@claude-flow/cli 3.32.25 → 3.32.29

package/dist/src/services/harness-flywheel.js

@@ -11,10 +11,9 @@
  *   4. GATE the winner through the shipped runHarnessLoop on the HELD-OUT split:
  *      held_out_improves AND redblue(anchor-no-regress) AND drift<=thr AND
  *      replay-deterministic AND receipt_coverage AND canary-no-worse.
- *   5. On accept → APPLY locally (the install self-optimizes on its own data; no
- *      signing needed because nothing is propagated), CHAIN to the previous
- *      champion, and record the attempt in the improvement ledger. Also STAGE
- *      the unsigned champion for optional promotion to the signed global channel.
+ *   5. On accept → emit + persist an immutable evaluation receipt. Evaluation
+ *      never mutates active policy. Explicit promotion is handled by the
+ *      ADR-322A transaction service.
  *
  * Trust split: LOCAL self-optimization is unsigned (an install trusting its own
  * measured gate); CROSS-install propagation still requires the config-signed
@@ -27,6 +26,9 @@ import { hashCorpus } from './harness-benchmark.js';
 import { harvestSelfSupervisedTasks, blendCorpus } from './harness-corpus-harvester.js';
 import { applyChampionParams } from '../config/harness-feedback-applier.js';
 import { appendLedger, bootstrapDeltaCILow } from './harness-improvement-ledger.js';
+import { createFlywheelReceipt, sha256Ref, } from './flywheel-receipt.js';
+import { readFlywheelTransactionState, registerFlywheelReceipt, } from './flywheel-transaction.js';
+import { runBoundedPool } from './bounded-worker-pool.js';
 export const DEFAULT_CONFIG = { alpha: 0.5, subjectWeight: 2.0, mmrLambda: 0.7, bodyWeight: 1.0, typePenaltyFactor: 1.0 };
 const EPS = 1e-3;
 const cfgCanon = (c) => JSON.stringify(Object.fromEntries(Object.keys(c).sort().map((k) => [k, c[k]])));
@@ -50,7 +52,7 @@ function grade(ranked, expected) {
     const idx = ranked.findIndex((r) => r.id === expected);
     return idx >= 0 ? 1 / (idx + 1) : 0;
 }
-function neighbors(base) {
+export function retrievalPolicyNeighbors(base) {
     const steps = { alpha: 0.1, subjectWeight: 0.5, mmrLambda: 0.1, bodyWeight: 0.5, typePenaltyFactor: 0.25 };
     const out = [];
     const seen = new Set();
@@ -89,7 +91,7 @@ function split(tasks, frac) {
  * Returns a rich result AND (as a side effect) appends to the improvement ledger
  * and — on accept — applies the champion locally + chains it.
  */
-export async function runFlywheelTick(projectRoot, deps) {
+export async function evaluateFlywheelCandidate(projectRoot, deps) {
     try {
         const patterns = await deps.getPatterns();
         if (!patterns || patterns.length < 8)
@@ -100,7 +102,9 @@ export async function runFlywheelTick(projectRoot, deps) {
         const blended = blendCorpus(deps.anchorTasks, harvested);
         const anchorIdSet = new Set(blended.anchorIds);
         const baseline = { ...DEFAULT_CONFIG, ...(deps.activeParams?.() ?? {}) };
-        const candidates = neighbors(baseline);
+        const candidates = deps.candidatePolicies?.length
+            ? deps.candidatePolicies.map((candidate) => ({ ...candidate }))
+            : retrievalPolicyNeighbors(baseline);
         // OBJECTIVE = the human-labeled anchor (the relevance we actually care about,
         // where headroom is known to exist). GUARD = the large, growing harvested set
         // (don't wreck broad retrieval while tuning the objective). Optimize the
@@ -112,12 +116,32 @@ export async function runFlywheelTick(projectRoot, deps) {
         // Precompute retrieval for baseline + all candidates over every task (async
         // I/O up front → the harness scoring stays pure/sync).
