create-harness-vibe-coding 0.8.19 → 0.9.3

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## [0.9.3] - 2026-09-13
+
+- Add `/wf-search` as a direct, cross-runtime evidence-backed research command with fact, verify, compare, and troubleshoot modes.
+- Add stateless ledger validation and Markdown rendering with bounded search/read budgets, citation integrity, uncertainty handling, URL normalization, and safe escaping.
+- Add project/global runtime discovery, optional controller-only save targets, task evidence indexing, and protection for `Harness/research/search/**` during updates and removal.
+- Register the command across Claude Code, OpenCode, and Codex compatibility surfaces with mirrored Skill references and installation coverage.
+- Preserve the verified wf-ui runtime and agent-terminal behavior while extending the release checks for the new command.
+
+## [0.9.2] - 2026-09-09
+
+- Bind dispatched progress and result reporting to the service-issued worker capability and the current dispatch attempt, preserving canonical request/reply correlation and rejecting caller-forged identity.
+- Add native-first runtime model capability checks with explicit operator-configured extensions, exact provider/model identity, and fail-closed unverified or unavailable outcomes without silent model substitution.
+- Preserve requested effort and provider-native variants across PTY and structured chat launch/retry paths for Codex app-server, Claude stream-json, and OpenCode server adapters, with settings declarations protected from ordinary HTTP mutation.
+- Keep wf-ui agent-terminal and detached-backend handoff behavior covered by the release checks while retaining the existing ConPTY cleanup path.
+- Add bounded task-context, memory, research-policy, and route-budget regression checks with self-contained test fixtures; the observed cache route remains guarded by the frozen 36,000-byte limit.
+- Candidate verification remains bounded: the remaining intelligence goals, fresh-provider coverage, and real post-release benchmark are not claimed complete by this release entry.
+
+## [0.9.1] - 2026-09-08
+
+- Unify task lifecycle around `active`, `blocked`, and `closed`, while preserving compatibility with legacy task statuses and allowing multiple open tasks with one deterministic active focus.
+- Make explicit `/wf` and `/wf-max` task ownership sticky across sessions; direct, `wf-auto`, `wf-auto-spark`, `wf-review`, and `wf-browser` tasks remain outside the durable WF lifecycle unless explicitly entered with WF.
+- Add project-level task grouping, tags, dates, dependency-aware routing, `INDEX.json`/`INDEX.md`, and queryable task views so agents can load the relevant project context on demand.
+- Update wf-ui project and task views to expose active-task focus, WF-managed resume state, project counts, and task metadata without introducing a second persistence layer.
+- Simplify the Skills Hub surface by removing the unstable Market/install panel from the primary workflow view while retaining the standalone market module for compatibility.
+- Harden `wf-learn` as a command contract: load the routed memory first, separate instance facts from reusable methods, and require a `Probe -> Identify -> Act -> Verify` workflow with counterexample checks to prevent overfitting.
+- Keep `wf-review` on native Harness review agents with bounded fan-out and cross-review evidence, without delegating review execution to external CLI helpers.
+
+## [0.8.21] - 2026-08-28
+
+- Add global-first install flow: `npm i -g create-harness-vibe-coding` once per machine, then `create-harness-vibe-coding init .` (or the new `/wf-init` direct command) per project; the global runtime is the single version source of truth and each project keeps only bridge docs plus its own state. `init --scope project` keeps the classic full project-level install for self-contained repos.
+- Slim the npm package from 17.9 MB to 7.8 MB by shipping without frontend sourcemaps and dev-only UI sources; the wf-ui runtime bundle keeps full functionality.
+- Make the startup update hook silent for patch-only releases (x.y.Z): only major and minor updates prompt the user to run `/wf-update`; unparseable versions still fail open with a notice.
+
+## [0.8.20] - 2026-08-28
+
+- Ship the wf-ui workflow canvas as a full agent-team surface: goal, event, timer, display, and capability node types with typed action surfaces, skills hub, magnetic docking, and undoable versioned graph edits.
+- Add agent team cooperation: structured peer requests with request ids, timer wakeup delivery, runtime-aware role profiles, and a subagent strategy matrix covering built-in helpers and visible wf-node agents with depth resume docking.
+- Consolidate all agent actions into a single `Harness/a2a/action-registry.json` source of truth (72 actions) with loader validation, derived `help --json`/`manuals` surfaces, and structural anti-drift tests against ghost/phantom actions.
+- Upgrade the file node with xlsx/pdf/zip format adapters, preview caching, write locks, `file.changed` watch broadcasts, and security hardening (Zip Slip guards, entry/size clamps, per-page PDF reads).
+- Rebuild markdown rendering on a shared markdown-it pipeline with lazy CDN mermaid (SRI-pinned, offline fallback), KaTeX, GFM task lists, and preview toggles for node cards, file big view, and the fullscreen editor.
+- Add task capsule groups with `--group`/`--by-group` filtering and whole-group batch archive, plus a task group index for grouped overviews.
+- Add real PTY-backed chat sessions (chat driver, Claude stream-json support, WS chat events) alongside terminal-based agent control.
+- Harden wf-ui terminal orchestration: full terminal input control, Codex rollout-id capture via PTY scan and sessions-dir polling, PTY resource usage reporting, and per-session terminal transcript ranges.
+- Fix `/wf-ui` direct command startup by adding detached server handoff, so OpenCode command timeouts do not stop the local control panel.
+- Preserve Agent terminal output when the drawer is minimized and restored by keeping the xterm instance mounted and replaying only missing terminal history.
+- Harden Windows PTY launch under detached UI servers by using the bundled ConPTY cleanup path by default, avoiding `AttachConsole failed` noise from the Homebridge PTY helper.
+- Detect Codex CLI update menus inside Harness-managed PTY sessions and let the wf-ui terminal prompt the user to skip this session or skip until the next version.
+- Add wf-ui storage cleanup controls for stopped session logs and detached launch temp logs, with retention settings and safer workflow node hover feedback.
+
 ## [0.8.19] - 2026-07-30
 
