just-vibe 0.8.1 → 0.10.0

package/CHANGELOG.md

@@ -1,6 +1,48 @@
 # Changelog
 
-## Unreleased
+## 0.10.0
+
+- Deliver source and focused methods for the 49-group frozen ECC backlog; track partial acceptance separately from implementation and retain the original comparison as a historical snapshot.
+- Correct twelve release-review defects in enforcement, session privacy, concurrent installation/recovery, cancellation, reconnect reservations, service startup, transcript truncation, historical pricing, telemetry identity and dispatch retention. Add process/crash regressions and an actual packed-archive upgrade/rollback test.
+- Add scoped configuration cleanup, skill maintenance, visible session imports/checkpoints, declarative behavior rules, MCP health and exact-version dependency indicators.
+- Add trusted runners, pre-commit/pre-push hooks, bounded jobs and services, cross-host councils, evaluation/promotion receipts, code tours, context graph, usage and telemetry exports.
+- Add the loopback operator and offline catalog, with explicitly enabled preview/apply project-adapter management.
+- Add 43 focused methods, 12 additional specialists, seven skill-file adapters, Kiro v1 event support, 22 connector recipes and an optional Python OpenAI/Anthropic/Ollama client.
+- Add integrity-pinned reviewed updates/rollback previews, edited-file protection, maintained getting-started translations and CPU evaluation examples.
+
+- Add bounded context-capacity, repeated-call and scope warnings, plus an optional Claude status-line bridge using actual host metrics.
+- Add inert quality-preset discovery, separately trusted batched formatting and staged-content commit checks that reject stale or incomplete evidence.
+- Add Cursor event hooks and OpenCode plugin events/tools behind explicit installation choices, with shared-configuration preservation and interruption recovery. Add Zed project skills and Hermes home skills.
+- Add GitHub epic snapshots, dependency/ownership/progress plans, exact comment previews, stale-state checks and uncertain-publication recovery/reconciliation.
+- Add JSON, Markdown and SARIF security reports with CI severity gates, broader configuration indicators and an explicitly pinned/trusted optional AgentShield runner.
+- Add conditional Django, FastAPI, Spring Boot, Flutter and React Native guides to existing build, repair, review and test workflows. Expand the native MCP interface to 45 tools.
+
+- Add guided project configuration, native task selection/evidence tools, grounded preference proposals with conditions/exceptions, and recoverable context backup/import/transfer.
+- Add `/orchestrate` and `/plan-review`, feature/fix/refactor/MVP phase contracts, dependent assignments with bounded retries, reviewed worker application with undo, and a private browser canvas with version-bound feedback.
+- Bind all goal evidence to source/branch/index state; preserve negative-learning decisions through pruning; scan structured MCP settings and exact loopback hosts; register Claude failure events.
+- Deliver complete canonical methods, selected technical rules and approved preferences to native specialists. Generate Codex-compatible MCP launch paths for persistent bundled installs.
+- Add Kimi, Qwen, Windsurf and Antigravity IDE adapters and opt-in real-host/browser verification runners.
+
+- Add the goal skill and persistent criteria, progress, blockers, evidence and resume context.
+- Add scoped memory and handoffs, native MCP tools, 12 specialist agents and bounded worktree workers.
+- Add optional action guards, a static agent-configuration scanner, observed-pattern review, preference sharing and skill/agent draft generation.
+- Add a local activity/health report, selective skill installation, 16 language/framework rule packs and owned-file adapters for Cursor, OpenCode, Copilot, Gemini, Kimi, Qwen, Windsurf and Antigravity IDE.
+- Preserve existing defaults and user edits; document activation, privacy, host coverage and verification limits.
+
+## 0.9.0
+
+- Add automatic request routing and compaction/resume context through native Codex/Claude plugin hooks, with focused workflow loading and guidance for discovering actual host capabilities.
+- Add personal/project feedback overlays that change effective command instructions and routing, retain source/version history, and support rollback, retirement and forgetting without rewriting package caches.
+- Add attributed evidence with source/artifact freshness, tool-activity records, and one bounded missing-evidence continuation; preserve current instructions and distinguish blockers from successful verification.
+- Add local activation settings, task retention, natural-language personalization controls, packaged runtime tests and native installation checks.
+- Preserve task identity across host continuation turns, enforce task-only feedback restrictions against the complete user message, and isolate optional project-hook failures while checking evidence after project commands finish.
+
+- Refine website spacing and long-text wrapping across the full catalog; add page transitions, section entrances, animated menus and pickers, state feedback, reduced-motion handling, and layout/navigation regression checks.
+- Default all frontend workflows to no emojis unless explicitly requested; route UI, React, Vite, design, polish, matching and UI copy through shared iconography guidance, including general workflows and role profiles used for frontend work.
+- Replace website text-glyph icons with Lucide SVGs and preserve icon markup when copy-button feedback resets.
+- Add a public website with installation guides, an editable prompt builder, searchable command and role libraries, and catalog-generated scope and verification documentation.
+- Add the just-vibe visual identity, generated logo and brand assets, responsive layouts, static-page/link checks, and browser accessibility and interaction checks.
+- Configure Vercel deployment independently of GitHub Actions and the npm CLI release process.
 