         const cache = new Map();
-        const configs = [baseline, ...candidates];
-        for (const cfg of configs) {
-            for (const t of blended.tasks) {
-                const q = t.input.q;
-                cache.set(`${t.id}::${cfgKey(cfg)}`, (await deps.search(q, cfg)) || []);
-            }
+        const configs = [...new Map([baseline, ...candidates].map((config) => [cfgKey(config), config])).values()];
+        const evalTasks = configs.flatMap((cfg) => blended.tasks.map((t) => {
+            const cacheKey = `${t.id}::${cfgKey(cfg)}`;
+            return {
+                id: cacheKey,
+                run: async (signal) => {
+                    if (signal.aborted)
+                        throw signal.reason;
+                    return (await deps.search(t.input.q, cfg, signal)) || [];
+                },
+            };
+        }));
+        const batch = await runBoundedPool(evalTasks, {
+            maxConcurrency: deps.maxConcurrency ?? 2,
+            timeoutMs: deps.evaluationTimeoutMs ?? 120_000,
+        });
+        for (const item of batch.results) {
+            if (item.status === 'fulfilled')
+                cache.set(item.id, item.value ?? []);
+        }
+        const failedEvaluations = batch.results.filter((item) => item.status !== 'fulfilled');
+        if (failedEvaluations.length > 0) {
+            return {
+                ran: false,
+                reason: `candidate evaluation incomplete (${failedEvaluations.length}/${batch.results.length}); peak concurrency ${batch.peakConcurrency}`,
+            };
         }
         const evalFn = (input, cfg) => cache.get(`${input.id}::${cfgKey(cfg)}`) ?? [];
         const gradeFn = (output, expected) => grade(output, expected);
@@ -171,7 +195,76 @@ export async function runFlywheelTick(projectRoot, deps) {
         const heldDeltas = held.map((t) => heldScoreFor(candidate, t) - heldScoreFor(baseline, t));
         const deltaCILow = bootstrapDeltaCILow(heldDeltas);
         const significant = deltaCILow > 0;
-        const finalAccept = result.accepted && significant;
+        const provisionalGates = Object.fromEntries(Object.entries(result.verdict?.terms ?? {}).map(([k, v]) => [k, v.pass]));
+        const txState = readFlywheelTransactionState(projectRoot);
+        const safetyEnvelopeRef = deps.safetyEnvelopeRef ?? sha256Ref(JSON.stringify({
+            schema: 'ruflo.safety-envelope/local-default-v1',
+            authorizationExpansion: false,
+            networkExpansion: false,
+            spendExpansion: false,
+        }));
+        const receipt = createFlywheelReceipt({
+            lineageId: deps.lineageId,
+            evaluationRunId: deps.evaluationRunId,
+            baselineRef: refOf(baseline),
+            expectedLedgerHead: txState.ledgerHead,
+            candidatePolicy: candidate,
+            safetyEnvelopeRef,
+            requestedProposer: deps.requestedProposer ?? 'local',
+            effectiveProposer: deps.effectiveProposer ?? 'local',
+            proposerSubstitution: deps.proposerSubstitution,
+            corpusVersion: blended.version,
+            corpusHash: blended.corpusHash,
+            baselineScore,
+            candidateScore,
+            heldOutDeltas: heldDeltas,
+            frozenAnchorRegression: guardRegressed ? 1 : 0,
+            gates: provisionalGates,
+            resourceEvidence: {
+                p95LatencyMicros: 0,
+                costMicrosPerTask: 0,
+                tokensPerTask: 0,
+                failureRate: '0',
+                evaluationCostMicros: 0,
+                currency: 'USD',
+            },
+            evidence: {
+                corpusRoles: {
+                    selectionTaskIds: train.map((task) => task.id),
+                    promotionHoldoutTaskIds: held.map((task) => task.id),
