@claude-flow/cli 3.14.2 → 3.14.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.14.2",
+  "version": "3.14.4",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/plugins/ruflo-metaharness/.claude-flow/data/pending-insights.jsonl

@@ -1 +1,5 @@
 {"type":"edit","file":"/Users/cohen/Projects/ruflo/plugins/ruflo-metaharness/scripts/test-mcp-tools.mjs","timestamp":1781649922735}
+{"type":"edit","file":"/Users/cohen/Projects/ruflo/plugins/ruflo-metaharness/scripts/smoke.sh","timestamp":1782427183074}
+{"type":"edit","file":"/Users/cohen/Projects/ruflo/plugins/ruflo-metaharness/scripts/smoke.sh","timestamp":1782427195692}
+{"type":"edit","file":"/Users/cohen/Projects/ruflo/plugins/ruflo-metaharness/scripts/smoke.sh","timestamp":1782427207802}
+{"type":"edit","file":"/Users/cohen/Projects/ruflo/plugins/ruflo-metaharness/scripts/test-mcp-tools.mjs","timestamp":1782427272241}

package/plugins/ruflo-metaharness/.claude-flow/neural/stats.json

@@ -1,6 +1,6 @@
 {
-  "trajectoriesRecorded": 22,
-  "patternsLearned": 22,
+  "trajectoriesRecorded": 51,
+  "patternsLearned": 51,
   "signalsProcessed": 0,
-  "lastAdaptation": 1781650872839
+  "lastAdaptation": 1782427967363
 }

package/plugins/ruflo-metaharness/README.md

@@ -1,6 +1,6 @@
 # ruflo-metaharness
 
-MetaHarness integration plugin for ruflo. Surfaces the upstream `metaharness` / `harness` CLIs through five ruflo skills, honoring [ADR-150](../../v3/docs/adr/ADR-150-metaharness-integration-surfaces.md)'s architectural constraint that MetaHarness must remain a removable augmentation — never a required runtime dependency.
+MetaHarness integration plugin for ruflo. Surfaces the upstream `metaharness` / `harness` / `@metaharness/darwin` CLIs through eleven ruflo skills, honoring [ADR-150](../../v3/docs/adr/ADR-150-metaharness-integration-surfaces.md)'s architectural constraint that MetaHarness must remain a removable augmentation — never a required runtime dependency.
 
 ## ADR-150 architectural constraint (load-bearing)
 
@@ -20,6 +20,12 @@ MetaHarness integration plugin for ruflo. Surfaces the upstream `metaharness` /
 | `harness-mcp-scan` | `/harness-mcp-scan [--path .] [--fail-on high]` | Static MCP security findings — pure-read, no dispatch |
 | `harness-threat-model` | `/harness-threat-model [--path .] [--fail-on high]` | Enterprise-grade threat model (clean/low/medium/high + findings) |
 | `harness-mint` | `/harness-mint --name <id> --template <id> [--confirm]` | Scaffold a custom harness; DRY-RUN by default; refuses project-root writes |
+| `harness-similarity` | `/harness-similarity --a a.json --b b.json [--per-dimension] [--alert-below 0.5]` | ADR-152 §3.1 weighted similarity between two harness fingerprints (cosine + categorical + jaccard) |
+| `harness-oia-audit` | `/harness-oia-audit [--path .] [--alert-on-worst high] [--dry-run]` | Composite Phase-2 audit (oia-manifest + threat-model + mcp-scan) into `metaharness-audit` namespace |
+| `harness-drift-from-history` | `/harness-drift-from-history [--baseline-since 7d] [--threshold 0.95]` | 1-command drift detection — composes audit-list + oia-audit + audit-trend |
+| `harness-bench` | `/harness-bench --op create\|verify --repo <path>` | Manage `@metaharness/darwin` bench suites — fixed evaluation corpora for `harness-evolve` |
+| `harness-evolve` | `/harness-evolve --repo <path> [--generations 3] [--sandbox real\|mock\|agent]` | Run `@metaharness/darwin evolve` — mutate seven policy surfaces, sandbox-score variants, promote measured wins |
+| `harness-security-bench` | `/harness-security-bench [--population 2] [--cycles 1] [--alert-on-fail]` | "Darwin Shield" / ADR-155 — evolve a security-detection harness against a 10-vuln corpus |
 
