devflow-kit 1.8.2 → 2.0.0

package/dist/cli/commands/compliance.js

@@ -0,0 +1,337 @@
+/**
+ * devflow compliance — Enable, disable, set, and check status of the compliance feature.
+ *
+ * Applies ADR-013: CLI-layer module; pure helpers in src/core/compliance.ts,
+ *   I/O orchestration in src/targets/claude-code/compliance-install.ts.
+ * Applies ADR-001: compliance is manifest-group (like proxy), not config.json-gated.
+ * Avoids PF-009: per-artifact failures are warn-not-throw.
+ * Avoids PF-015: enable/disable each converge BOTH artifacts unconditionally.
+ */
+import { Command } from 'commander';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import * as p from '@clack/prompts';
+import color from 'picocolors';
+import { ALWAYS_PRESENT_REFS, COMPLIANCE_FRAMEWORKS, normalizeFrameworks, parseFrameworkList, } from '../../core/compliance.js';
+import { frameworkChoices, FRAMEWORK_SELECT_MESSAGE } from './compliance-prompts.js';
+import { COMPLIANCE_SKILL_TOKENS } from '../../core/compliance-compose.js';
+import { readManifest, writeManifest } from '../../core/manifest.js';
+import { convergeFromManifest } from '../../targets/claude-code/compliance-install.js';
+import { validateRuleShadow, validateSkillShadow } from '../../targets/claude-code/installer.js';
+import { getClaudeDirectory, getDevFlowDirectory, } from '../../targets/claude-code/claude-paths.js';
+// ── Pure resolver ──────────────────────────────────────────────────────────────
+/**
+ * Pure resolver: maps (currentState × action) → (nextState, messages).
+ *
+ * D: Pure function — no I/O, fully testable without filesystem access.
+ *   The I/O layer (convergeComplianceArtifacts call, manifest write) is
+ *   always the caller's responsibility.
+ *   Messages for `enable` include framework IDs drawn from `current.frameworks`
+ *   as stored in the manifest, which may contain IDs not validated through
+ *   `parseFrameworkList` (e.g. if the manifest was hand-edited). The `set` case
+ *   receives `setFrameworks` which callers must pre-validate via parseFrameworkList.
+ *   The `status` action produces no messages. The `disable` action produces no IDs.
+ *
+ * Semantics:
+ *   enable  — restore: enabled:true, keep existing frameworks (bare --enable restores)
+ *   disable — keep:   enabled:false, frameworks remembered for re-enable
+ *   set     — replace: enabled:true, setFrameworks replaces exactly (zero allowed)
+ *   status  — no-op:  returns current unchanged
+ */
+export function resolveComplianceCliAction(current, action, setFrameworks) {
+    switch (action) {
+        case 'enable': {
+            if (current.enabled) {
+                return {
+                    nextState: current,
+                    messages: [{ level: 'info', text: 'Compliance already enabled' }],
+                };
+            }
+            const fwLabel = current.frameworks.length > 0
+                ? current.frameworks.join(', ')
+                : 'none (generic controls only)';
+            return {
+                nextState: { enabled: true, frameworks: current.frameworks },
+                messages: [{ level: 'success', text: `Compliance enabled (frameworks: ${fwLabel})` }],
+            };
+        }
+        case 'disable': {
+            return {
+                nextState: { enabled: false, frameworks: current.frameworks },
+                messages: [
+                    {
+                        level: 'success',
+                        text: 'Compliance disabled — artifacts removed, frameworks remembered for re-enable',
+                    },
+                ],
+            };
+        }
+        case 'set': {
+            const frameworks = setFrameworks ?? [];
+            const fwLabel = frameworks.length > 0
+                ? frameworks.join(', ')
+                : 'none (generic controls only)';
+            return {
+                nextState: { enabled: true, frameworks },
+                messages: [{ level: 'success', text: `Compliance enabled (frameworks: ${fwLabel})` }],
+            };
+        }
+        case 'status': {
+            return {
+                nextState: current,
+                messages: [],
+            };
+        }
+        default: {
+            const _exhaustive = action;
+            void _exhaustive;
+            return { nextState: current, messages: [] };
+        }
+    }
+}
+// ── Drift classification ───────────────────────────────────────────────────────
+/**
+ * Classify a list of manifest framework IDs that are not currently installed.
