prizmkit 1.0.66 → 1.0.68

package/bundled/VERSION.json

@@ -1,5 +1,5 @@
 {
-  "frameworkVersion": "1.0.66",
-  "bundledAt": "2026-03-19T12:01:20.770Z",
-  "bundledFrom": "913a1b3"
+  "frameworkVersion": "1.0.68",
+  "bundledAt": "2026-03-20T07:41:55.236Z",
+  "bundledFrom": "d0d6a3c"
 }

package/bundled/adapters/claude/settings-adapter.js

@@ -30,9 +30,38 @@ export async function generateSettings(targetRoot, options = {}) {
   if (!existing.permissions.allow) existing.permissions.allow = [];
 
   const prizmkitPermissions = [
+    // Core tools
     'Bash(python3 *)',
     'Bash(git *)',
     'Bash(jq *)',
+    // Common dev commands
+    'Bash(node *)',
+    'Bash(npm *)',
+    'Bash(npx *)',
+    // File operations
+    'Bash(cat *)',
+    'Bash(ls *)',
+    'Bash(pwd)',
+    'Bash(mkdir *)',
+    'Bash(cp *)',
+    'Bash(mv *)',
+    'Bash(rm *)',
+    'Bash(chmod *)',
+    'Bash(touch *)',
+    // Search & text tools
+    'Bash(find *)',
+    'Bash(grep *)',
+    'Bash(sed *)',
+    'Bash(awk *)',
+    'Bash(head *)',
+    'Bash(tail *)',
+    'Bash(wc *)',
+    'Bash(sort *)',
+    'Bash(echo *)',
+    // Script execution
+    'Bash(./*)',
+    'Bash(bash *)',
+    'Bash(sh *)',
   ];
 
   if (options.pipeline) {

package/bundled/dev-pipeline/run-bugfix.sh

@@ -605,12 +605,12 @@ main() {
         # Track current session (atomic write via temp file)
         python3 -c "
 import json, sys, os
-from datetime import datetime
+from datetime import datetime, timezone
 bug_id, session_id, state_dir = sys.argv[1], sys.argv[2], sys.argv[3]
 data = {
     'bug_id': bug_id,
     'session_id': session_id,
-    'started_at': datetime.now(datetime.UTC).strftime('%Y-%m-%dT%H:%M:%SZ')
+    'started_at': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
 }
 target = os.path.join(state_dir, 'current-session.json')
 tmp = target + '.tmp'

package/bundled/dev-pipeline/run.sh

@@ -240,15 +240,89 @@ with open(p, 'w', encoding='utf-8') as f:
 
     log_info "Session result: $session_status"
 
