worclaude 2.4.1 → 2.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -4,6 +4,22 @@ All notable changes to worclaude are documented in this file. Format loosely fol
4
4
 
5
5
  ## [Unreleased]
6
6
 
7
+ ## [2.4.2] — 2026-04-18
8
+
9
+ Hygiene patch closing three drifts surfaced by the 2026-04-18 anthropic-watch feed audit. No user-facing CLI surface change; `worclaude init` / `upgrade` produce identical output to 2.4.1.
10
+
11
+ ### Added
12
+
13
+ - `worclaude doctor` now recognizes the 7 hook events introduced since Claude Code 2.1.101: `TaskCreated`, `TaskCompleted`, `StopFailure`, `InstructionsLoaded`, `ConfigChange`, `Elicitation`, `ElicitationResult`. `VALID_HOOK_EVENTS` grew from 20 to 27 — matching `docs/reference/hooks.md` and `docs/spec/SPEC.md`, which already documented 27.
14
+ - `worclaude doctor` warns on agents declaring `claude-sonnet-4` / `sonnet-4` (Anthropic retires these model IDs on 2026-06-15).
15
+ - New `docs/spec/BACKLOG-v2.1.md` entry — "Sandbox defaults in scaffolded settings" — captures open design questions for scaffolding the Claude Code 2.1.113 `sandbox.network.deniedDomains` feature in a future minor.
16
+ - `docs/reference/upstream-automation.md` — new "Action pinning" policy paragraph and "Version history" section (2.4.0 → 2.4.2).
17
+
18
+ ### Changed
19
+
20
+ - `.github/workflows/upstream-check.yml` — `anthropics/claude-code-action` pinned from floating `@v1` to commit SHA `38ec876110f9fbf8b950c79f534430740c3ac009` (v1.0.101). Closes the pre-existing `TODO(security):` comment in the workflow. Feed content is untrusted user input; floating `@v1` let any future action release run unreviewed against the repo's `CLAUDE_CODE_OAUTH_TOKEN`.
21
+ - `src/commands/doctor.js` version-stamp comment refreshed from v2.1.101 to v2.1.114. `Setup` retained in the hook event set with an inline rationale comment (older worclaude scaffolds may still declare it).
22
+
7
23
  ## [2.4.1] — 2026-04-18
8
24
 
9
25
  Internal CI tooling — no change to the scaffolded output or npm package surface.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "worclaude",
3
- "version": "2.4.1",
3
+ "version": "2.4.2",
4
4
  "description": "The Workflow Layer for Claude Code — scaffold agents, commands, skills, hooks, and memory into any project",
5
5
  "type": "module",
6
6
  "bin": {
@@ -17,12 +17,13 @@ const PASS = 'pass';
17
17
  const WARN = 'warn';
18
18
  const FAIL = 'fail';
19
19
 
20
- // Claude Code v2.1.101 documented hook events (closed set)
20
+ // Claude Code v2.1.114 documented hook events (closed set)
21
21
  const VALID_HOOK_EVENTS = new Set([
22
22
  'PreToolUse',
23
23
  'PostToolUse',
24
24
  'PostToolUseFailure',
25
25
  'Stop',
26
+ 'StopFailure',
26
27
  'PreCompact',
27
28
  'PostCompact',
28
29
  'SessionStart',
@@ -33,6 +34,15 @@ const VALID_HOOK_EVENTS = new Set([
33
34
  'PermissionDenied',
34
35
  'SubagentStart',
35
36
  'SubagentStop',
37
+ 'TaskCreated',
38
+ 'TaskCompleted',
39
+ 'InstructionsLoaded',
40
+ 'ConfigChange',
41
+ 'Elicitation',
42
+ 'ElicitationResult',
43
+ // Setup: retained conservatively — not in 2.1.114 docs, but older
44
+ // worclaude scaffolds may still declare it; removing would flip
45
+ // doctor from PASS → FAIL on legitimate prior installs.
36
46
  'Setup',
37
47
  'CwdChanged',
38
48
  'FileChanged',
@@ -41,14 +51,17 @@ const VALID_HOOK_EVENTS = new Set([
41
51
  'TeammateIdle',
42
52
  ]);
43
53
 
44
- // Models deprecated in favor of alias-only references (opus, sonnet, haiku)
54
+ // Models deprecated in favor of alias-only references (opus, sonnet, haiku).
55
+ // claude-sonnet-4 / sonnet-4: Anthropic retires 2026-06-15.
45
56
  const DEPRECATED_MODELS = new Set([
46
57
  'opus-4',
47
58
  'opus-4.1',
59
+ 'sonnet-4',
48
60
  'claude-3-opus',
49
61
  'claude-3-haiku',
50
62
  'claude-opus-4',
51
63
  'claude-opus-4-1',
64
+ 'claude-sonnet-4',
52
65
  ]);
53
66
 
54
67
  // Events where blocking is by design — their output or side-effects must