@claude-flow/cli 3.44.0 → 3.46.0

package/dist/src/mcp-tools/memory-tools.js

@@ -1015,13 +1015,16 @@ export const memoryTools = [
                         if (nameMatch)
                             name = nameMatch[1].trim();
                     }
-                    // Split into sections for granular search
+                    // Split into sections for granular search. Persist each full section:
+                    // clipping at 4096 characters silently discarded its searchable tail (#3217).
                     const sections = body.split(/^(?=## )/m).filter(s => s.trim().length > 20);
                     if (sections.length === 0 && body.length > 10) {
                         // #1884 — sanitize key so memory_delete can later remove it. Without
                         // this, dangerous chars from frontmatter `name` strand the key.
                         const key = sanitizeMemoryKey(`claude:${memFile.project}:${name}`);
-                        await storeEntry({ key, value: body.slice(0, 4096), namespace: ns, generateEmbeddingFlag: true });
+                        const stored = await storeEntry({ key, value: body, namespace: ns, generateEmbeddingFlag: true });
+                        if (!stored.success)
+                            throw new Error(stored.error || `Failed to store ${key}`);
                         imported++;
                     }
                     else {
@@ -1034,7 +1037,9 @@ export const memoryTools = [
                             // #1884 — sanitize so any dangerous chars in the heading don't
                             // produce keys memory_delete will reject.
                             const key = sanitizeMemoryKey(`claude:${memFile.project}:${name}:${sectionTitle.slice(0, 50)}`);
-                            await storeEntry({ key, value: sectionBody.slice(0, 4096), namespace: ns, generateEmbeddingFlag: true });
+                            const stored = await storeEntry({ key, value: sectionBody, namespace: ns, generateEmbeddingFlag: true });
+                            if (!stored.success)
+                                throw new Error(stored.error || `Failed to store ${key}`);
                             imported++;
                         }
                     }
@@ -1054,7 +1059,7 @@ export const memoryTools = [
             }
             catch { /* probe failed — leave 'unknown' */ }
             return {
-                success: true,
+                success: skipped === 0,
                 imported,
                 skipped,
                 duplicatesSkipped,

package/dist/src/mcp-tools/metaharness-tools.js

@@ -402,7 +402,7 @@ export const metaharnessTools = [
     },
     // ───────────────────────────────────────────────────────────────────────
     // ADR-153 — @metaharness/darwin integration (3 tools).
-    // Backed by the separate `@metaharness/darwin@~0.8.0` npm package, NOT
+    // Backed by the separate `@metaharness/darwin@~0.10.2` npm package, NOT
     // the umbrella `metaharness`. Plugin scripts shell out via _darwin.mjs.
     // Same {success, data, degraded, exitCode} contract.
     // ───────────────────────────────────────────────────────────────────────

package/dist/src/mcp-tools/policy-enforcer.d.ts

@@ -30,10 +30,10 @@
  * misconfiguration defeats the feature. See `evaluateToolCall()`.
  *
  * Known scope limits (disclosed, not fixed here):
- *   - Only wired into the stdio `tools/call` dispatch
- *     (`MCPServerManager.handleMCPMessage`). The separate HTTP/websocket
- *     path (`startHttpServer()`, via `@claude-flow/mcp`) does not call
- *     this module and is unaffected even when this flag is set.
+ *   - Wired into all three stdio `tools/call` dispatchers: the CLI fast
+ *     path, the standalone MCP launcher, and MCPServerManager. The separate
+ *     HTTP/websocket path (`startHttpServer()`, via `@claude-flow/mcp`)
+ *     does not call this module and is unaffected even when this flag is set.
  *
  * `maxToolCallsPerTurn` reset semantics (dream-cycle 2026-09-01, follow-up
  * to 2026-08-31 review round 1): despite the field's name, the original

package/dist/src/mcp-tools/policy-enforcer.js

@@ -30,10 +30,10 @@
  * misconfiguration defeats the feature. See `evaluateToolCall()`.
  *
  * Known scope limits (disclosed, not fixed here):
- *   - Only wired into the stdio `tools/call` dispatch
- *     (`MCPServerManager.handleMCPMessage`). The separate HTTP/websocket
- *     path (`startHttpServer()`, via `@claude-flow/mcp`) does not call
- *     this module and is unaffected even when this flag is set.
+ *   - Wired into all three stdio `tools/call` dispatchers: the CLI fast
+ *     path, the standalone MCP launcher, and MCPServerManager. The separate
+ *     HTTP/websocket path (`startHttpServer()`, via `@claude-flow/mcp`)
+ *     does not call this module and is unaffected even when this flag is set.
  *
  * `maxToolCallsPerTurn` reset semantics (dream-cycle 2026-09-01, follow-up
  * to 2026-08-31 review round 1): despite the field's name, the original

