Skip to content

v0.5.0 Release Notes

Release Date: 2026-08-10

VisionStudio v0.5.0 is the pivot. Everything through v0.4.0 was the Electron desktop app talking to cmd/daemon — per-project spec authoring on the filesystem, no database. v0.5.0 introduces visionstudio: a Go CLI and web dashboard, backed by Dolt, for tracking cross-repository roadmap execution (Programs → Initiatives → Phases → RMIs) alongside the existing spec-authoring and LLM-as-a-Judge evaluation workflow. The Electron app and cmd/daemon remain in the tree but are now explicitly legacy, not under active development.

This is the largest release to date — 135 commits, spanning the new architecture's genesis through a security-hardening pass, a real user-facing feature (initiative hiding), two bug fixes, and a full documentation overhaul.

Highlights

  • The pivot — a new visionstudio CLI + web dashboard for roadmap execution, backed by Dolt, superseding the Electron/daemon path as the primary surface
  • Renamed vistudio → visionstudio (breaking — see Breaking Changes)
  • One-command startup (visionstudio app start), an embedded web SPA (no external files needed to run it), and diagnostics that explain how to fix a database-down error instead of surfacing a raw driver error
  • Programs and initiatives can each be hidden from the dashboard, with hiding a program cascading to its initiatives everywhere they're listed
  • Real path-traversal fixes — the spec-files endpoint and 12 separate CodeQL alerts across cmd/daemon, closed with validation upstreamed to the shared grokify/mogo library rather than duplicated locally
  • Documentation overhaul — README/installation/quickstart now lead with the CLI, the legacy path is clearly marked, and six new dashboard user-guide pages cover every panel

The Pivot

Foundation

The new architecture's data model, storage, and API layer:

  • pkg/ir: execution type aliases and JSON Schema generation scaffolding the roadmap-execution domain (d810887)
  • pkg/store and ent/: the store and Ent ORM layers, backed by Dolt (MySQL-compatible, Git-like versioned database) — migrated in from prism-build (2ac41fc)
  • pkg/webapi and an initial visionstudio CLI for database orchestration (3a717e2, aec0fde)
  • An end-to-end spec workflow system: workflow selection at initiative creation, judge-result ingestion from disk, agent evaluation definitions (4f33b9e and related)
  • The /api/spec-files endpoint for browsing an initiative's spec documents from the dashboard (470ebab)
  • pkg/apitypes — the Go-first type pipeline (Go structs → JSON Schema → Zod → TypeScript) that keeps backend and frontend types in sync

Dashboard

  • web/: the Vite + React SPA scaffold, with a shared UI toolkit and chart primitives (c68659e, 5a3ad66)
  • Execution, Spend, Maturity, Specs, and a composed four-quadrant InitiativeView panel (343e72a and related)
  • Repositories and Performance panels, added alongside the type pipeline (3f24ed4) — repository catalog with per-repo RMI counts, and token spend/cost tracking by model/initiative/phase/RMI

CLI Lifecycle

  • Renamed vistudio → visionstudio (c1f1bf8) — see Breaking Changes
  • Unified the default Dolt port and resolved it from ~/.productbuildershq/visionstudio/config.json (22e8305)
  • visionstudio app start/status/stop, visionstudio ui, and visionstudio db lifecycle commands — one command brings up the database (if needed) and serves the dashboard (53d9318)
  • The web SPA is embedded in the binary via go:embed, so it works from any directory with no separate npm run build/npm run dev step required to use it (f191fa2)
  • Connection failures now explain how to fix them — start the database, run migrations, check the DSN — instead of surfacing dial tcp ... connection refused (5751d49)

Security

The spec-files endpoint's initiative ID went straight from the URL into a filesystem path with no validation — an actual path-traversal vector, not a theoretical one (e2cd35a). Fixing it surfaced a broader pattern: 12 separate CodeQL go/path-injection alerts across cmd/daemon's capability, v2mom, spec, maturity, sample, and devx handlers, two of which (handleGetMaturityModel, handleMaturityDashboard) had no prior validation at all.

Rather than patch each site with a local, ad hoc check, the fix was upstreamed to github.com/grokify/mogo's os/osutil package as ValidatePathComponent (allowlist regex) and JoinSecure (containment check via filepath.Rel/filepath.IsAbs), plus FindFirstExistingSecure for the common "try N filename patterns for an ID" lookup (05ca077). This is now the house convention for any caller-derived path component — see CLAUDE.md.