+ * Separates valid (registry-known) IDs from invalid (unknown) IDs so the status
+ * display can recommend the correct remediation for each class.
+ *
+ * Called by the --status handler to compute drift between the manifest and
+ * installed artifacts. Also exported to allow unit testing of the classification
+ * logic in isolation.
+ */
+export function classifyDriftMissing(manifestFrameworks, installedRefIds, registryIds) {
+    const installedSet = new Set(installedRefIds);
+    const missing = manifestFrameworks.filter(id => !installedSet.has(id));
+    return {
+        validMissing: missing.filter(id => registryIds.has(id)),
+        invalidIds: missing.filter(id => !registryIds.has(id)),
+    };
+}
+// ── Status helpers ─────────────────────────────────────────────────────────────
+/** Returns true if the compliance skill dir exists at the install target. */
+async function skillInstalled(claudeDir) {
+    try {
+        await fs.access(path.join(claudeDir, 'skills', 'devflow:compliance'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Returns the set of installed framework reference IDs from the skill dir. */
+async function installedRefIds(claudeDir) {
+    const refDir = path.join(claudeDir, 'skills', 'devflow:compliance', 'references');
+    try {
+        const entries = await fs.readdir(refDir);
+        return entries
+            .filter(e => e.endsWith('.md') && !ALWAYS_PRESENT_REFS.includes(e))
+            .map(e => path.basename(e, '.md'))
+            // S58: sanitize — keep only entries whose basename matches the expected id
+            // shape (lowercase letters, digits, hyphens). Strips terminal-escape sequences
+            // or path segments that could be injected via a crafted filename.
+            .filter(id => /^[a-z0-9-]+$/.test(id));
+    }
+    catch {
+        return [];
+    }
+}
+/** Returns true if the compliance rule file exists at the install target. */
+async function ruleInstalled(claudeDir) {
+    try {
+        await fs.access(path.join(claudeDir, 'rules', 'devflow', 'compliance.md'));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Returns true if a user shadow exists for the compliance rule. */
+async function ruleShadowed(devflowDir) {
+    const shadowFile = path.join(devflowDir, 'rules', 'compliance.md');
+    const state = await validateRuleShadow(shadowFile);
+    return state === 'valid';
+}
+/**
+ * Returns the shadow state for the compliance skill:
+ *   'none'               — no valid shadow present
+ *   'shadowed'           — shadow present and contains composition tokens (composed normally)
+ *   'composition-skipped'— shadow present but token-free (C1 passthrough, no per-framework sections)
+ *
+ * D: reported in --status so users know their shadow suppresses dynamic composition.