+    # Write lightweight session summary for post-session inspection
+    local feature_slug
+    feature_slug=$(python3 -c "
+import json, re, sys
+flist, fid = sys.argv[1], sys.argv[2]
+with open(flist) as f:
+    data = json.load(f)
+for feat in data.get('features', []):
+    if feat.get('id') == fid:
+        fnum = feat['id'].replace('F-', '').replace('f-', '').zfill(3)
+        title = feat.get('title', '').lower()
+        title = re.sub(r'[^a-z0-9\s-]', '', title)
+        title = re.sub(r'[\s]+', '-', title.strip())
+        title = re.sub(r'-+', '-', title).strip('-')
+        print(f'{fnum}-{title}')
+        sys.exit(0)
+sys.exit(1)
+" "$feature_list" "$feature_id" 2>/dev/null) || {
+        log_warn "Could not resolve feature slug for $feature_id — session summary and artifact validation will be skipped"
+        feature_slug=""
+    }
+
+    if [[ -n "$feature_slug" ]]; then
+        local project_root_for_summary
+        project_root_for_summary="$(cd "$SCRIPT_DIR/.." && pwd)"
+        local summary_path="$project_root_for_summary/.prizmkit/specs/${feature_slug}/session-summary.json"
+        mkdir -p "$(dirname "$summary_path")"
+        local session_start_time
+        session_start_time=$(python3 -c "
+import json, sys, os
+p = os.path.join(sys.argv[1], 'current-session.json')
+if os.path.isfile(p):
+    with open(p) as f: print(json.load(f).get('started_at', ''))
+else: print('')
+" "$STATE_DIR" 2>/dev/null) || session_start_time=""
+        local exec_tier
+        exec_tier=$(python3 -c "
+import json, sys, os
+p = sys.argv[1]
+if os.path.isfile(p):
+    with open(p) as f: print(json.load(f).get('exec_tier', ''))
+else: print('')
+" "$session_dir/session-status.json" 2>/dev/null) || exec_tier=""
+        cat > "$summary_path" <<SUMMARY
+{
+  "feature_id": "$feature_id",
+  "session_id": "$session_id",
+  "status": "$session_status",
+  "started_at": "$session_start_time",
+  "completed_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "tier": "$exec_tier"
+}
+SUMMARY
+    fi
+
+    # Validate key artifacts exist after successful session
+    if [[ "$session_status" == "success" && -n "$feature_slug" ]]; then
+        local project_root_for_artifacts
+        project_root_for_artifacts="$(cd "$SCRIPT_DIR/.." && pwd)"
+        local context_snapshot="$project_root_for_artifacts/.prizmkit/specs/${feature_slug}/context-snapshot.md"
+        local plan_file="$project_root_for_artifacts/.prizmkit/specs/${feature_slug}/plan.md"
+
+        if [[ ! -f "$context_snapshot" ]]; then
+            log_warn "ARTIFACT_MISSING: context-snapshot.md not found at $context_snapshot"
+        fi
+        if [[ ! -f "$plan_file" ]]; then
+            log_warn "ARTIFACT_MISSING: plan.md not found at $plan_file"
+        fi
+    fi
+
     # Update feature status
-    python3 "$SCRIPTS_DIR/update-feature-status.py" \
+    local update_output
+    update_output=$(python3 "$SCRIPTS_DIR/update-feature-status.py" \
         --feature-list "$feature_list" \
         --state-dir "$STATE_DIR" \
         --feature-id "$feature_id" \
         --session-status "$session_status" \
         --session-id "$session_id" \
         --max-retries "$max_retries" \
-        --action update >/dev/null 2>&1 || true
+        --action update 2>&1) || {
+        log_error "Failed to update feature status: $update_output"
+        log_error "feature-list.json may be out of sync. Manual intervention needed."
+    }
 
     # Return status via global variable (avoids $() swallowing stdout)
     _SPAWN_RESULT="$session_status"
@@ -709,6 +783,16 @@ main() {
         exit 1
     fi
 
+    # Validate feature-list.json is at project root
+    local fl_dir
+    fl_dir="$(cd "$(dirname "$feature_list")" && pwd)"
+    local project_root
+    project_root="$(pwd)"
+    if [[ "$fl_dir" != "$project_root" ]]; then
+        log_warn "feature-list.json is not at project root ($project_root), found at $fl_dir"
+        log_warn "Pipeline expects feature-list.json at project root. Proceeding but results may be unstable."
+    fi
+
     check_dependencies
     run_log_cleanup
 
@@ -883,12 +967,12 @@ for f in data.get('stuck_features', []):
         # Update current session tracking (atomic write via temp file)
         python3 -c "
 import json, sys, os
-from datetime import datetime
+from datetime import datetime, timezone
 feature_id, session_id, state_dir = sys.argv[1], sys.argv[2], sys.argv[3]
 data = {
     'feature_id': feature_id,
     'session_id': session_id,
-    'started_at': datetime.now(datetime.UTC).strftime('%Y-%m-%dT%H:%M:%SZ')
+    'started_at': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
 }
 target = os.path.join(state_dir, 'current-session.json')
 tmp = target + '.tmp'

package/bundled/dev-pipeline/scripts/init-pipeline.py

@@ -300,6 +300,15 @@ def main():
         print(json.dumps(output, indent=2, ensure_ascii=False))
         sys.exit(1)
 
