@claude-flow/cli 3.32.3 → 3.32.4

package/dist/src/proxy/verify.d.ts

@@ -0,0 +1,44 @@
+/**
+ * meta-proxy release verification (ADR-307) — mirrors src/init/helper-signing.ts's
+ * raw-EdDSA `crypto.verify(null, ...)` pattern almost exactly, and matches the
+ * exact scheme confirmed live 2026-07-16 against a real v0.1.0 release: ONE
+ * combined `SHA256SUMS.sig` (raw Ed25519 over the `SHA256SUMS` file's bytes,
+ * base64-encoded — not a per-binary signature), then a per-asset SHA-256
+ * check against the matching `SHA256SUMS` line. Refuse-all-or-nothing on any
+ * mismatch, same discipline as `writeCriticalHelpers()`.
+ *
+ * @module proxy/verify
+ */
+/**
+ * meta-proxy's committed release-signing public key (SPKI PEM), confirmed
+ * live 2026-07-16 by verifying a real `SHA256SUMS.sig` from the v0.1.0
+ * release against it (crypto.verify -> true).
+ */
+export declare const PROXY_RELEASE_PUBKEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=\n-----END PUBLIC KEY-----";
+export declare class ReleaseVerificationError extends Error {
+    constructor(message: string);
+}
+/** Raw EdDSA verify of `SHA256SUMS.sig` (base64) over `SHA256SUMS`'s exact bytes. */
+export declare function verifySha256SumsSignature(sumsBytes: Buffer, sigBase64: string, pubkeyPem?: string): boolean;
+export type ParsedChecksums = Record<string, string>;
+/** Parses `<sha256>  <filename>` lines (sha256sum's own output format). */
+export declare function parseSha256Sums(sumsText: string): ParsedChecksums;
+export declare function sha256Hex(bytes: Buffer): string;
+export interface VerifyReleaseInput {
+    sumsBytes: Buffer;
+    sigBase64: string;
+    assetBytes: Buffer;
+    assetFilename: string;
+    pubkeyPem?: string;
+}
+export interface VerifyReleaseResult {
+    sha256: string;
+}
+/**
+ * Full verification: signature over SHA256SUMS, then the asset's own hash
+ * against the matching line. Throws `ReleaseVerificationError` on ANY
+ * failure — there is no partial-trust outcome, matching ADR-307's "refuses
+ * on any mismatch" requirement.
+ */
+export declare function verifyRelease(input: VerifyReleaseInput): VerifyReleaseResult;
+//# sourceMappingURL=verify.d.ts.map

package/dist/src/proxy/verify.js

@@ -0,0 +1,68 @@
+/**
+ * meta-proxy release verification (ADR-307) — mirrors src/init/helper-signing.ts's
+ * raw-EdDSA `crypto.verify(null, ...)` pattern almost exactly, and matches the
+ * exact scheme confirmed live 2026-07-16 against a real v0.1.0 release: ONE
+ * combined `SHA256SUMS.sig` (raw Ed25519 over the `SHA256SUMS` file's bytes,
+ * base64-encoded — not a per-binary signature), then a per-asset SHA-256
+ * check against the matching `SHA256SUMS` line. Refuse-all-or-nothing on any
+ * mismatch, same discipline as `writeCriticalHelpers()`.
+ *
+ * @module proxy/verify
+ */
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+/**
+ * meta-proxy's committed release-signing public key (SPKI PEM), confirmed
+ * live 2026-07-16 by verifying a real `SHA256SUMS.sig` from the v0.1.0
+ * release against it (crypto.verify -> true).
+ */
+export const PROXY_RELEASE_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=
+-----END PUBLIC KEY-----`;
+export class ReleaseVerificationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ReleaseVerificationError';
+    }
+}
+/** Raw EdDSA verify of `SHA256SUMS.sig` (base64) over `SHA256SUMS`'s exact bytes. */
+export function verifySha256SumsSignature(sumsBytes, sigBase64, pubkeyPem = PROXY_RELEASE_PUBKEY_PEM) {
+    const pubkey = createPublicKey(pubkeyPem);
+    const sig = Buffer.from(sigBase64.trim(), 'base64');
+    return cryptoVerify(null, sumsBytes, pubkey, sig);
+}
+/** Parses `<sha256>  <filename>` lines (sha256sum's own output format). */
+export function parseSha256Sums(sumsText) {
+    const result = {};
+    for (const line of sumsText.split(/\r?\n/)) {
+        const match = line.match(/^([0-9a-f]{64})\s+(.+)$/i);
+        if (!match)
+            continue;
+        result[match[2]] = match[1].toLowerCase();
+    }
+    return result;
+}
+export function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+/**
+ * Full verification: signature over SHA256SUMS, then the asset's own hash
+ * against the matching line. Throws `ReleaseVerificationError` on ANY
+ * failure — there is no partial-trust outcome, matching ADR-307's "refuses
+ * on any mismatch" requirement.
+ */
+export function verifyRelease(input) {
+    if (!verifySha256SumsSignature(input.sumsBytes, input.sigBase64, input.pubkeyPem)) {
+        throw new ReleaseVerificationError('SHA256SUMS.sig failed Ed25519 verification — refusing to install');
+    }
+    const sums = parseSha256Sums(input.sumsBytes.toString('utf-8'));
+    const expected = sums[input.assetFilename];
+    if (!expected) {
+        throw new ReleaseVerificationError(`SHA256SUMS has no entry for ${input.assetFilename}`);
+    }
+    const actual = sha256Hex(input.assetBytes);
+    if (actual !== expected) {
+        throw new ReleaseVerificationError(`sha256 mismatch for ${input.assetFilename}: expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…`);
+    }
+    return { sha256: actual };
+}
+//# sourceMappingURL=verify.js.map

