@claude-flow/cli 3.32.37 → 3.32.38

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.32.37",
+    "version": "3.32.38",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
@@ -8,6 +8,6 @@
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "4aXDfffQBBhj8kE+NJo5s/G4exfj/xdhqCwWIJxyGijINFL2GleKUam1oIYH9iyDeAZ1FKWrFAUzZ2WNEwMCDg==",
+  "signature": "TIaAcMVhpk+ezMRAJCOA7NQlvIznNqICVsJOiEDnW0Xqpxg1Zr3/RM2VlHaMqN7kaOiDf8sdus0R7b+mwFjUAg==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 4,
-  "generatedAt": "2026-07-29T19:40:17.000Z",
-  "gitSha": "401e02d5",
+  "generatedAt": "2026-07-29T19:50:37.000Z",
+  "gitSha": "ad8d071d",
   "catalog": {
     "agents": 164,
     "tools": 397,

package/dist/src/services/daemon-autostart.d.ts

@@ -1,5 +1,14 @@
 /** True if a live daemon already holds the project's pidfile. */
 export declare function isDaemonAlive(projectRoot: string): boolean;
+/**
+ * Return true only when the directory contains a durable Ruflo project marker.
+ *
+ * A bare `.claude/` is owned by Claude Code, and a bare `.claude-flow/` is not
+ * sufficient either: startup-time policy/champion migration can create it
+ * before this function runs. Treating that mutation as authorization caused a
+ * read-only command in any Claude project to spawn a detached daemon (#2852).
+ */
+export declare function isRufloProject(projectRoot: string): boolean;
 export interface EnsureResult {
     started: boolean;
     reason?: string;

package/dist/src/services/daemon-autostart.js

@@ -68,6 +68,43 @@ function autostartDisabled(projectRoot) {
         return true;
     return autostartDisabledByProjectConfig(projectRoot);
 }
+/**
+ * Return true only when the directory contains a durable Ruflo project marker.
+ *
+ * A bare `.claude/` is owned by Claude Code, and a bare `.claude-flow/` is not
+ * sufficient either: startup-time policy/champion migration can create it
+ * before this function runs. Treating that mutation as authorization caused a
+ * read-only command in any Claude project to spawn a detached daemon (#2852).
+ */
+export function isRufloProject(projectRoot) {
+    const root = path.resolve(projectRoot);
+    const directMarkers = [
+        path.join(root, '.claude-flow', 'config.yaml'),
+        path.join(root, '.claude-flow', 'config.yml'),
+        path.join(root, '.claude-flow', 'config.json'),
+        path.join(root, 'claude-flow.config.json'),
+        path.join(root, '.swarm', 'memory.db'),
+    ];
+    if (directMarkers.some((marker) => fs.existsSync(marker)))
+        return true;
+    try {
+        const settings = JSON.parse(fs.readFileSync(path.join(root, '.claude', 'settings.json'), 'utf-8'));
+        if (settings && typeof settings === 'object' && 'claudeFlow' in settings) {
+            return true;
+        }
+    }
+    catch { /* absent/malformed/non-Ruflo settings */ }
+    try {
+        const mcp = JSON.parse(fs.readFileSync(path.join(root, '.mcp.json'), 'utf-8'));
+        const servers = mcp?.mcpServers;
+        if (servers && typeof servers === 'object'
+            && ('ruflo' in servers || 'claude-flow' in servers)) {
+            return true;
+        }
+    }
+    catch { /* absent/malformed/non-Ruflo MCP config */ }
+    return false;
+}
 const defaultSpawn = (projectRoot) => {
     const cliBin = process.argv[1]; // the running bin/cli.js
     const child = spawn(process.execPath, [cliBin, 'daemon', 'start', '--quiet'], {
@@ -86,10 +123,7 @@ export function ensureDaemonRunning(projectRoot, opts = {}) {
     try {
         if (autostartDisabled(projectRoot))
             return { started: false, reason: 'disabled (RUFLO_DAEMON_AUTOSTART=0 or project config)' };
-        // `.claude/` belongs to Claude Code and is present in many repositories
-        // that have never initialized Ruflo. Only Ruflo's own state directory is
-        // an authorization signal for spawning a detached background process.
-        if (!fs.existsSync(path.join(projectRoot, '.claude-flow'))) {
+        if (!isRufloProject(projectRoot)) {
             return { started: false, reason: 'not a ruflo project' };
         }
         const alive = (opts.isAlive ?? isDaemonAlive)(projectRoot);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.37",
+  "version": "3.32.38",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",