@claude-flow/cli 3.32.9 → 3.32.10

package/plugins/ruflo-metaharness/scripts/learn.mjs

@@ -1,127 +1,127 @@
-#!/usr/bin/env node
-// learn.mjs — wrapper around `metaharness learn` (upstream ADR-235, metaharness@0.3.0).
-//
-// GEPA learning run: optimizes a harness genome against a SWE-bench-style
-// slice manifest. $0 DRY-RUN BY DEFAULT — upstream only spends (model calls,
-// Docker sandboxes) when --run is passed, and we forward that flag verbatim
-// so the spend opt-in stays explicit at every layer.
-//
-// CHECKOUT PRECONDITION (upstream design, not a bug)
-// ==================================================
-// The learning harness (GEPA + SWE-bench + Docker) is too heavy to ship in
-// the npm package, so `metaharness learn` requires a local clone of the
-// metaharness repo, located via $METAHARNESS_REPO or by running inside the
-// clone. When the checkout is absent we emit a structured
-// `{status: "checkout-required"}` payload and exit 0 — the script ran as
-// designed and told the agent what to do next. This is distinct from
-// `degraded: true` (npm package absent). The managed-service path (gateway-
-// side learn jobs, no checkout) is upstream's ADR-235 follow-up.
-//
-// USAGE
-//   node scripts/learn.mjs --host claude-code --model haiku --slice slices/lite.json
-//   node scripts/learn.mjs --repo ~/src/metaharness --host codex --model gpt-5-mini --slice s.json --run
-//
-// EXIT CODES
-//   0  learn completed (or dry-run report, or degraded, or checkout-required)
-//   1  --alert-on-fail and the learn run reported failure
-//   2  config error (bad arg)
-
-import { existsSync } from 'node:fs';
-import { runMetaharnessAsync, emitDegradedJsonAndExit } from './_harness.mjs';
-
-const ARGS = (() => {
-  const a = {
-    host: null,
-    model: null,
-    slice: null,
-    repo: null,
-    run: false,
-    alertOnFail: false,
-    format: 'json',
-    timeoutMs: null,
-  };
-  for (let i = 2; i < process.argv.length; i++) {
-    const v = process.argv[i];
-    if (v === '--host') a.host = process.argv[++i];
-    else if (v === '--model') a.model = process.argv[++i];
-    else if (v === '--slice') a.slice = process.argv[++i];
-    else if (v === '--repo') a.repo = process.argv[++i];
-    else if (v === '--run') a.run = true;
-    else if (v === '--alert-on-fail') a.alertOnFail = true;
-    else if (v === '--format') a.format = process.argv[++i];
-    else if (v === '--timeout-ms') a.timeoutMs = parseInt(process.argv[++i], 10);
-  }
-  return a;
-})();
-
-const CHECKOUT_RX = /requires a metaharness repo checkout/i;
-
-function defaultTimeoutMs() {
-  // Dry-run resolves the slice manifest + prices the run without spending —
-  // bounded by repo scan, not model calls. Real runs (--run) are dominated
-  // by model calls × slice size; callers should pass --timeout-ms matched
-  // to their slice. 10 min is a floor for small slices, not a budget.
-  return ARGS.run ? 600_000 : 120_000;
-}
-
-async function main() {
-  if (ARGS.repo && !existsSync(ARGS.repo)) {
-    console.error(`learn: --repo path does not exist: ${ARGS.repo}`);
-    process.exit(2);
-  }
-
-  const cliArgs = ['learn'];
-  if (ARGS.host) cliArgs.push('--host', ARGS.host);
-  if (ARGS.model) cliArgs.push('--model', ARGS.model);
-  if (ARGS.slice) cliArgs.push('--slice', ARGS.slice);
-  if (ARGS.run) cliArgs.push('--run');
-
-  const r = await runMetaharnessAsync(cliArgs, {
-    // learn emits a human-readable report; --json support is not guaranteed
-    // across 0.3.x, so we don't inject it and parse leniently instead.
-    json: false,
-    timeoutMs: ARGS.timeoutMs ?? defaultTimeoutMs(),
-    env: ARGS.repo ? { METAHARNESS_REPO: ARGS.repo } : {},
-  });
-
-  if (r.degraded) emitDegradedJsonAndExit(r.reason);
-
-  const combined = `${r.stdout}\n${r.stderr}`;
-  if (CHECKOUT_RX.test(combined)) {
-    console.log(JSON.stringify({
-      status: 'checkout-required',
-      hint: 'git clone https://github.com/ruvnet/metaharness.git, then re-run with '
-        + '--repo /path/to/metaharness (or set METAHARNESS_REPO). The learning '
-        + 'harness (GEPA + SWE-bench + Docker) is not shipped in the npm package.',
-      dryRun: !ARGS.run,
-      durationMs: r.durationMs,
-    }, null, 2));
-    process.exit(0);
-  }
-
-  // Lenient JSON extraction — grab the last {...} block if one exists.