+                    guardTaskIds: guard.map((task) => task.id),
+                },
+                verification: {
+                    redblue: result.verify?.redblue ?? 'SKIPPED',
+                    drift: result.verify?.drift ?? -1,
+                    driftThreshold: result.verify?.driftThreshold ?? 0.2,
+                    driftVerdict: result.verify?.driftVerdict ?? 'skipped',
+                    adversarialPass: result.verify?.adversarialPass ?? false,
+                },
+                canary: {
+                    candidate: result.canary?.candidate ?? {},
+                    baseline: result.canary?.baseline ?? {},
+                    pass: result.canary?.pass ?? false,
+                },
+            },
+            termVerification: Object.keys(provisionalGates).map((term) => ({
+                term,
+                verification: 'recomputed',
+                evidenceRef: sha256Ref(JSON.stringify({
+                    term,
+                    corpusHash: blended.corpusHash,
+                    heldOutDeltas: heldDeltas,
+                    verification: result.verify,
+                    canary: result.canary,
+                })),
+            })),
+            now: deps.now,
+            privateKeyPem: deps.receiptPrivateKeyPem,
+            publicKeyPem: deps.receiptPublicKeyPem,
+            bootstrapIterations: deps.bootstrapIterations,
+        });
+        await registerFlywheelReceipt(projectRoot, receipt, deps.now ?? Date.now());
+        const finalAccept = result.accepted && significant && receipt.payload.decision === 'accepted';
         const entry = {
             ts: deps.now ?? Date.now(),
             corpusVersion: blended.version, corpusHash: blended.corpusHash,
@@ -180,28 +273,46 @@ export async function runFlywheelTick(projectRoot, deps) {
             baselineScore, candidateScore, delta: candidateScore - baselineScore,
             deltaCILow, significant, loopAccepted: result.accepted,
             anchorRegressed, accepted: finalAccept,
-            gates: Object.fromEntries(Object.entries(result.verdict?.terms ?? {}).map(([k, v]) => [k, v.pass])),
+            gates: provisionalGates,
             reason: finalAccept ? result.reason : (result.accepted ? `held back — improvement not significant (CI low ${deltaCILow.toFixed(4)})` : result.reason),
         };
-        let applied = false;
-        if (finalAccept && result.manifest) {
-            entry.championRef = refOf(candidate);
-            // Apply locally (self-optimization) + chain to the previous champion.
-            const ap = applyChampionParams(projectRoot, {
-                championId: refOf(candidate), params: candidate,
-                layer: 'repo/local', previous: refOf(baseline), now: deps.now,
-            });
-            applied = ap.applied;
-        }
         appendLedger(`${projectRoot}/.claude-flow/metrics`, entry);
         return {
-            ran: true, reason: entry.reason, accepted: finalAccept, applied,
+            ran: true, reason: entry.reason, accepted: finalAccept, applied: false,
             baselineScore, candidateScore, delta: candidateScore - baselineScore,
-            anchorRegressed, championRef: entry.championRef, corpusVersion: blended.version,
+            anchorRegressed, championRef: finalAccept ? refOf(candidate) : undefined,
+            corpusVersion: blended.version, candidateConfig: candidate,
+            receiptId: receipt.payload.receiptId, receipt, promotable: finalAccept && !!receipt.signature,
         };
     }
     catch (e) {
         return { ran: false, reason: `error: ${e?.message ?? e}` };
     }
 }
+/**
+ * Compatibility wrapper. New callers get evaluation-only semantics. The legacy
+ * implicit apply path exists for one release behind an explicit opt-in flag.