+ */
+async function skillShadowState(devflowDir) {
+    const shadowDir = path.join(devflowDir, 'skills', 'compliance');
+    const state = await validateSkillShadow(shadowDir);
+    if (state !== 'valid')
+        return 'none';
+    try {
+        const skillMd = await fs.readFile(path.join(shadowDir, 'SKILL.md'), 'utf-8');
+        const hasTokens = COMPLIANCE_SKILL_TOKENS.some(tok => skillMd.includes(tok));
+        return hasTokens ? 'shadowed' : 'composition-skipped';
+    }
+    catch {
+        return 'none';
+    }
+}
+export const complianceCommand = new Command('compliance')
+    .description('Enable, disable, or configure the compliance feature')
+    .option('--enable', 'Enable compliance (restores previously selected frameworks)')
+    .option('--disable', 'Disable compliance (artifacts removed; frameworks remembered for re-enable)')
+    .option('--status', 'Show compliance state: manifest, installed artifacts, and shadow presence')
+    .option('--set <list>', 'Set active frameworks (comma-separated IDs); enables compliance. Use --set "" for zero frameworks (generic controls only)')
+    .action(async (options) => {
+    const claudeDir = getClaudeDirectory();
+    const devflowDir = getDevFlowDirectory();
+    const hasFlag = options.enable || options.disable || options.status || options.set !== undefined;
+    if (!hasFlag) {
+        p.intro(color.bgCyan(color.white(' Compliance ')));
+        const validIds = COMPLIANCE_FRAMEWORKS.map(fw => `${fw.id} — ${fw.hint}`).join('\n  ');
+        p.note(`${color.cyan('devflow compliance --enable')}   Enable compliance (restores prior frameworks)\n` +
+            `${color.cyan('devflow compliance --disable')}  Disable compliance (frameworks remembered)\n` +
+            `${color.cyan('devflow compliance --status')}   Show current state and installed artifacts\n` +
+            `${color.cyan('devflow compliance --set <ids>')} Set active frameworks and enable\n\n` +
+            `Valid framework IDs:\n  ${validIds}`, 'Usage');
+        p.outro(color.dim('Compliance rules are stamped with the active framework labels'));
+        return;
+    }
+    // Validate --set input before any I/O (parse-don't-validate at boundary)
+    let setFrameworks;
+    if (options.set !== undefined) {
+        const parsed = parseFrameworkList(options.set);
+        if (!parsed.ok) {
+            p.log.error(parsed.error);
+            process.exit(1);
+        }
+        setFrameworks = parsed.value;
+    }
+    const manifest = await readManifest(devflowDir);
+    if (!manifest) {
+        p.log.error('No manifest found. Run devflow init first.');
+        process.exit(1);
+    }
+    const current = manifest.features.compliance;
+    // ── Status ─────────────────────────────────────────────────────────────────
+    if (options.status) {
+        const enabledLabel = current.enabled ? color.green('enabled') : color.dim('disabled');
+        const fwLabel = current.frameworks.length > 0
+            ? current.frameworks.join(', ')
+            : color.dim('none declared');
+        const rulesEnabled = manifest.features.rules;
+        const [skillOk, refIds, ruleOk, isRuleShadowed, skillShadow] = await Promise.all([
+            skillInstalled(claudeDir),
+            installedRefIds(claudeDir),
+            ruleInstalled(claudeDir),
+            ruleShadowed(devflowDir),
+            skillShadowState(devflowDir),
+        ]);
+        // Detect framework drift: manifest says X, installed refs say Y.
+        // Invalid IDs (not in the registry) are reported separately from valid-but-missing
+        // IDs so the suggested remediation is correct: --enable can reconcile valid IDs,
+        // but only --set can remove IDs that are not in the registry.
+        const registrySet = new Set(COMPLIANCE_FRAMEWORKS.map(fw => fw.id));
+        const manifestSet = new Set(current.frameworks);
+        const driftInstalled = refIds.filter(id => !manifestSet.has(id));
+        const { validMissing, invalidIds } = classifyDriftMissing(current.frameworks, refIds, registrySet);
+        const lines = [
+            `State:      ${enabledLabel}`,
+            `Frameworks: ${fwLabel}`,
+            '',
+            `Skill:      ${skillOk ? color.green('installed') : color.dim('not installed')}` +
+                (skillShadow === 'composition-skipped'
+                    ? color.yellow(' [shadowed, composition skipped — per-framework sections absent]')
+                    : skillShadow === 'shadowed'