 ## 0.8.1
 

package/README.md

@@ -2,7 +2,9 @@
 
 Tools, skills, and commands for coding agents.
 
-**v0.8.1 contains 112 engineering profiles and 216 skill names backed by 213 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
+[Website](https://just-vibe-tools.vercel.app/) · [Documentation](https://just-vibe-tools.vercel.app/docs/) · [Command library](https://just-vibe-tools.vercel.app/commands/) · [Engineering profiles](https://just-vibe-tools.vercel.app/profiles/)
+
+**v0.10.0 contains 112 engineering profiles and 219 skill names backed by 216 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
 
 The [technical audit](docs/technical-audit.md) and [complete coverage inventory](docs/technical-coverage.md) document the latest expansion across every canonical workflow. Review/security commands now route to concrete vulnerability, framework, language and scanner guides. [Security fixture controls](evals/security/README.md) distinguish seeded defects from legitimate behavior; they do not claim model-review accuracy.
 
@@ -11,6 +13,26 @@ The active coding agent executes the workflows with its available tools. The dep
 v0.7 adds a quick path for simple work, a small starter catalog, contextual routing with reasons, project preferences and checkpoints, explicit evidence collectors, and optional project hooks. Detailed auth, component, training and delivery scenarios load only when relevant. See [daily workflows](plugins/just-vibe/references/daily-workflows.md) for configuration and examples, and the [v0.7 validation record](evals/releases/0.7.0.md) for tested scope and limits.
 