+    # Warn if feature-list.json is not at project root
+    feature_list_dir = os.path.dirname(os.path.abspath(args.feature_list))
+    indicators = ['.git', 'package.json', '.prizmkit']
+    is_at_root = any(os.path.exists(os.path.join(feature_list_dir, i)) for i in indicators)
+    if not is_at_root:
+        sys.stderr.write(
+            "Warning: feature-list.json may not be at project root: {}\n".format(feature_list_dir)
+        )
+
     # Validate schema
     schema_errors = validate_schema(data)
     if schema_errors:

package/bundled/dev-pipeline/templates/bootstrap-tier1.md

@@ -99,14 +99,14 @@ Files changed/created: [list]
 Key decisions: [list]
 ```
 
-### Phase 4: Self-Review
+### Phase 4: Code Review (mandatory)
 
 1. Re-read acceptance criteria from Section 1 of context-snapshot.md
-2. Run the full test suite
-3. Check error handling and edge cases
-4. Fix any issues found
+2. Run `/prizmkit-code-review` — verify all acceptance criteria, check code quality and correctness
+3. Run the full test suite
+4. If review uncovers issues, fix them (max 2 fix rounds)
 
-**CP-2**: All acceptance criteria met, tests pass.
+**CP-2**: All acceptance criteria met, tests pass, code review passed.
 
 ### Phase 4.5: Memory Maintenance (mandatory before commit)
 
@@ -183,7 +183,8 @@ Re-check `git status --short` and ensure it is empty before exiting.
 
 ## Reminders
 
-- Tier 1: you do everything — no subagents, no TeamCreate
+- Tier 1: you handle everything directly — invoke skills yourself (no subagents needed for simple tasks)
+- MANDATORY skills: `/prizmkit-code-review`, `/prizmkit-retrospective`, `/prizmkit-committer` — never skip these
 - Build context-snapshot.md FIRST; use it throughout instead of re-reading files
 - ALWAYS write session-status.json before exiting
 - `/prizmkit-committer` is mandatory — do NOT skip the commit phase, and do NOT replace it with manual git commit commands

package/bundled/dev-pipeline/templates/bootstrap-tier2.md

@@ -101,7 +101,9 @@ Spawn Dev subagent (Agent tool, subagent_type="prizm-dev-team-dev", run_in_backg
 Prompt:
 > "Read {{DEV_SUBAGENT_PATH}}. Implement feature {{FEATURE_ID}} (slug: {{FEATURE_SLUG}}).
 >
-> 1. Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` FIRST — all project context, source files, and tests are embedded there. Do NOT re-read individual source files.
+> **IMPORTANT**: Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` FIRST.
+> This file contains ALL source code and context. Do NOT re-read individual source files.
+> 1. Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` — all project context, source files, and tests are embedded there.
 > 2. Read `.prizmkit/specs/{{FEATURE_SLUG}}/plan.md` (including Tasks section).
 > 3. Implement task-by-task using TDD. Mark each task `[x]` in plan.md Tasks section immediately after completion.
 > 4. After ALL tasks complete, append an 'Implementation Log' section to `context-snapshot.md`:
@@ -119,7 +121,9 @@ Spawn Reviewer subagent (Agent tool, subagent_type="prizm-dev-team-reviewer", ru
 Prompt:
 > "Read {{REVIEWER_SUBAGENT_PATH}}. Review feature {{FEATURE_ID}} (slug: {{FEATURE_SLUG}}).
 >
-> 1. Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` FIRST:
+> **IMPORTANT**: Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` FIRST.
+> This file contains ALL source code and context. Do NOT re-read individual source files.
+> 1. Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md`:
 >    - Section 1: acceptance criteria to verify against
 >    - Section 4: original source files (before changes)
 >    - 'Implementation Log': what Dev changed

package/bundled/dev-pipeline/templates/bootstrap-tier3.md

@@ -222,7 +222,9 @@ Append the following to the Dev agent prompt:
 
 Prompt:
 > "Read {{DEV_SUBAGENT_PATH}}. Implement feature {{FEATURE_ID}} (slug: {{FEATURE_SLUG}}) using TDD.
-> 1. Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` FIRST — all source files and context are there. Do NOT re-read individual source files.
+> **IMPORTANT**: Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` FIRST.
+> This file contains ALL source code and context. Do NOT re-read individual source files.
+> 1. Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` — all source files and context are there.
 > 2. Read `plan.md` (including Tasks section) from `.prizmkit/specs/{{FEATURE_SLUG}}/`.
 > 3. Implement task-by-task. Mark each `[x]` in plan.md Tasks section **immediately** after completion (do NOT batch).
 > 4. Use `TEST_CMD=<TEST_CMD>` to run tests — do NOT explore alternative test commands.
@@ -262,7 +264,9 @@ Append the following to the Reviewer agent prompt:
 
 Prompt:
 > "Read {{REVIEWER_SUBAGENT_PATH}}. For feature {{FEATURE_ID}} (slug: {{FEATURE_SLUG}}):
-> 1. Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` FIRST — Section 4 has original source files, 'Implementation Log' section lists exactly what Dev changed. Do NOT re-read source files that are NOT mentioned in the Implementation Log.
+> **IMPORTANT**: Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` FIRST.
+> This file contains ALL source code and context. Do NOT re-read individual source files.
+> 1. Read `.prizmkit/specs/{{FEATURE_SLUG}}/context-snapshot.md` — Section 4 has original source files, 'Implementation Log' section lists exactly what Dev changed. Do NOT re-read source files that are NOT mentioned in the Implementation Log.
 > 2. Run prizmkit-code-review: spec compliance (against spec.md), code quality, correctness. Read ONLY files listed in Implementation Log.
 > 3. Write and execute integration tests covering all user stories from spec.md. Use `TEST_CMD=<TEST_CMD>` — do NOT try alternative test commands.
 > 4. Append 'Review Notes' to context-snapshot.md: issues (severity), test results, final verdict.

package/bundled/skills/_metadata.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.66",
+  "version": "1.0.68",
   "skills": {
     "prizm-kit": {
       "description": "Full-lifecycle dev toolkit. Covers spec-driven development, Prizm context docs, code quality, debugging, deployment, and knowledge management.",

package/bundled/skills/app-planner/SKILL.md

@@ -311,7 +311,13 @@ Resume incremental planning? (Y/n)"
 
 ### Artifact Path Convention
 
-The primary output `feature-list.json` is always written to the **project root** — this is where `dev-pipeline-launcher` and all pipeline scripts expect it.
+**CRITICAL PATH RULE**: `feature-list.json` MUST be written to the project root directory
+(same level as `package.json` / `.git`).
+
+Before writing, verify: `ls package.json .git 2>/dev/null` — if these exist in the current
+directory, you are at the project root. NEVER write to `dev-pipeline/` or any subdirectory.
+
+After writing, verify: `ls -la feature-list.json` from project root.
 
