@claude-flow/cli 3.32.2 → 3.32.3

package/dist/src/update/checker.js

@@ -1,191 +0,0 @@
-/**
- * Update checker for @claude-flow packages
- * Queries npm registry and compares versions
- */
-import * as semver from 'semver';
-import { createRequire } from 'node:module';
-import { shouldCheckForUpdates, recordCheck, getCachedVersions } from './rate-limiter.js';
-const DEFAULT_CONFIG = {
-    enabled: true,
-    checkIntervalHours: 24,
-    autoUpdate: {
-        patch: true,
-        minor: false,
-        major: false,
-    },
-    priority: {
-        '@claude-flow/security': 'critical',
-        '@claude-flow/cli': 'high',
-        '@claude-flow/embeddings': 'normal',
-        '@claude-flow/integration': 'normal',
-        '@claude-flow/testing': 'low',
-    },
-    exclude: [],
-};
-// Packages to check for updates
-const CLAUDE_FLOW_PACKAGES = [
-    '@claude-flow/cli',
-    '@claude-flow/embeddings',
-    '@claude-flow/security',
-    '@claude-flow/integration',
-    '@claude-flow/testing',
-];
-async function fetchPackageInfo(packageName) {
-    try {
-        const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
-            headers: { Accept: 'application/json' },
-            signal: AbortSignal.timeout(5000),
-        });
-        if (!response.ok) {
-            return null;
-        }
-        return (await response.json());
-    }
-    catch {
-        return null;
-    }
-}
-function getUpdateType(current, latest) {
-    if (!semver.valid(current) || !semver.valid(latest)) {
-        return 'none';
-    }
-    if (semver.eq(current, latest)) {
-        return 'none';
-    }
-    if (semver.major(latest) > semver.major(current)) {
-        return 'major';
-    }
-    if (semver.minor(latest) > semver.minor(current)) {
-        return 'minor';
-    }
-    if (semver.patch(latest) > semver.patch(current)) {
-        return 'patch';
-    }
-    return 'none';
-}
-function shouldAutoUpdate(updateType, priority, config) {
-    if (updateType === 'none')
-        return false;
-    // Critical security packages always auto-update patches
-    if (priority === 'critical' && updateType === 'patch') {
-        return true;
-    }
-    // Check config
-    if (updateType === 'major')
-        return config.autoUpdate.major;
-    if (updateType === 'minor')
-        return config.autoUpdate.minor;
-    if (updateType === 'patch')
-        return config.autoUpdate.patch;
-    return false;
-}
-export function getInstalledVersion(packageName) {
-    try {
-        // Try to find the package in node_modules
-        const possiblePaths = [
-            `${packageName}/package.json`,
-            `../../node_modules/${packageName}/package.json`,
-            `../../../node_modules/${packageName}/package.json`,
-        ];
-        for (const modulePath of possiblePaths) {
-            try {
-                // Use createRequire for ESM-compatible package.json loading
-                const esmRequire = createRequire(import.meta.url);
-                const resolved = esmRequire.resolve(modulePath, { paths: [process.cwd()] });
-                const pkg = esmRequire(resolved);
-                return pkg.version;
-            }
-            catch {
-                continue;
-            }
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-export async function checkForUpdates(config = DEFAULT_CONFIG) {
-    // Check rate limit
-    const rateCheck = shouldCheckForUpdates(config.checkIntervalHours);
-    if (!rateCheck.allowed) {
-        // Return cached results if available
-        const cached = getCachedVersions();
-        if (Object.keys(cached).length > 0) {
-            return {
-                results: [],
-                skipped: true,
-                reason: rateCheck.reason,
-            };
-        }
-        return { results: [], skipped: true, reason: rateCheck.reason };
-    }
-    const results = [];
-    const versionCache = {};
-    // Check each package
-    const packagesToCheck = CLAUDE_FLOW_PACKAGES.filter((pkg) => !config.exclude.includes(pkg));
-    // Sort by priority (critical first)
-    const priorityOrder = { critical: 0, high: 1, normal: 2, low: 3 };
-    packagesToCheck.sort((a, b) => {
-        const pa = config.priority[a] || 'normal';
-        const pb = config.priority[b] || 'normal';
-        return priorityOrder[pa] - priorityOrder[pb];
-    });
-    await Promise.all(packagesToCheck.map(async (packageName) => {
-        const currentVersion = getInstalledVersion(packageName);
-        if (!currentVersion) {
-            // Package not installed, skip
-            return;
-        }
-        const info = await fetchPackageInfo(packageName);
-        if (!info) {
-            return;
-        }
-        const latestVersion = info['dist-tags']?.latest;
-        if (!latestVersion) {
-            return;
-        }
-        versionCache[packageName] = latestVersion;
-        const updateType = getUpdateType(currentVersion, latestVersion);
-        const priority = config.priority[packageName] || 'normal';
-        results.push({
-            package: packageName,
-            currentVersion,
-            latestVersion,
-            updateType,
-            priority,
-            shouldAutoUpdate: shouldAutoUpdate(updateType, priority, config),
-        });
-    }));
-    // Record this check
-    recordCheck(versionCache);
-    // Filter to only updates available
-    const updates = results.filter((r) => r.updateType !== 'none');
-    return { results: updates, skipped: false };
-}
-export async function checkSinglePackage(packageName, config = DEFAULT_CONFIG) {
-    const currentVersion = getInstalledVersion(packageName);
-    if (!currentVersion) {
-        return null;
-    }
-    const info = await fetchPackageInfo(packageName);
-    if (!info) {
-        return null;
-    }
-    const latestVersion = info['dist-tags']?.latest;
-    if (!latestVersion) {
-        return null;
-    }
-    const updateType = getUpdateType(currentVersion, latestVersion);
-    const priority = config.priority[packageName] || 'normal';
-    return {
-        package: packageName,
-        currentVersion,
-        latestVersion,
-        updateType,
-        priority,
-        shouldAutoUpdate: shouldAutoUpdate(updateType, priority, config),
-    };
-}
-export { DEFAULT_CONFIG };
-//# sourceMappingURL=checker.js.map