package/dist/src/runtime/headless.d.ts

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+/**
+ * Headless Runtime for Background Workers
+ * Runs without TTY for daemon processes and scheduled tasks
+ *
+ * Usage:
+ *   npx @claude-flow/cli headless --worker <type>
+ *   npx @claude-flow/cli headless --daemon
+ *   npx @claude-flow/cli headless --benchmark
+ *
+ * Environment:
+ *   CLAUDE_FLOW_HEADLESS=true
+ *   CLAUDE_CODE_HEADLESS=true
+ *
+ * @module v3/cli/runtime/headless
+ */
+import { type HeadlessWorkerType } from '../services/headless-worker-executor.js';
+interface HeadlessConfig {
+    mode: 'worker' | 'daemon' | 'benchmark' | 'status';
+    workerType?: HeadlessWorkerType;
+    timeout?: number;
+    verbose?: boolean;
+}
+interface BenchmarkResults {
+    sona: {
+        avgMs: number;
+        targetMet: boolean;
+    };
+    flashAttention: {
+        throughputPerMs: number;
+        speedup: number;
+    };
+    hnsw: {
+        entriesIndexed: number;
+        searchTime: number;
+    };
+}
+/**
+ * Run a specific worker
+ */
+declare function runWorker(workerType: HeadlessWorkerType, timeout: number): Promise<void>;
+/**
+ * Run daemon mode
+ */
+declare function runDaemon(): Promise<void>;
+/**
+ * Run benchmarks
+ */
+declare function runBenchmarks(): Promise<BenchmarkResults>;
+/**
+ * Show system status
+ */
+declare function showStatus(): Promise<void>;
+/**
+ * Main entry point
+ */
+declare function main(): Promise<void>;
+export { main, runWorker, runDaemon, runBenchmarks, showStatus };
+export type { HeadlessConfig, BenchmarkResults };
+//# sourceMappingURL=headless.d.ts.map

