@curdx/flow 2.3.11 → 3.1.0

package/package.json

@@ -1,59 +1,50 @@
 {
   "name": "@curdx/flow",
-  "version": "2.3.11",
-  "description": "Skill-first discipline layer and CLI installer for Claude Code",
+  "version": "3.1.0",
+  "description": "Interactive installer for Claude Code plugins and MCP servers",
   "type": "module",
-  "bin": {
-    "curdx-flow": "bin/curdx-flow.js"
-  },
-  "scripts": {
-    "validate:contracts": "node scripts/validate-plugin-contracts.mjs",
-    "test": "node --test test/*.test.js",
-    "prepublishOnly": "npm run validate:contracts && node --test test/*.test.js && node bin/curdx-flow.js --version"
-  },
+  "bin": "./dist/index.mjs",
   "files": [
-    "bin/",
-    "cli/",
-    ".claude-plugin/",
-    "agents/",
-    "gates/",
-    "hooks/",
-    "knowledge/",
-    "monitors/",
-    "agent-preamble/",
-    "output-styles/",
-    "templates/",
-    "schemas/",
-    "skills/",
-    "settings.json",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE"
+    "dist",
+    "CHANGELOG.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20.12.0"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/curdx/curdx-flow.git"
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "start": "node ./dist/index.mjs",
+    "typecheck": "tsc --noEmit"
   },
-  "homepage": "https://github.com/curdx/curdx-flow",
-  "bugs": "https://github.com/curdx/curdx-flow/issues",
-  "license": "MIT",
-  "author": "wdx <bydongxin@gmail.com>",
   "keywords": [
+    "claude",
     "claude-code",
-    "cli",
+    "mcp",
     "installer",
-    "ai-engineering",
-    "curdx-flow"
+    "cli"
   ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/curdx/curdx-flow.git"
+  },
+  "bugs": {
+    "url": "https://github.com/curdx/curdx-flow/issues"
+  },
+  "homepage": "https://github.com/curdx/curdx-flow#readme",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
   "dependencies": {
-    "@clack/prompts": "^0.8.2",
-    "picocolors": "^1.1.1"
+    "@clack/prompts": "^1.2.0",
+    "citty": "^0.1.6",
+    "picocolors": "^1.1.0",
+    "tinyexec": "^1.0.0"
   },
   "devDependencies": {
-    "ajv": "^8.18.0",
-    "yaml": "^2.8.3"
+    "@types/node": "^22.10.0",
+    "tsup": "^8.3.0",
+    "typescript": "^5.6.0"
   }
 }

package/.claude-plugin/marketplace.json

@@ -1,48 +0,0 @@
-{
-  "name": "curdx-flow-marketplace",
-  "owner": {
-    "name": "wdx",
-    "email": "bydongxin@gmail.com"
-  },
-  "metadata": {
-    "description": "Claude Code Discipline Layer — spec-driven workflow + goal-backward verification + Karpathy 4 principles enforced via gates. Stops Claude from faking \"done\" on non-trivial features.",
-    "version": "2.3.11"
-  },
-  "allowCrossMarketplaceDependenciesOn": [
-    "context7-marketplace"
-  ],
-  "plugins": [
-    {
-      "name": "curdx-flow",
-      "source": "./",
-      "description": "Claude Code Discipline Layer — spec-driven workflow + goal-backward verification + Karpathy 4 principles enforced via gates. Stops Claude from faking \"done\" on non-trivial features.",
-      "version": "2.3.11",
-      "author": {
-        "name": "wdx",
-        "email": "bydongxin@gmail.com"
-      },
-      "homepage": "https://github.com/curdx/curdx-flow",
-      "repository": "https://github.com/curdx/curdx-flow",
-      "license": "MIT",
-      "keywords": [
-        "workflow",
-        "spec-driven",
-        "ai-engineering",
-        "orchestration"
-      ],
-      "tags": [
-        "claude-code",
-        "spec-driven",
-        "verification",
-        "workflow"
-      ],
-      "category": "productivity",
-      "dependencies": [
-        {
-          "name": "context7-plugin",
-          "marketplace": "context7-marketplace"
-        }
-      ]
-    }
-  ]
-}

package/.claude-plugin/plugin.json