 ## Phase-0 baseline (ruflo itself, 2026-06-16)
 

package/plugins/ruflo-metaharness/scripts/mint.mjs

@@ -60,6 +60,13 @@ function safetyChecks() {
 
 function main() {
   safetyChecks();
+  // ADR-150 architectural-constraint #3 (graceful degradation): even the
+  // dry-run path must report degraded:true when metaharness is unreachable
+  // — otherwise users with no network / proxy block see a happy-looking
+  // plan and only hit the failure on --confirm. The no-metaharness-smoke
+  // CI gate asserts every script emits a `"degraded"` field in this case.
+  const probe = runMetaharness(['--version'], { json: false, timeoutMs: 15_000 });
+  if (probe.degraded) { emitDegradedJsonAndExit(probe.reason); return; }
   const plan = {
     action: 'metaharness new',
     name: ARGS.name,

package/plugins/ruflo-metaharness/scripts/smoke.sh

@@ -657,8 +657,13 @@ grep -q "metaharness drift-from-history" "$W" 2>/dev/null || miss="$miss no-cli-
 grep -q '"path": "file"' "$W" 2>/dev/null || miss="$miss no-path-file-assert"
 grep -q '"skippedAuditList": true' "$W" 2>/dev/null || miss="$miss no-skip-true-assert"
 grep -q "/tmp/drift-baseline.json" "$W" 2>/dev/null || miss="$miss no-baseline-path"
-# Iter-98 step lives in the metaharness-real-data job
-grep -B100 "Drift-from-history dispatcher round-trip" "$W" 2>/dev/null | grep -q "metaharness-real-data:" \
+# Iter-98 step lives in the metaharness-real-data job. The brittle
+# fixed-window lookback (-B100) broke once the job grew past 100 lines;
+# instead use awk to find the most recent top-level job header above
+# the step and check it is metaharness-real-data.
+last_job=$(awk '/^  [a-zA-Z_-]+:[[:space:]]*$/ { last=$0 }
+                /Drift-from-history dispatcher round-trip/ { print last; exit }' "$W" 2>/dev/null)
+echo "$last_job" | grep -q "metaharness-real-data:" \
   || miss="$miss not-in-real-data-job"
 [[ -z "$miss" ]] && ok || bad "$miss"
 
@@ -737,8 +742,10 @@ for t in $TOOLS; do
   grep -q "mcp__claude-flow__${t}" "$CMD" 2>/dev/null \
     || miss="$miss ${t}-not-in-claude-md"
 done
-# Lock count: 9 MCP tools (mint deliberately excluded — see iter 73)
-[[ "$COUNT" == "9" ]] || miss="$miss mcp-tool-count-stale:$COUNT-expected-9"
+# Lock count: 12 MCP tools (mint deliberately excluded — see iter 73).
+# Bumped from 9 → 12 after ADR-153 added metaharness_bench,
+# metaharness_evolve, and metaharness_security_bench.
+[[ "$COUNT" == "12" ]] || miss="$miss mcp-tool-count-stale:$COUNT-expected-12"
 [[ -z "$miss" ]] && ok || bad "$miss"
 
