@claude-flow/cli 3.32.3 → 3.32.5

package/dist/src/auth/constants.js

@@ -0,0 +1,7 @@
+/**
+ * Shared ADR-306 constants — split out so `commands/auth.ts` and
+ * `auth/client.ts` reference the same keychain service name rather than two
+ * independently-typed string literals that could silently drift apart.
+ */
+export const KEYCHAIN_SERVICE = 'ruflo-cognitum-auth';
+//# sourceMappingURL=constants.js.map

package/dist/src/auth/scopes.d.ts

@@ -0,0 +1,14 @@
+/**
+ * ADR-306 scope <-> ADR-302 consent-domain mapping.
+ *
+ * The 5 ADR-306 scopes map 1:1 onto 5 `ConsentDomain` values that already
+ * exist in src/funnel/types.ts (pre-provisioned for exactly this purpose —
+ * see that file's own comments). No new consent machinery is needed; this
+ * module is just the lookup table ADR-306 describes but never names in code.
+ */
+import type { ConsentDomain } from '../funnel/index.js';
+export declare const SCOPE_TO_DOMAIN: Record<string, ConsentDomain>;
+export declare function domainForScope(scope: string): ConsentDomain | undefined;
+/** `login` always requests this scope only, on first run — ADR-306. */
+export declare const INITIAL_SCOPE = "account.create";
+//# sourceMappingURL=scopes.d.ts.map

package/dist/src/auth/scopes.js

@@ -0,0 +1,21 @@
+/**
+ * ADR-306 scope <-> ADR-302 consent-domain mapping.
+ *
+ * The 5 ADR-306 scopes map 1:1 onto 5 `ConsentDomain` values that already
+ * exist in src/funnel/types.ts (pre-provisioned for exactly this purpose —
+ * see that file's own comments). No new consent machinery is needed; this
+ * module is just the lookup table ADR-306 describes but never names in code.
+ */
+export const SCOPE_TO_DOMAIN = {
+    'account.create': 'account',
+    'proxy.use': 'proxy-install',
+    'cloud.route': 'cloud-routing',
+    'telemetry.write': 'telemetry',
+    'hosted.memory.use': 'hosted-memory',
+};
+export function domainForScope(scope) {
+    return SCOPE_TO_DOMAIN[scope];
+}
+/** `login` always requests this scope only, on first run — ADR-306. */
+export const INITIAL_SCOPE = 'account.create';
+//# sourceMappingURL=scopes.js.map

package/dist/src/auth/security-bridge.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Lazy loader for `@claude-flow/security`'s OAuth + keychain surface
+ * (ADR-306). `@claude-flow/security` is an `optionalDependency` of this
+ * package (see package.json) — `ruflo auth` is the one capability that
+ * genuinely cannot function without it, so this module's job is turning "the
+ * optional package failed to install" into one clear, actionable error
+ * instead of a raw `ERR_MODULE_NOT_FOUND` stack trace. Mirrors the
+ * lazy-`require`-in-try/catch idiom already used for this same package in
+ * src/mcp-client.ts's `applyContentBoundaryGuardrail`, but as an async
+ * dynamic `import()` (the security package is itself `"type": "module"`).
+ *
+ * Only `import type` is used for the package's real types below — type-only
+ * imports are fully erased at compile time and never touch the runtime
+ * module resolver, so this file type-checks whether or not the optional
+ * dependency happens to be installed in a given consumer's node_modules.
+ */
+import type { authorizeUrl as AuthorizeUrlFn, exchangeCode as ExchangeCodeFn, refreshToken as RefreshTokenFn, exchangeManualCode as ExchangeManualCodeFn, generatePkce as GeneratePkceFn, OAuthTokenResponse, PkceRequest, CallbackServer as CallbackServerClass, CallbackResult, openBrowser as OpenBrowserFn, createKeychainAdapter as CreateKeychainAdapterFn, KeychainAdapter, OAuthError as OAuthErrorClass } from '@claude-flow/security';
+export interface SecurityOAuthModule {
+    authorizeUrl: typeof AuthorizeUrlFn;
+    exchangeCode: typeof ExchangeCodeFn;
+    refreshToken: typeof RefreshTokenFn;
+    exchangeManualCode: typeof ExchangeManualCodeFn;
+    generatePkce: typeof GeneratePkceFn;
+    CallbackServer: typeof CallbackServerClass;
+    openBrowser: typeof OpenBrowserFn;
+    createKeychainAdapter: typeof CreateKeychainAdapterFn;
+    OAuthError: typeof OAuthErrorClass;
+    OOB_REDIRECT_URI: string;
+}
+export type { OAuthTokenResponse, PkceRequest, CallbackResult, KeychainAdapter };
+export declare class SecurityPackageMissingError extends Error {
+    constructor(cause: unknown);
+}
+/** Loads `@claude-flow/security`'s OAuth surface, throwing a clear error if it's absent. */
+export declare function loadSecurityOAuth(): Promise<SecurityOAuthModule>;
+//# sourceMappingURL=security-bridge.d.ts.map

