@axiomatic-labs/claudeflow 2.13.72 → 2.13.74

package/lib/doctor.js

@@ -42,7 +42,9 @@ function readPlaywrightCdpEndpoint(mcpPath) {
   const flagIdx = entry.args.indexOf('--cdp-endpoint');
   if (flagIdx === -1) return { state: 'no-flag', parsed };
   const value = entry.args[flagIdx + 1];
-  const match = /localhost:(\d+)/.exec(value || '');
+  // Accept localhost OR 127.0.0.1 (v2.13.72+ writes the latter explicitly to
+  // dodge the IPv4/IPv6 dual-daemon trap — see observer-loopback lint test).
+  const match = /(?:localhost|127\.0\.0\.1):(\d+)/.exec(value || '');
   if (!match) return { state: 'unparseable', value, parsed };
   return { state: 'ok', port: Number(match[1]), flagIdx, parsed };
 }
@@ -78,7 +80,7 @@ function checkCdpPortMismatch(cwd) {
 
 function applyCdpPortFix(check) {
   const { mcpPath, expected, parsed, flagIdx } = check.fix;
-  parsed.mcpServers.playwright.args[flagIdx + 1] = `http://localhost:${expected}`;
+  parsed.mcpServers.playwright.args[flagIdx + 1] = `http://127.0.0.1:${expected}`;
   fs.writeFileSync(mcpPath, JSON.stringify(parsed, null, 2) + '\n');
 }
 
@@ -251,6 +253,46 @@ function checkObserverState(cwd) {
   };
 }
 
+// Detects more than one process listening on the observer port. macOS allows
+// distinct sockets on the same port for IPv4 and IPv6, so a stale daemon
+// bound to "localhost" (which old code resolved to ::1) could coexist with a
+// fresh daemon bound to 127.0.0.1. Snapshots routed via `localhost` then
+// landed on the stale daemon, which carried the pre-v2.13.71 auto-resolve
+// bug — panel saw the new daemon's empty state, hook saw 1 incident. This
+// check surfaces that condition explicitly.
+function checkObserverDualBind(cwd) {
+  const observer = readObserverState(cwd);
+  if (!observer.port) {
+    return { id: 'observer-dual-bind', severity: 'info', message: 'No observer port known — skipping dual-bind check.' };
+  }
+  const port = observer.port;
+  let listeners = [];
+  try {
+    const { spawnSync } = require('child_process');
+    const r = spawnSync('lsof', [`-iTCP:${port}`, '-sTCP:LISTEN', '-P', '-n', '-F', 'pn'], { encoding: 'utf8', timeout: 1500 });
+    if (r.status === 0 && r.stdout) {
+      let currentPid = null;
+      for (const line of r.stdout.split('\n')) {
+        if (line.startsWith('p')) currentPid = Number(line.slice(1));
+        else if (line.startsWith('n') && currentPid) listeners.push({ pid: currentPid, name: line.slice(1) });
+      }
+    }
+  } catch {
+    return { id: 'observer-dual-bind', severity: 'info', message: 'lsof unavailable — cannot verify single-bind on observer port.' };
+  }
+  const uniquePids = new Set(listeners.map((l) => l.pid));
+  if (uniquePids.size <= 1) {
+    return { id: 'observer-dual-bind', severity: 'ok', message: `Observer port ${port} has a single listener.` };
+  }
+  return {
+    id: 'observer-dual-bind',
+    severity: 'error',
+    message: `Observer port ${port} has ${uniquePids.size} distinct processes listening (PIDs: ${[...uniquePids].join(', ')}). One is likely a stale daemon from a previous version. Browser snapshots may route to the wrong instance, causing the panel and the Stop hook to disagree. Fix: stop the older PID (\`kill <pid>\`) and let the SessionStart hook respawn a single daemon.`,
+    detail: listeners.map((l) => ({ file: `pid ${l.pid}`, reason: l.name })),
+    fix: { kind: 'dual-bind', listeners },
+  };
+}
+
 function applyStaleLockfileFix(check) {
   for (const { file } of check.fix.stale) {
     try { fs.unlinkSync(file); } catch {}
@@ -286,6 +328,7 @@ async function run(argv = []) {
     checkCdpPortMismatch(cwd),
     checkStaleLockfiles(cwd),
     checkObserverState(cwd),
+    checkObserverDualBind(cwd),
   ];
 
   for (const check of checks) printCheck(check);
@@ -326,6 +369,7 @@ module.exports.deriveCdpPort = deriveCdpPort;
 module.exports.checkCdpPortMismatch = checkCdpPortMismatch;
 module.exports.checkStaleLockfiles = checkStaleLockfiles;
 module.exports.checkObserverState = checkObserverState;
+module.exports.checkObserverDualBind = checkObserverDualBind;
 module.exports.readObserverState = readObserverState;
 module.exports.readPlaywrightCdpEndpoint = readPlaywrightCdpEndpoint;
 module.exports.applyCdpPortFix = applyCdpPortFix;

package/lib/install.js

@@ -117,7 +117,7 @@ async function run() {
       command: "npx",
       args: [
         "@playwright/mcp@latest",
-        "--cdp-endpoint", `http://localhost:${cdpPort}`,
+        "--cdp-endpoint", `http://127.0.0.1:${cdpPort}`,
         "--caps", "vision,devtools",
       ],
     };
@@ -220,6 +220,12 @@ async function run() {
     fs.rmSync(tmpExtract, { recursive: true, force: true });
   }
 
+  // Kill any running observer daemon so the next request spawns a fresh one
+  // with the updated runtime code. Pre-fix: a running daemon held the old
+  // version in memory until manually killed, causing the bridge to talk to
+  // stale logic (see v2.13.71→v2.13.72 dual-daemon incident).
+  killStaleObserverDaemon(cwd);
+
   // Install analysis tools (ast-grep + Serena MCP)
   installAnalysisTools();
 
@@ -282,6 +288,33 @@ async function run() {
   showGettingStarted(cwd, cliStatus);
 }
 
+function killStaleObserverDaemon(cwd) {
+  const pidPath = path.join(cwd, '.claudeflow', 'tmp', 'error-observer.pid');
+  if (!fs.existsSync(pidPath)) return;
+  let pid;
+  try {
+    pid = Number(fs.readFileSync(pidPath, 'utf8').trim());
+  } catch {
+    return;
+  }
+  if (!Number.isFinite(pid) || pid <= 1) return;
+  try {
+    // signal 0 = "is this PID alive and ours to signal?"
+    process.kill(pid, 0);
+  } catch {
+    // Not running or not ours. Clean up the stale pidfile and move on.
+    try { fs.unlinkSync(pidPath); } catch {}
+    return;
+  }
+  try {
+    process.kill(pid, 'SIGTERM');
+    ui.success(`Stopped running observer daemon (pid ${pid}) so the update takes effect`);
+  } catch {
+    // Swallow — non-fatal. The user can restart manually if needed.
+  }
+  try { fs.unlinkSync(pidPath); } catch {}
+}
+
 function ensureGlobalCli(version) {
   // Returns { available: boolean, autoInstalled: boolean, upgraded: boolean, fromVersion?: string, error?: string }
   // `commandExists('claudeflow')` yields a false positive when install.js runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.13.72",
+  "version": "2.13.74",
   "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"