@claude-flow/cli 3.32.1 → 3.32.3

package/dist/src/services/native-training.js

@@ -1,141 +0,0 @@
-/**
- * Native training via @ruvector/ruvllm's TrainingPipeline (#2549 follow-up).
- *
- * `neural train` historically trained only on the RuVector WASM path
- * (MicroLoRA + InfoNCE) and its "checkpoint" was a freshly-constructed
- * adapter's weights — the native TrainingPipeline (real epochs, loss
- * history, early stopping, EWC registration, disk checkpoints since
- * ruvllm 2.5.7) was never exercised. This service routes the LoRA
- * training leg through it.
- *
- * Batch formulation: pattern-alignment pairs — input = embedding[i],
- * target = embedding[i+1 mod n], quality 1.0 — the MSE analogue of the
- * WASM path's anchor→positive contrastive objective (adjacent training
- * items belong to the same pattern family by construction).
- *
- * Graceful: returns null when @ruvector/ruvllm is absent or anything
- * throws — callers fall back to the WASM path.
- */
-import { createRequire } from 'module';
-import { mkdirSync, existsSync } from 'fs';
-import { dirname } from 'path';
-/**
- * Thrown when an explicit --resume checkpoint cannot be found or loaded.
- * Distinct from the generic "native unavailable → null" degradation so the
- * caller can surface a loud, exit-1 failure rather than fresh training.
- */
-export class ResumeFailedError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ResumeFailedError';
-    }
-}
-export function nativeTrainingAvailable() {
-    try {
-        createRequire(import.meta.url).resolve('@ruvector/ruvllm');
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function runNativeTraining(opts) {
-    const { embeddings, epochs, batchSize, learningRate, dim, validationSplit, resumeFrom, checkpointPath } = opts;
-    if (embeddings.length < 2)
-        return null;
-    try {
-        const req = createRequire(import.meta.url);
-        const ruvllm = req('@ruvector/ruvllm');
-        const pipelineConfig = {
-            learningRate,
-            batchSize,
-            epochs,
-            inputDim: dim,
-            outputDim: dim,
-        };
-        // 0 (or omitted) disables validation; only pass a real holdout through.
-        if (typeof validationSplit === 'number' && validationSplit > 0) {
-            pipelineConfig.validationSplit = validationSplit;
-        }
-        const pipeline = new ruvllm.TrainingPipeline(pipelineConfig);
-        // Resume BEFORE training. Prefer resumeFrom() (2.6.0 — epoch position +
-        // optimizer state); fall back to loadCheckpoint() (2.5.7 — weights only).
-        // Any failure with an explicit --resume is loud (ResumeFailedError),
-        // never silent fresh training.
-        let resumed = false;
-        let resumeMode;
-        if (resumeFrom) {
-            if (!existsSync(resumeFrom)) {
-                throw new ResumeFailedError(`--resume checkpoint not found: ${resumeFrom}`);
-            }
-            try {
-                if (typeof pipeline.resumeFrom === 'function') {
-                    pipeline.resumeFrom(resumeFrom);
-                    resumeMode = 'resumeFrom';
-                }
-                else {
-                    const ok = pipeline.loadCheckpoint(resumeFrom);
-                    if (ok === false)
-                        throw new Error('loadCheckpoint returned false');
-                    resumeMode = 'loadCheckpoint';
-                }
-                resumed = true;
-            }
-            catch (e) {
-                if (e instanceof ResumeFailedError)
-                    throw e;
-                throw new ResumeFailedError(`--resume failed to load checkpoint ${resumeFrom}: ${e.message}`);
-            }
-        }
-        // Pattern-alignment pairs, chunked into pipeline batches.
