@claude-flow/cli 3.45.0 → 3.46.0

package/dist/src/mcp-tools/terminal-tools.js

@@ -153,6 +153,16 @@ export const terminalTools = [
             const startTime = Date.now();
             let output;
             let exitCode;
+            // dream-cycle 2026-09-21 (post-review): session.env was validated once
+            // at terminal_create time and trusted forever after via the on-disk
+            // store — a session persisted before a denylist update (or a store.json
+            // edited/restored out of band) could carry an env that the *current*
+            // validateEnv() would reject, silently bypassing the denylist for every
+            // execute on that pre-existing session. Re-validate at execution time
+            // too; drop (not fail the whole call) on now-invalid env so a stale
+            // session degrades to a clean environment rather than blocking.
+            const vSessionEnv = validateEnv(session.env, 'session.env');
+            const effectiveEnv = vSessionEnv.valid ? vSessionEnv.sanitized : {};
             try {
                 output = execSync(command, {
                     cwd,
@@ -160,7 +170,7 @@ export const terminalTools = [
                     timeout,
                     maxBuffer: 5 * 1024 * 1024,
                     stdio: ['pipe', 'pipe', 'pipe'],
-                    env: { ...process.env, ...session.env },
+                    env: { ...process.env, ...effectiveEnv },
                 });
                 exitCode = 0;
             }

package/dist/src/mcp-tools/workflow-tools.js

@@ -256,7 +256,7 @@ export const workflowTools = [
             const stepResults = [];
             // Variable substitution: {{name}} → workflow.variables[name] OR steps[stepId].output
             const interp = (text) => {
-                return text.replace(/\{\{\s*([a-zA-Z_][\w.]*)\s*\}\}/g, (_, key) => {
+                return text.replace(/\{\{\s*([a-zA-Z_][\w.-]*)\s*\}\}/g, (_, key) => {
                     // Direct variable
                     if (key in workflow.variables)
                         return String(workflow.variables[key]);

package/dist/src/memory/ewc-consolidation.d.ts

@@ -212,7 +212,13 @@ export declare class EWCConsolidator {
      * Called by SONA after distillLearning to track which patterns
      * are important and should be protected from forgetting.
      *
-     * Uses online averaging: F_new = alpha * F_old + (1-alpha) * F_current
+     * Uses online averaging: F_new = (1 - decay) * F_old + decay * F_current
+     * (same convention as computeFisherMatrix()/recordGradient() above: decay
+     * is the weight given to the new batch, so a small decay — the default,
+     * 0.01 — means the accumulated Fisher decays slowly and survives many
+     * subsequent low-signal calls, per the standard online-EWC/EWC++ update
+     * rule, e.g. Chaudhry et al., "Riemannian Walk for Incremental Learning",
+     * ECCV 2018, arXiv:1801.10112).
      *
      * @param confidenceChanges - Array of {id, embedding, oldConf, newConf}
      */
@@ -235,6 +241,15 @@ export declare class EWCConsolidator {
      * Clear all patterns and history (full reset)
      */
     clear(): void;
+    /**
+     * Validate a loaded globalFisher candidate before trusting it: must be an
+     * array of exactly `dimensions` finite, non-negative numbers. Fisher
+     * values are sums of squares (see computeFisherMatrix/recordGradient/
+     * updateFisherFromConfidences above), so a negative or non-finite entry
+     * means the persisted file is corrupted or from an incompatible layout,
+     * not a legitimate state to resume from.
+     */
+    private isValidFisherArray;
     /**
      * Calculate importance score for a pattern based on usage
      */

