@curdx/flow 7.1.20 → 7.1.22

package/CHANGELOG.md

@@ -2,6 +2,51 @@
 
 All notable changes to `@curdx/flow` are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/) and the project follows [Semantic Versioning](https://semver.org/).
 
+## 7.1.22 — 2026-05-11
+
+### Added
+
+- **Browser verification policy for full-stack delivery.** Added a plugin reference that standardizes Playwright CLI as the default repeatable E2E path and Chrome DevTools MCP as the high-fidelity path for GIS, WebGL, canvas, map, GPU, console, network, performance, and flaky Playwright cases.
+- **Browser readiness in `curdx-flow doctor`.** Doctor output now reports detected dev-server scripts, E2E scripts, browser automation dependencies, Playwright config files, chrome-devtools-mcp dependency declaration, and local Chrome availability.
+
+### Changed
+
+- **Task planning now requires an explicit Browser Verify decision.** `task-planner`, `/curdx-flow:tasks`, VE references, and task templates now require `playwright`, `chrome-devtools-mcp`, `none`, or `blocked` before implementation tasks.
+- **Executor and QA prompts enforce browser evidence.** `spec-executor`, `qa-engineer`, and `verification-before-completion` now reject browser-facing completion claims without fresh Playwright or Chrome DevTools MCP evidence, and explicitly avoid `/ultrareview` as a verification path.
+- **Research output feeds browser verification.** `research-analyst` now records Browser Verify strategy alongside dev server, E2E config, browser dependency, port, and health endpoint discovery.
+
+### Tests
+
+- Added runtime CLI coverage for browser readiness in `doctor` output and manifest-integrity coverage that keeps the browser verification policy linked into planning, execution, QA, and skill surfaces.
+- Verified with `npm run verify`.
+
+## 7.1.21 — 2026-05-11
+
+### Added
+
+- **Plugin-local runtime CLI and workflow snapshot surface.** `plugins/curdx-flow/bin/curdx-flow` now exposes deterministic `route`, `snapshot`, `specs`, `state`, `tasks`, `verify-blocks`, and `doctor` commands that skills and smoke tests can call without reaching into bundled hook internals.
+- **True Claude Code end-to-end flow test.** New `npm run test:claudecc:e2e` creates a temporary failing Node project, runs `/curdx-flow:start` through the real Claude Code CLI with the local plugin, verifies `npm test`, validates spec/task/snapshot invariants, captures `--debug-file`, and writes an `analyze` report.
+- **Prompt/batch runtime context hooks.** Added generated hook entrypoints for user-prompt expansion and post-tool-batch snapshots so Claude sees active-spec gates and next actions while a real session is running.
+
+### Changed
+
+- **Quick lite-spec is now a first-class completed workflow.** Runtime snapshots accept completed `spec-lite` quick specs with `tasks.md`, `.progress.md`, and `.curdx-state.json` without requiring full-spec `research.md` / `requirements.md` / `design.md` artifacts.
+- **Active spec marker contract is explicit.** `/curdx-flow:start` now instructs Claude to write `$defaultDir/.current-spec` with a bare name for default-root specs, and never to write a project-root `.current-spec`.
+- **Hook freshness checking is dirty-worktree friendly.** `check-hooks-fresh` now compares generated hook tree hashes before/after rebuild, preserving CI stale-bundle detection without failing merely because fresh bundles are already uncommitted.
+
+### Fixed
+
+- **`.current-spec` path resolution.** Runtime resolvers now treat relative marker values containing `/` as paths rather than double-prefixing them under `specs/`, and defensively accept a project-root marker if an older run wrote one.
+- **Small `npm test` implementation goals no longer route as publish-critical work.** Auto-policy no longer treats the word `npm` itself as high/critical release risk, while release/publish/tag/plugin/hook surfaces remain protected.
+- **Claude Code transcript lookup follows current project-dir encoding.** `analyze` now resolves `~/.claude/projects` directories where Claude Code hyphenates non-alphanumeric path characters, with legacy slash-only encoding retained as fallback.
+- **`analyze --out` writes the report file.** Markdown/JSON report output now respects `--out` in both fresh and cached-report paths.
+- **`analyze` scopes sidecar hook errors to the active project.** Global `~/.claude/curdx-flow/errors.jsonl` rows are now included only when their `cwd` or `transcript_path` matches the analyzed source, preventing stale errors from other sessions from polluting E2E reports.
+
+### Tests
+
+- Added regression coverage for quick lite-spec snapshots, active-spec marker placement, transcript encoding, scoped sidecar hook errors, `analyze --out`, route classification for `npm test`, and the new real Claude Code E2E script.
+- Verified with `npm run verify`, `npm run test:claudecc`, and `CURDX_FLOW_E2E_KEEP_TMP=1 npm run test:claudecc:e2e`.
+
 ## 7.1.20 — 2026-05-11
 
