npm - vibe-coding-master - Versions diffs - 0.2.6 → 0.2.7 - Mend

vibe-coding-master 0.2.6 → 0.2.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

package/README.md +147 -5
package/dist/backend/api/gateway-routes.js +17 -0
package/dist/backend/api/round-routes.js +1 -1
package/dist/backend/gateway/channels/weixin-ilink-channel.js +304 -0
package/dist/backend/gateway/gateway-audit-log.js +39 -0
package/dist/backend/gateway/gateway-command-parser.js +77 -0
package/dist/backend/gateway/gateway-service.js +848 -0
package/dist/backend/gateway/gateway-settings-service.js +214 -0
package/dist/backend/server.js +40 -2
package/dist/backend/services/claude-hook-service.js +13 -4
package/dist/backend/services/round-service.js +110 -64
package/dist/backend/services/session-service.js +10 -4
package/dist/backend/services/task-service.js +32 -3
package/dist/backend/services/translation-service.js +15 -0
package/dist/shared/types/gateway.js +1 -0
package/dist-frontend/assets/{index-CPXFnxAY.css → index-7lq6YPCq.css} +1 -1
package/dist-frontend/assets/index-DHuS-DYr.js +92 -0
package/dist-frontend/index.html +2 -2
package/docs/gateway-design.md +200 -27
package/docs/product-design.md +34 -13
package/docs/v0.2-implementation-plan.md +22 -7
package/package.json +2 -1
package/dist-frontend/assets/index-D0_02lmQ.js +0 -90

package/dist-frontend/index.html CHANGED Viewed

@@ -4,8 +4,8 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>VibeCodingMaster</title>
-    <script type="module" crossorigin src="/assets/index-D0_02lmQ.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CPXFnxAY.css">
+    <script type="module" crossorigin src="/assets/index-DHuS-DYr.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-7lq6YPCq.css">
   </head>
   <body>
     <div id="root"></div>

package/docs/gateway-design.md CHANGED Viewed

@@ -26,6 +26,12 @@ Product rules:
   VCM instance.
 - Gateway user messages talk only to the `project-manager` role.
 - Gateway never sends directly to `architect`, `coder`, or `reviewer`.
+- When the desktop UI has a current task selected, Gateway should adopt that
+  project/task context automatically instead of requiring `/tasks` and
+  `/use-task` first.
+- When Gateway is enabled, browser Flow pause alert should be forced off because
+  Weixin becomes the notification path and browser modal alerts can block the
+  workflow.
 - Gateway may push PM replies to Weixin whenever it is enabled, even when the PM
   turn was started from the desktop UI rather than from Weixin.
 - When translation is enabled, Chinese input is translated to English before it
@@ -37,8 +43,9 @@ The short product sentence is:
 ```text
 One phone DM binds to one desktop VCM; the phone can select project/task context,
-send ordinary messages to the current task's PM, and receive translated PM
-replies while gateway is enabled.
+pull the connected base repository, create and initialize a task through the
+saved launch template, send ordinary messages to the current task's PM, receive
+translated PM replies, and close completed tasks while gateway is enabled.
 ```
 ## Binding Model
@@ -76,13 +83,18 @@ current project
 current task
 current role = project-manager
 translation enabled/disabled
+saved launch template
 ```
 Plain text messages are sent to the PM session of the current task. If no
 project or task is selected, gateway replies with a short setup hint.
-The desktop UI remains the source of truth. Gateway only changes context through
-explicit commands.
+VCM normally runs one project and one task at a time. When Gateway is enabled,
+or when `/status` is called, VCM should refresh Gateway context from the
+desktop-selected project/task when available.
+The desktop UI remains the source of truth. Gateway changes mobile context or
+task lifecycle state only through explicit commands.
 ## Command Surface
@@ -93,8 +105,12 @@ MVP commands:
 /status
 /projects
 /use-project <index-or-path>
+/pull-current
 /tasks
 /use-task <index-or-task-slug>
+/create-task <task-slug> [title]
+/close-task
+/close-task confirm <task-slug>
 /translate on
 /translate off
 ```
@@ -102,6 +118,25 @@ MVP commands:
 Plain text that does not start with `/` is treated as a PM message for the
 current task.
