npm - winter-super-cli - Versions diffs - 2026.6.26 → 2026.6.28 - Mend

winter-super-cli 2026.6.26 → 2026.6.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (122) hide show

package/scripts/smoke-browser.js ADDED Viewed

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+import process from 'node:process';
+import { ToolExecutor } from '../src/tools/executor.js';
+const html = [
+  '<html>',
+  '<head><title>Winter Visible Smoke</title></head>',
+  '<body>',
+  '<button id="ok">OK</button>',
+  '<script>',
+  'document.querySelector("#ok").addEventListener("click",()=>document.body.dataset.clicked="yes")',
+  '</script>',
+  '</body>',
+  '</html>',
+].join('');
+const tools = new ToolExecutor({
+  projectPath: process.cwd(),
+  config: { async load() { return {}; } },
+  session: null,
+});
+const browserDebug = await tools.execute('BrowserDebug', {
+  url: `data:text/html,${encodeURIComponent(html)}`,
+  action: 'document.title',
+});
+if (browserDebug.success === false) {
+  console.error(`BrowserDebug smoke failed: ${browserDebug.error}`);
+  process.exit(1);
+}
+const visibleBrowser = await tools.execute('VisibleBrowser', {
+  url: `data:text/html,${encodeURIComponent(html)}`,
+  action: 'click',
+  selector: '#ok',
+  browser: 'chrome',
+  keep_open: false,
+});
+if (visibleBrowser.success === false) {
+  console.error(`VisibleBrowser smoke failed: ${visibleBrowser.error}`);
+  console.error(visibleBrowser.recovery || '');
+  process.exit(1);
+}
+if (visibleBrowser.visible !== true || visibleBrowser.controlled !== true || visibleBrowser.title !== 'Winter Visible Smoke') {
+  console.error(`VisibleBrowser smoke returned incomplete evidence: ${JSON.stringify(visibleBrowser, null, 2)}`);
+  process.exit(1);
+}
+console.log('Browser smoke passed: BrowserDebug and VisibleBrowser controlled a real Chromium page.');

package/scripts/smoke-package.js CHANGED Viewed

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { execFileSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 const root = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
@@ -14,7 +14,7 @@ const MAX_BUFFER = 50 * 1024 * 1024;
 function run(command, args, options = {}) {
   const label = [path.basename(command), ...args].join(' ');
-  console.log(`\n› ${label}`);
+  console.log(`\n> ${label}`);
   return execFileSync(command, args, {
     cwd: root,
     encoding: 'utf8',
@@ -27,7 +27,7 @@ function run(command, args, options = {}) {
 function runNpm(args) {
   if (!isWin) return run('npm', args);
   const commandLine = ['npm', ...args].join(' ');
-  console.log(`\n› ${commandLine}`);
+  console.log(`\n> ${commandLine}`);
   return execFileSync(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', commandLine], {
     cwd: root,
     encoding: 'utf8',
@@ -42,6 +42,12 @@ function assertIncludes(output, expected, label) {
   }
 }
+function assertExists(filePath, label) {
+  if (!existsSync(filePath)) {
+    throw new Error(`${label} is missing from installed package: ${filePath}`);
+  }
+}
 function printOutput(output) {
   const text = String(output || '').trim();
   if (text) console.log(text);
@@ -76,6 +82,34 @@ try {
   }
   console.log(`\nPackage dry-run passed: ${pack.filename} (${pack.files?.length || 0} files)`);
+  const tempRoot = mkdtempSync(path.join(tmpdir(), 'winter-package-smoke-'));
+  try {
+    const realPackOutput = runNpm(['pack', '--json', '--pack-destination', tempRoot]);
+    const [realPack] = JSON.parse(realPackOutput);
+    const tarball = path.join(tempRoot, realPack.filename);
+    assertExists(tarball, 'packed tarball');
+    const installRoot = path.join(tempRoot, 'install');
+    printOutput(runNpm(['install', '--prefix', installRoot, tarball, '--ignore-scripts']));
+    const installedRoot = path.join(installRoot, 'node_modules', 'winter-super-cli');
+    const installedBin = path.join(installedRoot, 'bin', 'winter.js');
+    assertExists(installedBin, 'installed CLI entrypoint');
+    assertExists(path.join(installedRoot, 'resources', 'local', 'gsap-skills'), 'gsap skills resource');
+    assertExists(path.join(installedRoot, 'resources', 'local', 'hermes-agent-core'), 'Hermes core resource');
+    assertExists(path.join(installedRoot, 'resources', 'local', 'page-agent'), 'Page Agent resource');
+    assertExists(path.join(installedRoot, 'resources', 'local', 'ecc'), 'ECC resource');
+    assertExists(path.join(installedRoot, 'skills', 'coding.md'), 'packaged coding skill');
+    assertExists(path.join(installedRoot, 'rules', 'default.md'), 'packaged rule');
+    const installedVersion = run(nodeCmd, [installedBin, '--version'], { cwd: installRoot });
+    printOutput(installedVersion);
+    assertIncludes(installedVersion, 'Winter CLI v', 'installed package version smoke');
+    console.log('\nInstalled package smoke passed.');
+  } finally {
+    rmSync(tempRoot, { recursive: true, force: true });
+  }
   console.log('\nSmoke package gate passed.');
 } catch (error) {
   console.error(`\nSmoke package gate failed: ${error.message}`);