package/dist/src/update/executor.d.ts

@@ -1,33 +0,0 @@
-/**
- * Update executor - performs actual package updates
- * Includes rollback capability
- */
-import { UpdateCheckResult } from './checker.js';
-import { ValidationResult } from './validator.js';
-export declare function isSafePackageSpec(pkg: string, version: string): boolean;
-export interface UpdateHistoryEntry {
-    timestamp: string;
-    package: string;
-    fromVersion: string;
-    toVersion: string;
-    success: boolean;
-    error?: string;
-    rollbackAvailable: boolean;
-}
-export interface UpdateExecutionResult {
-    success: boolean;
-    package: string;
-    version: string;
-    error?: string;
-    validation: ValidationResult;
-}
-export declare function loadHistory(): UpdateHistoryEntry[];
-export declare function executeUpdate(update: UpdateCheckResult, installedPackages: Record<string, string>, dryRun?: boolean): Promise<UpdateExecutionResult>;
-export declare function executeMultipleUpdates(updates: UpdateCheckResult[], installedPackages: Record<string, string>, dryRun?: boolean): Promise<UpdateExecutionResult[]>;
-export declare function rollbackUpdate(packageName?: string): Promise<{
-    success: boolean;
-    message: string;
-}>;
-export declare function getUpdateHistory(limit?: number): UpdateHistoryEntry[];
-export declare function clearHistory(): void;
-//# sourceMappingURL=executor.d.ts.map

