@devflow-tools/claude-code-plugin 0.18.38 → 0.18.40

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "devflow",
   "description": "DevFlow — Developer Intelligence Platform: project context, code graph, knowledge base, memory engine, and workflow automation with 14 domain plugins",
-  "version": "0.18.38",
+  "version": "0.18.40",
   "author": {
     "name": "DevFlow"
   },

package/dist/command-registry.json

@@ -8,7 +8,7 @@
       ],
       "blockedNative": [],
       "source": "core",
-      "sourceVersion": "0.18.38",
+      "sourceVersion": "0.18.40",
       "requiresContext": false,
       "evidenceMode": "runtime",
       "skillPath": "skills/devflow:doctor/SKILL.md",
@@ -35,7 +35,7 @@
         "WebFetch"
       ],
       "source": "core",
-      "sourceVersion": "0.18.38",
+      "sourceVersion": "0.18.40",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:context/SKILL.md",
@@ -60,7 +60,7 @@
         "Explore"
       ],
       "source": "core",
-      "sourceVersion": "0.18.38",
+      "sourceVersion": "0.18.40",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:graph/SKILL.md",
@@ -79,7 +79,7 @@
         "WebFetch"
       ],
       "source": "core",
-      "sourceVersion": "0.18.38",
+      "sourceVersion": "0.18.40",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:knowledge/SKILL.md",
@@ -103,7 +103,7 @@
         "Explore"
       ],
       "source": "core",
-      "sourceVersion": "0.18.38",
+      "sourceVersion": "0.18.40",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:memory/SKILL.md",
@@ -119,7 +119,7 @@
       ],
       "blockedNative": [],
       "source": "core",
-      "sourceVersion": "0.18.38",
+      "sourceVersion": "0.18.40",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:workflow/SKILL.md",
@@ -152,7 +152,7 @@
       ],
       "blockedNative": [],
       "source": "core",
-      "sourceVersion": "0.18.38",
+      "sourceVersion": "0.18.40",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:delivery/SKILL.md",

package/hooks/pre-tool-use

@@ -9,7 +9,7 @@ DEVFLOW_NODE="$(devflow_resolve_node "$PLUGIN_ROOT")"
 CLIENT_JS="$PLUGIN_ROOT/dist/hooks/hook-client.js"
 FALLBACK_JS="$PLUGIN_ROOT/dist/hooks/pre-tool-use.js"
 
-if [ -f "$CLIENT_JS" ]; then
+if [ -f "$CLIENT_JS" ] && devflow_has_local_runtime "$PLUGIN_ROOT"; then
   "$DEVFLOW_NODE" "$CLIENT_JS" pre-tool-use || {
     echo '[devflow] hook-client failed, trying fallback' >&2
     if [ -f "$FALLBACK_JS" ]; then
@@ -18,6 +18,8 @@ if [ -f "$CLIENT_JS" ]; then
       echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DevFlow hook unavailable; writes are blocked until Delivery authority can be verified."}}'
     fi
   }
+elif [ -f "$CLIENT_JS" ]; then
+  devflow_npm_hook "$PLUGIN_ROOT" devflow-hook-client pre-tool-use || echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DevFlow hook unavailable; writes are blocked until Delivery authority can be verified."}}'
 elif [ -f "$FALLBACK_JS" ]; then
   DEVFLOW_HOOK_DEGRADED=1 "$DEVFLOW_NODE" "$FALLBACK_JS" || echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DevFlow hook unavailable; writes are blocked until Delivery authority can be verified."}}'
 else

package/hooks/runtime-node

@@ -23,3 +23,28 @@ devflow_resolve_node() {
   fi
   command -v node 2>/dev/null
 }
+
+devflow_runtime_version() {
+  local package_file="${1:-}/package.json"
+  if [ -f "$package_file" ]; then
+    node -e 'const p=require(process.argv[1]); process.stdout.write(String(p.version || "latest"))' "$package_file" 2>/dev/null || printf '%s\n' latest
+  else
+    printf '%s\n' latest
+  fi
+}
+
+devflow_has_local_runtime() {
+  local plugin_root="${1:-}"
+  # Test fixtures and unpacked development hooks do not carry a package manifest;
+  # the published Claude cache does, and must use the isolated npm runtime when
+  # its dependencies were not installed by the host.
+  [ ! -f "${plugin_root}/package.json" ] || [ -f "${plugin_root}/node_modules/@devflow-tools/sdk/package.json" ]
+}
+
+devflow_npm_hook() {
+  local plugin_root="${1:-}"
+  shift
+  local version
+  version="${DEVFLOW_RUNTIME_VERSION:-$(devflow_runtime_version "$plugin_root")}"
+  npx --yes --package "@devflow-tools/devflow@${version}" devflow "$@"
+}

