
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
cc-devflow
Advanced tools
Harness-First Requirement Development Flow for Claude Code
A comprehensive development workflow system built on Claude Code's official sub-agents, hooks, and settings mechanisms. Transform requirements from planning to code delivery with a deterministic command chain.
Harness-first five-stage workflow from requirement setup to release: /flow:init → /flow:spec → /flow:dev → /flow:verify → /flow:release.
/flow:init → /flow:spec → /flow:dev → /flow:verify → /flow:releaseharness:* runtime operations with checkpoints and resumeharness:resume restores interrupted dispatch from persisted checkpointsnpm run adaptReal-time quality guardian: PreToolUse blocks non-compliant operations, PostToolUse auto-records changes.
Hook Types:
| Hook | Trigger Timing | Functionality |
|---|---|---|
| UserPromptSubmit | When user input is submitted | Intelligently recommends relevant Skills |
| PreToolUse | Before tool use | Blocks non-compliant operations (TDD violations, etc.) |
| PostToolUse | After tool use | Automatically records file changes |
| Stop | When session stops | Provides error handling hints |
Guardrail Workflow:
User edits file → PreToolUse Hook triggers
↓ Path normalization
↓ Rule matching
↓ Content checking
↓ Violation? Block operation : Allow operation
Skipping Guardrails:
# Method 1: File marker
echo "@skip-tdd-check" >> devflow/requirements/REQ-123/TASKS.md
# Method 2: Environment variable
export SKIP_TDD_ENFORCER=1
Intelligent knowledge base activation with grouped Skills and automatic context injection.
Skills-First Architecture (v4.0):
.claude/skills/
├── workflow.yaml # Skill dependency graph (OpenSpec-inspired)
├── workflow/ # 9 Workflow Skills (flow-init, flow-spec, flow-dev, etc.)
├── domain/ # 7 Domain Skills (tdd, debugging, brainstorming)
├── guardrail/ # 3 Guardrail Skills (constitution-guardian, tdd-enforcer)
└── utility/ # 8 Utility Skills (npm-release, skill-creator)
Key Skills by Category:
| Category | Skills | Purpose |
|---|---|---|
| Workflow | flow-init, flow-spec, flow-dev, flow-verify, flow-release | Core development workflow |
| Domain | tdd, debugging, brainstorming, verification | Domain expertise |
| Guardrail | constitution-guardian, tdd-enforcer | Real-time compliance |
| Utility | npm-release, skill-creator, writing-skills | Development tools |
Context Injection (Trellis-inspired):
context.jsonl defining required context filesinject-skill-context.ts hook auto-loads context before Skill execution{REQ} → actual requirement IDDual-layer execution model: Research Agents (11, read-only analysis) + Main Agent (execution).
Execution Model:
Tool Distribution:
# Install globally
npm install -g cc-devflow
# or
pnpm add -g cc-devflow
# Initialize in your project
cc-devflow init
# Compile for specific platform (optional)
cc-devflow adapt --platform cursor
cc-devflow adapt --platform codex
cc-devflow adapt --platform antigravity
cc-devflow adapt --platform qwen
pnpm dlx tiged Dimon94/cc-devflow/.claude .claude
To update to the latest version and synchronize your local project:
# Update globally
npm install -g cc-devflow@latest
# Update local project files (will overwrite conflicts)
cc-devflow init
# Initialize in current directory
cc-devflow init
# Initialize in specific directory
cc-devflow init --dir /path/to/project
# Compile for specific platform
cc-devflow adapt --platform codex
cc-devflow adapt --cwd /path/to/project --platform cursor
# Run harness runtime directly (for npm script delegation)
cc-devflow harness release --change-id REQ-123
cc-devflow init and cc-devflow adapt now auto-bootstrap missing harness:* npm scripts in package.json using portable cc-devflow harness <subcommand> entries (no machine-specific absolute paths), so /flow:* can execute the runtime chain without manual script patching.
