@claude-flow/cli 3.32.3 → 3.32.4

package/dist/src/update/checker.js

@@ -0,0 +1,191 @@
+/**
+ * Update checker for @claude-flow packages
+ * Queries npm registry and compares versions
+ */
+import * as semver from 'semver';
+import { createRequire } from 'node:module';
+import { shouldCheckForUpdates, recordCheck, getCachedVersions } from './rate-limiter.js';
+const DEFAULT_CONFIG = {
+    enabled: true,
+    checkIntervalHours: 24,
+    autoUpdate: {
+        patch: true,
+        minor: false,
+        major: false,
+    },
+    priority: {
+        '@claude-flow/security': 'critical',
+        '@claude-flow/cli': 'high',
+        '@claude-flow/embeddings': 'normal',
+        '@claude-flow/integration': 'normal',
+        '@claude-flow/testing': 'low',
+    },
+    exclude: [],
+};
+// Packages to check for updates
+const CLAUDE_FLOW_PACKAGES = [
+    '@claude-flow/cli',
+    '@claude-flow/embeddings',
+    '@claude-flow/security',
+    '@claude-flow/integration',
+    '@claude-flow/testing',
+];
+async function fetchPackageInfo(packageName) {
+    try {
+        const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
+            headers: { Accept: 'application/json' },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+function getUpdateType(current, latest) {
+    if (!semver.valid(current) || !semver.valid(latest)) {
+        return 'none';
+    }
+    if (semver.eq(current, latest)) {
+        return 'none';
+    }
+    if (semver.major(latest) > semver.major(current)) {
+        return 'major';
+    }
+    if (semver.minor(latest) > semver.minor(current)) {
+        return 'minor';
+    }
+    if (semver.patch(latest) > semver.patch(current)) {
+        return 'patch';
+    }
+    return 'none';
+}
+function shouldAutoUpdate(updateType, priority, config) {
+    if (updateType === 'none')
+        return false;
+    // Critical security packages always auto-update patches
+    if (priority === 'critical' && updateType === 'patch') {
+        return true;
+    }
+    // Check config
+    if (updateType === 'major')
+        return config.autoUpdate.major;
+    if (updateType === 'minor')
+        return config.autoUpdate.minor;
+    if (updateType === 'patch')
+        return config.autoUpdate.patch;
+    return false;
+}
+export function getInstalledVersion(packageName) {
+    try {
+        // Try to find the package in node_modules
+        const possiblePaths = [
+            `${packageName}/package.json`,
+            `../../node_modules/${packageName}/package.json`,
+            `../../../node_modules/${packageName}/package.json`,
+        ];
+        for (const modulePath of possiblePaths) {
+            try {
+                // Use createRequire for ESM-compatible package.json loading
+                const esmRequire = createRequire(import.meta.url);
+                const resolved = esmRequire.resolve(modulePath, { paths: [process.cwd()] });
+                const pkg = esmRequire(resolved);
+                return pkg.version;
+            }
+            catch {
+                continue;
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function checkForUpdates(config = DEFAULT_CONFIG) {
+    // Check rate limit
+    const rateCheck = shouldCheckForUpdates(config.checkIntervalHours);
+    if (!rateCheck.allowed) {
+        // Return cached results if available
+        const cached = getCachedVersions();
+        if (Object.keys(cached).length > 0) {
+            return {
+                results: [],
+                skipped: true,
+                reason: rateCheck.reason,
+            };
+        }
+        return { results: [], skipped: true, reason: rateCheck.reason };
+    }
+    const results = [];
+    const versionCache = {};
+    // Check each package
+    const packagesToCheck = CLAUDE_FLOW_PACKAGES.filter((pkg) => !config.exclude.includes(pkg));
+    // Sort by priority (critical first)
+    const priorityOrder = { critical: 0, high: 1, normal: 2, low: 3 };
+    packagesToCheck.sort((a, b) => {
+        const pa = config.priority[a] || 'normal';
+        const pb = config.priority[b] || 'normal';
+        return priorityOrder[pa] - priorityOrder[pb];
+    });
+    await Promise.all(packagesToCheck.map(async (packageName) => {
+        const currentVersion = getInstalledVersion(packageName);
+        if (!currentVersion) {
+            // Package not installed, skip
+            return;
+        }
+        const info = await fetchPackageInfo(packageName);
+        if (!info) {
+            return;
+        }
+        const latestVersion = info['dist-tags']?.latest;
+        if (!latestVersion) {
+            return;
+        }
+        versionCache[packageName] = latestVersion;
+        const updateType = getUpdateType(currentVersion, latestVersion);
+        const priority = config.priority[packageName] || 'normal';
+        results.push({
+            package: packageName,
+            currentVersion,
+            latestVersion,
+            updateType,
+            priority,
+            shouldAutoUpdate: shouldAutoUpdate(updateType, priority, config),
+        });
+    }));
+    // Record this check
+    recordCheck(versionCache);
+    // Filter to only updates available
