just-vibe 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 0.11.0
+
+- Add owned Claude command shortcuts for every selected workflow: `/jv <command>`, `/just-vibe <command>` and `/jv:<command>`. Preserve the canonical `/just-vibe:<command>` form, appended context and workflow authority; validate conflicts before install and preserve user-edited files on uninstall.
+- Recognize all four invocation forms in catalog lookup and explicit routing, with exact selection and unknown-command errors. Add a website guide and links from every command page, distinguishing Claude shortcuts from other hosts' native skill interfaces.
+
+- Add `reprompt` for rewriting prompts with preserved constraints, verified optional skill references, portable fallbacks, and no execution of the embedded task.
+
+- Repair worker startup and orchestration cancellation, runner input identity, workbench lock ownership, and Git repository isolation.
+- Correct strict file-read tracking, Cursor/Kiro event handling, quiz answer identity, session alias collisions, and supported configuration discovery/auditing.
+- Preserve installed Git hooks across package-cache cleanup and make installed hook identity usable for removal after upgrades.
+- Preserve Unicode across HTTP, native-hook, and subprocess boundaries; reject stale browser installation previews and support operator-page reloads.
+- Bind release preparation to unchanged checked source and verify published execution outside the checkout. See the [full review and verification record](docs/full-code-review-2026-09-21.md).
+- Complete owned-process cleanup before terminal results, preserve literal runner arguments, bind Node preload files to trust, and redact preview output independently of chunk boundaries.
+- Protect adaptive cleanup/recovery and unfinished learning activations; preserve repeated session messages; expose implemented recovery/window operations; correct benchmark Unicode and exception evidence.
+- Inspect Git's actual commit index, recover interrupted hook ownership updates, detect managed installation drift, isolate evaluation Git operations, and bind release verification to unchanged archive bytes. See the [second review](docs/second-code-review-2026-09-21.md).
+- Refine website navigation, full-width header/footer surfaces, selected sections, catalog padding, transparent branding, and page transitions without vertical text movement.
+
+## 0.10.0
+
+- Deliver source and focused methods for the 49-group frozen ECC backlog; track partial acceptance separately from implementation and retain the original comparison as a historical snapshot.
+- Correct twelve release-review defects in enforcement, session privacy, concurrent installation/recovery, cancellation, reconnect reservations, service startup, transcript truncation, historical pricing, telemetry identity and dispatch retention. Add process/crash regressions and an actual packed-archive upgrade/rollback test.
+- Add scoped configuration cleanup, skill maintenance, visible session imports/checkpoints, declarative behavior rules, MCP health and exact-version dependency indicators.
+- Add trusted runners, pre-commit/pre-push hooks, bounded jobs and services, cross-host councils, evaluation/promotion receipts, code tours, context graph, usage and telemetry exports.
+- Add the loopback operator and offline catalog, with explicitly enabled preview/apply project-adapter management.
+- Add 43 focused methods, 12 additional specialists, seven skill-file adapters, Kiro v1 event support, 22 connector recipes and an optional Python OpenAI/Anthropic/Ollama client.
+- Add integrity-pinned reviewed updates/rollback previews, edited-file protection, maintained getting-started translations and CPU evaluation examples.
+
+- Add bounded context-capacity, repeated-call and scope warnings, plus an optional Claude status-line bridge using actual host metrics.
+- Add inert quality-preset discovery, separately trusted batched formatting and staged-content commit checks that reject stale or incomplete evidence.
+- Add Cursor event hooks and OpenCode plugin events/tools behind explicit installation choices, with shared-configuration preservation and interruption recovery. Add Zed project skills and Hermes home skills.
+- Add GitHub epic snapshots, dependency/ownership/progress plans, exact comment previews, stale-state checks and uncertain-publication recovery/reconciliation.
+- Add JSON, Markdown and SARIF security reports with CI severity gates, broader configuration indicators and an explicitly pinned/trusted optional AgentShield runner.
+- Add conditional Django, FastAPI, Spring Boot, Flutter and React Native guides to existing build, repair, review and test workflows. Expand the native MCP interface to 45 tools.
+
+- Add guided project configuration, native task selection/evidence tools, grounded preference proposals with conditions/exceptions, and recoverable context backup/import/transfer.
+- Add `/orchestrate` and `/plan-review`, feature/fix/refactor/MVP phase contracts, dependent assignments with bounded retries, reviewed worker application with undo, and a private browser canvas with version-bound feedback.
+- Bind all goal evidence to source/branch/index state; preserve negative-learning decisions through pruning; scan structured MCP settings and exact loopback hosts; register Claude failure events.
+- Deliver complete canonical methods, selected technical rules and approved preferences to native specialists. Generate Codex-compatible MCP launch paths for persistent bundled installs.
+- Add Kimi, Qwen, Windsurf and Antigravity IDE adapters and opt-in real-host/browser verification runners.
+
+- Add the goal skill and persistent criteria, progress, blockers, evidence and resume context.
+- Add scoped memory and handoffs, native MCP tools, 12 specialist agents and bounded worktree workers.
+- Add optional action guards, a static agent-configuration scanner, observed-pattern review, preference sharing and skill/agent draft generation.
+- Add a local activity/health report, selective skill installation, 16 language/framework rule packs and owned-file adapters for Cursor, OpenCode, Copilot, Gemini, Kimi, Qwen, Windsurf and Antigravity IDE.
+- Preserve existing defaults and user edits; document activation, privacy, host coverage and verification limits.
+
 ## 0.9.0
 