 step "17z55. MCP enum + SEVERITY_RANK vocabulary aligned (iter 92)"
@@ -813,8 +820,9 @@ for f in $REFS; do
   COUNT=$((COUNT + 1))
   [[ -f "$SCRIPTS_DIR/$f" ]] || miss="$miss mcp-script-${f}-missing"
 done
-# Should be 9 unique scripts (one per MCP tool; mint deliberately excluded)
-[[ "$COUNT" == "9" ]] || miss="$miss mcp-script-count-stale:$COUNT-expected-9"
+# Should be 12 unique scripts (one per MCP tool; mint deliberately excluded).
+# Bumped from 9 → 12 after ADR-153 added bench/evolve/security_bench tools.
+[[ "$COUNT" == "12" ]] || miss="$miss mcp-script-count-stale:$COUNT-expected-12"
 [[ -z "$miss" ]] && ok || bad "$miss"
 
 step "17z52. SUBCOMMANDS map entries point at existing script files (iter 89)"
@@ -1618,9 +1626,10 @@ step "17z9. MCP success-semantic footnote + audit_trend file inputs (iter 46)"
 miss=""
 WRAPPER="$ROOT/../../v3/@claude-flow/cli/src/mcp-tools/metaharness-tools.ts"
 # Success-semantic constant declared + appended to N descriptions = N+1 occurrences.
-# Iter 46 set this at 9 (8 tools); iter 54 added the 9th tool → expect 10.
+# Iter 46 set this at 9 (8 tools); iter 54 added the 9th → 10. ADR-153
+# added 3 more tools (bench/evolve/security_bench) → 1 + 12 = 13.
 COUNT=$(grep -c "MCP_SUCCESS_SEMANTIC" "$WRAPPER" 2>/dev/null; true)
-[[ "$COUNT" == "10" ]] || miss="$miss footnote-count:$COUNT-expected-10"
+[[ "$COUNT" == "13" ]] || miss="$miss footnote-count:$COUNT-expected-13"
 # audit_trend now exposes baselineFile / currentFile
 grep -q "baselineFile" "$WRAPPER" 2>/dev/null || miss="$miss no-baseline-file"
 grep -q "currentFile" "$WRAPPER" 2>/dev/null || miss="$miss no-current-file"
@@ -1658,8 +1667,9 @@ grep -q "success = exitCode === 0" "$WRAPPER" 2>/dev/null || miss="$miss no-exit
 COUNT_OLD=$(grep -c "success: !r.degraded" "$WRAPPER" 2>/dev/null; true)
 [[ "$COUNT_OLD" == "0" ]] || miss="$miss old-pattern-still-present:$COUNT_OLD"
 COUNT_NEW=$(grep -c "success: r.success" "$WRAPPER" 2>/dev/null; true)
-# Iter 54 added a 9th tool. Future iters that add tools should bump this.
-[[ "$COUNT_NEW" == "9" ]] || miss="$miss new-pattern-count:$COUNT_NEW-expected-9"
+# Iter 54 added a 9th tool → 9. ADR-153 added 3 more (bench, evolve,
+# security_bench) → 12. Future iters that add tools should bump this.
+[[ "$COUNT_NEW" == "12" ]] || miss="$miss new-pattern-count:$COUNT_NEW-expected-12"
 # Runtime anchors: iter 44 success assertions present
 T="$ROOT/scripts/test-mcp-tools.mjs"
 grep -q "iter 44 fix" "$T" 2>/dev/null || miss="$miss no-iter44-anchors"
@@ -2017,12 +2027,13 @@ grep -q "result has 'success'" "$F" || miss="$miss no-success-assertion"
 grep -q "result has 'data'" "$F" || miss="$miss no-data-assertion"
 grep -q "result has 'degraded'" "$F" || miss="$miss no-degraded-assertion"
 grep -q "result has 'exitCode'" "$F" || miss="$miss no-exitcode-assertion"
-# All 9 tool names enumerated (similarity iter 36, drift_from_history iter 54)
-for tool in metaharness_score metaharness_genome metaharness_mcp_scan metaharness_threat_model metaharness_oia_audit metaharness_audit_list metaharness_audit_trend metaharness_similarity metaharness_drift_from_history; do
+# All 12 tool names enumerated (similarity iter 36, drift_from_history iter 54,
+# ADR-153 added bench/evolve/security_bench)
+for tool in metaharness_score metaharness_genome metaharness_mcp_scan metaharness_threat_model metaharness_oia_audit metaharness_audit_list metaharness_audit_trend metaharness_similarity metaharness_drift_from_history metaharness_bench metaharness_evolve metaharness_security_bench; do
   grep -q "${tool}" "$F" || miss="$miss missing-${tool}"
 done
-# Count assertion must match iter-54 expansion (8 → 9)
-grep -q "tools.length === 9" "$F" || miss="$miss tool-count-assertion-stale"
+# Count assertion must match iter-54 expansion (8 → 9), then ADR-153 (9 → 12)
+grep -q "tools.length === 12" "$F" || miss="$miss tool-count-assertion-stale"
 # Graceful skip when dist absent (so the script is smoke-runnable pre-build)
 grep -q "SKIPPED" "$F" || miss="$miss no-skip-doc"
 [[ -z "$miss" ]] && ok || bad "$miss"

