@claude-flow/cli 3.27.0 → 3.27.1

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.25.6
+3.23.0

package/.claude/helpers/helpers.manifest.json

@@ -1,13 +1,13 @@
 {
   "manifest": {
-    "version": "3.27.0",
+    "version": "3.27.1",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
-      "hook-handler.cjs": "2a18a761f0dc4839df8b6eeadf8f0ceb6badcc5bf14414c91555711a5e9d4bdc",
+      "hook-handler.cjs": "2e4927ff158c0079a67a6f0ef0b99ac748d600d33798b0a5fbd5a6a82225ec03",
       "intelligence.cjs": "bd1f8e4b034944aee1df0391dc47ac2e8cc4b3aa542c65407a59d49620bbf76b",
-      "statusline.cjs": "8abc67b7512e66fe5f8fe6cc5f099f827de6f7e2023a493f920090248d326e01"
+      "statusline.cjs": "44882bcda49ff6dc1d3738e25b6ec23e07bdc0177321b8cd15dd966ff1c7090f"
     }
   },
-  "signature": "f0oa4b6TIdjXxPc8TFjFEXODgr4+gNsdQXc54NszbvhpR066pXyaCgxrYTsN9iRwFFY1dp6RtaUCuaMpN4NqDg==",
+  "signature": "roS3Sgyq3yDDiQvm0pyB3ZzdGMUoQnRYJjFdbTSW5HZqPRirjf72qgkzQu+Yw+fNfVBrS9ljS/kWpnJKt/6DAw==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -23,6 +23,18 @@ const helpersDir = __dirname;
 // statusline-generator.ts's resolveCliBin() candidate list. Used only to
 // spawn the detached funnel-refresh helper below; failures are silent (no
 // candidate found just means the refresh never fires this session).
+//
+// Verifies dist/src/index.js exists alongside bin/cli.js, not just the bin
+// itself — Claude Code's own plugin marketplace mechanism installs by
+// `git clone`/`git pull` with no build step, so `~/.claude/plugins/
+// marketplaces/ruflo` is a SOURCE-ONLY checkout by construction: bin/cli.js
+// is present on disk but importing dist/src/index.js throws
+// ERR_MODULE_NOT_FOUND on every real command (confirmed live — only
+// `--version` happens to survive it, since it reads package.json directly).
+// Without this check, resolveCliBinForHook() picked that doomed candidate
+// first every time and spawnDetachedFunnelRefresh() below had no fallback,
+// so the promo/disclosure row could never populate for any marketplace
+// install, on any OS.
 function resolveCliBinForHook() {
   try {
     const home = os.homedir();
@@ -38,7 +50,11 @@ function resolveCliBinForHook() {
       path.join(helpersDir, '..', '..', 'bin', 'cli.js'),
     ];
     for (const p of candidates) {
-      if (fs.existsSync(p)) return p;
+      try {
+        if (fs.existsSync(p) && fs.existsSync(path.join(path.dirname(p), '..', 'dist', 'src', 'index.js'))) {
+          return p;
+        }
+      } catch (e) { /* try next candidate */ }
     }
   } catch (e) { /* ignore */ }
   return null;
@@ -54,12 +70,22 @@ function resolveCliBinForHook() {
 // session-restore's own process has already exited, so it actually gets a
 // chance to write the cache. Never awaited here — must not add to
 // SessionStart's own timeout budget.
-function spawnDetachedFunnelRefresh() {
+//
+// No usable local candidate (resolveCliBinForHook() returned null) falls
+// back to npx: this call is detached/unref'd, so a slower npx cold-start
+// costs nothing perceptible — unlike the statusline's own synchronous
+// render path, where local-first exists purely for per-render latency.
+// `--prefer-offline` avoids a registry round trip for the tarball when
+// already cached while still resolving the current `@latest` version.
+function spawnDetachedHookRefresh(subcommand) {
   try {
-    const cliBin = resolveCliBinForHook();
-    if (!cliBin) return;
     const { spawn } = require('child_process');
-    const child = spawn(process.execPath, [cliBin, 'hooks', 'refresh-funnel', '--quiet'], {
+    const cliBin = resolveCliBinForHook();
+    const cmd = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+    const spawnArgs = cliBin
+      ? [process.execPath, [cliBin, 'hooks', subcommand, '--quiet']]
+      : [cmd, ['--prefer-offline', '@claude-flow/cli', 'hooks', subcommand, '--quiet']];
+    const child = spawn(spawnArgs[0], spawnArgs[1], {
       detached: true,
       stdio: 'ignore',
       env: process.env,
@@ -68,24 +94,18 @@ function spawnDetachedFunnelRefresh() {
   } catch (e) { /* best-effort only */ }
 }
 
