@claude-flow/cli 3.42.3 → 3.42.4

package/plugins/ruflo-metaharness/skills/harness-threat-model/SKILL.md

@@ -1,41 +1,41 @@
----
-name: harness-threat-model
-description: Enterprise-review-grade threat model from `harness threat-model <path>`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
-argument-hint: "[--path .] [--fail-on clean|low|medium|high] [--format table|json]"
-allowed-tools: Bash
----
-
-The companion to `harness-mcp-scan` for enterprise security reviews.
-Where mcp-scan is a per-server static lint, threat-model produces a
-categorized report suitable for sharing with an InfoSec team.
-
-## Algorithm
-
-Implementation: [`scripts/threat-model.mjs`](../../scripts/threat-model.mjs).
-
-1. Invoke the pinned `harness` binary (`metaharness@~0.3.0`, resolved from a
-   local install or the one-time `~/.ruflo/metaharness-cache-<pin>` cache —
-   never `@latest`): `harness threat-model <path> --json`.
-2. Parse `{ worst, findings[] }`.
-3. `--fail-on <severity>`: exit 1 when `worst >= fail-on`. Default `high`.
-
-## Severity rank
-
-| Severity | Rank |
-|---|---:|
-| clean | 0 |
-| low | 1 |
-| medium | 2 |
-| high | 3 |
-
-## When to use
-
-- Pre-launch review: include the JSON output in the release-readiness
-  packet sent to security.
-- Periodic audit: schedule via the planned `oia-audit` background
-  worker (ADR-150 Phase 2) to detect MCP-surface drift.
-
-## Graceful degradation
-
-Same pattern as the other skills: when `harness` is absent, emit
-`{ degraded: true }` and exit 0. ADR-150 architectural constraint.
+---
+name: harness-threat-model
+description: Enterprise-review-grade threat model from `harness threat-model <path>`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
+argument-hint: "[--path .] [--fail-on clean|low|medium|high] [--format table|json]"
+allowed-tools: Bash
+---
+
+The companion to `harness-mcp-scan` for enterprise security reviews.
+Where mcp-scan is a per-server static lint, threat-model produces a
+categorized report suitable for sharing with an InfoSec team.
+
+## Algorithm
+
+Implementation: [`scripts/threat-model.mjs`](../../scripts/threat-model.mjs).
+
+1. Invoke the pinned `harness` binary (`metaharness@~0.3.0`, resolved from a
+   local install or the one-time `~/.ruflo/metaharness-cache-<pin>` cache —
+   never `@latest`): `harness threat-model <path> --json`.
+2. Parse `{ worst, findings[] }`.
+3. `--fail-on <severity>`: exit 1 when `worst >= fail-on`. Default `high`.
+
+## Severity rank
+
+| Severity | Rank |
+|---|---:|
+| clean | 0 |
+| low | 1 |
+| medium | 2 |
+| high | 3 |
+
+## When to use
+
+- Pre-launch review: include the JSON output in the release-readiness
+  packet sent to security.
+- Periodic audit: schedule via the planned `oia-audit` background
+  worker (ADR-150 Phase 2) to detect MCP-surface drift.
+
+## Graceful degradation
+
+Same pattern as the other skills: when `harness` is absent, emit
+`{ degraded: true }` and exit 0. ADR-150 architectural constraint.

package/scripts/postinstall.cjs

@@ -1,153 +1,153 @@
-#!/usr/bin/env node
-/**
- * @claude-flow/cli postinstall — agentdb compatibility patches.
- *
- * Two patches applied to the user's installed agentdb tree:
- *
- * 1. Sibling directory copy (#1721 fix): agentic-flow's runtime patch
- *    expects agentdb's controllers + utils + core + services + types
- *    at `dist/<name>/` (legacy v1.x layout). agentdb v3 ships at
- *    `dist/src/<name>/`. Copy each `dist/src/<name>/` subdir to
- *    `dist/<name>/` so the legacy import paths resolve. Skip dirs that
- *    already exist so this is idempotent.
- *
- * 2. Exports-field augmentation (ADR-095 G7): six controller files
- *    exist in agentdb's dist but are not declared in its package.json
- *    `exports` field — `AttestationLog`, `MutationGuard`,
- *    `GuardedVectorBackend`, `GNNService`, `RVFOptimizer`,
- *    `GraphAdapter`. Without these declared, Node's strict exports
- *    enforcement blocks subpath imports even when the file is on disk.
- *    We add the missing entries (only if the file actually exists)
- *    so consumers can reach them via `agentdb/controllers/...`.
