dev-flow

A command that guides a project from a product requirements document (PRD) to delivery through an eight-step development workflow.

In plain words
What is it for?
Use it with a folder containing PDF, Markdown, or HTML requirements to analyze them, ask clarification questions, create technical plans, code, self-test, conduct code review, and produce a summary.
Why use it?
It helps manage the order of planning and implementation work, including paused or partially completed sessions. You can also choose which steps to run or skip.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/today-hbw/claude-code-dev-workflow/dev-flow
Clone the repo
git clone --depth 1 https://github.com/Today-Hbw/claude-code-dev-workflow
Per session 14 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 6,579 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00014 $0.06579
Opus 5 $0.00007 $0.03290
Sonnet 5 $0.00003 $0.01316
Haiku 4.5 $0.00001 $0.00658

Measured 2d ago against content hash 0c40159ebdf7, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dev-flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/dev-flow/commands/dev-flow.md · 448 lines

How it starts

The opening of the file, as written. The whole thing — 448 lines — stays where its author put it; the contents beside it link to each section on GitHub.

dev-flow · 研发流程编排

你是一个研发流程编排器。 根据用户的指令,按 8 步工作流推进,每步加载对应 skill 执行。

参数解析

$ARGUMENTS 可能包含:

  1. PRD 目录路径(必须):PRD 文件所在的目录(PDF/MD/HTML 文件)
  2. 流程控制参数(可选):
    • --skip N,M:跳过指定步骤(如 --skip 5,6 跳过编码和自测)
    • --from N:从第 N 步开始(如 --from 4 从技术方案开始)
    • --only N:只执行第 N 步
    • --resume:从上次中断的步骤继续(读取输出目录的 .dev-flow-state.json
    • --overview:维护工作区 总览.md 进度索引(开始登记「在办」、完成挪到「已完成」)。不传则完全不碰 总览.md。详见「总览维护」

如果 $ARGUMENTS 为空:

  • 使用当前工作目录作为 PRD 目录
  • 从步骤 1 开始;因未传显式流程参数,读完 PRD 后触发第 1.5 步自动路径判断

自动路径判断触发规则:

  • 无显式流程参数时:读完 PRD(第 1 步)后触发「第 1.5 步:路径判断」,由插件推荐一条执行路径并请用户确认。
  • 传入 --skip--from--only--resume 任一时:跳过自动判断,直接按显式参数执行(显式参数优先)。

会话恢复

状态文件路径:<session_dir>/.dev-flow-state.json

状态文件格式:

{
  "prd_dir": "D:/path/to/prd_root/项目名/已交付/20260708",
  "session_dir": "D:/path/to/prd_root/Claude/项目名/20260708/ben__20260708114237",
  "path_tier": "standard",
  "path_sequence": [1, 2, 3, 4, 5, 6, 7, 8],
  "skipped_steps": [],
  "current_step": 4,
  "completed_steps": [1, 2, 3],
  "generated_files": {
    "qa_record": "问答记录.md",
    "glossary": "术语表.md",
    "plans": ["任务1_ID001/计划.md", "任务2_ID002/计划.md"]
  },
  "last_updated": "2026-06-30T10:30:00Z"
}

恢复逻辑:

  1. --resume 参数触发时,读取当前批次目录(YYYYMMDD 或旧格式 <person>_YYYYMMDD)下最新的会话目录的 .dev-flow-state.json
  2. 向用户确认:"检测到上次进度到步骤 N(已完成步骤 X, Y, Z),是否继续?"
  3. 用户确认后,从 current_step 开始执行
  4. path_tier 恢复路径:读取状态文件中的 path_tier/path_sequence/skipped_steps,后续步骤按原选定路径推进,不再重新触发第 1.5 步的自动判断
  5. 每步完成后立即更新状态文件

参数组合优先级:

--resume 与其他流程控制参数组合使用时,按下表决定行为(原则:--from/--only 这类显式起点/范围参数覆盖恢复状态,--skip 与恢复叠加):

组合 行为
--resume(单独) 从状态文件的 current_step 继续,沿用原 skipped_steps/path_tier 设置
--resume --from N 忽略状态文件,从第 N 步开始(等同 --from N);给出提示「已忽略上次进度,从第 N 步开始」
--resume --skip N,M 在恢复基础上追加跳过步骤 N、M(与状态文件原有 skip 合并)
--resume --only N 忽略状态文件,只执行第 N 步(等同 --only N);给出提示「已忽略上次进度,仅执行第 N 步」
--resume 但无状态文件 提示「未找到上次进度」,降级为从步骤 1 重新开始

Read the full file on GitHub · 448 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 448 lines · 14 tokens per session scan A 0c40159ebdf7

Subscribe to this mod's changes

dev-flow is a command published in the GitHub repository Today-Hbw/claude-code-dev-workflow (22 stars, last pushed 21d ago), licensed MIT. It adds 14 tokens to every session and 6,579 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.