 - Publish `$wf-ui` as the Harness control panel with task capsule observability, agent workflow hierarchy, runtime detection, real PTY-backed detected CLI launches, and multi-terminal peer sessions.

package/README-CN.md

@@ -56,7 +56,7 @@ Agent 读取本 README 后，按项目状态选择路径：
 | 已有 `Harness/` 但缺少 `Harness/scripts/wf-update-check.mjs` | `npx create-harness-vibe-coding@latest my-project . -y --on-conflict skip --json`。然后执行 `node Harness/scripts/wf-update-check.mjs --json` |
 | 安装或更新完成 | `node Harness/scripts/validate-harness.mjs --strict` |
 
-安装范围：默认是项目内安装。要写入一份机器级共享 runtime，用 `--install-scope global --global-dir <dir>`；commands/skills/agents 会以 copy 方式写入 Claude Code、Codex、OpenCode 的全局可发现目录，但每个项目自己的 `Harness/tasks/`、`Harness/PROGRESS.md`、项目 memory、项目事实和项目 settings 仍然留在项目内。
+安装范围：推荐全局优先。每台机器先执行一次 `npm i -g create-harness-vibe-coding`，然后在每个项目里运行 `create-harness-vibe-coding init .`（或 `/wf-init` 命令）。全局 runtime 是唯一的版本基准：commands、skills、agents、scripts 和 wf-ui 服务/资源都只在全局装一份，所有项目共享同一版本更新。每个项目只保留桥接文件（CLAUDE.md、AGENTS.md）和自己的状态（`Harness/tasks/`、`Harness/PROGRESS.md`、项目 memory、项目事实和项目 settings）。上表的项目内安装仍然可用；`--install-scope global --global-dir <dir>` 可手动播种共享 runtime，并把 commands/skills/agents 以 copy 方式写入 Claude Code、Codex、OpenCode 的全局目录。
 
