@devflow-tools/claude-code-plugin 0.19.11 → 0.19.12

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "devflow",
   "description": "DevFlow — Developer Intelligence Platform: project context, code graph, knowledge base, memory engine, and workflow automation with 14 domain plugins",
-  "version": "0.19.11",
+  "version": "0.19.12",
   "author": {
     "name": "DevFlow"
   },

package/dist/command-registry.json

@@ -8,7 +8,7 @@
       ],
       "blockedNative": [],
       "source": "core",
-      "sourceVersion": "0.19.11",
+      "sourceVersion": "0.19.12",
       "requiresContext": false,
       "evidenceMode": "runtime",
       "skillPath": "skills/devflow:doctor/SKILL.md",
@@ -35,7 +35,7 @@
         "WebFetch"
       ],
       "source": "core",
-      "sourceVersion": "0.19.11",
+      "sourceVersion": "0.19.12",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:context/SKILL.md",
@@ -60,7 +60,7 @@
         "Explore"
       ],
       "source": "core",
-      "sourceVersion": "0.19.11",
+      "sourceVersion": "0.19.12",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:graph/SKILL.md",
@@ -79,7 +79,7 @@
         "WebFetch"
       ],
       "source": "core",
-      "sourceVersion": "0.19.11",
+      "sourceVersion": "0.19.12",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:knowledge/SKILL.md",
@@ -103,7 +103,7 @@
         "Explore"
       ],
       "source": "core",
-      "sourceVersion": "0.19.11",
+      "sourceVersion": "0.19.12",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:memory/SKILL.md",
@@ -119,7 +119,7 @@
       ],
       "blockedNative": [],
       "source": "core",
-      "sourceVersion": "0.19.11",
+      "sourceVersion": "0.19.12",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:workflow/SKILL.md",
@@ -154,7 +154,7 @@
       ],
       "blockedNative": [],
       "source": "core",
-      "sourceVersion": "0.19.11",
+      "sourceVersion": "0.19.12",
       "requiresContext": true,
       "evidenceMode": "mixed",
       "skillPath": "skills/devflow:delivery/SKILL.md",