-  let json = null;
-  const matches = [...r.stdout.matchAll(/\{[\s\S]*?\}/g)];
-  for (let i = matches.length - 1; i >= 0; i--) {
-    try { json = JSON.parse(matches[i][0]); break; } catch { /* try previous */ }
-  }
-
-  const out = {
-    status: r.exitCode === 0 ? 'ok' : 'failed',
-    dryRun: !ARGS.run,
-    exitCode: r.exitCode,
-    report: json,
-    // When upstream emits no JSON, the raw report is still the deliverable.
-    rawReport: json ? undefined : r.stdout.slice(0, 20_000),
-    durationMs: r.durationMs,
-  };
-  console.log(JSON.stringify(out, null, 2));
-
-  if (ARGS.alertOnFail && r.exitCode !== 0) process.exit(1);
-  process.exit(0);
-}
-
-main().catch((e) => {
-  console.error(`learn: ${e?.message ?? e}`);
-  process.exit(2);
-});
+#!/usr/bin/env node
+// learn.mjs — wrapper around `metaharness learn` (upstream ADR-235, metaharness@0.3.0).
+//
+// GEPA learning run: optimizes a harness genome against a SWE-bench-style
+// slice manifest. $0 DRY-RUN BY DEFAULT — upstream only spends (model calls,
+// Docker sandboxes) when --run is passed, and we forward that flag verbatim
+// so the spend opt-in stays explicit at every layer.
+//
+// CHECKOUT PRECONDITION (upstream design, not a bug)
+// ==================================================
+// The learning harness (GEPA + SWE-bench + Docker) is too heavy to ship in
+// the npm package, so `metaharness learn` requires a local clone of the
+// metaharness repo, located via $METAHARNESS_REPO or by running inside the
+// clone. When the checkout is absent we emit a structured
+// `{status: "checkout-required"}` payload and exit 0 — the script ran as
+// designed and told the agent what to do next. This is distinct from
+// `degraded: true` (npm package absent). The managed-service path (gateway-
+// side learn jobs, no checkout) is upstream's ADR-235 follow-up.
+//
+// USAGE
+//   node scripts/learn.mjs --host claude-code --model haiku --slice slices/lite.json
+//   node scripts/learn.mjs --repo ~/src/metaharness --host codex --model gpt-5-mini --slice s.json --run
+//
+// EXIT CODES
+//   0  learn completed (or dry-run report, or degraded, or checkout-required)
+//   1  --alert-on-fail and the learn run reported failure
+//   2  config error (bad arg)
+
+import { existsSync } from 'node:fs';
+import { runMetaharnessAsync, emitDegradedJsonAndExit } from './_harness.mjs';
+
+const ARGS = (() => {
+  const a = {
+    host: null,
+    model: null,
+    slice: null,
+    repo: null,
+    run: false,
+    alertOnFail: false,
+    format: 'json',
+    timeoutMs: null,
+  };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--host') a.host = process.argv[++i];
+    else if (v === '--model') a.model = process.argv[++i];
+    else if (v === '--slice') a.slice = process.argv[++i];
+    else if (v === '--repo') a.repo = process.argv[++i];
+    else if (v === '--run') a.run = true;
+    else if (v === '--alert-on-fail') a.alertOnFail = true;
+    else if (v === '--format') a.format = process.argv[++i];
+    else if (v === '--timeout-ms') a.timeoutMs = parseInt(process.argv[++i], 10);
+  }
+  return a;
+})();
+
+const CHECKOUT_RX = /requires a metaharness repo checkout/i;
+
+function defaultTimeoutMs() {
+  // Dry-run resolves the slice manifest + prices the run without spending —
+  // bounded by repo scan, not model calls. Real runs (--run) are dominated
+  // by model calls × slice size; callers should pass --timeout-ms matched
+  // to their slice. 10 min is a floor for small slices, not a budget.