+    const updates = results.filter((r) => r.updateType !== 'none');
+    return { results: updates, skipped: false };
+}
+export async function checkSinglePackage(packageName, config = DEFAULT_CONFIG) {
+    const currentVersion = getInstalledVersion(packageName);
+    if (!currentVersion) {
+        return null;
+    }
+    const info = await fetchPackageInfo(packageName);
+    if (!info) {
+        return null;
+    }
+    const latestVersion = info['dist-tags']?.latest;
+    if (!latestVersion) {
+        return null;
+    }
+    const updateType = getUpdateType(currentVersion, latestVersion);
+    const priority = config.priority[packageName] || 'normal';
+    return {
+        package: packageName,
+        currentVersion,
+        latestVersion,
+        updateType,
+        priority,
+        shouldAutoUpdate: shouldAutoUpdate(updateType, priority, config),
+    };
+}
+export { DEFAULT_CONFIG };
+//# sourceMappingURL=checker.js.map

package/dist/src/update/executor.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Update executor - performs actual package updates
+ * Includes rollback capability
+ */
+import { UpdateCheckResult } from './checker.js';
+import { ValidationResult } from './validator.js';
+export declare function isSafePackageSpec(pkg: string, version: string): boolean;
+export interface UpdateHistoryEntry {
+    timestamp: string;
+    package: string;
+    fromVersion: string;
+    toVersion: string;
+    success: boolean;
+    error?: string;
+    rollbackAvailable: boolean;
+}
+export interface UpdateExecutionResult {
+    success: boolean;
+    package: string;
+    version: string;
+    error?: string;
+    validation: ValidationResult;
+}
+export declare function loadHistory(): UpdateHistoryEntry[];
+export declare function executeUpdate(update: UpdateCheckResult, installedPackages: Record<string, string>, dryRun?: boolean): Promise<UpdateExecutionResult>;
+export declare function executeMultipleUpdates(updates: UpdateCheckResult[], installedPackages: Record<string, string>, dryRun?: boolean): Promise<UpdateExecutionResult[]>;
+export declare function rollbackUpdate(packageName?: string): Promise<{
+    success: boolean;
+    message: string;
+}>;
+export declare function getUpdateHistory(limit?: number): UpdateHistoryEntry[];
+export declare function clearHistory(): void;
+//# sourceMappingURL=executor.d.ts.map

package/dist/src/update/executor.js

@@ -0,0 +1,217 @@
+/**
+ * Update executor - performs actual package updates
+ * Includes rollback capability
+ */
+import { execFileSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { validateUpdate } from './validator.js';
+/**
+ * audit_1776853149979: package name and version come from npm-view output and
+ * the update-history.json file (writable by anyone with FS access). Both
+ * previously interpolated straight into a shell string for `npm install`.
+ * These regexes pre-flight values so a hostile package name can't slip
+ * shell metacharacters through, even though execFileSync below already
+ * eliminates the shell.
+ */
+// First char of the unscoped name forbids `-` to defang CLI-flag confusion
+// when the spec is passed to npm (npm install -evil@1.0.0 looks flag-shaped).
+const SAFE_PKG_RE = /^(@[a-zA-Z0-9_\-]+\/)?[a-zA-Z0-9_][a-zA-Z0-9_\-.]{0,213}$/;
+// semver / dist-tag / range chars only — no shell metas.
+const SAFE_VERSION_RE = /^[a-zA-Z0-9._\-+~^*xX]{1,64}$/;
+export function isSafePackageSpec(pkg, version) {
+    return SAFE_PKG_RE.test(pkg) && SAFE_VERSION_RE.test(version);
+}
+const HISTORY_FILE = path.join(os.homedir(), '.claude-flow', 'update-history.json');
+const MAX_HISTORY_ENTRIES = 100;
+function ensureDir() {
+    const dir = path.dirname(HISTORY_FILE);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+}
+export function loadHistory() {
+    try {
+        if (fs.existsSync(HISTORY_FILE)) {
+            const content = fs.readFileSync(HISTORY_FILE, 'utf-8');
+            return JSON.parse(content);
+        }
+    }
+    catch {
+        // Corrupted file
+    }
+    return [];
+}
+function saveHistory(history) {
+    ensureDir();
+    // Keep only last N entries
+    const trimmed = history.slice(-MAX_HISTORY_ENTRIES);
+    fs.writeFileSync(HISTORY_FILE, JSON.stringify(trimmed, null, 2));
+}
+function recordUpdate(entry) {
+    const history = loadHistory();
+    history.push(entry);
+    saveHistory(history);
+}
+export async function executeUpdate(update, installedPackages, dryRun = false) {
+    // Validate first
+    const validation = validateUpdate(update.package, update.currentVersion, update.latestVersion, installedPackages);
+    if (!validation.valid) {
+        return {
+            success: false,
+            package: update.package,
+            version: update.latestVersion,
+            error: `Validation failed: ${validation.incompatibilities.join(', ')}`,
+            validation,
+        };
+    }
+    if (dryRun) {
+        return {
+            success: true,
+            package: update.package,
+            version: update.latestVersion,
+            validation,
+        };
+    }
+    // audit_1776853149979: validate package + version regex before any exec.