 ### Changed

package/dist/{analyze-FX2PCSL6.mjs → analyze-I4TXK4S7.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/analyze/index.ts
-import { existsSync, mkdirSync, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync as statSync3, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync as readFileSync2, readdirSync as readdirSync2, realpathSync as realpathSync2, statSync as statSync3, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
 import path4 from "path";
 
@@ -1617,8 +1617,17 @@ function resolveRealCwd(cwd) {
   return real;
 }
 function encodeCwd(realCwd) {
+  return realCwd.replace(/[^A-Za-z0-9]/g, "-");
+}
+function encodeLegacyCwd(realCwd) {
   return realCwd.replace(/\//g, "-");
 }
+function candidateProjectDirs(home, realCwd) {
+  const encoded = encodeCwd(realCwd);
+  const legacy = encodeLegacyCwd(realCwd);
+  const names = encoded === legacy ? [encoded] : [encoded, legacy];
+  return names.map((name) => path3.join(home, ".claude", "projects", name));
+}
 function resolveTranscriptSource(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   if (opts.fixtureOverride) {
@@ -1642,12 +1651,20 @@ function resolveTranscriptSource(opts = {}) {
   }
   const home = opts.homedir ?? homedir();
   const realCwd = resolveRealCwd(cwd);
-  const encoded = encodeCwd(realCwd);
-  const encodedDir = path3.join(home, ".claude", "projects", encoded);
+  const candidates = candidateProjectDirs(home, realCwd);
+  let encodedDir = candidates[0];
   let entries = [];
-  try {
-    entries = readdirSync(encodedDir, { withFileTypes: true });
-  } catch {
+  let foundDir = false;
+  for (const candidate of candidates) {
+    try {
+      entries = readdirSync(candidate, { withFileTypes: true });
+      encodedDir = candidate;
+      foundDir = true;
+      break;
+    } catch {
+    }
+  }
+  if (!foundDir) {
     throw new TranscriptNotFoundError(
       encodedDir,
       `no Claude Code project dir for cwd ${cwd} \u2014 run \`claude\` here at least once, or pass CURDX_TRANSCRIPT_FIXTURE=\u2026 for tests`
@@ -1684,6 +1701,15 @@ function writeState(state) {
   if (!existsSync(STATE_DIR)) mkdirSync(STATE_DIR, { recursive: true });
   writeFileSync(STATE_PATH, JSON.stringify(state, null, 2), "utf8");
 }
+function emitReport(bytes, out) {
+  if (!out) {
+    process.stdout.write(bytes);
+    return;
+  }
+  const target = path4.resolve(out);
+  mkdirSync(path4.dirname(target), { recursive: true });
+  writeFileSync(target, bytes, "utf8");
+}
 function cleanupOrphanState(state, currentPaths) {
   const now = Date.now();
   const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -1740,7 +1766,26 @@ function loadSpecStates() {
   }
   return out;
 }
-function loadErrorEntries() {
+function normalizePathForScope(p) {
+  try {
+    return realpathSync2(p);
+  } catch {
+    return path4.resolve(p);
+  }
+}
+function isErrorEntryInScope(entry, source) {
+  const transcriptPaths = new Set(source.paths.map((p) => normalizePathForScope(p)));
+  if (entry.transcript_path) {
+    if (transcriptPaths.has(normalizePathForScope(entry.transcript_path))) return true;
+  }
+  if (entry.cwd) {
+    const sourceCwds = /* @__PURE__ */ new Set([normalizePathForScope(source.cwd)]);
+    if (source.kind === "real") sourceCwds.add(normalizePathForScope(source.realCwd));
+    if (sourceCwds.has(normalizePathForScope(entry.cwd))) return true;
+  }
+  return false;
+}
+function loadErrorEntries(source) {
   if (!existsSync(ERRORS_LOG_PATH)) return [];
   let raw;
   try {
@@ -1757,7 +1802,7 @@ function loadErrorEntries() {
       const kind = typeof parsed.kind === "string" ? parsed.kind : "unknown";
       const payload = parsed.payload && typeof parsed.payload === "object" && !Array.isArray(parsed.payload) ? parsed.payload : void 0;
       const correlationId = typeof parsed.correlationId === "string" ? parsed.correlationId : void 0;
-      out.push({
+      const entry = {
         ts: typeof parsed.ts === "string" ? parsed.ts : "",
         ...typeof parsed.hook === "string" ? { hook: parsed.hook } : {},
         ...typeof parsed.event === "string" ? { event: parsed.event } : {},
@@ -1768,7 +1813,8 @@ function loadErrorEntries() {
         kind,
         ...payload !== void 0 ? { payload } : {},
         ...correlationId !== void 0 ? { correlationId } : {}
-      });
+      };
+      if (isErrorEntryInScope(entry, source)) out.push(entry);
     } catch {
       continue;
     }
@@ -1797,12 +1843,12 @@ async function runAnalyzeInner(opts) {
   const cacheCompatible = (state.lastIncludePrompts ?? false) === includePrompts && (state.lastCostSummary ?? false) === costSummary;
   if (allCachedReady && pathStats.length > 0 && cacheCompatible && (state.lastReportJson || state.lastReportMarkdown)) {
     if (opts.json && state.lastReportJson) {
-      process.stdout.write(state.lastReportJson);
+      emitReport(state.lastReportJson, opts.out);
       writeState(state);
       return;
     }
     if (!opts.json && state.lastReportMarkdown) {
-      process.stdout.write(state.lastReportMarkdown);
+      emitReport(state.lastReportMarkdown, opts.out);
       writeState(state);
       return;
     }
@@ -1822,7 +1868,7 @@ async function runAnalyzeInner(opts) {
       if (r) redacted.push(r);
     }
     const filtered = filterEvents(redacted, { ...opts, limit });
-    const errorEntries = loadErrorEntries();
+    const errorEntries = loadErrorEntries(source);
     const specStates = loadSpecStates();
     let costBreakdown;
     let recommendations = [];
@@ -1890,7 +1936,6 @@ async function runAnalyzeInner(opts) {
       ...recommendations.length > 0 ? { recommendations } : {}
     });
     const safeJson = redactReportFields(json, { includePrompts });
-    void opts.out;
     const markdownStr = markdown;
     let jsonObj = safeJson;
     if (opts.costSummary === true && costBreakdown) {
@@ -1908,9 +1953,9 @@ async function runAnalyzeInner(opts) {
     state.lastIncludePrompts = includePrompts;
     state.lastCostSummary = costSummary;
     if (opts.json) {
-      process.stdout.write(jsonStr);
+      emitReport(jsonStr, opts.out);
     } else {
-      process.stdout.write(markdownStr);
+      emitReport(markdownStr, opts.out);
     }
     void safeJson;
     if (counters.parse_error || counters.unknown_type) {

