devflow-kit 2.2.0 → 2.4.0

package/CHANGELOG.md

@@ -5,6 +5,49 @@ All notable changes to Devflow will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.0] - 2026-09-01
+
+### Added
+- **`suppress-attribution` flag** (optional boolean, default OFF): when enabled, writes `{"commit":"","pr":""}` to the `attribution` key in `settings.json`, suppressing Claude attribution trailers in git commits and PRs. Disabling (or uninstalling) removes the `attribution` key only when its current value exactly matches that managed shape — a custom attribution object is preserved, while enabling always replaces the existing value. Toggle via `devflow flags --enable/--disable suppress-attribution`.
+- **Attribution wizard step in Advanced init** (D27): the Advanced-mode `devflow init` wizard asks one attribution question after the compliance step. Recommended init never asks; it silently applies the seeded value (off by default on a fresh install). The non-interactive path is `devflow flags --enable/--disable suppress-attribution` — there is no `--attribution` init flag.
+
+### Changed
+- **`templates/settings.json` no longer ships an `attribution` block**: fresh installs now emit Claude attribution in git commits and PRs by default (where every prior install suppressed it). Existing installs are unaffected — see Upgrade note below.
+- **`devflow:git` skill**: commit and PR templates no longer carry a hard-coded `Co-Authored-By: Claude` trailer or `Generated with Claude Code` footer. Attribution suppression is now an opt-in flag (`suppress-attribution`) rather than a hard-coded default.
+- **Routing runtime pinned to `subswitch@0.4.0`** (from `0.2.0`). Over-window Anthropic-bound request bodies are now streamed upstream instead of being rejected by the relay, so long prompts no longer fail at the proxy; only translated (Codex) routes still return `413 request_too_large`. `buildRoutingConfigJson` no longer injects `anthropic.connectTimeoutMs` — the relay's own default (10 s, connect-only) governs; user-set values are preserved as before. The injection was a 0.2.0-era workaround artifact that outlived its purpose once the key's semantics were narrowed to DNS+TCP connect only.
+
+### Fixed
+- **`proxy-routing.json` upgrade safety**: `buildRoutingConfigJson` now strips all seven `limits.*` sub-keys that `subswitch@0.4.0` promotes to hard startup errors: `limits.maxBodyBytes` (renamed `limits.maxBufferedBodyBytes`), `limits.maxUpstreamSockets` (moved to `anthropic.maxUpstreamSockets`), `limits.streamIdleTimeoutMs` (moved to `providers.codex.streamIdleTimeoutMs`), `limits.requestTimeoutMs` (moved to `providers.codex.requestTimeoutMs`), and `limits.maxSseEventBytes` (moved to `providers.codex.maxSseEventBytes`), joining the existing strips for `anthropic.streamIdleTimeoutMs`, `limits.connectTimeoutMs`, and `limits.maxConcurrentRequests`. A hand-edited config carrying any of these keys would have killed the relay on every session start — spawned by the `ensure-proxy` hook, with no route back. The `limits` block is now omitted entirely when all its sub-keys are stripped (matching the `anthropic` block's existing omit-when-empty behaviour).
+
+**Upgrade**: no action required. If you hand-edited `~/.devflow/proxy-routing.json` to set any of the seven stripped `limits.*` keys, move their values to the 0.4.0 target paths (`limits.maxBufferedBodyBytes`, `anthropic.maxUpstreamSockets`, or the appropriate `providers.codex.*` key); the next `devflow proxy --enable` drops the stale keys for you.
+
+**Upgrade (attribution)**: existing installs that carry the devflow-managed `attribution` block — written by prior versions' `templates/settings.json` — keep their suppression. On the next `devflow init` or any `devflow flags` write, the managed block is detected and adopted into the manifest as `suppress-attribution: true` automatically, so no manual action is required. Installs with a custom `attribution` value are also unaffected — the shape guard prevents any modification.
+
+---
+
+## [2.3.0] - 2026-08-31
+
+### Added
+- **`refresh-anchor` ledger op**: post-promotion reinforcement now reaches rendered output. When the Learning agent reinforces an already-anchored observation (sharpening its `pattern`/`details`), calling `refresh-anchor <anchor_id>` re-projects the updated log row through the same `toLedgerRow` projector as `assign-anchor` and re-renders all three `.md` files. Previously, post-promotion sharpening was written to the log but never projected forward, so the rendered entry silently froze at its first-promotion snapshot.
+
+### Changed