+    if (!isSafePackageSpec(update.package, update.latestVersion)) {
+        return {
+            success: false,
+            package: update.package,
+            version: update.latestVersion,
+            error: `Refusing to install: package or version contains disallowed characters (pkg="${update.package}", version="${update.latestVersion}")`,
+            validation,
+        };
+    }
+    try {
+        // audit_1776853149979: switched to execFileSync('npm', argv) — no shell,
+        // so even if validation regressed, metas in update.package would stay
+        // literal in the argv slot.
+        execFileSync('npm', ['install', `${update.package}@${update.latestVersion}`, '--save-exact'], {
+            encoding: 'utf-8',
+            stdio: 'pipe',
+            timeout: 60000, // 1 minute timeout
+            shell: false,
+        });
+        // Record successful update
+        recordUpdate({
+            timestamp: new Date().toISOString(),
+            package: update.package,
+            fromVersion: update.currentVersion,
+            toVersion: update.latestVersion,
+            success: true,
+            rollbackAvailable: true,
+        });
+        return {
+            success: true,
+            package: update.package,
+            version: update.latestVersion,
+            validation,
+        };
+    }
+    catch (error) {
+        const err = error;
+        // Record failed update
+        recordUpdate({
+            timestamp: new Date().toISOString(),
+            package: update.package,
+            fromVersion: update.currentVersion,
+            toVersion: update.latestVersion,
+            success: false,
+            error: err.message,
+            rollbackAvailable: false,
+        });
+        return {
+            success: false,
+            package: update.package,
+            version: update.latestVersion,
+            error: err.message,
+            validation,
+        };
+    }
+}
+export async function executeMultipleUpdates(updates, installedPackages, dryRun = false) {
+    const results = [];
+    // Execute updates sequentially to avoid conflicts
+    for (const update of updates) {
+        const result = await executeUpdate(update, installedPackages, dryRun);
+        results.push(result);
+        // Update installed packages for next validation
+        if (result.success) {
+            installedPackages[update.package] = update.latestVersion;
+        }
+        // Stop on critical failures
+        if (!result.success && update.priority === 'critical') {
+            break;
+        }
+    }
+    return results;
+}
+export async function rollbackUpdate(packageName) {
+    const history = loadHistory();
+    if (history.length === 0) {
+        return { success: false, message: 'No update history available' };
+    }
+    // Find the last successful update for this package (or any if not specified)
+    const lastUpdate = packageName
+        ? history
+            .reverse()
+            .find((h) => h.package === packageName && h.success && h.rollbackAvailable)
+        : history.reverse().find((h) => h.success && h.rollbackAvailable);
+    if (!lastUpdate) {
+        return {
+            success: false,
+            message: packageName
+                ? `No rollback available for ${packageName}`
+                : 'No rollback available',
+        };
+    }
+    // audit_1776853149979: history entries can be tampered with by anyone who
+    // can write update-history.json — gate before exec.
+    if (!isSafePackageSpec(lastUpdate.package, lastUpdate.fromVersion)) {
+        return {
+            success: false,
+            message: `Refusing to rollback: package or version contains disallowed characters (pkg="${lastUpdate.package}", version="${lastUpdate.fromVersion}")`,
+        };
+    }
+    try {
+        // execFileSync, no shell.