package/dist/src/memory/ewc-consolidation.js

@@ -357,38 +357,68 @@ export class EWCConsolidator {
      * Called by SONA after distillLearning to track which patterns
      * are important and should be protected from forgetting.
      *
-     * Uses online averaging: F_new = alpha * F_old + (1-alpha) * F_current
+     * Uses online averaging: F_new = (1 - decay) * F_old + decay * F_current
+     * (same convention as computeFisherMatrix()/recordGradient() above: decay
+     * is the weight given to the new batch, so a small decay — the default,
+     * 0.01 — means the accumulated Fisher decays slowly and survives many
+     * subsequent low-signal calls, per the standard online-EWC/EWC++ update
+     * rule, e.g. Chaudhry et al., "Riemannian Walk for Incremental Learning",
+     * ECCV 2018, arXiv:1801.10112).
      *
      * @param confidenceChanges - Array of {id, embedding, oldConf, newConf}
      */
     updateFisherFromConfidences(confidenceChanges) {
         if (confidenceChanges.length === 0)
             return;
-        const alpha = this.config.fisherDecayRate;
+        const decay = this.config.fisherDecayRate;
         const currentFisher = new Array(this.config.dimensions).fill(0);
         let sampleCount = 0;
         for (const change of confidenceChanges) {
             if (!change.embedding || change.embedding.length === 0)
                 continue;
+            if (!Number.isFinite(change.oldConf) || !Number.isFinite(change.newConf))
+                continue;
             const confDelta = Math.abs(change.newConf - change.oldConf);
             if (confDelta === 0)
                 continue;
-            sampleCount++;
             const len = Math.min(change.embedding.length, this.config.dimensions);
-            // Squared gradient proxy: embedding scaled by confidence change magnitude
+            // Squared gradient proxy: embedding scaled by confidence change magnitude.
+            // Validate the whole sample before folding any of it in -- a single
+            // non-finite embedding dimension (NaN/Infinity) must not silently poison
+            // the shared accumulator for every other pattern in this batch.
+            const sampleFisher = new Array(len);
+            let sampleValid = true;
             for (let i = 0; i < len; i++) {
                 const grad = change.embedding[i] * confDelta;
-                currentFisher[i] += grad * grad;
+                const sq = grad * grad;
+                if (!Number.isFinite(sq)) {
+                    sampleValid = false;
+                    break;
+                }
+                sampleFisher[i] = sq;
             }
-        }
-        if (sampleCount > 0) {
-            for (let i = 0; i < this.config.dimensions; i++) {
-                currentFisher[i] /= sampleCount;
+            if (!sampleValid)
+                continue;
+            sampleCount++;
+            for (let i = 0; i < len; i++) {
+                currentFisher[i] += sampleFisher[i];
             }
         }
-        // Online EMA: F_new = alpha * F_old + (1-alpha) * F_current
+        // No sample contributed usable signal (all filtered out, or every delta was
+        // zero): leave globalFisher and persisted state untouched rather than
+        // decaying accumulated importance toward an empty/no-op batch.
+        if (sampleCount === 0)
+            return;
+        for (let i = 0; i < this.config.dimensions; i++) {
+            currentFisher[i] /= sampleCount;
+        }
+        // Online EMA: F_new = (1 - decay) * F_old + decay * F_current
         for (let i = 0; i < this.config.dimensions; i++) {
-            this.globalFisher[i] = alpha * this.globalFisher[i] + (1 - alpha) * currentFisher[i];
+            const next = (1 - decay) * this.globalFisher[i] + decay * currentFisher[i];
+            // Defensive: never let a non-finite result (e.g. from a corrupted prior
+            // globalFisher[i]) propagate into the live signal -- keep the last known
+            // finite value instead of poisoning it further.
+            this.globalFisher[i] = Number.isFinite(next) ? next : this.globalFisher[i];
         }
         this.saveToDisk();
     }
@@ -432,6 +462,19 @@ export class EWCConsolidator {
     // ============================================================================
     // Private Methods
     // ============================================================================
+    /**
+     * Validate a loaded globalFisher candidate before trusting it: must be an
+     * array of exactly `dimensions` finite, non-negative numbers. Fisher
+     * values are sums of squares (see computeFisherMatrix/recordGradient/
+     * updateFisherFromConfidences above), so a negative or non-finite entry
+     * means the persisted file is corrupted or from an incompatible layout,
+     * not a legitimate state to resume from.
+     */
+    isValidFisherArray(value) {
+        return (Array.isArray(value) &&
+            value.length === this.config.dimensions &&
+            value.every((v) => typeof v === 'number' && Number.isFinite(v) && v >= 0));
+    }
     /**
      * Calculate importance score for a pattern based on usage
      */
@@ -524,8 +567,15 @@ export class EWCConsolidator {
         if (state.version !== '1.0.0') {
             throw new Error(`Unsupported state version: ${state.version}`);
         }
-        // Restore state
-        this.globalFisher = state.globalFisher || new Array(this.config.dimensions).fill(0);
+        // Restore the Fisher matrix, quarantining anything malformed -- wrong
+        // length, non-numeric/non-finite entries (e.g. JSON's lossy NaN/Infinity
+        // -> null round-trip), or negative values (Fisher values are sums of
+        // squares and can never legitimately be negative) -- rather than
+        // silently absorbing corrupted or truncated state into live importance
+        // tracking on restart.
+        this.globalFisher = this.isValidFisherArray(state.globalFisher)
+            ? state.globalFisher
+            : new Array(this.config.dimensions).fill(0);
         // Restore patterns
         this.patterns.clear();
         if (state.patterns) {