- *
- * Both patches are best-effort — failure to apply does not break
- * install (try/catch wraps each phase). Re-running is safe.
- */
-
-'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-function findAgentdbBase() {
-  try {
-    const r = require.resolve('agentdb');
-    if (r.includes('dist/src')) return path.join(path.dirname(r), '..', '..');
-    if (r.includes('dist')) return path.join(path.dirname(r), '..');
-    return path.dirname(r);
-  } catch { return null; }
-}
-
-/**
- * Find every agentdb installation reachable in the install's node_modules
- * tree. Necessary because pnpm/npm hoisting can place multiple copies of
- * agentdb (different versions) at different levels. Only patching the
- * resolved one leaves consumer code that imports through a different
- * resolution path with stale exports.
- *
- * Strategy: walk up from the postinstall script's directory, collect any
- * `node_modules/agentdb` we find along the way + the .pnpm cached copies
- * directly under the same node_modules/.pnpm/ root.
- */
-function findAllAgentdbBases() {
-  const found = new Set();
-  let dir = __dirname;
-  for (let i = 0; i < 12; i++) {
-    const candidate = path.join(dir, 'node_modules', 'agentdb');
-    if (fs.existsSync(path.join(candidate, 'package.json'))) {
-      try { found.add(fs.realpathSync(candidate)); } catch { found.add(candidate); }
-    }
-    // Also check for .pnpm cache adjacent to this node_modules
-    const pnpmDir = path.join(dir, 'node_modules', '.pnpm');
-    if (fs.existsSync(pnpmDir)) {
-      try {
-        for (const e of fs.readdirSync(pnpmDir)) {
-          if (e.startsWith('agentdb@')) {
-            const adb = path.join(pnpmDir, e, 'node_modules', 'agentdb');
-            if (fs.existsSync(path.join(adb, 'package.json'))) {
-              try { found.add(fs.realpathSync(adb)); } catch { found.add(adb); }
-            }
-          }
-        }
-      } catch { /* ignore */ }
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return Array.from(found);
-}
-
-function copySiblings(base) {
-  const srcDist = path.join(base, 'dist', 'src');
-  if (!fs.existsSync(srcDist)) return;
-  for (const entry of fs.readdirSync(srcDist)) {
-    const src = path.join(srcDist, entry);
-    const target = path.join(base, 'dist', entry);
-    try {
-      if (fs.statSync(src).isDirectory() && !fs.existsSync(target)) {
-        fs.cpSync(src, target, { recursive: true });
-      }
-    } catch { /* best-effort */ }
-  }
-}
-
-function augmentExports(base) {
-  const pkgPath = path.join(base, 'package.json');
-  if (!fs.existsSync(pkgPath)) return;
-  let pkg;
-  try { pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8')); }
-  catch { return; }
-  if (!pkg.exports || typeof pkg.exports !== 'object') return;
-
-  // Subpath → relative file path (only added if both: (a) file exists, (b) export not already declared)
-  const additions = {
-    './controllers/AttestationLog': './dist/src/security/AttestationLog.js',
-    './controllers/MutationGuard': './dist/src/security/MutationGuard.js',
-    './controllers/GuardedVectorBackend': './dist/src/backends/ruvector/GuardedVectorBackend.js',
-    // GNNService and RVFOptimizer live outside dist/src/controllers/ in
-    // current agentdb. Map to the actual paths so the export points at a
-    // real file. Future agentdb versions may move them — the file-exists
-    // guard below will skip cleanly if these paths drift.
-    './controllers/GNNService': './dist/src/services/GNNService.js',
-    './controllers/RVFOptimizer': './dist/src/optimizations/RVFOptimizer.js',
-    // GraphAdapter location varies; try the graph-node backend path. If
-    // missing, the file-exists guard skips it without error.
-    './controllers/GraphAdapter': './dist/src/backends/graph-node/GraphAdapter.js',
-    // Also expose the security index so consumers can import the security namespace.
-    './security/controllers': './dist/src/security/index.js',
-  };
-
-  let changed = false;
-  for (const [subpath, target] of Object.entries(additions)) {
-    if (pkg.exports[subpath]) continue;
-    const abs = path.join(base, target);
-    if (!fs.existsSync(abs)) continue;
-    pkg.exports[subpath] = target;
-    changed = true;
-  }
-
-  if (changed) {
-    try {
-      fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
-    } catch { /* best-effort */ }
-  }
-}
-
-function main() {
-  // Patch every reachable agentdb instance, not just the first resolution
-  // result. pnpm/npm hoisting can leave multiple agentdb copies in the
-  // install tree, and consumers may import through any of them.
