@claude-flow/cli 3.32.9 → 3.32.11

package/bin/mcp-server.js

@@ -1,224 +1,224 @@
-#!/usr/bin/env node
-/**
- * @claude-flow/cli - MCP Server Entry Point
- *
- * Direct stdio MCP server for Claude Code integration.
- * This entry point handles stdin/stdout directly for MCP protocol
- * without any CLI formatting output that would corrupt the protocol.
- */
-
-import { randomUUID } from 'crypto';
-
-// Suppress the SPECIFIC cosmetic "[AgentDB Patch] Controller index not found"
-// noise. Tight match (both prefix AND "Controller index not found") so other
-// [AgentDB Patch] warnings about real issues still flow through. Also patch
-// console.log because the underlying call site uses it. See bin/cli.js for
-// the same rationale.
-const _origWarn = console.warn;
-const _origLog = console.log;
-const _isCosmeticAgentdbPatchNoise = (msg) =>
-  msg.includes('[AgentDB Patch]') && msg.includes('Controller index not found');
-console.warn = (...args) => {
-  if (_isCosmeticAgentdbPatchNoise(String(args[0] ?? ''))) return;
-  _origWarn.apply(console, args);
-};
-console.log = (...args) => {
-  if (_isCosmeticAgentdbPatchNoise(String(args[0] ?? ''))) return;
-  _origLog.apply(console, args);
-};
-
-import { listMCPTools, callMCPTool, hasTool } from '../dist/src/mcp-client.js';
-
-const VERSION = '3.0.0';
-const sessionId = `mcp-${Date.now()}-${randomUUID().slice(0, 8)}`;
-
-// Log to stderr (doesn't corrupt stdout for MCP protocol)
-console.error(
-  `[${new Date().toISOString()}] INFO [claude-flow-mcp] (${sessionId}) Starting in stdio mode`
-);
-console.error(JSON.stringify({
-  arch: process.arch,
-  mode: 'mcp-stdio',
-  nodeVersion: process.version,
-  pid: process.pid,
-  platform: process.platform,
-  protocol: 'stdio',
-  sessionId,
-  version: VERSION,
-}));
-
-// Handle stdin messages
-// Audit-flagged DoS protection (audit_1776483149979): cap stdin buffer
-// to 10MB. See bin/cli.js for the same protection on the auto-detect path.
-const MCP_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
-let buffer = '';
-
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', async (chunk) => {
-  buffer += chunk;
-
-  if (buffer.length > MCP_MAX_BUFFER_BYTES) {
-    console.log(JSON.stringify({
-      jsonrpc: '2.0',
-      id: null,
-      error: {
-        code: -32700,
-        message: `Buffered stdin exceeds ${MCP_MAX_BUFFER_BYTES} bytes without newline; resetting`,
-      },
-    }));
-    buffer = '';
-    return;
-  }
-
-  // Process complete JSON messages (newline-delimited)
-  let lines = buffer.split('\n');
-  buffer = lines.pop() || ''; // Keep incomplete line in buffer
-
-  for (const line of lines) {
-    if (line.trim()) {
-      try {
-        const message = JSON.parse(line);
-        const response = await handleMessage(message);
-        if (response) {
-          console.log(JSON.stringify(response));
-        }
-      } catch (error) {
-        console.error(
-          `[${new Date().toISOString()}] ERROR [claude-flow-mcp] Failed to parse:`,
-          error instanceof Error ? error.message : String(error)
-        );
-        // Send parse error response
-        console.log(JSON.stringify({
-          jsonrpc: '2.0',
-          id: null,
-          error: { code: -32700, message: 'Parse error' },
-        }));
-      }
-    }
-  }
-});
-
-process.stdin.on('end', () => {
-  console.error(
-    `[${new Date().toISOString()}] INFO [claude-flow-mcp] (${sessionId}) stdin closed, shutting down...`
-  );
-  process.exit(0);
-});
-
-// Handle process termination
-process.on('SIGINT', () => {
-  console.error(`[${new Date().toISOString()}] INFO [claude-flow-mcp] Received SIGINT`);
-  process.exit(0);
-});
