@devflow-tools/cli 0.3.2 → 0.4.0

package/dist/plugin-files/dist/skills/devflow:tailwind/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: devflow:tailwind
+description: Tailwind 专家 — 响应式设计、主题定制、Purge 检查、Utility 审查
+---
+
+<HARD-GATE>
+收到 devflow:tailwind 时，必须先调用以下 MCP 工具之一：
+tailwind_new_component
+</HARD-GATE>
+
+
+
+# 🌊 TAILWIND
+
+你是一个 Tailwind CSS 专家。使用 utility-first 方法构建界面。遇到问题先查 Tailwind 官方文档。
+
+## 适用场景
+
+**新建 Tailwind 组件：语义结构 → 样式 → 响应式 → 暗色模式**
+
+**Utility 审查：清除自定义 CSS → 统一为 Tailwind utility**
+
+**主题迁移：分析现有设计 → 提取 Design Token → 生成配置**
+
+## 核心规则
+
+- 优先使用 Tailwind utility classes，避免自定义 CSS
+- 使用 Tailwind 响应式断点（sm/md/lg/xl/2xl）
+- 颜色和间距从 theme 配置中引用
+- 复杂样式使用 @apply 抽取
+- 使用 class 策略实现暗色模式
+- 避免内联 style 和自定义 CSS
+- 不确定 class 名称时先查 Tailwind 官方文档
+
+## 当前版本
+
+- tailwind-docs: 3.4.0 — https://tailwindcss.com/docs
+
+## 工作流
+
+| 场景 | 触发方式 |
+|------|----------|
+| 新建 Tailwind 组件：语义结构 → 样式 → 响应式 → 暗色模式 | 调用 MCP 工具 `tailwind_new_component` |
+| Utility 审查：清除自定义 CSS → 统一为 Tailwind utility | 调用 MCP 工具 `tailwind_audit:utility` |
+| 主题迁移：分析现有设计 → 提取 Design Token → 生成配置 | 调用 MCP 工具 `tailwind_migrate:theme` |

package/dist/plugin-files/dist/skills/devflow:taro/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: devflow:taro
+description: Taro 跨端专家 — 多端适配、小程序调试、性能优化、兼容方案
+---
+
+<HARD-GATE>
+收到 devflow:taro 时，必须先调用以下 MCP 工具之一：
+taro_new_page
+</HARD-GATE>
+
+
+
+# 🛠️ TARO
+
+你是一个 Taro 跨端开发专家。使用 Taro 内置组件和 API，确保多端兼容。遇到小程序问题先查文档，不凭经验猜测。
+
+## 适用场景
+
+**新建页面：** Taro 跨端页面 → 生成页面组件（兼容 H5/微信小程序），配置路由和导航栏。
+
+**跨端兼容检查：扫描平台 API → 识别风险点 → 建议兼容方案**
+
+**小程序调试：错误排查 → 包体积分析 → 性能检测**
+
+**小程序性能优化：包体积 → 渲染优化 → 加载速度**
+
+## 核心规则
+
+- 使用 Taro 内置组件（View、Text、Image）替代 HTML 元素
+- 使用 Taro API 替代浏览器 API
+- 避免使用 window/document 等 DOM API
+- 使用条件编译处理平台差异（process.env.TARO_ENV）
+- 样式使用 px 单位（Taro 自动转换）
+- 合理使用分包加载减少首屏体积
+- 不确定跨端兼容性时先查 Taro 文档确认
+
+## 当前版本
+
+- taro-docs: 3.6.0 — https://docs.taro.zone/docs/
+
+## 工作流
+
+| 场景 | 触发方式 |
+|------|----------|
+| 新建页面： | 调用 MCP 工具 `taro_new_page` |
+| 跨端兼容检查：扫描平台 API → 识别风险点 → 建议兼容方案 | 调用 MCP 工具 `taro_check:cross-platform` |
+| 小程序调试：错误排查 → 包体积分析 → 性能检测 | 调用 MCP 工具 `taro_debug:miniapp` |
+| 小程序性能优化：包体积 → 渲染优化 → 加载速度 | 调用 MCP 工具 `taro_optimize:performance` |