+- **`decisions-ledger.jsonl` is now the anchor registry only (ADR-022)**: `decisions-log.jsonl` is the content authority; the ledger holds anchor numbers and `decisions_status` only. Entry content reaches the ledger exclusively through `assign-anchor` (first promotion) and `refresh-anchor` (post-promotion re-projection) via `toLedgerRow`. The Learning agent's previously sanctioned path of editing ledger rows directly is removed — content changes go to the log, then `refresh-anchor` re-projects. Tooling that reads or writes `decisions-ledger.jsonl` directly is affected.
+- **`/resolve` DUPLICATE verdict**: `/resolve` now collapses duplicate cross-reviewer findings via a new `DUPLICATE` triage verdict — resolution-summary counts unique issues, with a `Duplicates Collapsed` statistics row and a `## Duplicates` section for traceability.
+
+### Fixed
+- **Semicolon-safe `details` field parsing**: the decisions formatter now splits `details` into fields using a segment-aware parser (`segmentDetails`) instead of delimiter regexes. The parser recognises a segment as a new field only when it starts with a known key name followed by `:` (anchored to segment start); semicolons inside values are preserved. Fixes four related defects: truncation at the first internal semicolon, unanchored-key false match (e.g. `reissue:` matching `issue:`), first-match-wins hijack (a key name mentioned inside an earlier value would capture the wrong segment), and newline breakage. Measured blast radius on this repo's own ledger: 111 truncated field extractions before the fix, 0 after. **Installed projects' rendered decisions/pitfalls `.md` may show one-time `--check` drift under the new parser — self-heals on the next ledger op.**
+- **Armed double-assign guard**: `assign-anchor` now writes `anchor_id` back to the log row on promotion, enabling the guard that prevents re-anchoring an already-anchored observation. Previously `anchor_id` was never written back, so the guard was permanently inert and running `assign-anchor` twice on the same observation silently minted two anchors.
+- **Pitfall date stamping and render date-purity**: `assign-anchor` now stamps a `date` field on all entry types (decisions and pitfalls). Previously only decision rows received a date stamp, leaving the 7-day protection window permanently inert for all pitfall entries. Render formatters now use `row.date || ''` (D5) instead of reading the clock, making renders deterministic and avoiding phantom date changes on re-render.
+- **Amendments rendering**: `formatAmendmentsLine` renders the `amendments` field as a `- **Amendments**: ...` line in the entry body. Previously the projected `amendments` field was never rendered, so amendment notes were lost at the `.md` level. Index extraction regexes are now line-anchored (`/m` flag) to prevent amendment text that mentions `- **Status**:` or `- **Area**:` from hijacking the extracted values.
+- **Working memory worker staged-write CAS** (closes #306): the background memory worker now writes to `WORKING-MEMORY.md.new` (staged file, never the real path) and compare-and-swaps into place only if `WORKING-MEMORY.md` is byte-identical to the pre-run snapshot. Previously the success check accepted any mtime bump on a file whose line 1 carried the stamp prefix — including a human's own concurrent edit — and on that false success the worker deleted the unprocessed queue batch and touched `.last-refresh-ok`, producing silent loss of captured turns under a healthy freshness marker.
+- **Stamped pre-compact bootstrap**: `pre-compact-memory` now writes a HEAD SHA stamp on line 1 of `WORKING-MEMORY.md` (guarded by a 40-hex validation gate) and lays out the five canonical sections in fixed order. Previously the bootstrap ran without a stamp, producing "synced @ unknown" at the next SessionStart and an incorrect State-A classification that hid any real drift.
+- **Reconciliation-aware worker prompt**: the memory worker prompt now includes bounded git evidence since the last stamp, explicit reconciliation and expiry guidance, and a strict DONE definition (per PF-010). Addresses unbounded carry-forward, conversation-coined labels promoted to durable state, and no-expiry instruction.
+- **State-C orphaned `.processing` visibility**: `session-start-memory`'s State C queue-depth count now includes lines from any orphaned `.pending-turns.processing` file, not just `.pending-turns.jsonl`. Previously an orphaned `.processing` was invisible to the State C detector, so a CONFLICT-requeued batch did not show in the refresh-failing banner.
+- **`/resolve` base branch token**: resolution summaries now render the base branch name instead of a literal `{base}` token. Step 0b was not extracting `base_branch` while the summary template referenced it.
+- **render summary byte counts**: `render-decisions.cjs` now reports file sizes via `Buffer.byteLength()` instead of `String.length`. The em dash separator in index Area fields (U+2014, 3 UTF-8 bytes, 1 JS character) caused the logged index.md size to be 2 bytes per em dash in the rendered index under the old code.
+
+---
+
 ## [2.2.0] - 2026-08-25
 
