@axiomatic-labs/claudeflow 2.33.0 → 2.33.2

package/package.json

@@ -1,13 +1,18 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.33.0",
+  "version": "2.33.2",
   "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"
   },
   "files": [
-    "bin/",
-    "lib/",
+    "bin/cli.js",
+    "lib/auth.js",
+    "lib/claude-passthrough.js",
+    "lib/download.js",
+    "lib/install.js",
+    "lib/ui.js",
+    "lib/version.js",
     "README.md"
   ],
   "keywords": [

package/lib/doctor.js

@@ -1,376 +0,0 @@
-// `claudeflow doctor` — diagnose and optionally repair common local-machine
-// issues that don't surface until something silently fails.
-//
-// Scope (intentionally narrow):
-//   1. CDP port mismatch — `.mcp.json` ships a `--cdp-endpoint` derived from
-//      the path of whoever ran `claudeflow init`. After a clone, the local
-//      observer derives a different port from the new path, so the Playwright
-//      MCP can't reach the observer's Chrome.
-//   2. Stale browser PID lockfile — `openBrowser()` writes
-//      `.claudeflow/tmp/.browser-cdp-<port>.pid` and skips relaunch if the PID
-//      is alive. If Chrome is killed externally (pkill) the lockfile lingers
-//      and blocks subsequent launches.
-//
-// Read-only by default. `--fix` applies repairs after reporting them.
-
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-
-const ui = require('./ui.js');
-
-function deriveCdpPort(projectPath) {
-  const hash = crypto.createHash('sha1').update(projectPath).digest();
-  return 9200 + (hash.readUInt16BE(2) % 100);
-}
-
-function readPlaywrightCdpEndpoint(mcpPath) {
-  let raw;
-  try {
-    raw = fs.readFileSync(mcpPath, 'utf8');
-  } catch {
-    return { state: 'missing-file' };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    return { state: 'invalid-json', error: err.message };
-  }
-  const entry = parsed && parsed.mcpServers && parsed.mcpServers.playwright;
-  if (!entry || !Array.isArray(entry.args)) return { state: 'no-playwright' };
-  const flagIdx = entry.args.indexOf('--cdp-endpoint');
-  if (flagIdx === -1) return { state: 'no-flag', parsed };
-  const value = entry.args[flagIdx + 1];
-  // Accept localhost OR 127.0.0.1 (v2.13.72+ writes the latter explicitly to
-  // dodge the IPv4/IPv6 dual-daemon trap — see observer-loopback lint test).
-  const match = /(?:localhost|127\.0\.0\.1):(\d+)/.exec(value || '');
-  if (!match) return { state: 'unparseable', value, parsed };
-  return { state: 'ok', port: Number(match[1]), flagIdx, parsed };
-}
-
-function checkCdpPortMismatch(cwd) {
-  const mcpPath = path.join(cwd, '.mcp.json');
-  const expected = deriveCdpPort(cwd);
-  const reading = readPlaywrightCdpEndpoint(mcpPath);
-
-  switch (reading.state) {
-    case 'missing-file':
-      return { id: 'cdp-port', severity: 'info', message: 'No .mcp.json in cwd — skipping.' };
-    case 'invalid-json':
-      return { id: 'cdp-port', severity: 'error', message: `.mcp.json is invalid JSON: ${reading.error}` };
-    case 'no-playwright':
-      return { id: 'cdp-port', severity: 'info', message: '.mcp.json has no `playwright` entry — skipping.' };
-    case 'no-flag':
-      return { id: 'cdp-port', severity: 'info', message: 'Playwright MCP has no `--cdp-endpoint` flag — observer-MCP wiring not in use.' };
-    case 'unparseable':
-      return { id: 'cdp-port', severity: 'error', message: `Unparseable --cdp-endpoint value: ${reading.value}` };
-    case 'ok':
-      if (reading.port === expected) {
-        return { id: 'cdp-port', severity: 'ok', message: `CDP port matches (${expected}).` };
-      }
-      return {
-        id: 'cdp-port',
-        severity: 'mismatch',
-        message: `CDP port mismatch — .mcp.json has ${reading.port}, this machine derives ${expected} from ${cwd}.`,
-        fix: { mcpPath, expected, parsed: reading.parsed, flagIdx: reading.flagIdx },
-      };
-  }
-}
-
-function applyCdpPortFix(check) {
-  const { mcpPath, expected, parsed, flagIdx } = check.fix;
-  parsed.mcpServers.playwright.args[flagIdx + 1] = `http://127.0.0.1:${expected}`;
-  fs.writeFileSync(mcpPath, JSON.stringify(parsed, null, 2) + '\n');
-}
-
-function listStaleLockfiles(cwd) {
-  const dir = path.join(cwd, '.claudeflow', 'tmp');
-  let entries;
-  try {
-    entries = fs.readdirSync(dir);
-  } catch {
-    return [];
-  }
-  const stale = [];
-  for (const name of entries) {
-    if (!/^\.browser-cdp-\d+\.pid$/.test(name)) continue;
-    const full = path.join(dir, name);
-    let pid;
-    try {
-      pid = parseInt(fs.readFileSync(full, 'utf8').trim(), 10);
-    } catch {
-      stale.push({ file: full, reason: 'unreadable' });
-      continue;
-    }
-    if (!Number.isFinite(pid) || pid <= 0) {
-      stale.push({ file: full, reason: 'invalid-pid', pid });
-      continue;
-    }
-    try {
-      process.kill(pid, 0);
-    } catch (err) {
-      if (err.code === 'ESRCH') stale.push({ file: full, reason: 'dead-pid', pid });
-      // EPERM means the PID exists but we can't signal it — treat as alive.
