Commit graph

252 commits

Author SHA1 Message Date
f8cc299e9d test(voyage): refactor 4 downstream command tests to runtime SC4+SC7 (closes #2 #3 #6 #10) 2026-05-14 21:46:11 +02:00
2b2c45c1df test(voyage): refactor trekbrief command test to runtime SC1 (closes #1) 2026-05-14 21:44:38 +02:00
35a1e674c8 fix(voyage): require brief-validator gate in trekresearch + trekexecute (closes #12) 2026-05-14 21:43:45 +02:00
fd2a42fba1 feat(voyage): wire phase-signal-resolver into 4 downstream commands (closes #9 wiring) 2026-05-14 21:43:16 +02:00
b0db428c74 feat(voyage): add resolvePhaseModel for brief-signal orchestrator override (closes #9 part A) 2026-05-14 21:38:51 +02:00
001df01332 test(voyage): add profile-resolver non-interference tests (closes #4 SC5) 2026-05-14 21:36:57 +02:00
681f682abc fix(voyage): coerce brief_version to string + quote template + update doc pin (closes #8 #11)
v5.1.0 shipped with an unquoted brief_version: 2.1 in trekbrief-template.md.
parseScalar coerced it to Number 2.1, and the sequencing gate guarded on
typeof === 'string', silently bypassing BRIEF_V51_MISSING_SIGNALS.

Three-part atomic fix:
- brief-validator.mjs:87+149 now accepts both string and number forms via
  String(fm.brief_version) coercion.
- trekbrief-template.md quotes the value so new briefs parse as String.
- doc-consistency.test.mjs pins the QUOTED form going forward.

Three regression tests added in brief-validator.test.mjs.
2026-05-14 21:36:10 +02:00
b5ad71d92c test(voyage): add 4 brief fixtures for v5.1.1 runtime scenarios 2026-05-14 21:34:51 +02:00
aa819549be feat(voyage): add phase-signal-resolver helper for v5.1.1 wiring 2026-05-14 21:34:14 +02:00
65e0dfd4f2 docs(voyage): add CHANGELOG entry for v5.1.0 2026-05-13 21:24:49 +02:00
3e64cc76ff chore(voyage): bump version 5.0.3 → 5.1.0 2026-05-13 21:23:48 +02:00
3bed007424 docs(voyage): document phase_signals in CLAUDE + README + marketplace + ROADMAP (v5.1) 2026-05-13 21:22:07 +02:00
9d652f520e docs(voyage): amend HANDOVER-CONTRACTS + add 5 doc-consistency pins (v5.1) 2026-05-13 21:18:42 +02:00
26ac3d799c test(voyage): add 5 minimal command test files for v5.1 (sequencing-gate + low-effort) 2026-05-13 21:15:26 +02:00
7386f72242 feat(voyage): wire 4 downstream commands to brief.phase_signals + composition rule (v5.1) 2026-05-13 21:13:51 +02:00
1d993adeda feat(voyage): add Phase 3.5 per-phase effort dialog to /trekbrief (v5.1) 2026-05-13 21:11:04 +02:00
b43ad2e6fa feat(voyage): bump trekbrief-template to brief_version 2.1 + add phase_signals fixtures 2026-05-13 21:09:57 +02:00
efeba4d2cf feat(voyage): add phase_signals validation + sequencing gate to brief-validator (v5.1) 2026-05-13 21:08:37 +02:00
f22caaaaf8 docs(voyage): pin operator-UX contract — always emit file:// link + open command
Operator runs Ghostty (also iTerm2, modern Terminal.app) — all support
cmd+click on file:// URLs. Producing commands (/trekbrief, /trekplan,
/trekreview) already emit both forms but the contract was implicit.
This commit makes it explicit:

1. CLAUDE.md gains an "Operator-UX guarantee" paragraph stating both
   forms must always appear in the final report: (a) plain file://
   URL with absolute path (for cmd+click), (b) copy-pasteable
   `open file://` command (for terminals without cmd+click).

2. tests/lib/doc-consistency.test.mjs gains a pin asserting both
   patterns appear in all three producing commands' final report
   blocks. Drift catches at test time.

Non-functional change to the commands themselves — they already
emit both forms (verified at trekbrief.md L510/L519, trekplan.md
L798/L802, trekreview.md L299/L317).