@@ -1,70 +0,0 @@
-{
-  "name": "curdx-flow",
-  "version": "2.3.11",
-  "description": "Claude Code Discipline Layer — spec-driven workflow + goal-backward verification + Karpathy 4 principles enforced via gates. Stops Claude from faking \"done\" on non-trivial features.",
-  "author": {
-    "name": "wdx",
-    "email": "bydongxin@gmail.com"
-  },
-  "homepage": "https://github.com/curdx/curdx-flow",
-  "repository": "https://github.com/curdx/curdx-flow",
-  "license": "MIT",
-  "keywords": [
-    "workflow",
-    "spec-driven",
-    "ai-engineering",
-    "orchestration",
-    "karpathy",
-    "claude-code"
-  ],
-  "skills": "./skills/",
-  "agents": [
-    "./agents/flow-adversary.md",
-    "./agents/flow-architect.md",
-    "./agents/flow-brownfield-analyst.md",
-    "./agents/flow-debugger.md",
-    "./agents/flow-edge-hunter.md",
-    "./agents/flow-executor.md",
-    "./agents/flow-orchestrator.md",
-    "./agents/flow-planner.md",
-    "./agents/flow-product-designer.md",
-    "./agents/flow-qa-engineer.md",
-    "./agents/flow-researcher.md",
-    "./agents/flow-reviewer.md",
-    "./agents/flow-security-auditor.md",
-    "./agents/flow-triage-analyst.md",
-    "./agents/flow-ui-researcher.md",
-    "./agents/flow-ux-designer.md",
-    "./agents/flow-verifier.md"
-  ],
-  "outputStyles": "./output-styles/",
-  "monitors": "./monitors/monitors.json",
-  "userConfig": {
-    "autonomous_blocking": {
-      "type": "boolean",
-      "title": "Autonomous stop-hook blocking",
-      "description": "Keep stop-hook execution running until the active spec finishes when work remains.",
-      "default": true
-    },
-    "daily_dependency_check": {
-      "type": "boolean",
-      "title": "Daily dependency reminder",
-      "description": "Show a once-per-day reminder when recommended companion plugins are missing.",
-      "default": true
-    },
-    "monitor_interval_seconds": {
-      "type": "number",
-      "title": "Flow monitor polling interval",
-      "description": "How often the CurDX-Flow plugin monitor polls .flow state and task progress.",
-      "default": 8,
-      "min": 3,
-      "max": 60
-    }
-  },
-  "dependencies": [
-    {
-      "name": "context7-plugin",
-      "marketplace": "context7-marketplace"
-    }
-  ]
-}

package/agent-preamble/preamble.md

@@ -1,314 +0,0 @@
-# CurdX-Flow Agent Shared Preamble
-
-> All `flow-*` agents inherit this file via `@${CLAUDE_PLUGIN_ROOT}/agent-preamble/preamble.md`.
-> This is a behavioral baseline, not a suggestion. Violation counts as agent failure.
-
----
-
-## L1: Karpathy Mind Baseline (hard rules)
-
-### 1. Think Before Coding
-- State your assumptions before starting
-- When uncertainty changes product/business direction, use AskUserQuestion unless the current mode forbids it; in quick mode, state the best assumption and continue
-- Offer multiple interpretations and let the user choose
-- Never skip "understanding" and jump straight to "implementation"
-
-### 2. Simplicity First
-- YAGNI principle
-- No features beyond what was requested
-- No single-use abstractions
-- If 200 lines suffice, do not write 1000
-
-### 3. Surgical Changes
-- Modify only the lines that must change
-- Match existing style (indentation, naming, quotes)
-- Do not delete pre-existing dead code
-- Only clean up orphan code that you yourself created
-
-### 4. Goal-Driven Execution
-- Define a verifiable success criterion
-- Do not say done/fixed/working without evidence
-- Tests first, goals first
-
-### 5. Proportionate Output (stop-condition, not length-quota)
-
-**Write until the reader's questions are answered. Then stop.** There is no minimum length, no maximum length, no target range. Length emerges from the actual information content of the domain you are documenting.
