devflow-kit 0.9.0 → 1.1.0

package/CHANGELOG.md

@@ -5,6 +5,172 @@ All notable changes to DevFlow will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.0] - 2026-03-04
+
+### Added
+- **Ambient mode** — New `devflow-ambient` plugin with `/ambient` command for proportional quality enforcement
+  - Intent classification (BUILD/DEBUG/REVIEW/PLAN/EXPLORE/CHAT) auto-loads relevant skills
+  - Three depth tiers: QUICK (zero overhead), STANDARD (2-3 skills), ESCALATE (nudge to workflows)
+  - Always-on mode via `devflow ambient --enable` or `devflow init --ambient`
+  - New `ambient-router` skill for intent/depth classification
+  - New `test-driven-development` skill (auto-activates for BUILD tasks)
+  - Skills: 24 → 26, Plugins: 8 → 9
+- **Working memory enhancements** — Structured cross-session context preservation
+  - Structured sections: Now, Progress, Decisions, Modified Files, Context, Session Log
+  - Toggleable via `devflow memory --enable/--disable/--status` or `devflow init --memory/--no-memory`
+  - `PROJECT-PATTERNS.md` extraction — background hook accumulates patterns across sessions
+  - Directory separation: `.memory/` (session state) vs `.docs/` (reviews/design artifacts)
+  - Auto-migration from `.docs/` to `.memory/` with no-clobber semantics
+  - Auto-adds `.memory/` and `.docs/` to `.gitignore` on first hook run
+
+### Changed
+- **Background agent permissions** — Replaced `--dangerously-skip-permissions` with `--tools "Write"` + `--allowedTools` for restricted file access in memory update hooks
+- **Safe-delete auto-upgrade** — `devflow init` now detects outdated safe-delete blocks and silently upgrades them; no manual uninstall/reinstall needed
+
+### Fixed
+- **Ambient depth classification** — Intent now drives depth exclusively; removed 20-word threshold that silently downgraded ~32% of BUILD/DEBUG prompts to QUICK (#73)
+- **Safe-delete file existence** — Filter non-existent files before calling `trash` in bash/zsh, fish, and PowerShell Unix blocks; prevents noisy `trash: file doesn't exist` errors on `rm -f` of missing files (#74)
+- **Safe-delete deny list** — Expanded `rm` deny patterns from 8 to 21, covering `rm -r`, `rm -fr`, and `rm -f` flag variations that could bypass the `rm -rf`-only patterns (#74)
+
+---
+
+## [1.0.0] - 2026-02-25
+
+### Added
+- **Agent Teams integration** - Peer-to-peer agent collaboration across workflows
+  - `/code-review` uses adversarial review team with debate round and consensus findings
+  - `/implement` uses exploration and planning teams with debate, Shepherd↔Coder direct dialogue
+  - New `/debug` command for competing hypothesis investigation with agent teams
+  - `agent-teams` foundation skill with team spawning, challenge protocol, consensus formation
+  - Graceful fallback to parallel subagents when Agent Teams is unavailable
+- **`devflow-debug` plugin** - New plugin for bug investigation
+  - `/debug` command spawns 3-5 hypothesis investigators
+  - Adversarial debate where agents actively disprove each other's theories
+  - Root cause analysis report with confidence levels
+- **`accessibility` skill** - WCAG 2.1 AA patterns for keyboard navigation, ARIA, contrast
+  - Iron Law: EVERY INTERACTION MUST BE POSSIBLE WITHOUT A MOUSE
+  - Auto-triggers when creating UI components, forms, or interactive elements
+- **`frontend-design` skill** - Intentional visual design patterns (Anthropic's 4 Dimensions)
+  - Iron Law: AESTHETICS MUST HAVE INTENT
+  - AI slop detection (purple-pink gradients, Inter without rationale, everything centered)
+  - Auto-triggers when working with CSS, styling, or visual design
+- **Enhanced `react` skill** - Added 5 new categories from Vercel best practices
+  - Async Parallelization (Promise.all for independent fetches)
+  - Bundle Size (no barrel imports, lazy loading)
