@curdx/flow 7.1.7 → 7.1.9

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to `@curdx/flow` are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/) and the project follows [Semantic Versioning](https://semver.org/).
 
+## 7.1.9 — 2026-05-10
+
+### Changed
+
+- **Claude Code plugin API alignment.** `plugins/curdx-flow/.claude-plugin/plugin.json` now declares repository/homepage metadata and explicit official component paths for `skills`, `commands`, `agents`, and `hooks`. This keeps auto-discovery deterministic while preserving the existing command and skill layout.
+- **Agent Teams are now an optional experimental enhancement, not the default execution contract.** Research, requirements, design, tasks, two-stage review, bounded parallel dispatch, quick mode, and parallel execution coordinator docs now default to ordinary `Task(subagent_type: ...)` dispatch. `TeamCreate` / `TaskCreate` / `TaskList` / `SendMessage` flows are only used when `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` and the team tools are available; failures fall back to direct Task dispatch without treating the run as degraded.
+- **Plugin agents now use official runtime frontmatter.** All shipped agents declare `model`, `effort`, and `maxTurns`; read-only reviewer agents have explicit read-only tool allowlists. This makes model/turn budgeting and reviewer write boundaries visible to Claude Code.
+- **Hook UX and safety bounds improved.** Every command hook in `hooks/hooks.json` now declares a `statusMessage` and bounded timeout, matching current Claude Code hook configuration fields while preserving fail-open hook behavior.
+- **Slash-command frontmatter now passes `claude plugin validate`.** Command `argument-hint` values are quoted where they contain bracket syntax, and `allowed-tools` declarations use validator-friendly space-separated strings instead of inline YAML arrays.
+
+### Added
+
+- **Runner tests for plugin metadata drift.** `manifest-integrity.test.ts` now validates plugin manifest paths, hook status/timeout fields, agent runtime frontmatter, and reviewer read-only tool boundaries. Existing dispatch drift tests now lock the new direct-Task-first Agent Teams contract.
+
+## 7.1.8 — 2026-05-07
+
+### Fixed
+
+- **stop-watcher: completed specs no longer trigger missing-verification-block error (PR #9).** A spec finalized per NFR-5a (v7.1.0 retain-on-completion) repeatedly emitted `Phase 'execution' has no verification block. Run: /curdx-flow:execution` whenever the user stopped a session and the transcript happened to contain `ALL_TASKS_COMPLETE`. Root cause: `handleCompletion()` in `src/hooks/stop-watcher.ts` ran the iron-law verification gate without checking `state.completed === true` first; the mainline gate at L826 had the check, but handleCompletion exited before reaching it. Fix adds the same short-circuit immediately after the stateMalformed check inside handleCompletion. Mirrors the L826 guard intent — the two paths can't share a single check because handleCompletion returns before the mainline gate runs. Bundle (`plugins/curdx-flow/hooks/scripts/stop-watcher.mjs`) regenerated.
+- **tests: cross-platform fixture transcripts via runHook helper (PR #8).** Windows/Node22 CI was red since the OB-3 epic merged: 5/13 stop-watcher POC-gate tests failed because static fixtures (e.g. `all-complete.json`) hardcode `transcript_path: "/tmp/curdx-fixture-transcripts/complete.txt"`, which doesn't reliably resolve on Windows. The `runHook` helper (`tests/hooks/_helpers.ts`) was finished half-way during v7.0.0-beta.1's Bug 2 fix — it rewrote the fixture's `cwd` field to the runtime tmpdir but never gave `transcript_path` the same treatment. This release extends the cwd-rewrite block with a prefix substitution: any `transcript_path` starting with `/tmp/` is replaced with `os.tmpdir()` so the hook reads from the path the test's `beforeEach` actually provisions. No fixture JSON files needed editing. Companion change: `tests/hooks/stop-watcher.test.ts` `beforeEach` now writes to `os.tmpdir()/curdx-fixture-transcripts/...` via `FIXTURE_TRANSCRIPT_DIR`/`FIXTURE_TRANSCRIPT_FILE` constants (6 hardcoded `/tmp/` occurrences replaced).
+
+### Added — quality / CI hardening (no user-facing CLI changes)
+
+- **`tests/hooks/lib/verify-blocks.test.ts` — 13 isolated unit tests for the iron-law gate (PR #11).** verify-blocks is the single source of truth referenced from 4 distinct callers (Stop hook, TaskCompleted hook, npm verify, `curdx-flow check` CLI). Until now its behavior was only locked down via the Stop hook e2e suite — coarse proxy that exercised happy + missing + stale via spawnSync but couldn't isolate `walkSrcTree`'s prune list, depth cap, or the typed-coercion in `getVerificationPhase`. New direct tests cover: VERIFICATION_PHASES order, getVerificationPhase typed coercion + null-on-legacy-"unknown", verifyPhaseBlock 4 design-mandated branches (missing / non-zero-with-failedReason / non-zero-default / stale-evidence / happy), and walkSrcTree's empty-dir-zero / max-mtime-aggregation / WALK_SKIP_DIRS pruning / FR-8 fail-open on non-existent dir. Imports the TS source directly (`../../../src/hooks/lib/verify-blocks.js`) rather than spawning the bundle — verify-blocks is a non-CLI lib per the source comment at L17-21; consistent with `tests/hooks/subagent-context-injector.test.ts:6`.
+- **`tests/runner/manifest-integrity.test.ts` — frontmatter + reference-link guard for 31 plugin .md files (PR #12).** 15 commands + 10 agents + 6 skills had **zero automated check** before this release — a typo'd YAML key, renamed reference, or missing description could ship to users with no CI guard. New test validates: discovery sanity (lower bounds catch mass-deletion regressions), commands have non-empty `description`, agents/skills have both `name` + `description`, agent `name` matches filename (Task tool dispatch key), skill `name` matches parent directory (Skill tool dispatch key), every `references/<foo>.md` mention resolves — commands/agents look in global `plugins/curdx-flow/references/`, skills look in their LOCAL `skills/<name>/references/` subdir (the test differentiates the two scopes). Regex parsing only — no `gray-matter` dep, same convention as `claudeMd.test.ts` and `iron-law-doc.test.ts`.
+- **`test:runner` npm script + wired into `verify` chain (PR #12).** `tests/runner/` (claudeMd, two-stage-review, iron-law-doc, e2e-verification-flow, etc. — 9 files / 73 tests including the new manifest-integrity) was orphaned from the npm script chain: it ran locally on demand but never as part of `npm run verify` and never in CI. New `test:runner` script runs `vitest run tests/runner`. `verify` chain now: `typecheck && check-versions && check:hooks-fresh && build && check:bundle && test:hooks && test:analyze && test:runner && check-verification-blocks`.
+- **CI: bundle-size guard (`check:bundle`) runs on every PR (PR #10).** Validates `dist/index.mjs` against the 84 KB NFR-3 threshold (currently 72.94 KB ≤ 84 KB). Previously buried in `prepublishOnly` — too late to catch drift before merge. The test-matrix job also now runs `npm run build` (tsup) before `check:bundle` so `dist/index.mjs` exists when the guard fires.
+
+### Notes
+
+- **Plugin distribution constraint (re-affirmed):** `marketplace.json` declares `source: "./plugins/curdx-flow"`, so end users get the plugin via git clone (npm tarball ships only `dist/` per `package.json` `files`). Build artifacts under `plugins/curdx-flow/hooks/scripts/**/*.mjs` and `*.mjs.map` therefore **must remain git-tracked** — gitignoring them would break end-user installs. PR #9 includes the rebuilt `stop-watcher.mjs` bundle alongside the TS source change for this reason.
+- **Follow-ups deferred (not P0):**
+  - **`test:analyze` in CI**: vitest exits with code 2 in GitHub Actions ~300ms after all 106 analyze tests pass; reproducible only in CI, not local macOS. Suspected fork-pool teardown interaction with the preceding `test:hooks` vitest run. Filed for separate investigation; PR #10 added only `check:bundle` to the matrix.
+  - **`test:runner` step in `ci.yml`**: script ships in this release, but the matching `- run: npm run test:runner` step is a follow-up commit (avoiding scope creep on the v7.1.8 release wave).
+
 ## 7.1.7 — 2026-05-07
 