 
+## Next release: runtime tools and goals
+
+The frozen ECC backlog now has a separate [implementation and evidence ledger](docs/ecc-implementation-plan.md). This expansion adds 43 focused methods, 22 connector recipes, native session imports, configuration cleanup, behavior rules, MCP health, bounded jobs and services, independent councils, evaluation receipts, CodeTour exports, a context graph, usage accounting and an offline operator/catalog interface. [Use these features](plugins/just-vibe/references/runtime-expansion.md). These capabilities are included starting in **v0.10.0**. Acceptance is tracked separately: local regression and installation checks do not establish every framework, live-provider or operating-system requirement. See the [release fixes and remaining validation](docs/release-fixes-2026-09-20.md).
+
+The source checkout adds **/goal**, scoped searchable memory, 48 native MCP tools, 24 independent specialists, optional worktree workers, before-action policy, a configuration scanner, reviewed pattern learning, preference sharing/evolution, an activity report, selective installations and 16 language/framework rule packs. Cursor, OpenCode, Copilot, Gemini, Kimi, Qwen, Windsurf and Antigravity IDE have project file adapters. The source catalog now contains **219 skill names and 216 canonical workflows**. Guided setup, portable context, reviewed dependent workers and a browser plan canvas are included. These additions have not yet been published to npm.
+
+Read [the feature guide](docs/runtime-tools.md), [operation schemas and examples](plugins/just-vibe/references/runtime-platform.md), and [the implementation/validation plan](docs/runtime-expansion-plan.md). Existing installs retain their defaults; observation, blocking policy and worker launching are opt-in.
+
+The next release also includes context and repeated-call warnings, detected check presets, batched formatting, staged commit checks, Cursor/OpenCode event adapters, Zed/Hermes skill installation, GitHub epic coordination, and JSON/Markdown/SARIF security reports with an optional reviewed AgentShield runner. Focused Django, FastAPI, Spring Boot, Flutter and React Native guides extend existing workflows. See [configuration, examples and limits](plugins/just-vibe/references/runtime-depth.md) and [verification](docs/remaining-ecc-gaps-plan.md).
+
+The [complete ECC comparison](docs/ecc-complete-audit.md) inventories a pinned upstream snapshot and records remaining functionality, technical-depth gaps, optional products and implementation requirements. Earlier completed rounds covered their selected findings; they did not establish full ECC parity. The ledger distinguishes source presence from live verification and includes a maintainer check for upstream drift.
+
+## Automatic assistance
+
+Describe the outcome normally: “Fix the mobile menu,” “Why is training unstable?” or “Address this PR’s feedback.” Trusted native hooks now route each request to a focused shortlist, restore selected work after compaction, and direct the agent to discover and use its actual tools. Command names remain optional.
+
+The agent loads the relevant full workflow with versioned personal/project feedback. Explicit corrections and endorsements can change instructions, routing triggers, preferred tools and required checks. History, rollback, retirement and forgetting are supported. Silence and passing tests do not create preferences. Source and artifact changes invalidate old evidence; completion can request one bounded follow-up for missing evidence, then reports unresolved work honestly.
+
+Automatic assistance is included starting in **v0.9.0**. Native hook support and host trust are required; setup does not grant that trust. Personal state lives under `~/.just-vibe/adaptive`, outside repositories, with bounded task retention. No additional model service or runtime dependency is used. See [automatic assistance, schemas and limits](plugins/just-vibe/references/adaptive.md) and [validation](docs/adaptive-assistance.md).
+
 ## Intent, evidence and reversible work
 
 v0.8.0 adds working runtime helpers behind natural-language skill requests:
@@ -24,12 +46,12 @@ v0.8.0 adds working runtime helpers behind natural-language skill requests:
 
 See the [workflow guide](plugins/just-vibe/references/intent-workflows.md) for examples, boundaries and recovery. Users provide ordinary briefs; the agent prepares the helper inputs. These features support judgment rather than claiming an objective quality score.
 
-**Release status:** This checkout prepares v0.8.1. The previous [v0.8.0 publication](evals/releases/0.8.0-publication.json) was verified on npm. For this release, the maintainer again waived unavailable GitHub Actions because of the account minutes limit; local checks and exact-archive verification remain required. See the [v0.8.1 validation record](evals/releases/0.8.1.md).
+**Release version: 0.10.0.** Check [npm](https://www.npmjs.com/package/just-vibe) for the current `latest` tag. The [0.10.0 release validation record](evals/releases/0.10.0.md) describes the tested capabilities, platform limits and release-specific GitHub Actions waiver. No CI pass is claimed.
 
