@curdx/flow 2.2.0 → 2.2.4

package/cli/uninstall-actions.js

@@ -0,0 +1,323 @@
+import { existsSync, lstatSync, unlinkSync, rmSync, readlinkSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+import { REQUIRED_PLUGINS, RECOMMENDED_PLUGINS, BUNDLED_MCPS } from "./registry.js";
+import {
+  removeMcp,
+  removePluginMarketplace,
+  uninstallPlugin,
+} from "./lib/claude-ops.js";
+import {
+  confirm,
+  color,
+  listPlugins,
+  log,
+  resultLastLine,
+  resultOutput,
+} from "./utils.js";
+import {
+  UNINSTALL_STEP_COUNT,
+  getInstalledTargets,
+  getManagedMarketplaceIds,
+  selectRecommendedPluginsToRemove,
+  shouldKeepBundledMcps,
+  shouldKeepRequiredPlugins,
+} from "./uninstall-workflow.js";
+
+const HOME = homedir();
+
+const RECOMMENDED = RECOMMENDED_PLUGINS.map(toUninstallTarget);
+const REQUIRED = REQUIRED_PLUGINS.map(toUninstallTarget);
+
+// Symlinks created by install.js (only cleaned with --purge)
+const MANAGED_SYMLINKS = [
+  join(HOME, ".local", "bin", "bun"),
+  join(HOME, ".local", "bin", "uv"),
+];
+
+export async function uninstallCurdxFlowPlugin(
+  {
+    listPluginsImpl = listPlugins,
+    uninstallPluginImpl = uninstallPlugin,
+    logImpl = log,
+    resultOutputImpl = resultOutput,
+  } = {}
+) {
+  logImpl.blank();
+  logImpl.step(1, UNINSTALL_STEP_COUNT, "Uninstalling curdx-flow plugin...");
+  const curdx = listPluginsImpl().find((plugin) => plugin.name === "curdx-flow");
+  if (!curdx) {
+    logImpl.info("curdx-flow not installed, skipping");
+    return;
+  }
+
+  const result = await uninstallPluginImpl({
+    scope: "user",
+    uninstallSpec: "curdx-flow@curdx-flow-marketplace",
+  });
+  if (result.code === 0) {
+    logImpl.ok("curdx-flow uninstalled");
+    return;
+  }
+
+  logImpl.err(`Uninstall failed: ${resultOutputImpl(result)}`);
+}
+
+export async function maybeUninstallRecommendedPlugins(
+  { yes, keepRecommended },
+  {
+    getInstalledTargetsImpl = getInstalledTargets,
+    selectRecommendedPluginsToRemoveImpl = selectRecommendedPluginsToRemove,
+    uninstallNamedPluginImpl = uninstallNamedPlugin,
+    logImpl = log,
+  } = {}
+) {
+  logImpl.blank();
+  logImpl.step(2, UNINSTALL_STEP_COUNT, "Recommended plugins");
+  if (keepRecommended) {
+    logImpl.info("Keeping recommended plugins (--keep-recommended)");
+    return;
+  }
+
+  const present = getInstalledTargetsImpl(RECOMMENDED);
+  if (present.length === 0) {
+    logImpl.info("No installed recommended plugins");
+    return;
+  }
+
+  const selected = await selectRecommendedPluginsToRemoveImpl({ yes, present });
+  for (const name of selected) {
+    const entry = present.find((plugin) => plugin.name === name);
+    if (!entry) continue;
+    await uninstallNamedPluginImpl(entry);
+  }
+}
+
+export async function uninstallNamedPlugin(
+  entry,
+  {
+    uninstallPluginImpl = uninstallPlugin,
+    resultLastLineImpl = resultLastLine,
+  } = {}
+) {
+  log.blank();
+  console.log(`  ${color.cyan("▸")} Uninstalling ${color.bold(entry.name)}...`);
+  const result = await uninstallPluginImpl(entry);
+  if (result.code === 0) {
+    console.log(`  ${color.green("✓")} ${entry.name} uninstalled`);
+    return;
+  }
+
+  console.log(
+    `  ${color.red("✗")} ${entry.name} uninstall failed: ${resultLastLineImpl(result)}`
+  );
+}
+
+export async function maybeRemoveBundledMcps(
+  { yes, keepRecommended },
+  {
+    shouldKeepBundledMcpsImpl = shouldKeepBundledMcps,
+    confirmImpl = confirm,
+    removeMcpImpl = removeMcp,
+    logImpl = log,
+  } = {}
+) {
+  logImpl.blank();
+  logImpl.info("Required MCP servers (context7, sequential-thinking)");
+  if (shouldKeepBundledMcpsImpl({ yes, keepRecommended })) {
+    logImpl.info(
+      color.dim("--yes or --keep-recommended: keeping user-level MCPs (remove manually with `claude mcp remove <name>`)")
+    );
+    return;
+  }
+
+  const removeMcps = await confirmImpl(
+    `Remove user-level MCPs registered by install (${BUNDLED_MCPS.map((mcp) => mcp.name).join(", ")})? ${color.dim("(keeps them if other tools depend on them)")}`,
+    false
+  );
+  if (!removeMcps) {
+    logImpl.info("Keeping user-level MCPs");
+    return;
+  }
+
+  for (const mcp of BUNDLED_MCPS) {
+    const result = await removeMcpImpl({ name: mcp.name });
+    if (result.code === 0) {
+      logImpl.ok(`  ${mcp.name.padEnd(22)} removed`);
+    } else {
+      logImpl.info(`  ${mcp.name.padEnd(22)} ${color.dim("not present or already removed")}`);
+    }
+  }
+}
+
+export async function maybeUninstallRequiredPlugins(
+  { yes },
+  {
+    shouldKeepRequiredPluginsImpl = shouldKeepRequiredPlugins,
+    confirmImpl = confirm,
+    uninstallPluginImpl = uninstallPlugin,
