
+### Miscellaneous Chores
+
+* refresh generated license bundles and disposable-domain stats ([a389f38](https://github.com/visulima/visulima/commit/a389f38484788aafa8ba9b698e2dd5805a982d98))
+* sorted package.json ([b47c545](https://github.com/visulima/visulima/commit/b47c545591600fdab17d5cd3a3fbc68b61e199da))
+* sorted package.json v2 ([70f0116](https://github.com/visulima/visulima/commit/70f01166709d5db1bd8cb309758e86edd4127eb5))
+* **vis:** regenerate vis-config.schema.json for defaultBase ([4a847e9](https://github.com/visulima/visulima/commit/4a847e9a7e193880546c295920c29b2c67265a16)), closes [VisConfig#defaultBase](https://github.com/visulima/VisConfig/issues/defaultBase)
+
+### Tests
+
+* **vis:** cover highlight-preservation on sort + symmetric newRef on min-age skip ([5d383c7](https://github.com/visulima/visulima/commit/5d383c70a16c1a3b2243cb3d4503a547036a0d7c))
+
+
+### Dependencies
+
+* **@visulima/secret-scanner:** upgraded to 1.0.0-alpha.4
+* **@visulima/tabular:** upgraded to 4.0.0-alpha.12
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.16
+* **@visulima/tui:** upgraded to 1.0.0-alpha.20
+* **@visulima/ansi:** upgraded to 4.0.0-alpha.15
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.28
+* **@visulima/colorize:** upgraded to 2.0.0-alpha.12
+* **@visulima/error:** upgraded to 6.0.0-alpha.30
+* **@visulima/find-cache-dir:** upgraded to 3.0.0-alpha.10
+* **@visulima/fs:** upgraded to 5.0.0-alpha.28
+* **@visulima/interactive-manager:** upgraded to 1.0.0-alpha.3
+* **@visulima/package:** upgraded to 5.0.0-alpha.27
+* **@visulima/pail:** upgraded to 4.0.0-alpha.18
+* **@visulima/path:** upgraded to 3.0.0-alpha.11
+* **@visulima/redact:** upgraded to 3.0.0-alpha.12
+* **@visulima/source-map:** upgraded to 3.0.0-alpha.10
+* **@visulima/spinner:** upgraded to 1.0.0-alpha.2
+* **@visulima/string:** upgraded to 3.0.0-alpha.14
+
+## @visulima/vis [1.0.0-alpha.24](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.23...@visulima/vis@1.0.0-alpha.24) (2026-05-26)
+
+### Features
+
+* **vis:** surface peer-dependency hint after install ([4a140b0](https://github.com/visulima/visulima/commit/4a140b0d8e80f3dda82d0af645272e1149867d02))
+
+### Miscellaneous Chores
+
+* **ci-stability:** green CI across vis, native, lint, tests, attw ([#651](https://github.com/visulima/visulima/issues/651)) ([d4eb684](https://github.com/visulima/visulima/commit/d4eb684b5f75c818c9251048c605a0ed54a268e3))
+* **repo:** apply eslint --fix and prettier --fix across packages ([#650](https://github.com/visulima/visulima/issues/650)) ([2e26a84](https://github.com/visulima/visulima/commit/2e26a84774f218f21345e9a8ecd68236b6542743)), closes [#620](https://github.com/visulima/visulima/issues/620)
+* **repo:** sort package.json keys across all packages ([e1fd9ab](https://github.com/visulima/visulima/commit/e1fd9ab467ef96a98c777da1572ff6a50fcf7e71))
+
+### Tests
+
+* **repo:** add dist runtime + types integration tests ([32ee300](https://github.com/visulima/visulima/commit/32ee300b7184117a0ddf9f9d390f75f8932d5ed9))
+* **repo:** cover bin entry points in dist integration suite ([7479ef1](https://github.com/visulima/visulima/commit/7479ef113cf5ccef25692619082afb1b6a0eecab))
+
+
+### Dependencies
+
+* **@visulima/error:** upgraded to 6.0.0-alpha.28
+* **@visulima/tui:** upgraded to 1.0.0-alpha.19
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.27
+* **@visulima/fs:** upgraded to 5.0.0-alpha.26
+* **@visulima/package:** upgraded to 5.0.0-alpha.25
+* **@visulima/pail:** upgraded to 4.0.0-alpha.17
+
+## @visulima/vis [1.0.0-alpha.23](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.22...@visulima/vis@1.0.0-alpha.23) (2026-05-20)
+
+### Features
+
+* **vis:** add dashboard command with browser UI for cache and run metrics ([f94fcd9](https://github.com/visulima/visulima/commit/f94fcd94ef04f74e20ce308769d79cbd21d9fd60))
+* **vis:** add HTML graph report ([92865a2](https://github.com/visulima/visulima/commit/92865a2973a36f8c43adaf023ecd68e3859d0c68))
+* **vis:** add visx/vx npx-style entry point ([3802695](https://github.com/visulima/visulima/commit/3802695f3a0cf2776aaf706183ed2032324532bd))
+* **vis:** rebuild dashboard with Hono SSE + Vite + shadcn/ui ([f9df814](https://github.com/visulima/visulima/commit/f9df814683c6a1c967d8cbe15bee1b13959b5ab7))
+* **vis:** redesign audit HTML report + add --explain AI helper ([6b0ab9f](https://github.com/visulima/visulima/commit/6b0ab9ffe36c732a4ac0c05a4ad9453d51fbe89b))
+* **vis:** redesign dashboard with Nothing-inspired UI ([7cfc81d](https://github.com/visulima/visulima/commit/7cfc81d8592cdfda0086700363dbeac39650d1d7))
+
+### Bug Fixes
+
+* **ci:** address review findings — injection, perms, defaults, fetch hardening ([0192278](https://github.com/visulima/visulima/commit/0192278b63a0178262c08a3d77fa0e832d085147))
+* **vis:** address audit findings on dashboard + visx + defineConfig refactor ([1eb8ae5](https://github.com/visulima/visulima/commit/1eb8ae5820d425780b9f5c05f153b68fe74a8a36))
+* **vis:** clean up dashboard audit nits — typos, dead code, redundant calls ([46a5c0e](https://github.com/visulima/visulima/commit/46a5c0ed8116f79c0307d51a1eb7c9d8ae419dde))
+* **vis:** harden dashboard server, metrics, and live UI ([be4c6a1](https://github.com/visulima/visulima/commit/be4c6a134410ef9e2b893d57ee6e2c1b163c4b88))
+* **vis:** key doctor cache on the resolved npm lockfile ([628a21d](https://github.com/visulima/visulima/commit/628a21d62285d6299fe399409783c297c64f9e1b))
+* **vis:** name the actual lockfile in npm pruner messages ([c783683](https://github.com/visulima/visulima/commit/c78368392930c3eafdb6e0c056535217665b2f07))
+* **vis:** prune npm-shrinkwrap.json into the Docker context ([ecfb54c](https://github.com/visulima/visulima/commit/ecfb54c7c515a14509c71458468c99c000b07d21))
+* **vis:** render task failure block lazily at the consumer ([cb35aa7](https://github.com/visulima/visulima/commit/cb35aa78550408b462e9a1ec2af3eddb65a27b87))
+
+### Miscellaneous Chores
+
+* ignore sample-workspace .vis dirs and refresh license artifact ([0f88438](https://github.com/visulima/visulima/commit/0f884380bcc7b25ac0beec5994256cc5b956a167))
+* **vis:** make sample-workspace tasks cacheable ([a1db143](https://github.com/visulima/visulima/commit/a1db143b57a594470b9bf5695c60a0ced18344e3))
+
+### Code Refactoring
+
+* **vis:** extract tryLoadSourceMap helper ([5b06bb6](https://github.com/visulima/visulima/commit/5b06bb69876e4870e75985a75ff22e299c8cf583))
+* **vis:** make defineConfig a pure typed-identity ([28f6f3f](https://github.com/visulima/visulima/commit/28f6f3f909a89103b972ca50a502fb6145d87794))
+
+### Tests
+
+* **vis:** align task-store tests with lazy failure rendering ([9ddf5de](https://github.com/visulima/visulima/commit/9ddf5de95a41d89b4c9a33bbb88e777b909b6aee))
+
+### Continuous Integration
+
+* tighten workflow yaml + restore missing publint dep ([b478f9a](https://github.com/visulima/visulima/commit/b478f9a9329d9c7243e694e3f360d385cc34567c))
+
+
+### Dependencies
+
+* **@visulima/error:** upgraded to 6.0.0-alpha.27
+* **@visulima/tui:** upgraded to 1.0.0-alpha.18
+* **@visulima/ansi:** upgraded to 4.0.0-alpha.14
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.26
+* **@visulima/fs:** upgraded to 5.0.0-alpha.25
+* **@visulima/package:** upgraded to 5.0.0-alpha.24
+
+## @visulima/vis [1.0.0-alpha.22](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.21...@visulima/vis@1.0.0-alpha.22) (2026-05-19)
+
+### Features
+
+* **task-runner:** auto-capture outputs for compound build scripts ([e084434](https://github.com/visulima/visulima/commit/e0844344cf184177999a82b708299f08fbfd31ec))