# Chinese branch naming support (converts Chinese to pinyin)
pip install pypinyin
.claude/scripts/verify-setup.sh
/flow:init "REQ-001|User Authentication|https://docs.example.com/auth"
/flow:spec "REQ-001"
/flow:dev "REQ-001"
/flow:verify "REQ-001" --strict
/flow:release "REQ-001"
Interactive Demo:
python3 .claude/scripts/demo.py
Core Scripts:
# Environment check
bash .claude/scripts/check-prerequisites.sh
# View task status
bash .claude/scripts/check-task-status.sh --verbose
# Mark task complete
bash .claude/scripts/mark-task-complete.sh T001
# Generate status report
bash .claude/scripts/generate-status-report.sh --format markdown
Run Tests:
# Run all tests
bash .claude/tests/run-all-tests.sh --scripts
# Constitution tests
bash .claude/tests/constitution/run_all_constitution_tests.sh
Purpose: Project-wide planning and architecture design, typically executed once per project at the beginning
| Command | Purpose | Quick Example | Detailed Docs |
|---|---|---|---|
/core-roadmap | 🗺️ Generate Product Roadmap | /core-roadmap | → |
/core-architecture | 🏗️ Generate System Architecture | /core-architecture | → |
/core-guidelines | 📘 Generate Project Guidelines | /core-guidelines | → |
Purpose: Specific requirement development, executed once per requirement (REQ-XXX)
| Command | Purpose | Quick Example | Detailed Docs |
|---|---|---|---|
/flow:init | 📦 Initialize Requirement Context | /flow:init "REQ-123|Feature" | → |
/flow:spec | 📋 Build Task Manifest | /flow:spec "REQ-123" | → |
/flow:dev | 🛠️ Dispatch and Execute Tasks | /flow:dev "REQ-123" | → |
/flow:verify | ✅ Run Report Card Gates | /flow:verify "REQ-123" --strict | → |
/flow:release | 🚢 Release + Cleanup | /flow:release "REQ-123" | → |
/flow:fix | 🐛 Systematic Bug Fix | /flow:fix "BUG-123|Description" | → |
/flow:new | ⚠️ Deprecated alias | Use /flow:init mainline | → |
/flow:clarify | ⚠️ Deprecated | Merged into /flow:spec | → |
/flow:checklist | ⚠️ Deprecated | Use /flow:verify --strict | → |
/flow:quality | ⚠️ Deprecated | Use /flow:verify | → |
Your Scenario:
├─ Plan product direction? → /core-roadmap
├─ Design system architecture? → /core-architecture
├─ Establish coding standards? → /core-guidelines
├─ Start requirement delivery? → /flow:init "REQ-123|Feature|URLs"
├─ Generate task manifest? → /flow:spec "REQ-123"
├─ Execute planned tasks? → /flow:dev "REQ-123"
├─ Run strict quality gate? → /flow:verify "REQ-123" --strict
├─ Continue interrupted development? → /flow:restart "REQ-123"
├─ Check development progress? → /flow:status REQ-123
├─ Re-check consistency anytime? → /flow:verify "REQ-123"
├─ Fix production bug? → /flow:fix "BUG-001|Description"
└─ Ready to release? → /flow:release "REQ-123"
The following Mermaid diagram illustrates the complete cc-devflow workflow, including both project-level and requirement-level processes:
graph TB
Start([Start Project]) --> ProjectLevel{Project-Level Setup}
ProjectLevel --> CoreRoadmap["/core-roadmap<br/>ROADMAP.md & BACKLOG.md"]
ProjectLevel --> CoreArch["/core-architecture<br/>ARCHITECTURE.md"]
ProjectLevel --> CoreGuidelines["/core-guidelines<br/>frontend/backend guidelines"]
ProjectLevel --> CoreStyle["/core-style<br/>STYLE.md"]
CoreRoadmap --> ReqLevel
CoreArch --> ReqLevel
CoreGuidelines --> ReqLevel