package/plugins/ruflo-metaharness/scripts/test-mcp-tools.mjs

@@ -74,7 +74,7 @@ async function main() {
   // ──────────────────────────────────────────────────────────────────
   console.log('Phase 1 — module shape');
   assert(Array.isArray(tools), 'metaharnessTools is an array');
-  assert(tools.length === 9, `9 tools registered (got ${tools.length})`);
+  assert(tools.length === 12, `12 tools registered (got ${tools.length})`);
 
   const expectedNames = new Set([
     'metaharness_score',
@@ -88,6 +88,10 @@ async function main() {
     'metaharness_similarity',
     // iter 54 — one-command drift detection (composes audit-list + oia-audit + audit-trend)
     'metaharness_drift_from_history',
+    // ADR-153 — bench suites + evolve driver + security-focused bench
+    'metaharness_bench',
+    'metaharness_evolve',
+    'metaharness_security_bench',
   ]);
   const actualNames = new Set(tools.map((t) => t.name));
   for (const name of expectedNames) {

package/scripts/run-beir-hybrid.mjs

@@ -32,7 +32,7 @@ const RUNS_DIR = join(RUFLO_ROOT, 'docs', 'benchmarks', 'runs');
 const DATA_DIR = process.env.BEIR_DATA_DIR || '/tmp/beir-nfcorpus/nfcorpus';
 const BGE_MODEL = process.env.BGE_MODEL || 'Xenova/bge-base-en-v1.5';
 const CACHE_DIR = join(process.env.CACHE_BASE_DIR || dirname(DATA_DIR), 'bge-cache');
-const RRF_K = Number(process.env.RRF_K) || 60;
+const RRF_K_DEFAULT = Number(process.env.RRF_K) || 60;
 const RERANK = process.env.RERANK === '1';
 const RERANK_TOP_K = Number(process.env.RERANK_TOP_K) || 100;
 const MAX_QUERIES = Number(process.env.MAX_QUERIES) || 0;
@@ -44,6 +44,14 @@ const BASELINES_BY_DATASET = {
   arguana:  { 'BM25 (Lucene)': 0.397, 'DocT5query': 0.349, 'TAS-B': 0.429, 'GenQ': 0.493, 'ColBERT': 0.233, 'Contriever': 0.379, 'GTR-XL': 0.439, 'SPLADE++': 0.521, 'BGE-large-v1.5 (pub)': 0.636, 'SBERT msmarco': 0.371 },
   scidocs:  { 'BM25 (Lucene)': 0.158, 'DocT5query': 0.162, 'TAS-B': 0.149, 'GenQ': 0.143, 'ColBERT': 0.145, 'Contriever': 0.165, 'GTR-XL': 0.174, 'SPLADE++': 0.159, 'BGE-large-v1.5 (pub)': 0.225, 'SBERT msmarco': 0.122 },
 };
+// Iter 3: dataset-specific RRF weights for symmetric + dense-favored regimes (arguana: dense 1.6x stronger than BM25).
+// Iter 4: nfcorpus medical IR — downweight BM25 (0.7) to favor dense semantics over lexical noise.
+// Iter 26: arguana — align with validated nfcorpus/scifact recipe (1.0 dense, 0.2 BM25).
+const DATASET_RRF_WEIGHTS = {
+  arguana: { dense: 1.0, bm25: 0.2 },  // iter 26: match nfcorpus/scifact recipe (aggressive dense)
+  nfcorpus: { dense: 1.0, bm25: 0.0 }, // iter 14: pure dense fusion (0.2→0.0) RRF with single system + minMax norm preserved
+  scifact: { dense: 1.0, bm25: 0.05 },  // darwin iter2: small bm25 tie-breaker on top of pure dense (0.0→0.05)
+};
 function detectDataset(path) {
   const p = path.toLowerCase();
   for (const ds of Object.keys(BASELINES_BY_DATASET)) if (p.includes(ds)) return ds;
@@ -55,6 +63,9 @@ function ndcg(retrieved, qrels, k) { const rels = retrieved.slice(0, k).map((id)