package/skill.md CHANGED Viewed

@@ -16,23 +16,55 @@ File này định nghĩa cách Winter chọn và áp dụng skill. Không chỉ
 - **security**: Protect secrets, validate inputs, avoid unsafe shell/file operations.
 - **performance**: Measure or reason from the hot path before optimizing.
-## Available Local Skills (16)
+## Available Local Skills (48)
+- claude-code
+- codebase-inspection
+- codex
 - codex-primary-runtime
 - coding
-- coding.md
 - debug
-- debug.md
+- debugging-hermes-tui-commands
+- DESCRIPTION
 - design
+- github-auth
+- github-code-review
+- github-issues
+- github-pr-workflow
+- github-repo-management
+- gsap
+- gsap-core
+- gsap-frameworks
+- gsap-performance
+- gsap-plugins
+- gsap-react
+- gsap-scrolltrigger
+- gsap-timeline
+- gsap-utils
+- hermes-agent
+- hermes-agent-skill-authoring
+- hermes-s6-container-supervision
+- kanban-codex-lane
 - learned
+- llms.txt
+- native-mcp
+- node-inspect-debugger
+- opencode
 - performance
+- plan
+- python-debugpy
 - refactor
+- requesting-code-review
 - security
 - skill-creator
+- spike
+- subagent-driven-development
+- systematic-debugging
 - test
-- test.md
+- test-driven-development
 - vercel-react-best-practices
 - vibefigma
 - web-design-guidelines
+- writing-plans
 ## When To Apply
 - Code change: coding + test, thêm debug nếu có lỗi cụ thể.