+    logImpl = log,
+  } = {}
+) {
+  logImpl.blank();
+  logImpl.info("Required companion plugins");
+  if (shouldKeepRequiredPluginsImpl({ yes })) {
+    logImpl.info(
+      color.dim("--yes mode: keeping required companion plugins (use --purge to remove them)")
+    );
+    return;
+  }
+
+  const removeRequired = await confirmImpl(
+    `Remove required companion plugins (${REQUIRED.map((plugin) => plugin.name).join(", ")})? ${color.dim("(keeps shared tools available if other workflows depend on them)")}`,
+    false
+  );
+  if (!removeRequired) {
+    logImpl.info("Keeping required companion plugins");
+    return;
+  }
+
+  for (const plugin of REQUIRED) {
+    const result = await uninstallPluginImpl(plugin);
+    if (result.code === 0) {
+      logImpl.ok(`  ${plugin.name.padEnd(22)} uninstalled`);
+    } else {
+      logImpl.info(`  ${plugin.name.padEnd(22)} ${color.dim("not present or already removed")}`);
+    }
+  }
+}
+
+export async function maybePurgeRuntimeArtifacts(
+  { purge },
+  {
+    purgeManagedMarketplacesImpl = purgeManagedMarketplaces,
+    removeManagedSymlinksImpl = removeManagedSymlinks,
+    logImpl = log,
+  } = {}
+) {
+  logImpl.blank();
+  logImpl.step(3, UNINSTALL_STEP_COUNT, "Runtime symlinks and marketplaces");
+  if (!purge) {
+    logImpl.info(
+      color.dim("Keeping ~/.local/bin/bun, ~/.local/bin/uv (use --purge to remove)")
+    );
+    logImpl.info(
+      color.dim("Reason: these bun/uv binaries may be used by other tools — confirm before deleting")
+    );
+    return;
+  }
+
+  await purgeManagedMarketplacesImpl();
+  removeManagedSymlinksImpl();
+}
+
+export async function maybeRemoveProjectState(
+  { yes },
+  {
+    cwd = process.cwd(),
+    confirmImpl = confirm,
+    existsSyncImpl = existsSync,
+    rmSyncImpl = rmSync,
+    logImpl = log,
+  } = {}
+) {
+  logImpl.blank();
+  logImpl.step(4, UNINSTALL_STEP_COUNT, "Project state directory");
+  const flowDir = join(cwd, ".flow");
+  if (!existsSyncImpl(flowDir)) {
+    logImpl.info(".flow/ does not exist, skipping");
+    return;
+  }
+
+  if (yes) {
+    logImpl.info(
+      color.dim("--yes mode: keeping .flow/ (contains specs & decisions — confirm by hand before deleting)")
+    );
+    return;
+  }
+
+  const ok = await confirmImpl(
+    `${color.red("DANGER:")} delete the ${color.bold(".flow/")} directory of the current project? ${color.dim("(includes all specs / decisions, not recoverable)")}`,
+    false
+  );
+  if (!ok) {
+    logImpl.info("Keeping .flow/");
+    return;
+  }
+
+  try {
+    rmSyncImpl(flowDir, { recursive: true, force: true });
+    logImpl.ok(`Removed ${flowDir}`);
+  } catch (err) {
+    logImpl.err(`Removal failed: ${err.message}`);
+  }
+}
+
+async function purgeManagedMarketplaces(
+  {
+    getManagedMarketplaceIdsImpl = getManagedMarketplaceIds,
+    removePluginMarketplaceImpl = removePluginMarketplace,
+    logImpl = log,
+  } = {}
+) {
+  const marketplaceIds = getManagedMarketplaceIdsImpl(RECOMMENDED.concat(REQUIRED));
+
+  for (const marketplaceId of marketplaceIds) {
+    const result = await removePluginMarketplaceImpl(marketplaceId);
+    if (result.code === 0) {
+      logImpl.ok(`Removed marketplace ${marketplaceId}`);
+    } else if (!result.stderr.includes("not found")) {
+      logImpl.warn(`Failed to remove marketplace ${marketplaceId}: ${resultLastLine(result)}`);
+    }
+  }
+}
+
+function removeManagedSymlinks(
+  {
+    existsSyncImpl = existsSync,
+    isBrokenSymlinkImpl = isBrokenSymlink,
+    lstatSyncImpl = lstatSync,
+    readlinkSyncImpl = readlinkSync,
+    unlinkSyncImpl = unlinkSync,
+    logImpl = log,
+  } = {}
+) {
+  for (const link of MANAGED_SYMLINKS) {
+    if (!existsSyncImpl(link) && !isBrokenSymlinkImpl(link)) {
+      continue;
+    }
+    try {
+      const stat = lstatSyncImpl(link);
+      if (!stat.isSymbolicLink()) {
+        logImpl.warn(
+          `${link} is not a symlink (likely a real file placed by the user), skipping`
+        );
+        continue;
+      }
+      const target = readlinkSyncImpl(link);
+      unlinkSyncImpl(link);
+      logImpl.ok(`Removed symlink ${link} ${color.dim(`(was → ${target})`)}`);
+    } catch (err) {
+      logImpl.warn(`Failed to remove ${link}: ${err.message}`);
+    }
+  }
+}
+
+function toUninstallTarget(entry) {
+  return {
+    name: entry.name,
+    uninstallSpec: entry.uninstallSpec,
+    uninstallArgs: entry.uninstallArgs || [],
+    marketplaceId: entry.marketplaceId,
+    scope: entry.scope,
+  };
+}
+
+function isBrokenSymlink(pathname) {
+  try {
+    return lstatSync(pathname).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}