-    }
-  }
-  return stale;
-}
-
-function checkStaleLockfiles(cwd) {
-  const stale = listStaleLockfiles(cwd);
-  if (stale.length === 0) {
-    return { id: 'stale-lockfile', severity: 'ok', message: 'No stale browser lockfiles.' };
-  }
-  return {
-    id: 'stale-lockfile',
-    severity: 'mismatch',
-    message: `${stale.length} stale browser lockfile(s) — Chrome PIDs no longer alive.`,
-    detail: stale,
-    fix: { stale },
-  };
-}
-
-// Read the browser-error-daemon observer state. The daemon is the Node
-// process that hosts the HTTP server at error-observer.json's `port` and
-// receives error/network reports from Chrome.
-//
-// CAVEAT — this is NOT the same as Chrome's CDP pidfile:
-//   - `.browser-cdp-{cdpPort}.pid`     → Chrome browser process (CDP port)
-//   - `error-observer.pid` / json     → Node daemon process (observer port)
-// These are two distinct processes. Previous versions of this function
-// looked at the Chrome pidfile and reported the observer "stopped" even
-// when the daemon was alive, because the cdp-port pidfile may not be
-// present when Chrome was started outside of claudeflow's openBrowser().
-//
-// Detection strategy (in order of preference):
-//   1. error-observer.json exists → read its `port` + `pid_path`.
-//   2. If pidfile exists and PID is alive → running=true.
-//   3. Else, TCP probe the observer port via `lsof -i :PORT -sTCP:LISTEN -t`.
-//      The pidfile may be missing (race) but if SOMETHING is listening on
-//      the configured port, the daemon is up.
-function readObserverState(cwd) {
-  const observerJsonPath = path.join(cwd, '.claudeflow', 'tmp', 'error-observer.json');
-  // Defense-in-depth retry: even though the daemon now writes atomically
-  // (rename-after-write), older daemon versions and any future non-atomic
-  // writer would expose a 0-byte window during overwrite. We retry up to
-  // 3 times with a tiny pause between attempts so a transient empty read
-  // doesn't flip the panel UI between running/stopped every refresh.
-  let meta = null;
-  let lastErr = null;
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    try {
-      const raw = fs.readFileSync(observerJsonPath, 'utf8');
-      if (raw.trim()) {
-        meta = JSON.parse(raw);
-        break;
-      }
-      lastErr = new Error('empty file');
-    } catch (e) {
-      lastErr = e;
-      if (e.code === 'ENOENT') break; // file genuinely missing — no retry helps
-    }
-    if (attempt < 2) {
-      // Sync sleep (~30ms) via spawnSync — sufficient to outlast a writeFile race.
-      const { spawnSync } = require('child_process');
-      spawnSync('sleep', ['0.03']);
-    }
-  }
-  if (!meta) {
-    const source = (lastErr && lastErr.code === 'ENOENT') ? 'no-observer-json' : 'observer-json-malformed';
-    return { running: false, pid: null, port: null, source, observerJsonPath };
-  }
-  if (typeof meta.port !== 'number') {
-    return { running: false, pid: null, port: null, source: 'observer-json-malformed', observerJsonPath };
-  }
-  const port = meta.port;
-  const pidPath = typeof meta.pid_path === 'string' ? meta.pid_path : null;
-
-  // Try the pidfile first — fastest path.
-  let pid = null;
-  if (pidPath) {
-    try {
-      const p = parseInt(fs.readFileSync(pidPath, 'utf8').trim(), 10);
-      if (Number.isFinite(p) && p > 0) pid = p;
-    } catch {}
-  }
-  if (pid !== null) {
-    let alive = false;
-    try { process.kill(pid, 0); alive = true; } catch (e) { alive = e.code === 'EPERM'; }
-    if (alive) return { running: true, pid, port, source: 'pidfile', observerJsonPath };
-  }
-
-  // Fallback: TCP probe via lsof. Catches the case where pidfile is missing
-  // but the daemon process is still listening on the port.
