howone 0.1.53 → 0.2.1

package/templates/vite/.howone/skills/howone/03-ai-capabilities/02-workflow-contract-rules.md

@@ -41,19 +41,6 @@ service reject the request or produce a workflow the runtime cannot execute reli
 }
 ```
 
-## Supported Capability Boundary
-
-Design contracts only for capability families listed in `03-service-capability-catalog.md`.
-Do not invent general workflow powers beyond that catalog. In particular:
-
-- streaming execution and realtime partial results are not supported;
-- file work is limited to creating or modifying text, PDF, DOCX, PPTX, and XLSX outputs;
-- video work is limited to generation, concatenation, and first/last-frame extraction;
-- audio work is limited to TTS, speech recognition, and concatenating audio files.
-
-If the requested behavior needs anything outside the catalog, stop the AI workflow path and explain
-the missing capability or ask the user to narrow the feature.
-
 ## Loose JSON Schema
 
 The workflow engine is agentic. Overly strict schemas reduce reliability.
@@ -244,21 +231,6 @@ Instead:
 2. app code persists through the entity runtime after SDK handoff;
 3. durable fields map to the entity contract.
 
-## No Streaming Contracts
-
-HowOne AI workflow capability contracts are non-streaming. Do not add schema fields or descriptions
-that imply:
-
-- token streaming;
-- realtime audio/video processing;
-- incremental chunks;
-- event streams;
-- SSE/WebSocket workflow output;
-- live progress messages from the workflow.
-
-If the app needs progress UX, keep it app-owned: show pending/running/completed/failed states around
-the non-streaming workflow result.
-
 ## External Data Assumptions
 
 Do not require user-provided datasets unless the user said they have them.
@@ -442,84 +414,6 @@ Bad:
 }
 ```
 
-### RSS feed extraction
-
-```json
-{
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "rss_url": {
-        "type": "string",
-        "format": "uri",
-        "description": "RSS feed URL to fetch and parse."
-      },
-      "language": {
-        "type": "string",
-        "description": "Language for any generated summary text."
-      }
-    },
-    "required": ["rss_url"]
-  },
-  "outputSchema": {
-    "type": "object",
-    "properties": {
-      "items": {
-        "type": "array",
-        "description": "RSS feed items with title, URL, published date, and summary in the requested language when generated.",
-        "items": {
-          "type": "object",
-          "properties": {
-            "title": { "type": "string" },
-            "url": { "type": "string", "format": "uri" },
-            "published_at": { "type": "string" },
-            "summary": { "type": "string" }
-          }
-        }
-      }
-    },
-    "required": ["items"]
-  }
-}
-```
-
-### File creation or modification
-
-```json
-{
-  "inputSchema": {
-    "type": "object",
-    "properties": {
-      "file_type": {
-        "type": "string",
-        "description": "Target file type: txt, md, pdf, docx, pptx, or xlsx."
-      },
-      "content_or_instruction": {
-        "type": "string",
-        "description": "Content to create or instruction for modifying the source file."
-      },
-      "source_file_url": {
-        "type": "string",
-        "format": "uri",
-        "description": "Optional URL of an existing file to modify."
-      }
-    },
-    "required": ["file_type", "content_or_instruction"]
-  },
-  "outputSchema": {
-    "type": "object",
-    "properties": {
-      "file_url": {
-        "type": "string",
-        "format": "uri",
-        "description": "Public URL of the created or modified file."
-      }
-    },
-    "required": ["file_url"]
-  }
-}
-```
-
 ## Contract Checklist
 
 - Required inputs are essential only.
@@ -528,7 +422,6 @@ Bad:
 - Input/output property names do not overlap.
 - Text output descriptions specify language.
 - Description says what, not how.
-- Contract does not imply streaming, realtime output, or event delivery.
 - No CRUD/auth/upload/payment/app-state requirements.
 - Feature fits an available capability.
 - Schema is raw valid JSON.

package/templates/vite/.howone/skills/howone/03-ai-capabilities/03-service-capability-catalog.md

@@ -3,41 +3,29 @@
 Use this reference **only** for HowOne **workflow-service AI** feasibility. It lists what the current
 workflow service supports—not everything a full product may use.
 
-Infrastructure or products the user operates themselves (clusters, custom servers, third-party
-APIs, etc.) are **app-owned** per `01-architect/01-app-generation.md`. They are out of scope for
-this catalog and must not be rejected as "AI not supported" when the user only needs to connect to them in app code.
+Explicit user-owned integrations are outside this catalog per
+`01-architect/01-app-generation.md`. Use that exception only when the user explicitly asks to
+connect something outside HowOne. Ordinary generated AI app requests should be checked against this
+catalog first.
 