package/dist/src/auth/security-bridge.js

@@ -0,0 +1,42 @@
+/**
+ * Lazy loader for `@claude-flow/security`'s OAuth + keychain surface
+ * (ADR-306). `@claude-flow/security` is an `optionalDependency` of this
+ * package (see package.json) — `ruflo auth` is the one capability that
+ * genuinely cannot function without it, so this module's job is turning "the
+ * optional package failed to install" into one clear, actionable error
+ * instead of a raw `ERR_MODULE_NOT_FOUND` stack trace. Mirrors the
+ * lazy-`require`-in-try/catch idiom already used for this same package in
+ * src/mcp-client.ts's `applyContentBoundaryGuardrail`, but as an async
+ * dynamic `import()` (the security package is itself `"type": "module"`).
+ *
+ * Only `import type` is used for the package's real types below — type-only
+ * imports are fully erased at compile time and never touch the runtime
+ * module resolver, so this file type-checks whether or not the optional
+ * dependency happens to be installed in a given consumer's node_modules.
+ */
+export class SecurityPackageMissingError extends Error {
+    constructor(cause) {
+        super("ruflo auth needs the '@claude-flow/security' package, which isn't installed " +
+            "(it's an optional dependency — install/reinstall failed or was skipped for this " +
+            `platform). Try: npm install @claude-flow/security. Underlying error: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = 'SecurityPackageMissingError';
+    }
+}
+let cached = null;
+/** Loads `@claude-flow/security`'s OAuth surface, throwing a clear error if it's absent. */
+export async function loadSecurityOAuth() {
+    if (cached)
+        return cached;
+    try {
+        const mod = (await import('@claude-flow/security'));
+        if (!mod.authorizeUrl || !mod.createKeychainAdapter) {
+            throw new Error('module loaded but is missing expected OAuth exports');
+        }
+        cached = mod;
+        return mod;
+    }
+    catch (e) {
+        throw new SecurityPackageMissingError(e);
+    }
+}
+//# sourceMappingURL=security-bridge.js.map

package/dist/src/auth/session.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Process-lifetime in-memory access-token cache (ADR-306).
+ *
+ * The access token is never written to `auth.json` or any other disk file —
+ * only the refresh token (via the OS keychain, or nowhere in session-only
+ * mode) survives a process exit. Every fresh `ruflo` invocation starts with
+ * an empty cache and re-derives an access token from the refresh token (or
+ * asks the user to log in again, in session-only mode). This is a deliberate
+ * ADR-306 usability cost, not something to "fix" by persisting the access
+ * token — see auth/types.ts's doc comment.
+ */
+export declare function setSessionToken(profile: string, accessToken: string, expiresAtMs: number): void;
+/**
+ * Returns the cached access token when it remains valid for at least
+ * `minValidityMs`. Authenticated callers use a small refresh window so a
+ * token cannot expire while an outbound request is in flight.
+ */
+export declare function getSessionToken(profile: string, minValidityMs?: number): string | null;
+export declare function clearSessionToken(profile: string): void;
+//# sourceMappingURL=session.d.ts.map