+  return ARGS.run ? 600_000 : 120_000;
+}
+
+async function main() {
+  if (ARGS.repo && !existsSync(ARGS.repo)) {
+    console.error(`learn: --repo path does not exist: ${ARGS.repo}`);
+    process.exit(2);
+  }
+
+  const cliArgs = ['learn'];
+  if (ARGS.host) cliArgs.push('--host', ARGS.host);
+  if (ARGS.model) cliArgs.push('--model', ARGS.model);
+  if (ARGS.slice) cliArgs.push('--slice', ARGS.slice);
+  if (ARGS.run) cliArgs.push('--run');
+
+  const r = await runMetaharnessAsync(cliArgs, {
+    // learn emits a human-readable report; --json support is not guaranteed
+    // across 0.3.x, so we don't inject it and parse leniently instead.
+    json: false,
+    timeoutMs: ARGS.timeoutMs ?? defaultTimeoutMs(),
+    env: ARGS.repo ? { METAHARNESS_REPO: ARGS.repo } : {},
+  });
+
+  if (r.degraded) emitDegradedJsonAndExit(r.reason);
+
+  const combined = `${r.stdout}\n${r.stderr}`;
+  if (CHECKOUT_RX.test(combined)) {
+    console.log(JSON.stringify({
+      status: 'checkout-required',
+      hint: 'git clone https://github.com/ruvnet/metaharness.git, then re-run with '
+        + '--repo /path/to/metaharness (or set METAHARNESS_REPO). The learning '
+        + 'harness (GEPA + SWE-bench + Docker) is not shipped in the npm package.',
+      dryRun: !ARGS.run,
+      durationMs: r.durationMs,
+    }, null, 2));
+    process.exit(0);
+  }
+
+  // Lenient JSON extraction — grab the last {...} block if one exists.
+  let json = null;
+  const matches = [...r.stdout.matchAll(/\{[\s\S]*?\}/g)];
+  for (let i = matches.length - 1; i >= 0; i--) {
+    try { json = JSON.parse(matches[i][0]); break; } catch { /* try previous */ }
+  }
+
+  const out = {
+    status: r.exitCode === 0 ? 'ok' : 'failed',
+    dryRun: !ARGS.run,
+    exitCode: r.exitCode,
+    report: json,
+    // When upstream emits no JSON, the raw report is still the deliverable.
+    rawReport: json ? undefined : r.stdout.slice(0, 20_000),
+    durationMs: r.durationMs,
+  };
+  console.log(JSON.stringify(out, null, 2));
+
+  if (ARGS.alertOnFail && r.exitCode !== 0) process.exit(1);
+  process.exit(0);
+}
+
+main().catch((e) => {
+  console.error(`learn: ${e?.message ?? e}`);
+  process.exit(2);
+});

package/plugins/ruflo-metaharness/scripts/mcp-scan.mjs

@@ -1,111 +1,111 @@
-#!/usr/bin/env node
-// mcp-scan.mjs — wrapper around `harness mcp-scan <path>`.
-//
-// Static security scan of the harness's declared MCP surface. Reads
-// .mcp/servers.json + .harness/claims.json. Pure-read, no dispatch.
-//
-// USAGE
-//   node scripts/mcp-scan.mjs                           # current dir
-//   node scripts/mcp-scan.mjs --path <dir>
-//   node scripts/mcp-scan.mjs --fail-on high            # exit 1 if any HIGH finding (default)
-//   node scripts/mcp-scan.mjs --fail-on medium          # also fail on MEDIUM
-//   node scripts/mcp-scan.mjs --format json
-//
-// EXIT CODES
-//   0  no findings at or above --fail-on (or degraded)
-//   1  at least one finding ≥ --fail-on severity
-//   2  config error or scan failure
-
-// iter 50 — parseMcpScanText extracted to _harness.mjs so oia-audit
-// can use the same parser without duplicating logic.
-// iter 63 — SEVERITY_RANK also moves to _harness.mjs (single source of
-// truth; previously this file had a literal that diverged from oia-audit's).
-import { runHarness, emitDegradedJsonAndExit, parseMcpScanText, SEVERITY_RANK, rankSeverity } from './_harness.mjs';
-
-const ARGS = (() => {
-  const a = { path: '.', format: 'json', failOn: 'high' };
-  for (let i = 2; i < process.argv.length; i++) {
-    const v = process.argv[i];
-    if (v === '--path') a.path = process.argv[++i];
-    else if (v === '--fail-on') a.failOn = String(process.argv[++i] || 'high').toLowerCase();
-    else if (v === '--format') a.format = process.argv[++i];
-  }
-  return a;
-})();
-
-function main() {
-  if (!SEVERITY_RANK[ARGS.failOn]) {
-    console.error(`mcp-scan: --fail-on must be one of low|medium|high; got ${ARGS.failOn}`);
-    process.exit(2);
-  }
-  const r = runHarness(['mcp-scan', ARGS.path]);
-  if (r.degraded) { emitDegradedJsonAndExit(r.reason); return; }
-  if (r.exitCode !== 0 && r.exitCode !== 1) {
-    // exit 1 from harness can be "findings present"; only treat other
-    // non-zero as a real failure.