+        execFileSync('npm', ['install', `${lastUpdate.package}@${lastUpdate.fromVersion}`, '--save-exact'], {
+            encoding: 'utf-8',
+            stdio: 'pipe',
+            timeout: 60000,
+            shell: false,
+        });
+        // Record the rollback
+        recordUpdate({
+            timestamp: new Date().toISOString(),
+            package: lastUpdate.package,
+            fromVersion: lastUpdate.toVersion,
+            toVersion: lastUpdate.fromVersion,
+            success: true,
+            rollbackAvailable: false, // Can't rollback a rollback
+        });
+        return {
+            success: true,
+            message: `Rolled back ${lastUpdate.package} from ${lastUpdate.toVersion} to ${lastUpdate.fromVersion}`,
+        };
+    }
+    catch (error) {
+        const err = error;
+        return {
+            success: false,
+            message: `Rollback failed: ${err.message}`,
+        };
+    }
+}
+export function getUpdateHistory(limit = 20) {
+    const history = loadHistory();
+    return history.slice(-limit).reverse();
+}
+export function clearHistory() {
+    if (fs.existsSync(HISTORY_FILE)) {
+        fs.unlinkSync(HISTORY_FILE);
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/src/update/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Auto-update system for @claude-flow packages
+ *
+ * Features:
+ * - Rate-limited update checks (24h default)
+ * - Automatic patch updates for security packages
+ * - Compatibility validation before updates
+ * - Rollback capability
+ * - Update history logging
+ */
+export { checkForUpdates, checkSinglePackage, getInstalledVersion, DEFAULT_CONFIG, } from './checker.js';
+export type { UpdateCheckResult, UpdateConfig } from './checker.js';
+export { shouldCheckForUpdates, recordCheck, getCachedVersions, clearCache, loadState, } from './rate-limiter.js';
+export type { RateLimitState } from './rate-limiter.js';
+export { validateUpdate, validateBulkUpdate } from './validator.js';
+export type { ValidationResult } from './validator.js';
+export { executeUpdate, executeMultipleUpdates, rollbackUpdate, getUpdateHistory, clearHistory, loadHistory, } from './executor.js';
+export type { UpdateHistoryEntry, UpdateExecutionResult } from './executor.js';
+import type { UpdateCheckResult } from './checker.js';
+/**
+ * Run auto-update check on startup
+ * This is the main entry point for the auto-update system
+ */
+export declare function runStartupUpdateCheck(options: {
+    verbose?: boolean;
+    autoUpdate?: boolean;
+}): Promise<{
+    checked: boolean;
+    updatesAvailable: UpdateCheckResult[];
+    updatesApplied: string[];
+    skippedReason?: string;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/update/index.js

@@ -0,0 +1,64 @@
+/**
+ * Auto-update system for @claude-flow packages
+ *
+ * Features:
+ * - Rate-limited update checks (24h default)
+ * - Automatic patch updates for security packages
+ * - Compatibility validation before updates
+ * - Rollback capability
+ * - Update history logging
+ */
+export { checkForUpdates, checkSinglePackage, getInstalledVersion, DEFAULT_CONFIG, } from './checker.js';
+export { shouldCheckForUpdates, recordCheck, getCachedVersions, clearCache, loadState, } from './rate-limiter.js';
+export { validateUpdate, validateBulkUpdate } from './validator.js';
+export { executeUpdate, executeMultipleUpdates, rollbackUpdate, getUpdateHistory, clearHistory, loadHistory, } from './executor.js';
+// Re-export a convenience function for startup
+import { checkForUpdates, DEFAULT_CONFIG } from './checker.js';
+import { executeMultipleUpdates } from './executor.js';
+import { getInstalledVersion } from './checker.js';
+/**
+ * Run auto-update check on startup
+ * This is the main entry point for the auto-update system
+ */
+export async function runStartupUpdateCheck(options) {
+    const result = {
+        checked: false,
+        updatesAvailable: [],
+        updatesApplied: [],
+        skippedReason: undefined,
+    };
+    try {
+        const { results, skipped, reason } = await checkForUpdates(DEFAULT_CONFIG);
+        if (skipped) {
+            result.skippedReason = reason;
+            return result;
+        }
+        result.checked = true;
+        result.updatesAvailable = results;
+        // Auto-update if enabled
+        if (options.autoUpdate !== false) {
+            const autoUpdateable = results.filter((r) => r.shouldAutoUpdate);
+            if (autoUpdateable.length > 0) {
+                // Get current installed packages
+                const installedPackages = {};
+                for (const update of autoUpdateable) {
+                    const version = getInstalledVersion(update.package);
+                    if (version) {
+                        installedPackages[update.package] = version;
+                    }
+                }
+                // Execute updates
+                const updateResults = await executeMultipleUpdates(autoUpdateable, installedPackages);
+                result.updatesApplied = updateResults
