cc-devflow 4.5.12 → 4.5.13

package/.claude/skills/cc-review/CHANGELOG.md

@@ -1,5 +1,11 @@
 # CC-Review Changelog
 
+## 2.2.0 - 2026-05-13
+
+- split review exits by branch: plan and investigation reviews write findings directly into `task.md`
+- make implementation reviews return findings plus repair options and wait for the user's chosen fix before editing code
+- remove all other local review outputs; PR reviews are response/GitHub-only
+
 ## 2.1.2 - 2026-05-13
 
 - remove `no-op` routing from review output and use `stop` for clean/no-action endings

package/.claude/skills/cc-review/PLAYBOOK.md

@@ -13,7 +13,7 @@
 5. 可用 subagent 时可以派发只读 reviewer；raw output 留在会话里，主线程验证后再进入最终 findings。
 6. 不固定 finding 数量。证据决定输出。
 7. 每条 finding 必须有 evidence、impact、recommendation 和 route。
-8. 发现计划合同错误，回 `cc-plan`；发现代码错误，回 `cc-do`；只差验收，进 `cc-check`。
+8. 计划 review 的结果直接写回 `task.md`；执行 review 的结果先询问用户选择修复方案；只差验收，进 `cc-check`。
 
 ## Review Standard
 
@@ -30,4 +30,4 @@
 
 ## Decision Rule
 
-一个 finding 如果会改变范围、架构、用户可见行为、公共 API、测试策略或超过机械局部清理，必须进入用户决策队列或 reroute 到上游 skill。机械且低风险的问题可以作为 `cc-do` 的明确修复项，但 `cc-review` 自身不偷偷改代码。
+计划 review 发现的范围、架构、用户可见行为、公共 API、测试策略问题，必须直接写进 `task.md` 的合同、任务或开放问题里。执行 review 发现的问题必须在当前回复里给出修复选项，并询问用户是否修复以及选择哪种方案；用户选择后再直接修改代码并验证。

package/.claude/skills/cc-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cc-review
-version: 2.1.2
-description: Use when a plan, bug fix, PR, or implementation diff needs review findings. It finds concrete problems and routes them without writing process files.
+version: 2.2.0
+description: Use when a plan, bug fix, PR, or implementation diff needs review findings. Plan reviews write findings into task.md; implementation reviews ask the user to choose a repair option before fixing.
 triggers:
   - 深度 review 这个方案
   - review 这个复杂需求
@@ -21,14 +21,10 @@ writes:
   - path: current response
     durability: ephemeral
     required: true
-  - path: devflow/changes/<change-key>/handoff/pr-brief.md
+  - path: devflow/changes/<change-key>/task.md
     durability: durable
     required: false
-    when: review findings must be reflected in PR text
-  - path: devflow/postmortems/incidents/<date>-<change-key>.md
-    durability: durable
-    required: false
-    when: review exposes a recurring failure worth preserving
+    when: plan or investigation contract review changes the task contract
 effects:
   - optional deep review
   - read-only reviewer agent dispatch
@@ -43,6 +39,8 @@ entry_gate:
 exit_criteria:
   - Findings are listed first, ordered by severity and backed by concrete file/line, command, diff, UI, log, or missing-evidence proof.
   - Every finding has impact, recommendation, and route: cc-plan, cc-do, cc-check, cc-act, or stop.
+  - Plan or investigation review findings are written into the relevant `task.md` section before exit.
+  - Implementation review findings are returned with concrete repair options and a blocking user choice; no repair happens until the user selects an option.
   - In-scope code smells are either findings, explicit defers, or clean with reason.
   - If no issues are found, the answer says so and names residual test or evidence risk.
   - No process file was created.
@@ -69,9 +67,9 @@ tool_budget:
 
 ## Role
 
-`cc-review` 是可选的深度审查节点。它只做一件事：找出当前范围内真实存在的问题。
+`cc-review` 是可选的深度审查节点。它只做一件事：找出当前范围内真实存在的问题，并把问题放到正确出口。
 
