@axiomatic-labs/claudeflow 2.43.31 → 2.43.33

package/lib/install.js

@@ -102,70 +102,102 @@ function syncClaudeMd(cwd, snippetPath) {
 // Place + merge the framework from an extracted payload dir into a project. Pure filesystem, no network —
 // so it is testable on a throwaway dir.
 function installFromPayload(src, cwd) {
-  const out = { playbooks: 0, scripts: 0, skills: 0, agents: 0, claudeMd: false };
+  const out = { playbooks: 0, scripts: 0, skills: 0, agents: 0, claudeMd: false, failed: [] };
+  // Each placement step is ISOLATED: a failure in one (a copy error, a permission hiccup, a weird file in the
+  // user's tree) must NOT abort the rest — above all it must not skip the settings/env + CLAUDE.md config, the
+  // two steps a user most needs (the env block wires agent-teams + the autocompact window, etc.). Before this,
+  // any throw in steps 1–4 silently left settings/CLAUDE.md unconfigured. Each step records its name on failure
+  // so `run()` can warn instead of reporting a clean success over a partial install.
+  const step = (name, fn) => { try { fn(); } catch { out.failed.push(name); } };
 
   // 1) Playbooks — always refreshed (shared system).
-  const srcPlaybooks = path.join(src, '.claudeflow', 'playbooks');
-  if (fs.existsSync(srcPlaybooks)) {
-    const dst = path.join(cwd, '.claudeflow', 'playbooks');
-    rmrf(dst); copyDir(srcPlaybooks, dst);
-    out.playbooks = countFiles(dst);
-  }
+  step('playbooks', () => {
+    const srcPlaybooks = path.join(src, '.claudeflow', 'playbooks');
+    if (fs.existsSync(srcPlaybooks)) {
+      const dst = path.join(cwd, '.claudeflow', 'playbooks');
+      rmrf(dst); copyDir(srcPlaybooks, dst);
+      out.playbooks = countFiles(dst);
+    }
+  });
 
   // 2) Configs — per-project ones create-if-absent (never clobber a customized brand); shared refresh.
-  fs.mkdirSync(path.join(cwd, '.claudeflow'), { recursive: true });
-  for (const c of PER_PROJECT_CONFIGS) {
-    const s = path.join(src, '.claudeflow', c), d = path.join(cwd, '.claudeflow', c);
-    if (fs.existsSync(s) && !fs.existsSync(d)) fs.copyFileSync(s, d);
-  }
-  for (const c of SHARED_CONFIGS) {
-    const s = path.join(src, '.claudeflow', c);
-    if (fs.existsSync(s)) fs.copyFileSync(s, path.join(cwd, '.claudeflow', c));
-  }
+  step('configs', () => {
+    fs.mkdirSync(path.join(cwd, '.claudeflow'), { recursive: true });
+    for (const c of PER_PROJECT_CONFIGS) {
+      const s = path.join(src, '.claudeflow', c), d = path.join(cwd, '.claudeflow', c);
+      if (fs.existsSync(s) && !fs.existsSync(d)) fs.copyFileSync(s, d);
+    }
+    for (const c of SHARED_CONFIGS) {
+      const s = path.join(src, '.claudeflow', c);
+      if (fs.existsSync(s)) fs.copyFileSync(s, path.join(cwd, '.claudeflow', c));
+    }
+  });
 
-  // 3) Scripts (hooks + scans + servers) — always refreshed.
-  const srcScripts = path.join(src, 'scripts', 'claudeflow');
-  if (fs.existsSync(srcScripts)) {
-    const dst = path.join(cwd, 'scripts', 'claudeflow');
-    fs.mkdirSync(dst, { recursive: true });
-    for (const e of fs.readdirSync(srcScripts)) { fs.copyFileSync(path.join(srcScripts, e), path.join(dst, e)); out.scripts++; }
-  }
+  // 3) Scripts (hooks + scans + servers) — always refreshed. Per-file isolation so ONE bad file (a socket, a
+  //    permission denial) can't abort the whole copy — let alone the later settings/CLAUDE.md steps.
+  step('scripts', () => {
+    const srcScripts = path.join(src, 'scripts', 'claudeflow');
+    if (fs.existsSync(srcScripts)) {
+      const dst = path.join(cwd, 'scripts', 'claudeflow');
+      fs.mkdirSync(dst, { recursive: true });
+      for (const e of fs.readdirSync(srcScripts)) {
+        try { fs.copyFileSync(path.join(srcScripts, e), path.join(dst, e)); out.scripts++; } catch {}
+      }
+    }
+  });
 