Operator request 2026-05-13: "Noter ned i Voyage at jeg ALLTID får
en slik direkte file:// lenke."
2026-05-13 20:31:58 +02:00
40d8742712 chore(voyage): pin all sub-agents to Opus permanently (operator request)
Flip model: sonnet → model: opus across 20 agent files, 4 prose references
in commands (trekplan, trekresearch), trekendsession command frontmatter,
and CLAUDE.md tables. Aligns CLAUDE.md premium-profile row to actual
premium.yaml content (all-opus, which has been the case since v4.1.0 but
the doc was drift). Companion to VOYAGE_PROFILE=premium env-var (set in
~/.zshenv same day) — env-var governs orchestrator phase model; this
commit governs sub-agent models which are frontmatter-pinned and not
reachable by the profile resolver.

npm test: 516 pass, 0 fail, 2 skipped (unchanged from baseline).

Operator rationale: complete Opus coverage across all Voyage activity,
including the 20 sub-agents that the profile system does not control
(architecture-mapper, task-finder, plan-critic, scope-guardian,
brief-reviewer, code-correctness-reviewer, brief-conformance-reviewer,
review-coordinator, session-decomposer, plus the 6 researcher agents,
plus the 5 codebase-analysis agents).

Cost implication: sub-agent runs ~5x more expensive vs sonnet. Accepted.
2026-05-13 20:20:08 +02:00
f09e2271e7 docs(voyage): note trinity context (Tier 1 of voyage/app-creator/app-factory)
Informational blockquote after the v3.0.0 note. Documents that voyage is
Tier 1 (per-task) of a three-tier architecture under the author's private
marketplace: Tier 2 app-creator (per-app), Tier 3 app-factory (per-portfolio).
Both are pre-implementation. Asymmetry-invariant preserved: voyage stays
unaware of Tier 2/3 — Handover 1 (brief format) is the only integration
point. Brief-schema changes therefore breaking for downstream consumers,
formalized in v5.4.
2026-05-13 15:56:03 +02:00
951b4abafa chore(voyage): release v5.0.3 — annotation UX matches the claude-code-100x reference
The operator pointed at ~/repos/claude-code-100x/claude-code-100x/build-site.js
as the annotation reference from the start. v4.2/v4.3 built a bespoke
playground instead. v5.0.0 deleted it. v5.0.1 pointed at /playground
document-critique (Claude-leads, wrong direction). v5.0.2 was operator-led
but too thin (line-click + freeform note, no intent). v5.0.3 finally
matches the reference.

scripts/annotate.mjs rewritten:
  - Markdown rendered as proper article HTML (h1/p/li/ul/table/blockquote/pre)
    instead of line-numbered raw lines.
  - Pencil-toggle annotation mode in the topbar, default ON.
  - Select text OR click any element → form popover at cursor.
  - Three intent buttons: Fiks (red) / Endre (orange) / Spørsmål (blue).
  - Comment textarea. Save (Cmd+Enter), Cancel (Esc).
  - Section context auto-detected from nearest h1/h2.
  - Sidebar panel: annotations grouped by section, intent badges,
    snippet quotes, delete buttons, click-to-scroll with flash highlight.
  - Copy Prompt: structured markdown export with intent labels.
  - localStorage persistence keyed on absolute artifact path
    (voyage-annotate:v2: prefix to avoid colliding with v5.0.2 state).

Tests: 12 (up from 10), all passing. npm test: 518 / 516 pass / 0 fail / 2 skipped.

Reference: ~/repos/claude-code-100x/claude-code-100x/build-site.js
lines 1431–2255 (annotation UI section).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-13 15:08:20 +02:00
a9e3a40f4a chore(voyage): release v5.0.2 — operator-driven annotation HTML (scripts/annotate.mjs)
v5.0.0 added a read-only HTML render. v5.0.1 deleted that and pointed at
/playground document-critique, which pre-generates Claude's suggestions
and asks the operator to approve/reject them. The operator asked for the
opposite — a surface where THEY drive every annotation. v5.0.2 lands it.

scripts/annotate.mjs (~430 lines, zero deps) takes any artifact .md and
writes a self-contained HTML next to it. The HTML renders the document
with line numbers, lets the operator click any line to add their own
note (inline textarea, save with Cmd+Enter or button), keeps a sidebar
of all notes (editable + deletable + persisted in localStorage per
artifact path), and exposes Copy Prompt to gather every note into one
structured prompt. Operator copies, pastes back, Claude revises the .md.

