Changelog
What's new
Every release, straight from GitHub, newest first.
Added
- Added Phase 19 LLM discovery prompt/template artifacts so host agents can propose richer evidence-backed route, form, API, entity, scenario, and standards-placement context without ordinary Descuff commands calling an LLM.
- Added deterministic
llm-discovery.json validation for evidence IDs, source fingerprints, input artifact hashes, relative source paths, unsupported claims, and mutating/sensitive/high-consequence self-approval. - Added
descuff enrich support for accepted/rejected LLM discovery artifacts while preserving the existing semantic-enrichment compatibility path. - Added initial React/Vite preview support with a dedicated analyzer package, doctor detection, CLI scan workflow integration, route/form/fetch-reference evidence, existing standards discovery, fixtures, and release graph wiring.
Changed
- Updated installed Codex, Claude Code, and Cursor Descuff instructions to prefer LLM discovery as the guided workflow while keeping semantic enrichment as a fallback.
- Clarified React/Vite readiness explanations so client-side fetch references are treated as frontend-observed API evidence until runtime or backend source evidence proves the server handler.
Fixed
- Fixed
descuff doctor so ordinary React/Vite src/pages and src/app component folders are not misclassified as Next.js without Next dependency, config, or App Router file evidence. - Fixed package-local
@descuff/core and @descuff/validator test scripts so they run their package tests from the workspace root.
Changed
- Updated installed Descuff skill reporting guidance so Graphify results stay as compact supporting evidence and Descuff-specific next steps remain the final call to action.
- Clarified installed Descuff final reports should separate local source-backed validation from hosted deployed-site recon.
Changed
- Tightened installed Descuff skill intake so Codex, Claude Code, and Cursor wait for explicit confirmation before running Descuff commands unless the prompt explicitly says to proceed without confirmation.
Changed
- Updated installed Codex, Claude Code, and Cursor Descuff instructions to begin with a short intake that explains Descuff, states the local Next.js preview boundary, and asks about semantic enrichment, browser-agent scenarios, optional hosted recon, and Graphify usage before running the full workflow.
Added
- Added initial
descuff recon <url> hosted URL reconnaissance with public standards discovery, same-origin page inspection, confidence-labeled artifacts, and read-only browser-agent reachability summaries. - Added typed hosted recon blockers for robots exclusions, cross-origin links, crawl budgets, unsafe scenarios, destination misses, fetch failures, and baseline comparison failures.
- Added hosted recon diagnostics for malformed scenarios, inconclusive public evidence, and redacted sensitive query parameters.
- Added hosted recon fixture coverage for unsafe browser-agent scenarios and real local HTTP recon when the environment permits local sockets.
- Added opt-in
descuff recon <url> --browser rendered-page evidence with browser network counts and browser-discovered WebMCP tool reporting. - Added
descuff scenarios to generate evidence-backed read-only browser-agent task suggestions that hosted recon can use for before/after effort reporting.
Fixed
- Fixed
descuff recon argument parsing so flags and flag values can appear before the target URL. - Fixed hosted recon canonical-origin handling after public URL redirects, so browser rendering is not incorrectly skipped after normal domain redirects.
- Fixed Next.js analyzer route discovery for App Router
.mdx page files. - Replaced the deprecated
pnpm/action-setup@v4 workflow setup with Corepack-pinned pnpm@10.30.0 so CI and publish runs no longer emit Node 20 action deprecation warnings.
Added
- Added standard-neutral browser-agent runtime scenarios that compare baseline browser exploration against Descuff-assisted standards evidence.
- Added browser-agent scenario/result artifacts and readiness explanation artifacts that link score losses to affected scenarios, evidence surfaces, and repair guidance.
- Added typed validation failures for browser-agent baseline failure, post-Descuff failure, scenario budget overruns, benchmark regression, and inconclusive results.
- Added
READINESS_EXPLANATION_MISSING_EVIDENCE validation so incomplete readiness explanations cannot publish without evidence, affected surfaces, or scenario context. - Added fixture and snapshot coverage for content-site readiness explanations, static-site acceptable gaps, API-contract browser-agent scenarios, and browser-agent result Markdown.
- Added scenario route/origin boundary enforcement for browser-agent benchmarks so configured
allowedRoutes, allowedOrigins, and blockedOrigins are respected.
Changed
- Improved runtime proof summaries so CLI output reports browser-agent scenario counts, comparable effort changes, and after-path evidence surfaces.
Changed
- Switched repository and package metadata from MIT to Apache-2.0 so npm package pages reflect the stronger contribution and patent-license posture.
Added
- Added explicit WebMCP runtime execution scenarios so browser-discovered read-only tools are only executed with approved validation inputs.
- Added a framework-neutral browser-agent task benchmark contract and pure effort comparison helper for Phase 15 evidence artifacts.