One detail worth calling out: the filepath.Rel/filepath.IsAbs idiom was chosen deliberately, verified empirically against a live CodeQL scan — a strings.HasPrefix-based containment check wrapped in a helper function does not get recognized as a sanitizer by CodeQL's go/path-injection query, even when semantically equivalent and placed immediately before the sink.

Also fixed: spec file writes used 0644 permissions (world/group readable); tightened to 0600 (5048e18).

Features

Hiding Programs and Initiatives

Program.Hidden already existed; this release extends the same pattern to Initiative.Hidden:

visionstudio program hide <program-id>
visionstudio initiative hide <initiative-id>

Hiding a program cascades to hide its initiatives everywhere initiatives are listed — the sidebar, Initiatives Overview, a repository's linked-initiatives list, Performance's Cost by Initiative table, and Maturity's Capability Models initiative filter (the last one required fetching execution data into a component that previously didn't need it — see Fixed). It's a listing concept, not access control: a hidden initiative or program is still reachable by navigating directly to its URL if you already know the ID. See the Initiatives guide for the full breakdown of where this is enforced.

Fixed

  • Average-score badge scale — the initiative workflow diagram's average-score badge used ≥7/≥4 thresholds, a leftover from an earlier 0–10 scale, while the individual PRD/TRD/PLAN/ROADMAP boxes right next to it correctly used ≥4/≥3 against the real 1–5 rubric scale (220bb60)
  • Maturity hidden-initiative filtering — the Capability Models tab never fetched execution data, so its initiative filter chips — and, once traced further, the radar chart, per-dimension averages, and the assessments table too — all showed hidden-initiative data regardless of status (5ac5075)
  • Phase ordering, an empty-specType guard, legacy 0–100 score clamping, a 3/5 score incorrectly counted as passing instead of conditional, Windows path/signal compatibility, the embedded-Dolt default data directory, and clickable header nav-to-home (776aa9d and related)

Documentation

README, docs/getting-started/installation.md and quickstart.md, and CLAUDE.md all now lead with the visionstudio CLI and web dashboard; the Electron desktop app and cmd/daemon are explicitly marked legacy, not deleted (0f42586). Six new pages under docs/dashboard/ cover the web dashboard's own panels — Tour, Programs/Initiatives/RMIs, Repositories, Specs & Evaluation, Maturity, Performance — each verified against the actual routed React components rather than guessed, which caught and excluded four components (ExecutionPanel, ProgramsPanel, a duplicate InitiativeView, SpecsPanel) that turned out to be dead code, never imported anywhere (604f543).

CLAUDE.md also gained durable-conventions documentation for patterns established this release: the dual API-struct gotcha (cmd/visionstudio/api.go defines its own local APIProgram/APIInitiative/etc., separate from pkg/apitypes's schema-source versions of the same names — both must be updated together), the Hidden-entity convention, and the mogo path-safety convention (c1a5237).

Screenshots of the actual web dashboard — home, program view, initiative definition/execution, performance token views — were added to the README (7b42750 and related).

Breaking Changes

  • Binary/command renamed: vistudio → visionstudio, no alias. Update any scripts, aliases, or .mcp.json entries referencing the old name.
  • Ent schema change: JudgeResult now stores the full structured-evaluation report rather than a partial projection (e624512). Requires go generate ./ent and a database migration (visionstudio db init --migrate) — additive, safe on existing rows.

Dependencies

  • github.com/grokify/mogo → v0.74.7, for the new osutil path-safety helpers
  • Added github.com/ProductBuildersHQ/scale and github.com/grokify/oscompat
  • Added react-router-dom for the dashboard's client-side routing

What's Next

  • Documentation for the dashboard's own panels is complete; the legacy Electron/daemon user guide has not been re-audited for currency now that it's explicitly legacy
  • MaturityPanel's Capability Models tab is now hidden-initiative-aware; Performance's Accomplishments list (RMI-level, not initiative-level) still isn't, by design — flagged as a known, narrow gap rather than fixed
  • The 0–100 → 1–5 legacy score scale still persists in a few places outside the primary judge path; deferred as its own cross-repo cleanup