 Source: `docs/ai-capability.md`.
 
-## Global Boundaries
-
-Streaming is not supported. Do not design token streams, realtime audio/video processing,
-incremental workflow chunks, SSE/WebSocket workflow output, or live workflow progress events as
-HowOne AI capability. Progress UI is app-owned around a non-streaming workflow result.
-
-If the requested behavior is not listed in this catalog, do not simulate it or silently approximate
-it. State the missing capability and offer the closest supported version only when it preserves the
-user's original goal.
-
 ## Quick Selection Table
 
 | User asks for | Use capability family | Typical inputs | Typical outputs |
 |---|---|---|---|
 | Latest info, research, source-backed answer | Web search / crawling | `topic`, `prompt`, `url`, `search_level` | `answer`, `sources`, `page_content` |
-| Parse posts from an RSS feed | Fetch RSS feed from RSS URL | `rss_url`, optional filters | `items`, `source_metadata` |
-| Generate or transform text | Text generation / transformation | `prompt`, `source_text`, `language`, format instructions | `generated_text` or structured JSON |
 | Generate artwork/photo/logo/mockup | Image generation | `image_description`, `style_preference`, optional references | `generated_image_url` |
 | Edit an image | Image editing | `source_image_url`, `edit_instruction` | `edited_image_url` |
 | OCR or visual analysis | Image analysis / OCR | `image_urls`, `analysis_prompt` | `analysis_result` or `extracted_text` |
 | Generate short video | Video generation | `video_prompt`, aspect/duration/frame URLs | `video_url` |
-| Join video clips | Concatenate videos | `video_urls` | `merged_video_url` |
-| Extract first/last frame | Extract first and last frame | `source_video_url` | `first_frame_image_url`, `last_frame_image_url` |
-| Text to speech | TTS / text-to-speech | `text_to_generate`, `language`, `voice_hint` | `audio_url` |
-| Speech to text | Speech recognition | `source_audio_url`, `language` | `transcript_text`, optional `utterances` |
-| Merge audio | Concatenate audio files | `audio_urls` | `merged_audio_url` |
+| Join clips / extract frames | Video editing | `video_urls` or `video_url` | `video_url` or `image_url` |
+| Text to speech | Audio generation | `text_to_generate`, `language`, `voice_hint` | `audio_url` |
+| Speech to text | Audio recognition | `source_audio_url`, `language` | `transcript_text`, optional `utterances` |
+| Merge audio | Audio merging | `audio_urls` | `merged_audio_url` |
 | Stock/index history | Financial data retrieval | `trading_symbol`, `unit`, `start`, `end` | `price_history` |
 | Literature search/citations | Academic research | `query` | `papers`, `bibtex` |
-| Create or modify documents/spreadsheets/slides | File creation / modification | `file_type`, `content_or_instruction`, optional `source_file_url` | `file_url` |
+| Save generated file | File storage | `file_type`, `content` | `file_url` |
 
 If the requested behavior is not in this table or the detailed sections below, do not invent it.
 
@@ -65,46 +53,6 @@ Rules:
 - Do not use search as an outbound API caller.
 - Include source links in output when the product promises research.
 
-## RSS Feed Fetching
-
-Use for fetching and parsing a specific RSS feed URL.
-
-Inputs:
-
-- `rss_url`: URL of the RSS feed;
-- optional filtering instructions, item limit, language, or summary instruction.
-
-Outputs:
-
-- feed `items` with title, URL, date, and optional summary;
-- source/feed metadata when useful.
-
-Rules:
-
-- Use RSS only when the user has or asks for an RSS URL.
-- Use web search/crawling when the user asks for general latest information without a feed URL.
-- Do not treat RSS fetching as arbitrary API integration.
-
-## Text Generation And Transformation
-
-Use for writing, rewriting, summarizing, translating, classifying, extracting, and structured JSON
-generation when no specialized media/retrieval capability is needed.
-
-Inputs:
-
-- `prompt` or `source_text`;
-- optional `language`, audience, tone, format, or transformation instruction.
-
-Outputs:
-
-- generated text or structured JSON fields needed by the product.
-
-Rules:
-
-- Text outputs must specify language behavior.
-- Keep structured outputs minimal and product-facing.
-- Do not claim streaming tokens or realtime generation.
-
 ## Image Generation
 
 Use for new images from prompts or prompt + reference URLs.
@@ -189,12 +137,12 @@ Rules:
 
 - Keep individual clips short, generally 5-10 seconds.
 - For consistency, generate/use a first-frame image.
-- For longer videos, generate clips and concatenate via video composition utilities.
+- For longer videos, generate clips and concatenate via video editing.
 - Audio in video works best with one speaker per clip.
 