 ```
 <project-root>/

package/bundled/skills/dev-pipeline-launcher/SKILL.md

@@ -9,7 +9,16 @@ Launch the autonomous development pipeline from within an AI CLI conversation. T
 
 ### Execution Mode
 
-Always use daemon mode via `dev-pipeline/launch-daemon.sh` for start/stop/status/log actions. Foreground `run.sh` can be terminated by AI CLI session timeout, while daemon mode survives session closure — this prevents half-finished features that leave the codebase in an inconsistent state.
+**Default: Foreground mode** via `dev-pipeline/run.sh run` — this provides visible output and direct error feedback. Use `launch-daemon.sh` only when the user explicitly requests background execution (e.g., "run in background", "detached mode", "后台运行").
+
+Foreground `run.sh` is preferred because:
+- Immediate visibility of errors and progress
+- No orphaned processes if something goes wrong
+- Session summary artifacts are written reliably
+
+Use daemon mode (`launch-daemon.sh`) only when:
+- User explicitly requests background/detached execution
+- Pipeline must survive AI CLI session closure
 
 ### When to Use
 
@@ -98,31 +107,36 @@ Detect user intent from their message, then follow the corresponding workflow:
    ```
 
 4. **Ask execution mode**: Present the user with a choice before launching:
-   - **(1) Background daemon (recommended)**: Pipeline runs fully detached via `launch-daemon.sh`. Survives session closure.
-   - **(2) Foreground in session**: Pipeline runs in the current session via `run.sh run`. Visible output but will stop if session times out.
+   - **(1) Foreground in session (recommended)**: Pipeline runs in the current session via `run.sh run`. Visible output and direct error feedback.
+   - **(2) Background daemon**: Pipeline runs fully detached via `launch-daemon.sh`. Survives session closure. Use only when user explicitly requests background execution.
    - **(3) Manual — show commands**: Display the exact commands the user can run themselves. No execution.
 