package/dist/src/memory/intelligence.d.ts

@@ -248,6 +248,7 @@ export interface UnifiedLearningStats {
         signalsProcessed: number;
         lastAdaptation: number | null;
         source: string;
+        scope: 'project-persisted';
     };
     sona: {
         trajectoriesTotal: number;
@@ -256,6 +257,8 @@ export interface UnifiedLearningStats {
         avgAdaptationTimeMs: number;
         source: string;
         available: boolean;
+        scope: 'process-local';
+        metric: 'recent-buffered-trajectories';
     };
     memoryBridge: {
         totalEntries: number;
@@ -270,8 +273,9 @@ export interface UnifiedLearningStats {
         source: string;
     };
     consistency: {
-        sonaTracksGlobal: boolean;
-        sonaTracksGlobalDelta: number;
+        /** These counters measure different lifetimes and cannot be compared. */
+        sonaTracksGlobal: null;
+        sonaTracksGlobalDelta: null;
         notes: string[];
     };
     generatedAt: string;

package/dist/src/memory/intelligence.js

@@ -701,12 +701,15 @@ export async function getUnifiedLearningStats() {
     let sonaStats = { trajectoriesTotal: 0, patternsLearned: 0, reasoningBankSize: 0, avgAdaptationTimeMs: 0 };
     if (sonaCoord) {
         try {
-            const s = sonaCoord.stats?.() ?? {};
+            const s = sonaCoord.stats();
             sonaStats = {
-                trajectoriesTotal: Number(s.trajectoriesTotal ?? s.trajectoriesProcessed ?? 0),
-                patternsLearned: Number(s.totalPatterns ?? s.patternsLearned ?? 0),
-                reasoningBankSize: bank?.stats?.()?.patternCount ?? 0,
-                avgAdaptationTimeMs: sonaCoord.getAvgAdaptationTime?.() ?? 0,
+                // LocalSonaCoordinator.stats() reports trajectoryCount, a bounded
+                // recent buffer. Reading nonexistent trajectoriesTotal / processed
+                // fields made this metric permanently 0, even after learning.
+                trajectoriesTotal: s.trajectoryCount,
+                patternsLearned: 0,
+                reasoningBankSize: bank?.stats().patternCount ?? 0,
+                avgAdaptationTimeMs: s.avgAdaptationMs,
             };
         }
         catch { /* SONA not yet initialised */ }
@@ -729,11 +732,12 @@ export async function getUnifiedLearningStats() {
         neuralStats = nt.getNeuralStoreStats();
     }
     catch { /* neural module not loadable */ }
-    // Consistency notes — describe (don't enforce) the cross-store relationships
-    const sonaTracksGlobalDelta = sonaStats.trajectoriesTotal - intel.trajectoriesRecorded;
+    // SONA's coordinator is recreated on each process start, while globalStats
+    // is restored from disk. Their counts can differ by thousands after a
+    // restart even when both learning paths work correctly (#3198).
     const notes = [];
-    if (sonaAvailable && Math.abs(sonaTracksGlobalDelta) > 2) {
-        notes.push(`sona.trajectoriesTotal (${sonaStats.trajectoriesTotal}) drifts from globalStats.trajectoriesRecorded (${intel.trajectoriesRecorded}) by ${sonaTracksGlobalDelta} — expected to track within ±1`);
+    if (sonaAvailable && sonaStats.trajectoriesTotal !== intel.trajectoriesRecorded) {
+        notes.push('sona.trajectoriesTotal is a process-local, bounded recent trajectory buffer; global.trajectoriesRecorded is project-persisted. These counters have different lifetimes and are not comparable.');
     }
     if (intel.patternsLearned > 0 && neuralStats.patternCount === 0) {
         notes.push(`globalStats reports ${intel.patternsLearned} patterns learned but neural_patterns store is empty — pretrain has not written here, or trajectory-end isn't promoting patterns to the neural store yet`);
@@ -748,17 +752,20 @@ export async function getUnifiedLearningStats() {
             signalsProcessed: intel.signalsProcessed,
             lastAdaptation: intel.lastAdaptation,
             source: '.claude-flow/neural/stats.json (globalStats)',
+            scope: 'project-persisted',
         },
         sona: {
             ...sonaStats,
             source: 'sonaCoordinator (in-memory, resets per process)',
             available: sonaAvailable,
+            scope: 'process-local',
+            metric: 'recent-buffered-trajectories',
         },
         memoryBridge: bridgeStats,
         neuralPatterns: neuralStats,
         consistency: {
-            sonaTracksGlobal: sonaAvailable ? Math.abs(sonaTracksGlobalDelta) <= 1 : true,
-            sonaTracksGlobalDelta,
+            sonaTracksGlobal: null,
+            sonaTracksGlobalDelta: null,
             notes,
         },
         generatedAt: new Date().toISOString(),

