@axiomatic-labs/claudeflow 2.13.64 → 2.13.66

package/lib/hook-overrides.js

@@ -57,6 +57,7 @@ function defaultOverrides() {
     disabledReminders: [],
     enforcementDisabled: false,
     runToCompletionReminderEnabled: false,
+    cwdLockEnabled: false,
   };
 }
 
@@ -69,6 +70,7 @@ function readOverrides(projectRoot) {
     disabledReminders: Array.isArray(data.disabledReminders) ? data.disabledReminders : [],
     enforcementDisabled: data.enforcementDisabled === true,
     runToCompletionReminderEnabled: data.runToCompletionReminderEnabled === true,
+    cwdLockEnabled: data.cwdLockEnabled === true,
   };
 }
 
@@ -209,6 +211,20 @@ function toggleRunToCompletionReminder(projectRoot, { enable }) {
   return { state: enable ? 'on' : 'off' };
 }
 
+// Toggle the cwd-lock hook. Independent of the master enforcement switch —
+// the CwdChanged hook is not in the enforcement-catalog and ignores the
+// master switch by design (you can lock cwd even with enforcement off).
+function toggleCwdLock(projectRoot, { enable }) {
+  if (typeof enable !== 'boolean') return { state: 'error', reason: 'enable-required' };
+  const overrides = readOverrides(projectRoot);
+  if (overrides.cwdLockEnabled === enable) {
+    return { state: 'noop', reason: enable ? 'already-on' : 'already-off' };
+  }
+  overrides.cwdLockEnabled = enable;
+  writeOverrides(projectRoot, overrides);
+  return { state: enable ? 'on' : 'off' };
+}
+
 // Toggle a single reminder by id. Same persistence file, same hot-reload
 // semantics — `reload-reminder.js` re-reads overrides on every invocation.
 function toggleReminderOverride(projectRoot, { id, disable }) {
@@ -240,6 +256,7 @@ module.exports = {
   toggleReminderOverride,
   toggleEnforcementMode,
   toggleRunToCompletionReminder,
+  toggleCwdLock,
   normalizeHandlerPath,
   matchesOverride,
 };

package/lib/panel.js

@@ -30,6 +30,7 @@ const {
   toggleReminderOverride,
   toggleEnforcementMode,
   toggleRunToCompletionReminder,
+  toggleCwdLock,
   normalizeHandlerPath,
 } = require('./hook-overrides.js');
 
@@ -363,6 +364,14 @@ function getRunToCompletionInfo(cwd) {
   };
 }
 
+function getCwdLockInfo(cwd) {
+  const overrides = readOverrides(cwd);
+  return {
+    on: overrides.cwdLockEnabled === true,
+    handler: 'CwdChanged/lock-cwd.js',
+  };
+}
+
 function getActivePlanInfo(cwd) {
   const p = path.join(cwd, '.claudeflow', 'state', 'active-plan.json');
   let raw;
@@ -618,6 +627,7 @@ function collectStatus(cwd) {
     reminders: getRemindersInfo(cwd),
     enforcement: getEnforcementInfo(cwd),
     runToCompletion: getRunToCompletionInfo(cwd),
+    cwdLock: getCwdLockInfo(cwd),
     observer: getObserverInfo(cwd),
     activePlan: getActivePlanInfo(cwd),
     logs: getLogsInfo(cwd),
@@ -734,6 +744,9 @@ details[open] summary { padding-bottom: 8px; border-bottom: 1px solid var(--bord
 .logs-controls { display: flex; gap: 12px; align-items: center; margin-bottom: 14px; }
 .logs-controls select, .logs-controls button { background: var(--panel); border: 1px solid var(--border); color: var(--fg); padding: 6px 10px; border-radius: 6px; font: inherit; }
 .logs-controls button:hover { border-color: var(--accent); cursor: pointer; }
+.observer-filter { background: var(--panel); border: 1px solid var(--border); color: var(--fg); padding: 4px 10px; border-radius: 999px; cursor: pointer; font-size: 12px; font: inherit; }
+.observer-filter:hover { border-color: var(--accent, #6cf); }
+.observer-filter.active { background: rgba(108,170,255,0.12); border-color: var(--accent, #6cf); color: var(--accent, #6cf); }
 .btn-warn { background: var(--panel); border: 1px solid rgba(245,194,52,0.5); color: var(--warn, #f5c234); padding: 6px 12px; border-radius: 6px; cursor: pointer; font: inherit; }
 .btn-warn:hover { border-color: var(--warn, #f5c234); background: rgba(245,194,52,0.08); }
 .btn-warn:disabled { opacity: 0.4; cursor: not-allowed; }
@@ -797,6 +810,11 @@ details[open] summary { padding-bottom: 8px; border-bottom: 1px solid var(--bord
       <label class="enforce-switch"><input type="checkbox" id="run-to-completion-toggle" /><span class="enforce-slider"></span></label>
       <span class="enforce-state" id="run-to-completion-state">…</span>
     </span>
+    <span class="enforce-pill" id="cwd-lock-pill" title="Hard block — fires on Claude Code CwdChanged event. When the agent runs cd Subdir + cmd and the cwd would persist away from the project root, the change is blocked with a guidance message. Use (cd Subdir + cmd) subshells or absolute paths instead.">
+      <span class="enforce-label">Lock cwd</span>
+      <label class="enforce-switch"><input type="checkbox" id="cwd-lock-toggle" /><span class="enforce-slider"></span></label>
+      <span class="enforce-state" id="cwd-lock-state">…</span>
+    </span>
     <label class="toggle"><input type="checkbox" id="auto" checked /> auto-refresh 5s</label>
     <button id="refresh">Refresh</button>
   </span>
@@ -829,6 +847,7 @@ const SECTIONS = [
 