-        const inputs = [];
-        const targets = [];
-        const qualities = [];
-        for (let i = 0; i < embeddings.length; i++) {
-            inputs.push(Array.from(embeddings[i]));
-            targets.push(Array.from(embeddings[(i + 1) % embeddings.length]));
-            qualities.push(1.0);
-        }
-        for (let i = 0; i < inputs.length; i += batchSize) {
-            pipeline.addBatch(inputs.slice(i, i + batchSize), targets.slice(i, i + batchSize), qualities.slice(i, i + batchSize));
-        }
-        const r = pipeline.train();
-        // When validation is disabled the pipeline reports Infinity for
-        // bestValLoss — normalize any non-finite value to null so downstream
-        // "bestValLoss !== null ⇒ validation ran" holds for the results table.
-        const bestValLoss = typeof r.bestValLoss === 'number' && Number.isFinite(r.bestValLoss)
-            ? r.bestValLoss
-            : null;
-        const result = {
-            epochs: r.epochs,
-            steps: r.steps,
-            finalLoss: r.finalLoss,
-            bestValLoss,
-            durationMs: r.durationMs,
-            earlyStopped: !!r.earlyStopped,
-            resumed,
-            resumeMode,
-        };
-        if (checkpointPath) {
-            try {
-                mkdirSync(dirname(checkpointPath), { recursive: true });
-                const saved = pipeline.saveCheckpoint(checkpointPath);
-                // <2.5.7 returns undefined and writes nothing — verify on disk.
-                if (existsSync(checkpointPath)) {
-                    result.checkpointPath = checkpointPath;
-                    result.checkpointBytes = saved?.bytes;
-                }
-            }
-            catch { /* checkpoint is best-effort; training result stands */ }
-        }
-        return result;
-    }
-    catch (err) {
-        // An explicit --resume failure must propagate as a loud error; every
-        // other failure degrades to null so callers fall back to the WASM path.
-        if (err instanceof ResumeFailedError)
-            throw err;
-        return null;
-    }
-}
-//# sourceMappingURL=native-training.js.map

package/dist/src/services/registry-api.d.ts

@@ -1,58 +0,0 @@
-/**
- * Registry API Client
- * Secure integration with Claude Flow Cloud Functions
- *
- * Security:
- * - HTTPS only
- * - No credentials stored in code
- * - Rate limiting respected
- * - Input validation
- */
-export interface RatingResponse {
-    success: boolean;
-    itemId: string;
-    average: number;
-    count: number;
-    error?: string;
-}
-export interface BulkRatingsResponse {
-    [itemId: string]: {
-        average: number;
-        count: number;
-    };
-}
-export interface AnalyticsResponse {
-    downloads: Record<string, number>;
-    exports: number;
-    imports: number;
-    publishes: number;
-}
-/**
- * Rate a plugin or model
- */
-export declare function rateItem(itemId: string, rating: number, itemType?: 'plugin' | 'model', userId?: string): Promise<RatingResponse>;
-/**
- * Get ratings for a single item
- */
-export declare function getRating(itemId: string, itemType?: 'plugin' | 'model'): Promise<RatingResponse>;
-/**
- * Get ratings for multiple items (batch)
- */
-export declare function getBulkRatings(itemIds: string[], itemType?: 'plugin' | 'model'): Promise<BulkRatingsResponse>;
-/**
- * Get analytics data
- */
-export declare function getAnalytics(): Promise<AnalyticsResponse>;
-/**
- * Track a download event
- */
-export declare function trackDownload(pluginId: string): Promise<void>;
-/**
- * Check API health
- */
-export declare function checkHealth(): Promise<{
-    healthy: boolean;
-    latestCid?: string;
-    error?: string;
-}>;
-//# sourceMappingURL=registry-api.d.ts.map

package/dist/src/services/registry-api.js

@@ -1,146 +0,0 @@
-/**
- * Registry API Client
- * Secure integration with Claude Flow Cloud Functions
- *
- * Security:
- * - HTTPS only
