@axiomatic-labs/claudeflow 2.13.65 → 2.13.67

package/lib/hook-overrides.js

@@ -57,6 +57,7 @@ function defaultOverrides() {
     disabledReminders: [],
     enforcementDisabled: false,
     runToCompletionReminderEnabled: false,
+    cwdLockEnabled: false,
   };
 }
 
@@ -69,6 +70,7 @@ function readOverrides(projectRoot) {
     disabledReminders: Array.isArray(data.disabledReminders) ? data.disabledReminders : [],
     enforcementDisabled: data.enforcementDisabled === true,
     runToCompletionReminderEnabled: data.runToCompletionReminderEnabled === true,
+    cwdLockEnabled: data.cwdLockEnabled === true,
   };
 }
 
@@ -209,6 +211,20 @@ function toggleRunToCompletionReminder(projectRoot, { enable }) {
   return { state: enable ? 'on' : 'off' };
 }
 
+// Toggle the cwd-lock hook. Independent of the master enforcement switch —
+// the CwdChanged hook is not in the enforcement-catalog and ignores the
+// master switch by design (you can lock cwd even with enforcement off).
+function toggleCwdLock(projectRoot, { enable }) {
+  if (typeof enable !== 'boolean') return { state: 'error', reason: 'enable-required' };
+  const overrides = readOverrides(projectRoot);
+  if (overrides.cwdLockEnabled === enable) {
+    return { state: 'noop', reason: enable ? 'already-on' : 'already-off' };
+  }
+  overrides.cwdLockEnabled = enable;
+  writeOverrides(projectRoot, overrides);
+  return { state: enable ? 'on' : 'off' };
+}
+
 // Toggle a single reminder by id. Same persistence file, same hot-reload
 // semantics — `reload-reminder.js` re-reads overrides on every invocation.
 function toggleReminderOverride(projectRoot, { id, disable }) {
@@ -240,6 +256,7 @@ module.exports = {
   toggleReminderOverride,
   toggleEnforcementMode,
   toggleRunToCompletionReminder,
+  toggleCwdLock,
   normalizeHandlerPath,
   matchesOverride,
 };

package/lib/panel.js

@@ -30,6 +30,7 @@ const {
   toggleReminderOverride,
   toggleEnforcementMode,
   toggleRunToCompletionReminder,
+  toggleCwdLock,
   normalizeHandlerPath,
 } = require('./hook-overrides.js');
 
@@ -330,11 +331,18 @@ function getObserverInfo(cwd) {
   const unresolvedIncidents = summary && Array.isArray(summary.unresolved_incidents)
     ? summary.unresolved_incidents
     : [];
-  const allIncidents = state && state.incidents && typeof state.incidents === 'object'
+  const allInState = state && state.incidents && typeof state.incidents === 'object'
     ? Object.values(state.incidents)
         .sort((a, b) => String(b.last_seen_at || '').localeCompare(String(a.last_seen_at || '')))
         .slice(0, 50)
     : [];
+  // Default surface to UI: ACTIVE only. "Clear observer state" resolves all
+  // active incidents, so after clear the active list is empty (which matches
+  // the user's expectation that "Clear" empties the feed). Resolved incidents
+  // are kept in state.incidents for audit and can be surfaced via the
+  // "Show resolved" filter pill.
+  const activeIncidents = allInState.filter((inc) => !inc.resolved_at && inc.active !== false);
+  const resolvedIncidents = allInState.filter((inc) => inc.resolved_at || inc.active === false);
 
   return {
     daemon,
@@ -346,7 +354,10 @@ function getObserverInfo(cwd) {
     servers,
     browser,
     unresolved_incidents: unresolvedIncidents,
-    recent_incidents: allIncidents,
+    active_incidents: activeIncidents,
+    resolved_incidents: resolvedIncidents,
+    // Kept for backwards compat with older render code — same as active_incidents.
+    recent_incidents: activeIncidents,
     totals: summary ? {
       unresolved: summary.unresolved_incidents_total || 0,
       browser: summary.browser_incidents_total || 0,
@@ -363,6 +374,14 @@ function getRunToCompletionInfo(cwd) {
   };
 }
 