package/dist/plugin-files/dist/skills/devflow:vue/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: devflow:vue
+description: Vue 3 专家 — Bug 诊断、Composition API、响应式调试、组件重构
+---
+
+<HARD-GATE>
+收到 devflow:vue 时，必须先调用以下 MCP 工具之一：
+vue_diagnose_bug / vue_new_component / vue_debug_reactivity
+</HARD-GATE>
+
+
+
+# 💚 VUE
+
+你是一个 Vue 3 专家。使用 Composition API、<script setup> 和 TypeScript。遇到问题先查文档再给方案，不凭空猜测。
+
+## 适用场景
+
+**Bug 排查：** 组件渲染异常、响应式数据不同步 → 定位源码，检查 computed/watch 逻辑，搜索 Vue 官方文档验证 API 用法。
+
+**新建组件：** 按照项目 SFC 规范生成组件（template + script setup + style scoped），附带 Props/Emits/Slots 类型定义。
+
+**响应式调试：追踪数据流 → 定位问题 → 修复**
+
+**提取 Composable：识别重复逻辑 → 抽取 → 替换引用**
+
+**Pinia Store 重构：结构审查 → 拆分/合并 → 类型安全**
+
+## 核心规则
+
+- 使用 <script setup lang="ts"> 语法糖
+- 使用 Composition API（ref、reactive、computed、watch）
+- 状态管理使用 Pinia
+- 可复用逻辑抽取为 composables
+- 遇到不确定的 API 时先查 Vue 官方文档再回答
+- 修复 Bug 前先排查响应式数据流
+- 生成代码后必须通过 vue-tsc 类型检查
+- 不能凭记忆猜测 API 行为，必须基于当前项目版本
+
+## 当前版本
+
+- vue-docs: 3.4.0 — https://vuejs.org/guide/introduction.html
+
+## 工作流
+
+| 场景 | 触发方式 |
+|------|----------|
+| Bug 排查： | 调用 MCP 工具 `vue_diagnose_bug` |
+| 新建组件： | 调用 MCP 工具 `vue_new_component` |
+| 响应式调试：追踪数据流 → 定位问题 → 修复 | 调用 MCP 工具 `vue_debug_reactivity` |
+| 提取 Composable：识别重复逻辑 → 抽取 → 替换引用 | 调用 MCP 工具 `vue_extract:composable` |
+| Pinia Store 重构：结构审查 → 拆分/合并 → 类型安全 | 调用 MCP 工具 `vue_refactor:pinia` |

package/dist/plugin-files/dist/skills/devflow:workflow/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: devflow:workflow
+description: 执行标准化开发工作流 — Bug 修复、功能开发、代码审查
+---
+
+<HARD-GATE>
+收到 devflow:workflow 时，必须先调用以下 MCP 工具之一：
+run_workflow
+</HARD-GATE>
+
+
+
+# /devflow:workflow
+
+## 执行
+
+调用 `run_workflow` MCP 工具：
+
+```
+type = "bugfix" | "feature" | "review"
+input = 用户的查询内容
+```
+
+MCP 工具提供标准化的 DAG 步骤编排、人工确认节点、执行追踪和遥测记录。工作流执行过程中，MCP 工具会返回需要你介入的步骤，此时才根据步骤指引执行具体操作。

package/dist/plugin-files/hooks/constitution.md

@@ -0,0 +1,20 @@
+<EXTREMELY_IMPORTANT>
+你正在使用 DevFlow MCP Gateway。
+
+## MCP 优先原则
+
+收到 /devflow:* 命令时，必须先调用 SKILL.md 中列出的 MCP 工具。
+Hook 会自动拦截不符合规范的原生工具调用，并按提示引导你使用正确的 MCP 工具。
+
+正确流程：
+1. 调用 Skill 加载命令
+2. 立即调用 MCP 工具
+3. 基于 MCP 结果回答
+4. 如需补充信息，使用 Read 工具读取 MCP 未包含的关联文件
+
+绝对不要：
+- 在调用 MCP 之前用 grep/find/Glob/Explore 搜索代码
+- 用 WebSearch/WebFetch 替代 get_knowledge
+- 用 Agent(Explore) 替代 MCP 工具
+- 尝试绕过 Hook 拦截
+</EXTREMELY_IMPORTANT>