The three producing commands now run annotate.mjs at their last step and
print the file:// link with explicit "Click any line to add YOUR OWN note"
instructions. The v5.0.1 /playground document-critique line is gone.

npm test green: 516 tests, 514 pass, 0 fail, 2 skipped.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-13 14:04:28 +02:00
17039731a6 chore(voyage): release v5.0.1 — drop standalone HTML render; print literal /playground document-critique invocation
The v5.0.0 stop-gap had /trekbrief, /trekplan, and /trekreview each render
a read-only {artifact}.html (via scripts/render-artifact.mjs) AND print a
vague "run the /playground plugin" instruction. In practice the read-only
HTML was redundant with what /playground produces and the instruction
wasn't copy-paste-ready — the operator had to guess the right invocation.

v5.0.1 deletes scripts/render-artifact.mjs + its test + npm run render,
and makes each producing command end with a single boxed, literal,
copy-paste-ready line:

    /playground build a document-critique playground for {artifact_path}

One paste from the operator launches the official playground skill's
document-critique template, which builds an interactive HTML — artifact
on the left, per-line Approve/Reject/Comment cards on the right, Copy
Prompt button at the bottom. Mark suggestions, click Copy Prompt, paste
back, Claude revises the .md. Doc-consistency test pins the literal
invocation so the prose cannot soften back into vagueness.

npm test green: 503 tests, 501 pass, 0 fail, 2 skipped.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-13 13:24:32 +02:00
3683ae0070 chore(voyage): release v5.0.0 — remove bespoke playground + /trekrevise + Handover 8; render produced artifacts to HTML + link, annotate via /playground
The v4.2/v4.3 bespoke playground SPA (~388 KB), the /trekrevise command,
Handover 8 (annotation → revision), the supporting lib/ modules
(anchor-parser, annotation-digest, markdown-write, revision-guard), the
Playwright e2e suite, and the @playwright/test / @axe-core/playwright
devDeps are removed. A browser walkthrough found the playground borderline
unusable, and it duplicated the official /playground plugin's
document-critique / diff-review templates.

In their place: scripts/render-artifact.mjs — a small, zero-dependency
renderer that turns a brief/plan/review .md into a self-contained,
design-system-styled, zero-network .html (frontmatter folded into a
<details> block). /trekbrief, /trekplan, and /trekreview call it on their
last step and print the file:// link; to annotate, run /playground
(document-critique) on the .md and paste the generated prompt back.

Resolves the v4.3.1-deferred findings as moot (their target files are
deleted). npm test green: 509 tests, 507 pass, 0 fail, 2 skipped.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-12 14:05:07 +02:00
c381cc7ba4 chore(voyage): release v4.3.0 — finalize version-sync + docs (3 re-review findings deferred to v4.3.1)
Bumps .claude-plugin/plugin.json 4.2.0 -> 4.3.0 (package.json, package-lock.json,
and the README badge were already at 4.3.0). Updates the v4.3.0 CHANGELOG entry with
the verified test count (711 pass / 0 fail / 2 skipped, 713 total), a "Re-review
remediation (Sesjon 13-18)" note covering the 11-finding cycle Waves 1-3 closed, and
a "Known issues — deferred to v4.3.1" subsection listing the 3 new findings the Sesjon
18 re-review surfaced in the remediation code (87069b35 SECURITY_INJECTION defense-in-
depth, 4cc3bfc9 PLAN_EXECUTE_DRIFT, c6c64a58 MISSING_TEST). Updates root CLAUDE.md
(voyage v4.0.0 -> v4.3.0, seven-command + playground), root README + plugin README
(test count, Known-limitations note, fixes the stale "trekplan@" install snippet ->
"voyage@"), root marketplace.json (voyage description), and plugin CLAUDE.md (Playground
paragraph). A plan-critic-reviewed Wave-4 remediation plan for the 3 deferred findings
is ready (.claude/plans/, gitignored).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 21:08:48 +02:00
cfd2543cf9 test(voyage): regenerate pixel-diff baseline + clean a11y baseline (post-remediation) 2026-05-10 21:49:26 +02:00
45acb732b5 test(voyage): Group C.8 SC6 round-trip via readAndUpdate (1bc37231) 2026-05-10 21:48:21 +02:00
532f309e72 test(voyage): Group B fleet-grid CSS parity assertion (99707f51) 2026-05-10 21:46:18 +02:00
f694556d76 test(voyage): convert SC2 a11y spec to absolute 0-violation assertion (09132940) 2026-05-10 21:44:31 +02:00
5cabfdf76a test(voyage): add Group D XSS injection runtime guard (1d3591d4) 2026-05-10 21:42:52 +02:00
63fbcfa87c fix(voyage): remove dead console.log else-branches + announce drag-drop fallback (809a225e) 2026-05-10 21:26:24 +02:00
f6a758a3e2 fix(voyage): inline screenshot gallery loads docs/screenshots/ PNGs (31d28f65) 2026-05-10 21:25:01 +02:00
c541eedc48 fix(voyage): dashboard reads fm.plan_critic + orchestrator doc-consistency (906f155d, bee33a69) 2026-05-10 21:21:02 +02:00
06dff9d0d0 fix(voyage): resolve 4 color-contrast WCAG violations in light theme (09132940) 2026-05-10 21:18:53 +02:00
1a7978085a fix(voyage): move sidebar toggle outside aria-hidden region (09132940) 2026-05-10 21:16:52 +02:00
6a62945de1 fix(voyage): sanitize bodyHtml via DOMPurify in renderArtifact (1d3591d4) 2026-05-10 21:14:50 +02:00
d0156949bb fix(voyage): sync package-lock.json version to 4.3.0 (d94dfaf1) 2026-05-10 21:05:33 +02:00
e41d5aaacf revert(voyage): remove three-tier-context scope creep (1e8d2bf2) 2026-05-10 21:05:05 +02:00
39ad5e87bd fix(voyage): inject plan_critic via Phase 9 readAndUpdate (906f155d) 2026-05-10 21:03:54 +02:00
63dd3d88a2 docs(voyage): bump v4.3.0 + update CLAUDE.md + README.md + CHANGELOG.md
Step 33 of v4.3 plan — Wave 8 docs (3-doc-niv mandate):