package/cli/uninstall.js

@@ -2,48 +2,22 @@
  * uninstall command — remove curdx-flow plugin (and optionally recommended plugins / artifacts).
  */
 
-import { existsSync, lstatSync, unlinkSync, rmSync, readlinkSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-
-import {
-  color,
-  log,
-  resultLastLine,
-  resultOutput,
-  confirm,
-  listPlugins,
-} from "./utils.js";
-import { REQUIRED_PLUGINS, RECOMMENDED_PLUGINS, BUNDLED_MCPS } from "./registry.js";
-import {
-  removeMcp,
-  removePluginMarketplace,
-  uninstallPlugin,
-} from "./lib/claude-ops.js";
+import { log } from "./utils.js";
 import {
   createUninstallContext,
   ensureClaudeCliAvailableForUninstall,
-  getInstalledTargets,
-  getManagedMarketplaceIds,
   printUninstallSummary,
   removeProtocolsStep,
-  selectRecommendedPluginsToRemove,
-  shouldKeepBundledMcps,
-  shouldKeepRequiredPlugins,
-  UNINSTALL_STEP_COUNT,
   confirmUninstallStep,
 } from "./uninstall-workflow.js";
-
-const HOME = homedir();
-
-const RECOMMENDED = RECOMMENDED_PLUGINS.map(toUninstallTarget);
-const REQUIRED = REQUIRED_PLUGINS.map(toUninstallTarget);
-
-// Symlinks created by install.js (only cleaned with --purge)
-const MANAGED_SYMLINKS = [
-  join(HOME, ".local", "bin", "bun"),
-  join(HOME, ".local", "bin", "uv"),
-];
+import {
+  maybePurgeRuntimeArtifacts,
+  maybeRemoveBundledMcps,
+  maybeRemoveProjectState,
+  maybeUninstallRecommendedPlugins,
+  maybeUninstallRequiredPlugins,
+  uninstallCurdxFlowPlugin,
+} from "./uninstall-actions.js";
 