- * - No credentials stored in code
- * - Rate limiting respected
- * - Input validation
- */
-const REGISTRY_API_URL = 'https://us-central1-claude-flow.cloudfunctions.net/publish-registry';
-/**
- * Validate item ID to prevent injection
- */
-function validateItemId(itemId) {
-    // Only allow alphanumeric, @, /, -, _
-    return /^[@a-zA-Z0-9\/_-]+$/.test(itemId) && itemId.length < 100;
-}
-/**
- * Validate rating value
- */
-function validateRating(rating) {
-    return Number.isInteger(rating) && rating >= 1 && rating <= 5;
-}
-/**
- * Rate a plugin or model
- */
-export async function rateItem(itemId, rating, itemType = 'plugin', userId) {
-    if (!validateItemId(itemId)) {
-        throw new Error('Invalid item ID');
-    }
-    if (!validateRating(rating)) {
-        throw new Error('Rating must be integer 1-5');
-    }
-    const response = await fetch(`${REGISTRY_API_URL}?action=rate`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            itemId,
-            rating,
-            itemType,
-            ...(userId && { userId }),
-        }),
-        signal: AbortSignal.timeout(10000),
-    });
-    if (!response.ok) {
-        const error = await response.text();
-        throw new Error(`Rating failed: ${error}`);
-    }
-    return response.json();
-}
-/**
- * Get ratings for a single item
- */
-export async function getRating(itemId, itemType = 'plugin') {
-    if (!validateItemId(itemId)) {
-        throw new Error('Invalid item ID');
-    }
-    const params = new URLSearchParams({
-        action: 'get-ratings',
-        itemId,
-        itemType,
-    });
-    const response = await fetch(`${REGISTRY_API_URL}?${params}`, {
-        signal: AbortSignal.timeout(10000),
-    });
-    if (!response.ok) {
-        throw new Error('Failed to get ratings');
-    }
-    return response.json();
-}
-/**
- * Get ratings for multiple items (batch)
- */
-export async function getBulkRatings(itemIds, itemType = 'plugin') {
-    // Validate all IDs
-    for (const id of itemIds) {
-        if (!validateItemId(id)) {
-            throw new Error(`Invalid item ID: ${id}`);
-        }
-    }
-    // Limit batch size
-    const limitedIds = itemIds.slice(0, 50);
-    const response = await fetch(`${REGISTRY_API_URL}?action=bulk-ratings`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            itemIds: limitedIds,
-            itemType,
-        }),
-        signal: AbortSignal.timeout(15000),
-    });
-    if (!response.ok) {
-        throw new Error('Failed to get bulk ratings');
-    }
-    return response.json();
-}
-/**
- * Get analytics data
- */
-export async function getAnalytics() {
-    const response = await fetch(`${REGISTRY_API_URL}?action=analytics`, {
-        signal: AbortSignal.timeout(10000),
-    });
-    if (!response.ok) {
-        throw new Error('Failed to get analytics');
-    }
-    return response.json();
-}
-/**
- * Track a download event
- */
-export async function trackDownload(pluginId) {
-    if (!validateItemId(pluginId)) {
-        return; // Silently fail for invalid IDs
-    }
-    try {
-        await fetch(`${REGISTRY_API_URL}?action=track-download`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ pluginId }),
-            signal: AbortSignal.timeout(5000),
-        });
-    }
-    catch {
-        // Non-critical, don't throw
-    }
-}
-/**
- * Check API health
- */
-export async function checkHealth() {
-    try {
-        const response = await fetch(`${REGISTRY_API_URL}?action=status`, {
-            signal: AbortSignal.timeout(5000),
-        });
-        return response.json();
-    }
-    catch (error) {
-        return {
-            healthy: false,
-            error: error instanceof Error ? error.message : 'Unknown error',
-        };
-    }
-}
-//# sourceMappingURL=registry-api.js.map

package/dist/src/services/repo-supervisor.d.ts

@@ -1,70 +0,0 @@
-/**
- * #2661 root-fix — one repository-level supervisor.