+Task lifecycle commands:
+- `/pull-current` calls `POST /api/projects/current/pull` for the selected
+  desktop VCM project. It runs the same connected-repository fast-forward-only
+  pull as the desktop button. It must fail if the base repo has uncommitted
+  changes, if the branch has no upstream, or if the current active task is an
+  inline task using the base repo directly.
+- `/create-task <task-slug> [title]` creates a normal worktree-backed task,
+  selects it as the mobile current task, applies the saved launch template, and
+  starts the four role sessions (`project-manager`, `architect`, `coder`,
+  `reviewer`) through the same one-click-start path as the desktop UI. The saved
+  template controls permission mode, model, auto orchestration, and translation.
+  If no template has been saved, VCM uses the default launch template.
+- `/close-task` starts a destructive confirmation flow for the current task.
+  Gateway replies with the exact confirmation command.
+- `/close-task confirm <task-slug>` calls VCM Close Task cleanup for that task:
+  stop VCM-managed role sessions, remove the task worktree and task branch when
+  the task owns them, and remove VCM task/runtime metadata.
 Commands intentionally not in MVP:
 ```text
@@ -109,13 +144,13 @@ Commands intentionally not in MVP:
 /reject
 /pause
 /resume
-/start-session
 /stop-session
 ```
-The first version should not expose state-changing workflow controls beyond
-selecting the mobile context and toggling gateway translation. More controls can
-be added later after the PM-only conversation path is reliable.
+The first version should not expose arbitrary terminal controls, role-specific
+start/stop controls, approve/reject gates, or shell execution. The state-changing
+commands are limited to the VCM task lifecycle primitives needed to run a task
+end to end from mobile.
 ## Inbound Message Flow
@@ -150,6 +185,77 @@ Gateway should use the same bracketed-paste terminal submission path as the VCM
 desktop input path. A terminal write only proves the text was written to the PTY;
 Claude Code `UserPromptSubmit` remains the acceptance signal.
+## Task Lifecycle Command Flows
+### Pull Current Base Repository
+```text
+/pull-current
+  -> require current project
+  -> call POST /api/projects/current/pull
+  -> backend runs git pull --ff-only on connected base repo
+  -> refresh current project status
+  -> reply with branch, upstream, ahead/behind, and short commit
+```
+Rules:
+- Pull only the connected base repository, never a task worktree.
+- Use the same backend guard as desktop Connected Repository Pull.
+- Do not stash, merge, or continue after divergence.
+- If pull fails, reply with the VCM error message and hint.
+### Create And Initialize Task
+```text
+/create-task <task-slug> [title]
+  -> require current project
+  -> create a normal worktree-backed task through existing task service/API
+  -> select it as gateway current task
+  -> load saved launch template from app preferences
+  -> set orchestration from template
+  -> set gateway/desktop translation state from template
+  -> start four role sessions with template permission/model
+  -> switch mobile current role to project-manager
+  -> reply with task slug, branch, worktree, template summary, and session status
+```
+Rules:
+- Use the same task creation validation as desktop VCM.
+- Default to `createWorktree: true`. Gateway should not create inline tasks in
+  the MVP, because inline tasks make mobile pull/cleanup semantics harder.
+- Use the same one-click-start semantics as desktop VCM: only start from a newly
+  created task with no existing role sessions.
+- If one role session fails to start, reply with the role that failed and leave
+  the partially created task visible in desktop VCM for manual recovery.
+- Do not send the task request as a PM prompt. Task creation is a VCM control
+  command, not natural-language work for Claude.
+### Close Task
+```text
+/close-task
+  -> require current task
+  -> reply with destructive confirmation text
+/close-task confirm <task-slug>
+  -> require current task slug matches confirmation slug
+  -> call VCM Close Task cleanup
+  -> clear mobile current task if cleanup succeeds
+  -> reply with removed worktree, deleted branch, and cleaned state paths
+```
+Rules:
+- Close Task is destructive, so mobile requires explicit confirmation with the
+  task slug.
+- Use the same cleanup path as desktop Close Task.