 export async function uninstall(args = []) {
   const context = createUninstallContext(args);
@@ -66,221 +40,3 @@ export async function uninstall(args = []) {
 
   printUninstallSummary(context);
 }
-
-async function uninstallCurdxFlowPlugin() {
-  log.blank();
-  log.step(1, UNINSTALL_STEP_COUNT, "Uninstalling curdx-flow plugin...");
-  const curdx = listPlugins().find((plugin) => plugin.name === "curdx-flow");
-  if (!curdx) {
-    log.info("curdx-flow not installed, skipping");
-    return;
-  }
-
-  const result = await uninstallPlugin({
-    scope: "user",
-    uninstallSpec: "curdx-flow@curdx-flow-marketplace",
-  });
-  if (result.code === 0) {
-    log.ok("curdx-flow uninstalled");
-    return;
-  }
-
-  log.err(`Uninstall failed: ${resultOutput(result)}`);
-}
-
-async function maybeUninstallRecommendedPlugins({ yes, keepRecommended }) {
-  log.blank();
-  log.step(2, UNINSTALL_STEP_COUNT, "Recommended plugins");
-  if (keepRecommended) {
-    log.info("Keeping recommended plugins (--keep-recommended)");
-    return;
-  }
-
-  const present = getInstalledTargets(RECOMMENDED);
-  if (present.length === 0) {
-    log.info("No installed recommended plugins");
-    return;
-  }
-
-  const selected = await selectRecommendedPluginsToRemove({ yes, present });
-  for (const name of selected) {
-    const entry = present.find((plugin) => plugin.name === name);
-    if (!entry) continue;
-    await uninstallNamedPlugin(entry);
-  }
-}
-
-async function uninstallNamedPlugin(entry) {
-  log.blank();
-  console.log(`  ${color.cyan("▸")} Uninstalling ${color.bold(entry.name)}...`);
-  const result = await uninstallPlugin(entry);
-  if (result.code === 0) {
-    console.log(`  ${color.green("✓")} ${entry.name} uninstalled`);
-    return;
-  }
-
-  console.log(
-    `  ${color.red("✗")} ${entry.name} uninstall failed: ${resultLastLine(result)}`
-  );
-}
-
-async function maybeRemoveBundledMcps({ yes, keepRecommended }) {
-  log.blank();
-  log.info("Required MCP servers (context7, sequential-thinking)");
-  if (shouldKeepBundledMcps({ yes, keepRecommended })) {
-    log.info(
-      color.dim("--yes or --keep-recommended: keeping user-level MCPs (remove manually with `claude mcp remove <name>`)")
-    );
-    return;
-  }
-
-  const removeMcps = await confirm(
-    `Remove user-level MCPs registered by install (${BUNDLED_MCPS.map((mcp) => mcp.name).join(", ")})? ${color.dim("(keeps them if other tools depend on them)")}`,
-    false
-  );
-  if (!removeMcps) {
-    log.info("Keeping user-level MCPs");
-    return;
-  }
-
-  for (const mcp of BUNDLED_MCPS) {
-    const result = await removeMcp({ name: mcp.name });
-    if (result.code === 0) {
-      log.ok(`  ${mcp.name.padEnd(22)} removed`);
-    } else {
-      log.info(`  ${mcp.name.padEnd(22)} ${color.dim("not present or already removed")}`);
-    }
-  }
-}
-
-async function maybeUninstallRequiredPlugins({ yes }) {
-  log.blank();
-  log.info("Required companion plugins");
-  if (shouldKeepRequiredPlugins({ yes })) {
-    log.info(
-      color.dim("--yes mode: keeping required companion plugins (use --purge to remove them)")
-    );
-    return;
-  }
-
-  const removeRequired = await confirm(
-    `Remove required companion plugins (${REQUIRED.map((plugin) => plugin.name).join(", ")})? ${color.dim("(keeps shared tools available if other workflows depend on them)")}`,