package/dist/plugin-files/hooks/post-tool-use

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# PostToolUse Hook — DevFlow post-correction
+# After AI uses a native tool that could have been an MCP tool, inject a corrective reminder.
+
+INPUT_JSON=$(cat)
+TOOL_NAME=$(python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    print(data.get('tool_name', ''))
+except:
+    print('')
+" <<< "$INPUT_JSON" 2>/dev/null || echo "")
+
+# Only interested in tools that could bypass MCP
+case "$TOOL_NAME" in
+  Agent|Bash|Glob|Grep|WebSearch|WebFetch)
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+
+# Determine project root and receipt file
+PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+RECEIPT_DIR="${TMPDIR:-/tmp}/.devflow-receipts"
+mkdir -p "$RECEIPT_DIR"
+SESSION_ID=$(echo -n "$PROJECT_ROOT" | shasum -a 256 2>/dev/null | cut -c1-16 || echo "default")
+RECEIPT_FILE="$RECEIPT_DIR/${SESSION_ID}.json"
+
+# Check if there was a recent MCP call (within 30s) — if yes, this native tool call is supplementary, not a bypass
+HAS_RECENT_MCP=false
+if [ -f "$RECEIPT_FILE" ]; then
+  last_call=$(python3 -c "
+import json, sys, time
+try:
+  with open('$RECEIPT_FILE') as f:
+    d = json.load(f)
+  ts = d.get('lastMcpCall', 0)
+  now = int(time.time())
+  if now - ts < 30:
+    print('valid')
+except:
+  pass
+" 2>/dev/null || echo "")
+  if [ "$last_call" = "valid" ]; then
+    exit 0
+  fi
+fi
+
+# Read current bypass count
+BYPASS_COUNT=0
+if [ -f "$RECEIPT_FILE" ]; then
+  BYPASS_COUNT=$(python3 -c "
+import json
+with open('$RECEIPT_FILE') as f:
+  d = json.load(f)
+print(d.get('bypassCount', 0))
+" 2>/dev/null || echo "0")
+fi
+
+# If no bypasses yet, nothing to correct
+if [ "$BYPASS_COUNT" -eq 0 ]; then
+  exit 0
+fi
+
+# Build corrective message based on tool type and count
+case "$TOOL_NAME" in
+  Agent)
+    MESSAGE="第 ${BYPASS_COUNT} 次违规：你刚才使用了 Agent 子代理执行搜索。下次请用 get_project_context MCP 工具替代。"
+    ;;
+  Bash)
+    MESSAGE="第 ${BYPASS_COUNT} 次违规：你刚才用了 Bash 命令搜索代码。下次请用 get_project_context MCP 工具替代。"
+    ;;
+  Glob)
+    MESSAGE="第 ${BYPASS_COUNT} 次违规：你刚才用了 Glob 匹配文件。下次请用 get_project_context MCP 工具替代。"
+    ;;
+  Grep)
+    MESSAGE="第 ${BYPASS_COUNT} 次违规：你刚才用了 Grep 搜索代码。下次请用 get_project_context MCP 工具替代。"
+    ;;
+  WebSearch|WebFetch)
+    MESSAGE="第 ${BYPASS_COUNT} 次违规：你刚才用了网络搜索。下次请用 get_knowledge MCP 工具替代。"
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+
+# Add enforcement status
+if [ "$BYPASS_COUNT" -ge 3 ]; then
+  MESSAGE="${MESSAGE} 已达到最大违规次数，后续绕过将被硬阻止。"
+elif [ "$BYPASS_COUNT" -ge 2 ]; then
+  MESSAGE="${MESSAGE} 下次违规将被阻止。"
+else
+  MESSAGE="${MESSAGE} 请立即纠正。"
+fi
+
+# Output as additionalContext injection
+if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
+  ESCAPED=$(printf '%s' "$MESSAGE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
+  printf '{"hookSpecificOutput":{"hookEventName":"PostToolUse","additionalContext":"%s"}}\n' "$ESCAPED"
+fi
+
+exit 0