+ */
+export async function runFlywheelTick(projectRoot, deps) {
+    const result = await evaluateFlywheelCandidate(projectRoot, deps);
+    if (process.env.RUFLO_FLYWHEEL_LEGACY_APPLY === '1'
+        && result.accepted
+        && result.candidateConfig
+        && result.championRef) {
+        const applied = applyChampionParams(projectRoot, {
+            championId: result.championRef,
+            params: result.candidateConfig,
+            layer: 'repo/local',
+            previous: result.receipt?.payload.baselineRef,
+            now: deps.now,
+        });
+        return {
+            ...result,
+            applied: applied.applied,
+            legacyDeprecation: true,
+            reason: `${result.reason}; deprecated implicit apply path`,
+        };
+    }
+    return result;
+}
 //# sourceMappingURL=harness-flywheel.js.map

package/dist/src/services/policy-runtime.d.ts

@@ -0,0 +1,38 @@
+import { AgenticPolicyEngine, type BudgetLimit, type CapabilityEnvelope, type PolicyApproval, type PolicyDecision, type PolicyRequest, type PolicyRule, type PolicyState } from '@claude-flow/security';
+export declare function loadPolicyState(projectRoot?: string): PolicyState;
+export declare function autoMigratePolicyStateIfNeeded(projectRoot?: string): Promise<{
+    migrated: boolean;
+    statePath?: string;
+    mode?: PolicyState['mode'];
+}>;
+export declare function withPolicyTransaction<T>(projectRoot: string, operation: (engine: AgenticPolicyEngine) => T | Promise<T>, options?: {
+    approvalIssuerVerifier?: (issuer: string) => boolean;
+}): Promise<T>;
+export declare function evaluatePolicyRequest(request: PolicyRequest, projectRoot?: string): Promise<PolicyDecision>;
+export declare function setPolicyMode(mode: PolicyState['mode'], projectRoot?: string): Promise<void>;
+export declare function upsertPolicyRule(rule: PolicyRule, projectRoot?: string): Promise<void>;
+export declare function setPolicyBudget(limit: BudgetLimit, projectRoot?: string): Promise<void>;
+export declare function issuePolicyApproval(approval: Omit<PolicyApproval, 'uses' | 'issuedAt'> & {
+    uses?: number;
+    issuedAt?: number;
+}, projectRoot?: string, approvalIssuerVerifier?: (issuer: string) => boolean): Promise<PolicyApproval>;
+export declare function revokePolicyApproval(id: string, projectRoot?: string): Promise<boolean>;
+export declare function verifyPolicyLedger(projectRoot?: string): Promise<ReturnType<AgenticPolicyEngine['verifyLedger']>>;
+export declare function authorizeMcpTool(toolName: string, input: Record<string, unknown>, context?: Record<string, unknown>, attributes?: Readonly<{
+    actionType?: string;
+    network?: boolean;
+    destructive?: boolean;
+    namespaceAccess?: 'read' | 'write';
+    envelope?: CapabilityEnvelope;
+    costUsd?: number;
+    tokens?: number;
+    concurrency?: number;
+}>): Promise<PolicyDecision>;
+/** Trusted classification derived from the registered tool name, never input. */
+export declare function classifyMcpTool(toolName: string): {
+    actionType: string;
+    network: boolean;
+    destructive: boolean;
+    namespaceAccess?: 'read' | 'write';
+};
+//# sourceMappingURL=policy-runtime.d.ts.map

package/dist/src/services/policy-runtime.js

@@ -0,0 +1,340 @@
+import { AgenticPolicyEngine, createLegacyCompatibleState, } from '@claude-flow/security';
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { userInfo } from 'node:os';
+const POLICY_DIR = join('.claude-flow', 'policy');
+const POLICY_FILE = 'state.json';
+const LOCK_FILE = 'state.lock';
+const LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 5_000;