+                    .filter((r) => r.success)
+                    .map((r) => `${r.package}@${r.version}`);
+            }
+        }
+        return result;
+    }
+    catch {
+        // Silently fail on startup - don't block CLI usage
+        return result;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/src/update/rate-limiter.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Rate limiter for update checks
+ * Prevents excessive npm registry queries
+ */
+export interface RateLimitState {
+    lastCheck: string;
+    checksToday: number;
+    date: string;
+    packageVersions: Record<string, string>;
+}
+export declare function loadState(): RateLimitState;
+export declare function saveState(state: RateLimitState): void;
+export declare function shouldCheckForUpdates(intervalHours?: number): {
+    allowed: boolean;
+    reason?: string;
+};
+export declare function recordCheck(packageVersions: Record<string, string>): void;
+export declare function getCachedVersions(): Record<string, string>;
+export declare function clearCache(): void;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/src/update/rate-limiter.js

@@ -0,0 +1,96 @@
+/**
+ * Rate limiter for update checks
+ * Prevents excessive npm registry queries
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+const STATE_FILE = path.join(os.homedir(), '.claude-flow', 'update-state.json');
+const DEFAULT_INTERVAL_HOURS = 24;
+const MAX_CHECKS_PER_DAY = 10;
+function ensureDir() {
+    const dir = path.dirname(STATE_FILE);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+}
+function getDefaultState() {
+    return {
+        lastCheck: '',
+        checksToday: 0,
+        date: new Date().toISOString().split('T')[0],
+        packageVersions: {},
+    };
+}
+export function loadState() {
+    try {
+        if (fs.existsSync(STATE_FILE)) {
+            const content = fs.readFileSync(STATE_FILE, 'utf-8');
+            const state = JSON.parse(content);
+            // Reset counter if new day
+            const today = new Date().toISOString().split('T')[0];
+            if (state.date !== today) {
+                state.date = today;
+                state.checksToday = 0;
+            }
+            return state;
+        }
+    }
+    catch {
+        // Corrupted file, reset
+    }
+    return getDefaultState();
+}
+export function saveState(state) {
+    ensureDir();
+    fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+}
+export function shouldCheckForUpdates(intervalHours = DEFAULT_INTERVAL_HOURS) {
+    // Skip in CI environments
+    if (process.env.CI === 'true' || process.env.CONTINUOUS_INTEGRATION === 'true') {
+        return { allowed: false, reason: 'CI environment detected' };
+    }
+    // Skip if explicitly disabled
+    if (process.env.CLAUDE_FLOW_AUTO_UPDATE === 'false') {
+        return { allowed: false, reason: 'Auto-update disabled via environment' };
+    }
+    // Force update if requested
+    if (process.env.CLAUDE_FLOW_FORCE_UPDATE === 'true') {
+        return { allowed: true };
+    }
+    const state = loadState();
+    // Check daily limit
+    if (state.checksToday >= MAX_CHECKS_PER_DAY) {
+        return { allowed: false, reason: `Daily check limit (${MAX_CHECKS_PER_DAY}) reached` };
+    }
+    // Check time interval
+    if (state.lastCheck) {
+        const lastCheckTime = new Date(state.lastCheck).getTime();
+        const now = Date.now();
+        const hoursSinceLastCheck = (now - lastCheckTime) / (1000 * 60 * 60);
+        if (hoursSinceLastCheck < intervalHours) {
+            const nextCheck = Math.ceil(intervalHours - hoursSinceLastCheck);
+            return {
+                allowed: false,
+                reason: `Last check was ${Math.floor(hoursSinceLastCheck)}h ago (next check in ~${nextCheck}h)`
+            };
+        }
+    }
+    return { allowed: true };
+}
+export function recordCheck(packageVersions) {
+    const state = loadState();
+    state.lastCheck = new Date().toISOString();
+    state.checksToday += 1;
+    state.packageVersions = { ...state.packageVersions, ...packageVersions };
+    saveState(state);
+}
+export function getCachedVersions() {
+    return loadState().packageVersions;
+}
+export function clearCache() {
+    if (fs.existsSync(STATE_FILE)) {
+        fs.unlinkSync(STATE_FILE);
+    }
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/src/update/validator.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Package validator for update compatibility
+ * Ensures updates don't break the ecosystem
+ */
+export interface ValidationResult {
+    valid: boolean;
+    incompatibilities: string[];
+    warnings: string[];
+    requiredPeerUpdates: string[];
+}
+export declare function validateUpdate(packageName: string, fromVersion: string, toVersion: string, installedPackages: Record<string, string>): ValidationResult;
+export declare function validateBulkUpdate(updates: Array<{
+    package: string;
+    from: string;
+    to: string;
+}>, currentPackages: Record<string, string>): ValidationResult;
+//# sourceMappingURL=validator.d.ts.map