@claude-flow/cli 3.38.4 → 3.38.5

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.38.4",
+    "version": "3.38.5",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
@@ -8,6 +8,6 @@
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "pebcqTgxAwqxE5P2CeHtJGeddXdUluZcIkdlIrCo9NAjkNEFTiwV/PUltPtEvyYQ5uYu1AaZjbT/2qz3/YIhAg==",
+  "signature": "aNZkK2xmrSn4xS5GEZ42BMV56uqQorOY8jt/3cxHbCUt1D2Vi8Ewz31d4vrm8pDUR1wTtkUKj148o8saoUaxAg==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 4,
-  "generatedAt": "2026-08-12T18:43:20.202Z",
-  "gitSha": "d41af6e4",
+  "generatedAt": "2026-08-12T19:44:54.526Z",
+  "gitSha": "7715eb5e",
   "catalog": {
     "agents": 164,
     "tools": 397,

package/dist/src/commands/security.js

@@ -170,7 +170,14 @@ const scanCommand = {
             if (scanType === 'all' || scanType === 'code') {
                 spinner.setText('Scanning for hardcoded secrets...');
                 const secretPatterns = [
-                    { pattern: /['"](?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{20,}['"]/g, type: 'API Key (Stripe/OpenAI)' },
+                    // #2931: was `['"](?:sk-|...)...{20,}['"]` — the 20-char floor
+                    // missed shorter-but-real keys like `sk-1234567890abcdef` (16
+                    // chars), and the quote-adjacency anchor required a quote
+                    // literally next to the prefix, missing the extremely common
+                    // `Authorization: "Bearer sk_live_..."` shape where the quote
+                    // sits next to "Bearer", not the key. Lookaround boundaries
+                    // match the prefix wherever it appears as a standalone token.
+                    { pattern: /(?<![a-zA-Z0-9_])(?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{10,}(?![a-zA-Z0-9_])/g, type: 'API Key (Stripe/OpenAI)' },
                     { pattern: /['"]AKIA[A-Z0-9]{16}['"]/g, type: 'AWS Access Key' },
                     { pattern: /['"]ghp_[a-zA-Z0-9]{36}['"]/g, type: 'GitHub Token' },
                     { pattern: /['"]xox[baprs]-[a-zA-Z0-9-]+['"]/g, type: 'Slack Token' },
@@ -789,7 +796,7 @@ const secretsCommand = {
             { pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, type: 'JWT Token', risk: 'High', action: 'Remove from source' },
             { pattern: /-----BEGIN (?:RSA|EC|DSA|OPENSSH) PRIVATE KEY-----/g, type: 'Private Key', risk: 'Critical', action: 'Remove and regenerate' },
             { pattern: /(?:mongodb|postgres|mysql|redis):\/\/[^\s'"]+/g, type: 'Connection String', risk: 'High', action: 'Use env variable' },
-            { pattern: /['"](?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{20,}['"]/g, type: 'API Key (Stripe/OpenAI)', risk: 'Critical', action: 'Rotate immediately' },
+            { pattern: /(?<![a-zA-Z0-9_])(?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{10,}(?![a-zA-Z0-9_])/g, type: 'API Key (Stripe/OpenAI)', risk: 'Critical', action: 'Rotate immediately' },
             { pattern: /['"]xox[baprs]-[a-zA-Z0-9-]+['"]/g, type: 'Slack Token', risk: 'High', action: 'Revoke and rotate' },
             { pattern: /[a-zA-Z0-9_-]*(?:api[_-]?key|secret[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\s*[:=]\s*['"][^'"]{8,}['"]/gi, type: 'Generic Secret/API Key', risk: 'High', action: 'Use env variable' },
             { pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi, type: 'Hardcoded Password', risk: 'High', action: 'Use secrets manager' },

package/dist/src/mcp-tools/github-tools.js

@@ -391,9 +391,16 @@ export const githubTools = [
             const store = loadGitHubStore();
             const action = input.action || 'list';
             const gh = hasGhCli();
+            // #2963 — owner/repo were validated but never passed to `gh`, so `gh`
+            // silently resolved the target repo from the cwd's git remote instead
+            // of the caller-specified one. `gh` accepts `--repo owner/repo` on
+            // every issue subcommand used here.
+            const owner = input.owner;
+            const repo = input.repo;
+            const repoArgs = owner && repo ? ['--repo', `${owner}/${repo}`] : [];
             if (action === 'list') {
                 if (gh) {
-                    const raw = run('gh issue list --state all --limit 20 --json number,title,state,labels,createdAt');
+                    const raw = runArgv('gh', ['issue', 'list', '--state', 'all', '--limit', '20', '--json', 'number,title,state,labels,createdAt', ...repoArgs]);
                     if (raw) {
                         try {
                             const issues = JSON.parse(raw);
@@ -413,7 +420,7 @@ export const githubTools = [
                 // outside [A-Za-z0-9 _\-./] and caps each label at 64 chars.
                 const labels = sanitizeLabels(input.labels) ?? [];
                 if (gh) {
-                    const argv = ['issue', 'create', '--title', title, '--body', body];
+                    const argv = ['issue', 'create', '--title', title, '--body', body, ...repoArgs];
                     if (labels.length > 0) {
                         argv.push('--label', labels.join(','));
                     }
@@ -442,7 +449,7 @@ export const githubTools = [
                             argv.push('--add-label', labels.join(','));
                     }
                     if (argv.length > 3) {
-                        const result = runArgv('gh', argv);
+                        const result = runArgv('gh', [...argv, ...repoArgs]);
                         if (result !== null)
                             return { success: true, _real: true, action: 'updated', issueNumber };
                     }
@@ -463,7 +470,7 @@ export const githubTools = [
             if (action === 'close') {
                 const issueNumber = toPositiveInt(input.issueNumber);
                 if (gh && issueNumber) {
-                    const result = runArgv('gh', ['issue', 'close', String(issueNumber)]);
+                    const result = runArgv('gh', ['issue', 'close', String(issueNumber), ...repoArgs]);
                     if (result !== null)
                         return { success: true, _real: true, action: 'closed', issueNumber, closedAt: new Date().toISOString() };
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.38.4",
+  "version": "3.38.5",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",