devflow-kit 2.4.0 → 3.0.0

package/dist/cli/commands/security.js

@@ -4,8 +4,8 @@ import * as p from '@clack/prompts';
 import color from 'picocolors';
 import { getClaudeDirectory, getDevFlowDirectory, getManagedSettingsPath } from '../../targets/claude-code/claude-paths.js';
 import { readManifest, syncManifestFeature } from '../../core/manifest.js';
-import { mergeDenyList, stripUserDenyList, detectDenyState, DEVFLOW_HISTORICAL_DENY, removeManagedSettings, installManagedSettings, loadTemplateDenyEntries, stripUserSecurityDenyList, } from '../../targets/claude-code/post-install.js';
-import { writeFileAtomicExclusive } from '../../core/fs-atomic.js';
+import { applyUserSecurityDenyList, stripUserDenyList, detectDenyState, DEVFLOW_HISTORICAL_DENY, removeManagedSettings, installManagedSettings, loadTemplateDenyEntries, stripUserSecurityDenyList, } from '../../targets/claude-code/post-install.js';
+import { writeSettingsFileAtomic } from '../../core/fs-atomic.js';
 import { promises as fs } from 'fs';
 import { getPackageRoot } from '../../core/paths.js';
 // ─── Pure helpers ─────────────────────────────────────────────────────────────
@@ -23,7 +23,74 @@ export function countDenyEntries(settingsJson) {
         return 0;
     }
 }
-// ─── Command ──────────────────────────────────────────────────────────────────
+/**
+ * Remove the Devflow deny list from the managed settings file — the ONE
+ * implementation `devflow security --disable` and `devflow init --security none`
+ * share, so "none" means none in every location (#378).
+ *
+ * Gated on detectDenyState's parse-safe signal rather than on the file merely
+ * existing: removeManagedSettings parses the file without a guard, so a corrupt
+ * managed file must be classified here and never reach it (SF5). Never throws —
+ * a permission failure is the `failed` outcome, reported by the caller.
+ *
+ * `managedPath` is the injectable seam for tests (see removeManagedSettings);
+ * production callers omit it and get the platform path.
+ */
+export async function removeManagedDenyList(rootDir, verbose, managedPath) {
+    let target;
+    if (managedPath !== undefined) {
+        target = managedPath;
+    }
+    else {
+        try {
+            target = getManagedSettingsPath();
+        }
+        catch {
+            return { kind: 'absent' };
+        }
+    }
+    let content;
+    try {
+        content = await fs.readFile(target, 'utf-8');
+    }
+    catch {
+        return { kind: 'absent' };
+    }
+    if (!detectDenyState(null, true, content).managed) {
+        return { kind: 'no-devflow-entries', path: target };
+    }
+    const removed = await removeManagedSettings(rootDir, verbose, target);
+    return removed ? { kind: 'removed', path: target } : { kind: 'failed', path: target };
+}
+/**
+ * The user-facing line for a ManagedDenyRemoval. Pure.
+ *
+ * D-MANAGED-REMOVAL-REMEDY: both `devflow security --disable` and
+ * `devflow init --security none` print this line, so the `failed` remedy names
+ * no command — pointing at `devflow security --disable` sent a user of that very
+ * command back to it. A `failed` removal means the write needed admin rights and
+ * the sudo fallback could not run (no interactive terminal) or was declined, so
+ * the remedy is exactly that: re-run interactively and accept the prompt, or
+ * edit the named file as an administrator.