-
-process.on('SIGTERM', () => {
-  console.error(`[${new Date().toISOString()}] INFO [claude-flow-mcp] Received SIGTERM`);
-  process.exit(0);
-});
-
-/**
- * Handle MCP message
- */
-async function handleMessage(message) {
-  if (!message.method) {
-    return {
-      jsonrpc: '2.0',
-      id: message.id,
-      error: { code: -32600, message: 'Invalid Request: missing method' },
-    };
-  }
-
-  const params = message.params || {};
-
-  try {
-    switch (message.method) {
-      case 'initialize':
-        return {
-          jsonrpc: '2.0',
-          id: message.id,
-          result: {
-            protocolVersion: '2024-11-05',
-            serverInfo: { name: 'ruflo', version: VERSION },
-            capabilities: {
-              tools: { listChanged: true },
-              resources: { subscribe: true, listChanged: true },
-            },
-          },
-        };
-
-      case 'tools/list': {
-        const tools = listMCPTools();
-        return {
-          jsonrpc: '2.0',
-          id: message.id,
-          result: {
-            tools: tools.map(tool => ({
-              name: tool.name,
-              description: tool.description,
-              inputSchema: tool.inputSchema,
-            })),
-          },
-        };
-      }
-
-      case 'tools/call': {
-        const toolName = params.name;
-        const toolParams = params.arguments || {};
-
-        if (!hasTool(toolName)) {
-          return {
-            jsonrpc: '2.0',
-            id: message.id,
-            error: { code: -32601, message: `Tool not found: ${toolName}` },
-          };
-        }
-
-        try {
-          const result = await callMCPTool(toolName, toolParams, { sessionId });
-          return {
-            jsonrpc: '2.0',
-            id: message.id,
-            result: { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] },
-          };
-        } catch (error) {
-          return {
-            jsonrpc: '2.0',
-            id: message.id,
-            error: {
-              code: -32603,
-              message: error instanceof Error ? error.message : 'Tool execution failed',
-            },
-          };
-        }
-      }
-
-      case 'notifications/initialized':
-        console.error(`[${new Date().toISOString()}] INFO [claude-flow-mcp] Client initialized`);
-        return null; // No response for notifications
-
-      case 'ping':
-        return {
-          jsonrpc: '2.0',
-          id: message.id,
-          result: {},
-        };
-
-      default:
-        return {
-          jsonrpc: '2.0',
-          id: message.id,
-          error: { code: -32601, message: `Method not found: ${message.method}` },
-        };
-    }
-  } catch (error) {
-    console.error(`[${new Date().toISOString()}] ERROR [claude-flow-mcp] ${message.method}:`, error);
-    return {
-      jsonrpc: '2.0',
-      id: message.id,
-      error: {
-        code: -32603,
-        message: error instanceof Error ? error.message : 'Internal error',
-      },
-    };
-  }
-}
+#!/usr/bin/env node
+/**
+ * @claude-flow/cli - MCP Server Entry Point
+ *
+ * Direct stdio MCP server for Claude Code integration.
+ * This entry point handles stdin/stdout directly for MCP protocol
+ * without any CLI formatting output that would corrupt the protocol.
+ */
+
+import { randomUUID } from 'crypto';
+
+// Suppress the SPECIFIC cosmetic "[AgentDB Patch] Controller index not found"
+// noise. Tight match (both prefix AND "Controller index not found") so other
+// [AgentDB Patch] warnings about real issues still flow through. Also patch
+// console.log because the underlying call site uses it. See bin/cli.js for
+// the same rationale.