package/skills/gsap.md ADDED Viewed

@@ -0,0 +1,26 @@
+# GSAP Animation
+Winter packaged skill for GSAP animation work.
+## Usage
+Use this skill when the user asks for JavaScript animation, React/Vue/Svelte animation, scroll-driven animation, timelines, motion paths, SVG animation, Draggable, Flip, SplitText, ScrollTrigger, or asks which animation library to use.
+Before implementing non-trivial animation, inspect the bundled GSAP resource index at `resources/local/gsap-skills/skills/llms.txt`, then read the relevant `SKILL.md` under `resources/local/gsap-skills/skills/`.
+## Prompts
+- Build a GSAP animation using the relevant GSAP skill resource first
+- Add ScrollTrigger with cleanup and refresh behavior
+- Implement React GSAP with `@gsap/react`, scoped refs, and proper cleanup
+- Optimize animation performance using transform and opacity properties
+## Rules
+- Prefer GSAP for JavaScript animation when the user has not chosen another animation library.
+- Install GSAP from the public `gsap` npm package; do not require Club GSAP, private registry, auth tokens, or `.npmrc`.
+- Register plugins once before use.
+- Prefer timelines for sequenced animation instead of chained delays.
+- For React, prefer `@gsap/react` and scoped `useGSAP`; otherwise use `gsap.context()` and revert cleanup.
+- For ScrollTrigger, scope triggers, clean up on unmount, and call `ScrollTrigger.refresh()` after layout changes when needed.
+- Prefer transforms and `autoAlpha` over layout-heavy properties for smooth animation.

package/skills/hermes-agent.md ADDED Viewed

@@ -0,0 +1,17 @@
+# Hermes Agent Core
+Use when a task involves Winter core behavior, agent loops, tools, skills, memory, subagents, TUI, gateways, scheduled automation, or making small models act more capable.
+## Operating Rules
+- Apply Hermes-style closed learning loops: after difficult work, identify reusable procedures and failure modes.
+- Prefer skill lifecycle thinking: create, update, or recommend a skill when a workflow repeats.
+- Use session search/compression patterns: preserve high-signal decisions and verification evidence, not long transcripts.
+- Delegate independent workstreams through subagents or parallel tools when the task can be split safely.
+- Treat MCP/tools as a gateway: allowlist, diagnose, timeout, retry carefully, and require concrete tool-result evidence.
+- For UI/TUI work, keep rendering, command registry, tool progress, interrupts, model state, and session state as explicit separable surfaces.
+- For scheduled/background tasks, define trigger, injected context, verification command, delivery path, and failure handling.
+## Local Reference
+Read `resources/local/hermes-agent-core/AGENTS.md` and the matching `resources/local/hermes-agent-core/skills/**/SKILL.md` file before changing non-trivial Winter agent/core behavior.

package/src/agent/agent-definitions.js CHANGED Viewed

@@ -3,13 +3,13 @@ import { pathToFileURL } from 'url';
 import { promises as fs } from 'fs';
 const DEFAULT_TOOL_SETS = {
-  general: ['Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep', 'OpenBrowser', 'BrowserDebug', 'WebFetch', 'WebSearch', 'Parallel', 'Agent'],
+  general: ['Read', 'Write', 'Edit', 'Bash', 'Glob', 'Grep', 'OpenBrowser', 'VisibleBrowser', 'BrowserDebug', 'WebFetch', 'WebSearch', 'Parallel', 'Agent', 'DelegateTask'],
   plan: ['Read', 'Grep', 'Glob', 'WebFetch', 'WebSearch', 'Parallel'],
   review: ['Read', 'Grep', 'Glob', 'Bash', 'WebFetch'],
-  debug: ['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'OpenBrowser', 'BrowserDebug', 'WebFetch', 'Parallel'],
-  design: ['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'OpenBrowser', 'BrowserDebug', 'WebFetch'],
+  debug: ['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'OpenBrowser', 'VisibleBrowser', 'BrowserDebug', 'WebFetch', 'Parallel'],
+  design: ['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'OpenBrowser', 'VisibleBrowser', 'BrowserDebug', 'WebFetch'],
   research: ['Read', 'Grep', 'Glob', 'WebFetch', 'WebSearch', 'Parallel'],
-  swe: ['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'OpenBrowser', 'BrowserDebug', 'Parallel'],
+  swe: ['Read', 'Write', 'Edit', 'Bash', 'Grep', 'Glob', 'OpenBrowser', 'VisibleBrowser', 'BrowserDebug', 'Parallel'],
 };
 const BUILTIN_AGENTS = [