+ */
+export function describeManagedDenyRemoval(outcome) {
+    switch (outcome.kind) {
+        case 'removed':
+            return { level: 'info', text: `Security deny list removed from managed settings (${outcome.path})` };
+        case 'absent':
+            return { level: 'info', text: 'No managed settings to remove' };
+        case 'no-devflow-entries':
+            return { level: 'warn', text: 'Managed settings file exists but contains no Devflow deny entries — skipping' };
+        case 'failed':
+            return {
+                level: 'warn',
+                text: `Could not remove the Devflow deny list from managed settings (${outcome.path}) — ` +
+                    'it needs admin rights, and sudo was declined or unavailable. Re-run this command in an ' +
+                    'interactive terminal and accept the sudo prompt, or, as an administrator, remove the Devflow ' +
+                    `entries from permissions.deny in ${outcome.path}.`,
+            };
+    }
+}
 export const securityCommand = new Command('security')
     .description('Manage the security deny list (permissions.deny in Claude Code settings)')
     .option('--status', 'Show current deny list state and entry counts')
@@ -116,16 +183,8 @@ export const securityCommand = new Command('security')
             }
         }
         else {
-            // User mode: merge into ~/.claude/settings.json
-            let existing;
-            try {
-                existing = await fs.readFile(userSettingsPath, 'utf-8');
-            }
-            catch {
-                existing = '{}';
-            }
-            const merged = mergeDenyList(existing, templateDeny);
-            await writeFileAtomicExclusive(userSettingsPath, merged);
+            // User mode: merge into ~/.claude/settings.json, converging retired entries
+            const merged = await applyUserSecurityDenyList(userSettingsPath, templateDeny);
             const count = countDenyEntries(merged);
             p.log.success(`Security deny list applied to user settings (${count} entries)`);
             p.log.info(`  Location: ${color.dim(userSettingsPath)}`);
@@ -147,7 +206,7 @@ export const securityCommand = new Command('security')
             }
             const { json: stripped, removed } = stripUserDenyList(userSettingsJson, DEVFLOW_HISTORICAL_DENY);
             if (removed.length > 0) {
-                await writeFileAtomicExclusive(userSettingsPath, stripped);
+                await writeSettingsFileAtomic(userSettingsPath, stripped);
                 p.log.success(`Removed ${removed.length} entries from user settings:`);
                 for (const entry of removed) {
                     p.log.info(`  ${color.dim(entry)}`);
@@ -157,21 +216,14 @@ export const securityCommand = new Command('security')
                 p.log.info('No Devflow deny entries found in user settings');
             }
         }
-        // Managed settings: gate on detected.managed (parse-safe signal from detectDenyState),
-        // not raw managedExists — avoids raw JSON.parse crash inside removeManagedSettings
-        // when the managed file exists but is corrupt JSON. (SF5 — applies engineering.md
-        // "never throw in business logic"; avoids PF partial-failure: user settings already
-        // stripped but manifest sync would be skipped on uncaught throw.)
-        if (detected.managed) {
-            await removeManagedSettings(rootDir, true);
-        }
-        else if (managedExists && !detected.managed) {
-            // File exists but is unparseable or contains no Devflow entries — warn and skip.
-            p.log.warn('Managed settings file exists but contains no Devflow deny entries — skipping');
-        }
-        else {
-            p.log.info('No managed settings to remove');
-        }
+        // Managed settings: the shared removal (parse-safe gate, never throws — SF5;
+        // a throw here would skip the manifest sync below after user settings were
+        // already stripped).
+        const managedMsg = describeManagedDenyRemoval(await removeManagedDenyList(rootDir, false));
+        if (managedMsg.level === 'warn')
+            p.log.warn(managedMsg.text);
+        else
+            p.log.info(managedMsg.text);
         await syncManifestFeature(devflowDir, 'security', 'none');
         return;
     }

package/dist/cli/commands/skills.js

@@ -4,7 +4,8 @@ import * as path from 'path';
 import * as p from '@clack/prompts';
 import color from 'picocolors';
 import { getClaudeDirectory, getDevFlowDirectory } from '../../targets/claude-code/claude-paths.js';
-import { getAllSkillNames, prefixSkillName, unprefixSkillName, FEATURE_OWNED_SKILLS } from '../../core/plugins.js';
+import { getAllSkillNames, prefixSkillName, unprefixSkillName, skillOwners, FEATURE_OWNED_SKILLS } from '../../core/plugins.js';
+import { skillsDir } from '../../core/assets.js';
 import { copyDirectory, validateSkillShadow } from '../../targets/claude-code/installer.js';
 /**
  * Check if a directory exists.
@@ -24,6 +25,23 @@ async function dirExists(dirPath) {
 function getShadowDir(devflowDir, skillName) {
     return path.join(devflowDir, 'skills', unprefixSkillName(skillName));
 }
+/**
+ * The directory a new shadow of `bareName` is copied from.
+ *
+ * D-COMPLIANCE-SHADOW-SOURCE (mirrors seedRuleShadow's Tier-1 skip in rules.ts):
+ * a FEATURE_OWNED skill always seeds from the shipped SOURCE. Its installed copy
+ * is composed — every `${DEVFLOW_COMPLIANCE_*}` token already replaced with the
+ * frameworks of that moment — and a token-free shadow passes through composition
+ * byte-identical (C1), so seeding from it would freeze that stamp: a later
+ * `devflow compliance --set` could never re-stamp the skill. Every other skill
+ * seeds from its installed copy when there is one, else from source.
