@claude-flow/cli 3.27.0 → 3.27.2

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.25.6
+3.23.0

package/.claude/helpers/helpers.manifest.json

@@ -1,13 +1,13 @@
 {
   "manifest": {
-    "version": "3.27.0",
+    "version": "3.27.2",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
-      "hook-handler.cjs": "2a18a761f0dc4839df8b6eeadf8f0ceb6badcc5bf14414c91555711a5e9d4bdc",
+      "hook-handler.cjs": "2e4927ff158c0079a67a6f0ef0b99ac748d600d33798b0a5fbd5a6a82225ec03",
       "intelligence.cjs": "bd1f8e4b034944aee1df0391dc47ac2e8cc4b3aa542c65407a59d49620bbf76b",
-      "statusline.cjs": "8abc67b7512e66fe5f8fe6cc5f099f827de6f7e2023a493f920090248d326e01"
+      "statusline.cjs": "f553f12a34e7df405a64501cdedb684374ef92670279380bc95f625fc68b2d1b"
     }
   },
-  "signature": "f0oa4b6TIdjXxPc8TFjFEXODgr4+gNsdQXc54NszbvhpR066pXyaCgxrYTsN9iRwFFY1dp6RtaUCuaMpN4NqDg==",
+  "signature": "40Y8+mFRgH7LZZ5TeeDM6aIUcAKrNaN82nyJJzFyepx/HM1chZeK2yEUIbtPhyE0PdyoO4W1OuR3mlxLHgBjCA==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -23,6 +23,18 @@ const helpersDir = __dirname;
 // statusline-generator.ts's resolveCliBin() candidate list. Used only to
 // spawn the detached funnel-refresh helper below; failures are silent (no
 // candidate found just means the refresh never fires this session).
+//
+// Verifies dist/src/index.js exists alongside bin/cli.js, not just the bin
+// itself — Claude Code's own plugin marketplace mechanism installs by
+// `git clone`/`git pull` with no build step, so `~/.claude/plugins/
+// marketplaces/ruflo` is a SOURCE-ONLY checkout by construction: bin/cli.js
+// is present on disk but importing dist/src/index.js throws
+// ERR_MODULE_NOT_FOUND on every real command (confirmed live — only
+// `--version` happens to survive it, since it reads package.json directly).
+// Without this check, resolveCliBinForHook() picked that doomed candidate
+// first every time and spawnDetachedFunnelRefresh() below had no fallback,
+// so the promo/disclosure row could never populate for any marketplace
+// install, on any OS.
 function resolveCliBinForHook() {
   try {
     const home = os.homedir();
@@ -38,7 +50,11 @@ function resolveCliBinForHook() {
       path.join(helpersDir, '..', '..', 'bin', 'cli.js'),
     ];
     for (const p of candidates) {
-      if (fs.existsSync(p)) return p;
+      try {
+        if (fs.existsSync(p) && fs.existsSync(path.join(path.dirname(p), '..', 'dist', 'src', 'index.js'))) {
+          return p;
+        }
+      } catch (e) { /* try next candidate */ }
     }
   } catch (e) { /* ignore */ }
   return null;
@@ -54,12 +70,22 @@ function resolveCliBinForHook() {
 // session-restore's own process has already exited, so it actually gets a
 // chance to write the cache. Never awaited here — must not add to
 // SessionStart's own timeout budget.
-function spawnDetachedFunnelRefresh() {
+//
+// No usable local candidate (resolveCliBinForHook() returned null) falls
+// back to npx: this call is detached/unref'd, so a slower npx cold-start
+// costs nothing perceptible — unlike the statusline's own synchronous
+// render path, where local-first exists purely for per-render latency.
+// `--prefer-offline` avoids a registry round trip for the tarball when
+// already cached while still resolving the current `@latest` version.
+function spawnDetachedHookRefresh(subcommand) {
   try {
-    const cliBin = resolveCliBinForHook();
-    if (!cliBin) return;
     const { spawn } = require('child_process');
-    const child = spawn(process.execPath, [cliBin, 'hooks', 'refresh-funnel', '--quiet'], {
+    const cliBin = resolveCliBinForHook();
+    const cmd = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+    const spawnArgs = cliBin
+      ? [process.execPath, [cliBin, 'hooks', subcommand, '--quiet']]
+      : [cmd, ['--prefer-offline', '@claude-flow/cli', 'hooks', subcommand, '--quiet']];
+    const child = spawn(spawnArgs[0], spawnArgs[1], {
       detached: true,
       stdio: 'ignore',
       env: process.env,
@@ -68,24 +94,18 @@ function spawnDetachedFunnelRefresh() {
   } catch (e) { /* best-effort only */ }
 }
 