 用户不需要手动执行这些命令。Agent 负责安装、冲突处理、校验和汇报。
 
@@ -76,12 +76,14 @@ Agent 读取本 README 后，按项目状态选择路径：
 | `/wf-max <任务>` | 任务能拆成互不冲突的部分，需要最大并行度 | 在 WF 链路上增加 CEO -> Manager -> Worker 分工和并行波次 | `/wf-max 并行升级前端、后端和文档` |
 | `/wf-auto` | 希望 Agent 持续自我优化 | 连续执行优化循环，每轮保留计划、证据和反馈 | `/wf-auto 优化这个项目的稳定性` |
 | `/wf-auto-spark` | 需要外部灵感、竞品方向或长期路线图 | 搜索外部 spark，绑定 North Star 和里程碑，限制偏离范围 | `/wf-auto-spark 探索产品增长方向` |
-| `/wf-review [重点]` | 需要第二意见、同行审查或上线前复核 | 优先调用可用 peer CLI；没有时使用独立 reviewer 角色 | `/wf-review 重点检查安全和数据丢失` |
+| `/wf-review [重点]` | 需要第二意见、同行审查或上线前复核 | 只使用 Harness 原生的干净 reviewer 子代理，按风险智能控制并发数量 | `/wf-review 重点检查安全和数据丢失` |
 | `/wf-learn` | 同类错误反复出现，或一次任务结束后要沉淀经验 | 汇总上下文、记忆和项目经验 | `/wf-learn 总结这次返修原因` |
 | `/wf-browser <任务>` | 浏览器冒烟、E2E、截图、表单或页面验证 | 使用真实浏览器并提供截图、trace 或状态证据 | `/wf-browser 验证登录和支付流程` |
 | `/wf-readme <任务>` | README、安装文档、架构图或项目说明需要整理 | 保留事实，整理结构，补充安装和使用说明 | `/wf-readme 优化中文 README` |
 | `/wf-update` | 已安装 Harness，需要检查和应用框架更新 | 比较版本，自动处理安全变更，把语义冲突留给 Agent | `/wf-update` |
+| `/wf-search` | 任务需要一次可验证的真实工具搜索 | 把一次搜索组织成结构化台账（操作/来源/结论），用无状态 Node helper 校验并渲染成 Markdown 证据报告；`--save` 后保存在 `Harness/research/search/` | `/wf-search --mode fact "node:test runner 退出码"` |
 | `/wf-remove` | 需要卸载 Harness | 自动清理安全文件，保留用户数据，冲突文件先确认 | `/wf-remove` |
+| `/wf-init` | 已装全局 runtime，想让新项目接入 | 只写入项目桥接文件和项目状态；框架文件与版本管理以全局 runtime 为准 |
 
 Claude Code 使用 `/wf-*`；Codex 使用对应的 `$wf-*`；OpenCode 使用已注册命令或 Agent instruction。常见任务起点见 [WF-AUTO-ANGLES.md](Harness/specs/workflows/WF-AUTO-ANGLES.md)。
 

package/README.md

@@ -67,7 +67,7 @@ After reading this README, the agent selects the path that matches the project:
 | Existing `Harness/` but missing `Harness/scripts/wf-update-check.mjs` | `npx create-harness-vibe-coding@latest my-project . -y --on-conflict skip --json`. Then run `node Harness/scripts/wf-update-check.mjs --json` |
 | After install or update | `node Harness/scripts/validate-harness.mjs --strict` |
 
-Install scope: project-local is the default. To seed a shared machine-level runtime, use `--install-scope global --global-dir <dir>`; commands/skills/agents are copied into Claude Code, Codex, and OpenCode host-global directories, while `Harness/tasks/`, `Harness/PROGRESS.md`, project memory, project facts, and project settings stay inside each target project.
+Install scope policy: the CLI defaults to `global` for a new or empty target, and to `project` for an existing non-empty target so older repositories keep their historical behavior. An explicit `--install-scope project|global` always wins. For the production setup, install once per machine with `npm i -g create-harness-vibe-coding`, then run `create-harness-vibe-coding init .` (or `/wf-init`) inside each project. The global runtime is the single version source of truth for commands, skills, agents, scripts, and the wf-ui server/assets; each project keeps its bridge docs and state (`Harness/tasks/`, `Harness/PROGRESS.md`, memory, facts, and settings). `wf-ui` is included in that same runtime and lazy-loaded only when invoked, so starting the UI does not trigger a second download. Use `--install-scope project` for a self-contained or offline/CI install; use `--global-dir <dir>` and `--host-global-dir <dir>` when the shared locations must be explicit.
 
 After installation, hand off by phase: use `CLAUDE.md` as the normal session entry, use `Harness/specs/guides/SETUP.md` only for install/bootstrap, migration, or upgrade decisions, and use `Harness/README.md` as the Harness workflow router when a routed task needs it. Preserve project boundaries; research and plan before editing; run tests, validation, and review before claiming completion.
 