-  const bases = findAllAgentdbBases();
-  if (bases.length === 0) {
-    // Fall back to the single-base path so we still attempt something
-    // when the directory walk didn't find anything (e.g. unusual installs).
-    const base = findAgentdbBase();
-    if (base) bases.push(base);
-  }
-  for (const base of bases) {
-    try { copySiblings(base); } catch { /* phase 1 best-effort */ }
-  }
-}
-
-main();
+#!/usr/bin/env node
+/**
+ * @claude-flow/cli postinstall — agentdb compatibility patches.
+ *
+ * Two patches applied to the user's installed agentdb tree:
+ *
+ * 1. Sibling directory copy (#1721 fix): agentic-flow's runtime patch
+ *    expects agentdb's controllers + utils + core + services + types
+ *    at `dist/<name>/` (legacy v1.x layout). agentdb v3 ships at
+ *    `dist/src/<name>/`. Copy each `dist/src/<name>/` subdir to
+ *    `dist/<name>/` so the legacy import paths resolve. Skip dirs that
+ *    already exist so this is idempotent.
+ *
+ * 2. Exports-field augmentation (ADR-095 G7): six controller files
+ *    exist in agentdb's dist but are not declared in its package.json
+ *    `exports` field — `AttestationLog`, `MutationGuard`,
+ *    `GuardedVectorBackend`, `GNNService`, `RVFOptimizer`,
+ *    `GraphAdapter`. Without these declared, Node's strict exports
+ *    enforcement blocks subpath imports even when the file is on disk.
+ *    We add the missing entries (only if the file actually exists)
+ *    so consumers can reach them via `agentdb/controllers/...`.
+ *
+ * Both patches are best-effort — failure to apply does not break
+ * install (try/catch wraps each phase). Re-running is safe.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+function findAgentdbBase() {
+  try {
+    const r = require.resolve('agentdb');
+    if (r.includes('dist/src')) return path.join(path.dirname(r), '..', '..');
+    if (r.includes('dist')) return path.join(path.dirname(r), '..');
+    return path.dirname(r);
+  } catch { return null; }
+}
+
+/**
+ * Find every agentdb installation reachable in the install's node_modules
+ * tree. Necessary because pnpm/npm hoisting can place multiple copies of
+ * agentdb (different versions) at different levels. Only patching the
+ * resolved one leaves consumer code that imports through a different
+ * resolution path with stale exports.
+ *
+ * Strategy: walk up from the postinstall script's directory, collect any
+ * `node_modules/agentdb` we find along the way + the .pnpm cached copies
+ * directly under the same node_modules/.pnpm/ root.
+ */
+function findAllAgentdbBases() {
+  const found = new Set();
+  let dir = __dirname;
+  for (let i = 0; i < 12; i++) {
+    const candidate = path.join(dir, 'node_modules', 'agentdb');
+    if (fs.existsSync(path.join(candidate, 'package.json'))) {
+      try { found.add(fs.realpathSync(candidate)); } catch { found.add(candidate); }
+    }
+    // Also check for .pnpm cache adjacent to this node_modules
+    const pnpmDir = path.join(dir, 'node_modules', '.pnpm');
+    if (fs.existsSync(pnpmDir)) {
+      try {
+        for (const e of fs.readdirSync(pnpmDir)) {
+          if (e.startsWith('agentdb@')) {
+            const adb = path.join(pnpmDir, e, 'node_modules', 'agentdb');
+            if (fs.existsSync(path.join(adb, 'package.json'))) {
+              try { found.add(fs.realpathSync(adb)); } catch { found.add(adb); }
+            }
+          }
+        }
+      } catch { /* ignore */ }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return Array.from(found);
+}
+
+function copySiblings(base) {
+  const srcDist = path.join(base, 'dist', 'src');
+  if (!fs.existsSync(srcDist)) return;
+  for (const entry of fs.readdirSync(srcDist)) {
+    const src = path.join(srcDist, entry);
+    const target = path.join(base, 'dist', entry);
+    try {
+      if (fs.statSync(src).isDirectory() && !fs.existsSync(target)) {
+        fs.cpSync(src, target, { recursive: true });
+      }
+    } catch { /* best-effort */ }
+  }
+}
+
+function augmentExports(base) {
+  const pkgPath = path.join(base, 'package.json');
+  if (!fs.existsSync(pkgPath)) return;
+  let pkg;
+  try { pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8')); }
+  catch { return; }
+  if (!pkg.exports || typeof pkg.exports !== 'object') return;
+
+  // Subpath → relative file path (only added if both: (a) file exists, (b) export not already declared)
+  const additions = {
+    './controllers/AttestationLog': './dist/src/security/AttestationLog.js',
+    './controllers/MutationGuard': './dist/src/security/MutationGuard.js',
+    './controllers/GuardedVectorBackend': './dist/src/backends/ruvector/GuardedVectorBackend.js',
+    // GNNService and RVFOptimizer live outside dist/src/controllers/ in
+    // current agentdb. Map to the actual paths so the export points at a
+    // real file. Future agentdb versions may move them — the file-exists
+    // guard below will skip cleanly if these paths drift.