-    console.error(`mcp-scan: harness exited ${r.exitCode}`);
-    if (r.stderr) console.error(r.stderr.slice(0, 400));
-    process.exit(2);
-  }
-  // The JSON output shape from `harness mcp-scan` historically didn't
-  // include structured findings — it emits text even with --json. Parse
-  // the text into findings (iter 50) so audit-trend's introduced/cleared
-  // diff actually works. If a future upstream version DOES emit
-  // findings[], the parsed-text findings are overridden.
-  const parsed = parseMcpScanText(r.stdout);
-  // iter 124 — normalize finding shape so consumers see a stable contract.
-  // Upstream metaharness@0.1.x JSON path emits {id, severity, title, detail};
-  // our parseMcpScanText emits {severity, message}. Project both into a
-  // unified {severity, message, title?, detail?} so audit-trend's fingerprint
-  // diff and test-mcp-tools' assertions don't care which path produced them.
-  const rawFindings = Array.isArray(r.json?.findings) ? r.json.findings : parsed.findings;
-  const findings = rawFindings.map((f) => ({
-    ...f,
-    message: typeof f.message === 'string' && f.message
-      ? f.message
-      : (f.title || f.detail || ''),
-  }));
-  const payload = {
-    ...(r.json ?? {}),
-    findings,
-    summary: r.json?.summary ?? parsed.summary,
-    rawStdout: r.stdout.slice(0, 400),
-  };
-  const threshold = SEVERITY_RANK[ARGS.failOn];
-  // iter 63 — rankSeverity() safe lookup. Pre-iter-63 `undefined >= 3`
-  // was false → unknown-severity findings (e.g., warn / error) were
-  // silently excluded from the offending set, weakening --fail-on alerts.
-  const offending = findings.filter((f) => rankSeverity(f.severity) >= threshold);
-
-  const alert = {
-    threshold: ARGS.failOn,
-    triggered: offending.length > 0,
-    offendingCount: offending.length,
-    reason: offending.length > 0
-      ? `${offending.length} finding(s) at or above ${ARGS.failOn} severity`
-      : `no findings at or above ${ARGS.failOn} severity — OK`,
-  };
-
-  if (ARGS.format === 'json') {
-    // iter 112 — generatedAt for consistency with other --format json outputs
-    console.log(JSON.stringify({
-      ...payload, durationMs: r.durationMs, alert,
-      generatedAt: new Date().toISOString(),
-    }, null, 2));
-  } else {
-    console.log(`# harness mcp-scan — ${ARGS.path}`);
-    console.log('');
-    console.log(`Total findings: ${findings.length}`);
-    console.log(`| Severity | ID | Server | Tool | Message |`);
-    console.log(`|---|---|---|---|---|`);
-    for (const f of findings.slice(0, 50)) {
-      console.log(`| ${f.severity} | ${f.id ?? '—'} | ${f.server ?? '—'} | ${f.tool ?? '—'} | ${f.message ?? ''} |`);
-    }
-    console.log('');
-    console.log(alert.triggered ? `⚠ **ALERT**: ${alert.reason}` : `✓ ${alert.reason}`);
-  }
-
-  if (alert.triggered) process.exit(1);
-}
-
-main();
+#!/usr/bin/env node
+// mcp-scan.mjs — wrapper around `harness mcp-scan <path>`.
+//
+// Static security scan of the harness's declared MCP surface. Reads
+// .mcp/servers.json + .harness/claims.json. Pure-read, no dispatch.
+//
+// USAGE
+//   node scripts/mcp-scan.mjs                           # current dir
+//   node scripts/mcp-scan.mjs --path <dir>
+//   node scripts/mcp-scan.mjs --fail-on high            # exit 1 if any HIGH finding (default)
+//   node scripts/mcp-scan.mjs --fail-on medium          # also fail on MEDIUM
+//   node scripts/mcp-scan.mjs --format json
+//
+// EXIT CODES
+//   0  no findings at or above --fail-on (or degraded)
+//   1  at least one finding ≥ --fail-on severity
+//   2  config error or scan failure
+
+// iter 50 — parseMcpScanText extracted to _harness.mjs so oia-audit
+// can use the same parser without duplicating logic.