package/dist/plugin-files/hooks/pre-tool-use

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# PreToolUse Hook — DevFlow unified command enforcement
+# Reads command-registry.json and receipt to dynamically intercept
+# native tool calls that bypass MCP Gateway.
+
+# ---- Read stdin (Claude Code passes JSON via stdin) ----
+INPUT_JSON=$(cat)
+TOOL_NAME=$(python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    print(data.get('tool_name', ''))
+except:
+    print('')
+" <<< "$INPUT_JSON" 2>/dev/null || echo "")
+
+TOOL_INPUT=$(python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    ti = data.get('tool_input', {})
+    if data.get('tool_name') == 'Agent':
+        out = {'subagent_type': ti.get('subagent_type',''),
+               'description': ti.get('description',''),
+               'prompt': ti.get('prompt','')}
+        print(json.dumps(out))
+    else:
+        print(ti.get('command') or ti.get('query') or ti.get('pattern') or json.dumps(ti))
+except:
+    print('')
+" <<< "$INPUT_JSON" 2>/dev/null || echo "")
+
+# ---- Locate registry ----
+PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+RECEIPT_DIR="${TMPDIR:-/tmp}/.devflow-receipts"
+SESSION_ID=$(echo -n "$PROJECT_ROOT" | shasum -a 256 2>/dev/null | cut -c1-16 || echo "default")
+RECEIPT_FILE="$RECEIPT_DIR/${SESSION_ID}.json"
+
+REGISTRY="${CLAUDE_PLUGIN_ROOT:-}/dist/command-registry.json"
+if [ ! -f "$REGISTRY" ]; then
+  REGISTRY="$HOME/.devflow/command-registry.json"
+fi
+
+# Fallback: built-in default rules when registry is missing
+if [ ! -f "$REGISTRY" ]; then
+  REGISTRY_CONTENT='{"commands":{"devflow:context":{"mcpTools":["get_project_context","search_symbol"],"blockedNative":["Grep","grep","find","rg","ag","Glob","Explore","WebSearch","WebFetch"]},"devflow:knowledge":{"mcpTools":["get_knowledge"],"blockedNative":["WebSearch","WebFetch"]},"devflow:graph":{"mcpTools":["get_dependency_graph"],"blockedNative":["Glob","Explore"]},"devflow:memory":{"mcpTools":["get_memory"],"blockedNative":["Grep","grep","find"]}}}'
+else
+  REGISTRY_CONTENT=$(cat "$REGISTRY")
+fi
+
+# ---- Phase 1: Is this tool devflow-relevant? ----
+is_devflow_relevant() {
+  local tool="$1" input="$2"
+  case "$tool" in
+    Bash)
+      echo "$input" | grep -qE "^(grep|find|rg|ag) " || return 1
+      # Exclude test/build/git commands
+      echo "$input" | grep -qE "(npm test|npm run|npx |git |python -m pytest|cargo test)" && return 1
+      return 0 ;;
+    Grep|Glob) return 0 ;;
+    Agent)
+      echo "$input" | grep -qiE "explore|search|find|code" && return 0
+      return 1 ;;
+    WebSearch|WebFetch) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+if ! is_devflow_relevant "$TOOL_NAME" "$TOOL_INPUT"; then
+  exit 0
+fi
+
+# ---- Phase 2: Read activeCommand from receipt ----
+ACTIVE_CMD=$(RECEIPT_FILE="$RECEIPT_FILE" python3 -c "
+import json, os
+try:
+    with open(os.environ.get('RECEIPT_FILE','')) as f:
+        print(json.load(f).get('activeCommand',''))
+except:
+    print('')
+" 2>/dev/null || echo "")
+
+# No activeCommand → no enforcement (user is not in a /devflow:* command)
+[ -z "$ACTIVE_CMD" ] && exit 0
+
+# ---- Phase 2.5: Dynamic interception from registry ----
+MCP_INFO=$(ACTIVE_CMD="$ACTIVE_CMD" python3 -c "
+import json, sys, os
+try:
+    r = json.load(sys.stdin)
+    cmd = r['commands'].get(os.environ.get('ACTIVE_CMD',''), {})
+    tools = cmd.get('mcpTools', [])
+    blocked = cmd.get('blockedNative', [])
+    print(json.dumps({'tools': tools, 'blocked': blocked}))
+except:
+    print('{}')
+" <<< "$REGISTRY_CONTENT" 2>/dev/null || echo "{}")
+
+MCP_TOOLS=$(echo "$MCP_INFO" | python3 -c "import sys,json; print(' / '.join(json.load(sys.stdin).get('tools',[])))" 2>/dev/null || echo "")
+
+# Extract blocked list as newline-separated for membership check
+BLOCKED=$(echo "$MCP_INFO" | python3 -c "
+import sys, json
+for item in json.load(sys.stdin).get('blocked', []):
+    print(item)
+" 2>/dev/null || echo "")
+
+# Check if current tool matches blockedNative from registry
+IS_BLOCKED=false
+case "$TOOL_NAME" in
+  Bash)
+    # Extract the base command (first word)
+    BASE_CMD=$(echo "$TOOL_INPUT" | awk '{print $1}')
+    case "$BASE_CMD" in
+      grep|find|rg|ag)
+        echo "$BLOCKED" | grep -qxF "$BASE_CMD" && IS_BLOCKED=true ;;
+    esac
+    ;;
+  Grep)
+    echo "$BLOCKED" | grep -qxF "Grep" && IS_BLOCKED=true ;;
+  Glob)
+    echo "$BLOCKED" | grep -qxF "Glob" && IS_BLOCKED=true ;;
+  Agent)
+    # Agent with explore/search intent → check Explore in blocked
+    if echo "$TOOL_INPUT" | grep -qiE "explore|search|find|code"; then
+      echo "$BLOCKED" | grep -qxF "Explore" && IS_BLOCKED=true
+    fi
+    ;;
+  WebSearch)
+    echo "$BLOCKED" | grep -qxF "WebSearch" && IS_BLOCKED=true ;;
+  WebFetch)
+    echo "$BLOCKED" | grep -qxF "WebFetch" && IS_BLOCKED=true ;;
+esac
+
+if [ "$IS_BLOCKED" = "true" ]; then
+  cat >&2 <<EOF
+━━━━━━ DevFlow Gateway ━━━━━━
+🛑 当前命令 ${ACTIVE_CMD} 禁止使用 ${TOOL_NAME}。
+请使用 MCP 工具: ${MCP_TOOLS}
+━━━━━━━━━━━━━━━━━━━━━━━━━━━
+EOF
+  exit 2
+fi
+
+exit 0