package/dist/src/mcp-tools/terminal-tools.js

@@ -153,6 +153,16 @@ export const terminalTools = [
             const startTime = Date.now();
             let output;
             let exitCode;
+            // dream-cycle 2026-09-21 (post-review): session.env was validated once
+            // at terminal_create time and trusted forever after via the on-disk
+            // store — a session persisted before a denylist update (or a store.json
+            // edited/restored out of band) could carry an env that the *current*
+            // validateEnv() would reject, silently bypassing the denylist for every
+            // execute on that pre-existing session. Re-validate at execution time
+            // too; drop (not fail the whole call) on now-invalid env so a stale
+            // session degrades to a clean environment rather than blocking.
+            const vSessionEnv = validateEnv(session.env, 'session.env');
+            const effectiveEnv = vSessionEnv.valid ? vSessionEnv.sanitized : {};
             try {
                 output = execSync(command, {
                     cwd,
@@ -160,7 +170,7 @@ export const terminalTools = [
                     timeout,
                     maxBuffer: 5 * 1024 * 1024,
                     stdio: ['pipe', 'pipe', 'pipe'],
-                    env: { ...process.env, ...session.env },
+                    env: { ...process.env, ...effectiveEnv },
                 });
                 exitCode = 0;
             }

package/dist/src/mcp-tools/workflow-tools.js

@@ -256,7 +256,7 @@ export const workflowTools = [
             const stepResults = [];
             // Variable substitution: {{name}} → workflow.variables[name] OR steps[stepId].output
             const interp = (text) => {
-                return text.replace(/\{\{\s*([a-zA-Z_][\w.]*)\s*\}\}/g, (_, key) => {
+                return text.replace(/\{\{\s*([a-zA-Z_][\w.-]*)\s*\}\}/g, (_, key) => {
                     // Direct variable
                     if (key in workflow.variables)
                         return String(workflow.variables[key]);

package/dist/src/memory/ewc-consolidation.d.ts

@@ -212,7 +212,13 @@ export declare class EWCConsolidator {
      * Called by SONA after distillLearning to track which patterns
      * are important and should be protected from forgetting.
      *
-     * Uses online averaging: F_new = alpha * F_old + (1-alpha) * F_current
+     * Uses online averaging: F_new = (1 - decay) * F_old + decay * F_current
+     * (same convention as computeFisherMatrix()/recordGradient() above: decay
+     * is the weight given to the new batch, so a small decay — the default,
+     * 0.01 — means the accumulated Fisher decays slowly and survives many
+     * subsequent low-signal calls, per the standard online-EWC/EWC++ update
+     * rule, e.g. Chaudhry et al., "Riemannian Walk for Incremental Learning",
+     * ECCV 2018, arXiv:1801.10112).
      *
      * @param confidenceChanges - Array of {id, embedding, oldConf, newConf}
      */
@@ -235,6 +241,15 @@ export declare class EWCConsolidator {
      * Clear all patterns and history (full reset)
      */
     clear(): void;
+    /**
+     * Validate a loaded globalFisher candidate before trusting it: must be an
+     * array of exactly `dimensions` finite, non-negative numbers. Fisher
+     * values are sums of squares (see computeFisherMatrix/recordGradient/
+     * updateFisherFromConfidences above), so a negative or non-finite entry
+     * means the persisted file is corrupted or from an incompatible layout,
+     * not a legitimate state to resume from.
+     */
+    private isValidFisherArray;
     /**
      * Calculate importance score for a pattern based on usage
      */

