@curdx/flow 2.0.0-beta.14 → 2.0.0-beta.16

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Claude Code Discipline Layer — spec-driven workflow + goal-backward verification + Karpathy 4 principles enforced via gates. Stops Claude from faking \"done\" on non-trivial features.",
-    "version": "2.0.0-beta.14"
+    "version": "2.0.0-beta.16"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "curdx-flow",
-  "version": "2.0.0-beta.14",
+  "version": "2.0.0-beta.16",
   "description": "Claude Code Discipline Layer — spec-driven workflow + goal-backward verification + Karpathy 4 principles enforced via gates. Stops Claude from faking \"done\" on non-trivial features.",
   "author": {
     "name": "wdx",

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to CurDX-Flow will be documented here.
 
 ## [Unreleased]
 
+### Fixed
+
+- `hooks/hooks.json` + `hooks/scripts/inject-karpathy.sh` — migrated the L1 baseline injector from the `InstructionsLoaded` event to `SessionStart` with `matcher: "startup|clear|compact"`. Per the Claude Code hooks docs (code.claude.com/docs/en/hooks), `InstructionsLoaded` is an observability-only event: its hook schema has no `hookSpecificOutput` field, so the injector's `{"hookSpecificOutput":{"hookEventName":"InstructionsLoaded","additionalContext":…}}` payload was rejected at session boot with `Hook JSON output validation failed — (root): Invalid input`, producing the `SessionStart:startup hook error` banner on every Claude Code launch. The `startup|clear|compact` matcher preserves the original "baseline survives compaction" intent. Also updated `docs/architecture.md` and `README.zh.md` hook-event inventories.
+
 ### BREAKING
 
 - **`context7` and `sequential-thinking` moved from plugin-bundled MCPs to user-level MCPs.** Previously `.claude-plugin/plugin.json` declared both in `mcpServers`, so Claude Code auto-registered them as `plugin:curdx-flow:context7` and `plugin:curdx-flow:sequential-thinking` when the plugin installed. This is no longer the case — the `mcpServers` block is gone. Instead, `curdx-flow install` now runs `claude mcp add context7 …` + `claude mcp add sequential-thinking …` against the user's `~/.claude.json`, which keeps them as standard user-level registrations named `context7` and `sequential-thinking`.

package/README.zh.md

@@ -23,7 +23,7 @@ CurDX-Flow 是一个 Claude Code 插件，把 6 个验证过的 AI 工程工作
 - **8 个可组合 Gate** — Karpathy / Verification / TDD / Coverage / Adversarial / Edge-Case / Security / DevEx
 - **4 种执行策略** — linear / subagent / stop-hook / wave（自动路由）
 - **10 个知识文档** — 规格驱动 / POC-First / 原子提交 / 执行策略 / ...
-- **4 个 hook 事件** — SessionStart / InstructionsLoaded / Stop / PreToolUse
+- **3 个 hook 事件** — SessionStart / Stop / PreToolUse
 - **2 个自动安装的 MCP + 1 个推荐插件** — context7 / sequential-thinking（plugin.json 内置）+ chrome-devtools-mcp（recommended，beta.8 解耦）
 - **优雅降级** — 依赖缺失时进入 fallback 模式并清晰告知
 

package/cli/install.js

@@ -58,6 +58,15 @@ export async function install(args = []) {
   }
   log.ok(`claude CLI found (${ver})`);
 
+  // Snapshot curdx-flow's pre-install version BEFORE Step 2 touches the
+  // marketplace. Step 2 does `claude plugin marketplace remove` + `add` to
+  // rebind to the current source, and the remove side-effect also drops
+  // any plugins installed from that marketplace. If we only call
+  // listPlugins() in Step 3, curdx-flow is already gone from the list and
+  // we can't tell a fresh install apart from an upgrade — the Step 3
+  // output then incorrectly says "installed" for both cases.
+  const prevCurdxFlow = listPlugins().find((p) => p.name === "curdx-flow");
+
   // ---------- Step 2: Add marketplace ----------
   log.blank();
   const marketplaceSource = useOffline ? PKG_ROOT : "curdx/curdx-flow";
@@ -105,25 +114,51 @@ export async function install(args = []) {
     // marketplace not local (online install) or unreadable — fall through
   }
 