+// iter 63 — SEVERITY_RANK also moves to _harness.mjs (single source of
+// truth; previously this file had a literal that diverged from oia-audit's).
+import { runHarness, emitDegradedJsonAndExit, parseMcpScanText, SEVERITY_RANK, rankSeverity } from './_harness.mjs';
+
+const ARGS = (() => {
+  const a = { path: '.', format: 'json', failOn: 'high' };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--path') a.path = process.argv[++i];
+    else if (v === '--fail-on') a.failOn = String(process.argv[++i] || 'high').toLowerCase();
+    else if (v === '--format') a.format = process.argv[++i];
+  }
+  return a;
+})();
+
+function main() {
+  if (!SEVERITY_RANK[ARGS.failOn]) {
+    console.error(`mcp-scan: --fail-on must be one of low|medium|high; got ${ARGS.failOn}`);
+    process.exit(2);
+  }
+  const r = runHarness(['mcp-scan', ARGS.path]);
+  if (r.degraded) { emitDegradedJsonAndExit(r.reason); return; }
+  if (r.exitCode !== 0 && r.exitCode !== 1) {
+    // exit 1 from harness can be "findings present"; only treat other
+    // non-zero as a real failure.
+    console.error(`mcp-scan: harness exited ${r.exitCode}`);
+    if (r.stderr) console.error(r.stderr.slice(0, 400));
+    process.exit(2);
+  }
+  // The JSON output shape from `harness mcp-scan` historically didn't
+  // include structured findings — it emits text even with --json. Parse
+  // the text into findings (iter 50) so audit-trend's introduced/cleared
+  // diff actually works. If a future upstream version DOES emit
+  // findings[], the parsed-text findings are overridden.
+  const parsed = parseMcpScanText(r.stdout);
+  // iter 124 — normalize finding shape so consumers see a stable contract.
+  // Upstream metaharness@0.1.x JSON path emits {id, severity, title, detail};
+  // our parseMcpScanText emits {severity, message}. Project both into a
+  // unified {severity, message, title?, detail?} so audit-trend's fingerprint
+  // diff and test-mcp-tools' assertions don't care which path produced them.
+  const rawFindings = Array.isArray(r.json?.findings) ? r.json.findings : parsed.findings;
+  const findings = rawFindings.map((f) => ({
+    ...f,
+    message: typeof f.message === 'string' && f.message
+      ? f.message
+      : (f.title || f.detail || ''),
+  }));
+  const payload = {
+    ...(r.json ?? {}),
+    findings,
+    summary: r.json?.summary ?? parsed.summary,
+    rawStdout: r.stdout.slice(0, 400),
+  };
+  const threshold = SEVERITY_RANK[ARGS.failOn];
+  // iter 63 — rankSeverity() safe lookup. Pre-iter-63 `undefined >= 3`
+  // was false → unknown-severity findings (e.g., warn / error) were
+  // silently excluded from the offending set, weakening --fail-on alerts.
+  const offending = findings.filter((f) => rankSeverity(f.severity) >= threshold);
+
+  const alert = {
+    threshold: ARGS.failOn,
+    triggered: offending.length > 0,
+    offendingCount: offending.length,
+    reason: offending.length > 0
+      ? `${offending.length} finding(s) at or above ${ARGS.failOn} severity`
+      : `no findings at or above ${ARGS.failOn} severity — OK`,
+  };
+
+  if (ARGS.format === 'json') {
+    // iter 112 — generatedAt for consistency with other --format json outputs
+    console.log(JSON.stringify({
+      ...payload, durationMs: r.durationMs, alert,
+      generatedAt: new Date().toISOString(),
+    }, null, 2));
+  } else {
+    console.log(`# harness mcp-scan — ${ARGS.path}`);
+    console.log('');
+    console.log(`Total findings: ${findings.length}`);
+    console.log(`| Severity | ID | Server | Tool | Message |`);
+    console.log(`|---|---|---|---|---|`);
+    for (const f of findings.slice(0, 50)) {
+      console.log(`| ${f.severity} | ${f.id ?? '—'} | ${f.server ?? '—'} | ${f.tool ?? '—'} | ${f.message ?? ''} |`);
+    }
+    console.log('');
+    console.log(alert.triggered ? `⚠ **ALERT**: ${alert.reason}` : `✓ ${alert.reason}`);
+  }
+
+  if (alert.triggered) process.exit(1);
+}
+
+main();