package/dist/src/memory/ewc-consolidation.js

@@ -357,38 +357,68 @@ export class EWCConsolidator {
      * Called by SONA after distillLearning to track which patterns
      * are important and should be protected from forgetting.
      *
-     * Uses online averaging: F_new = alpha * F_old + (1-alpha) * F_current
+     * Uses online averaging: F_new = (1 - decay) * F_old + decay * F_current
+     * (same convention as computeFisherMatrix()/recordGradient() above: decay
+     * is the weight given to the new batch, so a small decay — the default,
+     * 0.01 — means the accumulated Fisher decays slowly and survives many
+     * subsequent low-signal calls, per the standard online-EWC/EWC++ update
+     * rule, e.g. Chaudhry et al., "Riemannian Walk for Incremental Learning",
+     * ECCV 2018, arXiv:1801.10112).
      *
      * @param confidenceChanges - Array of {id, embedding, oldConf, newConf}
      */
     updateFisherFromConfidences(confidenceChanges) {
         if (confidenceChanges.length === 0)
             return;
-        const alpha = this.config.fisherDecayRate;
+        const decay = this.config.fisherDecayRate;
         const currentFisher = new Array(this.config.dimensions).fill(0);
         let sampleCount = 0;
         for (const change of confidenceChanges) {
             if (!change.embedding || change.embedding.length === 0)
                 continue;
+            if (!Number.isFinite(change.oldConf) || !Number.isFinite(change.newConf))
+                continue;
             const confDelta = Math.abs(change.newConf - change.oldConf);
             if (confDelta === 0)
                 continue;
-            sampleCount++;
             const len = Math.min(change.embedding.length, this.config.dimensions);
-            // Squared gradient proxy: embedding scaled by confidence change magnitude
+            // Squared gradient proxy: embedding scaled by confidence change magnitude.
+            // Validate the whole sample before folding any of it in -- a single
+            // non-finite embedding dimension (NaN/Infinity) must not silently poison
+            // the shared accumulator for every other pattern in this batch.
+            const sampleFisher = new Array(len);
+            let sampleValid = true;
             for (let i = 0; i < len; i++) {
                 const grad = change.embedding[i] * confDelta;
-                currentFisher[i] += grad * grad;
+                const sq = grad * grad;
+                if (!Number.isFinite(sq)) {
+                    sampleValid = false;
+                    break;
+                }
+                sampleFisher[i] = sq;
             }
-        }
-        if (sampleCount > 0) {
-            for (let i = 0; i < this.config.dimensions; i++) {
-                currentFisher[i] /= sampleCount;
+            if (!sampleValid)
+                continue;
+            sampleCount++;
+            for (let i = 0; i < len; i++) {
+                currentFisher[i] += sampleFisher[i];
             }
         }
-        // Online EMA: F_new = alpha * F_old + (1-alpha) * F_current
+        // No sample contributed usable signal (all filtered out, or every delta was
+        // zero): leave globalFisher and persisted state untouched rather than
+        // decaying accumulated importance toward an empty/no-op batch.
+        if (sampleCount === 0)
+            return;
+        for (let i = 0; i < this.config.dimensions; i++) {
+            currentFisher[i] /= sampleCount;
+        }
+        // Online EMA: F_new = (1 - decay) * F_old + decay * F_current
         for (let i = 0; i < this.config.dimensions; i++) {
-            this.globalFisher[i] = alpha * this.globalFisher[i] + (1 - alpha) * currentFisher[i];
+            const next = (1 - decay) * this.globalFisher[i] + decay * currentFisher[i];
+            // Defensive: never let a non-finite result (e.g. from a corrupted prior
+            // globalFisher[i]) propagate into the live signal -- keep the last known
+            // finite value instead of poisoning it further.
+            this.globalFisher[i] = Number.isFinite(next) ? next : this.globalFisher[i];
         }
         this.saveToDisk();
     }
@@ -432,6 +462,19 @@ export class EWCConsolidator {
     // ============================================================================
     // Private Methods
     // ============================================================================
+    /**
+     * Validate a loaded globalFisher candidate before trusting it: must be an
+     * array of exactly `dimensions` finite, non-negative numbers. Fisher
+     * values are sums of squares (see computeFisherMatrix/recordGradient/
+     * updateFisherFromConfidences above), so a negative or non-finite entry
+     * means the persisted file is corrupted or from an incompatible layout,
+     * not a legitimate state to resume from.
+     */
+    isValidFisherArray(value) {
+        return (Array.isArray(value) &&
+            value.length === this.config.dimensions &&
+            value.every((v) => typeof v === 'number' && Number.isFinite(v) && v >= 0));
+    }
     /**
      * Calculate importance score for a pattern based on usage
      */
@@ -524,8 +567,15 @@ export class EWCConsolidator {
         if (state.version !== '1.0.0') {
             throw new Error(`Unsupported state version: ${state.version}`);
         }
-        // Restore state
-        this.globalFisher = state.globalFisher || new Array(this.config.dimensions).fill(0);
+        // Restore the Fisher matrix, quarantining anything malformed -- wrong
+        // length, non-numeric/non-finite entries (e.g. JSON's lossy NaN/Infinity
+        // -> null round-trip), or negative values (Fisher values are sums of
+        // squares and can never legitimately be negative) -- rather than
+        // silently absorbing corrupted or truncated state into live importance
+        // tracking on restart.
+        this.globalFisher = this.isValidFisherArray(state.globalFisher)
+            ? state.globalFisher
+            : new Array(this.config.dimensions).fill(0);
         // Restore patterns
         this.patterns.clear();
         if (state.patterns) {