 
 ## Use the workflows
 
-In Claude Code, use a command followed by as much context as needed:
+With trusted hooks, use an ordinary request. For explicit shortcuts, Claude Code supports a command followed by as much context as needed:
 
 ```text
 /just-vibe:auto fix checkout, add regression coverage, and verify.
@@ -265,7 +287,7 @@ The [conversation harness](evals/conversation/README.md) records review, selecte
 
 The [v0.6 results](evals/releases/0.6.0.md) record 32 controlled implementation trials and eight revised-command development trials. All passed their bounded checks; this does not rank overall output quality or convenience. The tasks supplied detailed contracts and did not measure user effort or preference. The [command-depth review](docs/command-quality.md#focused-depth-review) explains 27 focused revisions, and the [contextual review guide](docs/command-quality.md#output-quality-and-convenience) covers judgment, clarity, discovery and correction burden. [Benchmark protocol and supporting metrics](evals/benchmark/README.md) remain available for reproduction. External integration, browser and deployment checks require the relevant task environment.
 
-The [technical-guidance validation record](evals/releases/0.8.0-technical-guidance.md) covers the latest command expansion and security controls. The earlier [v0.8 validation record](evals/releases/0.8.0.md) covers the new intent helpers, real browser reports, installation checks and the pending Windows confirmation. GitHub CI remains blocked by account billing. The maintainer waived that gate for the [verified npm publication](evals/releases/0.8.0-publication.json); Windows validation remains pending.
+The [technical-guidance validation record](evals/releases/0.8.0-technical-guidance.md) covers the v0.8.0 command expansion and security controls. The earlier [v0.8 validation record](evals/releases/0.8.0.md) covers the new intent helpers, real browser reports, installation checks and the pending Windows confirmation. GitHub CI remains blocked by account billing. The [v0.10.0 release record](evals/releases/0.10.0.md) records the local checks and release-specific waiver; Windows validation remains pending.
 
 ### Repository layout
 
@@ -276,14 +298,14 @@ The [technical-guidance validation record](evals/releases/0.8.0-technical-guidan
 | `plugins/just-vibe/scripts/toolkit.mjs` | Discovery, routing, sessions, quizzes and persistent intent workflow CLI |
 | `plugins/just-vibe/scripts/lib/` | Catalog, capability, session, quiz, memory, guard, task, lab, proof, practice, experiment and decision modules |
 | `plugins/just-vibe/catalog/` | Canonical command contracts, 112 role profiles, examples, prerequisites and pack metadata |
-| `plugins/just-vibe/skills/` | 216 installed names, including three canonical aliases and setup |
+| `plugins/just-vibe/skills/` | 219 source skill names, including three aliases, goal, orchestration, plan review and setup |
 | `plugins/just-vibe/references/` | Shared execution rules, runtime interface, domain guidance and command index |
 | `.agents/plugins/marketplace.json` | Codex marketplace |
 | `.claude-plugin/marketplace.json` | Claude Code marketplace |
 | `scripts/` and `tests/` | Validation and lifecycle tests |
 | `evals/` | Behavior scenarios and isolated project/data fixtures |
 
-The installer has no runtime npm dependencies or lifecycle install scripts. Optional bundled hooks do no work until configured and trusted for a project; native host trust also applies. It adds no MCP servers, rules or permissions. Provider/check commands use argument arrays rather than interpolating user input into a shell. Host CLIs own installation state and caches. Local planning and naming documents are excluded from both Git and the npm archive.
+The installer has no runtime npm dependencies or lifecycle install scripts. Automatic routing hooks use native host trust and keep personal task records. Optional project check/formatter hooks still do no work until separately configured and trusted. The source plugin adds a local MCP server with scoped access controls. Language rule packs are optional; no host permissions are granted. Provider/check commands use argument arrays rather than interpolating user input into a shell. Host CLIs own installation state and caches. Local planning and naming documents are excluded from both Git and the npm archive.
 
 ## Troubleshooting
 

package/docs/adaptive-assistance.md

@@ -0,0 +1,44 @@
+# Automatic assistance implementation and validation
+
+Included starting in version 0.9.0. User operation and JSON schemas live in the packaged [adaptive reference](../plugins/just-vibe/references/adaptive.md). The website has a matching guide.
+
+## Implementation
+
+| Need | Implementation | Important boundary |
+| --- | --- | --- |
+| Ordinary conversation activates workflows | Bundled UserPromptSubmit hook, shared assistant runtime, local request/context routing | Shortlist retrieval is heuristic; the host resolves meaning, scope and mode. |
+| Only relevant methods are loaded | Compact injected entry point, select/load protocol, full canonical workflow retrieval | Existing direct skills remain available; native catalog truncation cannot remove the hook's runtime path. |
+| Agents discover and use real tools | Capability-specific guidance with observed/unknown state; existing host capability-report validation; full workflow methods | The hook cannot enumerate every host connector; the active agent uses its native discovery tools. |