+* **task-runner:** per-target hashMode "trace" opt-in ([#643](https://github.com/visulima/visulima/issues/643)) ([32353ff](https://github.com/visulima/visulima/commit/32353ff7a760ae9486e23cc4042fab46a2f2cc11))
+* **vis:** add composite s1ngularity supply-chain marshall ([44cdeaf](https://github.com/visulima/visulima/commit/44cdeafb58eefcef061ffaab6822d4628cb06b2c))
+* **vis:** add deprecation + package-age marshalls ([5547840](https://github.com/visulima/visulima/commit/5547840b5aef9689f4080c77c44d3884309b0601))
+* **vis:** add deps.dev as supply-chain security provider alongside Socket ([7f752d2](https://github.com/visulima/visulima/commit/7f752d250fa3c96d2ec01ca58bddf911586ea949))
+* **vis:** add lockfile supply-chain verification ([a8c741d](https://github.com/visulima/visulima/commit/a8c741d80b52b275cde11be188ab22c41a11f5f4))
+* **vis:** add migrate verify-graph equivalence verification ([697e2c0](https://github.com/visulima/visulima/commit/697e2c0888c596e4bcee0a12922db76937a29175))
+* **vis:** add Snyk security provider ([aba3571](https://github.com/visulima/visulima/commit/aba35710719d1325b311bf80d81a91c91e75aa1f))
+* **vis:** add write guard, watchman backend, vcs hints ([5127d79](https://github.com/visulima/visulima/commit/5127d79ad2aa523760517601f71fdf38571ca4d3))
+* **vis:** attested keyless-signed remote cache (Sigstore) ([4732610](https://github.com/visulima/visulima/commit/47326103a668ab99fcfc4e21f2c9efeaa5892944))
+* **vis:** default inferTargets on with guarded script enrichment ([29cabd1](https://github.com/visulima/visulima/commit/29cabd1763ce915cbfa6aaa85b1c29a020d72b01))
+* **vis:** harden bootstrap installers + add lint CI ([49ec0a2](https://github.com/visulima/visulima/commit/49ec0a25e76ab5865cd2a2dce49413311fcf389c))
+* **vis:** integrate aube package manager + offline OSV bloom prefilter ([9513e09](https://github.com/visulima/visulima/commit/9513e0930c6fbcdb00e42df2ab9c650194a35eb4))
+* **vis:** scan npm-shrinkwrap.json with precedence ([ae907f1](https://github.com/visulima/visulima/commit/ae907f18e560eed7c80c7738650330909a254148))
+* **vis:** security check on by default for update, add --no-security ([e8db4c8](https://github.com/visulima/visulima/commit/e8db4c88a4c64038ca00c46b2a63083fee224637))
+* **vis:** source-mapped, code-framed task failure rendering ([95b2343](https://github.com/visulima/visulima/commit/95b2343d7299ab8537c5a4ef0205ddeee9146c58))
+
+### Bug Fixes
+
+* **vis:** harden marshall pipeline and failure-render ANSI stripping ([22dc431](https://github.com/visulima/visulima/commit/22dc431ac3e841a2a342f297673b4d5f1a0a8a43))
+* **vis:** make write guard github/gitlab asymmetry explicit ([0202fd9](https://github.com/visulima/visulima/commit/0202fd99e920173cbbb5e9711bb2df9528d25e42))
+* **vis:** parse pnpm v11 multi-document lockfiles ([94024b6](https://github.com/visulima/visulima/commit/94024b65310ab70ef4a3d4fed93f4987203f4a57))
+* **vis:** version the packument cache so stale entries can't blind marshalls ([6741f55](https://github.com/visulima/visulima/commit/6741f551ed9c1a28a2184672ed644dd06344c93b))
+* **vis:** wire s1ngularity into the vis inspect dispatch ([0e355eb](https://github.com/visulima/visulima/commit/0e355eb44acfcf50caf09f7b0954038def735278))
+
+### Documentation
+
+* **vis:** add MARSHALL_DISABLE_S1NGULARITY to shell-alias guide ([fee4979](https://github.com/visulima/visulima/commit/fee4979338cd255ee5c4ff1e52e99e545695e4d7))
+* **vis:** document lockfile supply-chain verification ([05c338f](https://github.com/visulima/visulima/commit/05c338f55f7069ed59018e64be3d24016ab3fb66))
+* **vis:** document s1ngularity marshall in add/update/inspect ([6a14d5c](https://github.com/visulima/visulima/commit/6a14d5c190a6125817abe9c3e35afde87893228a))
+
+### Styles
+
+* **vis:** prettier/eslint conformance sweep ([dd200bd](https://github.com/visulima/visulima/commit/dd200bd84c022f5fd8819ce23bab2c1c4cace1ed))
+
+### Miscellaneous Chores
+
+* **vis:** remove competitive-analysis and priority-roadmap docs ([3116348](https://github.com/visulima/visulima/commit/3116348a5f76772ace9f285d136d352a815c3f0a))
+
+
+### Dependencies
+
+* **@visulima/error:** upgraded to 6.0.0-alpha.26
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.15
+* **@visulima/tui:** upgraded to 1.0.0-alpha.17
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.25
+* **@visulima/fs:** upgraded to 5.0.0-alpha.24
+* **@visulima/package:** upgraded to 5.0.0-alpha.23
+
+## @visulima/vis [1.0.0-alpha.21](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.20...@visulima/vis@1.0.0-alpha.21) (2026-05-16)
+
+
+### Dependencies
+
+* **@visulima/tui:** upgraded to 1.0.0-alpha.16
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.24
+* **@visulima/fs:** upgraded to 5.0.0-alpha.23
+* **@visulima/package:** upgraded to 5.0.0-alpha.22
+
+## @visulima/vis [1.0.0-alpha.20](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.19...@visulima/vis@1.0.0-alpha.20) (2026-05-14)
+
+### ⚠ BREAKING CHANGES
+
+* **vis:** the following security.* keys were renamed:
+- security.minimumReleaseAge          -> security.policies.first_seen.minutes
+- security.minimumReleaseAgeExclude   -> security.policies.first_seen.exclude
+- security.trustPolicy                -> security.policies.publisher_change.mode
+- security.trustPolicyExclude         -> security.policies.publisher_change.exclude
+- security.trustPolicyIgnoreAfter     -> security.policies.publisher_change.ignoreAfter
+- security.allowBuilds                -> security.policies.install_scripts.allow
+- security.strictDepBuilds            -> security.policies.install_scripts.strict
+- security.socket.minimumScore        -> security.policies.score.minimum
+- security.socket.acceptedRisks       -> security.acceptedRisks
+- security.audit.failOn               -> security.policies.vulnerability.failOn
+- security.audit.usage                -> security.policies.vulnerability.usage
+
+AcceptedRisk now carries optional policies[] and expiresAt fields so
+risks can be scoped per-policy and time-boxed. Native PM sync writers
+keep emitting pnpm-native field names since pnpm owns that schema.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): address coderabbit review feedback
+
+- Add JSDoc to exported items across hook builtins, advisories, audit, docker
+- Document OSV `last_affected` inclusive-upper semantics with a focused test
+- Annotate NAPI u64→u32 truncations with JS Number range rationale
+- Switch vis-mcp tool payloads to zod schemas with `.catchall(z.unknown())`
+  so unknown CLI fields stay forward-compatible
+- Fence RFC code blocks with explicit languages and tidy hook-command
+  formatting (multi-line type, implicit-return arrows)
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): address second-round coderabbit feedback on policies rename
+
+- Drift report labels now reference `security.policies.*` paths so the
+  hint matches the keys users edit
+- `defineConfig` JSDoc examples use the new `security.policies` shape
+- `mergeSecurityDefaults` deep-merges every defaulted sub-policy
+  generically; `mergeVisConfigs` deep-merges `policies` and
+  `acceptedRisks` so presets aren't clobbered
+- Config-writer scopes its `allow:` match to follow an
+  `install_scripts:` opener
+- JSDoc clarifications for `audit.advisories.source` default,
+  `acceptedRisks.expiresAt`/`acceptedScore` ranges, `malware.mode`
+  cross-field default, and the current `policies.score.minimum`
+  wiring gap
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* chore(vis): finish coderabbit round-2 fixes — camelCase policies + wire score.minimum
+
+- Rename `PolicyName` union to camelCase (`firstSeen`, `installScripts`,
+  `publisherChange`, `unexpectedDeps`). Updates every consumer in src/,
+  test fixtures, schemas, and docs. JSON schema regenerated.