 let state = null;
 let active = 'overview';
+let observerFilter = 'all';
 let timer = null;
 
 // Preserve which <details> were open across re-renders (auto-refresh would
@@ -932,6 +951,20 @@ function renderHeader() {
   } else if (rtcPill) {
     rtcPill.style.display = 'none';
   }
+  const lock = state.cwdLock;
+  const lockPill = document.getElementById('cwd-lock-pill');
+  const lockCb = document.getElementById('cwd-lock-toggle');
+  const lockLbl = document.getElementById('cwd-lock-state');
+  if (lock && lockPill) {
+    lockPill.dataset.state = lock.on ? 'on' : 'off';
+    lockCb.checked = lock.on;
+    lockLbl.textContent = lock.on ? 'ON' : 'OFF';
+    lockPill.title = lock.on
+      ? 'Lock cwd is ON — any persistent change of working directory away from the project root is blocked via the CwdChanged hook. Use (cd Subdir + cmd) subshells or absolute paths.'
+      : 'Lock cwd is OFF — the agent can cd into subdirectories and the cwd will persist across tool calls. Click to enforce a single project-root cwd.';
+  } else if (lockPill) {
+    lockPill.style.display = 'none';
+  }
 }
 
 function severityFor(id) {
@@ -1424,11 +1457,54 @@ function renderObserver() {
       </div>\`
     : '<p class="muted">No browser snapshots received yet. (The observer collects when the agent navigates with mcp__claude-in-chrome__*.)</p>';
 