- Added browser-agent benchmark JSON and Markdown artifact rendering for scans that produce benchmark evidence.
- Added optional
.descuff/runtime.json support so CLI scans can use real browser/runtime evidence instead of synthetic runtime evidence. - Added
BROWSER_AGENT_BENCHMARK_INCONCLUSIVE runtime validation when benchmark evidence cannot prove both paths succeeded. - Added automatic browser-agent benchmark records for explicit WebMCP runtime scenarios observed during browser analysis.
- Added runtime proof summaries to scan, start, validate, and finish output.
- Documented runtime analyzer benchmark generation, reporter benchmark output, and validator benchmark checks in package READMEs.
- Added
BROWSER_AGENT_BENCHMARK_REGRESSED runtime validation when browser-agent effort gets worse after Descuff.
Changed
- Aligned runtime WebMCP validation failures with the Phase 15 metadata-only and missing-tool contract.
Fixed
- Fixed
descuff doctor diagnostics so fresh projects report existing .descuff artifacts as absent before doctor writes its own artifacts. - Fixed
descuff doctor timestamps to use the actual check time instead of the deterministic test epoch when no test clock is provided. - Fixed malformed
package.json handling so invalid JSON is reported as PACKAGE_JSON_MALFORMED instead of PACKAGE_JSON_MISSING.
Added
- Added
descuff doctor [project-root] to diagnose supported Next.js roots, wrong-folder monorepos, writable .descuff/ artifacts, optional Graphify state, Git availability, and typed first-run blockers before creating a baseline. - Added stale
.descuff/source-fingerprints.json detection to doctor so users are told when local artifacts no longer match current source files. - Added advisory browser/runtime prerequisite diagnostics to
doctor, including Node support, project-level Playwright dependency presence, and explicit confirmation that no browser launch was performed. - Added structured
readinessExplanations to validation reports so machine consumers can distinguish complete categories, acceptable gaps, recommendations, and blockers. - Improved
descuff start output with detected app counts, standards status, validation status, readiness notes, generated artifact paths, and next-step guidance. - Improved
descuff install completion output with explicit finish versus check guidance for Codex, Claude Code, Cursor, and local preview installs.
Added
- Added minimal npm READMEs for public internal runtime packages so users know to install
descuff unless they are building on Descuff internals.
Fixed
- Added a release publish preflight that fails before
npm publish when any target package version is already present on npm. - Increased the packed release install smoke timeout so slow clean npm installs do not fail a valid release candidate.
- Added provenance-compatible repository metadata to every public package so npm Trusted Publishing can verify GitHub Actions provenance.
Added
- Added host-agent instruction guidance to run
descuff check . after ordinary edits in already-Descuffed apps, while reserving descuff finish . for explicit Descuff plan implementation. - Adopted phase-based preview versioning for future releases:
0.<phase>.<patch>, starting from the next publish. - Added release package graph validation and dependency-first publish-order reporting to harden release checks.
- Added a packed CLI install smoke command that installs tarballs into a clean temp project and runs
descuff --help, start, and finish. - Added changelog release heading validation for version, ISO date, and one-line release title.
- Added npm environment diagnostics for root-owned cache entries and pnpm-only config warnings during release checks.
- Added post-publish registry verification for packuments, latest dist-tags, tarball reachability, internal dependency resolution, and fresh public CLI install smoke tests.
- Documented public package-boundary rules and partial-publish recovery steps for contributors.
- Added a manual GitHub Actions Trusted Publishing workflow and dependency-ordered publish script for npm releases.
- Added an executable release recovery drill for simulated broken internal-package publish scenarios.
- Added a release version preparation script that updates public package versions, internal ranges, README release text, and the changelog heading.
- Fixed the Trusted Publishing workflow to avoid token auth during
npm publish so npm can use OIDC.
Fixed
- Renamed the published drift runtime package to
@descuff/drift-core and moved the CLI dependency to that package after npm accepted @descuff/drift publish metadata but did not serve its installable package document.
Fixed
- Republished the continuous-readiness release with all internal package ranges moved to
0.1.14 after descuff@0.1.13 reached npm before @descuff/drift@0.1.13 was publicly installable.
Added
- Added initial continuous-readiness drift detection with
descuff diff, descuff check, .descuff/drift-baseline.json, .descuff/drift-diff.json, .descuff/drift-check.json, and .descuff/drift-report.md. - Added drift baseline contract fingerprints and typed baseline failures for missing, malformed, unsupported, and project-mismatched baselines.
- Added drift validation plans that identify affected validation suites and explicitly record when full validation is used as the safety fallback.
- Added targeted
descuff check execution for static metadata, source fingerprints, runtime observations, WebMCP behavior, security model, and capability-confidence suites. - Added drift-level repair mapping for stale baselines, WebMCP disconnections, OpenAPI/API behavior mismatches, stale machine contracts, and structured metadata drift.