-## Video Composition Utilities
+## Video Editing
 
-Use only for concatenating video clips or extracting first/last frames.
+Use for concatenating clips or extracting first/last frames.
 
 Inputs:
 
@@ -203,16 +151,14 @@ Inputs:
 
 Outputs:
 
-- concatenate: `merged_video_url`;
-- frame extraction: `first_frame_image_url`, `last_frame_image_url`.
+- `merged_video_url` or `frame_image_url`.
 
 Rules:
 
 - Inputs must be accessible URLs.
 - Best results when clips share resolution/aspect ratio.
-- Do not claim arbitrary video editing beyond concatenation and first/last-frame extraction.
 
-## Text To Speech
+## Audio Generation
 
 Use for text-to-speech.
 
@@ -231,10 +177,10 @@ Outputs:
 Rules:
 
 - Single speaker per call.
-- For dialogue, generate each speaker line and concatenate audio files.
+- For dialogue, generate each speaker line and merge audio.
 - `audio_hint` should describe voice in English.
 
-## Speech Recognition
+## Audio Recognition
 
 Use for speech-to-text.
 
@@ -253,24 +199,6 @@ Rules:
 
 - Audio must be URL-accessible.
 - Silent or low-quality audio can produce empty/poor transcript.
-- Do not promise realtime transcription or streaming captions.
-
-## Audio Concatenation
-
-Use for joining multiple audio files in order.
-
-Inputs:
-
-- `audio_urls`: two or more accessible audio URLs.
-
-Outputs:
-
-- `merged_audio_url`.
-
-Rules:
-
-- Use this after separate TTS calls for multi-speaker dialogue.
-- Do not claim arbitrary audio editing beyond concatenation.
 
 ## Financial Data Retrieval
 
@@ -315,15 +243,14 @@ Rules:
 - Availability varies by academic source.
 - PDF assets should be handled as URLs.
 
-## File Creation And Modification
+## File Storage
 
-Use when the workflow needs to create or modify supported files.
+Use when workflow needs to save generated content into a file.
 
 Inputs:
 
-- `file_type`: `txt`, `md`, `pdf`, `docx`, `pptx`, or `xlsx`;
-- `content_or_instruction`: content to create or instruction for modification;
-- optional `source_file_url`: URL of an existing file to modify.
+- `file_type`: `json`, `yaml`, `csv`, `pdf`, `md`, or `txt`;
+- `content`: string content to save.
 
 Outputs:
 
@@ -331,20 +258,18 @@ Outputs:
 
 Rules:
 
-- Supported file work is create/modify only for text, PDF, DOCX, PPTX, and XLSX.
-- Do not use file output as a database.
-- If app needs records/history, persist file URLs through entities.
-- Do not claim arbitrary binary editing, ZIP manipulation, or filesystem access.
+- Structured content must be serialized to string before saving.
+- Do not use file storage as a database.
+- If app needs records/history, persist file URL through entities.
 
 ## Composition Patterns
 
 | Pattern | Workflow design |
 |---|---|
 | Image -> Video | generate first-frame image, pass as `first_frame_url` to video generation |
-| Multi-clip video | generate short clips, concatenate via video composition utilities |
-| Dialogue audio | generate each speaker line, concatenate audio files |
-| RSS -> Digest | fetch RSS feed, synthesize a digest, optionally create a supported file |
-| Search -> Report | web search/crawl, synthesize structured report, optionally create a supported file |
+| Multi-clip video | generate short clips, concatenate via video editing |
+| Dialogue audio | generate each speaker line, merge audio |
+| Search -> Report | web search/crawl, synthesize structured report, optionally save file |
 | Video -> Image edit -> Video | extract frame, edit frame, use as next reference |
 | RAG document chat | indexing workflow + query workflow |
 

package/templates/vite/.howone/skills/howone/03-ai-capabilities/04-workflow-operations.md

@@ -3,22 +3,19 @@
 Use this reference when submitting HowOne external AI workflow create/update operations through
 `external-ai-capability`. This is an AI workflow design reference, not an app SDK guide.
 
-Workflow create/update/status operations are asynchronous control-plane operations. They are not
-runtime streaming support. Do not use job polling, task IDs, SSE, or background status as evidence
-that a user-facing AI workflow can stream partial results.
-
 ## Current Tool Contract
 
 Do not hand-build raw workflow HTTP requests in generated app work. Use `external-ai-capability`
 after `.howone/ai/manifest.json` has been synced.
 