package/dist/src/memory/intelligence.d.ts

@@ -248,6 +248,7 @@ export interface UnifiedLearningStats {
         signalsProcessed: number;
         lastAdaptation: number | null;
         source: string;
+        scope: 'project-persisted';
     };
     sona: {
         trajectoriesTotal: number;
@@ -256,6 +257,8 @@ export interface UnifiedLearningStats {
         avgAdaptationTimeMs: number;
         source: string;
         available: boolean;
+        scope: 'process-local';
+        metric: 'recent-buffered-trajectories';
     };
     memoryBridge: {
         totalEntries: number;
@@ -270,8 +273,9 @@ export interface UnifiedLearningStats {
         source: string;
     };
     consistency: {
-        sonaTracksGlobal: boolean;
-        sonaTracksGlobalDelta: number;
+        /** These counters measure different lifetimes and cannot be compared. */
+        sonaTracksGlobal: null;
+        sonaTracksGlobalDelta: null;
         notes: string[];
     };
     generatedAt: string;

package/dist/src/memory/intelligence.js

@@ -701,12 +701,15 @@ export async function getUnifiedLearningStats() {
     let sonaStats = { trajectoriesTotal: 0, patternsLearned: 0, reasoningBankSize: 0, avgAdaptationTimeMs: 0 };
     if (sonaCoord) {
         try {
-            const s = sonaCoord.stats?.() ?? {};
+            const s = sonaCoord.stats();
             sonaStats = {
-                trajectoriesTotal: Number(s.trajectoriesTotal ?? s.trajectoriesProcessed ?? 0),
-                patternsLearned: Number(s.totalPatterns ?? s.patternsLearned ?? 0),
-                reasoningBankSize: bank?.stats?.()?.patternCount ?? 0,
-                avgAdaptationTimeMs: sonaCoord.getAvgAdaptationTime?.() ?? 0,
+                // LocalSonaCoordinator.stats() reports trajectoryCount, a bounded
+                // recent buffer. Reading nonexistent trajectoriesTotal / processed
+                // fields made this metric permanently 0, even after learning.
+                trajectoriesTotal: s.trajectoryCount,
+                patternsLearned: 0,
+                reasoningBankSize: bank?.stats().patternCount ?? 0,
+                avgAdaptationTimeMs: s.avgAdaptationMs,
             };
         }
         catch { /* SONA not yet initialised */ }
@@ -729,11 +732,12 @@ export async function getUnifiedLearningStats() {
         neuralStats = nt.getNeuralStoreStats();
     }
     catch { /* neural module not loadable */ }
-    // Consistency notes — describe (don't enforce) the cross-store relationships
-    const sonaTracksGlobalDelta = sonaStats.trajectoriesTotal - intel.trajectoriesRecorded;
+    // SONA's coordinator is recreated on each process start, while globalStats
+    // is restored from disk. Their counts can differ by thousands after a
+    // restart even when both learning paths work correctly (#3198).
     const notes = [];
-    if (sonaAvailable && Math.abs(sonaTracksGlobalDelta) > 2) {
-        notes.push(`sona.trajectoriesTotal (${sonaStats.trajectoriesTotal}) drifts from globalStats.trajectoriesRecorded (${intel.trajectoriesRecorded}) by ${sonaTracksGlobalDelta} — expected to track within ±1`);
+    if (sonaAvailable && sonaStats.trajectoriesTotal !== intel.trajectoriesRecorded) {
+        notes.push('sona.trajectoriesTotal is a process-local, bounded recent trajectory buffer; global.trajectoriesRecorded is project-persisted. These counters have different lifetimes and are not comparable.');
     }
     if (intel.patternsLearned > 0 && neuralStats.patternCount === 0) {
         notes.push(`globalStats reports ${intel.patternsLearned} patterns learned but neural_patterns store is empty — pretrain has not written here, or trajectory-end isn't promoting patterns to the neural store yet`);
@@ -748,17 +752,20 @@ export async function getUnifiedLearningStats() {
             signalsProcessed: intel.signalsProcessed,
             lastAdaptation: intel.lastAdaptation,
             source: '.claude-flow/neural/stats.json (globalStats)',
+            scope: 'project-persisted',
         },
         sona: {
             ...sonaStats,
             source: 'sonaCoordinator (in-memory, resets per process)',
             available: sonaAvailable,
+            scope: 'process-local',
+            metric: 'recent-buffered-trajectories',
         },
         memoryBridge: bridgeStats,
         neuralPatterns: neuralStats,
         consistency: {
-            sonaTracksGlobal: sonaAvailable ? Math.abs(sonaTracksGlobalDelta) <= 1 : true,
-            sonaTracksGlobalDelta,
+            sonaTracksGlobal: null,
+            sonaTracksGlobalDelta: null,
             notes,
         },
         generatedAt: new Date().toISOString(),