- package.json: version 4.2.0 -> 4.3.0
- CHANGELOG.md: v4.3.0 entry dated 2026-05-10 with Added/Changed/Fixed/
  Deferred-to-v4.4/Notes covering Wave 0-8 leveranser (dashboard-sentrisk
  layout, file://-loader 3 entry points, anchor-rendering modent, A11Y
  panel fra DS-primitives, screenshots-spor convention, DOMPurify ven-
  doring, voyage-scope DS-tokens, test pyramid Groups A-D, Playwright
  devDeps).
- CLAUDE.md: nytt 'Playground (v4.3)' avsnitt under Architecture som
  beskriver dashboard-modell, file-loader, anchor-rendering, A11Y panel,
  screenshots-spor, security hardening, og test pyramid.
- README.md: version badge 3.4.1 -> 4.3.0; '/trekrevise — Annotation
  playground' avsnitt utvidet med v4.3 rebuild-detaljer og pekere til
  playground/README.md + sc1-checklist-verification.md.

Test count: 705 pass / 0 fail / 2 skipped (npm test).
doc-consistency.test.mjs: 42/42 pass.
2026-05-10 18:29:45 +02:00
1afd0ff381 docs(voyage): write playground/README.md with v4.3 architecture + URL-parameter
Step 32 of v4.3 plan — Wave 8 docs:
- v4.3 dashboard-sentrisk arkitektur (fleet-grid + drill-down)
- Bruksveier: webkitdirectory-velger, drag-drop, URL-parameter ?project=
- Discoverability for .claude/projects/ (open/xdg-open/explorer)
- Annotation-flow + window.__voyage hooks
- Begrensninger (FF150-Win, no FSA, design/ out-of-scope, baseline'd WCAG)
- Bundle-strrelse breakdown
- Test-suite oversikt (Groups A-D)

NEW file (eksisterte ikke i v4.2 per plan-critic finding 13).
2026-05-10 18:25:37 +02:00
54ba4e051f verify(voyage): SC1 10-element checklist + Playwright baseline screenshots
Step 31 of v4.3 plan — Wave 7 SC1 authoritative verification:

- docs/sc1-checklist-verification.md: per-element pass/fail med evidens
  (Group A test referanser + manuell side-by-side mot llm-security-
  playground). 8 av 10 PASS bokstavelig, 2 PASS-redef (Element 4
  onboarding-grid -> fleet-grid, Element 6 screenshots-spor -> hooks +
  docs-konvensjon) per scope-guardian Assumptions 21+22 (operator-
  signed-off ved sesjon-start).
- tests/e2e/snapshots/voyage-playground-light.png (1280x900 light theme)
- tests/e2e/snapshots/voyage-playground-dark.png (1280x900 dark theme)
- tests/e2e/snapshots/a11y-baseline.json: WCAG-violations baseline
  (aria-hidden-focus + color-contrast) defer-til-v4.4