+- Add `types` mapping to the `#native` package.json import so TypeScript
+  resolves `index.d.ts` when consumers import the alias.
+- Thread `socketOptions.minimumScore` through `audit`, `doctor`, `check`,
+  `update`, `add`, `formatSecurityOverview`, `formatSummary`, and
+  `applyFilter`. `buildSocketOptions` now resolves the effective minimum
+  once (from `security.policies.score.minimum` or
+  `DEFAULT_LOW_SCORE_THRESHOLD`) so every consumer sees the same value
+  instead of comparing scores against the hard-coded constant.
+- Update the JSDoc on `policies.score.minimum` to reflect the new wiring.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* feat(vis): add Socket-style policy engine with 4 offline-clean policies
+
+Introduce a unified `evaluatePolicies()` engine under `src/security/policies/`
+with four offline-clean modules: license, install_scripts, vulnerability,
+and unexpected_deps (baseline mode). Each policy emits PolicyDecisions
+(block/warn/info) keyed by package, with per-policy accepted-risk scoping
+and expiresAt support reused from the shared matcher.
+
+Wires the engine into `vis audit`: a new `--policies <names>` flag
+(comma-list, `all`, or `none`) narrows evaluation. Block-severity
+decisions feed into `--exit-code` and `--fail-on`. JSON output gains
+`policies[]` + `summary.policyBlocks`. SARIF and HTML formatters render
+policy decisions alongside vulnerabilities; CSAF and CycloneDX-VEX are
+intentionally left untouched (vuln-specific data models).
+
+Adds `readNodeModulesManifests()` to walk `node_modules/` (including the
+pnpm `.pnpm/` content-addressed store) and surface license + scripts +
+maintainers metadata for the offline policies.
+
+33 new unit + integration tests; full vitest suite (3582/3582) green;
+`tsc --noEmit` clean.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* fix(vis): close three audit policy gating gaps surfaced by CodeRabbit
+
+- applyExitGate's fallthrough call to applyFailOnGate was dropping the
+  policyDecisions argument, so `vis audit --format sarif --fail-on high`
+  exited 0 when the only signal was a block-severity policy decision.
+  Forward the argument.
+- Unknown --policies tokens were silently swallowed when format was
+  json/sarif/csaf/cyclonedx-vex, so a typoed CI invocation reduced
+  enforcement with no log. Always emit the warning to stderr and
+  surface the tokens in JSON output as `warnings[]`.
+- Vulnerability-policy block decisions whose advisory was masked by
+  --severity used to exit 1 with no visible reason. Surface those
+  decisions in the human-readable "Policy Decisions" section so the
+  gate is always traceable.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+* fix(vis): correct npm/yarn min-release-age native config writers
+
+npm CLI types `min-release-age` as `Number` in days, not a duration string —
+vis wrote `48h`/`15m`, which npm's parseInt would silently read as 48/15 days.
+Write integer days rounded up so the native gate is never weaker than vis-config.
+
+Yarn Berry silently treats day suffixes in `npmMinimalAgeGate` as minutes
+
+### Features
+
+* **vis:** add LavaMoat allow-scripts parity (run/tripwire/--write/allowBins) ([84218d3](https://github.com/visulima/visulima/commit/84218d392abcde8d76b9b92de7d220be2b08e854))
+* **vis:** multi-source codeowners aggregation ([d22df81](https://github.com/visulima/visulima/commit/d22df81214899209be3fd9fa4d83372be97552ef))
+* **vis:** offline OSV scanner + unified security.policies ([#632](https://github.com/visulima/visulima/issues/632)) ([6461902](https://github.com/visulima/visulima/commit/646190243bf51bb6df172665d70fd501644e7bc3)), closes [#631](https://github.com/visulima/visulima/issues/631) [#631](https://github.com/visulima/visulima/issues/631) [yarnpkg/berry#6991](https://github.com/yarnpkg/berry/issues/6991)
+* **vis:** wire marshall env-var matrix into install/audit/check + add keys-refresh ([e1e2d6c](https://github.com/visulima/visulima/commit/e1e2d6c2dc81cfdf442b6f75b6497150b368565f))
+
+### Bug Fixes
+
+* **release:** patch NAPI version-check string and ship fresh loader on release ([0676e33](https://github.com/visulima/visulima/commit/0676e336f453c9ae38c9f3a5fbbb675f9bff7ea0))
+* **vis:** clear lint findings in hook dispatch, builtins, and util ([d05204c](https://github.com/visulima/visulima/commit/d05204c9a88d300b2b4ba3c2dd4169a9860a1d86))
+
+### Documentation
+
+* **vis:** add vltpkg/security-archive attribution ([019d6fd](https://github.com/visulima/visulima/commit/019d6fd4d4426991f2fb31450f72616b14874aff))
+
+### Miscellaneous Chores
+
+* fixed build ([ec156bf](https://github.com/visulima/visulima/commit/ec156bf08859e81186b74533610357d85c38f64e))
+* update license file ([8a84e10](https://github.com/visulima/visulima/commit/8a84e10f2077779159f2f1e186be1d461c47e043))
+* **vis:** apply prettier and eslint --fix sweep ([ec64552](https://github.com/visulima/visulima/commit/ec645524984f0e767ba63b3fcaaf60e184d31edf))
+* **vis:** clear remaining ESLint findings across marshalls and tests ([29f87c5](https://github.com/visulima/visulima/commit/29f87c56d8c4aadfe5e270e67901435af31b8eae))
+* **vis:** fix indent-binary-ops and silence default-log no-console ([9c8d5e1](https://github.com/visulima/visulima/commit/9c8d5e1cc07e6e5f3c01d0b79715f074dbda9b0b))
+* **vis:** style normalization sweep + scopedTasks/allowBins config fields ([ff97758](https://github.com/visulima/visulima/commit/ff977584da0afdf61d619b7a5fb7536f80c782a6))
+
+### Tests
+
+* **vis:** raise audit-offline gate to 5× budget for CI hosts ([345b159](https://github.com/visulima/visulima/commit/345b1590cd5f0fbe432855aafde8e7cb3ab19c84))
+* **vis:** use median-of-11 samples for audit-offline perf gate ([3225515](https://github.com/visulima/visulima/commit/3225515f9bf67149b8e0cb42812bc21729b6d750))
+
+### Continuous Integration
+
+* **vis:** track index.d.ts so loader artifact survives cache hits ([b9a439f](https://github.com/visulima/visulima/commit/b9a439f178f1849cc14233ad76e51fe38e5d180f))
+
+
+### Dependencies
+
+* **@visulima/secret-scanner:** upgraded to 1.0.0-alpha.3
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.14
+* **@visulima/tui:** upgraded to 1.0.0-alpha.15
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.23
+* **@visulima/colorize:** upgraded to 2.0.0-alpha.11
+* **@visulima/fs:** upgraded to 5.0.0-alpha.22
+* **@visulima/package:** upgraded to 5.0.0-alpha.21
+* **@visulima/pail:** upgraded to 4.0.0-alpha.16
+
+## @visulima/vis [1.0.0-alpha.19](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.18...@visulima/vis@1.0.0-alpha.19) (2026-05-11)