 ### Added — observability-v2 epic (OB-1 + OB-2 error-logger + OB-3, PR #7)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curdx/flow",
-  "version": "7.1.7",
+  "version": "7.1.9",
   "description": "Interactive installer for Claude Code plugins and MCP servers",
   "type": "module",
   "bin": "./dist/index.mjs",
@@ -19,9 +19,10 @@
     "dev": "tsup --watch",
     "test:hooks": "npm run build:hooks && vitest run tests/hooks --passWithNoTests",
     "test:analyze": "vitest run tests/analyze",
+    "test:runner": "vitest run tests/runner",
     "start": "node ./dist/index.mjs",
     "typecheck": "tsc --noEmit",
-    "verify": "npm run typecheck && npm run check-versions && npm run check:hooks-fresh && npm run build && npm run check:bundle && npm run test:hooks && npm run test:analyze && node scripts/check-verification-blocks.mjs",
+    "verify": "npm run typecheck && npm run check-versions && npm run check:hooks-fresh && npm run build && npm run check:bundle && npm run test:hooks && npm run test:analyze && npm run test:runner && node scripts/check-verification-blocks.mjs",
     "check-versions": "node scripts/check-versions.mjs",
     "bump-version": "node scripts/bump-version.mjs",
     "prepublishOnly": "node scripts/check-versions.mjs && npm run typecheck && npm run check:hooks-fresh && npm run build"