- *
- * Ten worktree daemons of the same repository independently deciding "is it
- * time to run audit/optimize/testgaps" every tick is the redundant-scheduler
- * half of the original cardinality bug — the budget ledger and job dedup
- * (global-ai-budget.ts, ai-job-dedup.ts) already bound and dedupe the actual
- * `claude --print` spend, but every daemon still runs its own timer and its
- * own "should I launch" decision. This module elects exactly ONE daemon per
- * repositoryId to own the recurring AI-worker schedule; every other worktree
- * of that repository stays a lease-only participant (workspace-lease.ts) —
- * it keeps running its cheap, $0 local-only workers (map/consolidate/backup)
- * on its own schedule, but does not attempt headless (`claude --print`)
- * execution for its recurring ticks. An explicit `daemon trigger --headless`
- * in a non-supervisor worktree is still honored (still budget/dedup-gated) —
- * this module only governs the unattended recurring schedule.
- *
- * Election is a simple lock-protected takeover, same pattern as
- * global-ai-budget.ts:
- *   - No record, a dead PID, or a stale heartbeat (>SUPERVISOR_STALE_MS) →
- *     the calling daemon takes over.
- *   - A live supervisor with a fresh heartbeat → the calling daemon is not
- *     elected; it does nothing (never overwrites a healthy supervisor).
- *
- * The registry lives under the user's home directory so every worktree's
- * daemon can see it:
- *
- *   ~/.claude-flow/supervisors/<repositoryId>.json
- */
-export declare const SUPERVISOR_STALE_MS: number;
-export interface SupervisorRecord {
-    worktreeRoot: string;
-    pid: number;
-    electedAt: number;
-    lastHeartbeat: number;
-}
-export interface SupervisorElectionResult {
-    isSupervisor: boolean;
-    record: SupervisorRecord | null;
-}
-export declare class RepoSupervisorRegistry {
-    private readonly dir;
-    constructor(options?: {
-        baseDir?: string;
-    });
-    private fileFor;
-    private ensureDir;
-    private withLock;
-    private readRecord;
-    private writeRecord;
-    private isStale;
-    /**
-     * Attempt election (or renewal, if this process already holds it). Safe
-     * and cheap to call on every daemon tick — a no-op write when nothing
-     * needs to change would still cost a lock+read+write, so callers should
-     * still throttle to their own heartbeat cadence rather than calling this
-     * per-worker-tick.
-     */
-    electOrRenew(repositoryId: string, worktreeRoot: string): Promise<SupervisorElectionResult>;
-    /** Cheap read-only check — does NOT renew or elect. */
-    isSupervisor(repositoryId: string, worktreeRoot: string): boolean;
-    /** Release supervisor status on graceful shutdown, so the next tick elsewhere can take over promptly. Best-effort. */
-    release(repositoryId: string, worktreeRoot: string): Promise<void>;
-    /** Snapshot for `daemon status --all`. Read-only, never mutates. */
-    getRecord(repositoryId: string): SupervisorRecord | null;
-}
-export declare function getRepoSupervisorRegistry(): RepoSupervisorRegistry;
-/** Test hook: reset the singleton (e.g. after changing RUFLO_AI_BUDGET_DIR). */
-export declare function resetRepoSupervisorRegistryForTests(): void;
-//# sourceMappingURL=repo-supervisor.d.ts.map

package/dist/src/services/repo-supervisor.js

@@ -1,228 +0,0 @@
-/**
- * #2661 root-fix — one repository-level supervisor.
- *
- * Ten worktree daemons of the same repository independently deciding "is it
- * time to run audit/optimize/testgaps" every tick is the redundant-scheduler
- * half of the original cardinality bug — the budget ledger and job dedup
- * (global-ai-budget.ts, ai-job-dedup.ts) already bound and dedupe the actual
- * `claude --print` spend, but every daemon still runs its own timer and its
- * own "should I launch" decision. This module elects exactly ONE daemon per
- * repositoryId to own the recurring AI-worker schedule; every other worktree
- * of that repository stays a lease-only participant (workspace-lease.ts) —
- * it keeps running its cheap, $0 local-only workers (map/consolidate/backup)
- * on its own schedule, but does not attempt headless (`claude --print`)
- * execution for its recurring ticks. An explicit `daemon trigger --headless`
- * in a non-supervisor worktree is still honored (still budget/dedup-gated) —
- * this module only governs the unattended recurring schedule.
