@claude-flow/cli 3.32.35 → 3.32.37

package/plugins/ruflo-metaharness/scripts/test-similarity.mjs

@@ -26,6 +26,7 @@ import {
 } from './_similarity.mjs';
 // iter 64 — also test the iter-63 shared severity primitives
 import { SEVERITY_RANK, rankSeverity, parseMcpScanText } from './_harness.mjs';
+import { parseTrailingJson } from './_invoke.mjs';
 
 const ARGS = (() => {
   const a = { format: 'table' };
@@ -273,6 +274,22 @@ assert(single.summary?.overallSeverity === 'info',
 assert(single.summary?.totalCount === 1,
   'summary.totalCount === 1 from "(1 finding,"');
 
+// Newer metaharness releases align severity labels to a fixed-width column.
+// Keep parsing the legacy compact form above while accepting `[LOW ]`.
+const padded = parseMcpScanText(`harness mcp-scan — /repo
+
+  [LOW ] 8 unpinned dependency range(s)
+         Floating ranges weaken supply-chain reproducibility.
+
+Result: LOW (1 finding, 0 high)
+`);
+assert(padded.findings.length === 1, 'padded [LOW ] block → 1 finding');
+assert(padded.findings[0].severity === 'low',
+  'padded severity lowercased without trailing whitespace');
+assert(padded.findings[0].message.includes('8 unpinned dependency range(s)') &&
+       padded.findings[0].message.includes('supply-chain reproducibility'),
+  'padded finding message and continuation extracted');
+
 // Continuation line — indented text appends to previous finding
 const cont = parseMcpScanText(`
   [HIGH] Exposed credential path
@@ -314,6 +331,27 @@ assert(mixed.findings.length === 1,
 assert(mixed.findings[0].severity === 'high',
   'strict regex captured the uppercase entry');
 
+console.log('\nPhase 11 — complete trailing JSON extraction');
+
+const nestedJson = parseTrailingJson(`progress: scanning {not-json}
+{
+  "dir": "/repo",
+  "findings": [
+    { "id": "allow-shell", "severity": "high" },
+    { "id": "no-audit-log", "severity": "medium" }
+  ],
+  "worst": "high"
+}
+`);
+assert(nestedJson?.dir === '/repo', 'mixed stdout returns root JSON object');
+assert(nestedJson?.findings?.length === 2,
+  'nested findings remain attached to root payload');
+assert(nestedJson?.findings?.[1]?.id === 'no-audit-log',
+  'extractor does not return the last nested object');
+assert(nestedJson?.worst === 'high', 'root-level severity is preserved');
+assert(parseTrailingJson('progress only {not-json}') === null,
+  'non-JSON progress braces return null');
+
 // ──────────────────────────────────────────────────────────────────
 const summary = {
   passed, failed,

package/plugins/ruflo-metaharness/scripts/threat-model.mjs

@@ -26,7 +26,10 @@ function main() {
   }
   const r = runHarness(['threat-model', ARGS.path]);
   if (r.degraded) { emitDegradedJsonAndExit(r.reason); return; }
-  if (r.exitCode !== 0 && r.exitCode !== 1) {
+  // Upstream uses exit 2 for a valid HIGH verdict. A parsed JSON payload is
+  // authoritative regardless of that domain exit code; only reject a
+  // non-zero invocation when it produced no structured result.
+  if (!r.json && r.exitCode !== 0 && r.exitCode !== 1) {
     console.error(`threat-model: harness exited ${r.exitCode}`);
     if (r.stderr) console.error(r.stderr.slice(0, 400));
     process.exit(2);

package/plugins/ruflo-metaharness/skills/harness-genome/SKILL.md

@@ -17,8 +17,11 @@ Implementation: [`scripts/genome.mjs`](../../scripts/genome.mjs).
 1. Shell out to `npx metaharness genome <path> --json` (60s hard timeout).
 2. Parse the shape: `{ repo_type, agent_topology[], risk_score,
    mcp_surface, test_confidence, publish_readiness }`.
-3. If `--alert-on-risk-above N`: exit 1 when `risk_score > N`.
-4. Output JSON (default) or markdown.
+3. Preserve upstream's readiness verdict as `verdict` and
+   `verdictExitCode`. Upstream exits 1 for `needs-work` and 2 for `blocked`;
+   these are valid reports, so the wrapper returns them successfully.
+4. If `--alert-on-risk-above N`: exit 1 when `risk_score > N`.
+5. Output JSON (default) or markdown.
 
 ## Phase-0 baseline (ruflo, measured 2026-06-16)