 ### Changed
@@ -1192,6 +1235,8 @@ devflow init
 ---
 
 [Unreleased]: https://github.com/dean0x/devflow/compare/v2.0.0...HEAD
+[2.4.0]: https://github.com/dean0x/devflow/compare/v2.3.0...v2.4.0
+[2.3.0]: https://github.com/dean0x/devflow/compare/v2.2.0...v2.3.0
 [2.2.0]: https://github.com/dean0x/devflow/compare/v2.1.0...v2.2.0
 [2.1.0]: https://github.com/dean0x/devflow/compare/v2.0.1...v2.1.0
 [2.0.1]: https://github.com/dean0x/devflow/compare/v2.0.0...v2.0.1

package/dist/cli/commands/attribution-prompts.js

@@ -0,0 +1,144 @@
+/**
+ * Attribution prompt helpers for devflow init.
+ *
+ * CLI-layer module (ADR-013): prompt-rendering logic lives in src/cli/commands/,
+ * core business logic stays in src/core/.
+ *
+ * Applies PF-029: the gate is an exported pure predicate with an explicit isTTY guard,
+ * so --recommended (flag, no prompt) and the non-TTY fallback keep their promptless
+ * contracts and the reachability rule is unit-testable without a terminal.
+ * Applies PF-014: runAttributionStep never calls process.exit() or throws — callers
+ * own the cancel idiom (p.cancel + process.exit(0)), keeping try/finally cleanup safe.
+ *
+ * D27: suppress-attribution flag — gates Claude Code's AI-attribution injection.
+ * The question is ADVANCED-ONLY; Recommended never asks. See shouldRunAttributionStep.
+ *
+ * Shared DI seam (PromptOutcome, WizardPromptIO, clackNote, clackSelect) lives in
+ * prompt-io.ts — one definition, both wizard modules import from there (ADR-019).
+ */
+import { clackNote, clackSelect } from './prompt-io.js';
+// ── Gate predicate ─────────────────────────────────────────────────────────────
+/**
+ * Determines whether the attribution wizard step should run for a given init invocation.
+ *
+ * D27 — ADVANCED-ONLY. The attribution question is reachable from the Advanced path
+ * and nowhere else. This DIVERGES DELIBERATELY from shouldRunComplianceStep, which also
+ * runs on interactive Recommended: attribution rewrites the user's git history metadata,
+ * so Recommended stays a zero-question path and silently applies the seeded value
+ * (fresh install: off). Do not "restore symmetry" with the compliance gate.
+ *
+ * Gate table:
+ *
+ *   --advanced flag / re-init (banner path) / prompt → Advanced   → yes
+ *   Interactive mode-prompt → Recommended                         → NO (D27 divergence)
+ *   --recommended flag                                            → no
+ *   !isTTY (any mode)                                             → no
+ *
+ * Gating on the mode name is sound here because 'advanced' is only ever resolved on an
+ * interactive path (the Advanced branch exit-1s on non-TTY), and the explicit isTTY guard
+ * keeps the promptless contracts of --recommended and the non-TTY fallback pinned
+ * regardless (PF-029).
+ *
+ * There is no CLI override for attribution — it is toggled post-install via
+ * `devflow flags --enable/--disable suppress-attribution`.
+ *
+ * Pure predicate — no side effects, fully testable without a TTY.
+ */
+export function shouldRunAttributionStep(input) {
+    if (!input.isTTY)
+        return false;
+    return input.mode === 'advanced';
+}
+/**
+ * Build the real (clack) AttributionPromptIO adapter.
+ * Delegates to the shared clackNote / clackSelect adapters (prompt-io.ts).
+ */
+export function buildClackAttributionPrompts() {
+    return {
+        note: clackNote,
+        select: (opts) => clackSelect(opts),
+    };
+}
+// ── Seed / apply helpers ───────────────────────────────────────────────────────
+/**
+ * Derive the boolean seed for the attribution prompt from the current FlagsRecord.
+ *
+ * Returns true only when `suppress-attribution` is explicitly set to the boolean
+ * true — undefined, null, and false all map to false, giving `p.select` a real
+ * boolean rather than an unchecked cast (PF-018: non-vacuous path).
+ *
+ * Pure function — no side effects, fully testable without a TTY.
+ */
+export function attributionSeedFrom(flags) {
+    return flags['suppress-attribution'] === true;
+}
+/**
+ * Apply the resolved wizard answer back onto the FlagsRecord.
+ *
+ * Returns a new record with `suppress-attribution` updated to outcome.suppress.
+ * Never mutates the input (immutability principle). The caller replaces its local
+ * enabledFlags binding with the return value.
+ *
+ * D27: this is the single merge site for the wizard answer; init.ts must not
+ * duplicate the spread inline.
+ *
+ * Pure function — no side effects, fully testable without a TTY.
+ */
+export function applyAttributionAnswer(flags, outcome) {
+    return { ...flags, 'suppress-attribution': outcome.suppress };
+}
+/**
+ * Run the attribution wizard step.
+ *
+ * Flow:
+ *   1. Note — "Current setting: …" header with context about what the flag does.
+ *   2. Enable select — labeled Yes / No with hints (seeded from prior state);
+ *      p.select is immune to Enter-through muscle memory while still preserving
+ *      the seeded value (ambient-prompt style — per PF-029).
+ *
+ * Returns:
+ *   {kind:'resolved', suppress, messages} — step completed; `suppress` is the chosen
+ *     boolean; `messages` are emitted by the caller.
+ *   {kind:'cancelled'} — user pressed Escape; caller runs p.cancel + process.exit(0).
+ *
+ * Invariants (PF-014):
+ *   - Never calls process.exit(), never throws.
+ *   - All I/O is routed through the `prompts` parameter (injectable for tests).
+ */
+export async function runAttributionStep(opts) {
+    const { seed, prompts } = opts;
+    const currentStr = seed ? 'suppressed' : 'shown (default)';
+    // security-02: name the destructive branch (Yes) BEFORE the user consents.
+    // ADR-024 corollary (b): turning the flag ON replaces any existing attribution
+    // value, including a custom one — this is deliberate. Only the exact
+    // devflow-managed shape {"commit":"","pr":""} is removed on disable.
+    // security-04: surface the org AI-disclosure-policy dimension as a note (not a gate).
+    prompts.note(`Current setting: ${currentStr}\n\n` +
+        'Choosing Yes REPLACES any existing \`attribution\` value in settings.json,\n' +
+        'including a custom one, with {"commit":"","pr":""}.\n' +
+        'Choosing No leaves a custom value untouched — only the exact\n' +
+        'devflow-managed block is ever removed on disable.\n' +
+        'Some organisations require machine-readable AI-authorship disclosure\n' +
+        '— check your policy before enabling.\n\n' +
+        'Toggle any time with: devflow flags --enable suppress-attribution', 'AI Attribution');
+    const enableOutcome = await prompts.select({
+        message: 'Suppress AI attribution in commits and PRs?',
+        options: [
+            { value: true, label: 'Yes', hint: 'hides Claude attribution labels in git history' },
+            { value: false, label: 'No', hint: 'keeps Claude attribution labels (default)' },
+        ],
+        initialValue: seed,
+    });
+    if (enableOutcome.kind === 'cancel')
+        return { kind: 'cancelled' };
+    const suppress = enableOutcome.value;
+    const text = suppress
+        ? 'Attribution: suppressed — disable with devflow flags --disable suppress-attribution'
+        : 'Attribution: shown (default)';
+    return {
+        kind: 'resolved',
+        suppress,
+        messages: [{ level: suppress ? 'success' : 'info', text }],
+    };
+}
+//# sourceMappingURL=attribution-prompts.js.map