package/dist/src/runtime/headless.js

@@ -0,0 +1,284 @@
+#!/usr/bin/env node
+/**
+ * Headless Runtime for Background Workers
+ * Runs without TTY for daemon processes and scheduled tasks
+ *
+ * Usage:
+ *   npx @claude-flow/cli headless --worker <type>
+ *   npx @claude-flow/cli headless --daemon
+ *   npx @claude-flow/cli headless --benchmark
+ *
+ * Environment:
+ *   CLAUDE_FLOW_HEADLESS=true
+ *   CLAUDE_CODE_HEADLESS=true
+ *
+ * @module v3/cli/runtime/headless
+ */
+import { HeadlessWorkerExecutor, HEADLESS_WORKER_TYPES } from '../services/headless-worker-executor.js';
+import { getDaemon, startDaemon, stopDaemon } from '../services/worker-daemon.js';
+import { initializeIntelligence, benchmarkAdaptation, getIntelligenceStats } from '../memory/intelligence.js';
+import { getHNSWStatus, batchCosineSim, flashAttentionSearch } from '../memory/memory-initializer.js';
+// ============================================================================
+// Main Runtime
+// ============================================================================
+/**
+ * Parse command line arguments
+ */
+function parseArgs() {
+    const args = process.argv.slice(2);
+    const config = {
+        mode: 'status',
+        verbose: false
+    };
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--worker' || arg === '-w') {
+            config.mode = 'worker';
+            config.workerType = args[++i];
+        }
+        else if (arg === '--daemon' || arg === '-d') {
+            config.mode = 'daemon';
+        }
+        else if (arg === '--benchmark' || arg === '-b') {
+            config.mode = 'benchmark';
+        }
+        else if (arg === '--status' || arg === '-s') {
+            config.mode = 'status';
+        }
+        else if (arg === '--timeout' || arg === '-t') {
+            config.timeout = parseInt(args[++i], 10) || 60000;
+        }
+        else if (arg === '--verbose' || arg === '-v') {
+            config.verbose = true;
+        }
+        else if (arg === '--help' || arg === '-h') {
+            showHelp();
+            process.exit(0);
+        }
+    }
+    return config;
+}
+/**
+ * Show help message
+ */
+function showHelp() {
+    console.log(`
+Headless Runtime for RuFlo V3
+
+Usage:
+  headless --worker <type>    Run a specific worker
+  headless --daemon           Start background daemon
+  headless --benchmark        Run performance benchmarks
+  headless --status           Show system status
+
+Workers: ${HEADLESS_WORKER_TYPES.join(', ')}
+
+Options:
+  -w, --worker <type>   Worker type to run
+  -d, --daemon          Run as daemon
+  -b, --benchmark       Run benchmarks
+  -s, --status          Show status
+  -t, --timeout <ms>    Execution timeout (default: 60000)
+  -v, --verbose         Verbose output
+  -h, --help            Show help
+
+Environment:
+  CLAUDE_FLOW_HEADLESS=true   Enable headless mode
+  CLAUDE_CODE_HEADLESS=true   Enable Claude Code headless
+
+Examples:
+  headless --worker audit --timeout 120000
+  headless --daemon
+  headless --benchmark
+`);
+}
+/**
+ * Run a specific worker
+ */
+async function runWorker(workerType, timeout) {
+    console.log(`[Headless] Starting worker: ${workerType}`);
+    const executor = new HeadlessWorkerExecutor(process.cwd(), {
+        maxConcurrent: 1,
+        defaultTimeoutMs: timeout
+    });
+    try {
+        const result = await executor.execute(workerType, {
+            timeoutMs: timeout,
+            model: 'sonnet',
+            sandbox: 'permissive'
+        });
+        if (result.success) {
+            console.log(`[Headless] Worker ${workerType} completed successfully`);
+            console.log(`[Headless] Duration: ${result.durationMs}ms`);
+            if (result.output) {
+                console.log(`[Headless] Output: ${JSON.stringify(result.output).slice(0, 500)}...`);
+            }
+        }
+        else {
+            console.error(`[Headless] Worker ${workerType} failed: ${result.error}`);
+            process.exit(1);
+        }
+    }
+    finally {
+        // executor doesn't have shutdown, just let it be garbage collected
+    }
+}
+/**
+ * Run daemon mode
+ */
+async function runDaemon() {
+    console.log('[Headless] Starting daemon mode...');
+    // Start the daemon
+    const daemon = await startDaemon(process.cwd());
+    console.log('[Headless] Daemon started');
+    console.log('[Headless] Press Ctrl+C to stop');
+    // Handle shutdown
+    process.on('SIGINT', async () => {
+        console.log('\n[Headless] Shutting down daemon...');
+        await stopDaemon();
+        process.exit(0);
+    });
+    process.on('SIGTERM', async () => {
+        console.log('\n[Headless] Received SIGTERM, shutting down...');
+        await stopDaemon();
+        process.exit(0);
+    });
+    // Keep process running
+    await new Promise(() => { });
+}
+/**
+ * Run benchmarks
+ */
+async function runBenchmarks() {
+    console.log('=== RuFlo V3 Performance Benchmarks ===\n');
+    // Initialize intelligence
+    await initializeIntelligence();
+    // SONA Benchmark
+    console.log('1. SONA Adaptation Benchmark (10,000 iterations)...');
+    const sonaResult = benchmarkAdaptation(10000);
+    console.log(`   Average: ${sonaResult.avgMs.toFixed(4)}ms`);
+    console.log(`   Target (<0.05ms): ${sonaResult.targetMet ? '✅ ACHIEVED' : '❌ NOT MET'}`);
+    // Flash Attention Benchmark
+    console.log('\n2. Flash Attention Search Benchmark...');
+    const dim = 384;
+    const count = 10000;
+    const query = new Float32Array(dim).map(() => Math.random() - 0.5);
+    const vectors = Array.from({ length: count }, () => new Float32Array(dim).map(() => Math.random() - 0.5));
+    // Warmup
+    flashAttentionSearch(query, vectors, { k: 10 });
+    const flashStart = performance.now();
+    for (let i = 0; i < 10; i++) {
+        flashAttentionSearch(query, vectors, { k: 10 });
+    }
+    const flashTime = (performance.now() - flashStart) / 10;
+    const throughput = count / flashTime;
+    // Brute force comparison
+    const bruteStart = performance.now();
+    for (let i = 0; i < 10; i++) {
+        const scores = batchCosineSim(query, vectors);
+        Array.from({ length: count }, (_, i) => i)
+            .sort((a, b) => scores[b] - scores[a])
+            .slice(0, 10);
+    }
+    const bruteTime = (performance.now() - bruteStart) / 10;
+    const speedup = bruteTime / flashTime;
+    console.log(`   Throughput: ${throughput.toFixed(0)} vectors/ms`);
+    console.log(`   Time for 10k vectors: ${flashTime.toFixed(2)}ms`);
+    console.log(`   Speedup vs brute force: ${speedup.toFixed(2)}x`);
+    // HNSW Status
+    console.log('\n3. HNSW Index Status...');
+    const hnswStatus = getHNSWStatus();
+    console.log(`   Entries indexed: ${hnswStatus.entryCount}`);
+    console.log(`   Initialized: ${hnswStatus.initialized}`);
+    // Intelligence Stats
+    console.log('\n4. Intelligence System Stats...');
+    const stats = getIntelligenceStats();
+    console.log(`   SONA enabled: ${stats.sonaEnabled}`);
+    console.log(`   Patterns learned: ${stats.patternsLearned}`);
+    console.log(`   Avg adaptation time: ${stats.avgAdaptationTime.toFixed(4)}ms`);
+    console.log('\n=== Benchmark Complete ===');
+    return {
+        sona: {
+            avgMs: sonaResult.avgMs,
+            targetMet: sonaResult.targetMet
+        },
+        flashAttention: {
+            throughputPerMs: throughput,
+            speedup
+        },
+        hnsw: {
+            entriesIndexed: hnswStatus.entryCount,
+            searchTime: flashTime
+        }
+    };
+}
+/**
+ * Show system status
+ */
+async function showStatus() {
+    console.log('=== RuFlo V3 System Status ===\n');
+    // Check daemon
+    const daemon = getDaemon();
+    console.log('Daemon:');
+    if (daemon) {
+        const status = daemon.getStatus();
+        console.log(`  Running: ${status.running}`);
+        console.log(`  PID: ${status.pid}`);
+        console.log(`  Workers: ${status.workers.size}`);
+    }
+    else {
+        console.log('  Not initialized');
+    }
+    // Intelligence
+    const stats = getIntelligenceStats();
+    console.log('\nIntelligence:');
+    console.log(`  SONA enabled: ${stats.sonaEnabled}`);
+    console.log(`  ReasoningBank size: ${stats.reasoningBankSize}`);
+    console.log(`  Patterns learned: ${stats.patternsLearned}`);
+    // HNSW
+    const hnsw = getHNSWStatus();
+    console.log('\nHNSW Index:');
+    console.log(`  Initialized: ${hnsw.initialized}`);
+    console.log(`  Entries: ${hnsw.entryCount}`);
+    console.log('\nEnvironment:');
+    console.log(`  CLAUDE_FLOW_HEADLESS: ${process.env.CLAUDE_FLOW_HEADLESS || 'not set'}`);
+    console.log(`  CLAUDE_CODE_HEADLESS: ${process.env.CLAUDE_CODE_HEADLESS || 'not set'}`);
+    console.log(`  NODE_ENV: ${process.env.NODE_ENV || 'development'}`);
+}
+/**
+ * Main entry point
+ */
+async function main() {
+    // Set headless environment
+    process.env.CLAUDE_FLOW_HEADLESS = 'true';
+    const config = parseArgs();
+    try {
+        switch (config.mode) {
+            case 'worker':
+                if (!config.workerType || !HEADLESS_WORKER_TYPES.includes(config.workerType)) {
+                    console.error(`Invalid worker type. Available: ${HEADLESS_WORKER_TYPES.join(', ')}`);
+                    process.exit(1);
+                }
+                await runWorker(config.workerType, config.timeout || 60000);
+                break;
+            case 'daemon':
+                await runDaemon();
+                break;
+            case 'benchmark':
+                await runBenchmarks();
+                break;
+            case 'status':
+            default:
+                await showStatus();
+                break;
+        }
+    }
+    catch (error) {
+        console.error('[Headless] Error:', error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+}
+// Run if executed directly
+main().catch(console.error);
+export { main, runWorker, runDaemon, runBenchmarks, showStatus };
+//# sourceMappingURL=headless.js.map