   // 4) Skills — replace each shipped claudeflow-* skill; preserve the user's own skills.
-  const srcSkills = path.join(src, '.claude', 'skills');
-  if (fs.existsSync(srcSkills)) {
-    const dst = path.join(cwd, '.claude', 'skills');
-    fs.mkdirSync(dst, { recursive: true });
-    for (const e of fs.readdirSync(srcSkills, { withFileTypes: true })) {
-      if (!e.isDirectory() || !e.name.startsWith('claudeflow-')) continue;
-      const d = path.join(dst, e.name);
-      rmrf(d); copyDir(path.join(srcSkills, e.name), d); out.skills++;
+  step('skills', () => {
+    const srcSkills = path.join(src, '.claude', 'skills');
+    if (fs.existsSync(srcSkills)) {
+      const dst = path.join(cwd, '.claude', 'skills');
+      fs.mkdirSync(dst, { recursive: true });
+      for (const e of fs.readdirSync(srcSkills, { withFileTypes: true })) {
+        if (!e.isDirectory() || !e.name.startsWith('claudeflow-')) continue;
+        const d = path.join(dst, e.name);
+        try { rmrf(d); copyDir(path.join(srcSkills, e.name), d); out.skills++; } catch {}
+      }
     }
-  }
+  });
 
   // 4b) Agents — replace each shipped claudeflow-* agent; preserve the user's own agents.
-  const srcAgents = path.join(src, '.claude', 'agents');
-  if (fs.existsSync(srcAgents)) {
-    const dst = path.join(cwd, '.claude', 'agents');
-    fs.mkdirSync(dst, { recursive: true });
-    for (const e of fs.readdirSync(srcAgents, { withFileTypes: true })) {
-      if (!e.isFile() || !e.name.startsWith('claudeflow-') || !e.name.endsWith('.md')) continue;
-      fs.copyFileSync(path.join(srcAgents, e.name), path.join(dst, e.name)); out.agents++;
+  step('agents', () => {
+    const srcAgents = path.join(src, '.claude', 'agents');
+    if (fs.existsSync(srcAgents)) {
+      const dst = path.join(cwd, '.claude', 'agents');
+      fs.mkdirSync(dst, { recursive: true });
+      for (const e of fs.readdirSync(srcAgents, { withFileTypes: true })) {
+        if (!e.isFile() || !e.name.startsWith('claudeflow-') || !e.name.endsWith('.md')) continue;
+        try { fs.copyFileSync(path.join(srcAgents, e.name), path.join(dst, e.name)); out.agents++; } catch {}
+      }
     }
-  }
+  });
 
-  // 5) settings.json hooks — MERGE (never clobber the user's settings).
-  const srcSettings = path.join(src, '.claude', 'settings.json');
-  if (fs.existsSync(srcSettings)) {
-    try { mergeSettings(cwd, JSON.parse(fs.readFileSync(srcSettings, 'utf8'))); } catch {}
-  }
+  // 5) settings.json — MERGE the shipped hooks + env (add-if-absent) into the user's settings (never clobber).
+  //    ALWAYS runs (isolated above) — this is what wires CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS et al.
+  step('settings', () => {
+    const srcSettings = path.join(src, '.claude', 'settings.json');
+    if (fs.existsSync(srcSettings)) {
+      mergeSettings(cwd, JSON.parse(fs.readFileSync(srcSettings, 'utf8')));
+    }
+  });
 