+function getCwdLockInfo(cwd) {
+  const overrides = readOverrides(cwd);
+  return {
+    on: overrides.cwdLockEnabled === true,
+    handler: 'CwdChanged/lock-cwd.js',
+  };
+}
+
 function getActivePlanInfo(cwd) {
   const p = path.join(cwd, '.claudeflow', 'state', 'active-plan.json');
   let raw;
@@ -618,6 +637,7 @@ function collectStatus(cwd) {
     reminders: getRemindersInfo(cwd),
     enforcement: getEnforcementInfo(cwd),
     runToCompletion: getRunToCompletionInfo(cwd),
+    cwdLock: getCwdLockInfo(cwd),
     observer: getObserverInfo(cwd),
     activePlan: getActivePlanInfo(cwd),
     logs: getLogsInfo(cwd),
@@ -800,6 +820,11 @@ details[open] summary { padding-bottom: 8px; border-bottom: 1px solid var(--bord
       <label class="enforce-switch"><input type="checkbox" id="run-to-completion-toggle" /><span class="enforce-slider"></span></label>
       <span class="enforce-state" id="run-to-completion-state">…</span>
     </span>
+    <span class="enforce-pill" id="cwd-lock-pill" title="Hard block — fires on Claude Code CwdChanged event. When the agent runs cd Subdir + cmd and the cwd would persist away from the project root, the change is blocked with a guidance message. Use (cd Subdir + cmd) subshells or absolute paths instead.">
+      <span class="enforce-label">Lock cwd</span>
+      <label class="enforce-switch"><input type="checkbox" id="cwd-lock-toggle" /><span class="enforce-slider"></span></label>
+      <span class="enforce-state" id="cwd-lock-state">…</span>
+    </span>
     <label class="toggle"><input type="checkbox" id="auto" checked /> auto-refresh 5s</label>
     <button id="refresh">Refresh</button>
   </span>
@@ -833,6 +858,7 @@ const SECTIONS = [
 let state = null;
 let active = 'overview';
 let observerFilter = 'all';
+let observerShowResolved = false;
 let timer = null;
 
 // Preserve which <details> were open across re-renders (auto-refresh would
@@ -936,6 +962,20 @@ function renderHeader() {
   } else if (rtcPill) {
     rtcPill.style.display = 'none';
   }
+  const lock = state.cwdLock;
+  const lockPill = document.getElementById('cwd-lock-pill');
+  const lockCb = document.getElementById('cwd-lock-toggle');
+  const lockLbl = document.getElementById('cwd-lock-state');
+  if (lock && lockPill) {
+    lockPill.dataset.state = lock.on ? 'on' : 'off';
+    lockCb.checked = lock.on;
+    lockLbl.textContent = lock.on ? 'ON' : 'OFF';
+    lockPill.title = lock.on
+      ? 'Lock cwd is ON — any persistent change of working directory away from the project root is blocked via the CwdChanged hook. Use (cd Subdir + cmd) subshells or absolute paths.'
+      : 'Lock cwd is OFF — the agent can cd into subdirectories and the cwd will persist across tool calls. Click to enforce a single project-root cwd.';
+  } else if (lockPill) {
+    lockPill.style.display = 'none';
+  }
 }
 
 function severityFor(id) {
@@ -1428,10 +1468,13 @@ function renderObserver() {
       </div>\`
     : '<p class="muted">No browser snapshots received yet. (The observer collects when the agent navigates with mcp__claude-in-chrome__*.)</p>';
 
-  // Build the filter index: for each surface (server label), find which
-  // incidents belong to it. browser incidents are matched by origin URL
-  // against each server's :PORT. Browser-other = browser incidents whose
-  // origin doesn't match any configured server (e.g. external URL).
+  // Active vs resolved toggle (client-side state observerShowResolved).
+  // After "Clear observer state", all active incidents are marked resolved;
+  // by default the UI shows only active. Toggle the pill to see history.
+  const showResolved = (typeof observerShowResolved !== 'undefined') && observerShowResolved;
+  const sourceList = showResolved ? o.resolved_incidents : o.active_incidents;
+
+  // Build the filter index ON THE CURRENT VIEW (active or resolved).
   const serverByOrigin = {};
   o.servers.forEach((srv) => {
     if (srv.port) serverByOrigin[\`localhost:\${srv.port}\`] = srv.label;
@@ -1450,7 +1493,7 @@ function renderObserver() {
     return inc.source || 'other';
   }
   const buckets = {};
-  o.recent_incidents.forEach((inc) => {
+  sourceList.forEach((inc) => {
     const b = incidentBucket(inc);
     if (!buckets[b]) buckets[b] = [];
     buckets[b].push(inc);
@@ -1458,7 +1501,7 @@ function renderObserver() {
   const surfacesInUse = Object.keys(buckets).sort();
   // Apply observerFilter client-side state. Default 'all' (no filter).
   const filteredIncidents = (typeof observerFilter === 'undefined' || observerFilter === 'all')
-    ? o.recent_incidents
+    ? sourceList
     : (buckets[observerFilter] || []);
 
