create-workframe 0.1.5 → 0.1.7

package/README.md

@@ -1,40 +1,40 @@
-# create-workframe
-
-Published on npm as **create-workframe**.
-
-```bash
-npx create-workframe@0.1.5 MyProject
-```
-
-Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.
-
-## Generated layout
-
-```text
-MyProject/
-├── Agents/
-├── Files/
-├── scripts/              bootstrap, lifecycle, workframe.mjs CLI
-├── docker-compose.yml
-├── workframe-api/
-├── workframe-ui/
-├── workframe-supervisor/
-└── workframe-manifest.json
-```
-
-## Project CLI
-
-From the generated project root:
-
-```bash
-node scripts/workframe.mjs doctor
-node scripts/workframe.mjs setup
-```
-
-## Source
-
-[github.com/npx-workframe/workframe](https://github.com/npx-workframe/workframe)
-
-Documentation: [docs/README.md](https://github.com/npx-workframe/workframe/blob/main/docs/README.md)
-
-Apache-2.0 — see `LICENSE`, `NOTICE`, `SECURITY.md`.
+# create-workframe
+
+Published on npm as **create-workframe**.
+
+```bash
+npx create-workframe@0.1.6 MyProject
+```
+
+Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.
+
+## Generated layout
+
+```text
+MyProject/
+├── Agents/
+├── Files/
+├── scripts/              bootstrap, lifecycle, workframe.mjs CLI
+├── docker-compose.yml
+├── workframe-api/
+├── workframe-ui/
+├── workframe-supervisor/
+└── workframe-manifest.json
+```
+
+## Project CLI
+
+From the generated project root:
+
+```bash
+node scripts/workframe.mjs doctor
+node scripts/workframe.mjs setup
+```
+
+## Source
+
+[github.com/npx-workframe/workframe](https://github.com/npx-workframe/workframe)
+
+Documentation: [docs/README.md](https://github.com/npx-workframe/workframe/blob/main/docs/README.md)
+
+Apache-2.0 — see `LICENSE`, `NOTICE`, `SECURITY.md`.

package/SECURITY.md

@@ -1,38 +1,38 @@
-# Security Policy
-
-## Supported versions
-
-| Version | Supported |
-| ------- | --------- |
-| 0.1.x   | Yes       |
-
-## Reporting a vulnerability
-
-Please **do not** open a public GitHub issue for security-sensitive reports.
-
-Send details to the maintainers via a private channel (GitHub Security Advisories on
-[npx-workframe/workframe](https://github.com/npx-workframe/workframe) when enabled, or
-direct contact with the repository owner).
-
-Include:
-
-- Affected component (workframe-api, supervisor, installer, UI, compose)
-- Steps to reproduce
-- Impact assessment (data exposure, auth bypass, RCE, etc.)
-- Suggested fix if you have one
-
-We aim to acknowledge reports within a few business days.
-
-## Scope notes
-
-- Personal Hermes installs outside a Workframe compose stack are out of scope unless the issue is in shared Workframe source that affects all installs.
-- Production deployments should use `WORKFRAME_DEPLOYMENT_MODE=trusted_team` or
-  `public_multi_user`, invite-only access, and without `DEV_LOCAL_UNSAFE`.
-- BYOK (bring-your-own-key) is the default credential mode; workspace company-pays is an
-  explicit admin opt-in.
-
-## Safe defaults
-
-- Deny-by-default provider credentials (`user_only` providers do not fall back to workspace keys).
-- Install-window gates for owner claim and stack configuration reads.
-- Supervisor-mediated host actions when `SECURE_MODE=true`.
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 0.1.x   | Yes       |
+
+## Reporting a vulnerability
+
+Please **do not** open a public GitHub issue for security-sensitive reports.
+
+Send details to the maintainers via a private channel (GitHub Security Advisories on
+[npx-workframe/workframe](https://github.com/npx-workframe/workframe) when enabled, or
+direct contact with the repository owner).
+
+Include:
+
+- Affected component (workframe-api, supervisor, installer, UI, compose)
+- Steps to reproduce
+- Impact assessment (data exposure, auth bypass, RCE, etc.)
+- Suggested fix if you have one
+
+We aim to acknowledge reports within a few business days.
+
+## Scope notes
+
+- Personal Hermes installs outside a Workframe compose stack are out of scope unless the issue is in shared Workframe source that affects all installs.
+- Production deployments should use `WORKFRAME_DEPLOYMENT_MODE=trusted_team` or
+  `public_multi_user`, invite-only access, and without `DEV_LOCAL_UNSAFE`.
+- BYOK (bring-your-own-key) is the default credential mode; workspace company-pays is an
+  explicit admin opt-in.
+
+## Safe defaults
+
+- Deny-by-default provider credentials (`user_only` providers do not fall back to workspace keys).
+- Install-window gates for owner claim and stack configuration reads.
+- Supervisor-mediated host actions when `SECURE_MODE=true`.