package/dist/src/memory/memory-bridge.js

@@ -565,6 +565,89 @@ async function cacheGet(registry, cacheKey) {
         return null;
     }
 }
+/**
+ * Cross-process cache coherence.
+ *
+ * The TieredCache lives in this process, but the database file is shared:
+ * Claude Code, Codex and Grok each run their own `mcp start` against the
+ * same `.swarm/` store, and each process only invalidates entries on its
+ * OWN writes. A key another process updated or deleted kept coming back
+ * from this process's cache — old value, `found: true` — until the cached
+ * entry expired (TieredCache TTL, 5 minutes by default; reads don't extend
+ * it).
+ *
+ * SQLite's `PRAGMA data_version` changes whenever a DIFFERENT connection has
+ * committed to the database file since this connection last asked, and never
+ * for this connection's own writes (https://sqlite.org/pragma.html#pragma_data_version).
+ * Checking it before a cached read is an exact "has anyone else written?"
+ * test that costs one pragma call. When it moves, drop the whole cache:
+ * every cached shape was derived from the old database state. The first
+ * check on a handle records its baseline and clears: a no-op for a fresh
+ * handle, and the right thing if a handle is ever replaced under a live
+ * cache.
+ *
+ * Native better-sqlite3 handles only. agentdb's sql.js fallback works on a
+ * private in-memory image that never sees another process's commits, so
+ * there is nothing to detect; it is skipped rather than probed. A handle
+ * that cannot prepare the check is remembered and never probed again; a
+ * check that fails on a given read (e.g. SQLITE_BUSY) clears the cache for
+ * safety and is simply retried on the next read.
+ */
+const _cacheDataVersionStmts = new WeakMap();
+const _cacheDataVersions = new WeakMap();
+const _cacheDataVersionUnsupported = new WeakSet();
+function dropCacheIfDbChangedElsewhere(registry, ctx) {
+    // Never let this check break the read it guards: any throw falls back to
+    // the pre-fix behaviour (a possibly stale hit).
+    try {
+        const db = ctx.db;
+        if (!db || ctx.agentdb?.isWasm === true || !('inTransaction' in db))
+            return;
+        if (_cacheDataVersionUnsupported.has(db))
+            return;
+        let stmt = _cacheDataVersionStmts.get(db);
+        if (!stmt) {
+            try {
+                stmt = db.prepare('PRAGMA data_version');
+                _cacheDataVersionStmts.set(db, stmt);
+            }
+            catch {
+                _cacheDataVersionUnsupported.add(db); // structural: this handle can't answer
+                return;
+            }
+        }
+        let cache = null;
+        try {
+            cache = registry.get('tieredCache');
+        }
+        catch { /* no cache, nothing to drop */ }
+        try {
+            const version = stmt.get()?.data_version;
+            if (typeof version !== 'number') {
+                // #3360: an unusable answer is not evidence the store is unchanged.
+                // Same posture as the catch below — a check we cannot validate drops
+                // the cache rather than trusting it, and leaves the baseline alone so
+                // the next read re-checks.
+                if (cache && typeof cache.clear === 'function')
+                    cache.clear();
+                return;
+            }
+            if (_cacheDataVersions.get(db) === version)
+                return;
+            if (cache && typeof cache.clear === 'function')
+                cache.clear();
+            _cacheDataVersions.set(db, version);
+        }
+        catch {
+            // Transient (e.g. SQLITE_BUSY): don't trust the cache for this read.
+            if (cache && typeof cache.clear === 'function')
+                cache.clear();
+        }
+    }
+    catch {
+        // Non-fatal.
+    }
+}
 /**
  * Write to TieredCache after DB write.
  */
@@ -1323,6 +1406,7 @@ export async function bridgeGetEntry(options) {
         const safeNs = String(namespace).replace(/:/g, '_');
         const safeKey = String(key).replace(/:/g, '_');
         const cacheKey = `entry:${safeNs}:${safeKey}`;
+        dropCacheIfDbChangedElsewhere(registry, ctx);
         const cached = await cacheGet(registry, cacheKey);
         if (cached && cached.content) {
             return {