package/dist/plugin-files/hooks/session-start

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Try to get project summary from devflow doctor
+SUMMARY=""
+DOCTOR_OUTPUT=""
+
+# Try global devflow first, then npx fallback
+if command -v devflow &>/dev/null; then
+  DOCTOR_OUTPUT=$(devflow doctor --json 2>/dev/null || echo "")
+elif command -v npx &>/dev/null; then
+  DOCTOR_OUTPUT=$(npx --yes @devflow-tools/cli doctor --json 2>/dev/null || echo "")
+fi
+
+if [ -n "$DOCTOR_OUTPUT" ] && echo "$DOCTOR_OUTPUT" | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then
+  PROJECT_NAME=$(echo "$DOCTOR_OUTPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('project',{}).get('name','') or d.get('projectName',''))" 2>/dev/null || echo "")
+  FILES=$(echo "$DOCTOR_OUTPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('project',{}).get('files', d.get('indexedFiles','?')))" 2>/dev/null || echo "?")
+  TECH=$(echo "$DOCTOR_OUTPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); s=d.get('project',{}).get('techStack',[]); print(', '.join(s) if s else 'unknown')" 2>/dev/null || echo "unknown")
+  ENGINES=$(echo "$DOCTOR_OUTPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); e=d.get('engines',{}); print(' '.join([f'{k} {\"✓\" if v else \"✗\"}' for k,v in e.items()]))" 2>/dev/null || echo "")
+  PLUGINS=$(echo "$DOCTOR_OUTPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); p=d.get('plugins',[]); print(', '.join(p))" 2>/dev/null || echo "")
+
+  SUMMARY="DevFlow 已就绪。项目 ${PROJECT_NAME:-unknown} (${TECH})。${FILES} 个文件已索引。引擎：${ENGINES}。已装插件：${PLUGINS}。使用 /devflow:context 查代码，/devflow:react 获取 React 专家能力。"
+else
+  SUMMARY="DevFlow 插件已加载。如尚未初始化项目，请运行 devflow init。使用 /devflow 查看可用命令。"
+fi
+
+# Generate session token for MCP Gateway authentication
+SESSION_TOKEN=""
+if command -v devflow &>/dev/null; then
+  SESSION_TOKEN=$(devflow session token --expires 3600 2>/dev/null || echo "")
+elif command -v npx &>/dev/null; then
+  SESSION_TOKEN=$(npx --yes @devflow-tools/cli session token --expires 3600 2>/dev/null || echo "")
+fi
+
+TOKEN_VALUE=""
+if [ -n "$SESSION_TOKEN" ] && echo "$SESSION_TOKEN" | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then
+  TOKEN_VALUE=$(echo "$SESSION_TOKEN" | python3 -c "import sys,json; print(json.load(sys.stdin).get('token',''))" 2>/dev/null || echo "")
+fi
+
+# Clean up stale receipt from previous session
+PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+RECEIPT_DIR="${TMPDIR:-/tmp}/.devflow-receipts"
+mkdir -p "$RECEIPT_DIR" 2>/dev/null || true