-// Same detached/unref'd pattern as spawnDetachedFunnelRefresh() above, for
+function spawnDetachedFunnelRefresh() {
+  spawnDetachedHookRefresh('refresh-funnel');
+}
+
+// Same fallback-aware pattern as spawnDetachedFunnelRefresh() above, for
 // ADR-316's co-pilot advisor tip. Safe to call on EVERY session-restore:
 // refresh-advisor's own action checks consent + a 24h TTL BEFORE spending
 // anything, so an unconsented or already-fresh install is a fast no-op file
 // read, never a network call. Never awaited here — must not add to
 // SessionStart's own timeout budget.
 function spawnDetachedAdvisorRefresh() {
-  try {
-    const cliBin = resolveCliBinForHook();
-    if (!cliBin) return;
-    const { spawn } = require('child_process');
-    const child = spawn(process.execPath, [cliBin, 'hooks', 'refresh-advisor', '--quiet'], {
-      detached: true,
-      stdio: 'ignore',
-      env: process.env,
-    });
-    child.unref();
-  } catch (e) { /* best-effort only */ }
+  spawnDetachedHookRefresh('refresh-advisor');
 }
 
 // Safe require with stdout suppression - the helper modules have CLI

package/.claude/helpers/statusline.cjs

@@ -116,7 +116,20 @@ function resolveCliBinCandidates() {
       }
     } catch { /* ignore */ }
   } catch { /* ignore */ }
-  return candidates.filter((p) => { try { return fs.existsSync(p); } catch { return false; } });
+  return candidates.filter((p) => {
+    try {
+      if (!fs.existsSync(p)) return false;
+      // A candidate's bin/cli.js can exist on disk while its compiled
+      // dist/ never got built (Claude Code's own plugin marketplace just
+      // git-clones the repo — no install/build step — so every marketplace
+      // install is a source-only checkout by construction). Importing
+      // dist/src/index.js from bin/cli.js then throws MODULE_NOT_FOUND on
+      // every real command; only --version happens to survive it. Check
+      // for the compiled entrypoint too so a doomed candidate is skipped
+      // up front instead of wasting a spawn-and-fail on every render.
+      return fs.existsSync(path.join(path.dirname(p), '..', 'dist', 'src', 'index.js'));
+    } catch { return false; }
+  });
 }
 
 // Return { fresh, promoFresh, data }. 'fresh' is true only if within the TTL

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-14T03:21:11.654Z",
-  "gitSha": "87212ddb",
+  "generatedAt": "2026-07-14T03:48:36.860Z",
+  "gitSha": "5ca9ce1b",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/dist/src/init/statusline-generator.js

@@ -139,7 +139,20 @@ function resolveCliBinCandidates() {
       }
     } catch { /* ignore */ }
   } catch { /* ignore */ }
-  return candidates.filter((p) => { try { return fs.existsSync(p); } catch { return false; } });
+  return candidates.filter((p) => {
+    try {
+      if (!fs.existsSync(p)) return false;
+      // A candidate's bin/cli.js can exist on disk while its compiled
+      // dist/ never got built (Claude Code's own plugin marketplace just
+      // git-clones the repo — no install/build step — so every marketplace
+      // install is a source-only checkout by construction). Importing
+      // dist/src/index.js from bin/cli.js then throws MODULE_NOT_FOUND on
+      // every real command; only --version happens to survive it. Check
+      // for the compiled entrypoint too so a doomed candidate is skipped
+      // up front instead of wasting a spawn-and-fail on every render.
+      return fs.existsSync(path.join(path.dirname(p), '..', 'dist', 'src', 'index.js'));
+    } catch { return false; }
+  });
 }
 
 // Return { fresh, promoFresh, data }. 'fresh' is true only if within the TTL

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.27.0",
+  "version": "3.27.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",