package/src/agent/runtime.js CHANGED Viewed

@@ -23,12 +23,21 @@ export class AgentRuntime {
     let reachedToolLimit = true;
     let usedTools = false;
     let usedMutatingTools = false;
+    let autoVerified = false;
+    let autoVerificationPassed = false;
+    let autoVerificationFailures = 0;
     const toolSummaries = [];
+    const executedTools = [];
+    const changedFiles = new Set();
     const totalUsage = {};
     const toolSignatureHistory = [];
+    const allowedToolNames = Array.isArray(tools) && tools.length > 0
+      ? new Set(tools.map(tool => tool.name || tool.function?.name).filter(Boolean).map(name => repl.tools.normalizeToolName(name)))
+      : null;
     const executionProfile = repl.selectExecutionProfile(messages, { enableTools: true });
     const requireToolEvidence = repl.actionRequiresTools(messages);
     let noToolActionRetries = 0;
+    let unfinishedActionRetries = 0;
     const sessionContext = repl.session?.getContext?.() || {};
     const profile = sessionContext.workflowProfile || 'general';
     const depth = /deep/i.test(profile) ? 'deep' : 'standard';
@@ -57,15 +66,12 @@ export class AgentRuntime {
           toolPromptOnly: forceTextToolFallback,
           requireToolEvidence: requireToolEvidence && !usedTools,
           usedMutatingTools: usedMutatingTools,
+          deferFinalContent: this.shouldVerifyBeforeFinal(messages, usedMutatingTools, autoVerificationPassed),
         }, startedAt, totalUsage);
         const assistantMsg = turn.assistantMsg || {};
         const toolCalls = turn.toolCalls || [];
-        if (turn.finalContent && toolCalls.length === 0) {
-          finalContent = turn.finalContent;
-        }
         if (toolCalls.length === 0) {
           if (turn.finishReason === 'tool_evidence_required') {
             noToolActionRetries++;
@@ -90,6 +96,80 @@ export class AgentRuntime {
             finalContent = '';
             continue;
           }
+          if (turn.finalContent && this.shouldVerifyBeforeFinal(messages, usedMutatingTools, autoVerificationPassed)) {
+            autoVerified = true;
+            const verification = await this.runVerificationTools({
+              messages,
+              toolSummaries,
+              startedAt,
+              totalUsage,
+            });
+            autoVerificationPassed = verification.passed;
+            if (!verification.passed) {
+              autoVerificationFailures++;
+              if (autoVerificationFailures >= 3) {
+                messages.push({
+                  role: 'user',
+                  content: [
+                    'Verification is still failing after multiple repair attempts.',
+                    'Stop making unsupported success claims. Give the user a concise status with the exact failing commands and remaining blocker.',
+                  ].join('\n'),
+                });
+                finalContent = await repl.requestFinalAnswer(messages, toolSummaries, startedAt, totalUsage);
+                reachedToolLimit = false;
+                break;
+              }
+              messages.push({
+                role: 'assistant',
+                content: assistantMsg.content || '',
+              });
+              messages.push({
+                role: 'user',
+                content: this.buildVerificationRepairPrompt(verification, autoVerificationFailures),
+              });
+              finalContent = '';
+              continue;
+            }
+            messages.push({
+              role: 'assistant',
+              content: assistantMsg.content || '',
+            });
+            finalContent = await repl.requestFinalAnswer(messages, toolSummaries, startedAt, totalUsage);
+            reachedToolLimit = false;
+            break;
+          }
+          if (
+            turn.finalContent &&
+            requireToolEvidence &&
+            usedTools &&
+            !usedMutatingTools &&
+            repl.responseIndicatesUnfinishedAction?.(turn.finalContent)
+          ) {
+            unfinishedActionRetries++;
+            if (unfinishedActionRetries > 3) {
+              finalContent = 'Chưa hoàn thành: model chỉ trả lời trạng thái sau khi inspect, chưa thực hiện thay đổi. Winter đã dừng để tránh báo tiến độ giả.';
+              console.log(`\n${colors.yellow}${finalContent}${colors.reset}\n`);
+              reachedToolLimit = false;
+              break;
+            }
+            messages.push({
+              role: 'assistant',
+              content: assistantMsg.content || '',
+            });
+            messages.push({
+              role: 'user',
+              content: repl.buildUnfinishedActionCorrection(messages, turn.finalContent),
+            });
+            forceTextToolFallback = true;
+            finalContent = '';
+            continue;
+          }
+          if (turn.finalContent) {
+            finalContent = turn.finalContent;
+          }
           if (turn.finishReason === 'length') {
             console.log(`\n${colors.yellow}ℹ Phản hồi bị cắt cụt do hết token. Đang tự động tiếp tục...${colors.reset}`);
             messages.push({
@@ -136,6 +216,24 @@ export class AgentRuntime {
         for (const tc of toolCalls) {
           const { toolName, toolArgs } = tc;
           const canonicalToolName = repl.tools.normalizeToolName(toolName);