+- Do not preflight or preserve uncommitted work beyond the existing desktop
+  Close Task behavior.
+- After cleanup, gateway should ask the user to run `/tasks` or
+  `/create-task <task-slug>` for the next task.
 ## PM Reply Push Flow
 Gateway push is not limited to gateway-originated turns. If gateway is enabled,
@@ -200,6 +306,25 @@ If no task is selected:
 No task is selected. Use /tasks and /use-task first.
 ```
+If `/pull-current` cannot run because the base repo is dirty, has no upstream,
+or is blocked by an inline task, reply with the same VCM reason shown in the
+desktop Connected Repository section.
+If `/create-task` fails task validation, reply with the VCM error and hint.
+Common examples are invalid task slug, dirty base repo, existing task branch, or
+missing harness ignore rules for `.ai/vcm/` / `.claude/worktrees/`.
+If `/create-task` creates the task but one of the four role sessions fails to
+start, do not hide the partial state. Reply with:
+```text
+Task was created, but <role> failed to start. Open desktop VCM to recover or retry.
+```
+If `/close-task confirm <task-slug>` does not match the current task, do not
+clean up anything. Reply with the current task slug and the exact confirmation
+command.
 If gateway translation fails before sending to PM, do not send the original
 Chinese. Reply with a translation failure message and ask the user to retry.
@@ -357,6 +482,13 @@ Settings shape:
   "dedupe": {
     "recentInboundMessageIds": []
   },
+  "pendingConfirmations": {
+    "closeTask": {
+      "taskSlug": null,
+      "createdAt": null,
+      "expiresAt": null
+    }
+  },
   "pushCursors": {
     "<taskSlug>:project-manager:<claudeSessionId>": {
       "lastTranscriptEventId": null,
@@ -381,7 +513,7 @@ Audit log rules:
 ## Backend Architecture
-Suggested files:
+Implemented files:
 ```text
 src/shared/types/gateway.ts
@@ -390,8 +522,6 @@ src/backend/gateway/
   gateway-service.ts
   gateway-settings-service.ts
   gateway-command-parser.ts
-  gateway-pm-bridge.ts
-  gateway-notifier.ts
   gateway-audit-log.ts
   channels/
     weixin-ilink-channel.ts
@@ -404,19 +534,26 @@ Responsibilities:
 - `gateway-settings-service`: load/save app-local gateway settings and secrets.
 - `weixin-ilink-channel`: QR login, long polling, send text, token expiration.
 - `gateway-command-parser`: parse `/help`, `/status`, `/projects`,
-  `/use-project`, `/tasks`, `/use-task`, and `/translate`.
-- `gateway-pm-bridge`: submit plain messages to the current task PM session.
-- `gateway-notifier`: push PM transcript replies to Weixin after PM Stop.
+  `/use-project`, `/pull-current`, `/tasks`, `/use-task`, `/create-task`,
+  `/close-task`, and `/translate`.
 - `gateway-audit-log`: append redacted JSONL audit entries.
-- `gateway-service`: lifecycle, poll loop, dispatch, and error backoff.
+- `gateway-service`: lifecycle, poll loop, command dispatch, PM terminal
+  submission, PM Stop reply push, and error backoff.
 - `gateway-routes`: desktop UI settings, QR login start/status, enable/disable,
   rebind, and gateway status.
 Service dependencies:
-- `ProjectService`: current project and recent project paths.
-- `TaskService`: task list and selected task validation.
-- `SessionService`: PM session state and Claude session metadata.
+- `ProjectService`: current project, recent project paths, connected-repo
+  status, and fast-forward-only pull.
+- `TaskService`: task list, task creation, selected task validation, and Close
+  Task cleanup.
+- `SessionService`: PM session state, Claude session metadata, and role session
+  start for launch-template initialization.
+- `AppSettingsService`: saved launch template with permission mode, model, auto
+  orchestration, and translation defaults.
+- `MessageService` / orchestration state service: set the newly created task to
+  template auto/manual orchestration mode.
 - `TerminalRuntime`: controlled PM terminal submission.
 - `ClaudeTranscriptService`: PM assistant output extraction.