package/dist/src/auth/session.js

@@ -0,0 +1,32 @@
+/**
+ * Process-lifetime in-memory access-token cache (ADR-306).
+ *
+ * The access token is never written to `auth.json` or any other disk file —
+ * only the refresh token (via the OS keychain, or nowhere in session-only
+ * mode) survives a process exit. Every fresh `ruflo` invocation starts with
+ * an empty cache and re-derives an access token from the refresh token (or
+ * asks the user to log in again, in session-only mode). This is a deliberate
+ * ADR-306 usability cost, not something to "fix" by persisting the access
+ * token — see auth/types.ts's doc comment.
+ */
+const sessions = new Map();
+export function setSessionToken(profile, accessToken, expiresAtMs) {
+    sessions.set(profile, { accessToken, expiresAt: expiresAtMs });
+}
+/**
+ * Returns the cached access token when it remains valid for at least
+ * `minValidityMs`. Authenticated callers use a small refresh window so a
+ * token cannot expire while an outbound request is in flight.
+ */
+export function getSessionToken(profile, minValidityMs = 0) {
+    const entry = sessions.get(profile);
+    if (!entry)
+        return null;
+    if (Date.now() + Math.max(0, minValidityMs) >= entry.expiresAt)
+        return null;
+    return entry.accessToken;
+}
+export function clearSessionToken(profile) {
+    sessions.delete(profile);
+}
+//# sourceMappingURL=session.js.map

package/dist/src/auth/state.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `auth.json` persistence — atomic tmp+rename, 0600, under ~/.ruflo (ADR-306).
+ * Reuses the exact same primitives `proxy-config.toml`'s consent mirror and
+ * every other funnel state file already use (src/funnel/state.ts).
+ */
+import type { AuthFile, ProfileAuthState } from './types.js';
+export declare const DEFAULT_PROFILE = "default";
+export declare function readAuthFile(): AuthFile;
+export declare function getProfile(name?: string): ProfileAuthState | null;
+export declare function listProfiles(): {
+    defaultProfile: string;
+    profiles: ProfileAuthState[];
+};
+/** Writes/overwrites a profile. The first profile ever written becomes the default. */
+export declare function setProfile(name: string, state: ProfileAuthState, makeDefault?: boolean): void;
+export declare function removeProfile(name: string): boolean;
+/** `auth logout --all` — forgets every profile. */
+export declare function clearAllProfiles(): void;
+//# sourceMappingURL=state.d.ts.map

package/dist/src/auth/state.js

@@ -0,0 +1,53 @@
+/**
+ * `auth.json` persistence — atomic tmp+rename, 0600, under ~/.ruflo (ADR-306).
+ * Reuses the exact same primitives `proxy-config.toml`'s consent mirror and
+ * every other funnel state file already use (src/funnel/state.ts).
+ */
+import { readStateJson, writeStateJson, deleteStateFile } from '../funnel/state.js';
+const AUTH_FILE = 'auth.json';
+export const DEFAULT_PROFILE = 'default';
+function emptyAuthFile() {
+    return { schemaVersion: 1, defaultProfile: DEFAULT_PROFILE, profiles: {} };
+}
+export function readAuthFile() {
+    const file = readStateJson(AUTH_FILE);
+    return file ?? emptyAuthFile();
+}
+function writeAuthFile(file) {
+    writeStateJson(AUTH_FILE, file);
+}
+export function getProfile(name) {
+    const file = readAuthFile();
+    const key = name ?? file.defaultProfile;
+    return file.profiles[key] ?? null;
+}
+export function listProfiles() {
+    const file = readAuthFile();
+    return { defaultProfile: file.defaultProfile, profiles: Object.values(file.profiles) };
+}
+/** Writes/overwrites a profile. The first profile ever written becomes the default. */
+export function setProfile(name, state, makeDefault = false) {
+    const file = readAuthFile();
+    const isFirst = Object.keys(file.profiles).length === 0;
+    file.profiles[name] = state;
+    if (makeDefault || isFirst)
+        file.defaultProfile = name;
+    writeAuthFile(file);
+}
+export function removeProfile(name) {
+    const file = readAuthFile();
+    if (!(name in file.profiles))
+        return false;
+    delete file.profiles[name];
+    if (file.defaultProfile === name) {
+        const remaining = Object.keys(file.profiles);
+        file.defaultProfile = remaining[0] ?? DEFAULT_PROFILE;
+    }
+    writeAuthFile(file);
+    return true;
+}
+/** `auth logout --all` — forgets every profile. */
+export function clearAllProfiles() {
+    deleteStateFile(AUTH_FILE);
+}
+//# sourceMappingURL=state.js.map