+function paths(projectRoot) {
+    const root = resolve(projectRoot);
+    const dir = join(root, POLICY_DIR);
+    return { dir, state: join(dir, POLICY_FILE), lock: join(dir, LOCK_FILE) };
+}
+function sleep(ms) {
+    return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+async function acquireLock(lockPath) {
+    const started = Date.now();
+    while (Date.now() - started < LOCK_WAIT_MS) {
+        try {
+            const fd = openSync(lockPath, 'wx', 0o600);
+            writeFileSync(fd, JSON.stringify({ pid: process.pid, acquiredAt: Date.now() }));
+            closeSync(fd);
+            return () => {
+                try {
+                    unlinkSync(lockPath);
+                }
+                catch { /* already released */ }
+            };
+        }
+        catch {
+            try {
+                if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS)
+                    unlinkSync(lockPath);
+            }
+            catch { /* another process changed the lock */ }
+            await sleep(10);
+        }
+    }
+    throw new Error('policy-state-lock-timeout');
+}
+function writeJsonAtomic(file, value) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temporary, file);
+}
+function trustPaths(projectRoot) {
+    const trustRoot = join(userInfo().homedir, '.config', 'ruflo', 'policy-trust');
+    const projectId = createHash('sha256').update(realpathSync(projectRoot)).digest('hex');
+    const dir = join(trustRoot, projectId);
+    return { key: join(dir, 'anchor.key'), anchor: join(dir, 'state.anchor.json') };
+}
+function trustKey(projectRoot, create) {
+    const { key } = trustPaths(projectRoot);
+    if (!existsSync(key)) {
+        if (!create)
+            return undefined;
+        mkdirSync(dirname(key), { recursive: true, mode: 0o700 });
+        writeFileSync(key, randomBytes(32), { mode: 0o600, flag: 'wx' });
+    }
+    const material = readFileSync(key);
+    if (material.length !== 32)
+        throw new Error('invalid-policy-trust-key');
+    return material;
+}
+function stateAuthentication(state, key) {
+    return createHmac('sha256', key).update(JSON.stringify(state)).digest('hex');
+}
+function verifyStateAnchor(projectRoot, state) {
+    const { anchor } = trustPaths(projectRoot);
+    if (!existsSync(anchor))
+        return;
+    if (!state)
+        throw new Error('policy-state-missing-for-anchored-project');
+    const key = trustKey(projectRoot, false);
+    if (!key)
+        throw new Error('policy-trust-key-missing');
+    const record = JSON.parse(readFileSync(anchor, 'utf8'));
+    const expected = stateAuthentication(state, key);
+    const actual = record.authentication ?? '';
+    if (!/^[a-f0-9]{64}$/.test(actual)
+        || !timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual, 'hex'))) {
+        throw new Error('policy-state-authentication-failed');
+    }
+}
+function writePolicyState(projectRoot, statePath, state) {
+    const anchorPath = trustPaths(projectRoot).anchor;
+    if (state.mode === 'enforce' || existsSync(anchorPath)) {
+        const key = trustKey(projectRoot, true);
+        const anchor = {
+            version: 1,
+            projectRoot: realpathSync(projectRoot),
+            mode: state.mode,
+            authentication: stateAuthentication(state, key),
+            updatedAt: Date.now(),
+        };
+        // On first enforcement, establish the external trust record first. A
+        // crash then leaves either a valid pair or an anchored mismatch that
+        // fails closed; it can never leave enforce state silently unanchored.