package/dist/src/ruvector/model-router.js

@@ -296,6 +296,24 @@ function envMaxUncertainty() {
         return undefined;
     return n;
 }
+// Dream Cycle 2026-09-17 — env override for priorDecay, mirroring
+// envMaxUncertainty() above. The discounted-Thompson-sampling primitive
+// (see priorDecay's doc comment) was built, tested, and benchmarked in
+// #3049 but shipped with no way to actually turn it on — DEFAULT_CONFIG
+// hardcoded 1 (disabled) with no env/config knob, unlike every sibling
+// tunable in this file. Parsed once at module load; invalid/out-of-range
+// values fall through to the constructor's own priorDecay<=0||>1 guard,
+// which already normalizes to 1 (disabled) — so an unset or malformed env
+// var is fully backward compatible with existing deployments.
+function envPriorDecay() {
+    const raw = process.env.CLAUDE_FLOW_PRIOR_DECAY;
+    if (!raw)
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0 || n > 1)
+        return undefined;
+    return n;
+}
 const DEFAULT_CONFIG = {
     confidenceThreshold: 0.85,
     maxUncertainty: envMaxUncertainty() ?? 0.15,
@@ -305,7 +323,7 @@ const DEFAULT_CONFIG = {
     autoSaveInterval: 1, // Save after every decision for CLI persistence
     enableCostOptimization: true,
     preferSpeed: true,
-    priorDecay: 1,
+    priorDecay: envPriorDecay() ?? 1,
 };
 // Beta shape parameters must stay well clear of 0 for sampleGamma/sampleBeta
 // to remain numerically stable across a persisted, long-running state file —

package/dist/src/services/distill-oracle.js

@@ -43,7 +43,8 @@ import { FableHarness, } from './fable-harness.js';
 // behavior mid-run (the #142 pin-drift failure mode). Pin it, and let
 // scripts/check-metaharness-pins.mjs watch this constant for drift. Kept in
 // lock-step with the optionalDependencies pin in package.json and the plugin
-// darwin cache (versioned by the plugin's own `~0.8.0` pin in _darwin.mjs).
+// darwin cache (versioned by the plugin's own `~0.10.2` pin in _darwin.mjs;
+// both are checked by scripts/check-metaharness-pins.mjs — #3366).
 export const MH_DARWIN_PIN = '0.10.2';
 // ── Public API ───────────────────────────────────────────────────────────
 /**

package/dist/src/services/git-workspace-identity.js

@@ -21,20 +21,17 @@
  * of the resolved directory path (prefixed `dir:`-style via isGit=false), so
  * callers never need a special case.
  */
-import { execFileSync } from 'child_process';
 import { createHash } from 'crypto';
 import { resolve } from 'path';
 import * as fs from 'fs';
+import { safeGitTextSync } from '@claude-flow/security/safe-git';
 const GIT_TIMEOUT_MS = 3000;
 function git(cwd, ...args) {
     try {
-        return execFileSync('git', args, {
-            cwd,
-            encoding: 'utf-8',
-            timeout: GIT_TIMEOUT_MS,
-            stdio: ['ignore', 'pipe', 'ignore'],
-            windowsHide: true,
-        }).trim();
+        return safeGitTextSync(cwd, args, {
+            timeoutMs: GIT_TIMEOUT_MS,
+            stderr: 'ignore',
+        });
     }
     catch {
         return null;