package/dist/cli/commands/compliance-prompts.js

@@ -9,9 +9,13 @@
  * no prompt) and the non-TTY fallback preserve their promptless contracts.
  * Applies PF-014: runComplianceStep never calls process.exit() or throws — callers
  * own the cancel idiom (p.cancel + process.exit(0)), keeping try/finally cleanup safe.
+ *
+ * Shared DI seam (PromptOutcome, WizardPromptIO, clackNote, clackSelect) lives in
+ * prompt-io.ts — one definition, both wizard modules import from there (ADR-019).
  */
 import * as p from '@clack/prompts';
 import { COMPLIANCE_FRAMEWORKS } from '../../core/compliance.js';
+import { clackNote, clackSelect } from './prompt-io.js';
 // ── Shared prompt content ──────────────────────────────────────────────────────
 /** Message shown on the compliance framework multiselect prompt. */
 export const FRAMEWORK_SELECT_MESSAGE = 'Select compliance frameworks (Enter to skip — generic controls only)';
@@ -75,21 +79,13 @@ export function shouldRunComplianceStep(input) {
 }
 /**
  * Build the real (clack) CompliancePromptIO adapter.
+ * Delegates the shared note + select to the shared adapters (prompt-io.ts).
  * Translates clack's cancel symbol into the PromptOutcome discriminated union.
  */
 export function buildClackCompliancePrompts() {
     return {
-        note: (message, title) => p.note(message, title),
-        select: async (opts) => {
-            const result = await p.select({
-                message: opts.message,
-                options: opts.options,
-                initialValue: opts.initialValue,
-            });
-            if (p.isCancel(result))
-                return { kind: 'cancel' };
-            return { kind: 'value', value: result };
-        },
+        note: clackNote,
+        select: (opts) => clackSelect(opts),
         multiselect: async (opts) => {
             const result = await p.multiselect({
                 message: opts.message,