+  - Re-render Optimization (primitive deps, stable callbacks)
+  - Image Optimization (dimensions, lazy loading, aspect-ratio)
+  - Data Structure Performance (Set/Map for O(1) lookups)
+- **Conditional frontend reviews** in `/code-review` command
+  - `react` review (if .tsx/.jsx files changed)
+  - `accessibility` review (if .tsx/.jsx files changed)
+  - `frontend-design` review (if .tsx/.jsx/.css/.scss files changed)
+- **Glob pattern activation schema** for skills
+  - Skills can declare `activation.file-patterns` and `activation.exclude` in frontmatter
+  - Future-proofs for conditional skill loading
+- **`github-patterns` skill** - Foundation skill for GitHub API interactions
+  - Rate limiting patterns (1-2s delays, 60s wait if <10 remaining)
+  - Comment deduplication algorithms
+  - Line-in-diff validation for PR comments
+  - Issue data parsing (acceptance criteria, dependencies)
+  - Branch name generation from issues
+  - Tech debt management patterns (archive on overflow)
+  - Iron Law: RESPECT RATE LIMITS OR FAIL GRACEFULLY
+- **Unified `Git` agent** - Single parameterized agent for all git/GitHub operations
+  - `fetch-issue` operation: Fetches GitHub issue details with acceptance criteria and suggested branch name
+  - `comment-pr` operation: Creates PR inline comments with deduplication and rate limiting
+  - `manage-debt` operation: Updates tech debt backlog issue with semantic deduplication
+  - `create-release` operation: Creates GitHub release with version tag
+  - Replaces: GetIssue, Comment, TechDebt agents
+- **`git-workflow` skill** - Unified commit and PR patterns (atomic commits, message format, PR quality)
+  - Iron Law: ATOMIC COMMITS OR NO COMMITS
+  - Auto-triggers when staging files, creating commits, or opening PRs
+- **Iron Laws** - Every skill now has a single, non-negotiable core principle
+  - 24 Iron Laws across all skills (e.g., "NEVER THROW IN BUSINESS LOGIC", "NO FAKE SOLUTIONS")
+  - Automatically enforced when skills activate
+  - Consistent format: `## Iron Law` section in each SKILL.md
+- **Clarification Gates** for `/specify` command
+  - Gate 0: Confirm understanding before exploration
+  - Gate 1: Validate scope and priorities after exploration
+  - Gate 2: Confirm acceptance criteria before issue creation
+  - No gate may be skipped - explicit user approval required
+- **Security deny list** via OS-level managed settings (140 blocked operations)
+  - System destruction (rm -rf, dd, mkfs, shred)
+  - Code execution (curl|bash, eval, exec)
+  - Privilege escalation (sudo, su, doas, pkexec)
+  - Permission changes (chmod 777, chown root)
+  - System control (kill -9, reboot, shutdown)
+  - Data exfiltration (netcat, socat, telnet)
+  - Sensitive file reads (.env, SSH keys, AWS credentials)
+  - Package globals (npm -g, pip --system)
+  - Resource abuse (fork bombs, crypto miners)
+- **`ENABLE_TOOL_SEARCH`** environment variable in settings
+  - Deferred MCP tool loading until needed
+  - ~85% token reduction for conversations with many MCP tools
+- **Context usage percentage** in statusline
+  - Replaces binary "exceeds 200k" warning
+  - Color-coded: Green (<50%), Yellow (50-80%), Red (>80%)
+  - Calculated from `context_window.current_usage` data
+- **Working Memory hooks** — Automatic session continuity via stop/session-start/pre-compact hooks (#59)
+  - Background haiku updater writes `.docs/WORKING-MEMORY.md` asynchronously
+  - SessionStart hook injects previous memory + git state on startup
+  - mkdir-based locking for concurrent session safety
+- **Teams/no-teams command variants** — Install-time selection of Agent Teams vs parallel subagents (#61)
+  - `--teams`/`--no-teams` CLI flags with TTY confirmation prompt
+  - Variant-aware installer copies correct `.md` files