package/dist/src/services/policy-runtime.js

@@ -1,14 +1,39 @@
 import { AgenticPolicyEngine, createLegacyCompatibleState, isMcpCallerAuthEnabled, decodeTokenEnvelope, publicKeyFromHex, verifyInvocationToken, } from '@claude-flow/security';
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readlinkSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-import { userInfo } from 'node:os';
+import { hostname, userInfo } from 'node:os';
 const POLICY_DIR = join('.claude-flow', 'policy');
 const POLICY_FILE = 'state.json';
 const LOCK_FILE = 'state.lock';
 const LOCK_STALE_MS = 30_000;
 const LOCK_WAIT_MS = 5_000;
+// A lock is ~170 bytes plus the hostname (at most 255 bytes).
+const LOCK_MAX_BYTES = 1_024;
+// Linux PID namespace of this process, e.g. `pid:[4026531836]`; undefined on
+// other platforms or without /proc. Recorded in the lock because a pid only
+// identifies a process inside the namespace that wrote it.
+const PID_NAMESPACE = (() => {
+    try {
+        return readlinkSync('/proc/self/ns/pid');
+    }
+    catch {
+        return undefined;
+    }
+})();
+// Linux boot id: one uuid per kernel boot, shared by every process on that
+// kernel and readable inside containers. Recorded because `host` is only a
+// name: two machines that share a project directory can report the same
+// hostname, and the init PID namespace has the same inode on every Linux host.
+const BOOT_ID = (() => {
+    try {
+        return readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+    }
+    catch {
+        return undefined;
+    }
+})();
 function paths(projectRoot) {
     const root = resolve(projectRoot);
     const dir = join(root, POLICY_DIR);
@@ -17,12 +42,96 @@ function paths(projectRoot) {
 function sleep(ms) {
     return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
 }
+/**
+ * Signal-0 existence probe, as in #1799 (`isPidAlive` in swarm-tools.ts), but
+ * only ESRCH counts as dead (as `processIsAlive` in helper-refresh.ts): here a
+ * false "dead" breaks mutual exclusion, so EPERM (another user's process) and
+ * any unexpected error mean alive.
+ */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code !== 'ESRCH';
+    }
+}
+/**
+ * Reads a lock only if it is a small regular file: never follows a symlink,
+ * never blocks on a FIFO or device, never reads more than LOCK_MAX_BYTES.
+ * Anything else returns undefined and the caller keeps the mtime rule.
+ */
+function readLockFile(lockPath) {
+    if (!lstatSync(lockPath).isFile())
+        return undefined;
+    const fd = openSync(lockPath, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0));
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > LOCK_MAX_BYTES)
+            return undefined;
+        const buffer = Buffer.alloc(LOCK_MAX_BYTES);
+        return buffer.toString('utf8', 0, readSync(fd, buffer, 0, LOCK_MAX_BYTES, 0));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * A process killed inside a transaction (SIGKILL, OOM, or a signal whose
+ * default action terminates it) never runs `finally { release() }`, so every
+ * caller, MCP reads included, waited LOCK_WAIT_MS and failed with
+ * policy-state-lock-timeout until the orphan's mtime crossed LOCK_STALE_MS.
+ * The pid is trusted only if the lock was written by this OS, on this kernel
+ * boot and in this PID namespace: anywhere else (a bwrap --unshare-pid
+ * sandbox, a container, another machine on a shared filesystem) a live owner
+ * also answers ESRCH. Locks without that identity (older ruflo, a crash
+ * between create and write, anything unparsable) return false and keep the
+ * mtime rule.
+ */
+function lockOwnerIsDead(lockPath) {
+    try {
+        const read = readLockFile(lockPath);
+        if (read === undefined)
+            return false;
+        const owner = JSON.parse(read);
+        if (!owner || owner.host !== hostname() || owner.platform !== process.platform
+            || owner.pidns !== PID_NAMESPACE || owner.boot !== BOOT_ID)
+            return false;
+        // Without /proc, one Linux kernel boot or PID namespace cannot be told
+        // from another, and `host` is only a name.
+        if (process.platform === 'linux'
+            && (PID_NAMESPACE === undefined || BOOT_ID === undefined))
+            return false;
+        const pid = owner.pid;
+        if (typeof pid !== 'number' || !Number.isInteger(pid) || pid <= 0 || pid > 0x7fffffff
+            || isPidAlive(pid))
+            return false;
+        // The lock can change hands while it is read and probed (its owner
+        // releases and exits, another process acquires). Re-read it and answer
+        // only if it is byte for byte the lock that was read: the next owner's
+        // lock always differs in `pid` or `acquiredAt`. `dev`/`ino`/`ctime` cannot
+        // stand in for that — ext4 reuses a freed inode number at once, and before
+        // Linux 6.13 two files created in one clock tick share a ctime.
+        return readLockFile(lockPath) === read;
+    }
+    catch {
+        return false;
+    }
+}
 async function acquireLock(lockPath) {
     const started = Date.now();
     while (Date.now() - started < LOCK_WAIT_MS) {
         try {
             const fd = openSync(lockPath, 'wx', 0o600);
-            writeFileSync(fd, JSON.stringify({ pid: process.pid, acquiredAt: Date.now() }));
+            writeFileSync(fd, JSON.stringify({
+                pid: process.pid,
+                acquiredAt: Date.now(),
+                host: hostname(),
+                platform: process.platform,
+                pidns: PID_NAMESPACE,
+                boot: BOOT_ID,
+            }));
             closeSync(fd);
             return () => {
                 try {
@@ -33,7 +142,8 @@ async function acquireLock(lockPath) {
         }
         catch {
             try {
-                if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS)
+                if (lockOwnerIsDead(lockPath)
+                    || Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS)
                     unlinkSync(lockPath);
             }
             catch { /* another process changed the lock */ }