package/dist/src/auth/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `ruflo auth` state shapes (ADR-306).
+ *
+ * `auth.json` holds identity metadata ONLY — never token material. The
+ * access token lives exclusively in a process-lifetime in-memory singleton
+ * (session.ts); the refresh token goes to the OS keychain (keychainRef set)
+ * or nowhere at all when no keychain backend is reachable (keychainRef:
+ * null — session-only mode, ADR-306's accepted usability cost, not a bug).
+ */
+export interface ProfileAuthState {
+    accountId: string;
+    scopes: string[];
+    /** ISO timestamp — the access token's own expiry, not tracked beyond this. */
+    accessTokenExpiresAt: string;
+    /** OS-keychain account identifier for this profile's refresh token, or null if session-only. */
+    keychainRef: string | null;
+    profile: string;
+    loginMethod: 'pkce' | 'device' | 'token-stdin';
+    /** ISO timestamp of the login that created/last-refreshed this profile. */
+    linkedAt: string;
+}
+export interface AuthFile {
+    schemaVersion: 1;
+    defaultProfile: string;
+    profiles: Record<string, ProfileAuthState>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/auth/types.js

@@ -0,0 +1,11 @@
+/**
+ * `ruflo auth` state shapes (ADR-306).
+ *
+ * `auth.json` holds identity metadata ONLY — never token material. The
+ * access token lives exclusively in a process-lifetime in-memory singleton
+ * (session.ts); the refresh token goes to the OS keychain (keychainRef set)
+ * or nowhere at all when no keychain backend is reachable (keychainRef:
+ * null — session-only mode, ADR-306's accepted usability cost, not a bug).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/autopilot-state.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Autopilot Shared State Module
+ *
+ * Centralizes state management, validation, and task discovery
+ * for both CLI command and MCP tools. Eliminates code duplication.
+ *
+ * ADR-072: Autopilot Integration
+ * Security: Addresses prototype pollution, NaN bypass, input validation
+ */
+export declare const STATE_DIR = ".claude-flow/data";
+export declare const STATE_FILE = ".claude-flow/data/autopilot-state.json";
+export declare const LOG_FILE = ".claude-flow/data/autopilot-log.json";
+/** Allowlist for valid task sources */
+export declare const VALID_TASK_SOURCES: Set<string>;
+/** Terminal task statuses */
+export declare const TERMINAL_STATUSES: Set<string>;
+export interface AutopilotState {
+    sessionId: string;
+    enabled: boolean;
+    startTime: number;
+    iterations: number;
+    maxIterations: number;
+    timeoutMinutes: number;
+    taskSources: string[];
+    lastCheck: number | null;
+    history: Array<{
+        ts: number;
+        iteration: number;
+        completed: number;
+        total: number;
+    }>;
+}
+export interface AutopilotLogEntry {
+    ts: number;
+    event: string;
+    [key: string]: unknown;
+}
+export interface TaskInfo {
+    id: string;
+    subject: string;
+    status: string;
+    source: string;
+}
+export interface TaskProgress {
+    completed: number;
+    total: number;
+    percent: number;
+    incomplete: TaskInfo[];
+}
+/**
+ * Safe JSON.parse that prevents prototype pollution.
+ */
+export declare function safeJsonParse<T>(raw: string): T;
+/**
+ * Validate and coerce a numeric parameter. Returns the default if
+ * the input is NaN, undefined, or outside the allowed range.
+ */
+export declare function validateNumber(value: unknown, min: number, max: number, defaultValue: number): number;
+/**
+ * Validate task sources against the allowlist.
+ * Returns only valid sources; falls back to defaults if none are valid.
+ */
+export declare function validateTaskSources(sources: unknown): string[];
+export declare function getDefaultState(): AutopilotState;
+export declare function loadState(): AutopilotState;
+export declare function saveState(state: AutopilotState): void;
+export declare function appendLog(entry: AutopilotLogEntry): void;
+export declare function loadLog(): AutopilotLogEntry[];
+export declare function discoverTasks(sources: string[]): TaskInfo[];
+export declare function isTerminal(status: string): boolean;
+export declare function getProgress(tasks: TaskInfo[]): TaskProgress;
+export declare function calculateReward(iterations: number, durationMs: number): number;
+export declare function tryLoadLearning(): Promise<{
+    initialize: () => Promise<boolean>;
+    [key: string]: unknown;
+} | null>;
+//# sourceMappingURL=autopilot-state.d.ts.map