+SESSION_ID=$(echo -n "$PROJECT_ROOT" | shasum -a 256 2>/dev/null | cut -c1-16 || echo "default")
+RECEIPT_FILE="$RECEIPT_DIR/${SESSION_ID}.json"
+OVERRIDE_FILE="$RECEIPT_DIR/${SESSION_ID}.override"
+rm -f "$RECEIPT_FILE" "$OVERRIDE_FILE" 2>/dev/null || true
+
+# Determine plugin root directory (same way as superpowers)
+if [ -z "${CLAUDE_PLUGIN_ROOT:-}" ]; then
+  SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+  PLUGIN_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+else
+  PLUGIN_ROOT="$CLAUDE_PLUGIN_ROOT"
+fi
+
+# Read DevFlow Constitution from file (avoids shell escaping issues)
+CONSTITUTION_FILE="${PLUGIN_ROOT}/skills/devflow/SKILL.md"
+if [ -f "${PLUGIN_ROOT}/hooks/constitution.md" ]; then
+  CONSTITUTION_FILE="${PLUGIN_ROOT}/hooks/constitution.md"
+fi
+
+if [ -f "$CONSTITUTION_FILE" ]; then
+  GLOBAL_CONSTRAINT=$(cat "$CONSTITUTION_FILE" 2>/dev/null || echo "DevFlow Constitution 加载失败")
+else
+  GLOBAL_CONSTRAINT="DevFlow Constitution 文件未找到。使用 /devflow: 命令时请优先调用 MCP 工具。"
+fi
+
+# Append Gateway status to summary
+GATEWAY_STATUS="\n\n━━━━━━ DevFlow Gateway ━━━━━━\n"
+# Check if devflow MCP server is configured (token will be auto-generated by ensureSessionToken)
+if [ -f ~/.claude/.mcp.json ] && grep -q '"devflow"' ~/.claude/.mcp.json 2>/dev/null; then
+  GATEWAY_STATUS="${GATEWAY_STATUS}Status: 🟢 DevFlow MCP 已配置\nGate 层数: 4 (宪法 → 派发 → 拦截 → 纠正)\n"
+elif [ -f .mcp.json ] && grep -q '"devflow"' .mcp.json 2>/dev/null; then
+  GATEWAY_STATUS="${GATEWAY_STATUS}Status: 🟢 DevFlow MCP 已配置（项目级）\nGate 层数: 4 (宪法 → 派发 → 拦截 → 纠正)\n"
+else
+  GATEWAY_STATUS="${GATEWAY_STATUS}Status: 🔴 未配置 DevFlow MCP Server\n请将 devflow MCP 配置加入 .mcp.json\n"
+fi
+GATEWAY_STATUS="${GATEWAY_STATUS}━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+SUMMARY="${SUMMARY}${GLOBAL_CONSTRAINT}${GATEWAY_STATUS}"
+
+# Escape for JSON
+ESCAPED=$(echo "$SUMMARY" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
+
+# Output context injection in Claude Code format
+if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
+  if [ -n "$TOKEN_VALUE" ]; then
+    ESCAPED_TOKEN=$(echo "$TOKEN_VALUE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
+    printf '{\n  "hookSpecificOutput": {\n    "hookEventName": "SessionStart",\n    "additionalContext": %s\n  },\n  "env": {\n    "DEVFLOW_SESSION_TOKEN": %s\n  }\n}\n' "$ESCAPED" "$ESCAPED_TOKEN"
+  else
+    printf '{\n  "hookSpecificOutput": {\n    "hookEventName": "SessionStart",\n    "additionalContext": %s\n  }\n}\n' "$ESCAPED"
+  fi
+fi
+
+exit 0