+
+### ⚠ BREAKING CHANGES
+
+* **vis:** replace prek runner with in-process hook dispatcher
+* **vis:** vis sbom now emits CycloneDX 1.7. Downstream consumers
+pinned to a 1.6 validator must upgrade.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+### Features
+
+* **vis:** bump sbom to cyclonedx 1.7 ([904075f](https://github.com/visulima/visulima/commit/904075fd9353e40b593d5a13f53307c584e31da7))
+* **vis:** replace prek runner with in-process hook dispatcher ([659ba07](https://github.com/visulima/visulima/commit/659ba07fc311c36783e8900188b9753276a961fe))
+
+
+### Dependencies
+
+* **@visulima/tui:** upgraded to 1.0.0-alpha.14
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.22
+* **@visulima/fs:** upgraded to 5.0.0-alpha.21
+* **@visulima/package:** upgraded to 5.0.0-alpha.20
+
+## @visulima/vis [1.0.0-alpha.18](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.17...@visulima/vis@1.0.0-alpha.18) (2026-05-11)
+
+### Features
+
+* **task-runner:** add resolveTurboEnvCompat helper ([a8e73ef](https://github.com/visulima/visulima/commit/a8e73ef324dd8d1bc1f1f471f59f9292f9f01745))
+* **vis:** add vis-mcp post-command promotion nudge ([9244fad](https://github.com/visulima/visulima/commit/9244fad8a8f9164ce99b2ab3cb771d53f926e788))
+* **vis:** expand secrets.config.presets to tag selectors ([77b8d2b](https://github.com/visulima/visulima/commit/77b8d2bbc951d5180753f37a45d2313c01fcf47f))
+* **vis:** honour TURBO_API/TURBO_TOKEN/TURBO_TEAM env vars ([0d4fc8c](https://github.com/visulima/visulima/commit/0d4fc8c1ad617ba27c436e40e520ddcbb19ebeca))
+* **vis:** show flakiness table on successful runs too ([085b219](https://github.com/visulima/visulima/commit/085b219a4472ceb0fd2f507c7bc3b3b1780a014a))
+* **vis:** surface retried-but-passed tasks and add CI log grouping ([2bdceaa](https://github.com/visulima/visulima/commit/2bdceaacf3f69c99a08c9e1b3b6eda0ee3528cd2))
+
+### Bug Fixes
+
+* **vis:** raise timeout for exposed-files preset tests to 15s ([433db73](https://github.com/visulima/visulima/commit/433db7319ecf4720664bc199582d571ea6a3630b))
+* **vis:** warm default ruleset for exposed-files preset tests ([9c76250](https://github.com/visulima/visulima/commit/9c76250d2ee6e8e2be878e5dcfb149d38126d60d))
+
+### Documentation
+
+* **vis:** mention TURBO_API fallback in help text and migrate hint ([f9bd7ac](https://github.com/visulima/visulima/commit/f9bd7acd7a53837e40376f9b0dcf54040bbc50a1))
+
+### Miscellaneous Chores
+
+* added fixtures to prettier ignore ([13bda29](https://github.com/visulima/visulima/commit/13bda2942d5d95fedeec7c07937fdfc37cf960c7))
+* **vis:** apply eslint and formatter sweep ([d3a48c5](https://github.com/visulima/visulima/commit/d3a48c577a77864b1aae52e6061a8aad1554f273))
+
+
+### Dependencies
+
+* **@visulima/secret-scanner:** upgraded to 1.0.0-alpha.2
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.13
+* **@visulima/tui:** upgraded to 1.0.0-alpha.13
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.21
+* **@visulima/fs:** upgraded to 5.0.0-alpha.20
+* **@visulima/package:** upgraded to 5.0.0-alpha.19
+
+## @visulima/vis [1.0.0-alpha.17](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.16...@visulima/vis@1.0.0-alpha.17) (2026-05-10)
+
+### Features
+
+* **vis:** expand typed plugin hook surface ([d0784df](https://github.com/visulima/visulima/commit/d0784df2b0c422002ec21c3c8da0002e0ff70dee))
+
+
+### Dependencies
+
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.12
+* **@visulima/tui:** upgraded to 1.0.0-alpha.12
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.20
+* **@visulima/fs:** upgraded to 5.0.0-alpha.19
+* **@visulima/package:** upgraded to 5.0.0-alpha.18
+
+## @visulima/vis [1.0.0-alpha.16](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.15...@visulima/vis@1.0.0-alpha.16) (2026-05-10)
+
+### Features
+
+* add service and tool projectType variants ([61858ad](https://github.com/visulima/visulima/commit/61858ad4c044b5f30318f282615c83f716667053)), closes [#21](https://github.com/visulima/visulima/issues/21)
+* **vis:** auto-start declared service deps for vis run with TUI dock ([adeb316](https://github.com/visulima/visulima/commit/adeb3164d29aec6da2eeed03d46fc0502aec5d6a))
+* **vis:** cross-PM dispatch for vis pm (yarn berry, pnpm 11, bun pm) ([fd56b86](https://github.com/visulima/visulima/commit/fd56b86317f4141227814504845f03ce777c0b88))
+* **vis:** expand nx migrator and add --force overwrite ([d6e5a91](https://github.com/visulima/visulima/commit/d6e5a91c4bc44a34dd770dd0b8298b5017bdd6df))
+* **vis:** prune workspace lockfile in docker scaffold ([d1c0904](https://github.com/visulima/visulima/commit/d1c090425d130b3e18b6e64e44fe81eb1e08b923))
+
+### Bug Fixes
+
+* **vis:** exit explicitly after cli.run settles ([2dc28e2](https://github.com/visulima/visulima/commit/2dc28e2d0d735526c9c551aeae72af63a2deee4d))
+* **vis:** release stdin and label persistent quits in dynamic TUI ([7350547](https://github.com/visulima/visulima/commit/7350547363fcbd4ec4d845d2194c22188605f34f))
+
+### Documentation
+
+* **vis:** document missing cache subcommands and run flags ([cf093a1](https://github.com/visulima/visulima/commit/cf093a1879ff414d0500ac91d76bba98352ed97e))
+
+### Miscellaneous Chores
+
+* **vis:** drop redundant section banners and pure-WHAT docblocks ([745844b](https://github.com/visulima/visulima/commit/745844b601cf111d362718611fa7021c19f2e939))
+* **vis:** finish .vis/ cutover for stragglers ([3053347](https://github.com/visulima/visulima/commit/30533478e084b9ae84aefe191d57c672ca0797fa))
+* **vis:** sort docker example api/package.json deps ([28fdbd7](https://github.com/visulima/visulima/commit/28fdbd780fb3384dcfc3f06db4145fafaeef52d2))
+
+### Code Refactoring
+
+* replace execa with tinyexec ([56ec776](https://github.com/visulima/visulima/commit/56ec776908fe0c068c54542f3885cb29f061fea7))
+* **vis:** consolidate workspace state under .vis/ ([9e89d52](https://github.com/visulima/visulima/commit/9e89d52f03cc8b3a6a51c13a2359e9b93532c1dd))
+* **vis:** extract definePlugin and fix jiti temp config path under pnpm hoisting ([8cda079](https://github.com/visulima/visulima/commit/8cda079c22686121c966befb25295bc3511bf29b))
+* **vis:** import @visulima/tui components and hooks from subpaths ([2d9245d](https://github.com/visulima/visulima/commit/2d9245d81c9555b87c3803a428b1a306ae242da0))
+* **vis:** polish derivations across vis-* TUI apps ([47a7945](https://github.com/visulima/visulima/commit/47a79456341282f945689e40c8b174e92b8dc6df))
+
+### Tests
+
+* **vis:** bump docker-lockfile prune test timeout for CI ([ef57ec2](https://github.com/visulima/visulima/commit/ef57ec21799b1158b972ff92568db111daa2e74f))