package/dist/src/autopilot-state.js

@@ -0,0 +1,271 @@
+/**
+ * Autopilot Shared State Module
+ *
+ * Centralizes state management, validation, and task discovery
+ * for both CLI command and MCP tools. Eliminates code duplication.
+ *
+ * ADR-072: Autopilot Integration
+ * Security: Addresses prototype pollution, NaN bypass, input validation
+ */
+import { randomUUID } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, renameSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { homedir } from 'node:os';
+// ── Constants ─────────────────────────────────────────────────
+export const STATE_DIR = '.claude-flow/data';
+export const STATE_FILE = `${STATE_DIR}/autopilot-state.json`;
+export const LOG_FILE = `${STATE_DIR}/autopilot-log.json`;
+/** Maximum entries kept in state.history (prevents unbounded growth) */
+const MAX_HISTORY_ENTRIES = 50;
+/** Maximum entries kept in the event log */
+const MAX_LOG_ENTRIES = 1000;
+/** Allowlist for valid task sources */
+export const VALID_TASK_SOURCES = new Set(['team-tasks', 'swarm-tasks', 'file-checklist']);
+/** Terminal task statuses */
+export const TERMINAL_STATUSES = new Set(['completed', 'done', 'cancelled', 'skipped', 'failed']);
+// ── Validation Helpers ────────────────────────────────────────
+/**
+ * Sanitize a parsed JSON object to prevent prototype pollution.
+ * Removes __proto__, constructor, and prototype keys recursively.
+ */
+function sanitizeObject(obj) {
+    if (obj === null || typeof obj !== 'object')
+        return obj;
+    if (Array.isArray(obj))
+        return obj.map(sanitizeObject);
+    const clean = {};
+    for (const key of Object.keys(obj)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
+        clean[key] = sanitizeObject(obj[key]);
+    }
+    return clean;
+}
+/**
+ * Safe JSON.parse that prevents prototype pollution.
+ */
+export function safeJsonParse(raw) {
+    return sanitizeObject(JSON.parse(raw));
+}
+/**
+ * Validate and coerce a numeric parameter. Returns the default if
+ * the input is NaN, undefined, or outside the allowed range.
+ */
+export function validateNumber(value, min, max, defaultValue) {
+    if (value === undefined || value === null)
+        return defaultValue;
+    const num = Number(value);
+    if (!Number.isFinite(num))
+        return defaultValue;
+    return Math.min(Math.max(min, Math.round(num)), max);
+}
+/**
+ * Validate task sources against the allowlist.
+ * Returns only valid sources; falls back to defaults if none are valid.
+ */
+export function validateTaskSources(sources) {
+    const defaults = ['team-tasks', 'swarm-tasks', 'file-checklist'];
+    if (!Array.isArray(sources))
+        return defaults;
+    const valid = sources
+        .filter((s) => typeof s === 'string')
+        .map(s => s.trim())
+        .filter(s => VALID_TASK_SOURCES.has(s));
+    return valid.length > 0 ? valid : defaults;
+}
+// ── State Management ──────────────────────────────────────────
+export function getDefaultState() {
+    return {
+        sessionId: randomUUID(),
+        enabled: false,
+        startTime: Date.now(),
+        iterations: 0,
+        maxIterations: 50,
+        timeoutMinutes: 240,
+        taskSources: ['team-tasks', 'swarm-tasks', 'file-checklist'],
+        lastCheck: null,
+        history: [],
+    };
+}
+export function loadState() {
+    const filePath = resolve(STATE_FILE);
+    const defaults = getDefaultState();
+    try {
+        if (existsSync(filePath)) {
+            const raw = safeJsonParse(readFileSync(filePath, 'utf-8'));
+            const merged = { ...defaults, ...raw };
+            // Re-validate fields that could be tampered with
+            merged.maxIterations = validateNumber(merged.maxIterations, 1, 1000, 50);
+            merged.timeoutMinutes = validateNumber(merged.timeoutMinutes, 1, 1440, 240);
+            merged.iterations = validateNumber(merged.iterations, 0, 1000, 0);