+                        ? color.green(' [shadowed]')
+                        : ''),
+            `Rule:       ${ruleOk ? color.green('installed') : color.dim('not installed')}` +
+                (!ruleOk && current.enabled && !rulesEnabled
+                    ? color.yellow(' (withheld — rules disabled)')
+                    : '') +
+                (isRuleShadowed ? color.green(' [shadowed]') : ''),
+        ];
+        if (driftInstalled.length > 0 || validMissing.length > 0 || invalidIds.length > 0) {
+            lines.push('');
+            if (driftInstalled.length > 0 || validMissing.length > 0) {
+                lines.push(color.yellow('Artifact drift detected (run devflow compliance --enable to reconcile):'));
+                if (driftInstalled.length > 0) {
+                    lines.push(`  Installed not in manifest: ${driftInstalled.join(', ')}`);
+                }
+                if (validMissing.length > 0) {
+                    lines.push(`  In manifest but not installed: ${validMissing.join(', ')}`);
+                }
+            }
+            for (const id of invalidIds) {
+                lines.push(color.red(`  unknown framework id in manifest (ignored): ${id} — remove with --set`));
+            }
+        }
+        p.note(lines.join('\n'), 'Compliance Status');
+        return;
+    }
+    // ── Enable / Disable / Set ─────────────────────────────────────────────────
+    if (options.enable && options.disable) {
+        p.log.error('--enable and --disable are mutually exclusive: specify only one.');
+        process.exit(1);
+    }
+    let action;
+    if (options.set !== undefined) {
+        action = 'set';
+    }
+    else if (options.enable) {
+        // TTY: prompt for frameworks if no --set provided
+        if (process.stdin.isTTY && current.frameworks.length === 0) {
+            // Multiselect for frameworks when enabling interactively and no prior selection
+            p.note(COMPLIANCE_FRAMEWORKS.map(fw => `${color.cyan(fw.id)} — ${fw.hint}`).join('\n'), 'Available Frameworks');
+            const selected = await p.multiselect({
+                message: FRAMEWORK_SELECT_MESSAGE,
+                options: frameworkChoices(),
+                initialValues: current.frameworks,
+                required: false,
+            });
+            if (p.isCancel(selected)) {
+                p.cancel('Cancelled');
+                return;
+            }
+            setFrameworks = selected;
+            action = 'set';
+        }
+        else {
+            action = 'enable';
+        }
+    }
+    else {
+        action = 'disable';
+    }
+    const resolved = resolveComplianceCliAction(current, action, setFrameworks);
+    // Converge artifacts (PF-015: always converge, never short-circuit)
+    await convergeFromManifest({
+        claudeDir,
+        devflowDir,
+        manifest: { features: { compliance: resolved.nextState, rules: manifest.features.rules } },
+        warn: (msg) => p.log.warn(msg),
+    });
+    // Persist to manifest — normalizeFrameworks deduplicates (e.g. --set gdpr,GDPR → [gdpr])
+    manifest.features.compliance = {
+        enabled: resolved.nextState.enabled,
+        frameworks: normalizeFrameworks(resolved.nextState.frameworks),
+    };
+    manifest.updatedAt = new Date().toISOString();
+    await writeManifest(devflowDir, manifest);
+    // Emit messages
+    for (const msg of resolved.messages) {
+        switch (msg.level) {
+            case 'success':
+                p.log.success(msg.text);
+                break;
+            case 'warn':
+                p.log.warn(msg.text);
+                break;
+            default:
+                p.log.info(msg.text);
+                break;
+        }
+    }
+    if (resolved.nextState.enabled && !manifest.features.rules) {
+        p.log.info(color.dim('Note: compliance rule withheld (rules disabled) — ' +
+            'run `devflow rules --enable` to install the stamped rule'));
+    }
+});
+//# sourceMappingURL=compliance.js.map

package/dist/cli/commands/context.js

@@ -0,0 +1,66 @@
+import * as path from 'path';
+// ─── Context hook utilities ────────────────────────────────────────────────
+//
+// The session-start-context hook is always-on (registered unconditionally by
+// init, removed by uninstall). It has internal sentinel awareness per feature.
+const CONTEXT_HOOK_MARKER = 'session-start-context';
+/**
+ * Add the session-start-context hook to SessionStart in settings JSON.
+ * Idempotent — returns unchanged JSON if hook already present.