+          if (allowedToolNames && !allowedToolNames.has(canonicalToolName)) {
+            const result = {
+              success: false,
+              error: `Tool ${canonicalToolName} is not allowed for this agent.`,
+              recovery: `Allowed tools: ${[...allowedToolNames].join(', ')}`,
+            };
+            const promptToolResult = await repl.buildPromptToolResultForModel(canonicalToolName, result);
+            messages.push({
+              role: 'tool',
+              tool_call_id: tc.id || `tool-${Date.now()}`,
+              content: JSON.stringify(promptToolResult),
+            });
+            const summary = repl.formatToolResultForConsole(canonicalToolName, result);
+            if (summary) {
+              toolSummaries.push(`${canonicalToolName}: ${summary}`);
+            }
+            continue;
+          }
           if (getMutatingToolNames().has(canonicalToolName)) {
             usedMutatingTools = true;
           }
@@ -201,6 +299,15 @@ export class AgentRuntime {
               : { success: false, error: 'Tool call is missing a tool name' };
             if (repl.spinner) repl.spinner.stop();
           }
+          executedTools.push({ tool: canonicalToolName, args: enrichedArgs, success: result?.success !== false });
+          if (getMutatingToolNames().has(canonicalToolName)) {
+            for (const key of ['file_path', 'filePath', 'path', 'file', 'notebook_path']) {
+              if (typeof enrichedArgs?.[key] === 'string' && enrichedArgs[key].trim()) {
+                changedFiles.add(enrichedArgs[key]);
+                break;
+              }
+            }
+          }
           const promptToolResult = await repl.buildPromptToolResultForModel(canonicalToolName, result);
           messages.push({
             role: 'tool',
@@ -254,6 +361,100 @@ export class AgentRuntime {
       console.log(`\n${colors.yellow}${finalContent}${colors.reset}\n`);
     }
-    return { finalContent, usedTools, usedMutatingTools };
+    return {
+      finalContent,
+      usedTools,
+      usedMutatingTools,
+      autoVerified,
+      autoVerificationPassed,
+      toolSummaries,
+      executedTools,
+      changedFiles: [...changedFiles],
+      usage: totalUsage,
+      messages,
+    };
+  }
+  shouldVerifyBeforeFinal(messages = [], usedMutatingTools = false, verificationPassed = false) {
+    if (!usedMutatingTools || verificationPassed) return false;
+    return this.repl.shouldAutoVerifyAfterTools?.(this.repl.getLatestUserText(messages), true) === true;
+  }
+  async runVerificationTools({ messages, toolSummaries, startedAt, totalUsage }) {
+    const repl = this.repl;
+    const commands = await repl.inferVerificationCommands?.(repl.getLatestUserText(messages));
+    const uniqueCommands = [...new Set((commands || []).filter(Boolean))].slice(0, 3);
+    if (uniqueCommands.length === 0) {
+      return { passed: true, details: [] };
+    }
+    if (repl.spinner) repl.spinner.stop();
+    console.log(`\n${colors.cyan}=== Auto verification before final answer ===${colors.reset}`);
+    const details = [];
+    for (const command of uniqueCommands) {
+      if (repl.spinner) {
+        repl.spinner.update(`Verifying: ${command}`);
+        repl.spinner.start();
+      }
+      const result = await repl.tools.execute('Bash', { command }, { cwd: repl.projectPath });
+      if (repl.spinner) repl.spinner.stop();
+      const passed = result?.success !== false;
+      details.push({
+        cmd: command,
+        passed,
+        output: result?.stdout || result?.stderr || result?.error || '',
+      });
+      messages.push({
+        role: 'user',
+        content: [
+          '[Winter auto-verification tool result]',
+          `Tool: Bash`,
+          `Command: ${command}`,
+          `Status: ${passed ? 'passed' : 'failed'}`,
+          String(result?.stdout || result?.stderr || result?.error || '').slice(0, 6000),
+        ].filter(Boolean).join('\n'),
+      });
+      const summary = repl.formatToolResultForConsole('Bash', result) || `${command}: ${passed ? 'passed' : 'failed'}`;
+      toolSummaries.push(`Bash: ${summary}`);
+      console.log(renderToolPanel({
+        toolName: '$ Bash',
+        summary,
+        success: passed,
+        colors,
+        title: 'Auto Verification',
+      }));
+    }
+    if (startedAt && totalUsage) {
+      // Keep the parameters intentionally used: callers pass the same timing and
+      // usage objects as normal tool turns so future instrumentation can attach here.
+    }
+    return {
+      passed: details.every(item => item.passed),
+      details,
+    };
+  }
+  buildVerificationRepairPrompt(verification, failureCount = 1) {
+    const failures = (verification?.details || [])
+      .filter(item => !item.passed)
+      .map(item => [
+        `Command: ${item.cmd}`,
+        String(item.output || '').slice(0, 5000),
+      ].join('\n'))
+      .join('\n\n---\n\n');
+    return [
+      `RUNTIME VERIFICATION FAILED before final answer (repair attempt ${failureCount}/3).`,
+      '',
+      failures || 'Verification failed, but no output was captured.',
+      '',
+      'Fix the first hard failure now with tools. Inspect the error path, patch the smallest root cause, and do not provide a final success answer until verification passes.',
+    ].join('\n');
   }
 }