package/dist/src/memory/memory-bridge.js

@@ -565,6 +565,89 @@ async function cacheGet(registry, cacheKey) {
         return null;
     }
 }
+/**
+ * Cross-process cache coherence.
+ *
+ * The TieredCache lives in this process, but the database file is shared:
+ * Claude Code, Codex and Grok each run their own `mcp start` against the
+ * same `.swarm/` store, and each process only invalidates entries on its
+ * OWN writes. A key another process updated or deleted kept coming back
+ * from this process's cache — old value, `found: true` — until the cached
+ * entry expired (TieredCache TTL, 5 minutes by default; reads don't extend
+ * it).
+ *
+ * SQLite's `PRAGMA data_version` changes whenever a DIFFERENT connection has
+ * committed to the database file since this connection last asked, and never
+ * for this connection's own writes (https://sqlite.org/pragma.html#pragma_data_version).
+ * Checking it before a cached read is an exact "has anyone else written?"
+ * test that costs one pragma call. When it moves, drop the whole cache:
+ * every cached shape was derived from the old database state. The first
+ * check on a handle records its baseline and clears: a no-op for a fresh
+ * handle, and the right thing if a handle is ever replaced under a live
+ * cache.
+ *
+ * Native better-sqlite3 handles only. agentdb's sql.js fallback works on a
+ * private in-memory image that never sees another process's commits, so
+ * there is nothing to detect; it is skipped rather than probed. A handle
+ * that cannot prepare the check is remembered and never probed again; a
+ * check that fails on a given read (e.g. SQLITE_BUSY) clears the cache for
+ * safety and is simply retried on the next read.
+ */
+const _cacheDataVersionStmts = new WeakMap();
+const _cacheDataVersions = new WeakMap();
+const _cacheDataVersionUnsupported = new WeakSet();
+function dropCacheIfDbChangedElsewhere(registry, ctx) {
+    // Never let this check break the read it guards: any throw falls back to
+    // the pre-fix behaviour (a possibly stale hit).
+    try {
+        const db = ctx.db;
+        if (!db || ctx.agentdb?.isWasm === true || !('inTransaction' in db))
+            return;
+        if (_cacheDataVersionUnsupported.has(db))
+            return;
+        let stmt = _cacheDataVersionStmts.get(db);
+        if (!stmt) {
+            try {
+                stmt = db.prepare('PRAGMA data_version');
+                _cacheDataVersionStmts.set(db, stmt);
+            }
+            catch {
+                _cacheDataVersionUnsupported.add(db); // structural: this handle can't answer
+                return;
+            }
+        }
+        let cache = null;
+        try {
+            cache = registry.get('tieredCache');
+        }
+        catch { /* no cache, nothing to drop */ }
+        try {
+            const version = stmt.get()?.data_version;
+            if (typeof version !== 'number') {
+                // #3360: an unusable answer is not evidence the store is unchanged.
+                // Same posture as the catch below — a check we cannot validate drops
+                // the cache rather than trusting it, and leaves the baseline alone so
+                // the next read re-checks.
+                if (cache && typeof cache.clear === 'function')
+                    cache.clear();
+                return;
+            }
+            if (_cacheDataVersions.get(db) === version)
+                return;
+            if (cache && typeof cache.clear === 'function')
+                cache.clear();
+            _cacheDataVersions.set(db, version);
+        }
+        catch {
+            // Transient (e.g. SQLITE_BUSY): don't trust the cache for this read.
+            if (cache && typeof cache.clear === 'function')
+                cache.clear();
+        }
+    }
+    catch {
+        // Non-fatal.
+    }
+}
 /**
  * Write to TieredCache after DB write.
  */
@@ -1323,6 +1406,7 @@ export async function bridgeGetEntry(options) {
         const safeNs = String(namespace).replace(/:/g, '_');
         const safeKey = String(key).replace(/:/g, '_');
         const cacheKey = `entry:${safeNs}:${safeKey}`;
+        dropCacheIfDbChangedElsewhere(registry, ctx);
         const cached = await cacheGet(registry, cacheKey);
         if (cached && cached.content) {
             return {