+            merged.taskSources = validateTaskSources(merged.taskSources);
+            // Cap history to prevent unbounded growth
+            if (Array.isArray(merged.history) && merged.history.length > MAX_HISTORY_ENTRIES) {
+                merged.history = merged.history.slice(-MAX_HISTORY_ENTRIES);
+            }
+            return merged;
+        }
+    }
+    catch {
+        // Corrupted state file — return defaults
+    }
+    return defaults;
+}
+export function saveState(state) {
+    const dir = resolve(STATE_DIR);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    // Cap history before saving
+    if (state.history.length > MAX_HISTORY_ENTRIES) {
+        state.history = state.history.slice(-MAX_HISTORY_ENTRIES);
+    }
+    const tmpFile = resolve(STATE_FILE) + '.tmp';
+    writeFileSync(tmpFile, JSON.stringify(state, null, 2));
+    renameSync(tmpFile, resolve(STATE_FILE));
+}
+export function appendLog(entry) {
+    const filePath = resolve(LOG_FILE);
+    const dir = resolve(STATE_DIR);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    let log = [];
+    try {
+        if (existsSync(filePath)) {
+            log = safeJsonParse(readFileSync(filePath, 'utf-8'));
+            if (!Array.isArray(log))
+                log = [];
+        }
+    }
+    catch {
+        log = [];
+    }
+    log.push(entry);
+    if (log.length > MAX_LOG_ENTRIES)
+        log = log.slice(-MAX_LOG_ENTRIES);
+    const tmpFile = filePath + '.tmp';
+    writeFileSync(tmpFile, JSON.stringify(log, null, 2));
+    renameSync(tmpFile, filePath);
+}
+export function loadLog() {
+    const filePath = resolve(LOG_FILE);
+    try {
+        if (existsSync(filePath)) {
+            const result = safeJsonParse(readFileSync(filePath, 'utf-8'));
+            return Array.isArray(result) ? result : [];
+        }
+    }
+    catch {
+        // Corrupted log — return empty
+    }
+    return [];
+}
+// ── Task Discovery ────────────────────────────────────────────
+export function discoverTasks(sources) {
+    const tasks = [];
+    // Only process valid sources
+    const validSources = sources.filter(s => VALID_TASK_SOURCES.has(s));
+    for (const source of validSources) {
+        if (source === 'team-tasks') {
+            const tasksDir = join(homedir(), '.claude', 'tasks');
+            try {
+                if (existsSync(tasksDir)) {
+                    const teams = readdirSync(tasksDir, { withFileTypes: true });
+                    for (const team of teams) {
+                        if (!team.isDirectory())
+                            continue;
+                        const teamDir = join(tasksDir, team.name);
+                        const files = readdirSync(teamDir).filter((f) => f.endsWith('.json'));
+                        for (const file of files) {
+                            try {
+                                const data = safeJsonParse(readFileSync(join(teamDir, file), 'utf-8'));
+                                tasks.push({
+                                    id: String(data.id || file.replace('.json', '')),
+                                    subject: String(data.subject || data.title || file),
+                                    status: String(data.status || 'unknown'),
+                                    source: 'team-tasks',
+                                });
+                            }
+                            catch { /* skip individual file */ }
+                        }
+                    }
+                }
+            }
+            catch { /* skip source */ }
+        }
+        if (source === 'swarm-tasks') {
+            const swarmFile = resolve('.claude-flow/swarm-tasks.json');
+            try {
+                if (existsSync(swarmFile)) {
+                    const data = safeJsonParse(readFileSync(swarmFile, 'utf-8'));
+                    const swarmTasks = Array.isArray(data) ? data : (data.tasks || []);