package/dist/src/runtime/parent-death-watchdog.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Parent-death watchdog (#2234).
+ *
+ * `ruflo mcp start` runs as a double-forked grandchild of Claude Code (`npx -y
+ * ruflo … mcp start` → `npm exec …` → `node … mcp start`). When Claude Code
+ * exits, only the `npm exec` shim is terminated; the `node` server reparents to
+ * `launchd`/`init` (`ppid === 1`) and silently lingers — leaving ~50 MB and an
+ * open database handle per restart. Over a week this accumulates to ~20
+ * orphaned servers (~1 GB), and an arbitrary stale one can win the next stdio
+ * handshake, transparently serving superseded code.
+ *
+ * Cheap, robust fix: poll `process.ppid`. When it becomes 1 (and didn't start
+ * there), our original parent has exited — we're orphaned. Run the cleanup
+ * hook and exit cleanly.
+ *
+ * @module runtime/parent-death-watchdog
+ */
+export interface ParentDeathWatchdogOptions {
+    /** Poll interval in ms. Default 2000. */
+    intervalMs?: number;
+    /**
+     * Cleanup hook fired when orphaning is detected. May be async. After it
+     * resolves (or throws), the process exits with code 0 (success) / 1 (error).
+     * Defaults to `process.exit(0)` directly.
+     */
+    onOrphaned?: () => void | Promise<void>;
+    /** Override `process.ppid` getter (tests). */
+    ppidGetter?: () => number;
+    /** Override `process.exit` (tests). */
+    exit?: (code: number) => void;
+}
+export interface ParentDeathWatchdog {
+    stop(): void;
+    /** Manually trigger the orphan check (used by tests). */
+    checkOnce(): Promise<void>;
+}
+/**
+ * Install a parent-death watchdog. Safe to call once per process; calling
+ * twice replaces the previous interval.
+ */
+export declare function installParentDeathWatchdog(opts?: ParentDeathWatchdogOptions): ParentDeathWatchdog;
+//# sourceMappingURL=parent-death-watchdog.d.ts.map