   // 6) CLAUDE.md — upsert the managed guidance block between markers (idempotent; updates propagate on re-install).
-  out.claudeMd = syncClaudeMd(cwd, path.join(src, 'assets', 'CLAUDE.snippet.md'));
+  step('claude-md', () => {
+    out.claudeMd = syncClaudeMd(cwd, path.join(src, 'assets', 'CLAUDE.snippet.md'));
+  });
 
   return out;
 }
 
+// `a < b` for `x.y.z` versions (numeric, missing parts = 0). Used to detect a STALE npx-cached CLI.
+function semverLt(a, b) {
+  const pa = String(a).split('.').map(n => parseInt(n, 10) || 0);
+  const pb = String(b).split('.').map(n => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) { if ((pa[i] || 0) < (pb[i] || 0)) return true; if ((pa[i] || 0) > (pb[i] || 0)) return false; }
+  return false;
+}
+
 async function run() {
   const current = readLocalVersion();
   ui.banner(current || undefined);
@@ -181,6 +213,24 @@ async function run() {
   const version = (release.tag_name || '').replace(/^v/, '')
     || asset.name.replace(/^claudeflow-?v?/, '').replace(/\.zip$/, '');
 
+  // STALE-npx-CACHE GUARD. This CLI binary is whatever npx ran — and `npx <pkg> install` (no @version) will
+  // happily REUSE a cached OLD CLI without checking npm for a newer one. An old CLI still downloads the fresh
+  // release ZIP (so hooks/playbooks/scripts update — looks like it worked) but its `mergeSettings` predates
+  // newer placement logic (e.g. the `env` block merge added after v2.42.0), so config like the agent-teams env
+  // vars is SILENTLY skipped — hooks land, env never does. If this CLI's own version is OLDER than the release
+  // it's installing, that's exactly the stale-cache case → make it LOUD (the old CLI itself can't, but once a
+  // user is on a guarded version this catches every future recurrence).
+  let staleCli = false;
+  try {
+    const cliVersion = require('../package.json').version;
+    staleCli = semverLt(cliVersion, version);
+    if (staleCli) {
+      ui.warn(`Stale CLI: npx is running a CACHED v${cliVersion} but the latest release is v${version}.`);
+      ui.warn(`  An old CLI updates hooks but can SKIP config (the agent-teams env vars, etc.). To install with`);
+      ui.warn(`  the matching CLI: ${ui.BOLD}npx @axiomatic-labs/claudeflow@latest install${ui.RESET}  (or clear the npx cache: ${ui.BOLD}npx clear-npx-cache${ui.RESET}).`);
+    }
+  } catch {}
+
   ui.step(`Downloading ${asset.name}...`);
   const zipBuffer = await downloadReleaseAsset(asset, token);
 
@@ -200,6 +250,9 @@ async function run() {
   ui.success(`claudeflow v${version} installed`);
   ui.info(`  ${summary.playbooks} playbooks · ${summary.scripts} scripts · ${summary.skills} skills`
     + (summary.claudeMd ? ' · CLAUDE.md guidance synced' : ''));
+  if (summary.failed && summary.failed.length) {
+    ui.warn(`  some steps did not complete: ${summary.failed.join(', ')}. Re-run \`npx @axiomatic-labs/claudeflow@latest install\` (the @latest avoids a stale npx cache).`);
+  }
   ui.done(`Describe a change and the ${ui.BOLD}claudeflow-implementer${ui.RESET} agent will build it.`);
 }
 

package/lib/version.js

@@ -31,7 +31,7 @@ async function run() {
   if (local) {
     ui.info(`Installed:   ${local}`);
   } else {
-    ui.warn('Not installed. Run: npx @axiomatic-labs/claudeflow install');
+    ui.warn('Not installed. Run: npx @axiomatic-labs/claudeflow@latest install');
   }
 
   const token = getGitHubToken();
@@ -50,7 +50,7 @@ async function run() {
     if (local && local === latest) {
       ui.success('Up to date.');
     } else if (local) {
-      ui.warn('Update available. Run: npx @axiomatic-labs/claudeflow install');
+      ui.warn('Update available. Run: npx @axiomatic-labs/claudeflow@latest install  (the @latest avoids a stale npx cache)');
     }
   } catch (err) {
     ui.error(`Could not fetch latest release: ${err.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.43.31",
+  "version": "2.43.33",
   "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"