package/dist/cli/commands/init-seed.js

@@ -13,7 +13,7 @@
  * beside init.ts in src/cli/commands/ rather than in src/core/ (which holds
  * agent-neutral, target-agnostic utilities).
  */
-import { resolveExistingViewMode, FLAG_REGISTRY, defaultValueOf, readViewMode, } from '../../core/flags.js';
+import { resolveExistingViewMode, settingHoldsManagedShape, FLAG_REGISTRY, defaultValueOf, readViewMode, } from '../../core/flags.js';
 import { partitionSelectablePlugins } from '../../core/plugins.js';
 /** Registry defaults — all features enabled except proxy (advanced-only, off by default). */
 export const FEATURE_DEFAULTS = {
@@ -160,12 +160,36 @@ export function resolveSeedPlugins(manifestPlugins, knownPlugins, allPlugins) {
     }
     return { workflowPlugins, languagePlugins };
 }
+/**
+ * Extract the attribution suppression state from a settings JSON string.
+ *
+ * Returns `true` when the exact devflow-managed attribution shape is present —
+ * delegating to `settingHoldsManagedShape('suppress-attribution')`, which is the
+ * single place that decides "on-disk value equals the managed shape" (consistency-01).
+ * Returns `undefined` when the block is absent, holds a custom value, or JSON is
+ * malformed — callers fall through to the manifest FlagsRecord entry or the registry
+ * default.
+ *
+ * Return type is `true | undefined` (typescript-06): settings.json can signal ON or
+ * nothing — never explicitly OFF. That asymmetry is load-bearing for seeding priority:
+ * `undefined` lets the manifest entry or the registry default win, while `true` is an
+ * unambiguous "this key was devflow-managed and active".
+ *
+ * Mirrors resolveExistingViewMode: returns undefined on malformed JSON, absent key,
+ * or any non-devflow attribution value.
+ *
+ * Pure function — no I/O, no side effects.
+ */
+export function resolveExistingAttributionSuppression(settingsJson) {
+    return settingHoldsManagedShape(settingsJson, 'suppress-attribution') ? true : undefined;
+}
 /**
  * Compose the full init seed from manifest, project config, settings, and registry.
  *
  * view-mode priority: existing settings.json (non-default) → manifest → 'default'.
- * The resolved view mode is encoded into flags['view-mode'] so all flag state lives
- * in one FlagsRecord (applying PF-015: fold before strip — the fold happens here).
+ * suppress-attribution priority: settings.json exact devflow shape → manifest → false.
+ * All flag overrides are encoded into flags so all flag state lives in one FlagsRecord
+ * (applying PF-015: fold before strip — the fold happens here).
  *
  * This is the single composition point; callers (init.ts hoist block) call this
  * once and pass `seed` down to prompt wiring.
@@ -194,9 +218,26 @@ export function resolveInitSeed(seedManifest, seedConfig, settingsSnapshot, plug
     else {
         resolvedViewMode = 'default'; // fall back to neutral
     }
+    // Encode resolved attribution suppression (D27) into flags['suppress-attribution'].
+    // Priority: settings.json exact devflow shape → manifest FlagsRecord entry → false.
+    // resolveExistingAttributionSuppression returns true only for the exact managed shape
+    // {"commit":"","pr":""}; custom values return undefined so the manifest entry wins.
+    const existingAttr = resolveExistingAttributionSuppression(settingsSnapshot);
+    const resolvedSuppressAttr = existingAttr !== undefined
+        ? existingAttr // settings.json exact shape wins
+        : flags['suppress-attribution'] === true; // manifest or registry default
     // Return a fresh spread rather than mutating flags in place — keeps this function pure
     // per the module docblock and avoids aliasing if the caller inspects seed.flags.
-    return { features, flags: { ...flags, 'view-mode': resolvedViewMode }, workflowPlugins, languagePlugins };
+    return {
+        features,
+        flags: {
+            ...flags,
+            'view-mode': resolvedViewMode,
+            'suppress-attribution': resolvedSuppressAttr,
+        },
+        workflowPlugins,
+        languagePlugins,
+    };
 }
 /**
  * Resolve the three seed inputs under the --reset gate.