CoreStyle --> ReqLevel
ReqLevel([Requirement-Level Development]) --> FlowInit["/flow:init<br/>harness:init + harness:pack"]
FlowInit --> FlowSpec["/flow:spec<br/>harness:plan<br/>task-manifest"]
FlowSpec --> FlowDev["/flow:dev<br/>harness:dispatch/resume<br/>runtime-events"]
FlowDev --> FlowVerify["/flow:verify<br/>harness:verify<br/>report-card"]
FlowVerify --> FlowRelease["/flow:release<br/>harness:release/janitor<br/>release-note"]
FlowRelease --> End([Release Complete])
FlowVerify -.->|Can be re-run at any stage| ReqLevel
style ProjectLevel fill:#e1f5ff
style ReqLevel fill:#fff4e1
style FlowInit fill:#e8f5e9
style FlowSpec fill:#e8f5e9
style FlowDev fill:#f3e5f5
style FlowVerify fill:#e1bee7
style FlowRelease fill:#e0f2f1
style End fill:#e3f2fd
Workflow Notes:
/flow:init → /flow:spec → /flow:dev → /flow:verify → /flow:releasenpm run harness:* operations with persisted checkpoints/flow:verify --strict blocks release when quality gates fail/flow:dev keeps fail-first verification before implementation/flow:new, /flow:clarify, /flow:checklist, /flow:quality remain as migration stubsExecution Model: Research Agents (11, read-only) + Main Agent (execution) Document Structure: Single-track architecture, one requirement directory contains all artifacts Quality Assurance: Constitution v2.0.0 + TDD Enforcement + Real-time Guardrail
clarify-analyst → Clarification questions (11-dimension scan)
prd-writer → PRD generation (must use PRD_TEMPLATE)
checklist-agent → Requirement quality validation (5 dimensions, 6 types) ⭐ NEW
ui-designer → UI prototype (conditional trigger)
tech-architect → Technical design (Anti-Tech-Creep enforcement)
planner → EPIC & TASKS (must use EPIC_TEMPLATE, TASKS_TEMPLATE)
dev-implementer → Implementation plan (research only)
qa-tester → Test plan + Test report
security-reviewer → Security plan + Security report
release-manager → Release plan
devflow/
├── ROADMAP.md # Product roadmap
├── ARCHITECTURE.md # System architecture design
├── BACKLOG.md # Requirement backlog
└── requirements/REQ-123/
├── PRD.md
├── EPIC.md
├── TASKS.md
├── EXECUTION_LOG.md
├── checklists/ # Requirement quality checklists
│ ├── ux.md
│ ├── api.md
│ └── security.md
├── TEST_PLAN.md
├── TEST_REPORT.md
├── SECURITY_PLAN.md
├── SECURITY_REPORT.md
└── RELEASE_PLAN.md
/flow:verify --strict before /flow:release)Minimum Configuration (.claude/settings.json):
{
"permissions": {
"allowGitOperations": true,
"allowNetworkRequests": true,
"allowSubprocesses": true
}
}
{
"hooks": {
"PreToolUse": [{
"matcher": "Edit|Write",
"hooks": [{"type": "command", "command": "..."}]
}]
}
}
# Flow behavior
export FLOW_AUTO_APPROVE=false
export MIN_TEST_COVERAGE=80
export STRICT_TYPE_CHECKING=true
# Guardrail skip
export SKIP_TDD_ENFORCER=1
export SKIP_CONSTITUTION_CHECK=1
Script Tests: 8/8 Passed ✅ (100%) Constitution Tests: 38/38 Passed ✅ (100%)
# Run all tests
bash .claude/tests/run-all-tests.sh --scripts
| Test Suite | Test Cases | Status |
|---|---|---|
test_check_prerequisites | 18 | ✅ 100% |
test_check_task_status | 18 | ✅ 100% |
test_common | 15 | ✅ 100% |
test_mark_task_complete | 15 | ✅ 100% |
test_setup_epic | 13 | ✅ 100% |
test_validate_constitution | 4 | ✅ 100% |
Note: entries before v6.0.0 keep their original command syntax for historical accuracy.