+        if (!existsSync(anchorPath)) {
+            writeJsonAtomic(anchorPath, anchor);
+            writeJsonAtomic(statePath, state);
+            return;
+        }
+        writeJsonAtomic(statePath, state);
+        writeJsonAtomic(anchorPath, anchor);
+        return;
+    }
+    writeJsonAtomic(statePath, state);
+}
+function detectLegacyCapabilities(projectRoot) {
+    const candidates = [
+        '.swarm/memory.db',
+        '.claude-flow/memory.db',
+        '.claude-flow/data/memory.db',
+        'agentdb.rvf',
+        'agentdb-memory.db',
+    ];
+    const found = candidates.filter((candidate) => existsSync(join(projectRoot, candidate)));
+    const flags = [
+        process.env.CLAUDE_FLOW_STRICT_AUTH === 'true' ? 'strict-auth' : null,
+        process.env.CLAUDE_FLOW_STRICT_MEMORY === 'true' ? 'strict-memory' : null,
+    ].filter(Boolean);
+    return `pre-ADR-324; capabilities=${[...found, ...flags].join(',') || 'none-detected'}`;
+}
+function configuredPolicyMode(projectRoot) {
+    let configured;
+    for (const relative of ['.agents/config.toml', '.codex/config.toml']) {
+        const file = join(resolve(projectRoot), relative);
+        if (!existsSync(file))
+            continue;
+        const content = readFileSync(file, 'utf8');
+        const section = content.match(/(?:^|\n)\[policy\]\s*\n([\s\S]*?)(?=\n\[[^\]]+\]|\s*$)/)?.[1];
+        const mode = section?.match(/(?:^|\n)\s*mode\s*=\s*"(legacy|observe|enforce)"/)?.[1];
+        if (mode)
+            configured = mode;
+    }
+    return configured;
+}
+export function loadPolicyState(projectRoot = process.cwd()) {
+    const target = paths(projectRoot);
+    if (!existsSync(target.state)) {
+        verifyStateAnchor(projectRoot, undefined);
+        return createLegacyCompatibleState(detectLegacyCapabilities(projectRoot));
+    }
+    const parsed = JSON.parse(readFileSync(target.state, 'utf8'));
+    if (parsed.version !== 1 || !Array.isArray(parsed.rules) || !Array.isArray(parsed.receipts)) {
+        throw new Error(`unsupported-policy-state-version:${String(parsed.version)}`);
+    }
+    verifyStateAnchor(projectRoot, parsed);
+    return parsed;
+}
+export async function autoMigratePolicyStateIfNeeded(projectRoot = process.cwd()) {
+    const target = paths(projectRoot);
+    if (existsSync(target.state)) {
+        const configured = configuredPolicyMode(projectRoot);
+        const current = loadPolicyState(projectRoot);
+        if (configured && current.configuredMode !== configured) {
+            await withPolicyTransaction(projectRoot, (engine) => engine.setConfiguredMode(configured));
+        }
+        return { migrated: false, statePath: target.state, mode: loadPolicyState(projectRoot).mode };
+    }
+    // Only upgrade existing Ruflo installations. A random directory should not
+    // acquire policy state merely because `ruflo --version` ran there.
+    if (!existsSync(join(resolve(projectRoot), '.claude-flow'))
+        && !existsSync(join(resolve(projectRoot), '.swarm')))
+        return { migrated: false };
+    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    const release = await acquireLock(target.lock);
+    try {
+        if (!existsSync(target.state)) {
+            const state = createLegacyCompatibleState(detectLegacyCapabilities(projectRoot));
+            const configured = configuredPolicyMode(projectRoot);
+            if (configured) {
+                state.mode = configured;
+                state.configuredMode = configured;
+            }
+            writePolicyState(projectRoot, target.state, state);
+        }
+    }
+    finally {
+        release();
+    }
+    return { migrated: true, statePath: target.state, mode: loadPolicyState(projectRoot).mode };
+}
+export async function withPolicyTransaction(projectRoot, operation, options = {}) {
+    const target = paths(projectRoot);