+const _origWarn = console.warn;
+const _origLog = console.log;
+const _isCosmeticAgentdbPatchNoise = (msg) =>
+  msg.includes('[AgentDB Patch]') && msg.includes('Controller index not found');
+console.warn = (...args) => {
+  if (_isCosmeticAgentdbPatchNoise(String(args[0] ?? ''))) return;
+  _origWarn.apply(console, args);
+};
+console.log = (...args) => {
+  if (_isCosmeticAgentdbPatchNoise(String(args[0] ?? ''))) return;
+  _origLog.apply(console, args);
+};
+
+import { listMCPTools, callMCPTool, hasTool } from '../dist/src/mcp-client.js';
+
+const VERSION = '3.0.0';
+const sessionId = `mcp-${Date.now()}-${randomUUID().slice(0, 8)}`;
+
+// Log to stderr (doesn't corrupt stdout for MCP protocol)
+console.error(
+  `[${new Date().toISOString()}] INFO [claude-flow-mcp] (${sessionId}) Starting in stdio mode`
+);
+console.error(JSON.stringify({
+  arch: process.arch,
+  mode: 'mcp-stdio',
+  nodeVersion: process.version,
+  pid: process.pid,
+  platform: process.platform,
+  protocol: 'stdio',
+  sessionId,
+  version: VERSION,
+}));
+
+// Handle stdin messages
+// Audit-flagged DoS protection (audit_1776483149979): cap stdin buffer
+// to 10MB. See bin/cli.js for the same protection on the auto-detect path.
+const MCP_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
+let buffer = '';
+
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', async (chunk) => {
+  buffer += chunk;
+
+  if (buffer.length > MCP_MAX_BUFFER_BYTES) {
+    console.log(JSON.stringify({
+      jsonrpc: '2.0',
+      id: null,
+      error: {
+        code: -32700,
+        message: `Buffered stdin exceeds ${MCP_MAX_BUFFER_BYTES} bytes without newline; resetting`,
+      },
+    }));
+    buffer = '';
+    return;
+  }
+
+  // Process complete JSON messages (newline-delimited)
+  let lines = buffer.split('\n');
+  buffer = lines.pop() || ''; // Keep incomplete line in buffer
+
+  for (const line of lines) {
+    if (line.trim()) {
+      try {
+        const message = JSON.parse(line);
+        const response = await handleMessage(message);
+        if (response) {
+          console.log(JSON.stringify(response));
+        }
+      } catch (error) {
+        console.error(
+          `[${new Date().toISOString()}] ERROR [claude-flow-mcp] Failed to parse:`,
+          error instanceof Error ? error.message : String(error)
+        );
+        // Send parse error response
+        console.log(JSON.stringify({
+          jsonrpc: '2.0',
+          id: null,
+          error: { code: -32700, message: 'Parse error' },
+        }));
+      }
+    }
+  }
+});
+
+process.stdin.on('end', () => {
+  console.error(
+    `[${new Date().toISOString()}] INFO [claude-flow-mcp] (${sessionId}) stdin closed, shutting down...`
+  );
+  process.exit(0);
+});
+
+// Handle process termination
+process.on('SIGINT', () => {
+  console.error(`[${new Date().toISOString()}] INFO [claude-flow-mcp] Received SIGINT`);
+  process.exit(0);
+});
+
+process.on('SIGTERM', () => {
+  console.error(`[${new Date().toISOString()}] INFO [claude-flow-mcp] Received SIGTERM`);
+  process.exit(0);
+});
+
+/**
+ * Handle MCP message
+ */
+async function handleMessage(message) {
+  if (!message.method) {
+    return {
+      jsonrpc: '2.0',
+      id: message.id,
+      error: { code: -32600, message: 'Invalid Request: missing method' },
+    };
+  }
+
+  const params = message.params || {};
+
+  try {
+    switch (message.method) {
+      case 'initialize':
+        return {
+          jsonrpc: '2.0',
+          id: message.id,
+          result: {
+            protocolVersion: '2024-11-05',
+            serverInfo: { name: 'ruflo', version: VERSION },
+            capabilities: {
+              tools: { listChanged: true },
+              resources: { subscribe: true, listChanged: true },
+            },
+          },
+        };
+
+      case 'tools/list': {
+        const tools = listMCPTools();
+        return {
+          jsonrpc: '2.0',
+          id: message.id,
+          result: {