+  - `stripTeamsConfig()` removes teams env vars when disabled
+
+### Changed
+- **Lean agent and command redesign** - Major refactoring reducing 3,653 lines to 844 (-77%)
+  - Commands: `/implement` (479→182), `/specify` (631→179), `/devlog` (408→113), `/code-review` (312→136)
+  - Agents: Coder, Synthesizer, Reviewer, Git, Devlog, CatchUp, Skimmer, Simplifier
+  - Removed embedded bash scripts, verbose templates, redundant explanations
+  - Preserved all workflows, agent invocations, and architecture
+- **Agent model assignments** - Simplified to inherit vs haiku
+  - `inherit`: Coder, Reviewer, Simplifier, Skimmer (use orchestrator's model)
+  - `haiku`: Synthesizer, Git, Devlog, CatchUp (fast, simple operations)
+- `/specify` now requires explicit user confirmation at each gate
+- Statusline shows actual percentage instead of just large context warning
+- Settings template includes permissions.deny and env configuration
+- Commit and PR patterns now auto-activate via skills instead of requiring explicit commands
+- **Skills consolidation** — 28 skills merged to 24
+  - `test-design` + `tests-patterns` → `test-patterns`
+  - `commit` + `pull-request` → `git-workflow`
+  - `code-smell` absorbed into `core-patterns`
+  - `codebase-navigation` removed (redundant with Explore agent)
+  - `devflow-` prefix dropped from all skill names
+- **Managed settings** replace `--override-settings` flag — OS-level deny list installed to system-managed path, non-overridable by user settings
+- **CLAUDE.md creation removed** — opinionated template no longer forced on users during init
+- **`--teams` default flipped to off** — Agent Teams now opt-in via `--teams` flag
+- **`/review` renamed to `/code-review`** — Plugin directory, command files, CLI registry, and all cross-references updated for clarity
+- **Landing page** — Reference badge and repo homepage URL added
+
+### Removed
+- **`/commit` command** - Replaced by `git-workflow` skill (use `git commit` directly)
+- **`/pull-request` command** - Replaced by `git-workflow` skill (use `gh pr create` directly)
+- **`/breakdown` command** - Removed (use natural conversation or TodoWrite directly)
+- **`/release` command** - Removed (use manual release process)
+- **`/resolve-comments` command** - Removed (address PR comments directly)
+- **`/run` command** - Removed (use `/implement` for full lifecycle)
+- **`Commit` agent** - Patterns moved to `git-workflow` skill
+- **`PullRequest` agent** - Patterns moved to `git-workflow` skill
+- **`Release` agent** - Removed (use manual release process)
+- **`/catch-up` command** - Superseded by Working Memory hooks (automatic context restoration)
+- **`/devlog` command** - Superseded by Working Memory hooks (automatic session logging)
+- **`catch-up` agent** - No longer needed with automatic Working Memory
+- **`devlog` agent** - No longer needed with automatic Working Memory
+- **`GetIssue` agent** - Replaced by Git agent (operation: fetch-issue)
+- **`Comment` agent** - Replaced by Git agent (operation: comment-pr)
+- **`TechDebt` agent** - Replaced by Git agent (operation: manage-debt)
+
+### Fixed
+- **Statusline base branch detection** — Layered 4-tier fallback (branch reflog → HEAD reflog → `gh pr view` cache → main/master) replaces hardcoded main/master check; fixes incorrect diff stats for branches off `develop`, `staging`, etc. (#70)
+- **Stale CLAUDE.md in files array** — Removed from `package.json` after CLAUDE.md creation was dropped
+- **Skimmer agent** — Use `npx rskim` to eliminate global install requirement (#60)
+- **Working Memory throttle race** — Marker file prevents concurrent updater spawns during Agent Teams sessions (#62)
+- **Working Memory diagnostics** — stderr captured to log file instead of swallowed (#62)
+
+---
+
 ## [0.9.0] - 2025-12-04
 