 - `TranslationService` / translation provider: inbound Chinese-to-English and
@@ -446,7 +583,7 @@ The user should be able to:
 - start QR login
 - see whether the phone is bound
 - reset binding
-- select current project/task from desktop
+- inspect the current gateway project/task context
 - toggle gateway translation
 - inspect recent gateway errors
@@ -482,7 +619,7 @@ Validation:
   expiration, redirect host, and retry backoff.
 - Manual smoke test with a real Weixin DM before wiring PM submission.
-### Phase 3: Inbound Command Handling
+### Phase 3: Inbound Context Commands
 - Implement `/help`, `/status`, `/projects`, `/use-project`, `/tasks`,
   `/use-task`, `/translate on`, and `/translate off`.
@@ -495,7 +632,31 @@ Validation:
 - Parser tests for known commands and invalid commands.
 - Gateway service tests for ignored unbound users and deduped messages.
-### Phase 4: PM Message Submission
+### Phase 4: Task Lifecycle Commands
+- Implement `/pull-current` by calling the connected repository pull path:
+  `POST /api/projects/current/pull` or the equivalent project service method.
+- Implement `/create-task <task-slug> [title]` by creating a worktree-backed
+  task, selecting it as mobile current task, applying the saved launch template,
+  setting orchestration mode, setting translation state, and starting the four
+  role sessions.
+- Implement `/close-task` and `/close-task confirm <task-slug>` as a two-step
+  destructive confirmation around the same Close Task cleanup path as desktop
+  VCM.
+- Persist close-task pending confirmation outside the repository.
+Validation:
+- Parser tests for `/pull-current`, `/create-task`, `/close-task`, and
+  confirmation mismatch.
+- Service tests for pull success and pull-blocked reasons.
+- Service tests that task creation uses `createWorktree: true` and launch
+  template role settings.
+- Service tests for partial role-session start failure reporting.
+- Service tests that Close Task calls the existing cleanup path only after exact
+  slug confirmation.
+### Phase 5: PM Message Submission
 - Treat plain DM text as PM input for the current task.
 - Require current project, current task, running PM session, and idle PM
@@ -512,9 +673,9 @@ Validation:
 - Tests that translated prompts do not include original Chinese.
 - Tests that successful submit records a gateway turn audit entry.
-### Phase 5: PM Reply Push
+### Phase 6: PM Reply Push
-- Hook PM `Stop` handling into `gateway-notifier`.
+- Hook PM `Stop` handling into `gateway-service`.
 - Load PM transcript and extract new assistant text since the last push cursor.
 - Push PM replies whenever gateway is enabled, regardless of whether the user
   turn started from gateway or desktop.
@@ -527,7 +688,7 @@ Validation:
 - Deduplication tests across repeated Stop hooks and app restart.
 - Translation failure fallback test.
-### Phase 6: Audit, Recovery, And Packaging
+### Phase 7: Audit, Recovery, And Packaging
 - Add redacted audit JSONL writer.
 - Add gateway lifecycle shutdown on VCM server stop.
@@ -542,10 +703,13 @@ Validation:
 - Manual iLink smoke test:
   - QR bind
   - `/status`
+  - `/pull-current`
+  - `/create-task mobile-demo`
   - `/tasks`
   - `/use-task`
   - Chinese plain text to PM
   - PM reply pushed back to Weixin
+  - `/close-task` + `/close-task confirm mobile-demo`
   - restart without replaying old messages
 ## Key Risks And Decisions
@@ -555,9 +719,11 @@ transcript events, not raw PTY output, because terminal output contains tool
 logs, redraws, and partial text. The notifier must persist a per-PM-session
 cursor.
-The second risk is accidental command scope growth. The MVP must stay PM-only
-and avoid workflow actions such as approve/reject/start/stop until the mobile
-conversation path is proven.
+The second risk is accidental command scope growth. Gateway should support the
+small task lifecycle needed to run work end to end from mobile: pull base repo,
+create and initialize a task, talk to PM, receive PM replies, and close the
+task. It should still avoid arbitrary terminal control, approve/reject gates,
+role-specific start/stop controls, shell commands, and direct non-PM prompts.