package/dist/src/update/executor.js

@@ -1,217 +0,0 @@
-/**
- * Update executor - performs actual package updates
- * Includes rollback capability
- */
-import { execFileSync } from 'child_process';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-import { validateUpdate } from './validator.js';
-/**
- * audit_1776853149979: package name and version come from npm-view output and
- * the update-history.json file (writable by anyone with FS access). Both
- * previously interpolated straight into a shell string for `npm install`.
- * These regexes pre-flight values so a hostile package name can't slip
- * shell metacharacters through, even though execFileSync below already
- * eliminates the shell.
- */
-// First char of the unscoped name forbids `-` to defang CLI-flag confusion
-// when the spec is passed to npm (npm install -evil@1.0.0 looks flag-shaped).
-const SAFE_PKG_RE = /^(@[a-zA-Z0-9_\-]+\/)?[a-zA-Z0-9_][a-zA-Z0-9_\-.]{0,213}$/;
-// semver / dist-tag / range chars only — no shell metas.
-const SAFE_VERSION_RE = /^[a-zA-Z0-9._\-+~^*xX]{1,64}$/;
-export function isSafePackageSpec(pkg, version) {
-    return SAFE_PKG_RE.test(pkg) && SAFE_VERSION_RE.test(version);
-}
-const HISTORY_FILE = path.join(os.homedir(), '.claude-flow', 'update-history.json');
-const MAX_HISTORY_ENTRIES = 100;
-function ensureDir() {
-    const dir = path.dirname(HISTORY_FILE);
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-}
-export function loadHistory() {
-    try {
-        if (fs.existsSync(HISTORY_FILE)) {
-            const content = fs.readFileSync(HISTORY_FILE, 'utf-8');
-            return JSON.parse(content);
-        }
-    }
-    catch {
-        // Corrupted file
-    }
-    return [];
-}
-function saveHistory(history) {
-    ensureDir();
-    // Keep only last N entries
-    const trimmed = history.slice(-MAX_HISTORY_ENTRIES);
-    fs.writeFileSync(HISTORY_FILE, JSON.stringify(trimmed, null, 2));
-}
-function recordUpdate(entry) {
-    const history = loadHistory();
-    history.push(entry);
-    saveHistory(history);
-}
-export async function executeUpdate(update, installedPackages, dryRun = false) {
-    // Validate first
-    const validation = validateUpdate(update.package, update.currentVersion, update.latestVersion, installedPackages);
-    if (!validation.valid) {
-        return {
-            success: false,
-            package: update.package,
-            version: update.latestVersion,
-            error: `Validation failed: ${validation.incompatibilities.join(', ')}`,
-            validation,
-        };
-    }
-    if (dryRun) {
-        return {
-            success: true,
-            package: update.package,
-            version: update.latestVersion,
-            validation,
-        };
-    }
-    // audit_1776853149979: validate package + version regex before any exec.
-    if (!isSafePackageSpec(update.package, update.latestVersion)) {
-        return {
-            success: false,
-            package: update.package,
-            version: update.latestVersion,
-            error: `Refusing to install: package or version contains disallowed characters (pkg="${update.package}", version="${update.latestVersion}")`,
-            validation,
-        };
-    }
-    try {
-        // audit_1776853149979: switched to execFileSync('npm', argv) — no shell,
-        // so even if validation regressed, metas in update.package would stay
-        // literal in the argv slot.
-        execFileSync('npm', ['install', `${update.package}@${update.latestVersion}`, '--save-exact'], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            timeout: 60000, // 1 minute timeout
-            shell: false,
-        });
-        // Record successful update
-        recordUpdate({
-            timestamp: new Date().toISOString(),
-            package: update.package,
-            fromVersion: update.currentVersion,
-            toVersion: update.latestVersion,
-            success: true,
-            rollbackAvailable: true,
-        });
-        return {
-            success: true,
-            package: update.package,
-            version: update.latestVersion,
-            validation,
-        };
-    }
-    catch (error) {
-        const err = error;
-        // Record failed update
-        recordUpdate({
-            timestamp: new Date().toISOString(),
-            package: update.package,
-            fromVersion: update.currentVersion,
-            toVersion: update.latestVersion,
-            success: false,
-            error: err.message,
-            rollbackAvailable: false,
-        });
-        return {
-            success: false,
-            package: update.package,
-            version: update.latestVersion,
-            error: err.message,
-            validation,
-        };
-    }
-}
-export async function executeMultipleUpdates(updates, installedPackages, dryRun = false) {
-    const results = [];
-    // Execute updates sequentially to avoid conflicts
-    for (const update of updates) {
-        const result = await executeUpdate(update, installedPackages, dryRun);
-        results.push(result);
-        // Update installed packages for next validation
-        if (result.success) {
-            installedPackages[update.package] = update.latestVersion;
-        }
-        // Stop on critical failures
-        if (!result.success && update.priority === 'critical') {
-            break;
-        }
-    }
-    return results;
-}
-export async function rollbackUpdate(packageName) {
-    const history = loadHistory();
-    if (history.length === 0) {
-        return { success: false, message: 'No update history available' };
-    }
-    // Find the last successful update for this package (or any if not specified)
-    const lastUpdate = packageName
-        ? history
-            .reverse()
-            .find((h) => h.package === packageName && h.success && h.rollbackAvailable)
-        : history.reverse().find((h) => h.success && h.rollbackAvailable);
-    if (!lastUpdate) {
-        return {
-            success: false,
-            message: packageName
-                ? `No rollback available for ${packageName}`
-                : 'No rollback available',
-        };
-    }
-    // audit_1776853149979: history entries can be tampered with by anyone who
-    // can write update-history.json — gate before exec.
-    if (!isSafePackageSpec(lastUpdate.package, lastUpdate.fromVersion)) {
-        return {
-            success: false,
-            message: `Refusing to rollback: package or version contains disallowed characters (pkg="${lastUpdate.package}", version="${lastUpdate.fromVersion}")`,
-        };
-    }
-    try {
-        // execFileSync, no shell.
-        execFileSync('npm', ['install', `${lastUpdate.package}@${lastUpdate.fromVersion}`, '--save-exact'], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            timeout: 60000,
-            shell: false,
-        });
-        // Record the rollback
-        recordUpdate({
-            timestamp: new Date().toISOString(),
-            package: lastUpdate.package,
-            fromVersion: lastUpdate.toVersion,
-            toVersion: lastUpdate.fromVersion,
-            success: true,
-            rollbackAvailable: false, // Can't rollback a rollback
-        });
-        return {
-            success: true,
-            message: `Rolled back ${lastUpdate.package} from ${lastUpdate.toVersion} to ${lastUpdate.fromVersion}`,
-        };
-    }
-    catch (error) {
-        const err = error;
-        return {
-            success: false,
-            message: `Rollback failed: ${err.message}`,
-        };
-    }
-}
-export function getUpdateHistory(limit = 20) {
-    const history = loadHistory();
-    return history.slice(-limit).reverse();
-}
-export function clearHistory() {
-    if (fs.existsSync(HISTORY_FILE)) {
-        fs.unlinkSync(HISTORY_FILE);
-    }
-}
-//# sourceMappingURL=executor.js.map