package/dist/cli/commands/init.js

@@ -18,7 +18,7 @@ import { addCaptureHooks, removeCaptureHooks } from './capture.js';
 import { removeDreamHook } from './legacy-hooks.js';
 import { addProxyHooks, removeProxyHooks, applyProxyEnv, stripProxyEnv, runProxyPreflight, buildRealPreflightDeps } from './proxy.js';
 import { reapplyAgentMapping, readAgentMapping } from '../../core/agent-models.js';
-import { readProxyState, writeProxyState, buildProxyState, buildRoutingConfigJson, DEFAULT_PROXY_PORT } from '../../core/proxy-state.js';
+import { readProxyState, writeProxyState, buildProxyState, buildRoutingConfigJson, DEFAULT_PROXY_PORT, proxyJsonExists } from '../../core/proxy-state.js';
 import { stripDevflowTeammateModeFromJson } from '../../core/teammate-mode-cleanup.js';
 // Settings/HookMatcher types used by hook utilities — each in their own module
 import { addHudStatusLine, removeHudStatusLine } from './hud.js';
@@ -30,6 +30,7 @@ import { writeConfig, readConfigIfPresent } from '../../core/feature-config.js';
 import { resolveInitSeed, applyCliToggles, resolveResetGatedInputs } from './init-seed.js';
 import { parseFrameworkList, normalizeFrameworks } from '../../core/compliance.js';
 import { formatComplianceSummary, shouldRunComplianceStep, runComplianceStep, buildClackCompliancePrompts, } from './compliance-prompts.js';
+import { shouldRunAttributionStep, runAttributionStep, buildClackAttributionPrompts, applyAttributionAnswer, attributionSeedFrom, } from './attribution-prompts.js';
 import { convergeFromManifest } from '../../targets/claude-code/compliance-install.js';
 import { getPendingTurnsPath, getPendingTurnsProcessingPath } from '../../core/project-paths.js';
 import * as os from 'os';
@@ -551,6 +552,9 @@ export const initCommand = new Command('init')
             // Step messages not emitted here — the Recommended summary note (below) already
             // prints the Compliance line from complianceSummary via formatComplianceSummary.
         }
+        // No attribution step here: the suppress-attribution question is Advanced-only (D27).
+        // Recommended silently carries the seeded value in enabledFlags — fresh installs get
+        // the registry default (off), re-inits get prior state. See shouldRunAttributionStep.
         // Apply explicit CLI toggles on top of the seed.
         // Precedence: explicit CLI flag > wizard result > seed value (prior state > registry default).
         // proxy is included: --proxy/--no-proxy CLI flags override the seed in non-interactive mode.
@@ -793,6 +797,41 @@ export const initCommand = new Command('init')
         // No third case in practice: on this path the predicate only returns false for a
         // CLI override (isTTY is guaranteed true by the non-TTY guard above). If it ever
         // did, the seed values assigned at declaration stand — which is the right default.
+        // Attribution feature (after compliance, before flags). This is the ONLY call site —
+        // the attribution question is Advanced-only (D27); the Recommended path never asks and
+        // silently carries the seeded value. The gate stays an explicit predicate call so the
+        // documented gate table in attribution-prompts.ts remains the single authority.
+        // isTTY is guaranteed true here (the non-TTY guard above exit-1'd); passing it keeps
+        // the promptless contract enforced at the predicate rather than by position (PF-029).
+        if (shouldRunAttributionStep({
+            // D27-GATE: bind to the resolved mode so all four documented gate-table rows
+            // are reachable and the predicate — not lexical placement — enforces Advanced-only.
+            // Using useRecommended ? 'recommended' : 'advanced' makes the gate testable from
+            // both sides and prevents the Recommended path from accidentally running the step
+            // if this block is ever repositioned (applies PF-029).
+            mode: useRecommended ? 'recommended' : 'advanced',
+            isTTY: process.stdin.isTTY,
+        })) {
+            const attributionStep = await runAttributionStep({
+                // attributionSeedFrom keeps the seed a real boolean regardless of the stored
+                // FlagsRecord value type — undefined/null/false all map to false (PF-018).
+                seed: attributionSeedFrom(enabledFlags),
+                prompts: buildClackAttributionPrompts(),
+            });
+            if (attributionStep.kind === 'cancelled') {
+                p.cancel('Installation cancelled.');
+                process.exit(0);
+            }
+            // D27: applyAttributionAnswer is the single merge site for the wizard answer.
+            enabledFlags = applyAttributionAnswer(enabledFlags, attributionStep);
+            // Advanced path emits an outcome line (mirrors compliance step pattern).
+            for (const msg of attributionStep.messages) {
+                if (msg.level === 'success')
+                    p.log.success(msg.text);
+                else
+                    p.log.info(msg.text);
+            }
+        }
         /**
          * D40: init applies seeded flag defaults non-interactively. Flags are customized
          * exclusively via `devflow flags`; re-init preserves existing values and adopts
@@ -1411,14 +1450,18 @@ export const initCommand = new Command('init')
             content = JSON.stringify(parsedSettings, null, 2) + '\n';
         }
         // Proxy env: ANTHROPIC_BASE_URL strip-then-add, scoped to managed port.
-        // Read proxy.json to learn which port we own — only that URL is stripped.
-        // A user's own localhost gateway on any other port is preserved.
+        // D-STRIP-1: only strip when proxy.json exists — evidence that Devflow previously
+        // wrote ANTHROPIC_BASE_URL. Without this gate, a fresh init on a machine where
+        // DEFAULT_PROXY_PORT (4141) happens to be a user's own gateway (LiteLLM etc.)
+        // would silently delete both their URL and the window-enforcement var.
         // Invariant: proxy.json always reflects the final settled state after the
         // preflight block above — all paths that force proxyEnabled=false also write
         // proxy.json enabled:false (avoids PF-015), so managedPort == effectivePort.
-        const proxyStateForStrip = await readProxyState(devflowDir);
-        const managedPort = proxyStateForStrip.ok ? proxyStateForStrip.value.port : DEFAULT_PROXY_PORT;
-        content = stripProxyEnv(content, managedPort);
+        if (await proxyJsonExists(devflowDir)) {
+            const proxyStateForStrip = await readProxyState(devflowDir);
+            const managedPort = proxyStateForStrip.ok ? proxyStateForStrip.value.port : DEFAULT_PROXY_PORT;
+            content = stripProxyEnv(content, managedPort);
+        }
         if (proxyEnabled)
             content = applyProxyEnv(content, effectivePort);
         if (content !== original) {

package/dist/cli/commands/prompt-io.js

@@ -0,0 +1,38 @@
+/**
+ * Shared wizard prompt-IO seam for devflow init wizard steps.
+ *
+ * ADR-019 corollary (one-definition seam): PromptOutcome and WizardPromptIO
+ * were byte-identical duplicates across attribution-prompts.ts and
+ * compliance-prompts.ts (architecture-03 / consistency-06). They are defined
+ * ONCE here and re-used via import.
+ *
+ * D-PROMPT-IO: WizardPromptIO is the base DI seam for all two-action wizard
+ * steps (note + boolean select). Modules that add a third prompt extend this
+ * interface with an intersection type (e.g. CompliancePromptIO).
+ */
+import * as p from '@clack/prompts';
+// ── Shared clack adapters ─────────────────────────────────────────────────────
+/** Real clack adapter for the note prompt. */
+export function clackNote(message, title) {
+    p.note(message, title);
+}
+/**
+ * Real clack adapter for a select prompt, generic over the option value type T.
+ *
+ * typescript-05: no `as T` cast on the result path. `p.select<T>` returns
+ * `Promise<symbol | T>`; `p.isCancel` is a `(value: unknown) => value is symbol`
+ * guard that narrows away the cancel branch, leaving `result: T` without a cast.
+ * An `as T` here would mask a future widening of the library's return type.
+ *
+ * The `as unknown as SelectOptions<T>` on the input is a safe bridge for the
+ * unresolved conditional type `Option<T>` — our shape satisfies both branches
+ * (Primitive: label optional; non-Primitive: label required) and is strictly
+ * narrower, so no value-type information is lost.
+ */
+export async function clackSelect(opts) {
+    const result = await p.select(opts);
+    if (p.isCancel(result))
+        return { kind: 'cancel' };
+    return { kind: 'value', value: result };
+}
+//# sourceMappingURL=prompt-io.js.map