+ */
+export function addContextHook(settingsJson, devflowDir) {
+    if (hasContextHook(settingsJson)) {
+        return settingsJson;
+    }
+    const settings = JSON.parse(settingsJson);
+    if (!settings.hooks) {
+        settings.hooks = {};
+    }
+    const hookCommand = path.join(devflowDir, 'scripts', 'hooks', 'run-hook') + ` ${CONTEXT_HOOK_MARKER}`;
+    const newEntry = {
+        hooks: [
+            {
+                type: 'command',
+                command: hookCommand,
+                timeout: 10,
+            },
+        ],
+    };
+    if (!settings.hooks.SessionStart) {
+        settings.hooks.SessionStart = [];
+    }
+    settings.hooks.SessionStart.push(newEntry);
+    return JSON.stringify(settings, null, 2) + '\n';
+}
+/**
+ * Remove the session-start-context hook from settings JSON.
+ * Idempotent — returns unchanged JSON if hook not present.
+ * Preserves all other SessionStart hooks.
+ */
+export function removeContextHook(settingsJson) {
+    const settings = JSON.parse(settingsJson);
+    if (!settings.hooks?.SessionStart) {
+        return settingsJson;
+    }
+    const before = settings.hooks.SessionStart.length;
+    settings.hooks.SessionStart = settings.hooks.SessionStart.filter((matcher) => !matcher.hooks.some((h) => h.command.includes(CONTEXT_HOOK_MARKER)));
+    if (settings.hooks.SessionStart.length === before) {
+        return settingsJson;
+    }
+    if (settings.hooks.SessionStart.length === 0) {
+        delete settings.hooks.SessionStart;
+    }
+    if (Object.keys(settings.hooks).length === 0) {
+        delete settings.hooks;
+    }
+    return JSON.stringify(settings, null, 2) + '\n';
+}
+/**
+ * Check if the session-start-context hook is present in settings JSON.
+ * Accepts either a JSON string or a parsed Settings object.
+ */
+export function hasContextHook(input) {
+    const settings = typeof input === 'string' ? JSON.parse(input) : input;
+    return settings.hooks?.SessionStart?.some((matcher) => matcher.hooks.some((h) => h.command.includes(CONTEXT_HOOK_MARKER))) ?? false;
+}
+//# sourceMappingURL=context.js.map

package/dist/cli/commands/debug.js

@@ -0,0 +1,122 @@
+import { Command } from 'commander';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import * as p from '@clack/prompts';
+import color from 'picocolors';
+import { getClaudeDirectory, getHomeDirectory } from '../../targets/claude-code/claude-paths.js';
+// ─── Pure functions — no I/O, fully testable ─────────────────────────────────
+/**
+ * Apply DEVFLOW_HOOK_DEBUG=1 to a settings JSON string.
+ * Returns a new serialized settings string. Does not mutate.
+ * Follows the applyFlags pattern from flags.ts.
+ */
+export function applyDebugTrace(settingsJson) {
+    const settings = JSON.parse(settingsJson);
+    settings.env ??= {};
+    settings.env.DEVFLOW_HOOK_DEBUG = '1';
+    return JSON.stringify(settings, null, 2) + '\n';
+}
+/**
+ * Remove DEVFLOW_HOOK_DEBUG from a settings JSON string.
+ * Removes the env object entirely when it becomes empty.
+ * Returns a new serialized settings string. Does not mutate.
+ * Follows the stripFlags pattern from flags.ts.
+ */
+export function stripDebugTrace(settingsJson) {
+    const settings = JSON.parse(settingsJson);
+    const env = settings.env;
+    if (env) {
+        delete env.DEVFLOW_HOOK_DEBUG;
+        if (Object.keys(env).length === 0) {
+            delete settings.env;
+        }
+    }
+    return JSON.stringify(settings, null, 2) + '\n';
+}
+/**
+ * Read the debug tracing state from a settings JSON string.
+ * Returns true when DEVFLOW_HOOK_DEBUG === '1'.