+* **vis:** cover docker scaffold with example workspace and real-lockfile fixture ([9104638](https://github.com/visulima/visulima/commit/910463861d1200773b163acdc8bff919e37d6b97))
+* **vis:** skip docker-lockfile fixture suite in CI ([af7503e](https://github.com/visulima/visulima/commit/af7503eea3d76ace9b9703332456b771bfd91380))
+
+
+### Dependencies
+
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.11
+* **@visulima/tui:** upgraded to 1.0.0-alpha.11
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.19
+* **@visulima/fs:** upgraded to 5.0.0-alpha.18
+* **@visulima/package:** upgraded to 5.0.0-alpha.17
+* **@visulima/string:** upgraded to 3.0.0-alpha.13
+
+## @visulima/vis [1.0.0-alpha.15](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.14...@visulima/vis@1.0.0-alpha.15) (2026-05-07)
+
+### Bug Fixes
+
+* moved deps to dev dep ([62a47f2](https://github.com/visulima/visulima/commit/62a47f29b182b202c9956819f3b4a32da38c14cd))
+
+
+### Dependencies
+
+* **@visulima/tui:** upgraded to 1.0.0-alpha.10
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.18
+* **@visulima/fs:** upgraded to 5.0.0-alpha.17
+* **@visulima/package:** upgraded to 5.0.0-alpha.16
+* **@visulima/pail:** upgraded to 4.0.0-alpha.15
+* **@visulima/redact:** upgraded to 3.0.0-alpha.11
+* **@visulima/string:** upgraded to 3.0.0-alpha.12
+
+## @visulima/vis [1.0.0-alpha.14](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.13...@visulima/vis@1.0.0-alpha.14) (2026-05-07)
+
+### Features
+
+* **vis:** add --peer and --include-internal flags to update and check ([900bbbe](https://github.com/visulima/visulima/commit/900bbbed6ec3611e993cf4fcc929c8b9b7cc7d60)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+
+### Bug Fixes
+
+* **vis:** apply pnpm !-exclusions and root .gitignore in workspace resolver ([b08a1be](https://github.com/visulima/visulima/commit/b08a1be4391e362dca4f935541362bae01b859d9)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+
+### Miscellaneous Chores
+
+* **vis:** bump example setup-wizard @inquirer/prompts to v8 ([1974734](https://github.com/visulima/visulima/commit/1974734c34d49c61ce62b663a999a6161e679251))
+* **vis:** bundle internal deps as devDeps and extend packem hoisted exclude ([9cd6cba](https://github.com/visulima/visulima/commit/9cd6cba0ed89e26b6def141433d024c7a5851578))
+
+### Code Refactoring
+
+* **vis:** centralize per-user filesystem layout in vis-paths helpers ([9a06751](https://github.com/visulima/visulima/commit/9a0675131e7da5bc338bcaf438574a4a5930d239))
+* **vis:** read negative flags via cerebro's options.X === false idiom ([c52f39f](https://github.com/visulima/visulima/commit/c52f39f9294c42e69be2e4e3c327330875aef37b))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.16
+* **@visulima/tui:** upgraded to 1.0.0-alpha.9
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.17
+* **@visulima/package:** upgraded to 5.0.0-alpha.15
+
+## @visulima/vis [1.0.0-alpha.13](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.12...@visulima/vis@1.0.0-alpha.13) (2026-05-06)
+
+
+### Dependencies
+
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.16
+* **@visulima/fs:** upgraded to 5.0.0-alpha.15
+* **@visulima/package:** upgraded to 5.0.0-alpha.14
+* **@visulima/pail:** upgraded to 4.0.0-alpha.14
+* **@visulima/tui:** upgraded to 1.0.0-alpha.8
+
+## @visulima/vis [1.0.0-alpha.12](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.11...@visulima/vis@1.0.0-alpha.12) (2026-05-06)
+
+### Features
+
+* **vis:** add --reverse for leaves-first task order ([9d02f37](https://github.com/visulima/visulima/commit/9d02f373ff08ed94c95055725ce43ed42ea8c9aa))
+* **vis:** add --skip-cache for selective per-task cache bypass ([28cfa7a](https://github.com/visulima/visulima/commit/28cfa7afc03ace27a4ff41746e91c70006cb9e9e))
+* **vis:** add corepack passthrough + unified dry/silent/env ([0ba38b2](https://github.com/visulima/visulima/commit/0ba38b297385497deb167efd03349f38ef1a7049)), closes [#6](https://github.com/visulima/visulima/issues/6) [#10](https://github.com/visulima/visulima/issues/10) [#11](https://github.com/visulima/visulima/issues/11)
+* **vis:** add custom-types lint for engines/packageManager/volta drift ([149455a](https://github.com/visulima/visulima/commit/149455a114b76c86ea12b7f271450297f38eeff6))
+* **vis:** add deno as first-class package manager + --auto-install-peers ([90d6d0f](https://github.com/visulima/visulima/commit/90d6d0fd98d531e1f76de42848da27605509f7d3))
+* **vis:** add sponsor notice after successful commands ([86ebd1c](https://github.com/visulima/visulima/commit/86ebd1c3270c3241c76577eae8bb889690b71e53))
+* **vis:** add syncpack migrate adapter and audit ([6e07ae8](https://github.com/visulima/visulima/commit/6e07ae86401f374d76206c81d1c6131bc08618e2))
+* **vis:** add task-level runner tags for capability-gated CI lanes ([8980e03](https://github.com/visulima/visulima/commit/8980e0319e99b4f79c5e049509d7dc2039f2092d))
+* **vis:** auto-generate JSON schemas from TypeScript types ([391a3f0](https://github.com/visulima/visulima/commit/391a3f0d253b3b55d02346bbb0dbeb061d8ec06f))
+* **vis:** close 7 syncpack-parity gaps ([85bc6b1](https://github.com/visulima/visulima/commit/85bc6b169fbc75cc4cc1b43b5bea85e673253f06)), closes [pnpm-workspace.yaml#overrides](https://github.com/visulima/pnpm-workspace.yaml/issues/overrides) [#623](https://github.com/visulima/visulima/issues/623) [#624](https://github.com/visulima/visulima/issues/624) [#625](https://github.com/visulima/visulima/issues/625) [#626](https://github.com/visulima/visulima/issues/626) [#627](https://github.com/visulima/visulima/issues/627) [#628](https://github.com/visulima/visulima/issues/628) [#629](https://github.com/visulima/visulima/issues/629)
+* **vis:** honor editorconfig in all JSON writers ([859e925](https://github.com/visulima/visulima/commit/859e92533d0349be37c1a750cb80582c14acb715))
+* **vis:** implement vis sync package-json-fields ([87e1fa1](https://github.com/visulima/visulima/commit/87e1fa11f2be741a768fe0c6c04238427823623a))
+* **vis:** port sherif lint rules and add migrate sherif command ([243324b](https://github.com/visulima/visulima/commit/243324b440a31831b6c6d93219d8cb3a3ab48495))
+* **vis:** scope banned-deps rules with packages/paths globs ([82fbaf2](https://github.com/visulima/visulima/commit/82fbaf2ffac946f032fc872ee2a428989ebf8c57))
+* **vis:** skip ignored paths in sort-package-json ([74215c0](https://github.com/visulima/visulima/commit/74215c06fd0e0f562b97e803a95b9e662e9980e2)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+* **vis:** surface leftover migration references in vis doctor ([ebd3a48](https://github.com/visulima/visulima/commit/ebd3a4841a736209cdbf2641ac6e27ec2e69f886))
