litclaude-ai 0.3.37 → 0.3.39

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.3.39 - 2026-08-04 — executable plan validation
+
+- Require planner handoff to use a generated plan that passes
+  `PLAN_STRUCTURE_PASS`, and make start-work reject fresh initialization or a
+  stale replay when the plan has zero executable top-level checkbox tasks.
+  Rejection occurs before durable state creation or replay ledger
+  reconciliation, with generated-plan-to-start-work contract coverage.
+
+## 0.3.38 - 2026-08-02 — figure output safety
+
+- `lit-scientific-visualization` now requires an explicit, user-approved output
+  path and forbids overwriting a figure the task did not create. The immutable
+  vendor examples it defers to save to fixed names (`figure1.pdf`, `figure1.png`,
+  `multi_panel.pdf`), and figures are written through Bash rather than the file
+  tools, so the harness read-before-write guard never sees them — copying an
+  example literally could clobber a file in the user's working directory.
+
 ## Unreleased — `lit-comprehend` explainer artifacts
 
 - Add the `lit-comprehend` skill, the `/litclaude:lit-comprehend` command, and the

package/README.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.37-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.39-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -41,11 +41,11 @@ later mode change or uninstall.
   Claude Code's native command surface and do not double-activate the hook
 - **Deep interview mode** - type `/deep-interview` or `$deep-interview` to
   turn broad intent into a spec before planning or implementation
-- **Workflow review discipline** - adds `review-work` 5-lane review discipline and
-  litgoal runtime docs without claiming a package publication has completed
-- **Dynamic workflow hardening** - adds stricter subagent assignment
-  contracts, `start-work-next`, context-pressure resume guidance, precise
-  mutated-file detection, and richer `workflow-check --json` readiness checks
+- **Workflow review discipline** - `review-work` audits a draft plan or completed
+  work across five evidence lanes and never implements what it reviewed
+- **Dynamic workflow discipline** - subagent assignments carry `TASK:`,
+  `DELIVERABLE`, `SCOPE`, and `VERIFY`; `start-work-next` resumes an interrupted
+  run, and `workflow-check --json` reports readiness before full QA
 - **Build-decision gate** - a minimum-first check that runs before the
   language gate and prefers the standard library, a native feature, or an
   installed dependency over hand-rolled code, with a reuse review after writing
@@ -174,18 +174,18 @@ cd /tmp
 npx --yes litclaude-ai@latest install
 ```
 
-`0.3.37` is the version prepared by this checkout. Registry lookup is authoritative
+`0.3.39` is the version prepared by this checkout. Registry lookup is authoritative
 for whether that exact version can be installed:
 
 ```bash
-npm view litclaude-ai@0.3.37 version
+npm view litclaude-ai@0.3.39 version
 ```
 
-If that lookup returns 0.3.37, the exact install is available:
+If that lookup returns 0.3.39, the exact install is available:
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.37 install
+npx --yes litclaude-ai@0.3.39 install
 ```
 
