Update WinUI skills for WinApp CLI 0.6

.claude-plugin/marketplace.json

@@ -5,12 +5,12 @@
     "url": "https://github.com/microsoft/win-dev-skills"
   },
   "description": "Agents and skills for native Windows app development with WinUI 3 and the Windows App SDK.",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "plugins": [
     {
       "name": "winui",
       "description": "Agents and skills for WinUI 3 app development. Create new WinUI 3 desktop apps, convert from other frameworks to WinUI 3, or add features to existing WinUI 3 applications.",
-      "version": "0.4.0",
+      "version": "0.5.0",
       "source": "./plugins/winui",
       "category": "windows-development",
       "tags": [

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -32,7 +32,6 @@ body:
         - "skill: winui-session-report"
         - "skill: winui-wpf-migration"
         - "tool: winui-analyzer (Roslyn)"
-        - "tool: winui-search"
         - "tool: winmd-cli"
         - "area: plugin / install"
         - "area: docs"

.github/PULL_REQUEST_TEMPLATE.md

@@ -31,7 +31,7 @@ The `pr-target-policy` CI check enforces this.
 
 - [ ] Agent (`plugins/winui/agents/`)
 - [ ] Skill: <!-- name(s) -->
-- [ ] Tool: <!-- winui-analyzer / winui-search / winmd-cli -->
+- [ ] Tool: <!-- winui-analyzer / winmd-cli -->
 - [ ] Plugin metadata (`plugin.json`, `plugins/winui/`)
 - [ ] Repo-level docs / governance
 

.github/codeql/codeql-config.yml

@@ -6,4 +6,3 @@ paths-ignore:
   - '**/*Tests/*.cs'
   - '**/bin/**'
   - '**/obj/**'
-  - 'src/tools/winui-search/Data/**'

.github/dependabot.yml

@@ -43,20 +43,6 @@ updates:
       prefix: "deps"
       include: "scope"
 
-  # winui-search CLI (gallery + toolkit scenario search)
-  - package-ecosystem: "nuget"
-    directory: "/src/tools/winui-search"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "tool: winui-search"
-    commit-message:
-      prefix: "deps"
-      include: "scope"
-
   # winmd-cli (WinMD inspector)
   - package-ecosystem: "nuget"
     directory: "/src/tools/winmd-cli"

.github/plugin/marketplace.json

@@ -6,13 +6,13 @@
   },
   "metadata": {
     "description": "Agents and skills for native Windows app development with WinUI 3 and the Windows App SDK.",
-    "version": "0.4.0"
+    "version": "0.5.0"
   },
   "plugins": [
     {
       "name": "winui",
       "description": "Agents and skills for WinUI 3 app development. Create new WinUI 3 desktop apps, convert from other frameworks to WinUI 3, or add features to existing WinUI 3 applications.",
-      "version": "0.4.0",
+      "version": "0.5.0",
       "source": "./plugins/winui"
     }
   ]