- Added fixture coverage for removed API capabilities and new-route structured metadata drift.
- Added deterministic runtime analyzer coverage for browser-collected WebMCP tool results alongside API response-shape evidence.
- Documented the default drift-baseline storage policy for local projects and CI.
Added
- Added
descuff install --platform cursor to write a Cursor project rule at .cursor/rules/descuff.mdc.
Added
- Added shared host-agent skill groundwork: compact skill evidence packets, semantic enrichment validation, semantic diff rendering, Graphify/native correlation contracts, and Codex/Claude Code/Cursor instruction rendering.
- Added
descuff install --platform codex and descuff install --platform claude-code for short assistant-specific setup. - Added
descuff install [codex|claude-code|cursor|all] to write local preview skill instructions under .descuff/skills/. - Added
descuff install codex --global to install a real Codex skill under $CODEX_HOME/skills/descuff or ~/.codex/skills/descuff. - Added fixture coverage proving the installed Codex skill contract can run
start -> enrich -> finish. - Added
descuff enrich to deterministically validate .descuff/semantic-enrichment.json and write semantic enrichment review artifacts. - Added tested skill-style orchestration coverage for
start -> enrich -> finish without any hidden LLM call. - Added an evidence-backed domain profile to the semantic model and skill evidence packet while preserving
applicationType as a compatibility field. - Added optional Graphify/native enrichment artifacts to scan output and the skill evidence packet without making Graphify required.
descuff scan now writes .descuff/graphify-enrichment.json, .descuff/graphify-enrichment.md, .descuff/skill-evidence-packet.json, .descuff/skill-evidence-packet.md, .descuff/semantic-enrichment-prompt.md, and .descuff/semantic-enrichment-template.json.
Fixed
- Tightened host-agent semantic-enrichment validation so malformed JSON with renamed or missing required fields is rejected before it can appear in accepted enrichment output.
Fixed
- Replaced publish-time
workspace: dependency ranges with concrete ^0.1.1 internal package ranges so npx descuff@0.1.1 installs correctly from npm.
Added
- Added route discovery support for Next.js projects that use
src/app and src/pages. - Added route discovery support for nested Next.js apps in common monorepo layouts, such as
apps/web/app. - Added Next.js
proxy.ts authentication-boundary detection. - Added route-handler authentication-boundary detection for common session, API-key, permission, and wrapper patterns.
- Added route-level visibility so authenticated pages are filtered out of public
llms.txt and Schema.org output. - Added conservative Server Action capability modelling for file-level
"use server" exports. - Added structured Phase 10 external audit benchmark records for eight completed public repository audits.
Fixed
- Avoid generating non-applicable standards for apps with no APIs or capabilities.
- Improved content, SaaS, sensitive-read, and high-consequence capability classification from external audit findings.
- Fixed validation false positives where protected route-handler mutations were treated as public sensitive capabilities.
Release Notes
- Audited against eight unrelated public Next.js repositories covering static sites, content sites, commerce, SaaS, booking, Pages Router auth, analytics, and forms-heavy monorepos.
- The audit intentionally used
descuff start, model/plan inspection, and validation results as the benchmark loop. Implementing standards inside every external repository was skipped because it would be expensive and would mainly test coding-agent behavior, not Descuff's analysis and validation engine. - Remaining known limitation: generated
llms.txt validation can reject intercepted/parallel App Router route markers until those route references are normalized or omitted.
Added
- Added
descuff start to create a baseline, validation report, agent plan, and .descuff/codex-prompt.md. - Added
descuff finish to rescan after implementation, validate again, and write .descuff/before-after.md.
Fixed
descuff validate now rescans before scoring readiness so stale validation artifacts do not survive source changes.
Added
- TypeScript/pnpm monorepo foundation.
- Next.js static analyzer for App Router, Pages Router, API routes, server actions, forms, middleware, existing standards, and runtime correlation.
- Descuff-owned structural and semantic IR with evidence-backed capability, risk, application-type, validation, and readiness models.
- Standard adapters for
llms.txt, Schema.org JSON-LD, OpenAPI, RFC 9727 API Catalog, and experimental WebMCP. - Agent workflow planning artifacts and non-LLM
descuff fix instructions. - Validation package covering static generated changes, build/test command integration, runtime observations, mutating scenario guardrails, security checks, UI regression checks, readiness reports, and repair guidance.
- Ecommerce Next.js fixture E2E proving the scan-to-validation path.
- Booking, content, SaaS, and intentionally broken Next.js source fixtures for broader analyzer and validation coverage.
- CLI commands for
scan, report, plan, fix, apply-safe, and validate.
Known Release Limitations
apply-safe does not write application source in this release.- Graphify is optional developer infrastructure and may require adding
~/.local/bin to PATH. 0.0.0 was superseded by 0.0.1 because the initial registry publish used workspace dependency metadata. latest now points to 0.0.2.