 The third risk is token and message leakage. Gateway credentials and audit logs
 must stay under `~/.vcm/gateway`, with secrets redacted from logs and never
@@ -575,10 +741,17 @@ Gateway MVP is complete when:
 - Desktop VCM can QR-bind one Weixin DM identity.
 - Bound phone can send `/status` and receive current VCM status.
 - Bound phone can list and select current project/task context.
+- Bound phone can run `/pull-current` to update the connected base repository
+  through VCM's fast-forward-only pull path.
+- Bound phone can run `/create-task <task-slug> [title]` to create a
+  worktree-backed task, select it, apply the saved launch template, and start
+  the four role sessions.
 - Bound phone can send Chinese plain text to current task PM.
 - PM receives only the translated English prompt, without original Chinese.
 - Gateway can push PM assistant replies to Weixin whenever enabled.
 - PM replies are translated to Chinese when gateway translation is enabled.
+- Bound phone can close a completed task through `/close-task` plus exact slug
+  confirmation, using the same cleanup path as desktop Close Task.
 - Duplicate iLink messages and duplicate PM Stop hooks do not produce duplicate
   sends.
 - Expired iLink token is reported clearly and requires rebind.

package/docs/product-design.md CHANGED Viewed

@@ -19,6 +19,26 @@ The user should mostly talk to `project-manager`. The project manager coordinate
 VCM is not a hosted SaaS product. It runs locally, connects to a local repository path, starts local Claude Code processes, and writes local task metadata into that repository.
+### 1.1 VCM Statistics Terminology
+VCM statistics use a task-level hierarchy:
+```text
+Session = n x Round = m x Turn
+```
+- `Session`: one VCM task. It is the statistics container for the whole task, from task creation until Close Task.
+- `Round`: one VCM conversation cycle. It starts with an accepted user prompt or VCM-delivered prompt, continues through sequential role orchestration, and ends when the final role turn stops and no next turn starts inside the 10 second stop window. In the normal orchestrated workflow, the final visible result comes back from `project-manager`.
+- `Turn`: one role-level Claude Code conversation. It starts when a prompt is submitted to one role session and ends when that role's Claude Code process emits `Stop`.
+Turns inside one Round are strictly sequential. VCM should finish one role Turn before starting the next role Turn in that Round.
+Session state is intentionally small: `created` means no Round has started yet, `running` means there is a current running Round, and `stopped` means there is no current running Round after at least one Round has stopped. Starting Claude Code role sessions does not make the VCM Session `running`.
+Round state is only `running` or `stopped`. After a `Stop` hook, the 10 second stop window still counts as `running`; the Round becomes `stopped` only when the timer expires without another `UserPromptSubmit`.
+This `Session` term is only for VCM statistics. It must not be confused with a Claude Code role session, terminal runtime session, or Claude transcript session id. VCM still runs one Claude Code role session per role inside one task-level VCM Session.
 ## 2. Product Goals
 VCM V1 must make multi-session Claude Code work visible and recoverable:
@@ -223,7 +243,7 @@ Sections:
 - `New Task`
 - `Tasks`
-The connected active task also has a bottom status dock. It is not a collapsible sidebar section. It stays at the bottom of the sidebar and shows the active task title, task status, task start time, total elapsed time, total flow-round count, and Claude Code active runtime. When the current round is active or settling, it also shows that round's start time and Claude Code active runtime.
+The connected active task also has a bottom status dock. It is not a collapsible sidebar section. It stays at the bottom of the sidebar and shows the active VCM Session title, task status, Session start time, total elapsed time, total Round count, and Claude Code active runtime. When the current Round is running, it also shows the Current Round start time, total elapsed time, Claude Code active runtime, and Turn count.
 `Repository Path` layout:
@@ -268,7 +288,7 @@ The old `Dirty: yes/no` label is not used. The UI uses `Working tree: clean` or
 The default theme mode is `System`, which follows the OS/browser color-scheme preference. The entire application chrome, sidebar, forms, modals, status badges, and workspace panels must support both light and dark rendering. Embedded terminals keep their terminal-native dark styling.
