@xingular/harness 2.0.0 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -2,6 +2,12 @@
2
2
 
3
3
  ## Unreleased
4
4
 
5
+ ## 2.1.0 - 2026-10-19
6
+
7
+ - Add per-request plan mode to SDK session runs: instructions arrive as a dynamic context update, and the tool gate refuses calls outside the read-only set. The terminal uses `/plan`, `/plan on`, and `/plan off` to narrow its active tools.
8
+ - Add bounded, UTF-8-safe Hub payload previews, explicit installed/changed/incomplete receipt states, and receipt-scoped uninstall that removes owned resources, including local edits within those paths.
9
+ - Highlight recognized leading slash commands in the terminal composer with the selected theme's link color, including enabled `/skill:name` invocations; unknown commands remain plain.
10
+
5
11
  ## 2.0.0 - 2026-10-18
6
12
 
7
13
  - Let a connected app sign in with an OAuth client the application registered itself (`oauthClient: 'app'`), supplied through `HarnessOptions.oauthClients` and never stored; `connections.appClients` reports which catalog entries a build can sign in for. See [ADR-0005](docs/decisions/ADR-0005-app-provided-oauth-clients.md).
package/README.md CHANGED
@@ -348,14 +348,18 @@ Node 22.19 or newer.
348
348
  `xingular-harness hub list [--refresh]`, `hub show publisher/name@version`, and
349
349
  `hub install publisher/name@version` browse and install exact catalog versions. `/hub` offers the
350
350
  same review in the interactive terminal, using its private control key for installation. Both the
351
- terminal and embedding applications use `hub.list`, `hub.get`, `hub.install`, and `hub.readDocument`.
352
- `hub.get { id, version, preview: true }` verifies data payload bytes without installing them.
351
+ terminal and embedding applications use `hub.list`, `hub.get`, `hub.preview`, `hub.install`,
352
+ `hub.uninstall`, and `hub.readDocument`. `hub.get { id, version, preview: true }` verifies data
353
+ payload bytes without installing them. `hub.preview { id, version, offset }` returns bounded,
354
+ UTF-8-safe pages of up to 16 KiB from a verified payload.
353
355
 
354
356
  Registry bundles import complete skills or single Markdown prompts/rules, disabled. Pi packages
355
357
  reuse the existing installer and require an exact npm version or full GitHub commit. Documents
356
358
  are saved as inert JSON for a compatible host to interpret; the harness does not apply them.
357
359
  Installation grants no attachment, trust, credentials, or permission. Writes are serialized and
358
- existing registry files are never overwritten.
360
+ existing registry files are never overwritten. Receipts report whether their resources are intact;
361
+ uninstall removes only the exact receipt's resources, including local edits within those paths, and
362
+ revokes its attachment choices.
359
363
 
360
364
  Installed documents and provenance live under `<data root>/hub/`; the catalog cache is
361
365
  `<state dir>/hub/catalog.json`. An offline snapshot ships with the package. Explicit refresh keeps