+            tools: tools.map(tool => ({
+              name: tool.name,
+              description: tool.description,
+              inputSchema: tool.inputSchema,
+            })),
+          },
+        };
+      }
+
+      case 'tools/call': {
+        const toolName = params.name;
+        const toolParams = params.arguments || {};
+
+        if (!hasTool(toolName)) {
+          return {
+            jsonrpc: '2.0',
+            id: message.id,
+            error: { code: -32601, message: `Tool not found: ${toolName}` },
+          };
+        }
+
+        try {
+          const result = await callMCPTool(toolName, toolParams, { sessionId });
+          return {
+            jsonrpc: '2.0',
+            id: message.id,
+            result: { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] },
+          };
+        } catch (error) {
+          return {
+            jsonrpc: '2.0',
+            id: message.id,
+            error: {
+              code: -32603,
+              message: error instanceof Error ? error.message : 'Tool execution failed',
+            },
+          };
+        }
+      }
+
+      case 'notifications/initialized':
+        console.error(`[${new Date().toISOString()}] INFO [claude-flow-mcp] Client initialized`);
+        return null; // No response for notifications
+
+      case 'ping':
+        return {
+          jsonrpc: '2.0',
+          id: message.id,
+          result: {},
+        };
+
+      default:
+        return {
+          jsonrpc: '2.0',
+          id: message.id,
+          error: { code: -32601, message: `Method not found: ${message.method}` },
+        };
+    }
+  } catch (error) {
+    console.error(`[${new Date().toISOString()}] ERROR [claude-flow-mcp] ${message.method}:`, error);
+    return {
+      jsonrpc: '2.0',
+      id: message.id,
+      error: {
+        code: -32603,
+        message: error instanceof Error ? error.message : 'Internal error',
+      },
+    };
+  }
+}

package/bin/preinstall.cjs

@@ -1,2 +1,2 @@
-#!/usr/bin/env node
-// Preinstall hook — no-op (cache repair removed in 3.1.0-alpha.53)
+#!/usr/bin/env node
+// Preinstall hook — no-op (cache repair removed in 3.1.0-alpha.53)

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-20T23:20:52.239Z",
-  "gitSha": "745dfbe3",
+  "generatedAt": "2026-07-26T22:48:15.666Z",
+  "gitSha": "2aec43f6",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/dist/src/autopilot-state.js

@@ -8,9 +8,10 @@
  * Security: Addresses prototype pollution, NaN bypass, input validation
  */
 import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, renameSync } from 'node:fs';
+import { existsSync, readFileSync, mkdirSync, readdirSync } from 'node:fs';
 import { resolve, join } from 'node:path';
 import { homedir } from 'node:os';
+import { writeFileAtomic } from './fs-secure.js';
 // ── Constants ─────────────────────────────────────────────────
 export const STATE_DIR = '.claude-flow/data';
 export const STATE_FILE = `${STATE_DIR}/autopilot-state.json`;
@@ -119,9 +120,18 @@ export function saveState(state) {
     if (state.history.length > MAX_HISTORY_ENTRIES) {
         state.history = state.history.slice(-MAX_HISTORY_ENTRIES);
     }
-    const tmpFile = resolve(STATE_FILE) + '.tmp';
-    writeFileSync(tmpFile, JSON.stringify(state, null, 2));
-    renameSync(tmpFile, resolve(STATE_FILE));
+    // ruvnet/ruflo#2782: use writeFileAtomic — its temp file is uniquified with
+    // pid + timestamp + random suffix, so two concurrent in-process saveState()
+    // calls can no longer collide on a shared `.tmp` basename and race one
+    // another's renameSync into ENOENT. Related to but distinct from #1637.
+    try {
+        writeFileAtomic(resolve(STATE_FILE), Buffer.from(JSON.stringify(state, null, 2)));
+    }
+    catch {
+        // A losing concurrent writer may briefly see ENOENT/EEXIST — the winning
+        // writer's payload is on disk, so the state is not lost. Swallow rather
+        // than crash the caller (daemon tick, MCP handler).
