@curdx/flow 7.1.4 → 7.1.5

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to `@curdx/flow` are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/) and the project follows [Semantic Versioning](https://semver.org/).
 
+## 7.1.5 — 2026-05-06
+
+### Fixed
+
+- **Prevent local source checkouts from silently running a stale CLI bundle.** A repo-local execution path could still write the old `~/.claude/CLAUDE.md` block even after `7.1.4` was published correctly, because `.gitignore` excludes `dist/` and `npx @curdx/flow` run from the source checkout may execute the checkout's local `bin` (`dist/index.mjs`) instead of the freshly published npm tarball. If `src/` had newer changes but `dist/` had not been rebuilt, the user would unknowingly run old installer logic and keep re-injecting the pre-7.1.4 managed block. Added `src/runner/buildFreshness.ts` and wired it into `src/index.ts` startup so source checkouts now fail fast with a clear error when `src/**/*.ts` is newer than `dist/index.mjs`, instructing the user to run `npm run build` or execute the published package explicitly. New tests in `tests/runner/buildFreshness.test.ts` cover both stale and fresh build states.
+
 ## 7.1.4 — 2026-05-06
 
 ### Changed

package/dist/index.mjs

@@ -1711,6 +1711,58 @@ var analyzeCmd = defineCommand({
 });
 var analyze_default = analyzeCmd;
 
+// src/runner/buildFreshness.ts
+import { readdirSync, statSync, existsSync as existsSync3 } from "fs";
+import path5 from "path";
+import { fileURLToPath } from "url";
+var SELF_PATH = fileURLToPath(import.meta.url);
+var RUNNER_DIR = path5.dirname(SELF_PATH);
+var PROJECT_ROOT = path5.resolve(RUNNER_DIR, "..", "..");
+var SRC_DIR = path5.join(PROJECT_ROOT, "src");
+var DIST_ENTRY = path5.join(PROJECT_ROOT, "dist", "index.mjs");
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
+function newestTsMtimeMs(dir) {
+  let newest = 0;
+  const entries = readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry.name)) continue;
+    const full = path5.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      newest = Math.max(newest, newestTsMtimeMs(full));
+      continue;
+    }
+    if (!entry.isFile() || !entry.name.endsWith(".ts")) continue;
+    newest = Math.max(newest, statSync(full).mtimeMs);
+  }
+  return newest;
+}
+function assertFreshLocalBuild() {
+  assertFreshBuild({ projectRoot: PROJECT_ROOT, srcDir: SRC_DIR, distEntry: DIST_ENTRY });
+}
+function assertFreshBuild(opts) {
+  const { projectRoot, srcDir, distEntry } = opts;
+  if (!existsSync3(srcDir) || !existsSync3(distEntry)) return;
+  let distMtimeMs = 0;
+  let newestSrcMtimeMs = 0;
+  try {
+    distMtimeMs = statSync(distEntry).mtimeMs;
+    newestSrcMtimeMs = newestTsMtimeMs(srcDir);
+  } catch {
+    return;
+  }
+  if (newestSrcMtimeMs <= distMtimeMs) return;
+  const relDist = path5.relative(projectRoot, distEntry);
+  const relSrc = path5.relative(projectRoot, srcDir);
+  throw new Error(
+    [
+      "Local build is stale: source files are newer than the bundled CLI entry.",
+      `Detected source checkout at ${projectRoot}.`,
+      `Run \`npm run build\` to refresh ${relDist}, or execute the published package explicitly with \`npx --package @curdx/flow@$(node -p "require('./package.json').version") @curdx/flow\`.`,
+      `This guard only applies when running from a local checkout that still contains ${relSrc}/.`
+    ].join(" ")
+  );
+}
+
 // src/index.ts
 function parseLang(v) {
   return v === "zh" || v === "en" ? v : void 0;
@@ -1846,6 +1898,7 @@ async function runInteractive(argv2) {
 }
 var argv = process.argv.slice(2);
 var first = firstNonFlag(argv);
+assertFreshLocalBuild();
 if (first === void 0 || first !== void 0 && !SUBCOMMANDS.has(first) && first !== "--help" && first !== "-h") {
   if (first === void 0) {
     runInteractive(argv).catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curdx/flow",
-  "version": "7.1.4",
+  "version": "7.1.5",
   "description": "Interactive installer for Claude Code plugins and MCP servers",
   "type": "module",
   "bin": "./dist/index.mjs",