-  const installed = listPlugins();
-  const already = installed.find((p) => p.name === "curdx-flow");
-  if (already && shippedVersion && already.version !== shippedVersion) {
+  // Use the pre-Step-2 snapshot — by this point `claude plugin marketplace
+  // remove` has already evicted the plugin, so listPlugins() here would
+  // always return undefined for curdx-flow and we'd mis-report "installed"
+  // when we actually upgraded (the bug reported by @wdx's beta.14 log).
+  const already = prevCurdxFlow;
+
+  if (already && shippedVersion && already.version === shippedVersion) {
+    // Already on the exact version the tarball ships — no re-install needed.
+    // `claude plugin install` would succeed too but the fresh-install output
+    // is misleading here.
+    log.ok(
+      `curdx-flow already at v${already.version} ${color.dim("(no change)")}`
+    );
+  } else if (already && shippedVersion) {
+    // Existing install, different version — frame as an upgrade.
     log.info(
-      `curdx-flow installed at v${already.version}, marketplace ships v${shippedVersion} — updating...`
+      `curdx-flow v${already.version} → v${shippedVersion}, installing...`
     );
     const r = await run(
       "claude",
-      ["plugin", "update", "curdx-flow@curdx-flow-marketplace"],
+      ["plugin", "install", "curdx-flow@curdx-flow-marketplace"],
       { silent: true }
     );
     if (r.code !== 0) {
-      log.warn(`Update returned non-zero: ${r.stderr.trim() || r.stdout.trim()}`);
-      log.info(`If the version stays on v${already.version}, run: claude plugin uninstall curdx-flow@curdx-flow-marketplace && retry`);
-    } else {
-      log.ok(`curdx-flow updated to v${shippedVersion}`);
+      log.err(`Install failed: ${r.stderr.trim() || r.stdout.trim()}`);
+      process.exit(1);
     }
+    log.ok(`curdx-flow upgraded to v${shippedVersion}`);
   } else if (already) {
-    log.ok(`curdx-flow already installed (v${already.version}, ${already.status})`);
+    // shippedVersion unknown (e.g. online install) — best we can do is report
+    // the previous version and let `claude plugin install` idempotently
+    // re-register.
+    log.info(
+      `curdx-flow v${already.version} detected, re-registering...`
+    );
+    const r = await run(
+      "claude",
+      ["plugin", "install", "curdx-flow@curdx-flow-marketplace"],
+      { silent: true }
+    );
+    if (r.code !== 0) {
+      log.err(`Install failed: ${r.stderr.trim() || r.stdout.trim()}`);
+      process.exit(1);
+    }
+    log.ok(`curdx-flow re-registered`);
   } else {
     const r = await run(
       "claude",
@@ -134,7 +169,11 @@ export async function install(args = []) {
       log.err(`Install failed: ${r.stderr.trim() || r.stdout.trim()}`);
       process.exit(1);
     }
-    log.ok("curdx-flow installed");
+    if (shippedVersion) {
+      log.ok(`curdx-flow v${shippedVersion} installed`);
+    } else {
+      log.ok("curdx-flow installed");
+    }
   }
 
   // ---------- Step 3.5: Register user-level MCPs (context7, sequential-thinking) ----------

package/hooks/hooks.json

@@ -8,10 +8,9 @@
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/session-start.sh"
           }
         ]
-      }
-    ],
-    "InstructionsLoaded": [
+      },
       {
+        "matcher": "startup|clear|compact",
         "hooks": [
           {
             "type": "command",

package/hooks/scripts/inject-karpathy.sh

@@ -1,10 +1,13 @@
 #!/usr/bin/env bash
-# CurDX-Flow InstructionsLoaded Hook
+# CurDX-Flow SessionStart baseline injection
 # Injects the L1 baseline (Karpathy 4 principles + mandatory tool rules + 3 red lines)
-# into every session after CLAUDE.md is loaded.
+# as additionalContext at every session boot (startup, /clear, post-compact).
 #
-# This is what makes the baseline "always on" — it doesn't rely on CLAUDE.md being
-# present in every project, and it survives context compaction.
+# Wired under SessionStart rather than InstructionsLoaded because Claude Code's
+# InstructionsLoaded event is observability-only — its hook schema rejects
+# hookSpecificOutput / additionalContext. SessionStart with matcher
+# "startup|clear|compact" gives the same "baseline is always on, even after
+# compaction" property while staying within the supported schema.
 
 set -u
 
@@ -46,7 +49,7 @@ CONTEXT='## CurDX-Flow Mind Baseline (L1 — always on)
 # Emit JSON with safe encoding
 if command -v python3 >/dev/null 2>&1; then
   ESCAPED="$(printf '%s' "$CONTEXT" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')"
-  printf '{"hookSpecificOutput":{"hookEventName":"InstructionsLoaded","additionalContext":%s}}\n' "$ESCAPED"
+  printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":%s}}\n' "$ESCAPED"
 fi
 
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curdx/flow",
-  "version": "2.0.0-beta.14",
+  "version": "2.0.0-beta.16",
   "description": "CLI installer for CurDX-Flow — AI engineering workflow meta-framework for Claude Code",
   "type": "module",
   "bin": {