-The tool performs:
+The foreground tool performs:
 
 ```text
 POST /workflows
-GET  /jobs/{job_id}
 ```
 
+The host-owned background poller performs `GET /jobs/{job_id}` and finalizes successful bindings.
+
 The tool reads the synced manifest and submits operations for selected capabilities.
 
 ## Create
@@ -69,16 +66,21 @@ Tool behavior:
 
 ```text
 previous config = current manifest capability.workflowId
-new config      = freshly generated UUID
+new config      = freshly generated UUID sent as config_id
 mode            = update
-manifest        = rewritten so capability.workflowId is the fresh UUID
+original_config_id = previous config sent to EAX
+workflow code   = regenerated by EAX from the current capability contract and updatePrompt
+submitted state = local manifest remains unchanged while EAX runs
+completed state = backend capability version receives the fresh UUID
 ```
 
-After update, re-read `.howone/ai/manifest.json`. The new manifest `workflowId` is the value used by
-SDK bindings and future execution.
+After a completed update, run `sync_ai_artifacts` and then re-read `.howone/ai/manifest.json`. The
+newly synced `workflowId` is the value used by SDK bindings and future execution. Failed operations
+keep their previous backend and local manifest bindings.
 
-Do not pass stale `workflowConfigID` values from old docs or older status payloads. The current
-tool owns config rotation and manifest write-back.
+Do not pass stale `workflowConfigID` values from old docs or older status payloads. Agents should
+not pass `original_config_id` directly either; the current tool derives it from the manifest and
+owns config rotation; the background finalizer owns backend binding promotion.
 
 ## Selection Rules
 
@@ -106,9 +108,6 @@ Terminal result meaning:
 | `completed` | workflow operation completed |
 | `failed` / `canceled` / `timed_out` | report error and do not pretend workflow is ready |
 
-For generated apps, progress UI is app-owned and should model non-streaming states such as
-pending/running/completed/failed around the final workflow result.
-
 ## Standard Flow
 
 New AI feature:
@@ -117,6 +116,8 @@ New AI feature:
 ai-capability-design apply_capability_patch
 sync_ai_artifacts
 external-ai-capability { cwd, capabilityNames }
+wait for terminal result
+sync_ai_artifacts
 read .howone/ai/manifest.json
 ```
 
@@ -126,6 +127,8 @@ Schema-changing AI update:
 ai-capability-design apply_capability_patch
 sync_ai_artifacts
 external-ai-capability { cwd, updates: [{ capabilityName, updatePrompt }] }
+wait for terminal result
+sync_ai_artifacts
 read .howone/ai/manifest.json
 ```
 
@@ -133,7 +136,10 @@ Behavior-only update:
 
 ```text
 external-ai-capability { cwd, updates: [{ capabilityName, updatePrompt }] }
+wait for terminal result
+sync_ai_artifacts
 read .howone/ai/manifest.json
+update SDK workflowId bindings from the newly synced manifest
 ```
 
 SDK/code work happens after these steps and belongs to the SDK track.
@@ -144,6 +150,6 @@ SDK/code work happens after these steps and belongs to the SDK track.
 - Create uses the existing manifest `workflowId`.
 - Update lets the tool generate a fresh config UUID.
 - Update has a concrete `updatePrompt`.
-- The manifest is re-read after update.
+- The backend capability version is finalized before local artifacts are synced again.
+- The manifest is re-read only after the post-completion sync.
 - SDK bindings are copied from manifest, not from memory or old status IDs.
-- Status polling is not streaming workflow output.

package/templates/vite/.howone/skills/howone/03-ai-capabilities/05-ai-feature-playbooks.md

@@ -138,30 +138,6 @@ Rules:
 - output descriptions must specify language;
 - if user asks for latest/current, this workflow must retrieve data internally.
 
-## Playbook: RSS Digest
-
-Use when the user provides or asks for a specific RSS feed URL and wants feed items, summaries, or
-a digest.
-
-Inputs:
-
-- `rss_url`;
-- optional `item_limit`;
-- optional `language`;
-- optional `summary_instruction`.
-
-Outputs:
-
-- `items` with title, URL, published date, and optional summary;
-- optional `digest` when the product needs a synthesized overview.
-
-Rules:
-
-- use RSS feed fetching only for explicit RSS URLs;
-- use web search/crawling for general latest news without an RSS URL;
-- do not treat RSS as arbitrary third-party API integration;
-- if users need saved feed history, persist items or digests through entities.
-
 ## Playbook: Stock Analysis
 
 Use for historical price analysis.
@@ -245,7 +221,7 @@ Output:
 Rules:
 
 - single speaker per call;
-- dialogue should generate multiple clips and concatenate audio files;
+- dialogue should generate multiple clips and merge;
 - persist audio URL through entity if user needs library/history.
 