+ */
+export function readDebugStatus(settingsJson) {
+    const settings = JSON.parse(settingsJson);
+    const rawEnv = settings.env;
+    if (typeof rawEnv !== 'object' || rawEnv === null || Array.isArray(rawEnv))
+        return false;
+    return rawEnv.DEVFLOW_HOOK_DEBUG === '1';
+}
+// ─── Command — thin I/O wrapper over the pure functions ──────────────────────
+export const debugCommand = new Command('debug')
+    .description('Toggle hook debug tracing (DEVFLOW_HOOK_DEBUG)')
+    .option('--enable', 'Enable debug tracing (DEVFLOW_HOOK_DEBUG=1)')
+    .option('--disable', 'Disable debug tracing')
+    .option('--status', 'Show debug state and log location')
+    .action(async (options) => {
+    const claudeDir = getClaudeDirectory();
+    const settingsPath = path.join(claudeDir, 'settings.json');
+    if (options.status) {
+        // Status reads current state — parse settings independently of the
+        // shared read/parse/write pattern to keep the branch self-contained.
+        let settingsJson;
+        try {
+            settingsJson = await fs.readFile(settingsPath, 'utf-8');
+        }
+        catch {
+            settingsJson = '{}';
+        }
+        let enabled = false;
+        try {
+            enabled = readDebugStatus(settingsJson);
+        }
+        catch {
+            // malformed — treat as disabled
+        }
+        p.log.info(`Debug tracing: ${enabled ? color.green('enabled') : color.dim('disabled')}`);
+        const cwd = process.cwd();
+        const slug = cwd.replace(/^\//, '').replace(/\//g, '-');
+        const home = getHomeDirectory();
+        const logPath = path.join(home, '.devflow', 'logs', slug, '.hook-debug.log');
+        p.log.info(`Log file: ${color.dim(logPath)}`);
+        if (enabled) {
+            p.log.info(color.dim(`Tip: tail -f ${logPath}`));
+        }
+        return;
+    }
+    // Read current settings (shared by enable and disable paths)
+    let settingsJson;
+    try {
+        settingsJson = await fs.readFile(settingsPath, 'utf-8');
+    }
+    catch {
+        settingsJson = '{}';
+    }
+    if (options.enable) {
+        let updated;
+        try {
+            updated = applyDebugTrace(settingsJson);
+        }
+        catch {
+            p.log.error('settings.json is malformed — fix it before modifying env vars');
+            return;
+        }
+        await fs.writeFile(settingsPath, updated, 'utf-8');
+        p.log.success('Hook debug tracing enabled');
+        p.log.info(color.dim('Remember to disable after debugging: devflow debug --disable'));
+        return;
+    }
+    if (options.disable) {
+        let updated;
+        try {
+            updated = stripDebugTrace(settingsJson);
+        }
+        catch {
+            p.log.error('settings.json is malformed — fix it before modifying env vars');
+            return;
+        }
+        await fs.writeFile(settingsPath, updated, 'utf-8');
+        p.log.success('Hook debug tracing disabled');
+        return;
+    }
+    // No option — show usage
+    p.log.info('Usage: devflow debug --enable | --disable | --status');
+});
+//# sourceMappingURL=debug.js.map

package/dist/cli/commands/flags.js

@@ -0,0 +1,119 @@
+import { Command } from 'commander';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import * as p from '@clack/prompts';
+import color from 'picocolors';
+import { getClaudeDirectory, getDevFlowDirectory } from '../../targets/claude-code/claude-paths.js';
+import { FLAG_REGISTRY, applyFlags, stripFlags, getDefaultFlags } from '../../core/flags.js';
+import { readManifest, writeManifest } from '../../core/manifest.js';
+/**
+ * Resolve current enabled flags from manifest (falls back to defaults if no manifest).
+ */
+async function resolveEnabledFlags(devflowDir) {
+    const manifest = await readManifest(devflowDir);
+    if (manifest) {
+        return manifest.features.flags;
+    }
+    return getDefaultFlags();
+}
+/**
+ * Update settings.json with the given flag set.