+* **vis:** translate syncpack isBanned versionGroups to policy.bannedDeps ([f95d01b](https://github.com/visulima/visulima/commit/f95d01bda6a5add3f7fa0d48c1c955942b5c7fc3))
+* **vis:** user-defined customTypes for vis lint ([51fa21f](https://github.com/visulima/visulima/commit/51fa21f4193913f64e4abcd1dc9f97322dd21553))
+
+### Bug Fixes
+
+* **vis:** coalesce wheel-burst input and group sort-package-json TUI ([97aa78b](https://github.com/visulima/visulima/commit/97aa78bc445fc234e1473986a867e70f8d15d7b4))
+* **vis:** declare missing editorconfig field on VisConfig type ([4a33428](https://github.com/visulima/visulima/commit/4a334285b396ee41a1dbe507eb27fb2894055463))
+* **vis:** drop duplicate --no-color global option ([c50879a](https://github.com/visulima/visulima/commit/c50879a7ab2b195b4decf81d2cca5d3a39b8f137))
+* **vis:** harden extraTypes per review ([8b56f48](https://github.com/visulima/visulima/commit/8b56f48fce55ac133bd20f181133ad17e06a9825))
+* **vis:** hash expanded command so token-driven cache keys vary per affected set ([636b1ac](https://github.com/visulima/visulima/commit/636b1ac843381cf7df3fec844431ec0123b5f565))
+* **vis:** read bun minimumReleaseAge from bunfig.toml, not package.json ([78fe9f4](https://github.com/visulima/visulima/commit/78fe9f40452ddfc93d4bd3d66ec49f269b6085e6))
+* **vis:** replace editorconfig with ec4rs binding ([3a83ed0](https://github.com/visulima/visulima/commit/3a83ed0f9de3e4202dfa51cf9bf4e6d8c3b0134d))
+* **vis:** resolve tsc errors in create handler and watch keybinds ([033760d](https://github.com/visulima/visulima/commit/033760d83c8a7252dadbd716ecd04f80f54816e9))
+
+### Documentation
+
+* **vis:** add migration sources to credits section ([2caddce](https://github.com/visulima/visulima/commit/2caddcea6755bdc73780b559243cc27d4f2d48f7))
+* **vis:** document json deps, sync fields, post-sort flags ([d244ddd](https://github.com/visulima/visulima/commit/d244ddd2b2e88d53e756fef57e4024cd46a57430))
+* **vis:** document patchedDependencies supply-chain check ([b373960](https://github.com/visulima/visulima/commit/b373960d6d7dc38db9eeb8437cec33d47f9102ab))
+* **vis:** document vis lint and mark syncpack item 6 shipped ([73cbd44](https://github.com/visulima/visulima/commit/73cbd4457810a91ecce99856522904885e80c4d6))
+* **vis:** mark `${affected.files}` token wiring as shipped ([e4d306e](https://github.com/visulima/visulima/commit/e4d306e5ddd1eba30a404bf3d03efc5d976f0e9a)), closes [#6](https://github.com/visulima/visulima/issues/6)
+* **vis:** mark syncpack ports shipped, link [#622](https://github.com/visulima/visulima/issues/622) ([2fdb8de](https://github.com/visulima/visulima/commit/2fdb8de9d1b6946208a34a4da491918820f8c815))
+
+### Miscellaneous Chores
+
+* commit pnpm-lock and vis syncpack roadmap ([5138981](https://github.com/visulima/visulima/commit/5138981ee04b45900c6cf1ba41f8e18025d4ba63))
+* re-enable antfu/if-newline in vis and secret-scanner ([bcd84de](https://github.com/visulima/visulima/commit/bcd84de019b60f6bc474852e7ae6b7da822a9185))
+* re-enable jsdoc/match-description in api-platform and tighten config docs ([4ecaa31](https://github.com/visulima/visulima/commit/4ecaa315064cdd798af1ea1296be1fe52967bf9a))
+* **vis:** apply pending eslint autofixes and regenerate bundled licenses ([742c613](https://github.com/visulima/visulima/commit/742c61358fcc6b07a62f3c4f688320335aeca27b))
+* **vis:** apply prettier and eslint quote-style auto-fix ([f477246](https://github.com/visulima/visulima/commit/f47724629e5708ca45bb7891fdc03411088f0d00))
+* **vis:** apply prettier and eslint quote-style auto-fix ([915d80b](https://github.com/visulima/visulima/commit/915d80b4eca4e8da8ca36154a994f9048d1c1e28))
+* **vis:** clear all eslint warnings across vis package ([f0c513e](https://github.com/visulima/visulima/commit/f0c513ead5761ebba35379099bcfa50ee006e44f))
+* **vis:** commit pending lint+tsc fixes ([3d7a519](https://github.com/visulima/visulima/commit/3d7a5193f729e70444bdac983afdcf39828b4ad6))
+* **vis:** destructure runtime to satisfy prefer-destructuring in custom-types tests ([4802c91](https://github.com/visulima/visulima/commit/4802c912dda97ffd04182c1d9d4169c58b3c5aac))
+* **vis:** drop stale planning doc and exclude sherif-lint fixtures ([6002fd2](https://github.com/visulima/visulima/commit/6002fd273242f357eb8884a1d3cfe2526c769d61))
+* **vis:** enforce @stylistic/quotes — auto-fix 333 single→double quote sites ([b33bdcb](https://github.com/visulima/visulima/commit/b33bdcbb52ecba14b8088053df5653adba0b5b6e))
+* **vis:** fix lint errors ([0898454](https://github.com/visulima/visulima/commit/0898454c6119b2eaf77836015bc078a8afd2a1c0))
+* **vis:** housekeeping cleanup ([59a33fb](https://github.com/visulima/visulima/commit/59a33fba3ed65ae965b227d1e860e05e1b707bfa))
+* **vis:** remove ~10 eslint disables and fix mid-tier violations ([6a8a960](https://github.com/visulima/visulima/commit/6a8a960289c31d495cd3d37d2b28022516c02cd5))
+* **vis:** remove ~10 stale-zero/trivial eslint disables ([ffda729](https://github.com/visulima/visulima/commit/ffda72972a7d44d3b6eb2d1942897ff211811172))
+* **vis:** remove ~21 eslint disables and fix the violations ([6aec6e8](https://github.com/visulima/visulima/commit/6aec6e830c6e8816036f5dce8c6f57178f1e1af6))
+* **vis:** rename PascalCase TUI components to kebab-case ([3aaa398](https://github.com/visulima/visulima/commit/3aaa398125f722770c1b44d0edb45ddfec2d0802))
+
+### Code Refactoring
+
+* **vis:** drop --json alias from vis list, use --format=json ([30251b0](https://github.com/visulima/visulima/commit/30251b016c5631bb200d580ece891ff783d67930))
+* **vis:** fold vis json deps into vis list --deps --format=ndjson ([1d0c859](https://github.com/visulima/visulima/commit/1d0c85981b9b1db1a49a6932dd4986e1862f4725))
+* **vis:** tighten verify+syncpack types from audit feedback ([277bf93](https://github.com/visulima/visulima/commit/277bf93f810e034c98b83c53a5ff09b7b4fe8688))
+* **vis:** tighten versionGroups remainder filter ([9965d34](https://github.com/visulima/visulima/commit/9965d34e5425d9307f1a2207058c3916d2b76cfb))
+
+### Tests
+
+* **vis:** bump loader-resolution timeout to 30s to survive suite contention ([17d738d](https://github.com/visulima/visulima/commit/17d738db8aee272fb9abbb40d0f2a094f16c5eae))
+* **vis:** cover custom-types format outputs ([b99ea50](https://github.com/visulima/visulima/commit/b99ea50a7b270bbc56984adf8a3f3c7b154559bb))