package/dist/index.mjs

@@ -1870,7 +1870,7 @@ var analyzeCmd = defineCommand({
     const limit = typeof limitRaw === "string" && limitRaw.length > 0 ? Number(limitRaw) : void 0;
     const topRaw = args.top;
     const top = typeof topRaw === "string" && topRaw.length > 0 ? Number(topRaw) : void 0;
-    const { runAnalyze } = await import("./analyze-FX2PCSL6.mjs");
+    const { runAnalyze } = await import("./analyze-I4TXK4S7.mjs");
     await runAnalyze({
       out: typeof args.out === "string" ? args.out : void 0,
       json: Boolean(args.json),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curdx/flow",
-  "version": "7.1.20",
+  "version": "7.1.22",
   "description": "Interactive installer for Claude Code plugins and MCP servers",
   "type": "module",
   "bin": "./dist/index.mjs",
@@ -21,6 +21,7 @@
     "test:analyze": "vitest run tests/analyze",
     "test:runner": "vitest run tests/runner",
     "test:claudecc": "npm run build:hooks && node scripts/claudecc-smoke.mjs",
+    "test:claudecc:e2e": "npm run build && npm run build:hooks && node scripts/claudecc-e2e-flow.mjs",
     "start": "node ./dist/index.mjs",
     "typecheck": "tsc --noEmit",
     "verify": "npm run typecheck && npm run check-versions && npm run check:hooks-fresh && npm run build && npm run check:bundle && npm run test:hooks && npm run test:analyze && npm run test:runner && node scripts/check-verification-blocks.mjs",