-   Default to option 1 if user says "just run it" or doesn't specify.
+   Default to option 1 if user says "just run it" or doesn't specify. Default to option 2 only if user explicitly says "background", "detached", or "后台".
 
-   **If option 2 (foreground)**:
+   **If option 1 (foreground)**:
    ```bash
    dev-pipeline/run.sh run feature-list.json
    ```
-   Note: This will block the session. Warn user about timeout risk.
 
-   **If option 3 (manual)**: Print commands and stop. Do not execute anything.
-   ```
-   # To run in background (recommended):
+   **If option 2 (background)**:
+   ```bash
    dev-pipeline/launch-daemon.sh start feature-list.json
+   ```
+   Note: Pipeline runs fully detached. Survives session closure.
 
-   # To run in foreground:
+   **If option 3 (manual)**: Print commands and stop. Do not execute anything.
+   ```
+   # To run in foreground (recommended):
    dev-pipeline/run.sh run feature-list.json
 
+   # To run in background (detached):
+   dev-pipeline/launch-daemon.sh start feature-list.json
+
    # To check status:
-   dev-pipeline/launch-daemon.sh status
+   dev-pipeline/run.sh status feature-list.json
    ```
 
-5. **Ask user to confirm**: "Ready to launch the pipeline? It will process N features in the background."
+5. **Ask user to confirm**: "Ready to launch the pipeline? It will process N features."
 
 6. **Launch**:
    ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prizmkit",
-  "version": "1.0.66",
+  "version": "1.0.68",
   "description": "Create a new PrizmKit-powered project with clean initialization — no framework dev files, just what you need.",
   "type": "module",
   "bin": {

package/src/upgrade.js

@@ -213,13 +213,25 @@ export async function runUpgrade(directory, options = {}) {
   }
 
   // 3. Resolve new skill list using old manifest's suite + platform (or defaults)
-  const platform = oldManifest?.platform || 'claude';
+  const oldManifestPlatform = oldManifest?.platform || 'claude';
   const suite = oldManifest?.suite || 'full';
   const team = oldManifest?.options?.team ?? true;
   const pipeline = oldManifest?.options?.pipeline ?? true;
   const rulesPreset = oldManifest?.options?.rules || 'recommended';
   const aiCli = userConfig.ai_cli || oldManifest?.options?.aiCli || '';
 
+  // Filesystem-based platform detection (overrides manifest if dirs exist)
+  const hasClaude = await fs.pathExists(path.join(projectRoot, '.claude', 'commands'))
+                    || await fs.pathExists(path.join(projectRoot, '.claude', 'agents'));
+  const hasCodeBuddy = await fs.pathExists(path.join(projectRoot, '.codebuddy', 'skills'))
+                       || await fs.pathExists(path.join(projectRoot, '.codebuddy', 'agents'));
+
+  let platform;
+  if (hasClaude && hasCodeBuddy) platform = 'both';
+  else if (hasCodeBuddy) platform = 'codebuddy';
+  else if (hasClaude) platform = 'claude';
+  else platform = oldManifestPlatform; // fallback to manifest
+
   const newSkillList = await resolveSkillList(suite);
   const agentsDir = getAgentsDir();
   const newAgentFiles = (await fs.readdir(agentsDir)).filter(f => f.endsWith('.md'));
@@ -255,7 +267,7 @@ export async function runUpgrade(directory, options = {}) {
   const oldVersion = oldManifest?.version || 'unknown';
   console.log(chalk.bold('  Upgrade Summary:'));
   console.log(`    Version: ${chalk.gray(oldVersion)} → ${chalk.cyan(pkg.version)}`);
-  console.log(`    Platform: ${platform}`);
+  console.log(`    Platform: ${platform}${platform !== oldManifestPlatform ? chalk.yellow(` (detected from filesystem, manifest had: ${oldManifestPlatform})`) : ''}`);
   console.log(`    Suite: ${suite}`);
   console.log('');