-它不写过程文件，不维护 review 状态机。需要保留的事实进入 Git commit、PR 文件，或者在复发/事故场景进入尸检 incident。
+它不写 review 过程产物，不维护 review 状态机。计划 review 的事实写回 `task.md`；执行 review 的事实先进入当前回复，等用户选择修复方案后再修。PR review 只回对话或 GitHub review。
 
 ## Iron Law
 
@@ -99,6 +97,13 @@ Review 的价值在于问题质量，不在于过程记录数量。没有证据
 | `PR` | 用户要求 review PR | PR diff, body accuracy, CI/test proof, merge risk |
 | `mixed` | 方案和实现都变了 | plan contract first, then implementation conformance |
 
+## Exit Contract
+
+- Plan / investigation review: directly update `devflow/changes/<change-key>/task.md` with the review findings, decision options, blocked assumptions, and required task changes. Final response only summarizes what was written and the next route.
+- Implementation review: do not edit code during the review pass. Return findings plus repair options, ask the user which option to apply, and stop. After the user chooses, apply the selected repair directly and verify it.
+- PR review: return findings in the response or GitHub review only; do not write local files.
+- Clean review: say `No findings`, name residual verification risk, and route to `cc-check` or `stop`.
+
 ## Finding Rules
 
 每条 finding 必须包含：
@@ -118,11 +123,23 @@ Review 的价值在于问题质量，不在于过程记录数量。没有证据
 
 ## Output
 
-只输出当前回复或 GitHub review，不写过程文件。默认结构：
+按 review 类型输出：
+
+### Plan / Investigation Review
+
+先写 `task.md`，再简短回复：
+
+1. Findings written: `task.md` path and sections changed.
+2. Required task changes: task IDs or contract sections updated.
+3. Route: `cc-plan` / `cc-investigate` / `cc-do` / `stop`.
+
+### Implementation Review
+
+只在对话里组织结果并询问用户：
 
 1. Findings: severity, file/line, evidence, impact, fix.
-2. Questions: only when they block the next route.
-3. Risk: residual test or evidence gap.
-4. Route: `cc-plan` / `cc-do` / `cc-check` / `cc-act` / `stop`.
+2. Repair options: smallest safe fix, broader cleanup, defer with risk.
+3. Recommendation: one option and why.
+4. User choice needed: ask which option to apply.
 
 没有问题时直接说 `No findings`，并说明还没验证的风险。

package/.claude/skills/cc-review/references/implementation-review-branch.md

@@ -9,4 +9,4 @@ Read:
 
 Review behavior, regression risk, security, reliability, test quality, and code smells inside the current blast radius.
 
-Findings stay in the response or PR text. Do not write process files.
+Findings stay in the response. Ask which repair option to apply before editing code. Do not write process files.

package/.claude/skills/cc-review/references/plan-review-branch.md

@@ -6,4 +6,4 @@ Read:
 2. relevant roadmap or issue text
 3. affected code/tests/docs
 
-Find scope, architecture, test-strategy, and ambiguity problems. Report findings in the response only. Do not write review files.
+Find scope, architecture, test-strategy, and ambiguity problems. Write findings into `task.md`; final response only summarizes the changed sections. Do not write separate files.

package/CHANGELOG.md

@@ -9,6 +9,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.5.13] - 2026-05-13
+
+### Changed
+
+- Updated `cc-review` so plan and investigation reviews write findings directly into `task.md`.
+- Updated implementation reviews to return repair options and wait for the user's selected fix before editing code.
+- Removed all other local `cc-review` output surfaces.
+
 ## [4.5.12] - 2026-05-13
 
 ### Changed

package/docs/examples/example-bindings.json

@@ -7,7 +7,7 @@
     "cc-plan": "3.10.1",
     "cc-investigate": "1.6.1",
     "cc-do": "1.7.1",
-    "cc-review": "2.1.2",
+    "cc-review": "2.2.0",
     "cc-pr-review": "1.1.1",
     "cc-pr-land": "1.1.0",
     "cc-check": "1.12.1",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "cc-devflow",
-    "version": "4.5.12",
+    "version": "4.5.13",
     "description": "Multi-platform CLI and skill pack for agent coding",
     "main": "bin/cc-devflow.js",
     "bin": {