🧩 Harness-First Mainline: Simpler default flow with auditable runtime state
v6.0.0 simplifies cc-devflow around a single default chain and internal runtime engine:
Default Command Chain
/flow:init → /flow:spec → /flow:dev → /flow:verify → /flow:releasenpm run harness:* operations for deterministic orchestrationRuntime Artifacts
context-package.md + harness-state.json for bootstrap statetask-manifest.json + runtime-events.jsonl for execution tracereport-card.json + release-note.md for quality and release evidenceDeprecated Command Migrations
/flow:new → run the 5-stage mainline explicitly/flow:clarify → merged into /flow:spec planning loop/flow:checklist and /flow:quality → replaced by /flow:verify📊 v6.0 Improvements:
| Metric | Before | After | Improvement |
|---|---|---|---|
| Default requirement commands | 8+ mixed paths | 5-stage fixed chain | Simplified |
| Resume capability | Command-specific | Unified harness:resume | Deterministic |
| Quality evidence | Fragmented outputs | Single report card gate | Auditable |
🤝 Claude Team Integration: Multi-Agent Parallel Collaboration
v4.7.0 introduces Claude Team integration for multi-agent parallel development:
Team Mode for /flow:dev - Parallel task execution with multiple agents
--team flag enables Team mode (default 3 agents)--agents N specifies agent count (2-5)New Hooks - Team lifecycle management
TeammateIdle Hook - Task assignment and schedulingTaskCompleted Hook - Quality verification on completionTask Dependency Parser - Intelligent task analysis
parse-task-dependencies.js - Parses TASKS.md format[P] parallel markers, [US*] user story groupsState Recovery - Checkpoint and resume
team-state-recovery.sh - Snapshot and restore Team stateNew Files
.claude/scripts/parse-task-dependencies.js - Task parser.claude/scripts/detect-file-conflicts.sh - Conflict detection.claude/scripts/team-dev-init.sh - Dev team initialization.claude/scripts/team-state-recovery.sh - State recovery.claude/docs/guides/TEAM_MODE_GUIDE.md - Complete usage guide📊 v4.7 Improvements:
| Metric | Before | After | Improvement |
|---|---|---|---|
| Parallel agents | 1 | 3-5 | +400% |
| Requirement completion time | 90 min | 50 min | -45% |
| Task scheduling | Manual | Automatic | 100% |
| Quality verification | Single-point | Distributed | 100% |
🌿 Git Worktree Integration: Parallel Development Support
v4.3.0 introduces Git Worktree integration for parallel development with isolated Claude Code sessions:
Git Worktree Mode (Default) - Isolated development environments
../repo-name-REQ-xxx/ worktree directoriescd instead of git checkout--branch-only flag for traditional branch modeNew Skill: using-git-worktrees - Complete worktree management
worktree-create.sh - Create new worktreeworktree-list.sh - List all worktreesworktree-switch.sh - Switch to worktreeworktree-cleanup.sh - Clean up merged worktreesModified Commands
/flow:init - Default worktree mode, --branch-only for compatibility/flow:release - Automatic worktree cleanup📊 v4.3 Improvements:
| Metric | Before | After | Improvement |
|---|---|---|---|
| Parallel requirements | 1 | 3-5 | +400% |
| Context switch time | 30s | 1s | -97% |
| Session isolation | None | Full | 100% |
🎯 Unified Specification Phase: /flow:spec Command
v4.1.0 merges flow-prd/flow-tech/flow-ui/flow-epic into a single /flow:spec command with parallel execution:
Unified /flow:spec Command - One command for entire specification phase
--skip-tech --skip-ui for small requirements--skip-ui--skip-techParallel Agent Execution - Tech + UI agents run concurrently
_shared/ directorySimplified Workflows (v4.1)
Quick (3 steps): /flow:init --quick → /flow:spec --skip-tech --skip-ui → /flow:dev → /flow:release