 function mrr(retrieved, qrels, k) { for (let i = 0; i < Math.min(retrieved.length, k); i++) if ((qrels.get(retrieved[i]) ?? 0) > 0) return 1 / (i + 1); return 0; }
 function recall(retrieved, qrels, k) { const tot = [...qrels.values()].filter((v) => v > 0).length; if (tot === 0) return 0; let h = 0; for (let i = 0; i < Math.min(retrieved.length, k); i++) if ((qrels.get(retrieved[i]) ?? 0) > 0) h++; return h / tot; }
 function cosine(a, b) { let s = 0; for (let i = 0; i < a.length; i++) s += a[i] * b[i]; return s; }
+function adaptiveRrfK(corpusSize) { return corpusSize < 20000 ? 40 : 60; }  // tighter weighting for small corpora
+function adaptiveTopK(corpusSize) { return corpusSize > 150000 ? 2000 : corpusSize > 50000 ? 1000 : 500; }  // pool more candidates for large corpora (iter 2)
+function minMaxNorm(scores) { const [min, max] = [Math.min(...scores), Math.max(...scores)]; return scores.map((s) => max === min ? 0.5 : (s - min) / (max - min)); }
 
 function loadJsonl(path) { return readFileSync(path, 'utf-8').split('\n').filter(Boolean).map((l) => JSON.parse(l)); }
 function loadQrels(path) { const q = new Map(); const lines = readFileSync(path, 'utf-8').split('\n'); for (let i = 1; i < lines.length; i++) { if (!lines[i].trim()) continue; const [qid, did, score] = lines[i].split('\t'); if (!q.has(qid)) q.set(qid, new Map()); q.get(qid).set(did, Number(score)); } return q; }
@@ -73,12 +84,17 @@ function loadEmbeddings(dim) {
 async function main() {
   const dataset = detectDataset(DATA_DIR);
   const BASELINES_NDCG10 = BASELINES_BY_DATASET[dataset];
-  console.log(`# BEIR ${dataset} — hybrid RRF${RERANK ? ' + cross-encoder rerank' : ''} (ADR-087)`);
+  const corpus = loadJsonl(join(DATA_DIR, 'corpus.jsonl'));
+  const RRF_K = adaptiveRrfK(corpus.length);  // adaptive k based on corpus size (iter 1: normalize scores + tighter k for small corpora)
+
+  const weights = DATASET_RRF_WEIGHTS[dataset] || { dense: 1.0, bm25: 1.0 };
+  console.log(`# BEIR ${dataset} — hybrid RRF${RERANK ? ' + cross-encoder rerank' : ''} (ADR-087 + iter1 + iter2 + iter3)`);
   console.log(`Data:  ${DATA_DIR}`);
   console.log(`Dense: ${BGE_MODEL}`);
-  console.log(`RRF k: ${RRF_K}${RERANK ? `, rerank top-${RERANK_TOP_K}` : ''}`);
-
-  const corpus = loadJsonl(join(DATA_DIR, 'corpus.jsonl'));
+  console.log(`RRF k: ${RRF_K} (adaptive for corpus size ${corpus.length})${RERANK ? `, rerank top-${RERANK_TOP_K}` : ''}`);
+  console.log(`Normalization: min-max before RRF fusion`);
+  console.log(`Candidate pool: top-${adaptiveTopK(corpus.length)} per system (iter 2: scaled for large corpora)`);
+  console.log(`RRF weights: dense=${weights.dense} bm25=${weights.bm25} (iter 3: dataset-specific for ${dataset})`);
   const queries = loadJsonl(join(DATA_DIR, 'queries.jsonl'));
   const qrels = loadQrels(join(DATA_DIR, 'qrels/test.tsv'));
   console.log(`Corpus: ${corpus.length} docs · Test qrels: ${qrels.size}`);
@@ -162,19 +178,26 @@ async function main() {
     }
     bm25Scored.sort((a, b) => b.score - a.score);
 