+    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    const release = await acquireLock(target.lock);
+    try {
+        const engine = AgenticPolicyEngine.fromState(loadPolicyState(projectRoot), {
+            signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
+            keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
+            evidenceVerifier: verifyPolicyEvidence,
+            approvalIssuerVerifier: options.approvalIssuerVerifier,
+        });
+        const result = await operation(engine);
+        const nextState = engine.exportState();
+        if (!engine.verifyLedger().valid)
+            throw new Error('policy-ledger-verification-failed');
+        writePolicyState(projectRoot, target.state, nextState);
+        return result;
+    }
+    finally {
+        release();
+    }
+}
+function verifyPolicyEvidence(evidence) {
+    if (!evidence.keyId || !evidence.contentHash || !evidence.signature)
+        return false;
+    let keys;
+    try {
+        keys = JSON.parse(process.env.CLAUDE_FLOW_POLICY_EVIDENCE_KEYS ?? '{}');
+    }
+    catch {
+        return false;
+    }
+    const key = keys[evidence.keyId];
+    if (!key || key.length < 16 || !/^sha256:[a-f0-9]{64}$/i.test(evidence.contentHash))
+        return false;
+    const signedClaims = JSON.stringify({
+        id: evidence.id,
+        provenance: evidence.provenance,
+        attestor: evidence.attestor,
+        observedAt: evidence.observedAt,
+        contentHash: evidence.contentHash,
+        keyId: evidence.keyId,
+    });
+    const expected = createHmac('sha256', key).update(signedClaims).digest('hex');
+    const provided = evidence.signature.replace(/^hmac-sha256:/, '');
+    if (!/^[a-f0-9]{64}$/i.test(provided))
+        return false;
+    return timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(provided, 'hex'));
+}
+export async function evaluatePolicyRequest(request, projectRoot = process.cwd()) {
+    return withPolicyTransaction(projectRoot, (engine) => engine.evaluate(request));
+}
+export async function setPolicyMode(mode, projectRoot = process.cwd()) {
+    return withPolicyTransaction(projectRoot, (engine) => engine.setMode(mode));
+}
+export async function upsertPolicyRule(rule, projectRoot = process.cwd()) {
+    return withPolicyTransaction(projectRoot, (engine) => engine.upsertRule(rule));
+}
+export async function setPolicyBudget(limit, projectRoot = process.cwd()) {
+    return withPolicyTransaction(projectRoot, (engine) => engine.setBudget(limit));
+}
+export async function issuePolicyApproval(approval, projectRoot = process.cwd(), approvalIssuerVerifier) {
+    return withPolicyTransaction(projectRoot, (engine) => engine.issueApproval(approval), { approvalIssuerVerifier });
+}
+export async function revokePolicyApproval(id, projectRoot = process.cwd()) {
+    return withPolicyTransaction(projectRoot, (engine) => engine.revokeApproval(id));
+}
+export async function verifyPolicyLedger(projectRoot = process.cwd()) {
+    return withPolicyTransaction(projectRoot, (engine) => engine.verifyLedger());
+}
+export async function authorizeMcpTool(toolName, input, context = {}, attributes = {}) {
+    let projectRoot = typeof context.projectRoot === 'string' ? context.projectRoot : process.cwd();
+    let processEnvelope;
+    if (process.env.CLAUDE_FLOW_CAPABILITY_ENVELOPE) {
+        try {
+            const parsed = JSON.parse(process.env.CLAUDE_FLOW_CAPABILITY_ENVELOPE);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                throw new Error('not an object');
+            }
+            processEnvelope = parsed;
+        }
+        catch {
+            throw new Error('invalid-worker-capability-envelope');
+        }
+        // Linked git worktrees share one immutable common git directory. Derive
+        // the coordinator checkout from that directory so a worker cannot fall
+        // back to independent legacy policy state in its isolated worktree.