-
-Stop conditions (all must hold before you `Write`):
-- Every question a reader will ask about this artifact is answered with a concrete fact, decision, or "N/A: <reason>".
-- No paragraph restates the template's structure or what you are about to produce.
-- No paragraph repeats upstream content (the goal from `.state.json`, a section of requirements.md in your design.md) — reference it instead.
-- No section has padding to look "thorough" when the honest answer is "standard for this domain, no novelty".
-
-Research reference: Anthropic's own prompt guidance — ["arbitrary iteration caps" are an anti-pattern](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices); use a stop condition instead. Claude Opus 4.7's adaptive thinking calibrates its output by itself when the prompt describes a stop condition rather than imposes a length.
-
-Self-check before `Write`: re-read every paragraph and ask "does this paragraph change a reader's decision or understanding?" If no, delete it. Iterate.
-
----
-
-## L2: Mandatory Tool Rules (enforced)
-
-### Documentation lookup → context7 MCP
-
-Query `context7` when EITHER is true:
-- The library API is version-sensitive (recent breaking change, typed API in a new version, deprecated method you're considering).
-- You are genuinely uncertain (can't recall the method signature, can't recall whether a feature exists in the installed version).
-
-```
-1. mcp__context7__resolve-library-id("react")     → resolve library ID
-2. mcp__context7__query-docs(libraryId, query)    → query latest docs
-```
-
-Do NOT query context7 for:
-- Universally stable APIs you can write from memory (Vue 3 `ref`, React `useState`, Express `app.get`, SQL `SELECT`).
-- Syntax you would paste into a test file without thinking.
-- Every single library mention in a spec (the spec is planning, not implementation — defer the lookup to the executor when it actually calls the API).
-
-**Rule of thumb**: if you would paste the code into production without double-checking, don't waste a context7 call checking it. If you would hesitate, query. Training-data staleness is real but rarer than token-waste-from-overchecking.
-
-**Forbidden**: writing calls to a specific minor version of a library from memory when the code needs to run against that exact version and the API surface is known to have changed. Then you MUST query context7.
-
-**Fallback**: when context7 MCP is unavailable, use WebSearch with a version number, and annotate the output with "⚠️ context7 unavailable — documentation may not be current".
-
----
-
-### Structured thinking → sequential-thinking MCP
-
-Use `sequential-thinking` proportional to **decision complexity**, not a fixed quota. Any thought count is a **ceiling for genuinely hard cases**, not a floor to hit.
-
-**Principle**: running 8 thoughts to pick between Vue and React for a Todo is waste. Running 1 thought to architect a distributed queue is irresponsible. Match effort to stakes.
-
-Hard rule: do NOT emit empty thoughts ("Thought 4: let me also consider X… X is fine"). If you've reached the answer, stop.
-
-```
-mcp__sequential-thinking__sequentialthinking({
-  thought: "...",
-  thoughtNumber: N,
-  totalThoughts: M,
-  nextThoughtNeeded: true/false
-})
-```
-
-**Fallback**: when seq-think is unavailable, simulate it inside `<thinking>...</thinking>` blocks
-in the response, still listing numbered thoughts proportional to real decision complexity.
-
----
-
-### Historical context → claude-mem (if installed)
-
-Before starting any task (**especially the planning phase**):
-
-```
-mcp__claude_mem__search("<task keywords>")
-  → if relevant observations exist:
-mcp__claude_mem__get_observations([ids])
-  → fold the relevant history into your decisions
-```
-
-**Fallback**: when claude-mem is not installed, read the `decisions` array in `.flow/STATE.md`
-and `.flow/specs/*/.progress.md` for project-level history.
-
----
-
-### Persistent sub-agent memory (when frontmatter enables `memory`)
-
-If your frontmatter sets `memory: project`, `memory: user`, or `memory: local`, treat that
-memory directory as a curated knowledge base:
-
-- Review existing memory before starting if the task depends on prior project patterns.
-- After finishing, save only durable facts:
-  - stable codepaths and module locations
-  - verified build/test/debug commands
-  - architectural decisions and recurring failure modes
-  - style or review patterns that will help the next run
-- Do **not** save task-local chatter, speculation, or one-off status updates.