package/dist/cli/commands/proxy.js

@@ -22,7 +22,7 @@ import * as https from 'https';
 import { spawn as cpSpawn } from 'child_process';
 import * as p from '@clack/prompts';
 import color from 'picocolors';
-import { readProxyState, writeProxyState, buildProxyState, buildRoutingConfigJson, proxyBaseUrl, resolveProxyBin, DEFAULT_PROXY_PORT, } from '../../core/proxy-state.js';
+import { readProxyState, writeProxyState, buildProxyState, buildRoutingConfigJson, proxyBaseUrl, proxyJsonExists, resolveProxyBin, DEFAULT_PROXY_PORT, } from '../../core/proxy-state.js';
 import { syncManifestFeature, readManifest } from '../../core/manifest.js';
 import { writeFileAtomicExclusive } from '../../core/fs-atomic.js';
 import { scrubChildEnv, openProxyLog, rotateProxyLogIfLarge } from '../../core/proxy-log.js';
@@ -149,9 +149,11 @@ function _stripProxyEnvFromObject(settings, managedPort) {
     const env = s.env;
     if (!env)
         return false;
-    // Devflow is the only producer of this var — always remove it, regardless of whether
-    // the URL is still ours. Port-scoping protects a FOREIGN url value; there is no
-    // foreign value of this key to protect. (applies PF-015, ADR-003)
+    // D-STRIP-1: every REMOVAL caller (init, uninstall, runDisable) first proves Devflow
+    // managed the proxy — `proxyJsonExists()` — and the enable caller is taking ownership
+    // of the key anyway, so reaching this line means the value is Devflow's to remove.
+    // Removal is therefore unconditional: unlike ANTHROPIC_BASE_URL (port-scoped below),
+    // this key has no foreign value to protect. (applies PF-015, ADR-003)
     const hadWindowVar = env[UNKNOWN_MODEL_WINDOW_ENV] !== undefined;
     delete env[UNKNOWN_MODEL_WINDOW_ENV];
     let removedUrl = false;
@@ -284,6 +286,31 @@ export function applyDisableToSettings(settings, managedPort) {
     const strippedEnv = _stripProxyEnvFromObject(settings, managedPort);
     return removedHooks || strippedEnv;
 }
+/**
+ * Settings teardown for every path that turns the proxy off: `devflow proxy --disable`
+ * and `devflow uninstall`.
+ *
+ * D-STRIP-1: the two removals answer to different evidence, so they are gated
+ * separately.
+ * - Hooks are Devflow's own artifacts — removed unconditionally. Leaving them behind
+ *   points later sessions at a hook script that no longer exists, and makes a re-run
+ *   of an interrupted uninstall unable to clean up.
+ * - The env vars (ANTHROPIC_BASE_URL, CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT)
+ *   are stripped only against `managedPort`, which the caller supplies from an existing
+ *   `proxy.json` — the one piece of evidence that Devflow ever wrote them. Pass
+ *   `undefined` when that file is absent: the values then belong to a gateway Devflow
+ *   never managed (a user's own LiteLLM on 4141, say) and must survive untouched.
+ *
+ * When `managedPort` is defined this delegates to `applyDisableToSettings`, so the
+ * both-operations invariant documented there still holds.
+ *
+ * Mutates settings in place. Returns true when any change was made.
+ */
+export function applyProxyTeardownToSettings(settings, managedPort) {
+    if (managedPort === undefined)
+        return removeProxyHooks(settings);
+    return applyDisableToSettings(settings, managedPort);
+}
 /**
  * Check whether the ensure-proxy hook is registered on at least one event.
  * Returns true if present on either SessionStart or UserPromptSubmit.
@@ -316,6 +343,47 @@ export function isOurRelayBody(body) {
         return false;
     }
 }
+/**
+ * Preflight check ④ — settings.json readable and parseable, no foreign
+ * ANTHROPIC_BASE_URL, plus the non-fatal ANTHROPIC_API_KEY warning.
+ *
+ * Extracted so the adopted-relay path and the free-port path run the identical
+ * check (D-EFR-5): a healthy relay on the port must not buy an exemption from the
+ * foreign-gateway refusal. Keeping it in one function is what stops the two paths
+ * from drifting on which sub-checks they apply or which message they return.
+ *
+ * `swallowSettingsReadError` semantics are preserved by the caller-supplied dep:
+ * when that flag is set (init), readSettingsJson() resolves to '{}' on I/O failure
+ * instead of rejecting, so the read-failure branch is reachable only from runEnable.
+ */
+async function checkSettingsEnv(deps, port) {
+    let settingsJson;
+    try {
+        settingsJson = await deps.readSettingsJson();
+    }
+    catch {
+        return Err('Could not read settings.json — check file permissions');
+    }
+    let parsedSettings;
+    try {
+        parsedSettings = JSON.parse(settingsJson);
+    }
+    catch {
+        return Err('settings.json is malformed — fix it before enabling the proxy');
+    }
+    if (readProxyEnvState(settingsJson, port) === 'foreign') {