.github/skills/pr-review/SKILL.md

@@ -15,10 +15,10 @@ This repo is **not a regular C# product**. It ships:
   skill prompts (`SKILL.md` files). These are **Tier 3 instructions** that
   agents frequently ignore (see `dimensions/skill-tool-boundary.md`). Adding
   prose here is the *last resort*, not the first response to any problem.
-- Three **in-repo C# tools** under `src/tools/` — the WinUI 3 Roslyn analyzer,
-  `winmd-cli`, and `winui-search`. These are **Tier 1 enforcement** and the
-  preferred place to land behavior changes.
-- **Committed binary payloads** (analyzer DLL, `winui-search.exe`,
+- Two **in-repo C# tools** under `src/tools/` — the WinUI 3 Roslyn analyzer
+  and `winmd-cli`. These are **Tier 1 enforcement** and the preferred place
+  to land behavior changes that belong in this repository.
+- **Committed analyzer payloads** (DLL and
   `Microsoft.WindowsAppSDK.Analyzers.targets`) inside `plugins/winui/skills/`
   that must stay in sync with their sources. CI provenance jobs will fail
   the PR if they drift, but it's better to flag the drift in review.
@@ -113,14 +113,13 @@ focus. Common buckets in this repo:
 | `plugins/winui/skills/<name>/references/` | skill-content (references discipline) |
 | `plugins/winui/skills/<name>/*.ps1` (e.g. `BuildAndRun.ps1`, `Analyze-Session.ps1`) | tool-correctness, payloads-and-tests |
 | `plugins/winui/skills/winui-dev-workflow/analyzer/` | payloads-and-tests (committed analyzer payload) |
-| `plugins/winui/skills/winui-design/winui-search.exe` | payloads-and-tests (committed AOT exe) |
 | `plugins/winui/agents/winui-dev.agent.md` | skill-content, docs-and-manifests |
 | `plugins/winui/plugin.json` | docs-and-manifests |
 | `.github/plugin/marketplace.json` | docs-and-manifests |
 | `src/tools/winui-analyzer/Microsoft.WindowsAppSDK.Analyzers/` | tool-correctness, payloads-and-tests |
 | `src/tools/winui-analyzer/Microsoft.WindowsAppSDK.Analyzers.Tests/` | payloads-and-tests |
 | `src/tools/winui-analyzer/RULES.md` / `CHANGELOG.md` | docs-and-manifests |
-| `src/tools/winmd-cli/`, `src/tools/winui-search/` | tool-correctness |
+| `src/tools/winmd-cli/` | tool-correctness |
 | `scripts/build-tools.ps1` | payloads-and-tests |
 | `.github/workflows/` | docs-and-manifests (CI), payloads-and-tests (provenance) |
 | `README.md`, `SECURITY.md`, `SUPPORT.md` | docs-and-manifests |
@@ -233,7 +232,7 @@ verdict.
 - **No file output.** Stdout only, unless the user explicitly asked for a
   file.
 - **No build/test execution.** Flag staleness (analyzer DLL not refreshed,
-  `winui-search.exe` not refreshed, `RULES.md` not updated) but do not run
+  `RULES.md` not updated) but do not run
   `scripts/build-tools.ps1` or `dotnet test` yourself — they are slow and
   the contributor will run them.
 - **Signal-to-noise.** Reject sub-agent findings that are pure style nits,

.github/skills/pr-review/dimensions/_shared-contract.md

@@ -98,7 +98,7 @@ high. The bar for adding tooling enforcement is lower.
   is too scenario-specific.
 - Trigger-phrasing problems in `description:` frontmatter that would
   cause the wrong agent activation.
-- Stale committed payloads (analyzer DLL, `winui-search.exe`,
+- Stale committed analyzer payloads (DLL or
   `Microsoft.WindowsAppSDK.Analyzers.targets`) that will fail CI
   provenance.
 - Manifest / version / agent-file drift that ships broken artifacts to
@@ -136,8 +136,8 @@ change should land. Cite the tier on every `skill-content` and
 
 | Tier | Type | Reliability | Examples in this repo |
 |------|------|-------------|------------------------|
-| **0** | Environment / harness defaults | Highest — agent never sees it | `dotnet new` template choice, `BuildAndRun.ps1` defaults, prerequisite checks in `winui-setup` |
-| **1** | Tooling enforcement | High — produces errors/warnings the agent must address | `Microsoft.WindowsAppSDK.Analyzers` rules, `winui-search.exe` query results, `winmd.exe` API verification, `winapp` CLI exit codes |
+| **0** | Environment / harness defaults | Highest — agent never sees it | `winapp new` template choice, `BuildAndRun.ps1` defaults, prerequisite checks in `winui-setup` |
+| **1** | Tooling enforcement | High — produces errors/warnings the agent must address | `Microsoft.WindowsAppSDK.Analyzers` rules, `winapp find-ui` query results, `winmd.exe` API verification, `winapp` CLI exit codes |
 | **2** | Templates / scaffolding | Medium — structural, applied at creation time | `Microsoft.WindowsAppSDK.WinUI.CSharp.Templates`, starter project files |
 | **3** | Instructions / skills | Lowest — advisory, frequently ignored | `SKILL.md` content, `winui-dev.agent.md` rules, `references/*.md` |
 