+* **vis:** cover syncpack-parity features and wire --query into --deps ([f913f51](https://github.com/visulima/visulima/commit/f913f51ba78e427c57099c9819f3013c5c88231d)), closes [pnpm-workspace.yaml#overrides](https://github.com/visulima/pnpm-workspace.yaml/issues/overrides)
+
+### Continuous Integration
+
+* **vis:** move schemas drift check out of vitest ([6da612b](https://github.com/visulima/visulima/commit/6da612bf459095777c163707747f6f0a29bf2fec))
+
+
+### Dependencies
+
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.15
+* **@visulima/fs:** upgraded to 5.0.0-alpha.14
+* **@visulima/package:** upgraded to 5.0.0-alpha.13
+* **@visulima/pail:** upgraded to 4.0.0-alpha.13
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.10
+* **@visulima/tui:** upgraded to 1.0.0-alpha.7
+
+## @visulima/vis [1.0.0-alpha.11](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.10...@visulima/vis@1.0.0-alpha.11) (2026-05-04)
+
+### Features
+
+* **task-runner,vis:** cache restoration fidelity ([a15cb22](https://github.com/visulima/visulima/commit/a15cb22bde832cfe76ee017722b8b9f9102dac8f))
+* **task-runner:** add REAPI gRPC backend, cacheMode, and cache doctor ([03e6da9](https://github.com/visulima/visulima/commit/03e6da97beb84f6adc4a07a1c7ca4acf28be3b33))
+* **task-runner:** add URI-based input format ([050b583](https://github.com/visulima/visulima/commit/050b5838c15590a3ccba0ca99ad585cbabc36d99))
+* **vis:** add --json and --describe to vis generate ([396c89b](https://github.com/visulima/visulima/commit/396c89b29ddca99b01394508fda4b3d6b1804a3a))
+* **vis:** add `vis add --to <pkg>` auto-conforming to catalogs (syncpack[#285](https://github.com/visulima/visulima/issues/285)) ([03a5641](https://github.com/visulima/visulima/commit/03a56411fe88165395ec081f1d9caee2474fbf2a))
+* **vis:** add 33 inferTargets detectors ([b4b4684](https://github.com/visulima/visulima/commit/b4b468436ed2c48484ecbf69539b0121870fd124))
+* **vis:** add ai heal + heal accept commands ([3c6fa32](https://github.com/visulima/visulima/commit/3c6fa323c8133d95a17fe9bc19ffd3d8aeb37c4e))
+* **vis:** add Buildkite CI provider and `vis generate buildkite-ci` builtin ([845ac99](https://github.com/visulima/visulima/commit/845ac99a37dc9f280d5bba11aad4cf196cdaaebc)), closes [#19](https://github.com/visulima/visulima/issues/19)
+* **vis:** add Claude skill for vis-mcp consumption ([434ceb2](https://github.com/visulima/visulima/commit/434ceb2e8d6c49f31a3b7f84d45c35de247a4806))
+* **vis:** add discover-help subcommand, drop --format from ai root ([36d3990](https://github.com/visulima/visulima/commit/36d3990f7ee6368687af8151454a86181f188511))
+* **vis:** add replay + strict env, finish service registry ([c6db6d5](https://github.com/visulima/visulima/commit/c6db6d54688c43960b5aef9650b3bbc0292c0a58)), closes [#10](https://github.com/visulima/visulima/issues/10) [#16](https://github.com/visulima/visulima/issues/16) [#20](https://github.com/visulima/visulima/issues/20)
+* **vis:** inferred targets, preflight, services ([9697571](https://github.com/visulima/visulima/commit/96975719f12ccaf051452ecc60f07f1df0b5bc69)), closes [#11](https://github.com/visulima/visulima/issues/11) [#21](https://github.com/visulima/visulima/issues/21)
+* **vis:** list --targets table with type, cache, description ([a480e27](https://github.com/visulima/visulima/commit/a480e27a8d9a938a5225b9ebfda918de6c569f21)), closes [#22](https://github.com/visulima/visulima/issues/22) [#23](https://github.com/visulima/visulima/issues/23)
+
+### Bug Fixes
+
+* declare libc on linux binding subpackages ([078b31f](https://github.com/visulima/visulima/commit/078b31f1a9029487c86651e75ecdad70f02b37e8)), closes [npm/cli#4828](https://github.com/npm/cli/issues/4828)
+* **vis:** address review findings on services + inference ([c191cbc](https://github.com/visulima/visulima/commit/c191cbc3661a2885488daa44554b642e64785e52))
+* **vis:** preserve probe error on close failure and clamp formatAge ([f1d71d6](https://github.com/visulima/visulima/commit/f1d71d63a5432fc2ed8c09c9a0a87e4e59b83b0b))
+* **vis:** tighten update command view and reduce duplicated security warnings ([4002b43](https://github.com/visulima/visulima/commit/4002b4379aadd00bac5c5e3d9c4eb5796b9d7b3d))
+
+### Documentation
+
+* **vis:** add AI integration guide ([a6dbbe0](https://github.com/visulima/visulima/commit/a6dbbe0bf8c03519764ff41da9efdd4cb4439b77))
+* **vis:** add ai/list pages, stub 18 commands, refresh flags ([71b81ca](https://github.com/visulima/visulima/commit/71b81ca8704548bca0ec33437854476eb425c411))
+* **vis:** cover template introspection in AI guide and skill ([7763283](https://github.com/visulima/visulima/commit/7763283dfd0f94dc8ef25800fa9f48e6d7888c8e))
+
+### Miscellaneous Chores
+
+* catalog refresh + task-runner binding bump to 1.0.0-alpha.8 ([ff4548a](https://github.com/visulima/visulima/commit/ff4548a5678c992048a57e73c310757733c04756))
+* **deps:** bump rust crates to current majors ([3a1d9bb](https://github.com/visulima/visulima/commit/3a1d9bb7f6e2c6b2d3862e212ae62707d60815cc))
+* prettier sweep + catalog refresh ([5c7a610](https://github.com/visulima/visulima/commit/5c7a610d9b33d6df3eb3d3ba77b79759241ee1a4))
+
+### Code Refactoring
+
+* **task-runner,vis:** consolidate helpers and tighten branches ([d1290d1](https://github.com/visulima/visulima/commit/d1290d1f614036902c6803d8ff51df100fdd07ab))
+* **task-runner,vis:** expose worktree helpers from task-runner ([12468d7](https://github.com/visulima/visulima/commit/12468d76bb03278ec56691ba0c6d9821c9482f94))
+* **vis:** expose /config via folder barrel ([0cd155a](https://github.com/visulima/visulima/commit/0cd155a872dda22d201fd86f16f056dced9886be))
+* **vis:** migrate otel plugin to @opentelemetry/api types ([6440f20](https://github.com/visulima/visulima/commit/6440f201e5c15013a941f014fc4a979c80314bcf))
+* **vis:** mirror src/ layout in __tests__/ and lift __fixtures__ ([ddedc1b](https://github.com/visulima/visulima/commit/ddedc1bbf87d8e572e40cb6ad65452a947dac148))
+* **vis:** unify path imports on @visulima/path ([06632ab](https://github.com/visulima/visulima/commit/06632aba64e0985bb24d476cbba7bebeebe08724))
+
+
+### Dependencies
+
+* **@visulima/cerebro:** upgraded to 3.0.0-alpha.14
+* **@visulima/fs:** upgraded to 5.0.0-alpha.13
+* **@visulima/package:** upgraded to 5.0.0-alpha.12
+* **@visulima/task-runner:** upgraded to 1.0.0-alpha.9
+* **@visulima/tui:** upgraded to 1.0.0-alpha.6
+
+## @visulima/vis [1.0.0-alpha.10](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.9...@visulima/vis@1.0.0-alpha.10) (2026-04-30)
+
+### Features
+