+| Missing steps remain visible | Per-task requirements, attributed evidence, tool-event metadata, source/artifact hashes, one bounded Stop continuation | Delivery and activity do not prove model compliance; host reports remain labeled. |
+| Corrections change future behavior | Project/user learning records, trigger preference/suppression, effective workflow overlays and additional requirements | Only explicit user feedback is eligible; interpretation is performed by the host. |
+| Updates are explainable and reversible | Per-lesson source excerpts, revisions, version history, rollback, retirement and forgetting | User-scope learning requires explicit cross-project language. |
+| Context survives compaction | SessionStart resume/compact restores the same task, selection and access to current evidence | Context does not restore authorization or assert freshness. |
+| Controls remain usable without memorizing commands | Natural-language personalization routing and a shared agent guide | Ambiguous maintenance targets must be resolved first. |
+
+All runtime code is dependency-free Node. It uses the existing atomic state, bounded reads, path protection, discovery and fingerprint utilities. Hooks never execute project scripts themselves; existing optional check/formatter automation retains its separate trust gate. No account identity or host permission settings are changed by this feature.
+
+The packaged command bodies remain canonical. Effective instructions are assembled on load with versioned personal overrides; `show` uses the same loader. Direct skills reach that loader through shared execution guidance. This avoids writing personal preferences into installed plugin caches that are replaced during upgrades.
+
+## Host support
+
+The adapter uses the common `session_id`, `cwd`, `hook_event_name`, `prompt`, tool-event and Stop output shapes. Codex turn IDs also prevent late events from crossing task boundaries. Plugin hooks use `CLAUDE_PLUGIN_ROOT`, which Codex supplies for compatibility. Host hook review/trust is not bypassed by the installer.
+
+Codex can represent a Stop continuation as another incoming prompt. The runtime recognizes its own exact emitted reminder by hash, adopts a fresh host turn ID when supplied, and preserves the existing task and retry budget. That reminder cannot become a new user-feedback source. Native host events remain distinct from manually supplied CLI inputs; local records are provenance aids, not cryptographic attestations against a process with filesystem access.
+
+References checked during implementation: [Codex hooks](https://learn.chatgpt.com/docs/hooks), [Codex skills](https://learn.chatgpt.com/docs/build-skills), [Claude hooks](https://code.claude.com/docs/en/hooks) and [Claude plugin discovery](https://code.claude.com/docs/en/plugins-reference).
+
+## Validation
+
+- `tests/adaptive.test.mjs` exercises ordinary UI/ML/GitHub/backend requests, unrelated requests, negative clauses, both adapter shapes, effective command loading, tool discovery uncertainty, artifact/source freshness, scoped learning, positive feedback, rollback, user-message provenance and bounded completion.
+- The test drives the real hook entry point and CLI through request, selection, load, evidence and completion in an isolated project. It checks that generated continuation prompts do not create feedback or restart retries, that new continuation turn IDs remain attached to the task, that task-only restrictions cannot be omitted from quoted feedback, and that optional project-hook failures or mutations do not suppress or prematurely certify completion.
+- Existing project-automation, routing, installation, package and full-runtime regression tests cover interaction with previous features.
+- `npm run test:hosts` installs, repeats, upgrades, checks, uninstalls and reinstalls through native Codex/Claude plugin managers in isolated configuration directories. It verifies the installed payload without changing the user's active installation.
+- Website production build and static documentation/link checks cover the new guide and navigation.
+
+These are deterministic/runtime and installation checks. They do not establish that every host version delivers every event, that a model always chooses the right workflow, or that users subjectively prefer every learned change. No new model-behavior score or comparison with another toolkit is claimed.
+
+Validation run on September 20, 2026: 202 root tests passed, one Windows-only test skipped on macOS; 27 of those passing tests cover this feature. Both native lifecycles passed with Codex CLI 0.152.0 and Claude Code 2.1.258. Skill/plugin validators passed during development. The website built 345 pages and passed all four static catalog/link/metadata tests on Node 24.21.0. The new documentation page was inspected in the browser at desktop and mobile widths during development; its mobile content did not overflow the viewport. These checks used isolated state and did not update the user's active installation. See the [v0.9.0 release record](../evals/releases/0.9.0.md) for publication verification.
+
+## Manual acceptance checks
+
+In a host with the plugin enabled and its hooks reviewed, send an ordinary task without a workflow name. Confirm the hook context has a task ID, the agent selects and loads the relevant method, uses actual tools, and reports concrete evidence. Follow with an explicit correction; inspect its source/version, start another session, and verify the next effective workflow includes it. Roll back the lesson and verify the prior behavior returns. Repeat with a conceptual question and an unrelated conversation to assess unnecessary activation and user effort.