-// Same detached/unref'd pattern as spawnDetachedFunnelRefresh() above, for
+function spawnDetachedFunnelRefresh() {
+  spawnDetachedHookRefresh('refresh-funnel');
+}
+
+// Same fallback-aware pattern as spawnDetachedFunnelRefresh() above, for
 // ADR-316's co-pilot advisor tip. Safe to call on EVERY session-restore:
 // refresh-advisor's own action checks consent + a 24h TTL BEFORE spending
 // anything, so an unconsented or already-fresh install is a fast no-op file
 // read, never a network call. Never awaited here — must not add to
 // SessionStart's own timeout budget.
 function spawnDetachedAdvisorRefresh() {
-  try {
-    const cliBin = resolveCliBinForHook();
-    if (!cliBin) return;
-    const { spawn } = require('child_process');
-    const child = spawn(process.execPath, [cliBin, 'hooks', 'refresh-advisor', '--quiet'], {
-      detached: true,
-      stdio: 'ignore',
-      env: process.env,
-    });
-    child.unref();
-  } catch (e) { /* best-effort only */ }
+  spawnDetachedHookRefresh('refresh-advisor');
 }
 
 // Safe require with stdout suppression - the helper modules have CLI

package/.claude/helpers/statusline.cjs

@@ -116,7 +116,20 @@ function resolveCliBinCandidates() {
       }
     } catch { /* ignore */ }
   } catch { /* ignore */ }
-  return candidates.filter((p) => { try { return fs.existsSync(p); } catch { return false; } });
+  return candidates.filter((p) => {
+    try {
+      if (!fs.existsSync(p)) return false;
+      // A candidate's bin/cli.js can exist on disk while its compiled
+      // dist/ never got built (Claude Code's own plugin marketplace just
+      // git-clones the repo — no install/build step — so every marketplace
+      // install is a source-only checkout by construction). Importing
+      // dist/src/index.js from bin/cli.js then throws MODULE_NOT_FOUND on
+      // every real command; only --version happens to survive it. Check
+      // for the compiled entrypoint too so a doomed candidate is skipped
+      // up front instead of wasting a spawn-and-fail on every render.
+      return fs.existsSync(path.join(path.dirname(p), '..', 'dist', 'src', 'index.js'));
+    } catch { return false; }
+  });
 }
 
 // Return { fresh, promoFresh, data }. 'fresh' is true only if within the TTL
@@ -585,6 +598,22 @@ function getCostFromStdin() {
 }
 
 // Read package version from the first package.json we find.
+// Compares dotted-numeric version strings (e.g. "3.27.1" vs "3.27.10").
+// Returns >0 if a>b, <0 if a<b, 0 if equal-as-far-as-parseable. Deliberately
+// simple (no prerelease/build-metadata handling) — this only orders local
+// package.json versions against each other, never anything untrusted from
+// a payload, so a full semver implementation would be dead weight here.
+function compareVersions(a, b) {
+  const pa = String(a).split('.').map((n) => parseInt(n, 10));
+  const pb = String(b).split('.').map((n) => parseInt(n, 10));
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const na = Number.isFinite(pa[i]) ? pa[i] : 0;
+    const nb = Number.isFinite(pb[i]) ? pb[i] : 0;
+    if (na !== nb) return na - nb;
+  }
+  return 0;
+}
+
 function getPkgVersion() {
   let ver = '3.6';
   try {
@@ -616,11 +645,24 @@ function getPkgVersion() {
         );
       }
     } catch { /* ignore */ }
+    // Pick the HIGHEST version among every candidate that exists, not the
+    // first one found. The marketplace plugin path is probed first (list
+    // order above), but Claude Code's own plugin marketplace mechanism
+    // syncs on its own git-pull cadence, independent of npm publishes — a
+    // freshly-published npm version can sit alongside a stale marketplace
+    // checkout for a while (observed live: marketplace one release behind
+    // right after a publish). Taking the first EXISTING candidate meant the
+    // header could show a stale version even when a newer install (e.g.
+    // node_modules/@claude-flow/cli from a plain npm install) was sitting right there.
+    let found = false;
     for (const p of pkgPaths) {
       if (!fs.existsSync(p)) continue;
       try {
         const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
-        if (pkg && typeof pkg.version === 'string' && pkg.version.length > 0) { ver = pkg.version; break; }
+        if (pkg && typeof pkg.version === 'string' && pkg.version.length > 0) {
+          if (!found || compareVersions(pkg.version, ver) > 0) ver = pkg.version;
+          found = true;
+        }
       } catch { /* ignore */ }
     }
   } catch { /* ignore */ }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-14T03:21:11.654Z",
-  "gitSha": "87212ddb",
+  "generatedAt": "2026-07-14T04:02:10.768Z",
+  "gitSha": "dbcfe15f",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/dist/src/init/statusline-generator.js

