worclaude 2.4.0 → 2.4.2

package/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 All notable changes to worclaude are documented in this file. Format loosely follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow [semver](https://semver.org/). Older releases (pre-2.3.0) are documented in [docs/spec/PROGRESS.md](./docs/spec/PROGRESS.md) and the [GitHub releases page](https://github.com/sefaertunc/Worclaude/releases).
 
+## [Unreleased]
+
+## [2.4.2] — 2026-04-18
+
+Hygiene patch closing three drifts surfaced by the 2026-04-18 anthropic-watch feed audit. No user-facing CLI surface change; `worclaude init` / `upgrade` produce identical output to 2.4.1.
+
+### Added
+
+- `worclaude doctor` now recognizes the 7 hook events introduced since Claude Code 2.1.101: `TaskCreated`, `TaskCompleted`, `StopFailure`, `InstructionsLoaded`, `ConfigChange`, `Elicitation`, `ElicitationResult`. `VALID_HOOK_EVENTS` grew from 20 to 27 — matching `docs/reference/hooks.md` and `docs/spec/SPEC.md`, which already documented 27.
+- `worclaude doctor` warns on agents declaring `claude-sonnet-4` / `sonnet-4` (Anthropic retires these model IDs on 2026-06-15).
+- New `docs/spec/BACKLOG-v2.1.md` entry — "Sandbox defaults in scaffolded settings" — captures open design questions for scaffolding the Claude Code 2.1.113 `sandbox.network.deniedDomains` feature in a future minor.
+- `docs/reference/upstream-automation.md` — new "Action pinning" policy paragraph and "Version history" section (2.4.0 → 2.4.2).
+
+### Changed
+
+- `.github/workflows/upstream-check.yml` — `anthropics/claude-code-action` pinned from floating `@v1` to commit SHA `38ec876110f9fbf8b950c79f534430740c3ac009` (v1.0.101). Closes the pre-existing `TODO(security):` comment in the workflow. Feed content is untrusted user input; floating `@v1` let any future action release run unreviewed against the repo's `CLAUDE_CODE_OAUTH_TOKEN`.
+- `src/commands/doctor.js` version-stamp comment refreshed from v2.1.101 to v2.1.114. `Setup` retained in the hook event set with an inline rationale comment (older worclaude scaffolds may still declare it).
+
+## [2.4.1] — 2026-04-18
+
+Internal CI tooling — no change to the scaffolded output or npm package surface.
+
+### Added
+
+- Daily `upstream-check` GitHub Actions workflow (09:30 UTC cron) that fetches the anthropic-watch feeds, diffs against committed state, and opens a GitHub issue when a Worclaude-relevant change appears. Completes the emit half of the anthropic-watch integration ([#69](https://github.com/sefaertunc/Worclaude/pull/69)).
+- `scripts/upstream-precheck.mjs` — zero-dep Node 20 parallel feed fetch with 10s timeout, Set-based delta detection, 90-day firstSeen prune, and a 3-strike feed-unreachable watchdog with auto-recovery.
+- `scripts/upstream-parse.mjs` — reads `claude-code-action` execution JSONL, applies a strict `SKIP_ISSUE` / `# Title:` / `# Body` contract with a plaintext fallback.
+- `scripts/_gha-outputs.mjs` — shared zero-dep GitHub Actions helpers.
+- `.github/upstream-state.json` — schema v2 state file (seeded from live `all.json`); every mutation gated on `github.ref == 'refs/heads/main'` so feature-branch dispatches stay read-only.
+- `tests/fixtures/upstream/` — four parser fixtures (skip, issue, malformed, plaintext-fallback).
+- `docs/reference/upstream-automation.md` — operations runbook and required branch-protection settings for the workflow.
+
+### Changed
+
+- `docs/reference/slash-commands.md` — cross-link to the new upstream-automation reference page.
+- `docs/.vitepress/config.mjs` — sidebar entry for upstream-automation; `phases/**` added to `srcExclude`.
+
+### Removed
+
+- `docs/research/PHASE-1-DIAGNOSIS-REPORT.md` — retired investigation scratchpad (preserved in git history).
+
 ## [2.4.0] — 2026-04-16
 
 Worclaude 2.4.0 adds **upstream awareness**: every scaffolded project now ships a `/upstream-check` command and an `upstream-watcher` universal agent that consume the [anthropic-watch](https://github.com/sefaertunc/anthropic-watch) feeds at runtime (16 Anthropic sources — Claude Code releases, SDK changelogs, docs, engineering blog, status page, and more) and report what's new, what's critical, and what affects the current project. No new npm dependencies — fetching happens via `curl` inside Claude Code.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "worclaude",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "The Workflow Layer for Claude Code — scaffold agents, commands, skills, hooks, and memory into any project",
   "type": "module",
   "bin": {

package/src/commands/doctor.js

@@ -17,12 +17,13 @@ const PASS = 'pass';
 const WARN = 'warn';
 const FAIL = 'fail';
 
-// Claude Code v2.1.101 documented hook events (closed set)
+// Claude Code v2.1.114 documented hook events (closed set)
 const VALID_HOOK_EVENTS = new Set([
   'PreToolUse',
   'PostToolUse',
   'PostToolUseFailure',
   'Stop',
+  'StopFailure',
   'PreCompact',
   'PostCompact',
   'SessionStart',
@@ -33,6 +34,15 @@ const VALID_HOOK_EVENTS = new Set([
   'PermissionDenied',
   'SubagentStart',
   'SubagentStop',
+  'TaskCreated',
+  'TaskCompleted',
+  'InstructionsLoaded',
+  'ConfigChange',
+  'Elicitation',
+  'ElicitationResult',
+  // Setup: retained conservatively — not in 2.1.114 docs, but older
+  // worclaude scaffolds may still declare it; removing would flip
+  // doctor from PASS → FAIL on legitimate prior installs.
   'Setup',
   'CwdChanged',
   'FileChanged',
@@ -41,14 +51,17 @@ const VALID_HOOK_EVENTS = new Set([
   'TeammateIdle',
 ]);
 
-// Models deprecated in favor of alias-only references (opus, sonnet, haiku)
+// Models deprecated in favor of alias-only references (opus, sonnet, haiku).
+// claude-sonnet-4 / sonnet-4: Anthropic retires 2026-06-15.
 const DEPRECATED_MODELS = new Set([
   'opus-4',
   'opus-4.1',
+  'sonnet-4',
   'claude-3-opus',
   'claude-3-haiku',
   'claude-opus-4',
   'claude-opus-4-1',
+  'claude-sonnet-4',
 ]);
 
 // Events where blocking is by design — their output or side-effects must