+        try {
+            const cwd = realpathSync(process.cwd());
+            const common = execFileSync('git', ['-C', cwd, 'rev-parse', '--path-format=absolute', '--git-common-dir'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+            projectRoot = dirname(realpathSync(common));
+        }
+        catch {
+            throw new Error('authoritative-worker-policy-root-unavailable');
+        }
+    }
+    return evaluatePolicyRequest({
+        identity: {
+            id: process.env.CLAUDE_FLOW_PRINCIPAL_ID ?? 'legacy-cli',
+            type: process.env.CLAUDE_FLOW_PRINCIPAL_ID ? 'agent' : 'legacy',
+        },
+        action: {
+            type: attributes.actionType ?? 'mcp.tool.call',
+            resource: toolName,
+            tool: toolName,
+            server: typeof context.serverId === 'string' ? context.serverId : 'ruflo',
+            namespace: typeof input.namespace === 'string' ? input.namespace : undefined,
+            environment: typeof context.environment === 'string' ? context.environment : undefined,
+            costUsd: attributes.costUsd,
+            tokens: attributes.tokens,
+            concurrency: attributes.concurrency,
+            network: attributes.network === true,
+            destructive: attributes.destructive === true,
+        },
+        context: {
+            envelope: attributes.envelope ?? processEnvelope,
+            approvalIds: Array.isArray(context.approvalIds) ? context.approvalIds.map(String) : undefined,
+            evidence: Array.isArray(context.evidence) ? context.evidence : undefined,
+            metadata: {
+                inputDigest: `sha256:${createHash('sha256').update(JSON.stringify(input)).digest('hex')}`,
+            },
+        },
+    }, projectRoot);
+}
+/** Trusted classification derived from the registered tool name, never input. */
+export function classifyMcpTool(toolName) {
+    const normalized = toolName.toLowerCase();
+    const policyAdmin = normalized.startsWith('policy_')
+        && !['policy_evaluate', 'policy_status'].includes(normalized);
+    const memoryRead = /^(?:memory|agentdb)_(?:pattern-)?(?:search|query|get|retrieve|list|status|stats)/.test(normalized);
+    const memoryWrite = /^(?:memory|agentdb)_(?:pattern-)?(?:store|insert|update|delete|clear|purge|init)/.test(normalized);
+    const terminal = /^(?:terminal_execute|bash|shell|exec)/.test(normalized);
+    const destructive = policyAdmin
+        || terminal
+        || /(delete|remove|clear|purge|revoke|promote|deploy|integrate|cleanup|terminate|stop)/.test(normalized);
+    const network = terminal
+        || /(github|browser|web_|http_|fetch|managed_agent|federation|ipfs|openrouter|provider)/.test(normalized);
+    return {
+        actionType: policyAdmin
+            ? `policy.admin.${normalized.slice('policy_'.length)}`
+            : memoryRead
+                ? 'memory.read'
+                : memoryWrite
+                    ? 'memory.write'
+                    : 'mcp.tool.call',
+        network,
+        destructive,
+        namespaceAccess: memoryRead ? 'read' : memoryWrite ? 'write' : undefined,
+    };
+}
+//# sourceMappingURL=policy-runtime.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.25",
+  "version": "3.32.29",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -86,6 +86,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "check:metaharness-pins": "node ../../../scripts/check-metaharness-pins.mjs",
     "test": "vitest run",
     "test:plugin-store": "npx tsx src/plugins/tests/standalone-test.ts",
     "test:pattern-store": "npx tsx src/transfer/store/tests/standalone-test.ts",
@@ -104,23 +105,40 @@
     "@claude-flow/mcp": "3.0.0-alpha.8",
     "@claude-flow/neural": "3.0.0-alpha.9",
     "@claude-flow/shared": "3.0.0-alpha.7",
-    "@metaharness/router": "^0.3.2",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",
-    "metaharness": "^0.4.1",
     "semver": "7.7.3",
     "sql.js": "^1.13.0",
     "yaml": "^2.8.0"
   },
   "optionalDependencies": {
     "@claude-flow/memory": "^3.0.0-alpha.21",
-    "@claude-flow/security": "^3.0.0-alpha.12",
-    "@metaharness/darwin": "^0.8.0",
+    "@claude-flow/security": "^3.0.0-alpha.14",
     "agentdb": "^3.0.0-alpha.17",
     "agentic-flow": "^3.0.0-alpha.1",
     "better-sqlite3": "^12.9.0",
     "ruvector": "^0.2.27"
   },
+  "peerDependencies": {
+    "@metaharness/darwin": "^0.8.0",
+    "@metaharness/flywheel": "^0.1.7",
+    "@metaharness/router": "^0.3.2",
+    "metaharness": "^0.4.1"
+  },
+  "peerDependenciesMeta": {
+    "@metaharness/darwin": {
+      "optional": true
+    },
+    "@metaharness/flywheel": {
+      "optional": true
+    },
+    "@metaharness/router": {
+      "optional": true
+    },
+    "metaharness": {
+      "optional": true
+    }
+  },
   "publishConfig": {
     "access": "public",
     "tag": "latest"