+        return Err('An existing ANTHROPIC_BASE_URL in settings.json points to a different gateway — Devflow will not overwrite it');
+    }
+    // API key warning (non-fatal)
+    const envBlock = parsedSettings.env;
+    if (typeof envBlock === 'object' &&
+        envBlock !== null &&
+        !Array.isArray(envBlock) &&
+        typeof envBlock.ANTHROPIC_API_KEY === 'string') {
+        deps.onWarn?.('ANTHROPIC_API_KEY is set in settings.json — requests will use that key through the local relay');
+    }
+    return Ok(undefined);
+}
 /**
  * Run preflight checks before enabling the Devflow proxy.
  *
@@ -324,6 +392,8 @@ export function isOurRelayBody(body) {
  * ② ~/.codex/auth.json exists.
  * ③ Port probe: free → OK; accepting → health check → adopt or fail.
  * ④ settings.json parseable; ANTHROPIC_BASE_URL not pointing elsewhere; API key warn.
+ *    Runs on BOTH outcomes of ③ that can proceed — adopted relay and free port
+ *    (D-EFR-5) — via the shared `checkSettingsEnv` helper.
  *
  * Doctor is deliberately excluded from preflight: the relay's doctor subcommand
  * probes the relay port — a not-yet-started relay makes that probe fail (exit 1). A
@@ -349,6 +419,12 @@ export async function runProxyPreflight(port, codexAuthPath, configPath, logPath
         // Port is up — check health identity
         const healthResult = await deps.httpGet(`${proxyBaseUrl(port)}/__subswitch/health`, PROBE_TIMEOUT_MS);
         if (healthResult.ok && isOurRelayBody(healthResult.value)) {
+            // D-EFR-5: run check ④ BEFORE the adopted early-return. The old order
+            // (adopted-return first, settings check only when the port was free) let a
+            // healthy relay on the port silently skip the foreign-gateway refusal entirely.
+            const settingsCheck = await checkSettingsEnv(deps, port);
+            if (!settingsCheck.ok)
+                return Err(settingsCheck.error);
             return Ok({ binPath, npxWarning, adopted: true });
         }
         // Port accepting but health timed out, failed, or not our relay
@@ -356,32 +432,9 @@ export async function runProxyPreflight(port, codexAuthPath, configPath, logPath
     }
     // Port refused — free to proceed
     // ④ Settings.json check
-    let settingsJson;
-    try {
-        settingsJson = await deps.readSettingsJson();
-    }
-    catch {
-        return Err('Could not read settings.json — check file permissions');
-    }
-    let parsedSettings;
-    try {
-        parsedSettings = JSON.parse(settingsJson);
-    }
-    catch {
-        return Err('settings.json is malformed — fix it before enabling the proxy');
-    }
-    const envState = readProxyEnvState(settingsJson, port);
-    if (envState === 'foreign') {
-        return Err('An existing ANTHROPIC_BASE_URL in settings.json points to a different gateway — Devflow will not overwrite it');
-    }
-    // API key warning (non-fatal)
-    const envBlock = parsedSettings.env;
-    if (typeof envBlock === 'object' &&
-        envBlock !== null &&
-        !Array.isArray(envBlock) &&
-        typeof envBlock.ANTHROPIC_API_KEY === 'string') {
-        deps.onWarn?.('ANTHROPIC_API_KEY is set in settings.json — requests will use that key through the local relay');
-    }
+    const settingsCheck = await checkSettingsEnv(deps, port);
+    if (!settingsCheck.ok)
+        return Err(settingsCheck.error);
     return Ok({ binPath, npxWarning, adopted: false });
 }
 // ─── Production dependency implementations ────────────────────────────────────
@@ -1381,6 +1434,13 @@ async function runDisable() {
     // applyDisableToSettings strips ANTHROPIC_BASE_URL only when the URL
     // port matches the port Devflow manages — callers must supply it. Reading
     // proxy.json here also consolidates state for Step 2 below.
+    //
+    // D-STRIP-1: readProxyState() cannot distinguish "file absent" from "file present
+    // with the default port", so the env strip is gated on the file's existence — the
+    // only evidence that Devflow ever wrote those vars. Must be read before Step 2
+    // creates the file. Hook removal is NOT gated: our hooks are ours to remove on
+    // every path.
+    const proxyManaged = await proxyJsonExists(devflowDir);
     const priorStateResult = await readProxyState(devflowDir);
     const priorState = priorStateResult.ok ? priorStateResult.value : null;
     const managedPort = priorState?.port ?? DEFAULT_PROXY_PORT;
@@ -1401,7 +1461,7 @@ async function runDisable() {
         process.exitCode = 1;
         return;
     }
-    const changed = applyDisableToSettings(parsedSettings, managedPort);
+    const changed = applyProxyTeardownToSettings(parsedSettings, proxyManaged ? managedPort : undefined);
     if (changed) {
         // Guard ENOSPC/EACCES — unhandled rejection leaves proxy in partial state
         try {