 Otherwise, wait for explicit human publication and repeat the lookup before using
@@ -216,7 +216,7 @@ The installer also sets Claude Code's `statusLine` command to the packaged
 LitClaude HUD. A typical no-color render starts like:
 
 ```text
-[🔥LITCLAUDE v0.3.37] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.39] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 The `↻` suffix is a compact rate-limit reset countdown. It is separated from
@@ -297,50 +297,30 @@ After install, start Claude Code:
 ```bash
 claude
 ```
+Then type one of these prompts. Each row is a natural phrase; the `$name` and `/name` forms of the
+same route work too, and the full trigger list with activation rules lives in
+[docs/hooks.md](./docs/hooks.md).
+
+| Type this | What it does |
+|---|---|
+| `lit`, `litwork` | Start the Litwork execution loop — evidence-first, test-first |
+| `lit plan <what>` | Planning only. Also `$lit-plan`, `/lit-plan` |
+| `lit review <scope>` | Review a draft plan or completed work. Also `$review-work`, `/review-work` |
+| `lit research <question>` | Saturating research with a claim/source graph. Also `$litresearch`, `/litclaude:litresearch` |
+| `lit search <question>` | Public-source retrieval |
+| `lit query <question>` | Evidence lookup against durable state |
+| `lit goal <outcome>` | Bind one objective plus checkable criteria. Also `$litgoal`, `/litgoal` |
+| `lit workflow <objective>` | Propose a Dynamic workflow for broad delegated work |
+| `lit dynamic workflow`, `lit ultracode` | The same route, stronger opt-in wording |
+| `lit team`, `lit team mode`, `lit teammates` | Native agent teams, when the experimental gate is on |
+| `lit start work <plan>` | `BLOCKED:` by design — use `/start-work` or `$start-work` with the approved plan |
+| `handoff`, `/litclaude:lit-handoff` | Write a verified continuation packet |
+| `$deep-interview`, `/deep-interview` | Turn an underspecified request into a decision-complete brief |
+| `$lit-loop`, `/lit-loop`, `/litclaude:lit-loop` | The explicit evidence loop |
+| `lit-scientific-visualization` | Publication figures. Also `/litclaude:lit-scientific-visualization` |
+| `autoresearch <mode> <objective>` | Autonomous research loop. Also `/litclaude:autoresearch` |
+| `autoconference <mode> <objective>` | Multi-agent research conference. Also `/litclaude:autoconference` |
 
-Then type one of these prompts:
-
-```text
-lit
-litwork
-lit plan <what you want planned>
-lit review <scope to review>
-lit research <research question>
-lit search <public-source question>
-lit query <evidence question>
-lit goal <outcome and criteria>
-lit workflow <parallel or delegated objective>
-lit dynamic workflow <parallel or delegated objective>
-lit ultracode <parallel or delegated objective>
-lit team <collaborative objective>
-lit team mode <collaborative objective>
-lit teammates <collaborative objective>
-lit start work <approved plan>
-$lit-plan <what you want planned>
-/lit-plan <what you want planned>
-$lit-loop <what you want executed with evidence>
-/lit-loop <what you want executed with evidence>
-$deep-interview <what needs clarification>
-/deep-interview <what needs clarification>
-$dynamic-workflow <parallel or delegated objective>
-/dynamic-workflow <parallel or delegated objective>
-$review-work <scope to review>
-/review-work <scope to review>
-$litgoal <goal operation>
-/litgoal <goal operation>
-$start-work plans/example-plan.md
-/start-work plans/example-plan.md
-handoff
-/litclaude:lit-handoff
-lit-scientific-visualization
-/litclaude:lit-scientific-visualization <publication figure request>
-autoresearch <mode> <objective>
-/litclaude:autoresearch <mode> <objective>
-autoconference <mode> <objective>
-/litclaude:autoconference <mode> <objective>
-wikify <init|ingest|query|save|lint> <scope or question>
-/litclaude:wikify <init|ingest|query|save|lint> <scope or question>
-```
 
 Expected behavior: LitClaude's prompt hook adds mode-specific `LITWORK MODE
 ENABLED` context for natural LIT routes and shows `LitClaude lit hook active` as

package/README_ko-KR.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.37-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.39-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -183,18 +183,18 @@ cd /tmp
 npx --yes litclaude-ai@latest install
 ```
 
-`0.3.37`은 이 checkout에서 준비 중인 version입니다. exact version의 설치 가능
+`0.3.39`은 이 checkout에서 준비 중인 version입니다. exact version의 설치 가능
 여부에는 registry 조회 결과를 authoritative한 기준으로 사용합니다.
 
 ```bash
-npm view litclaude-ai@0.3.37 version
+npm view litclaude-ai@0.3.39 version
 ```
 
-조회 결과가 0.3.37이면 exact install을 사용할 수 있습니다.
+조회 결과가 0.3.39이면 exact install을 사용할 수 있습니다.
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.37 install
+npx --yes litclaude-ai@0.3.39 install
 ```
 
 그렇지 않으면 명시적인 human publication을 기다립니다. 게시 후 조회를 다시 실행해
@@ -225,7 +225,7 @@ installer는 Claude Code의 `statusLine` command도 packaged LitClaude HUD로
 설정합니다. 색상을 제거한 예시는 다음처럼 시작합니다.
 
 ```text
-[🔥LITCLAUDE v0.3.37] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.39] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 `↻` 표시는 rate-limit reset까지 남은 시간을 짧게 보여주는 countdown입니다.

package/RELEASE_CHECKLIST.md

@@ -1,6 +1,6 @@
 # LitClaude Release Checklist
 
-Status: `litclaude-ai@0.3.37` is the current release candidate — exact canonical
+Status: `litclaude-ai@0.3.39` is the current release candidate — exact canonical
 frontend corpus plus Claude-native `autoresearch`, `autoconference`, and `wikify`
 workflow-family integration. It byte-pins the frontend library, legal companions,
 family source closures, and adapters through independent commitments and package
@@ -45,9 +45,9 @@ side-effect-free, the launcher starts only a separate Claude Code
 print/background worker, and the release preserves the Korean polishing
 command, strict multi-agent review pipeline, fidelity guardrails, package
 hygiene checks, native route gates, and safe start-work handoff behavior.
-`package.json` is aligned to `0.3.37`,
-`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.37`, and the
-plugin-local MCP server reports `0.3.37`.
+`package.json` is aligned to `0.3.39`,
+`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.39`, and the
+plugin-local MCP server reports `0.3.39`.
 