@@ -83,13 +83,15 @@ When in doubt, use `/wf-help` (or `$wf-help` in Codex). It returns the full comm
 | `/wf-max <task>` | The task splits into independent work and needs maximum parallelism | Adds CEO -> Manager -> Worker roles and parallel waves to the full WF chain | `/wf-max upgrade frontend, backend, and docs in parallel` |
 | `/wf-auto` | You want continuous self-directed optimization with adaptive probe selection | Runs repeated optimization cycles with plans, evidence, and feedback | `/wf-auto improve this project's stability` |
 | `/wf-auto-spark` | You need external inspiration, competitive direction, or a long-term roadmap | Searches for sparks, anchors work to a North Star and milestones, and guards scope drift | `/wf-auto-spark explore product growth directions` |
-| `/wf-review [focus]` | You need a second opinion, peer review, or a pre-release check | Uses a peer CLI when available, otherwise an independent reviewer role, and classifies findings by severity | `/wf-review focus on security and data loss` |
-| `/wf-learn` | The same mistakes keep recurring or a completed task needs to become reusable knowledge | Consolidates context, memory, and project lessons | `/wf-learn summarize why this task needed rework` |
+| `/wf-review [focus]` | You need a second opinion, peer review, or a pre-release check | Uses clean Harness-native reviewer subagents with bounded intelligent fan-out and classifies findings by severity | `/wf-review focus on security and data loss` |
+| `/wf-learn` | The same mistakes keep recurring or a completed task needs to become reusable knowledge | Extracts generalized methods with anti-overfitting and route-load checks | `/wf-learn summarize why this task needed rework` |
 | `/wf-browser <task>` | Browser smoke tests, E2E, screenshots, forms, or UI verification | Uses a real browser and returns screenshots, traces, and evidence | `/wf-browser verify login and checkout` |
 | `/wf-ui` | Open the Harness control panel for task management, workflow graphs, agents, and settings | Directly starts the local backend and browser UI on 127.0.0.1 | `/wf-ui` |
 | `/wf-readme <task>` | README, install docs, architecture diagrams, or project docs need work | Preserves facts while improving structure, setup, and usage guidance | `/wf-readme improve the Chinese README` |
 | `/wf-update` | Harness is already installed and needs an update | Compares versions, applies safe changes, leaves semantic conflicts to the agent, and reports release highlights from the changelog metadata | `/wf-update` |
-| `/wf-remove` | You need to uninstall Harness | Removes safe files, preserves user data, and asks before touching conflicts | `/wf-remove` |
+| `/wf-search` | A task needs a real tool search with verifiable sources and claims | Organizes one search into a structured ledger (operations/sources/claims), validates it with a stateless Node helper, and renders a Markdown evidence report; reports save to `Harness/research/search/` | `/wf-search --mode fact "node:test runner exit codes"` |
+| `/wf-remove` | You need to uninstall Harness | Removes safe files, preserves user data, and asks before touching conflicts |
+| `/wf-init` | You installed the global runtime and want a new project to use it | Writes only project bridge docs and project-local state; framework files and versioning stay in the global runtime | `/wf-remove` |
 | `/wf-help` | You do not know which command to use | Returns command usage without starting a workflow | `/wf-help` |
 
 Claude Code uses `/wf-*`; Codex uses the matching `$wf-*`; OpenCode uses the registered command or Agent instruction. Browser E2E guidance is built into `wf-browser`. `/wf-auto` and `/wf-auto-spark` are continuous modes, so give the agent a clear goal, scope, and acceptance criteria before starting.
@@ -98,6 +100,23 @@ Common starting points: Web/API work starts with correctness, security, reliabil
 
 Chinese README: [README-CN.md](README-CN.md)
 
+### Harness intelligence routing
+
+Workflow entry points create a bounded, role-scoped task context pack before
+dispatch and regenerate it on resume. External research is conditional: the
+local policy checks capability gaps, volatile APIs, explicit requests, repeated
+failures, or benchmark gaps before an agent reads current web, GitHub, or
+Hugging Face sources. Source URL, version/terms, date, and adopt/adapt/reject
+rationale remain part of task evidence. Packs and structural checks improve
+boundaries but do not replace semantic validation.
+
+`/wf-max` uses evidence-driven WF-Max-Useful fan-out by default; a dependency
+chain, absent independent acceptance, or coordination cost without benefit may
+be recorded as no-spawn. WF-Max-Strict is enabled only by an explicit strict
+request and remains bounded by actual runtime capacity. Direct commands such as
+`/wf-help`, `/wf-task-list`, `/wf-init`, and `/wf-update` stay direct and do not
+force task routing or external research.
+
 ## Measured difference
 