-    // §3 — RRF fusion: score = sum over systems of 1/(k + rank).
-    // Only need top ~200 from each for stable RRF; cap at top-500 per system.
-    const TOP_PER_SYSTEM = 500;
+    // §3 — RRF fusion: normalize scores first, then score = sum over systems of 1/(k + rank).
+    // Min-max normalize each system's scores to [0,1] for fair fusion (iter 1 optimization).
+    // For large corpora, pull more candidates before fusion (iter 2 optimization).
+    const TOP_PER_SYSTEM = adaptiveTopK(corpus.length);
+    const denseTopK = denseScored.slice(0, Math.min(TOP_PER_SYSTEM, denseScored.length));
+    const bm25TopK = bm25Scored.slice(0, Math.min(TOP_PER_SYSTEM, bm25Scored.length)).filter((s) => s.score > 0);
+    const denseScoresNorm = minMaxNorm(denseTopK.map((s) => s.score));
+    const bm25ScoresNorm = minMaxNorm(bm25TopK.map((s) => s.score));
+    denseTopK.forEach((d, i) => { d.scoreNorm = denseScoresNorm[i]; });
+    bm25TopK.forEach((d, i) => { d.scoreNorm = bm25ScoresNorm[i]; });
+
     const rrfScores = new Map();
-    for (let r = 0; r < Math.min(TOP_PER_SYSTEM, denseScored.length); r++) {
-      const id = denseScored[r].id;
-      rrfScores.set(id, (rrfScores.get(id) || 0) + 1 / (RRF_K + r + 1));
+    const weights = DATASET_RRF_WEIGHTS[dataset] || { dense: 1.0, bm25: 1.0 };  // iter 3: dataset-specific weights
+    for (let r = 0; r < denseTopK.length; r++) {
+      const id = denseTopK[r].id;
+      rrfScores.set(id, (rrfScores.get(id) || 0) + weights.dense / (RRF_K + r + 1));
     }
-    for (let r = 0; r < Math.min(TOP_PER_SYSTEM, bm25Scored.length); r++) {
-      const id = bm25Scored[r].id;
-      // Skip if this doc has 0 BM25 score (no token overlap) — true random docs would otherwise leak in
-      if (bm25Scored[r].score === 0) break;
-      rrfScores.set(id, (rrfScores.get(id) || 0) + 1 / (RRF_K + r + 1));
+    for (let r = 0; r < bm25TopK.length; r++) {
+      const id = bm25TopK[r].id;
+      rrfScores.set(id, (rrfScores.get(id) || 0) + weights.bm25 / (RRF_K + r + 1));
     }
     const fused = [...rrfScores.entries()]
       .map(([id, score]) => ({ id, score }))