litclaude-ai 0.3.37 → 0.3.38

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.3.38 - 2026-08-02 — figure output safety
+
+- `lit-scientific-visualization` now requires an explicit, user-approved output
+  path and forbids overwriting a figure the task did not create. The immutable
+  vendor examples it defers to save to fixed names (`figure1.pdf`, `figure1.png`,
+  `multi_panel.pdf`), and figures are written through Bash rather than the file
+  tools, so the harness read-before-write guard never sees them — copying an
+  example literally could clobber a file in the user's working directory.
+
 ## Unreleased — `lit-comprehend` explainer artifacts
 
 - Add the `lit-comprehend` skill, the `/litclaude:lit-comprehend` command, and the

package/README.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.37-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.38-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -174,18 +174,18 @@ cd /tmp
 npx --yes litclaude-ai@latest install
 ```
 
-`0.3.37` is the version prepared by this checkout. Registry lookup is authoritative
+`0.3.38` is the version prepared by this checkout. Registry lookup is authoritative
 for whether that exact version can be installed:
 
 ```bash
-npm view litclaude-ai@0.3.37 version
+npm view litclaude-ai@0.3.38 version
 ```
 
-If that lookup returns 0.3.37, the exact install is available:
+If that lookup returns 0.3.38, the exact install is available:
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.37 install
+npx --yes litclaude-ai@0.3.38 install
 ```
 
 Otherwise, wait for explicit human publication and repeat the lookup before using
@@ -216,7 +216,7 @@ The installer also sets Claude Code's `statusLine` command to the packaged
 LitClaude HUD. A typical no-color render starts like:
 
 ```text
-[🔥LITCLAUDE v0.3.37] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.38] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 The `↻` suffix is a compact rate-limit reset countdown. It is separated from

package/README_ko-KR.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.37-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.38-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -183,18 +183,18 @@ cd /tmp
 npx --yes litclaude-ai@latest install
 ```
 
-`0.3.37`은 이 checkout에서 준비 중인 version입니다. exact version의 설치 가능
+`0.3.38`은 이 checkout에서 준비 중인 version입니다. exact version의 설치 가능
 여부에는 registry 조회 결과를 authoritative한 기준으로 사용합니다.
 
 ```bash
-npm view litclaude-ai@0.3.37 version
+npm view litclaude-ai@0.3.38 version
 ```
 
-조회 결과가 0.3.37이면 exact install을 사용할 수 있습니다.
+조회 결과가 0.3.38이면 exact install을 사용할 수 있습니다.
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.37 install
+npx --yes litclaude-ai@0.3.38 install
 ```
 
 그렇지 않으면 명시적인 human publication을 기다립니다. 게시 후 조회를 다시 실행해
@@ -225,7 +225,7 @@ installer는 Claude Code의 `statusLine` command도 packaged LitClaude HUD로
 설정합니다. 색상을 제거한 예시는 다음처럼 시작합니다.
 
 ```text
-[🔥LITCLAUDE v0.3.37] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.38] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 `↻` 표시는 rate-limit reset까지 남은 시간을 짧게 보여주는 countdown입니다.

package/RELEASE_CHECKLIST.md

@@ -1,6 +1,6 @@
 # LitClaude Release Checklist
 
-Status: `litclaude-ai@0.3.37` is the current release candidate — exact canonical
+Status: `litclaude-ai@0.3.38` is the current release candidate — exact canonical
 frontend corpus plus Claude-native `autoresearch`, `autoconference`, and `wikify`
 workflow-family integration. It byte-pins the frontend library, legal companions,
 family source closures, and adapters through independent commitments and package
@@ -45,9 +45,9 @@ side-effect-free, the launcher starts only a separate Claude Code
 print/background worker, and the release preserves the Korean polishing
 command, strict multi-agent review pipeline, fidelity guardrails, package
 hygiene checks, native route gates, and safe start-work handoff behavior.
-`package.json` is aligned to `0.3.37`,
-`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.37`, and the
-plugin-local MCP server reports `0.3.37`.
+`package.json` is aligned to `0.3.38`,
+`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.38`, and the
+plugin-local MCP server reports `0.3.38`.
 
 This release carries the v0.2.2 Dynamic workflow hardening surfaces:
 `/dynamic-workflow`, `workflow-check --json`, native `/goal` fallback guidance,
@@ -280,9 +280,9 @@ checkout and from an isolated install of the packed tarball:
 Before requesting publication approval, confirm these artifacts from the current
 checkout:
 
-- `package.json` version is `0.3.37`.
-- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.37`.
-- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.37`.
+- `package.json` version is `0.3.38`.
+- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.38`.
+- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.38`.
 - Prompt-hook tests cover bundled `SKILL.md` body injection for bare `hyperplan`, `litresearch`, `lit research`, `init-deep`, and explicit leading `$start-work`; diagnostic/copy mentions stay inert while leading natural-language `lit start work` stays BLOCKED.
 - `lit search` and `lit query` route to `/litclaude:litresearch` without activating on slash mentions, code spans, or non-lit prompts.
 - Litresearch web lanes require public API/feed preference, validator-first checks, route traces, prompt-injection quarantine, and honest auth/paywall/private-data stop reasons.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litclaude-ai",
-  "version": "0.3.37",
+  "version": "0.3.38",
   "description": "Claude Code-native workflow distribution.",
   "type": "module",
   "bin": {

package/plugins/litclaude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "litclaude",
   "description": "Claude Code-native workflow plugin with a bounded-authority start-work lifecycle.",
-  "version": "0.3.37",
+  "version": "0.3.38",
   "author": {
     "name": "LitClaude contributors"
   },

package/plugins/litclaude/bin/litclaude-mcp.js

@@ -3,7 +3,7 @@
 import { readPublicSource } from "../lib/public-source-reader/reader.mjs";
 
 const protocolVersion = "2024-11-05";
-const serverVersion = "0.3.37";
+const serverVersion = "0.3.38";
 
 const publicSourceReadTool = {
   name: "public_source_read",

package/plugins/litclaude/skills/lit-scientific-visualization/SKILL.md

@@ -49,7 +49,8 @@ verdicts: [PASS, DEGRADED, FAIL, BLOCKED]
 5. Insert both the installed source root's `scripts/` and `assets/` directories into Python's module search path. Import `rcparams` and export helpers from `scripts/`, and import `color_palettes` from `assets/`; adding only `scripts/` is incomplete because the immutable source's palette example imports `color_palettes` as a top-level module. Resolve `.mplstyle` resources from that same `assets/` directory.
 6. Validate the data semantics before choosing a chart. Independent observations remain scatter-only; a line requires an ordered trajectory or justified model fit.
 7. Generate the smallest correct figure, export the requested vector and/or 600+ DPI raster artifacts, and inspect layout, clipping, legends, axes, labels, accessibility, and file integrity.
-8. Report dependency status, exact outputs, verification observations, and residual limitations.
+8. Save to an explicit output path the user chose or approved. The immutable source examples save to fixed names such as `figure1.pdf`, `figure1.png`, and `multi_panel.pdf`; copying those literally writes into the user's working directory. Never overwrite an existing file that this task did not create — check first, and ask when the intended name is already taken.
+9. Report dependency status, exact outputs, verification observations, and residual limitations.
 
 ## #contract.outputs