+    }
 }
 export function appendLog(entry) {
     const filePath = resolve(LOG_FILE);
@@ -142,9 +152,16 @@ export function appendLog(entry) {
     log.push(entry);
     if (log.length > MAX_LOG_ENTRIES)
         log = log.slice(-MAX_LOG_ENTRIES);
-    const tmpFile = filePath + '.tmp';
-    writeFileSync(tmpFile, JSON.stringify(log, null, 2));
-    renameSync(tmpFile, filePath);
+    // ruvnet/ruflo#2782: same shared `.tmp`-basename race as saveState() above —
+    // concurrent appendLog() calls would collide their sentinel temp files and
+    // renameSync into ENOENT. writeFileAtomic uses a uniquified temp so callers
+    // cannot step on each other.
+    try {
+        writeFileAtomic(filePath, Buffer.from(JSON.stringify(log, null, 2)));
+    }
+    catch {
+        // Log write is best-effort — don't crash the caller on a losing race.
+    }
 }
 export function loadLog() {
     const filePath = resolve(LOG_FILE);

package/dist/src/benchmarks/gaia-critic.js

@@ -70,25 +70,25 @@ function resolveApiKey(override) {
  * Instructs Sonnet to act as an adversarial reviewer and respond in JSON.
  */
 function buildCriticSystemPrompt() {
-    return `You are an adversarial reviewer of agent answers on the GAIA benchmark. \
-Your job is to find flaws in candidate answers before they are submitted.
-
-Given a question, a candidate answer, and a summary of the agent's reasoning \
-trajectory, you must decide whether the candidate answer is correct.
-
-Evaluation criteria:
-1. Does the answer directly address what the question asks?
-2. Is there evidence in the trajectory that supports the answer?
-3. Are there obvious flaws (wrong unit, wrong format, missed constraint, \
-fabricated source, off-by-one error, truncation)?
-4. For numeric answers: is the magnitude and unit plausible?
-5. For list answers: are all required items present and correctly ordered?
-
-Respond ONLY with a JSON object — no markdown, no prose outside the JSON:
-{"verdict":"pass"|"fail"|"uncertain","reasoning":"<1-3 sentences>","suggestedRevision":"<corrected answer or empty string>"}
-
-Use "uncertain" only when you genuinely cannot determine correctness from the \
-available information. Never use "uncertain" to avoid making a decision when \
+    return `You are an adversarial reviewer of agent answers on the GAIA benchmark. \
+Your job is to find flaws in candidate answers before they are submitted.
+
+Given a question, a candidate answer, and a summary of the agent's reasoning \
+trajectory, you must decide whether the candidate answer is correct.
+
+Evaluation criteria:
+1. Does the answer directly address what the question asks?
+2. Is there evidence in the trajectory that supports the answer?
+3. Are there obvious flaws (wrong unit, wrong format, missed constraint, \
+fabricated source, off-by-one error, truncation)?
+4. For numeric answers: is the magnitude and unit plausible?
+5. For list answers: are all required items present and correctly ordered?
+
+Respond ONLY with a JSON object — no markdown, no prose outside the JSON:
+{"verdict":"pass"|"fail"|"uncertain","reasoning":"<1-3 sentences>","suggestedRevision":"<corrected answer or empty string>"}
+
+Use "uncertain" only when you genuinely cannot determine correctness from the \
+available information. Never use "uncertain" to avoid making a decision when \
 evidence is available.`;
 }
 /**
@@ -108,11 +108,11 @@ function buildCriticUserMessage(question, candidateAnswer, trajectory) {
             const result = s.result ? ` → ${s.result.slice(0, 200)}` : '';
             return `${label}${result}`;
         }).join('\n');
-    return `QUESTION: ${question.question}
-
-CANDIDATE ANSWER: ${candidateAnswer}
-
-AGENT TRAJECTORY (${trajectory.turns} turns, summarised):
+    return `QUESTION: ${question.question}
+
+CANDIDATE ANSWER: ${candidateAnswer}
+
+AGENT TRAJECTORY (${trajectory.turns} turns, summarised):
 ${trajectoryText}`;
 }
 /**