 When `Flow pause alert` is on, VCM plays a short, soft, two-note local chime after a role flow stops advancing. If the flow lasted less than 2 minutes, the chime plays 3 times, 1.4 seconds apart, and stops. If the flow lasted 2 minutes or longer, VCM shows an in-app alert dialog and repeats the chime until the user confirms the dialog. The alert sound must reuse one browser audio context after user activation instead of creating a fresh context for each repeat, because Safari can block repeated timer-driven playback when every repeat looks like a new autoplay attempt.
-`Try alert` must work even when no flow has just paused so the user can verify browser sound and notification behavior.
+`Try alert` must work even when no flow has just stopped advancing so the user can verify browser sound and notification behavior.
 Safari may still require the user to manually set `Safari > Website Settings > Auto-Play > Allow All Auto-Play`; Chrome is the recommended browser for reliable repeated alert sound.
 There is no separate `Pause orchestration` or `Resume orchestration` control in the GUI. The current product model is one on/off toggle in the role console toolbar.
@@ -341,21 +361,22 @@ VCM detects flow pauses from Claude Code hook events, not from terminal silence,
 Backend role state:
 - VCM terminal submit: role becomes `running`.
-- `Stop`: role becomes `idle` and records `lastStopAt`.
+- `Stop`: role becomes `idle` and records `lastTurnEndedAt`.
 - The role tab and flow pause state both react to Claude Code hook events.
-Task-level round state:
+Task-level Round state:
-- The first `UserPromptSubmit` starts a flow round.
-- Each later `UserPromptSubmit` inside the same flow increments `promptSubmitCount`.
-- `Stop` moves the round into a 10 second settling window.
-- A new `UserPromptSubmit` inside the window continues the same round.
-- If no new prompt is accepted before the deadline, the round becomes `paused`.
-- The pause transition is timer-driven from the `Stop` event. Round-state reads do not end a round.
-- Before pausing, VCM checks `.ai/vcm/handoffs/messages`; if a pending route message exists and can be delivered, VCM retries delivery and extends the settling window instead of alerting.
-- The same round state stores total round count, prompt-submit count, stop count, and Claude Code active runtime. Active runtime is measured only between `UserPromptSubmit` and `Stop`, not during the settling window.
+- The first `UserPromptSubmit` starts a Round for the current VCM Session.
+- Each accepted `UserPromptSubmit` is the start of one Turn.
+- `Stop` ends the current Turn and starts a 10 second stop timer; during that timer, the Round is still `running`.
+- A new `UserPromptSubmit` inside the window continues the same Round and starts the next Turn.
+- If no new prompt is accepted before the deadline, the Round becomes `stopped`.
+- The stop transition is timer-driven from the `Stop` event. Round-state reads do not end a Round.
+- Before stopping, VCM checks `.ai/vcm/handoffs/messages`; if a pending route message exists and can be delivered, VCM retries delivery and extends the stop window instead of alerting.
+- The same Round state stores total Round count, Turn count, completed Turn count, and Claude Code active runtime. Active runtime is measured only between `UserPromptSubmit` and `Stop`, not during the stop window.
+- The Current Round dock shows both wall-clock Round duration and Claude Code active runtime. `Total` is `now - Round.startedAt`; `CC runtime` is the accumulated active runtime across Turns in that Round; `Turn count` is the number of accepted prompts in the Round.
-The frontend polls this task-level round state and deduplicates each paused round so the same paused state does not alert on every poll. Flow duration is measured from the first `UserPromptSubmit` to `pausedAt`, falling back to the last `Stop` when needed. Pauses under 2 minutes trigger the weak 3-chime reminder at 1.4 second intervals. Pauses at or above 2 minutes trigger the strong alert dialog and repeating sound until confirmation.
+The frontend polls this task-level Round state and deduplicates each stopped Round so the same stopped state does not alert on every poll. Flow duration is measured from the first `UserPromptSubmit` to `stoppedAt`, falling back to the last `Stop` when needed. Runs under 2 minutes trigger the weak 3-chime reminder at 1.4 second intervals. Runs at or above 2 minutes trigger the strong alert dialog and repeating sound until confirmation.