.github/skills/pr-review/dimensions/docs-and-manifests.md

@@ -24,7 +24,7 @@ When code or skills change, these need to keep up:
 - `src/tools/winui-analyzer/RULES.md` — rule catalog (per-rule entry
   required for every shipped diagnostic; IDs are immutable).
 - `src/tools/winui-analyzer/CHANGELOG.md` — analyzer-scoped changelog.
-- Per-tool READMEs: `src/tools/{winui-analyzer,winmd-cli,winui-search}/README.md`.
+- Per-tool READMEs: `src/tools/{winui-analyzer,winmd-cli}/README.md`.
 - `SECURITY.md`, `SUPPORT.md`, `THIRD_PARTY_NOTICES.md`,
   `cgmanifest.json` — only relevant when dependencies or contact
   surfaces change.
@@ -99,7 +99,7 @@ When code or skills change, these need to keep up:
   walks `find plugins/winui/skills -type f -name SKILL.md`. New
   skills outside this glob won't be validated → **medium**.
 - Any CI step's hardcoded file path
-  (e.g. `plugins/winui/skills/winui-design/winui-search.exe`)
+  (e.g. `plugins/winui/skills/winui-dev-workflow/analyzer/Microsoft.WindowsAppSDK.Analyzers.dll`)
   changed in the diff but not in the workflow → **high**.
 
 ### Other docs

.github/skills/pr-review/dimensions/payloads-and-tests.md

@@ -6,21 +6,20 @@ Set `Domain: payloads-and-tests` on every finding.
 
 ## What this dimension owns
 
-This repo commits **prebuilt binary payloads** alongside source for
-two of its tools, and the CI `pr-validation` workflow has provenance
-jobs that fail the PR if those payloads drift from source. This
-dimension's job is to flag drift *before* the contributor pushes.
+This repo commits the analyzer's **prebuilt payloads** alongside source,
+and the CI `pr-validation` workflow has provenance jobs that fail the PR
+if those payloads drift from source. This dimension's job is to flag
+drift *before* the contributor pushes.
 
 The payloads:
 
 | Payload (committed) | Source | CI job that catches drift |
 |---|---|---|
 | `plugins/winui/skills/winui-dev-workflow/analyzer/Microsoft.WindowsAppSDK.Analyzers.dll` | `src/tools/winui-analyzer/Microsoft.WindowsAppSDK.Analyzers/` | `analyzer-provenance` (sha256 + size delta) |
 | `plugins/winui/skills/winui-dev-workflow/analyzer/Microsoft.WindowsAppSDK.Analyzers.targets` | `src/tools/winui-analyzer/Microsoft.WindowsAppSDK.Analyzers/Microsoft.WindowsAppSDK.Analyzers.targets` | `analyzer-targets-sync` (byte-identical) |
-| `plugins/winui/skills/winui-design/winui-search.exe` | `src/tools/winui-search/` | `winui-search-provenance` (smoke + size ±10%) |
 
-Refresh command: `./scripts/build-tools.ps1` (no flags) rebuilds all
-three tools and refreshes both payloads. The contributor will run
+Refresh command: `./scripts/build-tools.ps1` (no flags) rebuilds both
+C# tools and refreshes the analyzer payloads. The contributor will run
 this — you only flag drift.
 
 ## What to look for
@@ -39,21 +38,11 @@ this — you only flag drift.
   Same pattern but for
   `Microsoft.WindowsAppSDK.Analyzers.targets`. CI
   `analyzer-targets-sync` requires byte-identical files. → **high**.
-- **`winui-search` source touched, exe not refreshed.** Diff
-  includes `src/tools/winui-search/**` *but not*
-  `plugins/winui/skills/winui-design/winui-search.exe` → **high**.
-  CI `winui-search-provenance` runs smoke tests (`list`, `search
-  tabview` → must include `gallery-tabview`) and a ±10% size
-  comparison.
 - **Payload-only change (no source).** The inverse — committed DLL
-  or exe updated without a corresponding source diff. Either the
+  or `.targets` updated without a corresponding source diff. Either the
   source was already on `main` (fine — this is a refresh PR) or
   someone hand-edited the binary (red flag). → **medium**, ask the
   contributor to confirm.
-- **`winui-search` data files updated without rebuild.** Diff
-  touches `src/tools/winui-search/Data/*.json` *but not* the
-  committed exe. The data is **embedded** at build time — JSON
-  changes have no effect until the exe is republished. → **high**.
 