- *
- * Election is a simple lock-protected takeover, same pattern as
- * global-ai-budget.ts:
- *   - No record, a dead PID, or a stale heartbeat (>SUPERVISOR_STALE_MS) →
- *     the calling daemon takes over.
- *   - A live supervisor with a fresh heartbeat → the calling daemon is not
- *     elected; it does nothing (never overwrites a healthy supervisor).
- *
- * The registry lives under the user's home directory so every worktree's
- * daemon can see it:
- *
- *   ~/.claude-flow/supervisors/<repositoryId>.json
- */
-import * as fs from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-// Longer than any plausible daemon heartbeat interval (daemons renew via the
-// existing 60s lifecycle-monitor tick) so a merely-slow tick never triggers
-// a false takeover, but short enough that a crashed supervisor's worktree
-// yields the schedule within a few minutes rather than indefinitely.
-export const SUPERVISOR_STALE_MS = 3 * 60 * 1000;
-const LOCK_STALE_MS = 10_000;
-function delay(ms) {
-    return new Promise((r) => setTimeout(r, ms));
-}
-function isProcessAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Invariant 9 (#2661): registry files must never be symlinks. */
-function assertNotSymlink(path) {
-    try {
-        const st = fs.lstatSync(path);
-        if (st.isSymbolicLink()) {
-            throw new Error(`Repo-supervisor file is a symlink (refusing): ${path}`);
-        }
-    }
-    catch (e) {
-        if (e.code === 'ENOENT')
-            return;
-        throw e;
-    }
-}
-export class RepoSupervisorRegistry {
-    dir;
-    constructor(options) {
-        this.dir = options?.baseDir
-            ?? process.env.RUFLO_AI_BUDGET_DIR
-            ?? join(homedir(), '.claude-flow');
-    }
-    fileFor(repositoryId) {
-        return join(this.dir, 'supervisors', `${repositoryId}.json`);
-    }
-    ensureDir() {
-        const dir = join(this.dir, 'supervisors');
-        if (!fs.existsSync(dir))
-            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    async withLock(repositoryId, fn) {
-        this.ensureDir();
-        const lockFile = `${this.fileFor(repositoryId)}.lock`;
-        const deadline = Date.now() + 2000;
-        for (;;) {
-            try {
-                const fd = fs.openSync(lockFile, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY, 0o600);
-                fs.writeSync(fd, String(process.pid));
-                fs.closeSync(fd);
-                try {
-                    return fn();
-                }
-                finally {
-                    try {
-                        fs.unlinkSync(lockFile);
-                    }
-                    catch { /* already gone */ }
-                }
-            }
-            catch (e) {
-                if (e.code !== 'EEXIST')
-                    throw e;
-                try {
-                    const st = fs.lstatSync(lockFile);
-                    if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
-                        fs.unlinkSync(lockFile);
-                        continue;
-                    }
-                }
-                catch { /* raced — retry */ }
-                if (Date.now() > deadline)
-                    throw new Error('timed out acquiring repo-supervisor lock');
-                await delay(25);
-            }
-        }
-    }
-    readRecord(repositoryId) {
-        const file = this.fileFor(repositoryId);
-        assertNotSymlink(file);
-        if (!fs.existsSync(file))
-            return null;
-        try {
-            const raw = JSON.parse(fs.readFileSync(file, 'utf-8'));
-            if (raw && typeof raw.pid === 'number' && typeof raw.lastHeartbeat === 'number') {
-                return raw;
-            }
-        }
-        catch { /* corrupt — treat as absent */ }
-        return null;
-    }
-    writeRecord(repositoryId, record) {
-        const file = this.fileFor(repositoryId);
-        assertNotSymlink(file);
-        const tmp = `${file}.tmp.${process.pid}`;
-        fs.writeFileSync(tmp, JSON.stringify(record), { mode: 0o600 });
-        fs.renameSync(tmp, file);
-    }
-    isStale(record, now) {
-        return now - record.lastHeartbeat > SUPERVISOR_STALE_MS || !isProcessAlive(record.pid);
-    }
-    /**
-     * Attempt election (or renewal, if this process already holds it). Safe
-     * and cheap to call on every daemon tick — a no-op write when nothing
-     * needs to change would still cost a lock+read+write, so callers should
-     * still throttle to their own heartbeat cadence rather than calling this
-     * per-worker-tick.