package/dist/runtime-manifest.json

@@ -1,14 +1,14 @@
 {
   "manifestVersion": "devflow-runtime.v1",
-  "packageVersion": "0.19.11",
-  "sourceCommit": "a9cb69a06f0e49285d67614cb039eaf5deb39d93",
+  "packageVersion": "0.19.12",
+  "sourceCommit": "3f6d514b9a3a6115b05b1adca6ab6e34e14b932a",
   "bundleHashes": {
     "hooks": "858e24cc2bc01cdc69e47010e9e51eafc9d9230c9799a421821c3aa917f9c062",
-    "mcp": "0fa7e886d73d154311629ae3c16bb118eb938002af9da41f5d24daebb3ca708e",
+    "mcp": "426258c76db3c4032baafd4b3926795e053b2a3df1ae72f0f2425f2e3f1e3c99",
     "cli": "6205081f819ee3651962df36edd626b993a917fb8691f20c84e6b6e04af81d16"
   },
-  "registryHash": "467030836beede7accd7909089e905a1b188e714387e8f47853db9f4c557e3cc",
+  "registryHash": "7b889fac3e660b71b8eae63778a467eb6e9b3ead5649df9b5f381202bf49511c",
   "stateDbPath": "<projectRoot>/.devflow/delivery-line/state.db",
-  "builtAt": 1793867974816,
-  "manifestHash": "bc88f09432e0f641fc6eb7ca9156fda38ff6cc2ef63cdb3cc756c99ab43ddc46"
+  "builtAt": 1793876144270,
+  "manifestHash": "8db9db765e889947542eebea3a536462fe336ac000b773f4ce28f8ab03aeb8e4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devflow-tools/claude-code-plugin",
-  "version": "0.19.11",
+  "version": "0.19.12",
   "description": "Claude Code hooks and skills for the DevFlow development intelligence runtime.",
   "type": "module",
   "scripts": {
@@ -12,20 +12,20 @@
     "verify:runtime-dependencies": "node --import tsx scripts/verify-runtime-dependencies.ts"
   },
   "dependencies": {
-    "@devflow-tools/benchmark": "0.19.11",
-    "@devflow-tools/context-engine": "0.19.11",
-    "@devflow-tools/database": "0.19.11",
-    "@devflow-tools/mcp-server": "0.19.11",
-    "@devflow-tools/memory-engine": "0.19.11",
-    "@devflow-tools/sdk": "0.19.11",
-    "@devflow-tools/semantic-engine": "0.19.11",
-    "@devflow-tools/server": "0.19.11",
-    "@devflow-tools/task-runtime": "0.19.11",
-    "@devflow-tools/telemetry": "0.19.11",
-    "@devflow-tools/workflow-engine": "0.19.11"
+    "@devflow-tools/benchmark": "0.19.12",
+    "@devflow-tools/context-engine": "0.19.12",
+    "@devflow-tools/database": "0.19.12",
+    "@devflow-tools/mcp-server": "0.19.12",
+    "@devflow-tools/memory-engine": "0.19.12",
+    "@devflow-tools/sdk": "0.19.12",
+    "@devflow-tools/semantic-engine": "0.19.12",
+    "@devflow-tools/server": "0.19.12",
+    "@devflow-tools/task-runtime": "0.19.12",
+    "@devflow-tools/telemetry": "0.19.12",
+    "@devflow-tools/workflow-engine": "0.19.12"
   },
   "devDependencies": {
-    "@devflow-tools/devflow": "0.19.11"
+    "@devflow-tools/devflow": "0.19.12"
   },
   "allowScripts": {
     "better-sqlite3@12.11.1": true,
@@ -50,7 +50,7 @@
     "hooks",
     "skills"
   ],
-  "gitHead": "a9cb69a06f0e49285d67614cb039eaf5deb39d93",
+  "gitHead": "3f6d514b9a3a6115b05b1adca6ab6e34e14b932a",
   "license": "MIT",
   "repository": {
     "type": "git",

package/skills/devflow:delivery/SKILL.md

@@ -68,6 +68,18 @@ description: 通过可审计 Delivery Line 将需求推进到验证完成的 int
   作为默认交互，也不得由 agent 调用 MCP mutation 模拟用户批准或拒绝。
 - 审批必须始终通过原生 `AskUserQuestion` 选项完成；宿主会按当前 session 唯一待审批 gate 自动绑定并签名消费选择。只有用户明确输入兼容命令时才处理 `/devflow:approve`，不得把命令作为提示或默认交互。
 - `/devflow:revise`、`/devflow:cancel` 和 `/devflow:exit` 尚未注册为可信命令；仅使用当前 `nextActions` 已实现的路径，不得向用户展示不存在的命令。
+
+## 可信动作通道（trusted_action）
+
+需要用户裁决的敏感动作（取消案件 / 前台执行 / 提交审查）通过 pending decision 走宿主签名通道：
+
+- agent 调用 `mcp__plugin_devflow_devflow__delivery_propose_trusted_action`（action + payload）创建
+  `kind=trusted_action` 的 pending decision——**这是 agent 触发这些动作的唯一合法通道**（MCP 侧身份恒为
+  agent，直接调用 cancel/begin_foreground/submit_review 会被可信通道拒绝，这是设计而非故障）。
+- pending decision 会出现在 `delivery_status` 的 `pendingDecisions`；用 `AskUserQuestion` 原样展示
+  options（confirm/abort），宿主 hook 签名用户选择并消费决策。
+- 用户选 confirm → 动作以人类身份执行（cancel 生效 / 租约交给宿主会话 / 裁决入证据链）；选 abort →
+  决策消费、案件不变。
 - 审批返回后不要结束会话：立即调用 `delivery_status`，按返回的 `nextActions` 连续推进；只有出现新的
   人工 gate、明确 blocker、终态或用户明确暂停时才结束。
 - plan 审批后若 `nextActions` 包含 `resume`，先用 `AskUserQuestion` 询问执行方式（前台执行 / 后台 worker，