 ### Analyzer test coverage
 
@@ -124,10 +113,8 @@ findings, but additionally:
 
 ## Severity guide for this dimension
 
-- Source touched but committed payload not refreshed (DLL, .targets,
-  or exe) → **high** (CI provenance will fail).
-- `winui-search` data JSON edited without exe rebuild → **high**
-  (the change is invisible at runtime).
+- Source touched but committed payload not refreshed (DLL or .targets)
+  → **high** (CI provenance will fail).
 - New analyzer rule with no test → **high**.
 - New tool not wired into `build-tools.ps1` → **medium**.
 - Allowlist change without regression test → **medium**.

.github/skills/pr-review/dimensions/skill-content.md

@@ -62,7 +62,7 @@ priors. Every line of prose must pull its weight.
   re-state rules already covered in a sibling skill — link or
   reference instead. Flag when the same checklist appears twice.
 - **Restating help text.** Bullets that re-document what `winapp
-  --help`, `winui-search list`, or `winmd --help` already prints are
+  --help`, `winapp find-ui --help`, or `winmd --help` already prints are
   pure context inflation.
 - **"Best practices" laundry lists** with no concrete change in agent
   behavior (e.g. "follow YAGNI / DRY / KISS") — these are universally
@@ -89,8 +89,8 @@ priors. Every line of prose must pull its weight.
   read.
 - **References that should be tool data.** A long reference file that
   is essentially a catalogue of WinUI controls, snippets, or API
-  signatures duplicates `winui-search.exe`'s data. Flag and emit a
-  paired `skill-tool-boundary` finding (Tier 1 alternative).
+  signatures duplicates `winapp find-ui` or `winmd` data. Flag and emit
+  a paired `skill-tool-boundary` finding (Tier 1 alternative).
 
 ### Trigger / activation hygiene
 

.github/skills/pr-review/dimensions/skill-tool-boundary.md

@@ -20,8 +20,8 @@ consider them before defaulting to Tier 3 prose.
 
 | Tier | Type | Reliability | In-repo examples |
 |------|------|-------------|-------------------|
-| **0** | Environment / harness defaults | Highest — agent never sees it | `dotnet new` template choice baked into `winui-dev-workflow`, `BuildAndRun.ps1` defaults, `winui-setup` prerequisite checks |
-| **1** | Tooling enforcement | High — produces diagnostics agent must address | `Microsoft.WindowsAppSDK.Analyzers` rules (WUI0xxx-WUI4xxx), `winui-search.exe` queries, `winmd.exe` API verification, `winapp` CLI exit codes |
+| **0** | Environment / harness defaults | Highest — agent never sees it | `winapp new` template choice, `BuildAndRun.ps1` defaults, `winui-setup` prerequisite checks |
+| **1** | Tooling enforcement | High — produces diagnostics agent must address | `Microsoft.WindowsAppSDK.Analyzers` rules (WUI0xxx-WUI4xxx), `winapp find-ui` queries, `winmd.exe` API verification, `winapp` CLI exit codes |
 | **2** | Templates / scaffolding | Medium — structural, applied once | `Microsoft.WindowsAppSDK.WinUI.CSharp.Templates`, starter `.csproj` defaults |
 | **3** | Instructions / skills | Lowest — advisory, frequently ignored | `SKILL.md` content, `winui-dev.agent.md` rules, `references/*.md` |
 