package/dist/src/services/worker-daemon.js

@@ -14,6 +14,7 @@ import { EventEmitter } from 'events';
 import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, unlinkSync } from 'fs';
 import { cpus } from 'os';
 import { join } from 'path';
+import { createRequire } from 'node:module';
 import { writeFileAtomic } from '../fs-secure.js';
 import { HeadlessWorkerExecutor, isHeadlessWorker, } from './headless-worker-executor.js';
 // ADR-174 M3: the consolidate worker below drives the real DISTILL/CONSOLIDATE
@@ -26,6 +27,9 @@ import { backupMemoryDb } from './memory-backup.js';
 import { resolveGitWorkspaceIdentity } from './git-workspace-identity.js';
 import { getWorkspaceLeaseRegistry } from './workspace-lease.js';
 import { getRepoSupervisorRegistry } from './repo-supervisor.js';
+// Daemon config is read synchronously from the constructor. In an ESM build,
+// bare `require` is undefined, so use a module-relative require for YAML.
+const requireYaml = createRequire(import.meta.url);
 // Default worker configurations with improved intervals (P0 fix: map 5min -> 15min)
 const DEFAULT_WORKERS = [
     { type: 'map', intervalMs: 15 * 60 * 1000, offsetMs: 0, priority: 'normal', description: 'Codebase mapping', enabled: true },
@@ -368,8 +372,7 @@ export class WorkerDaemon extends EventEmitter {
             try {
                 // Lazy-load yaml so the daemon doesn't hard-require it; if the
                 // dep isn't installed, fall back to the previous warn-only path.
-                // eslint-disable-next-line @typescript-eslint/no-var-requires
-                const yamlMod = require('yaml');
+                const yamlMod = requireYaml('yaml');
                 const parsed = yamlMod.parse(readFileSync(yPath, 'utf-8'));
                 if (parsed && typeof parsed === 'object') {
                     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -1013,7 +1016,9 @@ export class WorkerDaemon extends EventEmitter {
             return `max age ${Math.round(ttlMs / 1000)}s reached`;
         }
         if (idleMs > 0) {
-            const lastActivity = this.lastWorkerActivityMs() ?? startedMs;
+            // Worker timestamps survive restarts; they cannot make this process
+            // idle before it has been alive for a full idle window (#3194).
+            const lastActivity = Math.max(this.lastWorkerActivityMs() ?? startedMs, startedMs);
             if (now - lastActivity >= idleMs) {
                 return `idle for ${Math.round(idleMs / 1000)}s (no worker activity)`;
             }

package/node_modules/@claude-flow/codex/dist/worktrees/coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../src/worktrees/coordinator.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAcD,qBAAa,wBAAwB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAElB,QAAQ,EAAE,MAAM;IAQ5B,OAAO,CACL,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,EACjD,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACvD,iBAAiB;IA+CpB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB;IAkBxC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAYnE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE;IAgBjE,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,WAAW;CAKpB"}
+{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../src/worktrees/coordinator.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAUD,qBAAa,wBAAwB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAElB,QAAQ,EAAE,MAAM;IAQ5B,OAAO,CACL,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,EACjD,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACvD,iBAAiB;IA+CpB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB;IAkBxC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAYnE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE;IAgBjE,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,WAAW;CAKpB"}