package/src/agent/subagent-child.js ADDED Viewed

@@ -0,0 +1,44 @@
+import { WinterREPL } from '../cli/repl.js';
+import { AgentTool } from '../tools/agent.js';
+async function runSubagent(message = {}) {
+  const options = message.options || {};
+  const repl = new WinterREPL({
+    projectPath: options.projectPath || options.cwd || process.cwd(),
+    sessionId: options.sessionId,
+    version: options.version,
+  });
+  repl.readlineClosed = true;
+  repl.running = true;
+  repl.showInputPrompt = () => {};
+  repl.closeInputBox = () => {};
+  repl.shouldPromptForToolPermission = async () => false;
+  await repl.ai.init?.();
+  const tool = new AgentTool(repl);
+  const result = await tool.executeSubagent(message.task, {
+    ...options,
+    processIsolation: false,
+    process_isolation: false,
+  });
+  return {
+    ...result,
+    workspaceIsolated: options.workspaceIsolation === true,
+    workspacePath: options.projectPath,
+    parentProjectPath: options.parentProjectPath,
+  };
+}
+process.on('message', async message => {
+  if (message?.type !== 'run') return;
+  try {
+    const result = await runSubagent(message);
+    process.send?.({ type: 'result', result });
+  } catch (error) {
+    process.send?.({
+      type: 'error',
+      error: error.message,
+      stack: error.stack,
+    });
+  }
+});