package/dist/plugin-files/hooks/stop

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Stop Hook — DevFlow session cleanup
+# Cleans up receipt/override files and outputs violation summary.
+
+PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+RECEIPT_DIR="${TMPDIR:-/tmp}/.devflow-receipts"
+SESSION_ID=$(echo -n "$PROJECT_ROOT" | shasum -a 256 2>/dev/null | cut -c1-16 || echo "default")
+RECEIPT_FILE="$RECEIPT_DIR/${SESSION_ID}.json"
+OVERRIDE_FILE="$RECEIPT_DIR/${SESSION_ID}.override"
+
+if [ -f "$RECEIPT_FILE" ]; then
+  # Read and output summary
+  python3 -c "
+import json
+with open('$RECEIPT_FILE') as f:
+  d = json.load(f)
+bypass = d.get('bypassCount', 0)
+print(f'会话违规统计: {bypass}/3')
+if bypass > 0:
+  print(f'最后一次拦截: {d.get(\"lastAttempt\", \"N/A\")}')
+" 2>/dev/null || true
+
+  # Cleanup
+  rm -f "$RECEIPT_FILE"
+fi
+
+rm -f "$OVERRIDE_FILE"
+
+exit 0

package/dist/plugin-files/hooks.json

@@ -0,0 +1,40 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/session-start\"",
+            "async": false
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash|Glob|Grep|WebSearch|WebFetch|Agent",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/pre-tool-use\"",
+            "async": false
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Bash|Glob|Grep|WebSearch|WebFetch|Agent",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/post-tool-use\"",
+            "async": false
+          }
+        ]
+      }
+    ]
+  }
+}

package/dist/plugin-files/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@devflow-tools/claude-code-plugin",
+  "version": "0.4.0",
+  "private": true,
+  "description": "DevFlow — Developer Intelligence Platform for Claude Code",
+  "type": "module",
+  "scripts": {
+    "build": "npx tsx scripts/inject-gates.ts",
+    "deploy": "npx tsx scripts/inject-gates.ts --deploy"
+  },
+  "keywords": [
+    "pi-package",
+    "skills",
+    "development",
+    "context",
+    "knowledge-base"
+  ],
+  "pi": {
+    "skills": [
+      "./skills"
+    ]
+  },
+  "files": [
+    "dist",
+    "hooks",
+    "hooks.json",
+    "skills"
+  ]
+}