 ### Added
@@ -74,7 +240,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Trust agent judgment after safety checks pass
   - Only abort for genuine issues (secrets, credentials)
   - Faster workflow without back-and-forth
-- **`/implement` command** - Streamlined from 507 to ~100 lines
+- **`/run` command** - Streamlined from 507 to ~100 lines (renamed from `/implement`)
   - Removed over-engineered interactive triage
   - Focus on efficient task execution
   - Only stop for genuine design decisions
@@ -127,7 +293,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Tracks completion status
 
 #### Enhanced Audit System
-- **Three-category reporting** - All 9 audit agents refactored for clearer feedback
+- **Three-category reporting** - All 9 review agents refactored for clearer feedback
   - **🔴 Issues in Your Changes** - NEW vulnerabilities/problems introduced (BLOCKING)
   - **⚠️ Issues in Code You Touched** - Problems near your changes (SHOULD FIX)
   - **ℹ️ Pre-existing Issues** - Legacy problems unrelated to PR (INFORMATIONAL)
@@ -142,7 +308,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 #### Code Review Command Rewrite
 - **Completely rewritten `/code-review` command** - Better orchestration and synthesis
-  - Orchestrates all audit sub-agents in parallel for faster execution
+  - Orchestrates all review sub-agents in parallel for faster execution
   - Synthesizes findings from three-category reports
   - Generates actionable summary with clear priorities
   - Separates blocking issues from informational findings
@@ -244,7 +410,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Automatic activation based on conversation context
 
 #### Smart Interactive Commands
-- **/implement command** - Orchestrator for guided feature implementation
+- **/run command** - Orchestrator for guided feature implementation (originally `/implement`)
   - Interactive workflow for planning, research, and execution
   - Integrates with project-state agent for context gathering
   - Guides through research, design, implementation, and testing phases
@@ -304,12 +470,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - **Statusline path resolution** - Use absolute paths instead of tilde (~) for reliable execution
-- **Audit report organization** - Formalized structured storage for all audit reports
-  - Branch-specific directories: `.docs/audits/<branch-name>/`
+- **Audit report organization** - Formalized structured storage for all review reports
+  - Branch-specific directories: `.docs/reviews/<branch-name>/`
   - Timestamped reports for historical tracking
-  - Standardized naming: `<audit-type>-report.<timestamp>.md`
+  - Standardized naming: `<review-type>-report.<timestamp>.md`
   - Standalone directory for direct agent invocations
-  - Applied consistently across all 9 audit agents
+  - Applied consistently across all 9 review agents
 
 ### Added
 - **Release notes persistence** - Save comprehensive release notes to `.docs/releases/RELEASE_NOTES_v<version>.md`
@@ -373,10 +539,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Never overwrites without explicit permission
 
 #### TypeScript Auditor Sub-Agent
-- **audit-typescript** - Specialized TypeScript code quality and type safety auditor
+- **review-typescript** - Specialized TypeScript code quality and type safety auditor
   - Conditional execution: Runs only if .ts/.tsx files changed OR tsconfig.json exists
   - Built-in detection logic (gracefully skips non-TypeScript projects)
-  - Comprehensive audits: type safety config, `any` usage, type assertions, branded types
+  - Comprehensive reviews: type safety config, `any` usage, type assertions, branded types
   - Advanced patterns: discriminated unions, immutability, Result types
   - Code quality: naming conventions, dependency injection, pure functions
   - Severity-based reporting (CRITICAL/HIGH/MEDIUM/LOW) with file:line references
@@ -424,17 +590,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 13. Provide verification links and next steps
 
 ### Changed
-- **Pre-commit workflow** - Integrated audit-typescript into 5-agent review
+- **Pre-commit workflow** - Integrated review-typescript into 5-agent review
   - Conditionally executes for TypeScript projects
   - No manual configuration needed
-- **Pre-PR workflow** - Integrated audit-typescript into comprehensive review
+- **Pre-PR workflow** - Integrated review-typescript into comprehensive review
   - Automatic TypeScript detection and execution
-  - Preserves existing audit orchestration patterns
+  - Preserves existing review orchestration patterns
 
 ### Documentation
 - Added `/release` command to README commands table
 - Added `release` sub-agent to README sub-agents table
-- Added `audit-typescript` sub-agent to README sub-agents table
+- Added `review-typescript` sub-agent to README sub-agents table
 - Created "Creating a Release" workflow section in README
 - Documented smart CLAUDE.md installation behavior
 - Included release automation in integration examples
@@ -443,7 +609,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.2.0] - 2025-10-16
 
