devflow-kit 2.4.0 → 3.0.0

package/src/assets/skills/review-methodology/references/violations.md

@@ -43,31 +43,25 @@ git diff --name-only  # Only file names, no line numbers
 
 ## PR Comment Violations
 
-### Commenting on Wrong Lines
+### Publishing from Inside a Review
 
-```bash
-# VIOLATION: Commenting without checking if file is in diff
-gh api "repos/${REPO}/pulls/${PR_NUMBER}/comments" \
-    -f path="$FILE" \
-    -f line="$LINE"  # May fail if file not in PR
-
-# VIOLATION: No rate limiting
-for issue in "${ISSUES[@]}"; do
-    create_pr_comment "$issue"  # Will hit API rate limits
-done
+```markdown
+# VIOLATION: Publishing from inside a review
 ```
 
+A review that posts its own comments bypasses the repo-visibility gate and the
+comment-sink scrub that post-review-summary applies, and publishes findings that were
+never synthesized or deduplicated. Write the finding into the report instead.
+
 ### Wrong Comment Scope
 
-```bash
+```markdown
 # VIOLATION: Commenting on pre-existing issues
-# Category 3 issues should NOT get PR comments
-create_pr_comment "file.ts" "456" "Pre-existing bug"  # Wrong!
-
-# VIOLATION: Missing severity indicator
-create_pr_comment "file.ts" "123" "This is a problem"  # No severity
 ```
 
+Category 3 findings belong to the summary report. A comment on a line the author did
+not touch reads as a request to fix unrelated code.
+
 ---
 
 ## Report Violations
@@ -111,11 +105,9 @@ Use these to find violations in review code:
 # Find hardcoded base branches
 grep -r 'BASE_BRANCH="main"' --include="*.sh"
 
-# Find missing rate limiting
-grep -r 'gh api.*comments' --include="*.sh" | grep -v 'sleep'
-
-# Find missing severity classifications
-grep -r 'create_pr_comment' --include="*.sh" | grep -v 'CRITICAL\|HIGH\|MEDIUM\|LOW'
+# Find review instructions that post their own comments instead of writing the report
+grep -rn 'gh pr comment' --include="*.md" --include="*.sh"
+grep -rn 'gh api .*/comments' --include="*.md" --include="*.sh"
 ```
 
 ---

package/src/assets/skills/worktree-support/SKILL.md

@@ -49,7 +49,7 @@ Extract: `worktree {path}`, `HEAD {sha}`, `branch refs/heads/{name}`
 
 Exclude:
 - **Bare worktrees** (no branch)
-- **Detached HEAD** (no named branch)
+- **Detached HEAD** (no named branch; roots and detached HEAD: `references/roots.md`)
 - **Protected branches**: `main`, `master`, `develop`, `integration`, `trunk`, `release/*`, `staging`, `production`
 - **Mid-rebase or mid-merge**: check `git -C {path} status` for "rebase in progress" or "merging"
 

package/src/assets/skills/worktree-support/references/roots.md

@@ -0,0 +1,29 @@
+# Project Roots and Detached HEAD
+
+Where devflow keeps per-project data across checkouts, and what it does on a detached HEAD. Companion to the worktree discovery algorithm in `SKILL.md`.
+
+## Which Root Holds What
+
+Devflow's per-project data does not all live in the same checkout.
+
+| Data | Root | Why |
+|------|------|-----|
+| Learning ledger and queue (`.devflow/learning/`) | The main worktree, when its `.devflow/` exists and the main worktree is not HOME; else this checkout's toplevel | One ledger per repository, so ADR/PF numbers never restart or collide in a linked worktree (D-LEDGER-MAIN-WORKTREE) |
+| Working memory (`.devflow/memory/`) | This checkout's toplevel | Memory describes the branch in front of you |
+| Feature knowledge bases (`.devflow/features/`) | This checkout's toplevel | They are committed per branch (D-PROMPT-ROOT) |
+| Personal `.devflow/config.json` | This checkout's toplevel | Per-worktree by decision: a new worktree does not inherit the source checkout's personal settings |
+
+Hooks, loaders, the `devflow learning` CLI and the HUD resolve the root from git, never from cwd, so a session started in a subdirectory uses the repository root. Outside a git repository, and in a repository rooted at HOME, no hook creates `.devflow/` or a `.gitignore` (D-HOOKS-GIT-ONLY). A worktree that grew its own ledger before the main-worktree rule keeps it on disk; sessions there stop appending to it.
+
+---
+
+## Detached HEAD
+
+A detached HEAD is a commit checked out without a branch (`git checkout <sha>`, `git bisect`, a rebase stop, `git worktree add --detach`, a CI checkout). Devflow treats it as follows (D-DETACHED-HEAD):
+
+| Surface | Behaviour |
+|---------|-----------|
+| Knowledge commit | Skipped: a commit there becomes unreachable once HEAD moves. The Knowledge agent reports `KB_COMMIT: skipped (detached HEAD) — uncommitted: <paths>`, and the calling workflow names those paths to the user |
+| Worktree discovery | Excluded from auto-review (discovery Step 3 in `SKILL.md`): there is no branch to review, compare or push |
+| Memory bootstrap | The first compaction bootstraps `WORKING-MEMORY.md` stamped `branch: (detached)`, keyed on the HEAD commit; an unborn branch has no commit and still skips |
+| Memory header | Renders `detached @ <short-sha>` instead of `on unknown` |

package/src/targets/claude-code/templates/managed-settings.json

@@ -24,15 +24,16 @@
       "Bash(> /dev/nvme*)",
       "Bash(sh -c *)",
       "Bash(bash -c *)",
-      "Bash(curl * | bash*)",
-      "Bash(curl * | sh*)",
-      "Bash(wget * | bash*)",
-      "Bash(wget * | sh*)",
-      "Bash(fetch | sh*)",
-      "Bash(lynx -source | bash*)",
-      "Bash(base64 -d | bash*)",
-      "Bash(base64 -d | sh*)",
-      "Bash(base64 --decode | bash*)",
+      "Bash(zsh -c *)",
+      "Bash(bash)",
+      "Bash(sh)",
+      "Bash(zsh)",
+      "Bash(bash - *)",
+      "Bash(sh - *)",
+      "Bash(zsh - *)",
+      "Bash(bash -s *)",
+      "Bash(sh -s *)",
+      "Bash(zsh -s *)",
       "Bash(eval *)",
       "Bash(exec *)",
       "Bash(sudo *)",
@@ -90,6 +91,21 @@
       "Bash(docker run -v /:/host*)",
       "Bash(docker run --pid=host*)",
       "Bash(docker run --net=host*)",
+      "Bash(docker run*--privileged*)",
+      "Bash(docker run*-v /:*)",
+      "Bash(docker run*--volume /:*)",
+      "Bash(docker run*--volume=/:*)",
+      "Bash(docker pull *)",
+      "Bash(docker image pull *)",
+      "Bash(docker rm *)",
+      "Bash(docker container rm *)",
+      "Bash(docker rmi *)",
+      "Bash(docker image rm *)",
+      "Bash(docker volume rm *)",
+      "Bash(docker*prune*)",
+      "Bash(orb *)",
+      "Bash(orbctl *)",
+      "Bash(open *OrbStack*)",
       "Bash(nsenter*)",
       "Bash(crontab*)",
       "Bash(rm /var/log*)",