-  try {
-    const { spawnSync } = require('child_process');
-    const r = spawnSync('lsof', ['-i', `:${port}`, '-sTCP:LISTEN', '-t'], { encoding: 'utf8', timeout: 1500 });
-    if (r.status === 0 && r.stdout && r.stdout.trim()) {
-      const tcpPid = parseInt(r.stdout.trim().split('\n')[0], 10);
-      if (Number.isFinite(tcpPid) && tcpPid > 0) {
-        return { running: true, pid: tcpPid, port, source: 'tcp-probe', observerJsonPath };
-      }
-    }
-  } catch {}
-
-  return { running: false, pid: pid, port, source: 'no-listener', observerJsonPath };
-}
-
-// Surface as a doctor/panel issue when the browser-error-daemon observer
-// is stopped while Playwright is configured. The observer collects console
-// errors + network failures during headed browser verification — when it's
-// down, those signals are silently lost, so the agent may verify a flow
-// that has console errors and not know it.
-function checkObserverState(cwd) {
-  const mcpPath = path.join(cwd, '.mcp.json');
-  let cfg;
-  try { cfg = JSON.parse(fs.readFileSync(mcpPath, 'utf8')); }
-  catch { return { id: 'observer-state', severity: 'info', message: 'No .mcp.json — observer not applicable.' }; }
-  const hasPlaywright = cfg.mcpServers
-    && Object.keys(cfg.mcpServers).some((s) => s.toLowerCase().includes('playwright'));
-  if (!hasPlaywright) {
-    return { id: 'observer-state', severity: 'info', message: 'Playwright not configured — observer not applicable.' };
-  }
-  const observer = readObserverState(cwd);
-  if (observer.running) {
-    return {
-      id: 'observer-state',
-      severity: 'ok',
-      message: `browser-error-daemon running on port ${observer.port} (pid ${observer.pid}, detected via ${observer.source}).`,
-    };
-  }
-  // Distinguish "never started" (no observer JSON) from "started then died".
-  const detailMsg = observer.source === 'no-observer-json'
-    ? 'no `.claudeflow/tmp/error-observer.json` — the daemon never started this session. Check `.claude/hooks/SessionStart/browser-error-daemon.js` for failures.'
-    : observer.source === 'observer-json-malformed'
-    ? '`.claudeflow/tmp/error-observer.json` is malformed.'
-    : 'observer JSON exists (port ' + observer.port + ') but no process is listening — the daemon crashed after startup. Tail `.claude/tmp/hooks.log` for the most recent SessionStart entry.';
-  return {
-    id: 'observer-state',
-    severity: 'mismatch',
-    message: `browser-error-daemon is STOPPED while Playwright is configured. Console errors / network failures from headed sessions are NOT being collected — the agent may verify a flow with console errors and miss them. Diagnosis: ${detailMsg}`,
-    detail: [{ port: observer.port, source: observer.source, observerJsonPath: observer.observerJsonPath }],
-  };
-}
-
-// Detects more than one process listening on the observer port. macOS allows
-// distinct sockets on the same port for IPv4 and IPv6, so a stale daemon
-// bound to "localhost" (which old code resolved to ::1) could coexist with a
-// fresh daemon bound to 127.0.0.1. Snapshots routed via `localhost` then
-// landed on the stale daemon, which carried the pre-v2.13.71 auto-resolve
-// bug — panel saw the new daemon's empty state, hook saw 1 incident. This
-// check surfaces that condition explicitly.