package/dist/src/update/index.d.ts

@@ -1,33 +0,0 @@
-/**
- * Auto-update system for @claude-flow packages
- *
- * Features:
- * - Rate-limited update checks (24h default)
- * - Automatic patch updates for security packages
- * - Compatibility validation before updates
- * - Rollback capability
- * - Update history logging
- */
-export { checkForUpdates, checkSinglePackage, getInstalledVersion, DEFAULT_CONFIG, } from './checker.js';
-export type { UpdateCheckResult, UpdateConfig } from './checker.js';
-export { shouldCheckForUpdates, recordCheck, getCachedVersions, clearCache, loadState, } from './rate-limiter.js';
-export type { RateLimitState } from './rate-limiter.js';
-export { validateUpdate, validateBulkUpdate } from './validator.js';
-export type { ValidationResult } from './validator.js';
-export { executeUpdate, executeMultipleUpdates, rollbackUpdate, getUpdateHistory, clearHistory, loadHistory, } from './executor.js';
-export type { UpdateHistoryEntry, UpdateExecutionResult } from './executor.js';
-import type { UpdateCheckResult } from './checker.js';
-/**
- * Run auto-update check on startup
- * This is the main entry point for the auto-update system
- */
-export declare function runStartupUpdateCheck(options: {
-    verbose?: boolean;
-    autoUpdate?: boolean;
-}): Promise<{
-    checked: boolean;
-    updatesAvailable: UpdateCheckResult[];
-    updatesApplied: string[];
-    skippedReason?: string;
-}>;
-//# sourceMappingURL=index.d.ts.map

