
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@sungblab/devflow-native
Advanced tools
Local-first workflow continuity harness for AI coding agents.
Devflow Native is a repo-local workflow companion for Claude Code, Codex, and other AI coding agents.
Codex, Claude Code, Gemini, Superpowers, and shell sessions do the work. Devflow records the shared project truth they need to start, finish, and hand off work without losing context.
AI coding agents make implementation faster, but long-running development still breaks at session boundaries:
Devflow's job is to keep that workflow state compact, local, inspectable, and usable by the next agent session.
The primary surface is the repo-local plugin at plugins/devflow.
Devflow is meant to be installed by the coding agent you already use. A maintainer should be able to paste one bootstrap prompt into Codex or Claude Code, let that agent clone or inspect Devflow, install the repo-local harness, verify MCP/plugin/hook wiring, and then restart the agent host with Devflow context active.
Copy this into Codex or Claude Code from the repository you want to equip:
Install Devflow Native for this repository.
Use https://github.com/Sungblab/devflow-native as the source. Do not replace
existing project instructions. Inspect the current repo first, install only the
missing Devflow harness pieces, configure MCP/plugin/hook integration when the
host supports it, verify the result, and tell me exactly whether I need to
restart Codex or Claude Code.
Expected verification:
- Devflow CLI help works.
- Source install or npm link exposes a `devflow` command.
- Devflow doctor/status work for this repo.
- Devflow harness health is ok, or the remaining host limitation is explicit.
- Existing AGENTS.md, CLAUDE.md, README, tests, and project rules are preserved.
When enabled in Codex or Claude Code, the plugin is expected to:
doctor and status context at session startㄱㄱ, 이어가, 끝내, or pr ㄱㄱThe CLI and MCP server are the local engine behind that plugin. They remain useful for debugging, tests, and hosts that do not support plugin hooks yet.
Codex or Claude Code opens the repo
-> Devflow SessionStart hook injects compact repo context
Maintainer says "ㄱㄱ" or "이어가"
-> Devflow UserPromptSubmit hook classifies the workflow intent
-> the agent uses status, active work, and handoff state before editing
Maintainer says "끝내" or "pr ㄱㄱ"
-> Devflow finish skill checks docs impact, gates, risks, and next prompt
-> completion evidence is recorded in .devflow/state/events.jsonl
The local engine exposes direct commands for the installing agent, development, and fallback use:
npm link
devflow --help
devflow --version
node packages/cli/src/index.js --help
node packages/cli/src/index.js doctor --platform windows-powershell --json
node packages/cli/src/index.js status --simple
node packages/cli/src/index.js finish --json
node packages/cli/src/index.js prompt next
node packages/cli/src/index.js prompt latest
npm run mcp:stdio
Before npm publication, npm link is the intended local install path for an
agent-led setup. The package name is @sungblab/devflow-native, and
npm run pack:check verifies that the packed tarball installs into a temporary
consumer project and exposes the devflow binary.
Run npm run publish:check before any real npm release. It performs the
package install check plus npm publish --dry-run and package contents guards.
devflow finish records local evidence in .devflow/state/events.jsonl.
It also writes the latest human-readable prompt projection to
.devflow/next-prompt.md. devflow prompt next emits an ad hoc compact
handoff prompt, and devflow prompt latest reads the persisted prompt for the
next session.
Most AI coding tools optimize for code generation or agent orchestration. Devflow optimizes for continuity:
The durable source of truth is structured .devflow state and append-only
events. CLI, MCP, and plugin skills are different ways to read or write that
same state.
Research notes, paper drafts, pilot fixtures, and non-public evaluation data are kept in a separate private repository. This public repository contains the product implementation and public product documentation only.
packages/core shared product model, local state, gates, handoff contracts
packages/cli terminal command surface over core contracts
packages/mcp MCP handler and stdio transport over the same contracts
packages/adapters agent/session history adapters
plugins/devflow repo-local Codex and Claude Code plugin drafts
docs product, architecture, roadmap, examples, and public notes
templates future project scaffold templates
The current MVP is plugin-first and MCP-backed:
plugins/devflow/.codex-plugin/plugin.jsonplugins/devflow/.claude-plugin/plugin.jsonplugins/devflow/hooks/hooks.jsonplugins/devflow/skills/start/SKILL.mdplugins/devflow/skills/finish/SKILL.mdpackages/mcp/src/stdio.jspackages/cli/src/index.jsThe MCP package exposes the same core contracts through devflow.doctor,
devflow.status, devflow.finish, devflow.record_gate,
devflow.gates_run, devflow.next_prompt, and devflow.handoff_latest, plus
work, split, prompt, session, and health tools.
devflow finish --json now returns a false-completion guard contract with
canClaimDone, doneBlockers, changed files, gate evidence, skipped or failed
gates, remaining risks, a structured handoff, and the next-session prompt.
This repository is still an MVP. The local CLI, MCP handler layer, and repo-local plugin drafts are present. Richer artifact generation, hosted sync, and broader adapter coverage are later work.
FAQs
Local-first workflow continuity harness for AI coding agents.
We found that @sungblab/devflow-native demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.