Pixel-diff-spec (Step 30) sammenlikner mot baseline med maxDiffPixelRatio
0.02. Wave 7 = VERIFICATION ONLY; HTML FROZEN; faktisk a11y-fix deferred
til v4.4.
2026-05-10 18:24:29 +02:00
94b0893caf test(voyage): add e2e Playwright + axe-core specs (a11y + network) [skip-docs]
Step 30 of v4.3 plan — Wave 7 Group D:
- voyage-playground-a11y.spec.mjs (3 tests): light + dark theme axe-core
  scans (compared against baseline JSON, fails only on NEW or GROWN
  violations) + pixel-diff smoke for SC1 (light + dark, 1280x900,
  maxDiffPixelRatio=0.02).
- voyage-playground-network.spec.mjs (1 test): SC7 authoritative gate via
  page.on('request') instrument — verifies zero external (http/https/ws)
  requests during page load.
- playwright.config.mjs: snapshotPathTemplate routes to tests/e2e/snapshots/
  (matches Step 31 expected_paths).

Baseline policy: HTML is FROZEN in Sesjon 6 (Wave 7 = verification, not
fix). Existing critical/serious WCAG violations (aria-hidden-focus +
color-contrast) recorded in tests/e2e/snapshots/a11y-baseline.json as
delta-baseline. Actual a11y fix deferred to v4.4.

Verify: npm run test:e2e -> 4 passed (3 a11y + 1 network).
2026-05-10 18:22:52 +02:00
37804c8d58 test(voyage): add Group B (structure) + Group C (annotation export schema) tests [skip-docs]
Step 29 of v4.3 plan — Wave 7:
- Group B (9 tests): DS-token classes (badge--scope-voyage, guide-panel,
  fleet-grid), theme-toggle wiring (data-action, wireThemeToggle,
  localStorage), sidebar-tab keyboard pattern (role=tablist,
  aria-selected, J/K/Esc), anchor-ID format mirror.
- Group C (7 tests, +1 vs original): export-bundle JSON parse, required
  keys, per-annotation field validation, empty-export edge case,
  annotation_digest order-independence, SHA-256 16-hex-char validity
  (SC6 / SC-GAP-3), fixture plan anchor format.
- Fixtures: tests/fixtures/playground/v43-export-bundle.json +
  v43-plan-pre-annotate.md (ANN-0001 + ANN-0002, revision: 0).

Test count: 689 → 705 pass / 0 fail / 2 skipped.
2026-05-10 18:18:24 +02:00
f8d0843c4b test(voyage): extend playground tests with Group A static-HTML assertions [skip-docs]
Step 28 of v4.3 plan — Wave 7 Group A: 17 new static-HTML grep assertions
covering SC1 10-element checklist (one test per element), SC3 webkitdirectory
+ drag-drop attributes, SC6 export-bundle markers (buildAnnotatedMarkdown,
filename pattern, Blob + clipboard flows), and SC7 tag-level no-CDN checks
(every <script src> + <link href> must be local).

Test count: 672 → 689 pass / 0 fail / 2 skipped.
2026-05-10 18:15:53 +02:00
f5c936357b feat(voyage): add Playwright + @axe-core/playwright devDependencies
Step 27 of v4.3 plan — adds Playwright 1.59.1 + axe-core/playwright 4.10.2
as devDependencies, npm script test:e2e, and playwright.config.mjs with
file:// baseURL pointing at playground/. Chromium browser binary installed
to ~/Library/Caches/ms-playwright/.

Trace: SC2 (WCAG verifikasjon krever browser-driver), research/04
Recommendation security; brief Constraint linje 64 (zero new deps i
playground/) er OK fordi Playwright er devDependency på voyage-plugin-rot,
ikke i playground/.
2026-05-10 18:13:29 +02:00
9c14b74418 feat(voyage): implement path-traversal + symlink/dotfile filter on loaded files 2026-05-10 18:05:35 +02:00
63b5331e2e feat(voyage): implement HTML-comment indirect prompt injection mitigation (Sec T4) 2026-05-10 18:03:37 +02:00
eb8971a624 feat(voyage): vendor DOMPurify >=3.1.1 + sanitize annotation-content 2026-05-10 18:01:30 +02:00