-    false
-  );
-  if (!removeRequired) {
-    log.info("Keeping required companion plugins");
-    return;
-  }
-
-  for (const plugin of REQUIRED) {
-    const result = await uninstallPlugin(plugin);
-    if (result.code === 0) {
-      log.ok(`  ${plugin.name.padEnd(22)} uninstalled`);
-    } else {
-      log.info(`  ${plugin.name.padEnd(22)} ${color.dim("not present or already removed")}`);
-    }
-  }
-}
-
-async function maybePurgeRuntimeArtifacts({ purge }) {
-  log.blank();
-  log.step(3, UNINSTALL_STEP_COUNT, "Runtime symlinks and marketplaces");
-  if (!purge) {
-    log.info(
-      color.dim("Keeping ~/.local/bin/bun, ~/.local/bin/uv (use --purge to remove)")
-    );
-    log.info(
-      color.dim("Reason: these bun/uv binaries may be used by other tools — confirm before deleting")
-    );
-    return;
-  }
-
-  await purgeManagedMarketplaces();
-  removeManagedSymlinks();
-}
-
-async function purgeManagedMarketplaces() {
-  const marketplaceIds = getManagedMarketplaceIds(RECOMMENDED.concat(REQUIRED));
-
-  for (const marketplaceId of marketplaceIds) {
-    const result = await removePluginMarketplace(marketplaceId);
-    if (result.code === 0) {
-      log.ok(`Removed marketplace ${marketplaceId}`);
-    } else if (!result.stderr.includes("not found")) {
-      log.warn(`Failed to remove marketplace ${marketplaceId}: ${resultLastLine(result)}`);
-    }
-  }
-}
-
-function removeManagedSymlinks() {
-  for (const link of MANAGED_SYMLINKS) {
-    if (!existsSync(link) && !isBrokenSymlink(link)) {
-      continue;
-    }
-    try {
-      const stat = lstatSync(link);
-      if (!stat.isSymbolicLink()) {
-        log.warn(
-          `${link} is not a symlink (likely a real file placed by the user), skipping`
-        );
-        continue;
-      }
-      const target = readlinkSync(link);
-      unlinkSync(link);
-      log.ok(`Removed symlink ${link} ${color.dim(`(was → ${target})`)}`);
-    } catch (err) {
-      log.warn(`Failed to remove ${link}: ${err.message}`);
-    }
-  }
-}
-
-async function maybeRemoveProjectState({ yes }) {
-  log.blank();
-  log.step(4, UNINSTALL_STEP_COUNT, "Project state directory");
-  const flowDir = join(process.cwd(), ".flow");
-  if (!existsSync(flowDir)) {
-    log.info(".flow/ does not exist, skipping");
-    return;
-  }
-
-  if (yes) {
-    log.info(
-      color.dim("--yes mode: keeping .flow/ (contains specs & decisions — confirm by hand before deleting)")
-    );
-    return;
-  }
-
-  const ok = await confirm(
-    `${color.red("DANGER:")} delete the ${color.bold(".flow/")} directory of the current project? ${color.dim("(includes all specs / decisions, not recoverable)")}`,
-    false
-  );
-  if (!ok) {
-    log.info("Keeping .flow/");
-    return;
-  }
-
-  try {
-    rmSync(flowDir, { recursive: true, force: true });
-    log.ok(`Removed ${flowDir}`);
-  } catch (err) {
-    log.err(`Removal failed: ${err.message}`);
-  }
-}
-
-function toUninstallTarget(entry) {
-  return {
-    name: entry.name,
-    uninstallSpec: entry.uninstallSpec,
-    uninstallArgs: entry.uninstallArgs || [],
-    marketplaceId: entry.marketplaceId,
-    scope: entry.scope,
-  };
-}
-
-function isBrokenSymlink(pathname) {
-  try {
-    return lstatSync(pathname).isSymbolicLink();
-  } catch {
-    return false;
-  }
-}