+ */
+export function shadowSeedDir(bareName, installedDir) {
+    const sourceDir = path.join(skillsDir(), bareName);
+    if (FEATURE_OWNED_SKILLS.includes(bareName))
+        return sourceDir;
+    return installedDir ?? sourceDir;
+}
 /**
  * Check if a skill has a shadow (personal override).
  */
@@ -31,6 +49,26 @@ export async function hasShadow(skillName, devflowDir) {
     const dir = devflowDir ?? getDevFlowDirectory();
     return dirExists(getShadowDir(dir, skillName));
 }
+/**
+ * Which plugin(s) a user must select to get a skill — rendered for a message.
+ *
+ * Every declarer, never the first: once install is scoped, the question this
+ * answers is "which plugin do I select to keep this?", and a first-wins answer
+ * names one plugin out of several that would each do (D-ALL-OWNERS).
+ * FEATURE_OWNED skills have no plugin owner at all and say so, because telling
+ * a user to select a plugin for `compliance` would send them looking for one
+ * that does not exist. Compliance is installed on every machine
+ * (D-COMPLIANCE-INSTALL-ALWAYS), so its feature is the whole answer.
+ */
+function describeOwners(bareName, owners) {
+    const declarers = owners ?? skillOwners(bareName);
+    if (declarers.length === 0) {
+        return FEATURE_OWNED_SKILLS.includes(bareName)
+            ? 'the compliance feature (every install)'
+            : 'no plugin';
+    }
+    return declarers.join(' or ');
+}
 /** Render the shadow-state display tag for a skill. Exhaustive switch catches new states at compile time. */
 function buildSkillShadowTag(shadowState) {
     switch (shadowState) {
@@ -72,8 +110,16 @@ export const skillsCommand = new Command('skills')
         }
         const prefixedName = prefixSkillName(bareName);
         const installedSkillDir = path.join(claudeDir, 'skills', prefixedName);
-        if (!await dirExists(installedSkillDir)) {
-            p.log.error(`Skill not installed: ${prefixedName}. Run devflow init first.`);
+        const installed = await dirExists(installedSkillDir);
+        // A skill outside the current selection is not installed, and that is no
+        // longer a reason to refuse: skills are plugin-scoped now, so "not
+        // installed" is an ordinary state for a registry skill nobody selected.
+        // The shadow is seeded from the shipped source instead and reported as
+        // DORMANT — it exists, it is preserved by every future install, and it
+        // applies to nothing until the plugin that uses it is selected.
+        const seedDir = shadowSeedDir(bareName, installed ? installedSkillDir : null);
+        if (!await dirExists(seedDir)) {
+            p.log.error(`No source for ${bareName} — reinstall devflow, then try again.`);
             process.exit(1);
         }
         const shadowDir = getShadowDir(devflowDir, bareName);
@@ -83,8 +129,12 @@ export const skillsCommand = new Command('skills')
         }
         // Create shadow directory (unprefixed) and copy original as reference backup
         await fs.mkdir(path.join(devflowDir, 'skills'), { recursive: true });
-        await copyDirectory(installedSkillDir, shadowDir);
+        await copyDirectory(seedDir, shadowDir);
         p.log.success(`Shadowed ${color.cyan(bareName)}`);
+        if (!installed) {
+            p.log.warn(`Shadow for ${bareName} is inactive — the plugin that uses it is not selected. ` +
+                `Run devflow init and select ${describeOwners(bareName)} to apply it.`);
+        }
         p.log.info(`Edit ${color.dim(path.join(shadowDir, 'SKILL.md'))} then run devflow init to apply.`);
     }
     else if (action === 'unshadow') {
@@ -114,14 +164,27 @@ export const skillsCommand = new Command('skills')
         catch { /* skills dir absent — no shadows */ }
         const shadowDirSet = new Set(shadowDirNames);
         const knownSkillSet = new Set(allSkills);
+        // L3: every skill's declarers, resolved ONCE into a map before any row is
+        // rendered. Calling skillOwners() inside the row loop would walk the whole
+        // registry per skill for an answer that does not change between rows.