package/dist/src/update/index.js

@@ -1,64 +0,0 @@
-/**
- * Auto-update system for @claude-flow packages
- *
- * Features:
- * - Rate-limited update checks (24h default)
- * - Automatic patch updates for security packages
- * - Compatibility validation before updates
- * - Rollback capability
- * - Update history logging
- */
-export { checkForUpdates, checkSinglePackage, getInstalledVersion, DEFAULT_CONFIG, } from './checker.js';
-export { shouldCheckForUpdates, recordCheck, getCachedVersions, clearCache, loadState, } from './rate-limiter.js';
-export { validateUpdate, validateBulkUpdate } from './validator.js';
-export { executeUpdate, executeMultipleUpdates, rollbackUpdate, getUpdateHistory, clearHistory, loadHistory, } from './executor.js';
-// Re-export a convenience function for startup
-import { checkForUpdates, DEFAULT_CONFIG } from './checker.js';
-import { executeMultipleUpdates } from './executor.js';
-import { getInstalledVersion } from './checker.js';
-/**
- * Run auto-update check on startup
- * This is the main entry point for the auto-update system
- */
-export async function runStartupUpdateCheck(options) {
-    const result = {
-        checked: false,
-        updatesAvailable: [],
-        updatesApplied: [],
-        skippedReason: undefined,
-    };
-    try {
-        const { results, skipped, reason } = await checkForUpdates(DEFAULT_CONFIG);
-        if (skipped) {
-            result.skippedReason = reason;
-            return result;
-        }
-        result.checked = true;
-        result.updatesAvailable = results;
-        // Auto-update if enabled
-        if (options.autoUpdate !== false) {
-            const autoUpdateable = results.filter((r) => r.shouldAutoUpdate);
-            if (autoUpdateable.length > 0) {
-                // Get current installed packages
-                const installedPackages = {};
-                for (const update of autoUpdateable) {
-                    const version = getInstalledVersion(update.package);
-                    if (version) {
-                        installedPackages[update.package] = version;
-                    }
-                }
-                // Execute updates
-                const updateResults = await executeMultipleUpdates(autoUpdateable, installedPackages);
-                result.updatesApplied = updateResults
-                    .filter((r) => r.success)
-                    .map((r) => `${r.package}@${r.version}`);
-            }
-        }
-        return result;
-    }
-    catch {
-        // Silently fail on startup - don't block CLI usage
-        return result;
-    }
-}
-//# sourceMappingURL=index.js.map

package/dist/src/update/rate-limiter.d.ts

@@ -1,20 +0,0 @@
-/**
- * Rate limiter for update checks
- * Prevents excessive npm registry queries
- */
-export interface RateLimitState {
-    lastCheck: string;
-    checksToday: number;
-    date: string;
-    packageVersions: Record<string, string>;
-}
-export declare function loadState(): RateLimitState;
-export declare function saveState(state: RateLimitState): void;
-export declare function shouldCheckForUpdates(intervalHours?: number): {
-    allowed: boolean;
-    reason?: string;
-};
-export declare function recordCheck(packageVersions: Record<string, string>): void;
-export declare function getCachedVersions(): Record<string, string>;
-export declare function clearCache(): void;
-//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/src/update/rate-limiter.js