@@ -53,7 +53,7 @@ This is the most common drift. Symptoms:
   This is what `winmd.exe` is for — recommend invoking it from the
   skill instead of duplicating the rule.
 - A new list of **WinUI control names or sample patterns**. This is
-  what `winui-search.exe` is for. The skill should *describe how to
+  what `winapp find-ui` is for. The skill should *describe how to
   query* the tool, not embed the catalogue.
 - A new bullet that says **"after building, do X"**. This usually
   belongs in `BuildAndRun.ps1` (Tier 0) so the agent gets it for free.
@@ -64,8 +64,8 @@ For each such finding:
 - Severity: **medium** (would be high if the analyzer/tool clearly
   could enforce it but the contributor chose prose).
 - Recommendation: name the specific Tier 1 hook — "Add an analyzer
-  rule under `WUI20xx` (runtime/layout/XAML pitfalls)", "Extend
-  `winui-search` index", "Add a step to `BuildAndRun.ps1`".
+  rule under `WUI20xx` (runtime/layout/XAML pitfalls)", "Improve the
+  upstream `winapp find-ui` corpus", "Add a step to `BuildAndRun.ps1`".
 
 ### Skill prose that should be a Tier 2 (template) change
 
@@ -139,9 +139,6 @@ Less common but real:
   than a real WinUI pitfall. Analyzer noise erodes trust in the
   whole catalog. Recommend converting to skill guidance (Tier 3) or
   dropping.
-- A new `winui-search` synonym hack that encodes a single
-  contributor's mental model rather than a generally useful query
-  alias.
 - A new `winmd-cli` flag that exists only to match one skill's exact
   output format — couplings like this should be inverted (skill
   adapts to tool, not vice versa).
@@ -179,8 +176,9 @@ justification, the addition is misplaced — emit a finding.
 
 - New skill prose duplicating an existing analyzer rule → **medium**
   (Tier 3, recommend cite-the-rule-instead).
-- New skill prose that should clearly have been a new analyzer rule
-  / new `winui-search` data / new `BuildAndRun.ps1` step → **high**
+- New skill prose that should clearly have been a new analyzer rule,
+  an upstream `winapp find-ui` improvement, or a new `BuildAndRun.ps1`
+  step → **high**
   if the change is large and the Tier 1 path is straightforward;
   **medium** otherwise.
 - New skill prose that should clearly have been a `winapp` CLI

.github/skills/pr-review/dimensions/tool-correctness.md

@@ -19,7 +19,6 @@ C# / PowerShell code under:
 - `src/tools/winui-analyzer/Microsoft.WindowsAppSDK.Analyzers/` — Roslyn
   analyzer (netstandard2.0).
 - `src/tools/winmd-cli/` — Native-AOT WinRT/.NET metadata indexer.
-- `src/tools/winui-search/` — Native-AOT BM25 search exe.
 - `plugins/winui/skills/winui-dev-workflow/BuildAndRun.ps1`
 - `plugins/winui/skills/winui-session-report/Analyze-Session.ps1`
 - `scripts/build-tools.ps1`
@@ -58,7 +57,7 @@ directly break agent sessions.
   **medium**; cache lookups via `RegisterCompilationStartAction`
   instead.
 
-### Native AOT (winmd-cli & winui-search)
+### Native AOT (winmd-cli)
 
 - **AOT-incompat reflection.** No `Activator.CreateInstance(Type)`,
   no `Assembly.GetTypes()`-then-reflect, no `JsonSerializer` without
@@ -68,11 +67,9 @@ directly break agent sessions.
   `IL3050` / `IL2104` warnings under `PublishAot=true`. Suppressions
   must include a justifying comment.
 - **Single-file assumptions.** Don't read `Assembly.Location` or
-  `AppContext.BaseDirectory + relative file` in winui-search /
-  winmd-cli new code; both ship as single-file exes and these paths
-  behave differently from the source-build dev experience.
-- **Embedded resources.** `winui-search` data is embedded JSON; new
-  resource names must match `EmbeddedResource` items in the csproj.
+  `AppContext.BaseDirectory + relative file` in winmd-cli new code; it
+  ships as a single-file exe and these paths behave differently from
+  the source-build dev experience.
 
 ### Repo-specific PowerShell rules
 
@@ -120,4 +117,3 @@ emit findings only when the issue is also tied to one of the
 repo-specific rules above (e.g. a path traversal *in* an analyzer
 rule's IO, where the consequences are amplified by the analyzer's
 trust position).
-