package/dist/src/runtime/parent-death-watchdog.js

@@ -0,0 +1,70 @@
+/**
+ * Parent-death watchdog (#2234).
+ *
+ * `ruflo mcp start` runs as a double-forked grandchild of Claude Code (`npx -y
+ * ruflo … mcp start` → `npm exec …` → `node … mcp start`). When Claude Code
+ * exits, only the `npm exec` shim is terminated; the `node` server reparents to
+ * `launchd`/`init` (`ppid === 1`) and silently lingers — leaving ~50 MB and an
+ * open database handle per restart. Over a week this accumulates to ~20
+ * orphaned servers (~1 GB), and an arbitrary stale one can win the next stdio
+ * handshake, transparently serving superseded code.
+ *
+ * Cheap, robust fix: poll `process.ppid`. When it becomes 1 (and didn't start
+ * there), our original parent has exited — we're orphaned. Run the cleanup
+ * hook and exit cleanly.
+ *
+ * @module runtime/parent-death-watchdog
+ */
+/**
+ * Install a parent-death watchdog. Safe to call once per process; calling
+ * twice replaces the previous interval.
+ */
+export function installParentDeathWatchdog(opts = {}) {
+    const intervalMs = opts.intervalMs ?? 2000;
+    const get = opts.ppidGetter ?? (() => process.ppid);
+    const exit = opts.exit ?? ((code) => process.exit(code));
+    const onOrphaned = opts.onOrphaned;
+    const initialPpid = get();
+    let triggered = false;
+    let timer;
+    const triggerOrphaned = async () => {
+        if (triggered)
+            return;
+        triggered = true;
+        if (timer) {
+            clearInterval(timer);
+            timer = undefined;
+        }
+        try {
+            if (onOrphaned)
+                await onOrphaned();
+            exit(0);
+        }
+        catch {
+            exit(1);
+        }
+    };
+    const checkOnce = async () => {
+        // Only trigger when we *transition* to ppid=1; if we already started there
+        // (process launched directly under launchd/init) it isn't an orphan event.
+        const ppid = get();
+        if (ppid === 1 && initialPpid !== 1)
+            await triggerOrphaned();
+    };
+    timer = setInterval(() => {
+        void checkOnce();
+    }, intervalMs);
+    // Don't keep the event loop alive on the watchdog alone.
+    if (typeof timer.unref === 'function')
+        timer.unref();
+    return {
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = undefined;
+            }
+        },
+        checkOnce,
+    };
+}
+//# sourceMappingURL=parent-death-watchdog.js.map