+                    for (const t of swarmTasks) {
+                        if (t && typeof t === 'object') {
+                            const task = t;
+                            tasks.push({
+                                id: String(task.id || task.taskId || `swarm-${tasks.length}`),
+                                subject: String(task.subject || task.description || task.name || 'Unnamed task'),
+                                status: String(task.status || 'unknown'),
+                                source: 'swarm-tasks',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip source */ }
+        }
+        if (source === 'file-checklist') {
+            const checklistFile = resolve('.claude-flow/data/checklist.json');
+            try {
+                if (existsSync(checklistFile)) {
+                    const data = safeJsonParse(readFileSync(checklistFile, 'utf-8'));
+                    const items = Array.isArray(data) ? data : (data.items || []);
+                    for (const item of items) {
+                        if (item && typeof item === 'object') {
+                            const i = item;
+                            tasks.push({
+                                id: String(i.id || `check-${tasks.length}`),
+                                subject: String(i.subject || i.text || i.description || 'Unnamed item'),
+                                status: String(i.status || (i.done ? 'completed' : 'pending')),
+                                source: 'file-checklist',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip source */ }
+        }
+    }
+    return tasks;
+}
+// ── Progress Helpers ──────────────────────────────────────────
+export function isTerminal(status) {
+    return TERMINAL_STATUSES.has(status.toLowerCase());
+}
+export function getProgress(tasks) {
+    const completed = tasks.filter(t => isTerminal(t.status)).length;
+    const total = tasks.length;
+    const percent = total === 0 ? 100 : Math.round((completed / total) * 100);
+    const incomplete = tasks.filter(t => !isTerminal(t.status));
+    return { completed, total, percent, incomplete };
+}
+// ── Reward Calculation ────────────────────────────────────────
+export function calculateReward(iterations, durationMs) {
+    const iterFactor = (1 - iterations / (iterations + 10)) * 0.6;
+    const timeFactor = (1 - Math.min(durationMs / 3600000, 1)) * 0.4;
+    return Math.round((iterFactor + timeFactor) * 100) / 100;
+}
+// ── Learning Integration ──────────────────────────────────────
+export async function tryLoadLearning() {
+    try {
+        const modPath = 'agentic-flow/dist/coordination/autopilot-learning.js';
+        const mod = await import(/* webpackIgnore: true */ modPath).catch(() => null);
+        if (mod?.AutopilotLearning) {
+            const instance = new mod.AutopilotLearning();
+            if (await instance.initialize())
+                return instance;
+        }
+    }
+    catch { /* not available */ }
+    return null;
+}
+//# sourceMappingURL=autopilot-state.js.map

package/dist/src/benchmarks/gaia-agent-planning.smoke.d.ts

@@ -0,0 +1,18 @@
+/**
+ * GAIA Agent — Planning Interval Smoke Tests
+ *
+ * Verifies that the planning-checkpoint injection logic fires at the correct
+ * turns and stays silent when conditions are not met.  All tests are fully
+ * mocked — no live Anthropic API calls, $0 cost.
+ *
+ * Test cases:
+ *   1. 12-turn loop with interval=4 → replans at turns 4, 8, 12  (3 replans)
+ *   2.  3-turn loop with interval=4 → NO replan (interval never hit)
+ *   3. end_turn at turn 5          → NO replan injected (terminal state)
+ *   4. all-tool_use 8-turn loop    → exactly floor(8/4) = 2 replans
+ *   5. planningInterval=0          → disabled entirely, 0 replans
+ *
+ * Refs: ADR-133, ADR-135, iter 34, #2156
+ */
+export {};
+//# sourceMappingURL=gaia-agent-planning.smoke.d.ts.map