 ### Added
-- **audit-documentation sub-agent** - Ensures documentation stays aligned with code
+- **review-documentation sub-agent** - Ensures documentation stays aligned with code
   - Validates README accuracy (installation, usage, examples)
   - Checks API documentation matches actual function signatures
   - Detects stale code comments and commented-out code
@@ -469,12 +635,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 - **Pre-commit strategy** - Lightweight 5-agent review for fast feedback
-  - Core audits: Security, Performance, Architecture, Tests, Complexity
+  - Core reviews: Security, Performance, Architecture, Tests, Complexity
   - Typical execution: 30-60 seconds
-  - Additional audits available on explicit request
+  - Additional reviews available on explicit request
 - **Pre-pr strategy** - Comprehensive 7-8 agent review
-  - All core audits plus Dependencies and Documentation
-  - Conditional Database audit (only if DB files changed)
+  - All core reviews plus Dependencies and Documentation
+  - Conditional Database review (only if DB files changed)
   - Typical execution: 2-3 minutes
   - Thorough branch review before PR creation
 - **Path handling** - No longer assumes HOME environment variable
@@ -493,8 +659,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Hardcoded path assumptions** - Proper fallbacks and environment overrides
 
 ### Documentation
-- Added audit-documentation to sub-agents table in README
-- Clarified audit strategies for pre-commit vs pre-pr
+- Added review-documentation to sub-agents table in README
+- Clarified review strategies for pre-commit vs pre-pr
 - Updated workflow examples with refined command usage
 
 ## [0.1.2] - 2025-10-05
@@ -545,13 +711,13 @@ DevFlow is an Agentic Development Toolkit designed to enhance Claude Code with i
 - `/debug [issue]` - Systematic debugging with issue-specific investigation
 
 #### Sub-Agents (Audit Specialists)
-- `audit-security` - Security vulnerability detection and analysis
-- `audit-performance` - Performance optimization and bottleneck detection
-- `audit-architecture` - Software architecture and design pattern analysis
-- `audit-tests` - Test quality and coverage analysis
-- `audit-dependencies` - Dependency management and security analysis
-- `audit-complexity` - Code complexity and maintainability assessment
-- `audit-database` - Database design and optimization review
+- `review-security` - Security vulnerability detection and analysis
+- `review-performance` - Performance optimization and bottleneck detection
+- `review-architecture` - Software architecture and design pattern analysis
+- `review-tests` - Test quality and coverage analysis
+- `review-dependencies` - Dependency management and security analysis
+- `review-complexity` - Code complexity and maintainability assessment
+- `review-database` - Database design and optimization review
 
 #### Workflow Sub-Agents
 - `catch-up` - Project status and context restoration with validation
@@ -560,7 +726,7 @@ DevFlow is an Agentic Development Toolkit designed to enhance Claude Code with i
 #### Features
 - **Smart Statusline** - Real-time project context display with git status and cost tracking
 - **Security & Optimization** - Automatic `.claudeignore` file creation for token efficiency
-- **Parallel Sub-Agent Execution** - Run multiple audits simultaneously for better performance
+- **Parallel Sub-Agent Execution** - Run multiple reviews simultaneously for better performance
 - **Git Safety** - Sequential git operations to prevent lock file conflicts
 - **Structured Documentation** - Organized tracking in `.docs/` directory
 
@@ -583,6 +749,8 @@ devflow init
 
 ---
 
+[1.1.0]: https://github.com/dean0x/devflow/compare/v1.0.0...v1.1.0
+[1.0.0]: https://github.com/dean0x/devflow/compare/v0.9.0...v1.0.0
 [0.9.0]: https://github.com/dean0x/devflow/releases/tag/v0.9.0
 [0.8.1]: https://github.com/dean0x/devflow/releases/tag/v0.8.1
 [0.8.0]: https://github.com/dean0x/devflow/releases/tag/v0.8.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 DevFlow Contributors
+Copyright (c) 2025-2026 DevFlow Contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal