@claude-flow/cli 3.32.1 → 3.32.3

package/dist/src/commands/update.js

@@ -1,276 +0,0 @@
-/**
- * V3 CLI Update Command
- * Auto-update system for @claude-flow packages (ADR-025)
- */
-import { output } from '../output.js';
-import { checkForUpdates, getInstalledVersion, DEFAULT_CONFIG, } from '../update/checker.js';
-import { executeMultipleUpdates, rollbackUpdate, getUpdateHistory, clearHistory, } from '../update/executor.js';
-import { clearCache } from '../update/rate-limiter.js';
-// Helper functions
-function formatUpdateType(type) {
-    switch (type) {
-        case 'major':
-            return output.error('MAJOR');
-        case 'minor':
-            return output.warning('minor');
-        case 'patch':
-            return output.success('patch');
-        default:
-            return type;
-    }
-}
-function formatPriority(priority) {
-    switch (priority) {
-        case 'critical':
-            return output.error('CRITICAL');
-        case 'high':
-            return output.warning('high');
-        case 'normal':
-            return output.info('normal');
-        case 'low':
-            return output.dim('low');
-        default:
-            return priority;
-    }
-}
-// Subcommand: check
-const checkCommand = {
-    name: 'check',
-    description: 'Check for available @claude-flow package updates',
-    options: [
-        { name: 'force', description: 'Force check (ignore rate limit)', type: 'boolean' },
-        { name: 'json', description: 'Output as JSON', type: 'boolean' },
-    ],
-    async action(ctx) {
-        const { flags } = ctx;
-        if (flags.force) {
-            process.env.CLAUDE_FLOW_FORCE_UPDATE = 'true';
-        }
-        try {
-            const { results, skipped, reason } = await checkForUpdates(DEFAULT_CONFIG);
-            if (skipped) {
-                output.printInfo(`Update check skipped: ${reason}`);
-                output.writeln('Use --force to check anyway');
-                return { success: true };
-            }
-            if (flags.json) {
-                console.log(JSON.stringify(results, null, 2));
-                return { success: true };
-            }
-            if (results.length === 0) {
-                output.printSuccess('All @claude-flow packages are up to date!');
-                return { success: true };
-            }
-            output.writeln();
-            output.writeln(output.highlight('═══ Available Updates ═══'));
-            output.writeln();
-            output.printTable({
-                columns: [
-                    { key: 'package', header: 'Package' },
-                    { key: 'current', header: 'Current' },
-                    { key: 'latest', header: 'Latest' },
-                    { key: 'type', header: 'Type' },
-                    { key: 'priority', header: 'Priority' },
-                    { key: 'auto', header: 'Auto' },
-                ],
-                data: results.map((r) => ({
-                    package: r.package,
-                    current: r.currentVersion,
-                    latest: output.highlight(r.latestVersion),
-                    type: formatUpdateType(r.updateType),
-                    priority: formatPriority(r.priority),
-                    auto: r.shouldAutoUpdate ? output.success('yes') : output.dim('no'),
-                })),
-            });
-            output.writeln();
-            const autoUpdates = results.filter((r) => r.shouldAutoUpdate);
-            const manualUpdates = results.filter((r) => !r.shouldAutoUpdate);
-            if (autoUpdates.length > 0) {
-                output.printInfo(`${autoUpdates.length} update(s) will be applied automatically on next startup`);
-            }
-            if (manualUpdates.length > 0) {
-                output.writeln();
-                output.printInfo('To update manually, run:');
-                output.writeln('  claude-flow update all');
-            }
-            return { success: true };
-        }
-        finally {
-            delete process.env.CLAUDE_FLOW_FORCE_UPDATE;
-        }
-    },
-};
-// Subcommand: all
-const allCommand = {
-    name: 'all',
-    description: 'Update all @claude-flow packages',
-    options: [
-        { name: 'dry-run', description: 'Show what would be updated', type: 'boolean' },
-        { name: 'include-major', description: 'Include major version updates', type: 'boolean' },
-    ],
-    async action(ctx) {
-        const { flags } = ctx;
-        process.env.CLAUDE_FLOW_FORCE_UPDATE = 'true';
-        try {
-            output.printInfo('Checking for updates...');
-            const config = {
-                ...DEFAULT_CONFIG,
-                autoUpdate: {
-                    patch: true,
-                    minor: true,
-                    major: flags['include-major'] || false,
-                },
-            };
-            const { results } = await checkForUpdates(config);
-            if (results.length === 0) {
-                output.printSuccess('All packages are up to date!');
-                return { success: true };
-            }
-            // Get installed packages
-            const installedPackages = {};
-            for (const update of results) {
-                const version = getInstalledVersion(update.package);
-                if (version) {
-                    installedPackages[update.package] = version;
-                }
-            }
-            output.printInfo(`Updating ${results.length} package(s)...`);
-            const updateResults = await executeMultipleUpdates(results, installedPackages, flags['dry-run']);
-            const successful = updateResults.filter((r) => r.success);
-            const failed = updateResults.filter((r) => !r.success);
-            output.writeln();
-            output.writeln(output.highlight(flags['dry-run'] ? '═══ Dry Run - Would Update ═══' : '═══ Update Results ═══'));
-            output.writeln();
-            if (successful.length > 0) {
-                output.printSuccess(`${successful.length} package(s) ${flags['dry-run'] ? 'would be ' : ''}updated:`);
-                for (const r of successful) {
-                    output.writeln(`  ${output.success('✓')} ${r.package}@${r.version}`);
-                }
-            }
-            if (failed.length > 0) {
-                output.writeln();
-                output.printError(`${failed.length} package(s) failed:`);
-                for (const r of failed) {
-                    output.writeln(`  ${output.error('✗')} ${r.package}: ${r.error}`);
-                }
-            }
-            return { success: failed.length === 0 };
-        }
-        finally {
-            delete process.env.CLAUDE_FLOW_FORCE_UPDATE;
-        }
-    },
-};
-// Subcommand: history
-const historyCommand = {
-    name: 'history',
-    description: 'View update history',
-    options: [
-        { name: 'limit', short: 'n', description: 'Number of entries', type: 'string', default: '20' },
-        { name: 'json', description: 'Output as JSON', type: 'boolean' },
-        { name: 'clear', description: 'Clear history', type: 'boolean' },
-    ],
-    async action(ctx) {
-        const { flags } = ctx;
-        if (flags.clear) {
-            clearHistory();
-            output.printSuccess('Update history cleared');
-            return { success: true };
-        }
-        const limit = parseInt(flags.limit || '20', 10);
-        const history = getUpdateHistory(limit);
-        if (history.length === 0) {
-            output.printInfo('No update history available');
-            return { success: true };
-        }
-        if (flags.json) {
-            console.log(JSON.stringify(history, null, 2));
-            return { success: true };
-        }
-        output.writeln();
-        output.writeln(output.highlight('═══ Update History ═══'));
-        output.writeln();
-        output.printTable({
-            columns: [
-                { key: 'time', header: 'Time' },
-                { key: 'package', header: 'Package' },
-                { key: 'from', header: 'From' },
-                { key: 'to', header: 'To' },
-                { key: 'status', header: 'Status' },
-            ],
-            data: history.map((h) => ({
-                time: new Date(h.timestamp).toLocaleString(),
-                package: h.package,
-                from: h.fromVersion,
-                to: h.toVersion,
-                status: h.success ? output.success('success') : output.error('failed'),
-            })),
-        });
-        return { success: true };
-    },
-};
-// Subcommand: rollback
-const rollbackCommand = {
-    name: 'rollback',
-    description: 'Rollback last update',
-    options: [
-        { name: 'package', short: 'p', description: 'Specific package to rollback', type: 'string' },
-    ],
-    async action(ctx) {
-        const { flags } = ctx;
-        const packageName = flags.package;
-        output.printInfo(packageName ? `Rolling back ${packageName}...` : 'Rolling back last update...');
-        const result = await rollbackUpdate(packageName);
-        if (result.success) {
-            output.printSuccess(result.message);
-        }
-        else {
-            output.printError(result.message);
-        }
-        return { success: result.success };
-    },
-};
-// Subcommand: clear-cache
-const clearCacheCommand = {
-    name: 'clear-cache',
-    description: 'Clear update check cache',
-    async action() {
-        clearCache();
-        output.printSuccess('Update cache cleared');
-        output.printInfo('Next startup will check for updates');
-        return { success: true };
-    },
-};
-// Main update command
-const updateCommand = {
-    name: 'update',
-    description: 'Manage @claude-flow package updates (ADR-025)',
-    subcommands: [checkCommand, allCommand, historyCommand, rollbackCommand, clearCacheCommand],
-    async action() {
-        // Show help if no subcommand
-        output.writeln();
-        output.writeln(output.highlight('═══ Update Command ═══'));
-        output.writeln();
-        output.writeln('Manage @claude-flow package updates with auto-update support.');
-        output.writeln();
-        output.writeln('Subcommands:');
-        output.printList([
-            `${output.highlight('check')}       - Check for available updates`,
-            `${output.highlight('all')}         - Update all packages`,
-            `${output.highlight('history')}     - View update history`,
-            `${output.highlight('rollback')}    - Rollback last update`,
-            `${output.highlight('clear-cache')} - Clear update check cache`,
-        ]);
-        output.writeln();
-        output.writeln('Environment Variables:');
-        output.printList([
-            `${output.dim('CLAUDE_FLOW_AUTO_UPDATE=false')}  - Disable auto-update`,
-            `${output.dim('CLAUDE_FLOW_FORCE_UPDATE=true')} - Force update check`,
-        ]);
-        output.writeln();
-        output.writeln('Run "claude-flow update <subcommand> --help" for subcommand help');
-        return { success: true };
-    },
-};
-export default updateCommand;
-//# sourceMappingURL=update.js.map

package/dist/src/commands/verify.d.ts

@@ -1,19 +0,0 @@
-/**
- * V3 CLI Verify Command
- *
- * Fetches the verification.md.json witness manifest from the live repo,
- * recomputes SHA-256 of every cited file in the user's installed
- * artifact, re-derives the Ed25519 public key from the manifest's git
- * commit, and verifies the signature.
- *
- * Run via: ruflo verify [--branch <branch>] [--manifest <local-path>]
- *
- * If everything checks, the user has byte-for-byte the same fix
- * footprint as the manifest claims. If anything mismatches, the
- * command exits non-zero and prints which fix regressed or which file
- * drifted.
- */
-import type { Command } from '../types.js';
-export declare const verifyCommand: Command;
-export default verifyCommand;
-//# sourceMappingURL=verify.d.ts.map

package/dist/src/commands/verify.js

@@ -1,261 +0,0 @@
-/**
- * V3 CLI Verify Command
- *
- * Fetches the verification.md.json witness manifest from the live repo,
- * recomputes SHA-256 of every cited file in the user's installed
- * artifact, re-derives the Ed25519 public key from the manifest's git
- * commit, and verifies the signature.
- *
- * Run via: ruflo verify [--branch <branch>] [--manifest <local-path>]
- *
- * If everything checks, the user has byte-for-byte the same fix
- * footprint as the manifest claims. If anything mismatches, the
- * command exits non-zero and prints which fix regressed or which file
- * drifted.
- */
-import { createHash } from 'crypto';
-import { existsSync, readFileSync } from 'fs';
-import { dirname, join, sep } from 'path';
-import { fileURLToPath } from 'url';
-import { output } from '../output.js';
-const DEFAULT_MANIFEST_URL = 'https://raw.githubusercontent.com/ruvnet/ruflo/{branch}/verification.md.json';
-async function fetchWitness(branch) {
-    const url = DEFAULT_MANIFEST_URL.replace('{branch}', branch);
-    // audit_1776853149979: bare fetch had no timeout — a hung GitHub CDN would
-    // pin the verify command indefinitely. 30s is generous for a sub-MB JSON.
-    const res = await fetch(url, { signal: AbortSignal.timeout(30000) });
-    if (!res.ok) {
-        throw new Error(`Failed to fetch manifest from ${url}: ${res.status} ${res.statusText}`);
-    }
-    return await res.json();
-}
-function loadLocalWitness(localPath) {
-    if (!existsSync(localPath)) {
-        throw new Error(`Manifest not found: ${localPath}`);
-    }
-    return JSON.parse(readFileSync(localPath, 'utf-8'));
-}
-/**
- * Locate the user's installed package root.
- *
- * The witness manifest paths are repo-relative (e.g.
- * "v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js"). For
- * end users, only the dist/ subtree ships in node_modules. We map
- * the repo path → the installed equivalent by stripping the
- * "v3/@claude-flow/<pkg>/" prefix and looking up node_modules/<pkg>/.
- */
-function repoPathToInstalledPath(repoPath) {
-    // Match v3/@claude-flow/<pkg>/<rest>
-    const match = repoPath.match(/^v3\/(@claude-flow\/[^/]+)\/(.+)$/);
-    if (match) {
-        const pkg = match[1];
-        const rest = match[2];
-        const candidates = [];
-        // 1. cwd/node_modules/<pkg>/<rest> (typical end-user install)
-        candidates.push(join(process.cwd(), 'node_modules', pkg, rest));
-        // 2. Walk up from this script looking for node_modules/<pkg>/<rest>
-        //    Covers cases where verify runs from inside a nested module.
-        try {
-            const __filename = fileURLToPath(import.meta.url);
-            let dir = dirname(__filename);
-            for (let i = 0; i < 10; i++) {
-                candidates.push(join(dir, 'node_modules', pkg, rest));
-                const parent = dirname(dir);
-                if (parent === dir)
-                    break;
-                dir = parent;
-            }
-        }
-        catch { /* ignore */ }
-        // 3. Source-tree resolution: when verify runs against a checked-out
-        //    repo (the developer's working copy), packages live at
-        //    `<repoRoot>/v3/<pkg>/<rest>` rather than under node_modules.
-        //    Walk up looking for the literal repo-relative path so the verify
-        //    command works for maintainers running it from the repo itself.
-        try {
-            const __filename = fileURLToPath(import.meta.url);
-            let dir = dirname(__filename);
-            for (let i = 0; i < 10; i++) {
-                candidates.push(join(dir, repoPath));
-                const parent = dirname(dir);
-                if (parent === dir)
-                    break;
-                dir = parent;
-            }
-        }
-        catch { /* ignore */ }
-        candidates.push(join(process.cwd(), repoPath));
-        for (const c of candidates) {
-            if (existsSync(c))
-                return c;
-        }
-        return null;
-    }
-    // Top-level paths (e.g. package.json) — return relative to cwd
-    const top = join(process.cwd(), repoPath);
-    return existsSync(top) ? top : null;
-}
-function fileSha256(path) {
-    return createHash('sha256').update(readFileSync(path)).digest('hex');
-}
-function fileContains(path, marker) {
-    return readFileSync(path, 'utf-8').includes(marker);
-}
-async function verifySignature(witness) {
-    // Lazy-load @noble/ed25519 — keep verify command snappy when no signature check needed
-    let ed = null;
-    try {
-        ed = await import('@noble/ed25519');
-    }
-    catch {
-        return { manifestHashOk: false, publicKeyReproducible: false, signatureValid: false };
-    }
-    // Configure sync sha512 for the v2 API
-    const sha512Sync = (...m) => {
-        const h = createHash('sha512');
-        for (const x of m)
-            h.update(x);
-        return h.digest();
-    };
-    ed.etc.sha512Sync = sha512Sync;
-    const manifestCanonical = JSON.stringify(witness.manifest);
-    const recomputedHash = createHash('sha256').update(manifestCanonical).digest('hex');
-    const manifestHashOk = recomputedHash === witness.integrity.manifestHash;
-    const seed = createHash('sha256').update(witness.manifest.gitCommit + ':ruflo-witness/v1').digest();
-    const reKey = ed.getPublicKey(seed);
-    const publicKeyReproducible = Buffer.from(reKey).toString('hex') === witness.integrity.publicKey;
-    const signatureValid = ed.verify(Buffer.from(witness.integrity.signature, 'hex'), Buffer.from(witness.integrity.manifestHash, 'hex'), Buffer.from(witness.integrity.publicKey, 'hex'));
-    return { manifestHashOk, publicKeyReproducible, signatureValid };
-}
-export const verifyCommand = {
-    name: 'verify',
-    description: 'Verify installed artifact against the signed witness manifest',
-    options: [
-        {
-            name: 'branch',
-            short: 'b',
-            type: 'string',
-            description: 'Git branch to fetch verification.md.json from (defaults to fix/issues-may-1-3)',
-            default: 'fix/issues-may-1-3',
-        },
-        {
-            name: 'manifest',
-            short: 'm',
-            type: 'string',
-            description: 'Local path to a verification.md.json file (overrides --branch)',
-        },
-        {
-            name: 'json',
-            type: 'boolean',
-            description: 'Output JSON instead of human-readable table',
-            default: false,
-        },
-    ],
-    examples: [
-        { command: 'ruflo verify', description: 'Fetch latest manifest from main branch + verify' },
-        { command: 'ruflo verify --branch main', description: 'Verify against a specific branch' },
-        { command: 'ruflo verify --manifest ./verification.md.json', description: 'Use a local manifest copy' },
-        { command: 'ruflo verify --json', description: 'Machine-readable output for CI' },
-    ],
-    action: async (ctx) => {
-        const branch = ctx.flags.branch || 'fix/issues-may-1-3';
-        const localPath = ctx.flags.manifest;
-        const asJson = ctx.flags.json === true;
-        if (!asJson) {
-            output.writeln();
-            output.writeln(output.bold('Ruflo Verification'));
-            output.writeln(output.dim('─'.repeat(50)));
-        }
-        let witness;
-        try {
-            witness = localPath ? loadLocalWitness(localPath) : await fetchWitness(branch);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            if (asJson)
-                output.printJson({ ok: false, error: msg });
-            else
-                output.printError(`Could not load witness manifest: ${msg}`);
-            return { success: false, exitCode: 1 };
-        }
-        // Signature verification
-        const sig = await verifySignature(witness);
-        // File verification
-        const fileResults = witness.manifest.fixes.map((fix) => {
-            const installedPath = repoPathToInstalledPath(fix.file);
-            if (!installedPath) {
-                return { ...fix, status: 'missing', sha256Match: false, markerPresent: false, installedPath: null, localSha256: undefined };
-            }
-            const localHash = fileSha256(installedPath);
-            const markerPresent = fileContains(installedPath, fix.marker);
-            const sha256Match = localHash === fix.sha256;
-            const status = sha256Match && markerPresent
-                ? 'pass'
-                : (markerPresent ? 'drift' : 'regressed');
-            return { ...fix, status, sha256Match, markerPresent, localSha256: localHash, installedPath: installedPath.replace(process.cwd() + sep, '') };
-        });
-        const passCount = fileResults.filter((r) => r.status === 'pass').length;
-        const driftCount = fileResults.filter((r) => r.status === 'drift').length;
-        const regressedCount = fileResults.filter((r) => r.status === 'regressed').length;
-        const missingCount = fileResults.filter((r) => r.status === 'missing').length;
-        const allOk = sig.manifestHashOk && sig.publicKeyReproducible && sig.signatureValid && regressedCount === 0;
-        if (asJson) {
-            output.printJson({
-                ok: allOk,
-                manifest: witness.manifest,
-                signature: sig,
-                results: fileResults,
-                summary: { pass: passCount, drift: driftCount, regressed: regressedCount, missing: missingCount },
-            });
-            return { success: allOk, exitCode: allOk ? 0 : 1 };
-        }
-        output.writeln();
-        output.writeln(output.bold('Manifest signature'));
-        output.writeln(`  manifest hash matches: ${sig.manifestHashOk ? output.success('yes') : output.error('no')}`);