-     */
-    async electOrRenew(repositoryId, worktreeRoot) {
-        try {
-            return await this.withLock(repositoryId, () => {
-                const now = Date.now();
-                const existing = this.readRecord(repositoryId);
-                if (existing && existing.pid === process.pid && existing.worktreeRoot === worktreeRoot) {
-                    const renewed = { ...existing, lastHeartbeat: now };
-                    this.writeRecord(repositoryId, renewed);
-                    return { isSupervisor: true, record: renewed };
-                }
-                if (!existing || this.isStale(existing, now)) {
-                    const record = { worktreeRoot, pid: process.pid, electedAt: now, lastHeartbeat: now };
-                    this.writeRecord(repositoryId, record);
-                    return { isSupervisor: true, record };
-                }
-                // A live supervisor already owns this repository — never overwrite it.
-                return { isSupervisor: false, record: existing };
-            });
-        }
-        catch {
-            // Fail closed on the SCHEDULE side too: if we can't safely coordinate,
-            // assume we are NOT the supervisor rather than risk two daemons both
-            // believing they own the schedule. The budget ledger is the actual
-            // hard invariant either way.
-            return { isSupervisor: false, record: null };
-        }
-    }
-    /** Cheap read-only check — does NOT renew or elect. */
-    isSupervisor(repositoryId, worktreeRoot) {
-        try {
-            const existing = this.readRecord(repositoryId);
-            if (!existing)
-                return false;
-            const now = Date.now();
-            if (this.isStale(existing, now))
-                return false;
-            return existing.pid === process.pid && existing.worktreeRoot === worktreeRoot;
-        }
-        catch {
-            return false;
-        }
-    }
-    /** Release supervisor status on graceful shutdown, so the next tick elsewhere can take over promptly. Best-effort. */
-    async release(repositoryId, worktreeRoot) {
-        try {
-            await this.withLock(repositoryId, () => {
-                const existing = this.readRecord(repositoryId);
-                if (existing && existing.pid === process.pid && existing.worktreeRoot === worktreeRoot) {
-                    const file = this.fileFor(repositoryId);
-                    try {
-                        fs.unlinkSync(file);
-                    }
-                    catch { /* already gone */ }
-                }
-            });
-        }
-        catch { /* best-effort */ }
-    }
-    /** Snapshot for `daemon status --all`. Read-only, never mutates. */
-    getRecord(repositoryId) {
-        try {
-            const existing = this.readRecord(repositoryId);
-            if (!existing || this.isStale(existing, Date.now()))
-                return null;
-            return existing;
-        }
-        catch {
-            return null;
-        }
-    }
-}
-let registryInstance = null;
-export function getRepoSupervisorRegistry() {
-    if (!registryInstance)
-        registryInstance = new RepoSupervisorRegistry();
-    return registryInstance;
-}
-/** Test hook: reset the singleton (e.g. after changing RUFLO_AI_BUDGET_DIR). */
-export function resetRepoSupervisorRegistryForTests() {
-    registryInstance = null;
-}
-//# sourceMappingURL=repo-supervisor.js.map