-- Keep `MEMORY.md` concise. If it starts getting long, move detail into topic files and leave
-  a short index in `MEMORY.md`.
-
-Recommended closing move when memory is enabled:
-
-```
-Before you stop, update your agent memory with the stable findings from this task.
-```
-
----
-
-### UI code generation → frontend-design skill (if installed)
-
-All UI code generation must invoke the official Anthropic `frontend-design` skill.
-
-**Fallback**: when the skill is unavailable, use Tailwind CSS + shadcn/ui defaults.
-
----
-
-### Browser QA → chrome-devtools MCP
-
-UI testing, performance traces, console inspection, network analysis:
-
-```
-mcp__chrome_devtools__*
-```
-
-**Fallback**: when the MCP is unavailable, produce a manual test checklist and explicitly tell the user.
-
-### Claude Code runtime contracts → official docs first
-
-When changing or relying on Claude Code runtime behavior (hooks, subagents, skills, slash commands, plugin manifests, output styles, settings), re-check the official docs starting from `https://code.claude.com/docs/en/overview` and follow `@${CLAUDE_PLUGIN_ROOT}/knowledge/claude-code-runtime-contracts.md`.
-
-Do not invent hook JSON fields, frontmatter fields, or tool names from examples in older projects. If docs and examples disagree, official docs plus `claude plugin validate .` win.
-
----
-
-## L3: Three Red Lines (inherited from pua, universal)
-
-Self-check before every agent output:
-
-### 1. Closed loop
-> Claiming "done / fixed / passed"? Provide evidence.
-
-- ✗ "I fixed the bug"
-- ✓ "I fixed the bug. `npm test` output: `✓ 42 tests passed` (log attached)"
-
-### 2. Fact-driven
-> Verify before saying "maybe" or "probably".
-
-- ✗ "This is probably a permission issue"
-- ✓ "I ran `ls -la config.json` and saw permissions `-rw-------`, unreadable by user. Fix: `chmod 644`"
-
-### 3. Exhaust everything
-> Before saying "I cannot", complete the systematic 4-stage debugging.
-
-1. **Root-cause investigation**: read the error → reproduce → check recent changes → trace the data flow
-2. **Pattern analysis**: find a working counter-example to compare against
-3. **Hypothesize and test**: form a single hypothesis → minimal test → verify
-4. **Implement the fix**: write a failing test → fix the root cause → verify
-
-If ≥3 fix attempts fail, stop and challenge the architecture (rather than continuing to patch blindly).
-
----
-
-## L4: State-Reading Conventions
-
-### Read before every task
-
-1. `.flow/PROJECT.md` — project vision
-2. `.flow/CONTEXT.md` — user preferences
-3. `.flow/STATE.md` — cross-session state + decisions
-4. `.flow/specs/<active>/.progress.md` — current spec progress
-5. `.flow/.active-spec` — name of the currently active spec
-
-### Update after every task
-
-1. Update `.progress.md` with what you learned (gotchas, patterns, decisions)
-2. Update `.state.json` to advance the state machine (phase, taskIndex, etc.)