 - Add automatic request routing and compaction/resume context through native Codex/Claude plugin hooks, with focused workflow loading and guidance for discovering actual host capabilities.

package/README.md

@@ -1,10 +1,12 @@
 # just-vibe
 
+**Command shortcuts (v0.11.0):** Claude setup adds `/jv <command>`, `/just-vibe <command>` and `/jv:<command>` alongside `/just-vibe:<command>`. Append the same request after any form. For example, `/jv reprompt Make this prompt clearer: Fix stale search results.` See the [shortcut guide](https://just-vibe-tools.vercel.app/docs/command-shortcuts/) for setup, context examples and Codex's skill-picker equivalent.
+
 Tools, skills, and commands for coding agents.
 
 [Website](https://just-vibe-tools.vercel.app/) · [Documentation](https://just-vibe-tools.vercel.app/docs/) · [Command library](https://just-vibe-tools.vercel.app/commands/) · [Engineering profiles](https://just-vibe-tools.vercel.app/profiles/)
 
-**v0.9.0 contains 112 engineering profiles and 216 skill names backed by 213 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
+**v0.11.0 contains 112 engineering profiles and 220 skill names backed by 217 canonical workflows** for Codex and Claude Code: focused skills for development, architecture, decisions, Git/GitHub, Vercel, Vite, React, UI, backend, APIs, databases, data, ML, LLMs, testing, security, and operations. Each canonical workflow has selection guidance, scope, concrete decision branches, evidence requirements, outputs, verification, recovery conditions and at least three example requests. Each entry point also contains an authored technical method: evidence to inspect, a procedure, a likely misdiagnosis and a discriminating check. Applied methods live in 22 pack guides. The v0.8.1 prompt update adds explicit infer/default/ask policies, a conditional worked example for each pack, and guidance for preserving corrections across turns; see [prompt improvements](docs/prompt-improvements.md).
 
 The [technical audit](docs/technical-audit.md) and [complete coverage inventory](docs/technical-coverage.md) document the latest expansion across every canonical workflow. Review/security commands now route to concrete vulnerability, framework, language and scanner guides. [Security fixture controls](evals/security/README.md) distinguish seeded defects from legitimate behavior; they do not claim model-review accuracy.
 
@@ -13,6 +15,30 @@ The active coding agent executes the workflows with its available tools. The dep
 v0.7 adds a quick path for simple work, a small starter catalog, contextual routing with reasons, project preferences and checkpoints, explicit evidence collectors, and optional project hooks. Detailed auth, component, training and delivery scenarios load only when relevant. See [daily workflows](plugins/just-vibe/references/daily-workflows.md) for configuration and examples, and the [v0.7 validation record](evals/releases/0.7.0.md) for tested scope and limits.
 