+- **vis:** [@inherit](https://github.com/inherit) array merge sentinel ([c1334ab](https://github.com/visulima/visulima/commit/c1334ab75a84e12aa972aa1aba57ee74edbcc17d))
+- **vis:** add manual typosquat list and scoped brand-jacks ([1eaef11](https://github.com/visulima/visulima/commit/1eaef1154bb3ca18f09cebee290a9857c5171339))
+- **vis:** auto-recover orphaned runners via doctor --fix ([7c68a6e](https://github.com/visulima/visulima/commit/7c68a6e1fd163fdcfb2f4f663f78b5b81cf4df09))
+- **vis:** cache diagnostics, retention, and quiet output style ([9ec307b](https://github.com/visulima/visulima/commit/9ec307b06cec5c3114a6e70abbf1f2346ce61910))
+- **vis:** doctor checks for watch/signal runtime ([d7d53a7](https://github.com/visulima/visulima/commit/d7d53a7f520b64e72aa193e0beacf2722a82a6f4))
+- **vis:** finish vis-side when:/always:/tokens migration ([3c3c759](https://github.com/visulima/visulima/commit/3c3c75946d716efa5971f6cf1fa9ae8d139d9652))
+- **vis:** per-package vis.task.ts overlay ([14f6adf](https://github.com/visulima/visulima/commit/14f6adfc37b7ff552629309bd555d1fd3dd317f9)), closes [package.json#workspaces](https://github.com/visulima/package.json/issues/workspaces)
+- **vis:** rewrite doctor with TUI store and live scan progress ([84f4923](https://github.com/visulima/visulima/commit/84f492376ef9129781464b26a50b1954b7e3b206))
+- **vis:** secure-by-default install/add and lint cleanup ([28df4c4](https://github.com/visulima/visulima/commit/28df4c40504b7414460c57ef563593cfe14c5eeb))
+- **vis:** split ai into nested subcommands, add discovery, unify cache type filter ([51d2b5e](https://github.com/visulima/visulima/commit/51d2b5ee9fdfcee0cbd4d5e5b9f2f1d08f9ef2ea))
+- **vis:** support extends in vis.config.ts ([70d7b36](https://github.com/visulima/visulima/commit/70d7b36b362b0a7340e4717bdae12db355bf05e9))
+- **vis:** typed errors for vis config loader ([0dce143](https://github.com/visulima/visulima/commit/0dce143247ba695eb7fa46f3b59c709c473bdc57))
+- **vis:** watch keybinds and timeout escalation ([3181bb5](https://github.com/visulima/visulima/commit/3181bb50986b4d7e924a2d5b053a9883228ab08f))
+- **vis:** worktree-aware shared task cache with --scope flag ([4328542](https://github.com/visulima/visulima/commit/4328542a9abfa16a40fa62cfe9e8d688eb0d9d81))
+
+### Bug Fixes
+
+- **vis:** address review findings on watch UX bundle ([edee703](https://github.com/visulima/visulima/commit/edee7038fe23a488791682dd8ce5c469b40a3e8c))
+- **vis:** measure update list viewport for scrollbar ([4451cd3](https://github.com/visulima/visulima/commit/4451cd3726598ad1848c61800410f6d3146ec817))
+
+### Documentation
+
+- **vis:** document doctor command and Phase 2 watch/signal flow ([4e66350](https://github.com/visulima/visulima/commit/4e663505be135666757d9e90bbfd033f66466220)), closes [doctor#runtime](https://github.com/visulima/doctor/issues/runtime)
+- **vis:** document layered configuration ([9a0f303](https://github.com/visulima/visulima/commit/9a0f3037f94992887e3551fbcd72f2dc73260305))
+- **vis:** spec for layered configuration ([bcd830d](https://github.com/visulima/visulima/commit/bcd830dc9f1ed7e9dfc39f91649f839afe29bd87))
+
+### Miscellaneous Chores
+
+- **vis:** alphabetize VisConfig members in workspace.ts ([b7869a6](https://github.com/visulima/visulima/commit/b7869a650641a55d895dbf135bfec1a94f9f50e7))
+
+### Code Refactoring
+
+- **vis:** expose VisConfig types and move RFC under rfc/ ([3baa115](https://github.com/visulima/visulima/commit/3baa1151b6ec5d611135cc77e1b39911a4592470))
+- **vis:** regroup src into folders and reuse visulima primitives ([18250d7](https://github.com/visulima/visulima/commit/18250d7bd39bccfdccc9737e13a8b0e7c28ffca2))
+
+### Tests
+
+- added more tests ([33f3f19](https://github.com/visulima/visulima/commit/33f3f191332ff9590d94ae543f3b7ef0b82de291))
+- **vis:** scrub leaked GIT\_\* env vars in worktree fixture tests ([f066775](https://github.com/visulima/visulima/commit/f0667756c16cd3ad4e25541113e481966606fe62))
+
+### Dependencies
+
+- **@visulima/cerebro:** upgraded to 3.0.0-alpha.13
+- **@visulima/task-runner:** upgraded to 1.0.0-alpha.8
+
+## @visulima/vis [1.0.0-alpha.9](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.8...@visulima/vis@1.0.0-alpha.9) (2026-04-28)
+
+### Features
+
+- Add toolchain management with version manager detection and delegation ([#617](https://github.com/visulima/visulima/issues/617)) ([548b0e8](https://github.com/visulima/visulima/commit/548b0e8f9d59743be25abb97b5de3fdbeb681bd6))
+- **vis:** add aube as default installer with PM fallback ([79a9933](https://github.com/visulima/visulima/commit/79a99333c0e73e69f375b36c56e40b2693dc4c90))
+- **vis:** add ignore/sortOrder/unsorted/finalNewline/lineEnding to sort-package-json ([50f68df](https://github.com/visulima/visulima/commit/50f68dfc2bc31c082ef98b3ddcf73d3dee0cc080))
+- **vis:** interactive TUI for bare `vis migrate` ([2171441](https://github.com/visulima/visulima/commit/217144190520447ba9fbe66a9a8f0c452469151e))
+
+### Bug Fixes
+
+- fixed spacing ([1544af2](https://github.com/visulima/visulima/commit/1544af21294edaaf5799846e6c6063c86def3d29))
+- **vis:** use default colorize import ([2b95ad2](https://github.com/visulima/visulima/commit/2b95ad28207e699161ed201a43f175a630a06c61))
+
+### Miscellaneous Chores
+
+- added missing version key ([036d86e](https://github.com/visulima/visulima/commit/036d86e6cfa078e4f651327f630cec721f1bbc47))
+- **vis:** upgrade packem to 2.0.0-alpha.76 ([9753759](https://github.com/visulima/visulima/commit/97537598a23a4f680e332ca2ea73ad64f301252a))
+
+### Code Refactoring
+
+- **vis:** adopt cerebro lazy commands; split each command into folder ([e1efc0f](https://github.com/visulima/visulima/commit/e1efc0fe57e39433c33c50b1ad2c9e971ea596ba))
+- **vis:** drop native-binding wrapper; preserve indent in sort-package-json ([efcccb8](https://github.com/visulima/visulima/commit/efcccb8bedac2f7e7e0819b8eb12277e5bf71312))
+
+### Tests
 
+- **vis:** isolate host env in toolchain tests, fix assertion count ([d472635](https://github.com/visulima/visulima/commit/d4726350c3a68d574b08aff88369751f07216137))
+- **vis:** scope PATH in ensureToolchain engines-pnpm test ([ced1571](https://github.com/visulima/visulima/commit/ced157139ba8c6140b85a11d6c3655b2412620ac))
 
 ### Dependencies
 
-* **@visulima/cerebro:** upgraded to 3.0.0-alpha.12
-* **@visulima/tui:** upgraded to 1.0.0-alpha.5
+- **@visulima/cerebro:** upgraded to 3.0.0-alpha.12
+- **@visulima/tui:** upgraded to 1.0.0-alpha.5
 
 ## @visulima/vis [1.0.0-alpha.8](https://github.com/visulima/visulima/compare/@visulima/vis@1.0.0-alpha.7...@visulima/vis@1.0.0-alpha.8) (2026-04-22)