+ */
+async function updateSettingsFlags(claudeDir, flagIds) {
+    const settingsPath = path.join(claudeDir, 'settings.json');
+    let content;
+    try {
+        content = await fs.readFile(settingsPath, 'utf-8');
+        // Validate that content is parseable JSON before passing to stripFlags/applyFlags
+        JSON.parse(content);
+    }
+    catch {
+        content = '{}';
+    }
+    const stripped = stripFlags(content);
+    const updated = applyFlags(stripped, flagIds);
+    await fs.writeFile(settingsPath, updated, 'utf-8');
+}
+/**
+ * Update manifest with the given flag set.
+ */
+async function updateManifestFlags(devflowDir, flagIds) {
+    const manifest = await readManifest(devflowDir);
+    if (!manifest)
+        return;
+    manifest.features.flags = flagIds;
+    manifest.updatedAt = new Date().toISOString();
+    await writeManifest(devflowDir, manifest);
+}
+/**
+ * Parse and validate comma-separated flag IDs against the registry.
+ * Exits with error if any IDs are unknown.
+ */
+function parseFlagIds(input) {
+    const ids = input.split(',').map(s => s.trim()).filter(Boolean);
+    const invalid = ids.filter(id => !FLAG_REGISTRY.some(f => f.id === id));
+    if (invalid.length > 0) {
+        p.log.error(`Unknown flag(s): ${invalid.join(', ')}`);
+        p.log.info(`Available: ${FLAG_REGISTRY.map(f => f.id).join(', ')}`);
+        process.exit(1);
+    }
+    return ids;
+}
+export const flagsCommand = new Command('flags')
+    .description('Manage Claude Code feature flags')
+    .option('--enable <ids>', 'Enable flag(s), comma-separated')
+    .option('--disable <ids>', 'Disable flag(s), comma-separated')
+    .option('--status', 'Show current flag states')
+    .option('--list', 'List all available flags')
+    .action(async (options) => {
+    const claudeDir = getClaudeDirectory();
+    const devflowDir = getDevFlowDirectory();
+    if (options.list) {
+        p.intro(color.bgCyan(color.black(' Claude Code Flags ')));
+        const defaults = new Set(getDefaultFlags());
+        for (const flag of FLAG_REGISTRY) {
+            const status = defaults.has(flag.id) ? color.green('default ON') : color.dim('default OFF');
+            const targetInfo = flag.target.type === 'env'
+                ? `env.${flag.target.key}`
+                : `setting.${flag.target.key}`;
+            p.log.info(`${color.bold(flag.id)} — ${flag.label} (${status})`);
+            p.log.info(`  ${color.dim(flag.description)} → ${color.dim(targetInfo)}`);
+        }
+        return;
+    }
+    if (options.status) {
+        p.intro(color.bgCyan(color.black(' Claude Code Flags ')));
+        const enabled = new Set(await resolveEnabledFlags(devflowDir));
+        for (const flag of FLAG_REGISTRY) {
+            const state = enabled.has(flag.id) ? color.green('enabled') : color.dim('disabled');
+            p.log.info(`${flag.id.padEnd(25)} ${state}`);
+        }
+        return;
+    }
+    if (options.enable) {
+        const ids = parseFlagIds(options.enable);
+        const current = await resolveEnabledFlags(devflowDir);
+        const updated = [...new Set([...current, ...ids])];
+        await updateSettingsFlags(claudeDir, updated);
+        await updateManifestFlags(devflowDir, updated);
+        for (const id of ids) {
+            p.log.success(`${id} enabled`);
+        }
+        return;
+    }
+    if (options.disable) {
+        const ids = parseFlagIds(options.disable);
+        const current = await resolveEnabledFlags(devflowDir);
+        const toDisable = new Set(ids);
+        const updated = current.filter(id => !toDisable.has(id));
+        await updateSettingsFlags(claudeDir, updated);
+        await updateManifestFlags(devflowDir, updated);
+        for (const id of ids) {
+            p.log.success(`${id} disabled`);
+        }
+        return;
+    }
+    // No option — show help
+    p.log.info('Usage: devflow flags --status | --list | --enable <ids> | --disable <ids>');
+});
+//# sourceMappingURL=flags.js.map