Standard (4 steps): /flow:init → /flow:spec → /flow:dev → /flow:verify → /flow:release
Full (5 steps): /flow:init → /flow:spec → /flow:dev → /flow:verify --strict → /flow:release
Deprecations: /flow-prd, /flow-tech, /flow-ui, /flow-epic now deprecated (use /flow:spec)
📊 v4.1 Improvements:
| Metric | Before (v4.0) | After (v4.1) | Improvement |
|---|---|---|---|
| Command calls | 4 | 1 | -75% |
| Design phase time | 8-12 min | 5-8 min | -35% |
| Entry/Exit Gate code | ~280 lines | ~100 lines | -64% |
🏗️ Skills-First Architecture: Unified Skills with Context Injection
v4.0.0 introduces a major architectural refactor, reorganizing 135 files into a unified Skills-First Architecture inspired by Trellis and OpenSpec:
Skills-First Architecture - All Skills organized into 4 groups
workflow/: 9 core workflow Skills (flow-init, flow-spec, flow-dev, etc.)domain/: 7 domain expertise Skills (tdd, debugging, brainstorming, verification)guardrail/: 3 real-time compliance Skills (constitution-guardian, tdd-enforcer)utility/: 8 development tool Skills (npm-release, skill-creator, writing-skills)JSONL Context Injection (Trellis-inspired)
context.jsonl defining required context filesinject-skill-context.ts hook auto-loads context before Skill execution{REQ} replaced with actual requirement ID"optional": trueworkflow.yaml Dependency Graph (OpenSpec-inspired)
requires and generatesSelf-Contained Skills
references/ subdirectoryassets/ subdirectoryMulti-Module Cross-Platform Compiler (v3.0)
.codex/skills/, .codex/prompts/, AGENTS.md.cursor/rules/*.mdc, .cursor/subagents/, hooks.json.qwen/commands/*.toml, .qwen/agents/, CONTEXT.md.agent/skills/, .agent/workflows/, .agent/rules/context.jsonl compilation-time expansion with platform-specific formats📊 v4.0 Improvements:
| Metric | Before | After | Improvement |
|---|---|---|---|
| Maintenance points | 4 directories | 1 directory | -75% |
| Context loading | Manual full load | On-demand auto | -70% tokens |
| Dependency visibility | Implicit | Explicit (workflow.yaml) | +100% |
| Platform module support | Commands only | All modules | +400% |
📁 New Files:
.claude/skills/workflow.yaml - Skill dependency graph.claude/hooks/inject-skill-context.ts - Context injection hook.claude/skills/workflow/*/context.jsonl - Per-Skill context definitionsdevflow/spec/{frontend,backend,shared}/index.md - Specification indexeslib/compiler/context-expander.js - Context.jsonl expansion modulelib/compiler/__tests__/multi-module-emitters.test.js - Multi-module tests🛡️ Discipline System: Iron Law + Rationalization Defense + Pressure Testing
v2.3.0 upgrades the Constitution from a "document" to an "executable discipline system", borrowing best practices from superpowers project:
Iron Law + Rationalization Tables - Pre-block AI Agent rationalization attempts
| Excuse | Reality | formatrationalization-library.md for all rationalizationsTwo-Stage Code Review - /flow-review command (NEW)
spec-reviewer.md and code-quality-reviewer.md agentsVerification Before Completion - Evidence before assertions
verification-before-completion skillverify-gate.sh script for all flow exit gatesSystematic Debugging - /flow-fix enhanced with 4-phase debugging
flow-debugging and flow-tdd skillsBrainstorming Integration - /flow:init now includes brainstorming
BRAINSTORM.md as requirement "North Star"/flow:spec requires BRAINSTORM alignment checkflow-brainstorming skillPressure Testing Framework - TDD for Skills
tests/pressure-scenarios/ with 4 scenariosrun-pressure-tests.sh runnerSkills Fusion - Superpowers skills migrated to local