 Harness does not make the model smarter. It reduces uncontrolled parts of agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-harness-vibe-coding",
-  "version": "0.8.19",
+  "version": "0.9.3",
   "description": "Scaffold a 0-1 product harness for AI-assisted research, PRD, planning, architecture, build, test, and feedback loops",
   "type": "module",
   "bin": {
@@ -9,6 +9,17 @@
   "files": [
     "bin/",
     "src/",
+    "!src/ui/src",
+    "!src/ui/e2e",
+    "!src/ui/test-results",
+    "!src/ui/verification-screenshots",
+    "!src/ui/playwright-report",
+    "!src/ui/debug-results-excalidraw",
+    "!src/ui/debug-results-excalidraw/**",
+    "!src/ui/trace-unpack-m3-settings",
+    "!src/ui/trace-unpack-m3-settings/**",
+    "!src/ui/pnpm-lock.yaml",
+    "!src/ui/**/*.map",
     "templates/",
     "docs/images/harness-icon.png",
     "docs/images/harness-architecture-light.png",
@@ -28,7 +39,11 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.7.0",
-    "picocolors": "^1.1.0"
+    "iconv-lite": "^0.6.3",
+    "picocolors": "^1.1.0",
+    "read-excel-file": "^9.3.10",
+    "unpdf": "^1.8.1",
+    "yauzl": "^2.10.0"
   },
   "engines": {
     "node": ">=18"

package/src/generator.js

@@ -11,6 +11,7 @@ const CHECKSUM_EXCLUDE = [
   /^Harness\/PROGRESS\.md$/,
   /^Harness\/tasks\//,
   /^Harness\/memory\//,
+  /^Harness\/research\/search\//,
   /^Harness\/research\/PRD\.md$/,
   /^Harness\/research\/research-results\.md$/,
   /^Harness\/architecture\.md$/,
@@ -375,10 +376,11 @@ Project settings override global settings. Existing user-authored files at Harne
   ];
 }
 
-function installMetadata({ installScope, resolvedGlobalDir, hostPlans = [] }) {
-  if (installScope !== 'global') return { installScope: 'project' };
+function installMetadata({ installScope, resolvedGlobalDir, hostPlans = [], installMode = undefined }) {
+  if (installScope !== 'global') return { installScope: 'project', installMode: installMode || 'project' };
   return {
     installScope: 'global',
+    installMode: installMode || 'runtime',
     globalDir: normalizePath(resolvedGlobalDir),
     copyMode: 'copy',
     projectState: {
@@ -1211,7 +1213,18 @@ export function generate({
   }
 
   try {
-    const metadata = installMetadata({ installScope: normalizedInstallScope, resolvedGlobalDir, hostPlans });
+    const projectMetadata = installMetadata({
+      installScope: normalizedInstallScope,
+      resolvedGlobalDir,
+      hostPlans,
+      installMode: normalizedInstallScope === 'global' ? 'bridge' : 'project',
+    });
+    const runtimeMetadata = installMetadata({
+      installScope: normalizedInstallScope,
+      resolvedGlobalDir,
+      hostPlans,
+      installMode: 'runtime',
+    });
     const projectWrite = writeGeneratedPlan({
       plan,
       fileSpecs,
@@ -1219,7 +1232,7 @@ export function generate({
       resolvedDir,
       vars,
       optional,
-      metadata,
+      metadata: projectMetadata,
     });
     created.push(...projectWrite.created);
 
@@ -1233,7 +1246,7 @@ export function generate({
         resolvedDir: resolvedGlobalDir,
         vars,
         optional,
-        metadata,
+        metadata: runtimeMetadata,
         createdPrefix: 'global:',
       });
       created.push(...globalWrite.created);
@@ -1247,7 +1260,7 @@ export function generate({
         resolvedDir: hostPlan.root,
         vars,
         optional,
-        metadata,
+        metadata: runtimeMetadata,
         createdPrefix: `host:${hostPlan.host}:`,
       });
       created.push(...hostWrite.created);