+        const ownersBySkill = new Map(allSkills.map(skill => [skill, skillOwners(skill)]));
         // Build rows in parallel; short-circuit validateSkillShadow for skills with no shadow dir
         const knownResults = await Promise.all(allSkills.map(async (skill) => {
             const shadowState = shadowDirSet.has(skill)
                 ? await validateSkillShadow(path.join(shadowsRoot, skill))
                 : 'none';
-            return { skill, shadowState };
+            const installed = await dirExists(path.join(claudeDir, 'skills', prefixSkillName(skill)));
+            return { skill, shadowState, installed };
         }));
-        const rows = knownResults.map(({ skill, shadowState }) => `  ${color.cyan(skill.padEnd(28))} ${buildSkillShadowTag(shadowState)}`);
+        const rows = knownResults.map(({ skill, shadowState, installed }) => {
+            // Skills are plugin-scoped, so "which plugin do I select to keep this?"
+            // is the question the list has to answer — and for a skill that is not
+            // installed it is the only useful thing the row can say.
+            const provenance = installed
+                ? color.dim(`installed because: ${describeOwners(skill, ownersBySkill.get(skill))}`)
+                : color.dim(`not installed — provided by: ${describeOwners(skill, ownersBySkill.get(skill))}`);
+            return `  ${color.cyan(skill.padEnd(28))} ${buildSkillShadowTag(shadowState).padEnd(20)} ${provenance}`;
+        });
         // Orphan shadows: in ~/.devflow/skills/ but not a known skill
         for (const dirName of shadowDirNames) {
             if (!knownSkillSet.has(dirName)) {
@@ -129,7 +192,8 @@ export const skillsCommand = new Command('skills')
             }
         }
         const shadowedCount = knownResults.filter(r => r.shadowState !== 'none').length;
-        p.note(rows.join('\n'), `Skills (${allSkills.length} known, ${shadowedCount} shadowed)`);
+        const installedCount = knownResults.filter(r => r.installed).length;
+        p.note(rows.join('\n'), `Skills (${allSkills.length} known, ${installedCount} installed, ${shadowedCount} shadowed)`);
     }
     else {
         p.log.error(`Unknown action: ${action}`);

package/dist/cli/commands/tracker-prompts.js

@@ -0,0 +1,145 @@
+/**
+ * Tracker prompt helpers for devflow init.
+ *
+ * CLI-layer module (ADR-013): prompt-rendering logic lives in src/cli/commands/,
+ * core business logic stays in src/core/tracker.ts.
+ *
+ * avoids PF-029: the wizard gate keys on `modePromptShown` (was the Setup-mode
+ * p.select prompt actually shown?), never on the mode name, so --recommended
+ * (flag, no prompt) and the non-TTY fallback preserve their promptless contracts.
+ * avoids PF-014: runTrackerStep never calls process.exit() or throws — callers
+ * own the cancel idiom (p.cancel + process.exit(0)), keeping try/finally safe.
+ * The shared DI seam (PromptOutcome, WizardPromptIO, clackNote, clackSelect) is
+ * defined once in prompt-io.ts and imported here, never re-declared.
+ *
+ * D-TRACKER-GATE: this step copies COMPLIANCE's gate, not ATTRIBUTION's.
+ * Attribution is Advanced-only because it silently rewrites git metadata; a
+ * wrong tracker provider is immediately visible and trivially reversible, while
+ * a user who never sees the question silently gets `github` — invisible to
+ * exactly the Jira/Linear user the question exists for. Compliance's signature
+ * is also the only one already carrying `hasCliOverride`, which `--tracker`
+ * needs.
+ */
+import { clackNote, clackSelect } from './prompt-io.js';
+import { DEFAULT_TRACKER_PROVIDER, TRACKER_PROVIDERS, } from '../../core/tracker.js';
+// ── Shared prompt content ──────────────────────────────────────────────────────
+/** Message shown on the tracker provider select prompt. */
+export const TRACKER_SELECT_MESSAGE = 'Issue tracker for this machine';
+/** Build clack select options for the tracker provider list. */
+export function providerChoices() {
+    return TRACKER_PROVIDERS.map(provider => ({
+        value: provider.id,
+        label: provider.label,
+        hint: provider.hint,
+    }));
+}
+/**
+ * Format a padded provider catalogue suitable for a clack note body.
+ * Produces: `  github     — GitHub Issues through the gh CLI`
+ */
+export function formatProviderCatalogue() {
+    return 'Valid provider IDs:\n' +
+        TRACKER_PROVIDERS.map(p => `  ${p.id.padEnd(10)} — ${p.hint}`).join('\n');
+}
+/**
+ * Format tracker state for the Recommended-mode summary line and note header.
+ *
+ * Pure function — no I/O, no side effects. `github` carries the `(default)`
+ * marker so a user reading the summary can tell "I chose this" from "this is
+ * what devflow does when nobody chooses".