-        output.writeln(`  public key reproducible from gitCommit: ${sig.publicKeyReproducible ? output.success('yes') : output.error('no')}`);
-        output.writeln(`  Ed25519 signature valid: ${sig.signatureValid ? output.success('yes') : output.error('no')}`);
-        output.writeln();
-        output.writeln(output.bold('Fix verification'));
-        for (const r of fileResults) {
-            const status = r.status === 'pass'
-                ? output.success('pass')
-                : r.status === 'drift'
-                    ? output.warning('drift')
-                    : output.error(r.status);
-            output.writeln(`  [${status}] ${r.id} — ${r.desc}`);
-            if (r.status === 'drift' && r.localSha256) {
-                output.writeln(output.dim(`         expected sha256: ${r.sha256.slice(0, 16)}…`));
-                output.writeln(output.dim(`         local    sha256: ${r.localSha256.slice(0, 16)}…`));
-            }
-            else if (r.status === 'regressed') {
-                output.writeln(output.dim(`         marker missing: '${r.marker}' not found in ${r.installedPath ?? r.file}`));
-            }
-            else if (r.status === 'missing') {
-                output.writeln(output.dim(`         file not found in node_modules: ${r.file}`));
-            }
-        }
-        output.writeln();
-        output.writeln(output.bold('Summary'));
-        output.writeln(`  pass:      ${passCount}`);
-        output.writeln(`  drift:     ${driftCount}`);
-        output.writeln(`  regressed: ${regressedCount}`);
-        output.writeln(`  missing:   ${missingCount}`);
-        output.writeln();
-        if (allOk) {
-            output.printSuccess('All fixes verified. Installed artifact matches the signed witness manifest.');
-            return { success: true };
-        }
-        if (regressedCount > 0) {
-            output.printError(`${regressedCount} fix(es) regressed. Markers not found in installed artifact.`);
-        }
-        if (driftCount > 0) {
-            output.printWarning(`${driftCount} fix(es) drifted. Markers present, but file SHA-256 differs (could be a benign edit; inspect the diff).`);
-        }
-        if (!sig.signatureValid || !sig.manifestHashOk) {
-            output.printError('Manifest signature failed verification. The witness file may have been tampered with or corrupted.');
-        }
-        return { success: false, exitCode: 1 };
-    },
-};
-export default verifyCommand;
-//# sourceMappingURL=verify.js.map

package/dist/src/commands/version.d.ts

@@ -1,42 +0,0 @@
-/**
- * `ruflo version` — ANV (Agent-Native Versioning) Phase 1.
- * https://gist.github.com/ruvnet/0d858ad440a4439b4a2281a40c39b1a0
- *
- * Plain `ruflo --version` / `-V` (index.ts's showVersion()) is UNCHANGED —
- * it stays bare semver so scripts parsing that output never see a surprise
- * suffix. This is a separate subcommand: `ruflo version` prints the same
- * bare semver by default, and `--explain` additionally renders the ANV
- * catalog/benchmark breakdown when a catalog-manifest.json ships with this
- * install. No catalog-manifest.json (e.g. an old install, or a dev checkout
- * that hasn't run the generator) degrades to bare semver — the suffix is
- * advisory, never load-bearing for npm range resolution or CLI behavior.
- */
-import type { Command } from '../types.js';
-interface CatalogManifest {
-    schemaVersion: number;
-    generation: number;
-    generatedAt: string;
-    gitSha: string;
-    catalog: {
-        agents: number;
-        tools: number;
-        skills: number;
-    };
-    benchmark: {
-        tier: number;
-        verifiedAt: string;
-        signature?: string;
-    } | null;
-}
-/**
- * The advisory suffix itself (semver build metadata, `+` prefix — legal per
- * semver.org §10, ignored by npm for range resolution/precedence).
- *   +ad.<release-sequence>.g<gitSha>.cat<generation>[.hal<tier>]
- * `.hal<tier>` is only appended when a real, signed benchmark submission
- * exists for THIS catalog generation — never fabricated (ANV's own
- * "verifiable, no unverifiable claims" principle).
- */
-export declare function buildAdvisorySuffix(manifest: CatalogManifest, releaseSequence?: number): string;
-export declare const versionCommand: Command;
-export {};
-//# sourceMappingURL=version.d.ts.map