@@ -1,96 +0,0 @@
-/**
- * Rate limiter for update checks
- * Prevents excessive npm registry queries
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-const STATE_FILE = path.join(os.homedir(), '.claude-flow', 'update-state.json');
-const DEFAULT_INTERVAL_HOURS = 24;
-const MAX_CHECKS_PER_DAY = 10;
-function ensureDir() {
-    const dir = path.dirname(STATE_FILE);
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-}
-function getDefaultState() {
-    return {
-        lastCheck: '',
-        checksToday: 0,
-        date: new Date().toISOString().split('T')[0],
-        packageVersions: {},
-    };
-}
-export function loadState() {
-    try {
-        if (fs.existsSync(STATE_FILE)) {
-            const content = fs.readFileSync(STATE_FILE, 'utf-8');
-            const state = JSON.parse(content);
-            // Reset counter if new day
-            const today = new Date().toISOString().split('T')[0];
-            if (state.date !== today) {
-                state.date = today;
-                state.checksToday = 0;
-            }
-            return state;
-        }
-    }
-    catch {
-        // Corrupted file, reset
-    }
-    return getDefaultState();
-}
-export function saveState(state) {
-    ensureDir();
-    fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
-}
-export function shouldCheckForUpdates(intervalHours = DEFAULT_INTERVAL_HOURS) {
-    // Skip in CI environments
-    if (process.env.CI === 'true' || process.env.CONTINUOUS_INTEGRATION === 'true') {
-        return { allowed: false, reason: 'CI environment detected' };
-    }
-    // Skip if explicitly disabled
-    if (process.env.CLAUDE_FLOW_AUTO_UPDATE === 'false') {
-        return { allowed: false, reason: 'Auto-update disabled via environment' };
-    }
-    // Force update if requested
-    if (process.env.CLAUDE_FLOW_FORCE_UPDATE === 'true') {
-        return { allowed: true };
-    }
-    const state = loadState();
-    // Check daily limit
-    if (state.checksToday >= MAX_CHECKS_PER_DAY) {
-        return { allowed: false, reason: `Daily check limit (${MAX_CHECKS_PER_DAY}) reached` };
-    }
-    // Check time interval
-    if (state.lastCheck) {
-        const lastCheckTime = new Date(state.lastCheck).getTime();
-        const now = Date.now();
-        const hoursSinceLastCheck = (now - lastCheckTime) / (1000 * 60 * 60);
-        if (hoursSinceLastCheck < intervalHours) {
-            const nextCheck = Math.ceil(intervalHours - hoursSinceLastCheck);
-            return {
-                allowed: false,
-                reason: `Last check was ${Math.floor(hoursSinceLastCheck)}h ago (next check in ~${nextCheck}h)`
-            };
-        }
-    }
-    return { allowed: true };
-}
-export function recordCheck(packageVersions) {
-    const state = loadState();
-    state.lastCheck = new Date().toISOString();
-    state.checksToday += 1;
-    state.packageVersions = { ...state.packageVersions, ...packageVersions };
-    saveState(state);
-}
-export function getCachedVersions() {
-    return loadState().packageVersions;
-}
-export function clearCache() {
-    if (fs.existsSync(STATE_FILE)) {
-        fs.unlinkSync(STATE_FILE);
-    }
-}
-//# sourceMappingURL=rate-limiter.js.map

package/dist/src/update/validator.d.ts

@@ -1,17 +0,0 @@
-/**
- * Package validator for update compatibility
- * Ensures updates don't break the ecosystem
- */
-export interface ValidationResult {
-    valid: boolean;
-    incompatibilities: string[];
-    warnings: string[];
-    requiredPeerUpdates: string[];
-}
-export declare function validateUpdate(packageName: string, fromVersion: string, toVersion: string, installedPackages: Record<string, string>): ValidationResult;
-export declare function validateBulkUpdate(updates: Array<{
-    package: string;
-    from: string;
-    to: string;
-}>, currentPackages: Record<string, string>): ValidationResult;
-//# sourceMappingURL=validator.d.ts.map