+  // Build the filter index: for each surface (server label), find which
+  // incidents belong to it. browser incidents are matched by origin URL
+  // against each server's :PORT. Browser-other = browser incidents whose
+  // origin doesn't match any configured server (e.g. external URL).
+  const serverByOrigin = {};
+  o.servers.forEach((srv) => {
+    if (srv.port) serverByOrigin[\`localhost:\${srv.port}\`] = srv.label;
+    if (srv.port) serverByOrigin[\`127.0.0.1:\${srv.port}\`] = srv.label;
+  });
+  function incidentBucket(inc) {
+    if (inc.source === 'server') {
+      return (inc.metadata && inc.metadata.label) || inc.surface || 'server-unknown';
+    }
+    if (inc.source === 'browser') {
+      const url = (inc.metadata && (inc.metadata.url || inc.metadata.origin)) || '';
+      const m = url.match(/^https?:\\/\\/([^/]+)/);
+      if (m && serverByOrigin[m[1]]) return serverByOrigin[m[1]];
+      return 'browser-other';
+    }
+    return inc.source || 'other';
+  }
+  const buckets = {};
+  o.recent_incidents.forEach((inc) => {
+    const b = incidentBucket(inc);
+    if (!buckets[b]) buckets[b] = [];
+    buckets[b].push(inc);
+  });
+  const surfacesInUse = Object.keys(buckets).sort();
+  // Apply observerFilter client-side state. Default 'all' (no filter).
+  const filteredIncidents = (typeof observerFilter === 'undefined' || observerFilter === 'all')
+    ? o.recent_incidents
+    : (buckets[observerFilter] || []);
+
+  const filterPill = (label, value, count) => {
+    const active = (typeof observerFilter === 'undefined' && value === 'all') || observerFilter === value;
+    const cls = active ? 'observer-filter active' : 'observer-filter';
+    return \`<button class="\${cls}" data-observer-filter="\${escapeHtml(value)}">\${escapeHtml(label)}<span class="muted" style="margin-left:6px;font-size:11px;">\${count}</span></button>\`;
+  };
+  const filterPills = '<div class="observer-filters" style="display:flex;gap:6px;flex-wrap:wrap;margin:8px 0;">' +
+    filterPill('All', 'all', o.recent_incidents.length) +
+    surfacesInUse.map((surface) => filterPill(surface, surface, buckets[surface].length)).join('') +
+    '</div>';
+
   // Incidents feed
-  const incidentsBlock = o.recent_incidents.length === 0
-    ? '<p class="muted">No incidents recorded.</p>'
+  const incidentsBlock = filteredIncidents.length === 0
+    ? '<p class="muted">No incidents in this filter.</p>'
     : '<div class="incidents-feed">' +
-      o.recent_incidents.map((inc) => {
+      filteredIncidents.map((inc) => {
         const sevClass = inc.severity === 'error' || inc.severity === 'critical' ? 'err' : (inc.severity === 'warning' ? 'warn' : 'info');
         const resolvedBadge = inc.resolved_at
           ? '<span class="badge ok" style="margin-left:6px;">resolved</span>'
@@ -1467,6 +1543,7 @@ function renderObserver() {
     <h3 style="margin-top:18px;font-size:14px;">Browser channel</h3>
     \${browserBlock}
     <h3 style="margin-top:18px;font-size:14px;">Incidents (most recent \${o.recent_incidents.length})</h3>
+    \${filterPills}
     <div class="card" style="padding:0;">\${incidentsBlock}</div>\`;
 }
 
@@ -1617,6 +1694,11 @@ document.addEventListener('click', (e) => {
   if (t.id === 'clear-observer') {
     return clearObserverAction(t);
   }
+  if (t.dataset && t.dataset.observerFilter) {
+    observerFilter = t.dataset.observerFilter;
+    renderContent();
+    return;
+  }
 });
 
 async function clearObserverAction(btn) {
@@ -1819,6 +1901,34 @@ document.getElementById('run-to-completion-toggle').onchange = (e) => {
   toggleRunToCompletion(e.target.checked);
 };
 
+async function toggleCwdLockUI(enable) {
+  try {
+    const r = await fetch('/api/cwd-lock/toggle', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ enable }),
+    });
+    const result = await r.json();
+    if (!r.ok || result.state === 'error') {
+      showToast('Toggle failed: ' + (result.reason || result.error || 'unknown'), 'err');
+    } else if (result.state === 'noop') {
+      showToast('Cwd lock already in target state', 'ok');
+    } else {
+      showToast(enable
+        ? 'Cwd lock ON — cd away from project root will be BLOCKED on next CwdChanged.'
+        : 'Cwd lock OFF — agent can freely change directory.',
+        'ok');
+    }
+  } catch (e) {
+    showToast('Network error: ' + e.message, 'err');
+  }
+  await refresh();
+}
+
+document.getElementById('cwd-lock-toggle').onchange = (e) => {
+  toggleCwdLockUI(e.target.checked);
+};
+
 document.getElementById('refresh').onclick = refresh;
 document.getElementById('auto').onchange = (e) => {
   if (timer) clearInterval(timer);
@@ -1928,6 +2038,20 @@ function handler(cwd) {
         return send(status, JSON.stringify(result), 'application/json');
       }
 
+      if (req.method === 'POST' && route === '/api/cwd-lock/toggle') {
+        const raw = await readRequestBody(req);
+        let payload;
+        try { payload = JSON.parse(raw); }
+        catch { return send(400, JSON.stringify({ error: 'invalid json' }), 'application/json'); }
+        const { enable } = payload;
+        if (typeof enable !== 'boolean') {
+          return send(400, JSON.stringify({ error: 'enable required' }), 'application/json');
+        }
+        const result = toggleCwdLock(cwd, { enable });
+        const status = result.state === 'error' ? 500 : 200;
+        return send(status, JSON.stringify(result), 'application/json');
+      }
+
       if (req.method === 'POST' && route === '/api/run-to-completion/toggle') {
         const raw = await readRequestBody(req);
         let payload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.13.64",
+  "version": "2.13.66",
   "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"