 
+## Runtime tools and goals
+
+The frozen ECC backlog now has a separate [implementation and evidence ledger](docs/ecc-implementation-plan.md). This expansion adds 43 focused methods, 22 connector recipes, native session imports, configuration cleanup, behavior rules, MCP health, bounded jobs and services, independent councils, evaluation receipts, CodeTour exports, a context graph, usage accounting and an offline operator/catalog interface. [Use these features](plugins/just-vibe/references/runtime-expansion.md). These capabilities are included starting in **v0.10.0**. Acceptance is tracked separately: local regression and installation checks do not establish every framework, live-provider or operating-system requirement. See the [release fixes and remaining validation](docs/release-fixes-2026-09-20.md).
+
+The toolkit includes **/goal**, scoped searchable memory, 48 native MCP tools, 24 independent specialists, optional worktree workers, before-action policy, a configuration scanner, reviewed pattern learning, preference sharing/evolution, an activity report, selective installations and 16 language/framework rule packs. Cursor, OpenCode, Copilot, Gemini, Kimi, Qwen, Windsurf and Antigravity IDE have project file adapters. The source catalog now contains **220 skill names and 217 canonical workflows**, including the `reprompt` workflow added in v0.11.0. Guided setup, portable context, reviewed dependent workers and a browser plan canvas are included.
+
+Read [the feature guide](docs/runtime-tools.md), [operation schemas and examples](plugins/just-vibe/references/runtime-platform.md), and [the implementation/validation plan](docs/runtime-expansion-plan.md). Existing installs retain their defaults; observation, blocking policy and worker launching are opt-in.
+
+The toolkit also includes context and repeated-call warnings, detected check presets, batched formatting, staged commit checks, Cursor/OpenCode event adapters, Zed/Hermes skill installation, GitHub epic coordination, and JSON/Markdown/SARIF security reports with an optional reviewed AgentShield runner. Focused Django, FastAPI, Spring Boot, Flutter and React Native guides extend existing workflows. See [configuration, examples and limits](plugins/just-vibe/references/runtime-depth.md) and [verification](docs/remaining-ecc-gaps-plan.md).
+
+The [complete ECC comparison](docs/ecc-complete-audit.md) inventories a pinned upstream snapshot and records remaining functionality, technical-depth gaps, optional products and implementation requirements. Earlier completed rounds covered their selected findings; they did not establish full ECC parity. The ledger distinguishes source presence from live verification and includes a maintainer check for upstream drift.
+
+## Improve a prompt
+
+Starting in v0.11.0, select **just-vibe → reprompt** in Codex, or use `/just-vibe:reprompt` in Claude Code, and append the prompt:
+
+```text
+/just-vibe:reprompt Fix our React search page when older requests finish last.
+Keep the current API and dependencies. Do not deploy.
+Use relevant installed skills in the rewritten prompt.
+```
+
+It returns a paste-ready prompt, preserves your constraints, and names only skills it can verify (with availability checks for another host). It does not execute the embedded task. Add “output only,” “no skills,” or identify an earlier prompt or file to refine. See [examples and boundaries](plugins/just-vibe/references/reprompt.md).
+
 ## Automatic assistance
 
 Describe the outcome normally: “Fix the mobile menu,” “Why is training unstable?” or “Address this PR’s feedback.” Trusted native hooks now route each request to a focused shortlist, restore selected work after compaction, and direct the agent to discover and use its actual tools. Command names remain optional.
@@ -34,7 +60,7 @@ v0.8.0 adds working runtime helpers behind natural-language skill requests:
 
 See the [workflow guide](plugins/just-vibe/references/intent-workflows.md) for examples, boundaries and recovery. Users provide ordinary briefs; the agent prepares the helper inputs. These features support judgment rather than claiming an objective quality score.
 
-**Release information:** Check [npm for just-vibe 0.9.0](https://www.npmjs.com/package/just-vibe/v/0.9.0) and the [release validation record](evals/releases/0.9.0.md) for registry verification and tested scope. This release uses the maintainer-authorized local-check exception because GitHub Actions minutes are unavailable; no CI pass is claimed.
+**Release:** v0.11.0 adds prompt rewriting and short command invocations, together with the runtime fixes from both recent code reviews. Check [npm](https://www.npmjs.com/package/just-vibe) for registry availability. Native syntax, installation checks and evaluation limits are documented in the [shortcut verification record](docs/audits/command-shortcuts-2026-09-21.md). GitHub Actions is unavailable because account billing prevents jobs from starting; local checks are recorded separately and no CI pass is claimed.
 
 
 ## Use the workflows
@@ -275,7 +301,7 @@ The [conversation harness](evals/conversation/README.md) records review, selecte
 
 The [v0.6 results](evals/releases/0.6.0.md) record 32 controlled implementation trials and eight revised-command development trials. All passed their bounded checks; this does not rank overall output quality or convenience. The tasks supplied detailed contracts and did not measure user effort or preference. The [command-depth review](docs/command-quality.md#focused-depth-review) explains 27 focused revisions, and the [contextual review guide](docs/command-quality.md#output-quality-and-convenience) covers judgment, clarity, discovery and correction burden. [Benchmark protocol and supporting metrics](evals/benchmark/README.md) remain available for reproduction. External integration, browser and deployment checks require the relevant task environment.
 
-The [technical-guidance validation record](evals/releases/0.8.0-technical-guidance.md) covers the v0.8.0 command expansion and security controls. The earlier [v0.8 validation record](evals/releases/0.8.0.md) covers the new intent helpers, real browser reports, installation checks and the pending Windows confirmation. GitHub CI remains blocked by account billing. The [v0.9.0 release record](evals/releases/0.9.0.md) records the current local checks and release-specific waiver; Windows validation remains pending.
+The [technical-guidance validation record](evals/releases/0.8.0-technical-guidance.md) covers the v0.8.0 command expansion and security controls. The earlier [v0.8 validation record](evals/releases/0.8.0.md) covers the new intent helpers, real browser reports, installation checks and the pending Windows confirmation. GitHub CI remains blocked by account billing. The [v0.10.0 release record](evals/releases/0.10.0.md) records the local checks and release-specific waiver; Windows validation remains pending.
 