@@ -139,7 +139,20 @@ function resolveCliBinCandidates() {
       }
     } catch { /* ignore */ }
   } catch { /* ignore */ }
-  return candidates.filter((p) => { try { return fs.existsSync(p); } catch { return false; } });
+  return candidates.filter((p) => {
+    try {
+      if (!fs.existsSync(p)) return false;
+      // A candidate's bin/cli.js can exist on disk while its compiled
+      // dist/ never got built (Claude Code's own plugin marketplace just
+      // git-clones the repo — no install/build step — so every marketplace
+      // install is a source-only checkout by construction). Importing
+      // dist/src/index.js from bin/cli.js then throws MODULE_NOT_FOUND on
+      // every real command; only --version happens to survive it. Check
+      // for the compiled entrypoint too so a doomed candidate is skipped
+      // up front instead of wasting a spawn-and-fail on every render.
+      return fs.existsSync(path.join(path.dirname(p), '..', 'dist', 'src', 'index.js'));
+    } catch { return false; }
+  });
 }
 
 // Return { fresh, promoFresh, data }. 'fresh' is true only if within the TTL
@@ -608,6 +621,22 @@ function getCostFromStdin() {
 }
 
 // Read package version from the first package.json we find.
+// Compares dotted-numeric version strings (e.g. "3.27.1" vs "3.27.10").
+// Returns >0 if a>b, <0 if a<b, 0 if equal-as-far-as-parseable. Deliberately
+// simple (no prerelease/build-metadata handling) — this only orders local
+// package.json versions against each other, never anything untrusted from
+// a payload, so a full semver implementation would be dead weight here.
+function compareVersions(a, b) {
+  const pa = String(a).split('.').map((n) => parseInt(n, 10));
+  const pb = String(b).split('.').map((n) => parseInt(n, 10));
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const na = Number.isFinite(pa[i]) ? pa[i] : 0;
+    const nb = Number.isFinite(pb[i]) ? pb[i] : 0;
+    if (na !== nb) return na - nb;
+  }
+  return 0;
+}
+
 function getPkgVersion() {
   let ver = '3.6';
   try {
@@ -639,11 +668,24 @@ function getPkgVersion() {
         );
       }
     } catch { /* ignore */ }
+    // Pick the HIGHEST version among every candidate that exists, not the
+    // first one found. The marketplace plugin path is probed first (list
+    // order above), but Claude Code's own plugin marketplace mechanism
+    // syncs on its own git-pull cadence, independent of npm publishes — a
+    // freshly-published npm version can sit alongside a stale marketplace
+    // checkout for a while (observed live: marketplace one release behind
+    // right after a publish). Taking the first EXISTING candidate meant the
+    // header could show a stale version even when a newer install (e.g.
+    // node_modules/@claude-flow/cli from a plain npm install) was sitting right there.
+    let found = false;
     for (const p of pkgPaths) {
       if (!fs.existsSync(p)) continue;
       try {
         const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
-        if (pkg && typeof pkg.version === 'string' && pkg.version.length > 0) { ver = pkg.version; break; }
+        if (pkg && typeof pkg.version === 'string' && pkg.version.length > 0) {
+          if (!found || compareVersions(pkg.version, ver) > 0) ver = pkg.version;
+          found = true;
+        }
       } catch { /* ignore */ }
     }
   } catch { /* ignore */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.27.0",
+  "version": "3.27.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",