package/cli/utils.js

@@ -32,4 +32,9 @@ export {
   parsePluginListJson,
   readUserMcpConfig,
 } from "./lib/claude.js";
-export { ensureClaudeMemRuntimes, ensureRuntimeInPath } from "./lib/runtime.js";
+export {
+  ensureClaudeMemRuntimes,
+  ensureRuntimeInPath,
+  inspectClaudeMemRuntimes,
+  inspectRuntimeInPath,
+} from "./lib/runtime.js";

package/gates/adversarial-review-gate.md

@@ -17,7 +17,7 @@ depends_on: []
 
 - /curdx-flow:review command
 - Before Phase transitions (requirements → design, design → tasks)
-- Before code merge (/curdx-flow:ship)
+- Before code merge or human PR/release handoff
 - Enabled by default in Enterprise mode
 
 ---

package/gates/security-gate.md

@@ -14,7 +14,7 @@ depends_on: []
 ## Trigger Timing
 
 - When the `security-audit` skill runs
-- Before `/curdx-flow:ship` (auto-triggered, Phase 6+)
+- Before human PR/release handoff, after `/curdx-flow:verify` and `/curdx-flow:review`
 - When committing specs involving auth / payments / PII
 
 ---
@@ -154,7 +154,7 @@ pnpm audit
 
 ### Blocking Items
 
-- If SR-01 ~ SR-05 are found → block immediately, prohibit `/curdx-flow:ship`
+- If SR-01 ~ SR-05 are found → block immediately; do not hand off for PR/release
 - Must fix or explicitly exempt (record in STATE.md as tech debt + commitment to fix before release)
 
 ### Warning Items

package/gates/test-quality-gate.md

@@ -0,0 +1,59 @@
+---
+gate: test-quality-gate
+category: standard-mode
+severity: blocking
+depends_on: []
+---
+
+# Test Quality Gate
+
+A green test suite is not enough. Tests must exercise real behavior and fail for the right reason.
+
+## Blocking Findings
+
+Flag as blocking when a test is the only evidence for an FR/AC and any of these hold:
+
+1. **Mock-only behavior**
+   - Assertions only check mock calls (`toHaveBeenCalled`, `calledWith`, spy counts).
+   - The real module/function under test is never invoked.
+   - The test would still pass if the production implementation were empty.
+
+2. **Mock setup dominates evidence**
+   - Mock/stub/spy setup lines are more than 3x real behavioral assertions.
+   - The test mostly restates fixture wiring instead of asserting output, state, persistence, or user-visible behavior.
+
+3. **Skipped or inert tests**
+   - `it.skip`, `describe.skip`, `test.skip`, `xit`, `pending`, or equivalent on covered behavior.
+   - Test has no assertions and no meaningful side-effect check.
+
+4. **Implementation-biased regression**
+   - Test was added after implementation without evidence of RED failure when the task claims TDD.
+   - Test asserts internal private structure instead of externally observable behavior.
+
+5. **Missing cleanup for stateful mocks**
+   - Stateful mocks/spies are used across tests without `afterEach` cleanup (`restoreAllMocks`, `clearAllMocks`, sandbox restore, etc.).
+   - Shared mock state can leak between tests.
+
+## Acceptable Mock Usage
+
+Mocks are acceptable when they isolate a boundary and the assertion still verifies real behavior:
+
+- Network/payment/email provider mocked, but service logic and error handling are real.
+- Clock/randomness mocked to make deterministic assertions.
+- Database mocked only when a separate integration test covers persistence behavior.
+
+## Evidence Checklist
+
+For each FR/AC test evidence, record:
+
+- Test file and test name.
+- What real code path is invoked.
+- What behavioral assertion proves the requirement.
+- Whether the test was observed RED before GREEN when TDD is claimed.
+- Whether mocks are boundary-only or behavior-replacing.
+
+## Verdicts
+
+- `PASS`: Tests exercise real behavior with meaningful assertions.
+- `WARN`: Mock-heavy but supported by separate integration/e2e coverage.
+- `FAIL`: Mock-only/skipped/no-assertion test is used as primary evidence.