@axiomatic-labs/claudeflow 2.43.32 → 2.43.34

package/lib/install.js

@@ -190,6 +190,14 @@ function installFromPayload(src, cwd) {
   return out;
 }
 
+// `a < b` for `x.y.z` versions (numeric, missing parts = 0). Used to detect a STALE npx-cached CLI.
+function semverLt(a, b) {
+  const pa = String(a).split('.').map(n => parseInt(n, 10) || 0);
+  const pb = String(b).split('.').map(n => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) { if ((pa[i] || 0) < (pb[i] || 0)) return true; if ((pa[i] || 0) > (pb[i] || 0)) return false; }
+  return false;
+}
+
 async function run() {
   const current = readLocalVersion();
   ui.banner(current || undefined);
@@ -205,6 +213,24 @@ async function run() {
   const version = (release.tag_name || '').replace(/^v/, '')
     || asset.name.replace(/^claudeflow-?v?/, '').replace(/\.zip$/, '');
 
+  // STALE-npx-CACHE GUARD. This CLI binary is whatever npx ran — and `npx <pkg> install` (no @version) will
+  // happily REUSE a cached OLD CLI without checking npm for a newer one. An old CLI still downloads the fresh
+  // release ZIP (so hooks/playbooks/scripts update — looks like it worked) but its `mergeSettings` predates
+  // newer placement logic (e.g. the `env` block merge added after v2.42.0), so config like the agent-teams env
+  // vars is SILENTLY skipped — hooks land, env never does. If this CLI's own version is OLDER than the release
+  // it's installing, that's exactly the stale-cache case → make it LOUD (the old CLI itself can't, but once a
+  // user is on a guarded version this catches every future recurrence).
+  let staleCli = false;
+  try {
+    const cliVersion = require('../package.json').version;
+    staleCli = semverLt(cliVersion, version);
+    if (staleCli) {
+      ui.warn(`Stale CLI: npx is running a CACHED v${cliVersion} but the latest release is v${version}.`);
+      ui.warn(`  An old CLI updates hooks but can SKIP config (the agent-teams env vars, etc.). To install with`);
+      ui.warn(`  the matching CLI: ${ui.BOLD}npx @axiomatic-labs/claudeflow@latest install${ui.RESET}  (or clear the npx cache: ${ui.BOLD}npx clear-npx-cache${ui.RESET}).`);
+    }
+  } catch {}
+
   ui.step(`Downloading ${asset.name}...`);
   const zipBuffer = await downloadReleaseAsset(asset, token);
 

package/lib/version.js

@@ -31,7 +31,7 @@ async function run() {
   if (local) {
     ui.info(`Installed:   ${local}`);
   } else {
-    ui.warn('Not installed. Run: npx @axiomatic-labs/claudeflow install');
+    ui.warn('Not installed. Run: npx @axiomatic-labs/claudeflow@latest install');
   }
 
   const token = getGitHubToken();
@@ -50,7 +50,7 @@ async function run() {
     if (local && local === latest) {
       ui.success('Up to date.');
     } else if (local) {
-      ui.warn('Update available. Run: npx @axiomatic-labs/claudeflow install');
+      ui.warn('Update available. Run: npx @axiomatic-labs/claudeflow@latest install  (the @latest avoids a stale npx cache)');
     }
   } catch (err) {
     ui.error(`Could not fetch latest release: ${err.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiomatic-labs/claudeflow",
-  "version": "2.43.32",
+  "version": "2.43.34",
   "description": "Claudeflow — AI-powered development toolkit for Claude Code. Skills, agents, hooks, and quality gates that ship production apps.",
   "bin": {
     "claudeflow": "./bin/cli.js"