package/dist/src/ruvector/model-router.js

@@ -296,6 +296,24 @@ function envMaxUncertainty() {
         return undefined;
     return n;
 }
+// Dream Cycle 2026-09-17 — env override for priorDecay, mirroring
+// envMaxUncertainty() above. The discounted-Thompson-sampling primitive
+// (see priorDecay's doc comment) was built, tested, and benchmarked in
+// #3049 but shipped with no way to actually turn it on — DEFAULT_CONFIG
+// hardcoded 1 (disabled) with no env/config knob, unlike every sibling
+// tunable in this file. Parsed once at module load; invalid/out-of-range
+// values fall through to the constructor's own priorDecay<=0||>1 guard,
+// which already normalizes to 1 (disabled) — so an unset or malformed env
+// var is fully backward compatible with existing deployments.
+function envPriorDecay() {
+    const raw = process.env.CLAUDE_FLOW_PRIOR_DECAY;
+    if (!raw)
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0 || n > 1)
+        return undefined;
+    return n;
+}
 const DEFAULT_CONFIG = {
     confidenceThreshold: 0.85,
     maxUncertainty: envMaxUncertainty() ?? 0.15,
@@ -305,7 +323,7 @@ const DEFAULT_CONFIG = {
     autoSaveInterval: 1, // Save after every decision for CLI persistence
     enableCostOptimization: true,
     preferSpeed: true,
-    priorDecay: 1,
+    priorDecay: envPriorDecay() ?? 1,
 };
 // Beta shape parameters must stay well clear of 0 for sampleGamma/sampleBeta
 // to remain numerically stable across a persisted, long-running state file —

package/dist/src/services/distill-oracle.js

@@ -43,7 +43,8 @@ import { FableHarness, } from './fable-harness.js';
 // behavior mid-run (the #142 pin-drift failure mode). Pin it, and let
 // scripts/check-metaharness-pins.mjs watch this constant for drift. Kept in
 // lock-step with the optionalDependencies pin in package.json and the plugin
-// darwin cache (versioned by the plugin's own `~0.8.0` pin in _darwin.mjs).
+// darwin cache (versioned by the plugin's own `~0.10.2` pin in _darwin.mjs;
+// both are checked by scripts/check-metaharness-pins.mjs — #3366).
 export const MH_DARWIN_PIN = '0.10.2';
 // ── Public API ───────────────────────────────────────────────────────────
 /**

package/dist/src/services/git-workspace-identity.js

@@ -21,20 +21,17 @@
  * of the resolved directory path (prefixed `dir:`-style via isGit=false), so
  * callers never need a special case.
  */
-import { execFileSync } from 'child_process';
 import { createHash } from 'crypto';
 import { resolve } from 'path';
 import * as fs from 'fs';
+import { safeGitTextSync } from '@claude-flow/security/safe-git';
 const GIT_TIMEOUT_MS = 3000;
 function git(cwd, ...args) {
     try {
-        return execFileSync('git', args, {
-            cwd,
-            encoding: 'utf-8',
-            timeout: GIT_TIMEOUT_MS,
-            stdio: ['ignore', 'pipe', 'ignore'],
-            windowsHide: true,
-        }).trim();
+        return safeGitTextSync(cwd, args, {
+            timeoutMs: GIT_TIMEOUT_MS,
+            stderr: 'ignore',
+        });
     }
     catch {
         return null;