 ### Repository layout
 
@@ -286,14 +312,14 @@ The [technical-guidance validation record](evals/releases/0.8.0-technical-guidan
 | `plugins/just-vibe/scripts/toolkit.mjs` | Discovery, routing, sessions, quizzes and persistent intent workflow CLI |
 | `plugins/just-vibe/scripts/lib/` | Catalog, capability, session, quiz, memory, guard, task, lab, proof, practice, experiment and decision modules |
 | `plugins/just-vibe/catalog/` | Canonical command contracts, 112 role profiles, examples, prerequisites and pack metadata |
-| `plugins/just-vibe/skills/` | 216 installed names, including three canonical aliases and setup |
+| `plugins/just-vibe/skills/` | 220 source skill names, including three aliases, goal, orchestration, plan review and setup |
 | `plugins/just-vibe/references/` | Shared execution rules, runtime interface, domain guidance and command index |
 | `.agents/plugins/marketplace.json` | Codex marketplace |
 | `.claude-plugin/marketplace.json` | Claude Code marketplace |
 | `scripts/` and `tests/` | Validation and lifecycle tests |
 | `evals/` | Behavior scenarios and isolated project/data fixtures |
 
-The installer has no runtime npm dependencies or lifecycle install scripts. Automatic routing hooks use native host trust and keep personal task records. Optional project check/formatter hooks still do no work until separately configured and trusted. It adds no MCP servers, rules or permissions. Provider/check commands use argument arrays rather than interpolating user input into a shell. Host CLIs own installation state and caches. Local planning and naming documents are excluded from both Git and the npm archive.
+The installer has no runtime npm dependencies or lifecycle install scripts. Automatic routing hooks use native host trust and keep personal task records. Optional project check/formatter hooks still do no work until separately configured and trusted. The source plugin adds a local MCP server with scoped access controls. Language rule packs are optional; no host permissions are granted. Provider/check commands use argument arrays rather than interpolating user input into a shell. Host CLIs own installation state and caches. Local planning and naming documents are excluded from both Git and the npm archive.
 
 ## Troubleshooting
 

package/docs/audits/command-shortcuts-2026-09-21.md

@@ -0,0 +1,14 @@
+# Command shortcut verification — 2026-09-21
+
+This records prepublication checks for the v0.11.0 changes. It is not a general model-quality evaluation or proof of registry publication.
+
+- Node 24: full validation and test suite, 400 tests total, 399 passed, one Windows-only skip.
+- Native bundled installation lifecycles passed in isolated Codex 0.152.0 and Claude Code 2.1.258 configuration directories: setup, repeated setup, doctor, update, uninstall, repeated uninstall and reinstall.
+- Claude Code 2.1.258 live startup listed all 220 canonical namespaced commands and all 220 jv aliases, plus the jv and just-vibe dispatchers.
+- Four separate live Claude requests using /jv reprompt, /just-vibe reprompt, /jv:reprompt and /just-vibe:reprompt successfully returned rewritten prompts. The three forwarding forms called the canonical just-vibe:reprompt skill with the complete argument string. The canonical form loaded directly. The embedded explanatory task was not executed.
+- Four live Codex 0.152.0 CLI requests passed through the installed plugin and trusted prompt hooks, one for each form. All four selected reprompt, loaded its instructions and returned a rewritten prompt. These were ordinary prompt-text invocations, not custom slash-menu registrations. One run also emitted tracking commentary despite output-only wording; this is not a claim of perfect model adherence.
+- The native lifecycle suite was repeated successfully with v0.11.0 package and plugin metadata.
+- Fixtures cover every catalog ID through all four parsers, multiline context preservation, unknown IDs, explicit routing over incidental task keywords, selected installations, ownership conflicts, selection expansion, edited files and uninstall preservation.
+- Website production build generated 355 pages; four static catalog/link/metadata checks passed. The guide was inspected in the browser at desktop and 390px widths, with no document overflow. Its link is available from docs navigation and every command page.
+
+Limits: live checks exercised a simple rewrite, not every command's behavior or every host/version. Prompt quality, implied assumptions and skill selection still require case-specific judgment. Codex uses its native skill picker; parser recognition does not add custom slash entries to another host's input box. New catalog behavior remains marked not-evaluated in the formal behavioral evaluation system.