 ## Playbook: Video Generator
@@ -269,46 +245,6 @@ Rules:
 - for longer output, compose multiple clips and concatenate;
 - first-frame image helps consistency.
 
-## Playbook: Video Frame Utility
-
-Use when the product needs a first frame and last frame from a video URL.
-
-Inputs:
-
-- `source_video_url`.
-
-Outputs:
-
-- `first_frame_image_url`;
-- `last_frame_image_url`.
-
-Rules:
-
-- use this only for first/last-frame extraction;
-- do not promise arbitrary frame-by-frame analysis or video editing;
-- persist extracted image URLs through entities if the app needs history.
-
-## Playbook: File Creator / Modifier
-
-Use when the product needs to create or modify a supported file: text, PDF, DOCX, PPTX, or XLSX.
-
-Inputs:
-
-- `file_type`: txt, md, pdf, docx, pptx, or xlsx;
-- `content_or_instruction`;
-- optional `source_file_url` for modification.
-
-Output:
-
-- `file_url`.
-
-Rules:
-
-- create/modify supported file types only;
-- app uploads source files first and passes URLs;
-- do not use generated files as a database;
-- persist file URLs through entities if users need history, folders, sharing, or review.
-
 ## RAG Playbook
 
 Use only when app needs question answering over user/project documents.
@@ -334,7 +270,6 @@ Rules:
 - Verify capability exists in `03-service-capability-catalog.md`.
 - Use URL inputs for files/media.
 - Keep outputs minimal and product-facing.
-- Do not design streaming/realtime AI output.
 - Decide persistence separately.
 - Generate SDK bindings only after manifest sync and external workflow submit.
 - Use app-owned UI for progress/errors.

package/templates/vite/.howone/skills/howone/SKILL.md

@@ -17,7 +17,7 @@ Load only the track needed for the user's request. Do not read SDK files while d
 
 Use this skill before work when any condition is true:
 
-- You need to decide whether HowOne can satisfy the user's request, whether it is app-owned, or whether the request needs clarification before handoff.
+- You need to decide whether HowOne can satisfy the user's request, whether an explicit user-owned integration is outside platform contracts, or whether the request needs clarification before handoff.
 - The user asks for persisted app data, backend schema, entity fields, access, indexes, public pages, private history, or Mongo-backed records.
 - The user asks for HowOne AI behavior, capability contracts, workflow generation/update/status, or `external-ai`.
 - The work reads or writes `.howone/database/*`, `.howone/ai/*`, `src/lib/sdk.ts`, or app code using `@howone/sdk` / `howone.*`.
@@ -37,7 +37,7 @@ Classify the request before tool writes:
 | Add/change HowOne AI behavior | AI | `ai-capability-design`, `sync_ai_artifacts`, `external-ai-capability`, `03-ai-capabilities/*` |
 | Call HowOne from generated app code | SDK | `src/lib/sdk.ts`, synced manifests, `04-app-sdk/*` |
 | UI only, no HowOne data or AI | None | edit app code only |
-| User-owned external services | App-owned | integrate in app code/config; do not fake platform contracts |
+| Explicit user-owned integrations | App-owned | only when the user explicitly asks to connect something outside HowOne; do not reclassify ordinary AI/data/auth app requests |
 
 If multiple tracks apply, process them in dependency order:
 
@@ -72,7 +72,8 @@ get_current_schema -> apply_schema_patch -> sync_schema_artifacts -> read .howon
 AI contract:
 
 ```text
-get_current_ai_capabilities -> apply_capability_patch -> sync_ai_artifacts -> external-ai-capability -> read .howone/ai/manifest.json
+get_current_ai_capabilities -> apply_capability_patch -> sync_ai_artifacts -> external-ai-capability
+-> wait for terminal result -> sync_ai_artifacts -> read .howone/ai/manifest.json
 ```
 
 No contract dry-run step. Normal generation applies one well-formed patch directly. For destructive,
@@ -144,5 +145,5 @@ read synced manifests -> update src/lib/sdk.ts -> implement UI/server code using
 - Backend and AI design references must not include SDK implementation work.
 - SDK references must not invent backend or AI contracts; they consume synced manifests.
 - AI workflows must not perform database CRUD; persistence is app code through entities.
-- User-owned infrastructure is app code, not a platform gap.
+- Explicit user-owned integrations are app code, not a platform gap.
 - Platform gap means missing HowOne contract/tool/catalog support, not an unsupported technology name.

package/templates/vite/.howone/skills/web-clone/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Jane (@xiaoerzhan / 小耳)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.