+    './controllers/GNNService': './dist/src/services/GNNService.js',
+    './controllers/RVFOptimizer': './dist/src/optimizations/RVFOptimizer.js',
+    // GraphAdapter location varies; try the graph-node backend path. If
+    // missing, the file-exists guard skips it without error.
+    './controllers/GraphAdapter': './dist/src/backends/graph-node/GraphAdapter.js',
+    // Also expose the security index so consumers can import the security namespace.
+    './security/controllers': './dist/src/security/index.js',
+  };
+
+  let changed = false;
+  for (const [subpath, target] of Object.entries(additions)) {
+    if (pkg.exports[subpath]) continue;
+    const abs = path.join(base, target);
+    if (!fs.existsSync(abs)) continue;
+    pkg.exports[subpath] = target;
+    changed = true;
+  }
+
+  if (changed) {
+    try {
+      fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
+    } catch { /* best-effort */ }
+  }
+}
+
+function main() {
+  // Patch every reachable agentdb instance, not just the first resolution
+  // result. pnpm/npm hoisting can leave multiple agentdb copies in the
+  // install tree, and consumers may import through any of them.
+  const bases = findAllAgentdbBases();
+  if (bases.length === 0) {
+    // Fall back to the single-base path so we still attempt something
+    // when the directory walk didn't find anything (e.g. unusual installs).
+    const base = findAgentdbBase();
+    if (base) bases.push(base);
+  }
+  for (const base of bases) {
+    try { copySiblings(base); } catch { /* phase 1 best-effort */ }
+  }
+}
+
+main();

package/dist/src/ruvector/diskann-backend.d.ts

@@ -1,78 +0,0 @@
-/**
- * DiskANN Vector Search Backend
- *
- * SSD-friendly approximate nearest neighbor search using Vamana graph.
- * Falls back gracefully to HNSW (@ruvector/router VectorDb) or
- * pure-JS cosine similarity when DiskANN is unavailable.
- *
- * @module v3/cli/ruvector/diskann-backend
- */
-export interface DiskAnnConfig {
-    dim: number;
-    maxDegree?: number;
-    buildBeam?: number;
-    searchBeam?: number;
-    alpha?: number;
-    pqSubspaces?: number;
-    storagePath?: string;
-}
-export interface SearchResult {
-    id: string;
-    distance: number;
-    score: number;
-}
-export type VectorBackend = 'diskann' | 'hnsw' | 'cosine-js';
-/**
- * Check if @ruvector/diskann is available
- */
-export declare function isDiskAnnAvailable(): Promise<boolean>;
-/**
- * Create or get a DiskANN index instance
- */
-export declare function getDiskAnnIndex(config: DiskAnnConfig): Promise<{
-    index: any;
-    backend: VectorBackend;
-}>;
-/**
- * Get the active backend name
- */
-export declare function getActiveBackend(): VectorBackend;
-/**
- * Reset the index (for testing)
- */
-export declare function resetIndex(): void;
-/**
- * Insert a vector into the active backend
- */
-export declare function insertVector(id: string, vector: Float32Array, config?: DiskAnnConfig): Promise<{
-    backend: VectorBackend;
-}>;
-/**
- * Build the index (required for DiskANN before search)
- */
-export declare function buildIndex(config?: DiskAnnConfig): Promise<void>;
-/**
- * Search for k nearest neighbors
- */
-export declare function searchVectors(query: Float32Array, k: number, config?: DiskAnnConfig): Promise<SearchResult[]>;
-export interface BenchmarkResult {
-    backend: VectorBackend;
-    dim: number;
-    vectorCount: number;
-    insertTimeMs: number;
-    buildTimeMs: number;
-    searchTimeMs: number;
-    searchesPerSecond: number;
-    recall: number;
-    memoryMB: number;
-}
-/**
- * Run a benchmark comparing available backends
- */
-export declare function benchmark(opts?: {
-    dim?: number;
-    vectorCount?: number;
-    k?: number;
-    queries?: number;
-}): Promise<BenchmarkResult[]>;
-//# sourceMappingURL=diskann-backend.d.ts.map