+ */
+export function formatTrackerSummary(provider) {
+    return provider === DEFAULT_TRACKER_PROVIDER ? `${provider} (default)` : provider;
+}
+// ── Gate predicate ─────────────────────────────────────────────────────────────
+/**
+ * Determines whether the tracker wizard step should run for a given init invocation.
+ *
+ * Gate table (per PF-029: key on modePromptShown, never on the mode name):
+ *
+ *   --recommended flag / !isTTY fallback             → no (promptless contract preserved)
+ *   Interactive mode-prompt → Recommended            → yes (modePromptShown=true)
+ *   --advanced flag / re-init (banner path)          → yes (mode='advanced', isTTY=true)
+ *   Interactive mode-prompt → Advanced               → yes (modePromptShown=true)
+ *   Any path with --tracker <id>                     → no (hasCliOverride wins)
+ *
+ * BOTH wizard paths call this predicate, so the table above is the single
+ * authority for both and they cannot drift. A Recommended-only wiring would be
+ * dead on every re-init — re-init is Advanced-only by construction.
+ *
+ * Pure predicate — no side effects, fully testable without a TTY.
+ */
+export function shouldRunTrackerStep(input) {
+    if (input.hasCliOverride)
+        return false;
+    if (!input.isTTY)
+        return false;
+    // Advanced path: non-TTY has already exit-1'd, so isTTY=true here → always run.
+    // Covers: --advanced flag, re-init banner path, interactive-prompt → advanced.
+    if (input.mode === 'advanced')
+        return true;
+    // Recommended path: only run when the Setup-mode p.select actually ran
+    // (user made an active choice). --recommended flag and !isTTY fallback never set
+    // modePromptShown=true, preserving their promptless contracts.
+    return input.modePromptShown;
+}
+/**
+ * Build the real (clack) TrackerPromptIO adapter.
+ * Delegates the shared note + select to the shared adapters (prompt-io.ts).
+ * Translates clack's cancel symbol into the PromptOutcome discriminated union.
+ */
+export function buildClackTrackerPrompts() {
+    return {
+        note: clackNote,
+        select: (opts) => clackSelect(opts),
+        selectProvider: (opts) => clackSelect(opts),
+    };
+}
+/**
+ * Run the tracker wizard step.
+ *
+ * Flow:
+ *   1. Note — "Current setting: …" header then the provider catalogue.
+ *   2. Provider select — labelled GitHub / Jira / Linear with hints, seeded from
+ *      the prior state. `p.select`, never `p.confirm`: Enter-through must be an
+ *      INFORMED keep of a named provider, not a y/N reflex (PF-029).
+ *
+ * Returns:
+ *   {kind:'resolved', state, messages} — step completed; `state` is the chosen
+ *     TrackerFeatureState; `messages` are emitted by the caller.
+ *   {kind:'cancelled'} — user pressed Escape; caller runs p.cancel + process.exit(0).
+ *
+ * Invariants (PF-014):
+ *   - Never calls process.exit(), never throws.
+ *   - The returned state is always a fresh object, never the seed.
+ *   - All I/O is routed through the `prompts` parameter (injectable for tests).
+ */
+export async function runTrackerStep(opts) {
+    const { seed, prompts } = opts;
+    prompts.note(`Current setting: ${formatTrackerSummary(seed.provider)}\n\n` +
+        'Selects which issue tracker devflow reads and writes when a workflow\n' +
+        'needs an issue. GitHub is the default and needs no extra setup.\n' +
+        'Jira and Linear learn your project\'s issue conventions in the\n' +
+        'background at the next session start; pull requests stay on GitHub\n' +
+        'either way.\n\n' +
+        formatProviderCatalogue(), 'Issue tracker');
+    const outcome = await prompts.selectProvider({
+        message: TRACKER_SELECT_MESSAGE,
+        options: providerChoices(),
+        initialValue: seed.provider,
+    });
+    if (outcome.kind === 'cancel')
+        return { kind: 'cancelled' };
+    const provider = outcome.value;
+    return {
+        kind: 'resolved',
+        // Fresh object — never alias the seed the caller still holds.
+        state: { provider },
+        messages: [
+            provider === DEFAULT_TRACKER_PROVIDER
+                ? { level: 'info', text: `Tracker: ${provider} (default) — change later with devflow tracker --set <id>` }
+                : { level: 'success', text: `Tracker: ${provider}` },
+        ],
+    };
+}
+//# sourceMappingURL=tracker-prompts.js.map