-function checkObserverDualBind(cwd) {
-  const observer = readObserverState(cwd);
-  if (!observer.port) {
-    return { id: 'observer-dual-bind', severity: 'info', message: 'No observer port known — skipping dual-bind check.' };
-  }
-  const port = observer.port;
-  let listeners = [];
-  try {
-    const { spawnSync } = require('child_process');
-    const r = spawnSync('lsof', [`-iTCP:${port}`, '-sTCP:LISTEN', '-P', '-n', '-F', 'pn'], { encoding: 'utf8', timeout: 1500 });
-    if (r.status === 0 && r.stdout) {
-      let currentPid = null;
-      for (const line of r.stdout.split('\n')) {
-        if (line.startsWith('p')) currentPid = Number(line.slice(1));
-        else if (line.startsWith('n') && currentPid) listeners.push({ pid: currentPid, name: line.slice(1) });
-      }
-    }
-  } catch {
-    return { id: 'observer-dual-bind', severity: 'info', message: 'lsof unavailable — cannot verify single-bind on observer port.' };
-  }
-  const uniquePids = new Set(listeners.map((l) => l.pid));
-  if (uniquePids.size <= 1) {
-    return { id: 'observer-dual-bind', severity: 'ok', message: `Observer port ${port} has a single listener.` };
-  }
-  return {
-    id: 'observer-dual-bind',
-    severity: 'error',
-    message: `Observer port ${port} has ${uniquePids.size} distinct processes listening (PIDs: ${[...uniquePids].join(', ')}). One is likely a stale daemon from a previous version. Browser snapshots may route to the wrong instance, causing the panel and the Stop hook to disagree. Fix: stop the older PID (\`kill <pid>\`) and let the SessionStart hook respawn a single daemon.`,
-    detail: listeners.map((l) => ({ file: `pid ${l.pid}`, reason: l.name })),
-    fix: { kind: 'dual-bind', listeners },
-  };
-}
-
-function applyStaleLockfileFix(check) {
-  for (const { file } of check.fix.stale) {
-    try { fs.unlinkSync(file); } catch {}
-  }
-}
-
-const SEVERITY_TAG = {
-  ok:       `${ui.GREEN}✓${ui.RESET}`,
-  info:     `${ui.DIM}·${ui.RESET}`,
-  mismatch: `${ui.YELLOW}!${ui.RESET}`,
-  error:    `${ui.RED}✗${ui.RESET}`,
-};
-
-function printCheck(check) {
-  const tag = SEVERITY_TAG[check.severity] || '?';
-  console.log(`  ${tag} [${check.id}] ${check.message}`);
-  if (check.detail && Array.isArray(check.detail)) {
-    for (const d of check.detail) {
-      console.log(`      ${ui.DIM}- ${d.file} (${d.reason}${d.pid ? `, pid=${d.pid}` : ''})${ui.RESET}`);
-    }
-  }
-}
-
-async function run(argv = []) {
-  const fixMode = argv.includes('--fix');
-  const cwd = process.cwd();
-
-  ui.banner();
-  console.log(`  Diagnosing ${ui.CYAN}${cwd}${ui.RESET}${fixMode ? ` ${ui.YELLOW}(--fix)${ui.RESET}` : ''}`);
-  console.log('');
-
-  const checks = [
-    checkCdpPortMismatch(cwd),
-    checkStaleLockfiles(cwd),
-    checkObserverState(cwd),
-    checkObserverDualBind(cwd),
-  ];
-
-  for (const check of checks) printCheck(check);
-
-  const fixable = checks.filter(c => c.fix);
-  if (fixable.length === 0) {
-    console.log('');
-    console.log(`  ${ui.GREEN}All checks passed.${ui.RESET}`);
-    return 0;
-  }
-
-  if (!fixMode) {
-    console.log('');
-    console.log(`  ${ui.YELLOW}${fixable.length} issue(s) detected.${ui.RESET} Re-run with ${ui.CYAN}claudeflow doctor --fix${ui.RESET} to repair.`);
-    return 1;
-  }
-
-  console.log('');
-  console.log(`  ${ui.CYAN}Applying fixes...${ui.RESET}`);
-  for (const check of fixable) {
-    if (check.id === 'cdp-port') {
-      applyCdpPortFix(check);
-      console.log(`  ${ui.GREEN}✓${ui.RESET} Rewrote .mcp.json playwright --cdp-endpoint → ${check.fix.expected}`);
-      console.log(`      ${ui.YELLOW}Do NOT commit this change${ui.RESET} — the port is local to this machine's path.`);
-      console.log(`      Consider: ${ui.CYAN}git update-index --skip-worktree .mcp.json${ui.RESET}`);
-    } else if (check.id === 'stale-lockfile') {
-      applyStaleLockfileFix(check);
-      console.log(`  ${ui.GREEN}✓${ui.RESET} Removed ${check.fix.stale.length} stale lockfile(s).`);
-    }
-  }
-  console.log('');
-  console.log(`  ${ui.GREEN}Done.${ui.RESET} Reconnect MCP (${ui.CYAN}/mcp${ui.RESET} in Claude Code) to pick up changes.`);
-  return 0;
-}
-
-module.exports = run;
-module.exports.deriveCdpPort = deriveCdpPort;
-module.exports.checkCdpPortMismatch = checkCdpPortMismatch;
-module.exports.checkStaleLockfiles = checkStaleLockfiles;
-module.exports.checkObserverState = checkObserverState;
-module.exports.checkObserverDualBind = checkObserverDualBind;
-module.exports.readObserverState = readObserverState;
-module.exports.readPlaywrightCdpEndpoint = readPlaywrightCdpEndpoint;
-module.exports.applyCdpPortFix = applyCdpPortFix;
-module.exports.applyStaleLockfileFix = applyStaleLockfileFix;