 ## 9. Session Lifecycle

package/docs/v0.2-implementation-plan.md CHANGED Viewed

@@ -1,6 +1,6 @@
 # VCM 0.2 Implementation Plan
-Last updated: 2026-06-08
+Last updated: 2026-06-10
 VCM 0.2 has two product tracks:
@@ -12,8 +12,9 @@ This document is an implementation plan, not a target-repository harness file.
 ## 1. Mobile Gateway Goal
-VCM 0.2 should let one mobile Weixin DM bind to one desktop VCM instance and
-talk to the current task's `project-manager` role.
+VCM 0.2 should let one mobile Weixin DM bind to one desktop VCM instance,
+manage the basic task lifecycle, and talk to the current task's
+`project-manager` role.
 The detailed gateway product design and implementation plan lives in
 `docs/gateway-design.md`.
@@ -25,6 +26,12 @@ Current decisions:
 - Binding is not project-specific and not task-specific.
 - The bound phone can select among the projects and tasks available to the
   desktop VCM instance.
+- The bound phone can pull the selected connected base repo through VCM's
+  fast-forward-only connected repository pull path.
+- The bound phone can create a worktree-backed task and ask VCM to initialize it
+  through the saved launch template.
+- The bound phone can close a completed task through VCM's Close Task cleanup
+  path after explicit confirmation.
 - Plain mobile text is sent only to the current task's `project-manager`.
 - Gateway never sends directly to `architect`, `coder`, or `reviewer`.
 - PM replies may be pushed to Weixin whenever gateway is enabled, even when the
@@ -45,7 +52,8 @@ VCM 0.2 gateway should not:
 - store gateway credentials in the connected repository
 - send directly to non-PM roles
 - run shell commands from gateway messages
-- provide approve/reject/start/stop workflow controls in the MVP
+- provide approve/reject gates, arbitrary role-specific start/stop controls, or
+  shell execution in the MVP
 - bypass existing backend task/session/orchestration services
 ## 3. Gateway Shape
@@ -64,7 +72,7 @@ The iLink channel is outbound-first from the VCM process. It long-polls iLink
 for direct messages and sends replies through the iLink send API. This avoids a
 public callback URL for the first gateway version.
-Suggested backend files:
+Implemented backend files:
 ```text
 src/shared/types/gateway.ts
@@ -73,8 +81,6 @@ src/backend/gateway/
   gateway-service.ts
   gateway-settings-service.ts
   gateway-command-parser.ts
-  gateway-pm-bridge.ts
-  gateway-notifier.ts
   gateway-audit-log.ts
   channels/
     weixin-ilink-channel.ts
@@ -101,8 +107,12 @@ MVP commands:
 /status
 /projects
 /use-project <index-or-path>
+/pull-current
 /tasks
 /use-task <index-or-task-slug>
+/create-task <task-slug> [title]
+/close-task
+/close-task confirm <task-slug>
 /translate on
 /translate off
 ```
@@ -139,10 +149,15 @@ Gateway MVP is acceptable when:
 - desktop VCM can QR-bind one Weixin DM identity
 - the bound phone can DM `/status` and receive current VCM status
 - the bound phone can list and select current project/task context
+- the bound phone can run `/pull-current` to update the connected base repo
+- the bound phone can run `/create-task <task-slug> [title]` to create a task
+  and start four role sessions through the saved launch template
 - the bound phone can send Chinese plain text to current task PM
 - PM receives only the translated English prompt, without original Chinese
 - gateway pushes PM assistant replies to Weixin whenever enabled
 - PM replies are translated to Chinese when gateway translation is enabled
+- the bound phone can close a completed task through `/close-task` and exact
+  slug confirmation
 - restart does not replay already handled iLink messages or PM replies
 - credentials and audit logs stay outside connected repos

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "vibe-coding-master",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "Local GUI session cockpit for Claude Code role sessions.",
   "type": "module",
   "files": [
@@ -43,6 +43,7 @@
     "execa": "^9.6.0",
     "fastify": "^5.3.3",
     "node-pty": "^1.0.0",
+    "qrcode-generator": "^2.0.4",
     "react": "^19.1.0",
     "react-dom": "^19.1.0",
     "react-markdown": "^10.1.0",