 This release carries the v0.2.2 Dynamic workflow hardening surfaces:
 `/dynamic-workflow`, `workflow-check --json`, native `/goal` fallback guidance,
@@ -280,9 +280,9 @@ checkout and from an isolated install of the packed tarball:
 Before requesting publication approval, confirm these artifacts from the current
 checkout:
 
-- `package.json` version is `0.3.37`.
-- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.37`.
-- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.37`.
+- `package.json` version is `0.3.39`.
+- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.39`.
+- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.39`.
 - Prompt-hook tests cover bundled `SKILL.md` body injection for bare `hyperplan`, `litresearch`, `lit research`, `init-deep`, and explicit leading `$start-work`; diagnostic/copy mentions stay inert while leading natural-language `lit start work` stays BLOCKED.
 - `lit search` and `lit query` route to `/litclaude:litresearch` without activating on slash mentions, code spans, or non-lit prompts.
 - Litresearch web lanes require public API/feed preference, validator-first checks, route traces, prompt-injection quarantine, and honest auth/paywall/private-data stop reasons.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litclaude-ai",
-  "version": "0.3.37",
+  "version": "0.3.39",
   "description": "Claude Code-native workflow distribution.",
   "type": "module",
   "bin": {

package/plugins/litclaude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "litclaude",
   "description": "Claude Code-native workflow plugin with a bounded-authority start-work lifecycle.",
-  "version": "0.3.37",
+  "version": "0.3.39",
   "author": {
     "name": "LitClaude contributors"
   },

package/plugins/litclaude/bin/litclaude-mcp.js

@@ -3,7 +3,7 @@
 import { readPublicSource } from "../lib/public-source-reader/reader.mjs";
 
 const protocolVersion = "2024-11-05";
-const serverVersion = "0.3.37";
+const serverVersion = "0.3.39";
 
 const publicSourceReadTool = {
   name: "public_source_read",

package/plugins/litclaude/lib/start-work-lifecycle.mjs

@@ -504,6 +504,10 @@ export const initializeStartWork = (root, request) => withLock(root, () => {
   const fingerprint = requestHash("init", normalized);
   const replay = idempotentReplay(existing, request.idempotencyKey, fingerprint);
   if (replay) {
+    const replayPlan = canonicalPlan(canonicalCwd, request.plan);
+    if (readPlanProgress(replayPlan).total === 0) {
+      throw new StartWorkLifecycleError("plan has no top-level checkbox tasks");
+    }
     reconcileLedger(canonicalCwd, existing);
     return replay;
   }
@@ -531,6 +535,7 @@ export const initializeStartWork = (root, request) => withLock(root, () => {
 
   const timestamp = nowIso();
   const progress = readPlanProgress(plan);
+  if (progress.total === 0) throw new StartWorkLifecycleError("plan has no top-level checkbox tasks");
   const work = {
     work_id: request.workId,
     status: "active",

package/plugins/litclaude/skills/lit-scientific-visualization/SKILL.md

@@ -49,7 +49,8 @@ verdicts: [PASS, DEGRADED, FAIL, BLOCKED]
 5. Insert both the installed source root's `scripts/` and `assets/` directories into Python's module search path. Import `rcparams` and export helpers from `scripts/`, and import `color_palettes` from `assets/`; adding only `scripts/` is incomplete because the immutable source's palette example imports `color_palettes` as a top-level module. Resolve `.mplstyle` resources from that same `assets/` directory.
 6. Validate the data semantics before choosing a chart. Independent observations remain scatter-only; a line requires an ordered trajectory or justified model fit.
 7. Generate the smallest correct figure, export the requested vector and/or 600+ DPI raster artifacts, and inspect layout, clipping, legends, axes, labels, accessibility, and file integrity.
-8. Report dependency status, exact outputs, verification observations, and residual limitations.
+8. Save to an explicit output path the user chose or approved. The immutable source examples save to fixed names such as `figure1.pdf`, `figure1.png`, and `multi_panel.pdf`; copying those literally writes into the user's working directory. Never overwrite an existing file that this task did not create — check first, and ask when the intended name is already taken.
+9. Report dependency status, exact outputs, verification observations, and residual limitations.
 
 ## #contract.outputs