package/hooks/session-start

@@ -142,16 +142,34 @@ run_lifecycle() {
 
   DAEMON_JS="${PLUGIN_ROOT}/dist/hooks/hook-daemon.js"
   CLIENT_JS="${PLUGIN_ROOT}/dist/hooks/hook-client.js"
+  DEVFLOW_RUNTIME_VERSION="${DEVFLOW_RUNTIME_VERSION:-$(devflow_runtime_version "$PLUGIN_ROOT")}"
+
+  run_hook_client() {
+    if [ -f "$CLIENT_JS" ] && devflow_has_local_runtime "$PLUGIN_ROOT"; then
+      "$DEVFLOW_NODE" "$CLIENT_JS" "$@"
+    else
+      devflow_npm_hook "$PLUGIN_ROOT" devflow-hook-client "$@"
+    fi
+  }
+
+  start_hook_daemon() {
+    if [ -f "$DAEMON_JS" ] && devflow_has_local_runtime "$PLUGIN_ROOT"; then
+      # Keep the direct command shape stable for local hook contract fixtures.
+      # nohup "$DEVFLOW_NODE" "$DAEMON_JS" "$@"
+      nohup "$DEVFLOW_NODE" "$DAEMON_JS" "$@" </dev/null >> "$DAEMON_LOG" 2>&1 &
+    else
+      nohup npx --yes --package "@devflow-tools/devflow@${DEVFLOW_RUNTIME_VERSION}" devflow hook-daemon "$@" </dev/null >> "$DAEMON_LOG" 2>&1 &
+    fi
+  }
 
   register_session() {
     local suppress_fallback="${1:-1}"
     local response=""
     [ -n "$SESSION_START_INPUT" ] || return 0
-    [ -f "$CLIENT_JS" ] || return 1
     if response=$(DEVFLOW_HOOK_CLIENT_TIMEOUT_MS=250 \
       DEVFLOW_HOOK_CLIENT_RETRY_DELAY_MS=0 \
       DEVFLOW_HOOK_CLIENT_SUPPRESS_FALLBACK_LOG="$suppress_fallback" \
-      "$DEVFLOW_NODE" "$CLIENT_JS" session-start "$SESSION_START_INPUT" 2>> "$DAEMON_LOG"); then
+      run_hook_client session-start "$SESSION_START_INPUT" 2>> "$DAEMON_LOG"); then
       DEVFLOW_DAEMON_REACHABLE=1
       DEVFLOW_SESSION_DURABLE=1
       DAEMON_SESSION_RESPONSE="$response"
@@ -180,13 +198,13 @@ run_lifecycle() {
 
   if [ -n "$SESSION_START_INPUT" ] && register_session 1; then
     :
-  elif [ -f "$DAEMON_JS" ] && command -v nohup >/dev/null 2>&1 && [ -x "$DEVFLOW_NODE" ]; then
+  elif command -v nohup >/dev/null 2>&1 && [ -x "$DEVFLOW_NODE" ]; then
     if [ -n "$SESSION_START_INPUT" ] && queue_session_start; then
-      nohup "$DEVFLOW_NODE" "$DAEMON_JS" "$PROJECT_ROOT" </dev/null >> "$DAEMON_LOG" 2>&1 &
+      start_hook_daemon "$PROJECT_ROOT"
     elif [ -n "$SESSION_START_INPUT" ]; then
-      nohup "$DEVFLOW_NODE" "$DAEMON_JS" "$PROJECT_ROOT" "$SESSION_START_INPUT" </dev/null >> "$DAEMON_LOG" 2>&1 &
+      start_hook_daemon "$PROJECT_ROOT" "$SESSION_START_INPUT"
     else
-      nohup "$DEVFLOW_NODE" "$DAEMON_JS" "$PROJECT_ROOT" </dev/null >> "$DAEMON_LOG" 2>&1 &
+      start_hook_daemon "$PROJECT_ROOT"
     fi
     DAEMON_PID=$!
     DEVFLOW_DAEMON_LAUNCHING=1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devflow-tools/claude-code-plugin",
-  "version": "0.18.38",
+  "version": "0.18.40",
   "description": "Claude Code hooks and skills for the DevFlow development intelligence runtime.",
   "type": "module",
   "scripts": {
@@ -12,20 +12,20 @@
     "verify:runtime-dependencies": "node --import tsx scripts/verify-runtime-dependencies.ts"
   },
   "dependencies": {
-    "@devflow-tools/benchmark": "0.18.38",
-    "@devflow-tools/context-engine": "0.18.38",
-    "@devflow-tools/database": "0.18.38",
-    "@devflow-tools/mcp-server": "0.18.38",
-    "@devflow-tools/memory-engine": "0.18.38",
-    "@devflow-tools/sdk": "0.18.38",
-    "@devflow-tools/semantic-engine": "0.18.38",
-    "@devflow-tools/server": "0.18.38",
-    "@devflow-tools/task-runtime": "0.18.38",
-    "@devflow-tools/telemetry": "0.18.38",
-    "@devflow-tools/workflow-engine": "0.18.38"
+    "@devflow-tools/benchmark": "0.18.40",
+    "@devflow-tools/context-engine": "0.18.40",
+    "@devflow-tools/database": "0.18.40",
+    "@devflow-tools/mcp-server": "0.18.40",
+    "@devflow-tools/memory-engine": "0.18.40",
+    "@devflow-tools/sdk": "0.18.40",
+    "@devflow-tools/semantic-engine": "0.18.40",
+    "@devflow-tools/server": "0.18.40",
+    "@devflow-tools/task-runtime": "0.18.40",
+    "@devflow-tools/telemetry": "0.18.40",
+    "@devflow-tools/workflow-engine": "0.18.40"
   },
   "devDependencies": {
-    "@devflow-tools/devflow": "0.18.38"
+    "@devflow-tools/devflow": "0.18.40"
   },
   "allowScripts": {
     "better-sqlite3@12.11.1": true,