flow-tdd, flow-debugging, flow-receiving-review, flow-finishing-branchsuperpowers:xxx references replaced with local skillsRalph × Manus Integration - Autonomous development with memory (NEW)
/flow:dev (Autonomous by default)flow-attention-refresh skill with 4 refresh protocolsERROR_LOG.md structured error trackingresearch/attempts/ failure trace recording/flow:init Stage 2.5 Research📋 Constitution v2.1.0:
rationalization-library.md📁 New Files:
.claude/commands/util/cancel-ralph.md - Cancel Ralph loop command.claude/skills/flow-attention-refresh/SKILL.md - 4 attention refresh protocols.claude/hooks/ralph-stop-hook.sh - Stop Hook for self-referential loops.claude/hooks/hooks.json - Hook registration configuration.claude/scripts/setup-ralph-loop.sh - Ralph state initialization script.claude/docs/templates/ERROR_LOG_TEMPLATE.md - Execution error log format.claude/docs/templates/ATTEMPT_TEMPLATE.md - Research attempt log format.claude/agents/spec-reviewer.md - Stage 1 spec compliance reviewer.claude/agents/code-quality-reviewer.md - Stage 2 code quality reviewer.claude/commands/flow-review.md - Two-stage review command (legacy, replaced by .claude/commands/flow/quality.md).claude/rules/rationalization-library.md - Centralized rationalization defense.claude/scripts/verify-gate.sh - Exit gate verification script.claude/skills/flow-brainstorming/ - Brainstorming skill.claude/skills/flow-debugging/ - Systematic debugging skill.claude/skills/flow-tdd/ - TDD enforcement skill.claude/skills/flow-receiving-review/ - Review feedback handling skill.claude/skills/flow-finishing-branch/ - Branch completion decision skill.claude/skills/verification-before-completion/ - Completion verification skilltests/ - Pressure testing framework🔌 Multi-Platform Adaptation: Agent Adapter Architecture + Command Emitter
v2.2.0 introduces comprehensive multi-platform support, enabling cc-devflow workflows to run on multiple AI coding assistants:
Agent Adapter Architecture (REQ-004) - Pluggable adapter layer for platform differences
Command Emitter Compiler (REQ-005) - Single Source of Truth compilation
.claude/ as SSOT, compiles to platform-native formatsnpm run adapt CLI for multi-platform compilation.codex/), Cursor (.cursor/), Qwen (.qwen/), Antigravity (.agent/){SCRIPT:*}, {TEMPLATE:*}, {GUIDE:*}, {AGENT_SCRIPT}, $ARGUMENTSAdapter Compiler (REQ-006) - Multi-platform rules entry file generation
skill-rules.json + skill.md metadata)skills and rulesEntry tracking--rules and --skills CLI options for selective compilation📦 New CLI Tool:
npm run adapt # Compile for all platforms
npm run adapt -- --platform codex # Compile for specific platform
npm run adapt -- --check # Check for drift without compiling
npm run adapt -- --verbose # Show detailed output
🏢 Core Breakthrough: Introduction of Project-Level Commands
v2.1.0's core breakthrough is the introduction of Project-Level Commands, forming a two-tier system with previous Requirement-Level Commands:
Project-Level Commands - Project-wide planning and architecture design (executed once per project at the beginning)
/core-roadmap - Interactive product roadmap generation (6-stage dialogue)/core-architecture - 4 architecture diagram generation (Mermaid format)/core-guidelines - Project guidelines generation (frontend/backend separation)Requirement-Level Commands Enhancement - Stage 1.5 Roadmap & Architecture context loading (flow-init)
📚 Documentation Improvements:
Contributing: Contributing Guide Issues: GitHub Issues Documentation: Complete Documentation
MIT License - See LICENSE file
🌟 Star this repository if cc-devflow helps streamline your development workflow!
FAQs
DevFlow CLI tool
We found that cc-devflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.