   const filterPill = (label, value, count) => {
@@ -1466,9 +1509,13 @@ function renderObserver() {
     const cls = active ? 'observer-filter active' : 'observer-filter';
     return \`<button class="\${cls}" data-observer-filter="\${escapeHtml(value)}">\${escapeHtml(label)}<span class="muted" style="margin-left:6px;font-size:11px;">\${count}</span></button>\`;
   };
-  const filterPills = '<div class="observer-filters" style="display:flex;gap:6px;flex-wrap:wrap;margin:8px 0;">' +
-    filterPill('All', 'all', o.recent_incidents.length) +
+  // Show resolved toggle pill — separate from surface filters.
+  const showResolvedClass = showResolved ? 'observer-filter active' : 'observer-filter';
+  const showResolvedPill = \`<button class="\${showResolvedClass}" data-observer-show-resolved="toggle" style="margin-left:auto;">\${showResolved ? 'Showing resolved' : 'Show resolved'}<span class="muted" style="margin-left:6px;font-size:11px;">\${o.resolved_incidents.length}</span></button>\`;
+  const filterPills = '<div class="observer-filters" style="display:flex;gap:6px;flex-wrap:wrap;align-items:center;margin:8px 0;">' +
+    filterPill('All', 'all', sourceList.length) +
     surfacesInUse.map((surface) => filterPill(surface, surface, buckets[surface].length)).join('') +
+    showResolvedPill +
     '</div>';
 
   // Incidents feed
@@ -1513,7 +1560,7 @@ function renderObserver() {
     <div class="card" style="padding:0;">\${serversTable}</div>
     <h3 style="margin-top:18px;font-size:14px;">Browser channel</h3>
     \${browserBlock}
-    <h3 style="margin-top:18px;font-size:14px;">Incidents (most recent \${o.recent_incidents.length})</h3>
+    <h3 style="margin-top:18px;font-size:14px;">\${showResolved ? 'Resolved incidents (' + o.resolved_incidents.length + ')' : 'Active incidents (' + o.active_incidents.length + ')'}</h3>
     \${filterPills}
     <div class="card" style="padding:0;">\${incidentsBlock}</div>\`;
 }
@@ -1670,6 +1717,13 @@ document.addEventListener('click', (e) => {
     renderContent();
     return;
   }
+  if (t.dataset && t.dataset.observerShowResolved) {
+    observerShowResolved = !observerShowResolved;
+    // Reset surface filter when toggling, since counts change.
+    observerFilter = 'all';
+    renderContent();
+    return;
+  }
 });
 
 async function clearObserverAction(btn) {
@@ -1872,6 +1926,34 @@ document.getElementById('run-to-completion-toggle').onchange = (e) => {
   toggleRunToCompletion(e.target.checked);
 };
 
+async function toggleCwdLockUI(enable) {
+  try {
+    const r = await fetch('/api/cwd-lock/toggle', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ enable }),
+    });
+    const result = await r.json();
+    if (!r.ok || result.state === 'error') {
+      showToast('Toggle failed: ' + (result.reason || result.error || 'unknown'), 'err');
+    } else if (result.state === 'noop') {
+      showToast('Cwd lock already in target state', 'ok');
+    } else {
+      showToast(enable
+        ? 'Cwd lock ON — cd away from project root will be BLOCKED on next CwdChanged.'
+        : 'Cwd lock OFF — agent can freely change directory.',
+        'ok');
+    }
+  } catch (e) {
+    showToast('Network error: ' + e.message, 'err');
+  }
+  await refresh();
+}
+
+document.getElementById('cwd-lock-toggle').onchange = (e) => {
+  toggleCwdLockUI(e.target.checked);
+};
+
 document.getElementById('refresh').onclick = refresh;
 document.getElementById('auto').onchange = (e) => {
   if (timer) clearInterval(timer);
@@ -1981,6 +2063,20 @@ function handler(cwd) {
         return send(status, JSON.stringify(result), 'application/json');
       }
 
+      if (req.method === 'POST' && route === '/api/cwd-lock/toggle') {
+        const raw = await readRequestBody(req);
+        let payload;
+        try { payload = JSON.parse(raw); }
+        catch { return send(400, JSON.stringify({ error: 'invalid json' }), 'application/json'); }
+        const { enable } = payload;
+        if (typeof enable !== 'boolean') {
+          return send(400, JSON.stringify({ error: 'enable required' }), 'application/json');
+        }
+        const result = toggleCwdLock(cwd, { enable });
+        const status = result.state === 'error' ? 500 : 200;
+        return send(status, JSON.stringify(result), 'application/json');
+      }
+
       if (req.method === 'POST' && route === '/api/run-to-completion/toggle') {
         const raw = await readRequestBody(req);
         let payload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.13.65",
+  "version": "2.13.67",
   "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"