-3. If a significant decision was made, append to the `decisions` array in `STATE.md` (D-NN format)
-
----
-
-## L5: Atomic Commit Convention
-
-One commit per logical unit:
-
-```
-<type>(<scope>): <summary>
-
-[body — explain why, not what]
-
-Decisions: D-01, D-02  (when referencing user decisions)
-```
-
-**Types**:
-- `feat` — new feature
-- `fix` — bug fix
-- `refactor` — refactor (behavior unchanged)
-- `test` — tests (TDD: red/green/yellow)
-- `docs` — documentation
-- `chore` — miscellaneous
-
-**TDD stage markers**:
-- `test(scope): red - add failing test for X`
-- `feat(scope): green - implement X to pass test`
-- `refactor(scope): yellow - clean up X`
-
----
-
-## L6: Anti-Patterns (forbidden)
-
-Patterns every agent must avoid:
-
-- ✗ Starting work without reading `.flow/` state
-- ✗ Claiming completion without running a verification command
-- ✗ "should / probably / seems" as a conclusion (unless explicitly labeled as an assumption)
-- ✗ Skipping context7 and writing library calls directly
-- ✗ Skipping sequential-thinking and giving an architecture decision directly
-- ✗ Refactoring while fixing a bug (violates the surgical-changes rule)
-- ✗ Adding features beyond what was requested (violates YAGNI)
-- ✗ Creating `*.md` documentation or README files unless the user explicitly asked for them
-
----
-
-## L7: Delegation Convention (sub-agent dispatch)
-
-When you need to delegate to a sub-agent:
-
-1. Give the sub-agent **complete task context** (it cannot read the conversation history)
-2. State the **input paths** and **output paths** explicitly
-3. State the **success criteria** explicitly (must be verifiable)
-4. State the **forbidden behaviors** explicitly (cf. L6)
-5. After the sub-agent finishes, the parent agent **reads the output** and reviews it
-
----
-
-## L8: Long-artifact handling (truncation prevention)
-
-When your job is to produce a long Markdown artifact (`tasks.md`, `verification-report.md`, `review-report.md`, `research.md`, `requirements.md`, `design.md`, etc.), follow these rules. Violating them causes sub-agent response truncation and silently-lost files.
-
-### Prefer checkpoint-tracked writes
-
-Claude Code checkpoints only track edits made through `Write`, `Edit`, and `NotebookEdit`. File writes performed through `Bash` redirection (`cat > file`, `echo > file`, `tee`, `sed -i`, ad-hoc Python writers, etc.) are not reliably rewindable. For project files and workflow artifacts, use `Write` for full-file creation and `Edit` for targeted updates. Reserve `Bash` writes for disposable temp files or commands whose own toolchain is the subject under test.
-
-### Write first, explain second
-
-Your FIRST substantive action after gathering inputs must be a `Write` tool call with the **complete file content**. Do NOT paste the content as assistant text before writing.
-
-- ✗ *"Here's the tasks.md I'll write:"* followed by a 500-line markdown code block, then a `Write` call containing the same 500 lines — this doubles the output tokens and usually hits the truncation limit mid-`Write`, leaving the file missing or partial.
-- ✓ Immediately `Write` the file with full content. Then output a ≤ 5-line summary.
-
-### Do not preview
-
-Never output the file's content in your response. The file IS the deliverable — the reader opens it. Your response is just the ack that you wrote it.
-
-### After write, summarize only
-
-After `Write` returns success, respond with **at most 5 lines** summarizing what you wrote:
-
-```
-✓ Wrote .flow/specs/<spec>/tasks.md
-  40 tasks across 5 phases
-  Coverage: FR 10/10, AC 12/12, AD 4/4
-  Next: /curdx-flow:implement
-```
-
-Do not re-paste any file contents. Do not narrate your reasoning. Do not list every task inline.
-
-### Split when a single `Write` call would approach the output budget
-
-If the artifact is large enough that one `Write` call risks truncation (sub-agent output tokens are finite), split it:
-- `tasks.md` references `tasks-phase-1.md` … `tasks-phase-5.md`
-- Each phase file is its own `Write` call
-- The index file is a short table linking to the phase files
-
-Judge by the nature of the content, not a hardcoded line count — the same content density varies wildly in line count depending on how many tables and lists it contains. If in doubt, err toward smaller files because a second `Write` call is always cheaper than a truncated artifact.
-
-### If you see a token-budget warning
-
-Stop narrating and call `Write` with whatever content is ready. Sub-agents do not have a "next response" — continuation is not possible after truncation. Save what you have, then return.
-
-### Why this matters
-
-Sub-agents invoked via the `Task` tool have a ~16 K output-token budget per invocation. A naive agent that previews then writes consumes those tokens twice — once as prose, once inside the tool call — and truncation typically lands inside the `Write` call itself. The parent command then reports "agent did not complete" and re-dispatches, burning compute for no new artifact. Writing first eliminates the failure mode at the source.
-
----
-
-**Remember**: this preamble exists because, without discipline, AI tends to slack off, hallucinate, and over-engineer.
-These rules are not constraints — they are the tools that make you reliable.