@claude-flow/cli 3.45.0 → 3.46.1

package/node_modules/@claude-flow/security/dist/input-validator.d.ts

@@ -159,14 +159,14 @@ export declare const SpawnAgentSchema: z.ZodObject<{
     timeout: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
+    id?: string | undefined;
 }, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
+    id?: string | undefined;
 }>;
 /**
  * Task input schema
@@ -181,13 +181,13 @@ export declare const TaskInputSchema: z.ZodObject<{
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "low" | "medium" | "high" | "critical" | undefined;
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }, {
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "low" | "medium" | "high" | "critical" | undefined;
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }>;
 /**
@@ -234,16 +234,16 @@ export declare const ExecutorConfigSchema: z.ZodObject<{
     cwd: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
     allowSudo: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    timeout: number;
     allowedCommands: string[];
+    timeout: number;
     maxBuffer: number;
     allowSudo: boolean;
     blockedPatterns?: string[] | undefined;
     cwd?: string | undefined;
 }, {
     allowedCommands: string[];
-    timeout?: number | undefined;
     blockedPatterns?: string[] | undefined;
+    timeout?: number | undefined;
     maxBuffer?: number | undefined;
     cwd?: string | undefined;
     allowSudo?: boolean | undefined;

package/node_modules/@claude-flow/security/dist/safe-git.d.ts

@@ -0,0 +1,22 @@
+export interface SafeGitSyncOptions {
+    readonly maxBuffer?: number;
+    readonly timeoutMs?: number;
+    readonly stderr?: 'pipe' | 'ignore';
+}
+/**
+ * Build the argument vector used for every RuFlo-controlled Git subprocess.
+ *
+ * `core.fsmonitor` is command-bearing repository-local configuration. A copied
+ * repository can therefore select a host command that Git executes while
+ * refreshing its index. Command-line `-c` has higher precedence than local
+ * repository configuration, so this invariant must precede every repository
+ * operation that RuFlo performs itself.
+ *
+ * This deliberately does not claim that every command-bearing Git setting is
+ * neutralized. Keep the wrapper as the single policy point so additional
+ * reviewed overrides can be added without auditing every caller again.
+ */
+export declare function safeGitArgv(repoRoot: string, args: readonly string[]): string[];
+export declare function safeGitTextSync(repoRoot: string, args: readonly string[], options?: SafeGitSyncOptions): string;
+export declare function safeGitBufferSync(repoRoot: string, args: readonly string[], options?: SafeGitSyncOptions): Buffer;
+//# sourceMappingURL=safe-git.d.ts.map

package/node_modules/@claude-flow/security/dist/safe-git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-git.d.ts","sourceRoot":"","sources":["../src/safe-git.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACrC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAI/E;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAQR;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAQR"}

package/node_modules/@claude-flow/security/dist/safe-git.js

@@ -0,0 +1,63 @@
+import { execFileSync } from 'node:child_process';
+const GIT_CONFIG_OVERRIDE = ['-c', 'core.fsmonitor=false'];
+const DEFAULT_MAX_BUFFER = 4 * 1024 * 1024;
+/**
+ * Build the argument vector used for every RuFlo-controlled Git subprocess.
+ *
+ * `core.fsmonitor` is command-bearing repository-local configuration. A copied
+ * repository can therefore select a host command that Git executes while
+ * refreshing its index. Command-line `-c` has higher precedence than local
+ * repository configuration, so this invariant must precede every repository
+ * operation that RuFlo performs itself.
+ *
+ * This deliberately does not claim that every command-bearing Git setting is
+ * neutralized. Keep the wrapper as the single policy point so additional
+ * reviewed overrides can be added without auditing every caller again.
+ */
+export function safeGitArgv(repoRoot, args) {
+    assertGitPath(repoRoot);
+    for (const arg of args)
+        assertGitArgument(arg);
+    return [...GIT_CONFIG_OVERRIDE, '-C', repoRoot, ...args];
+}
+export function safeGitTextSync(repoRoot, args, options = {}) {
+    return execFileSync('git', safeGitArgv(repoRoot, args), {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', options.stderr ?? 'pipe'],
+        maxBuffer: boundedMaxBuffer(options.maxBuffer),
+        ...(options.timeoutMs === undefined ? {} : { timeout: boundedTimeout(options.timeoutMs) }),
+        windowsHide: true,
+    }).trim();
+}
+export function safeGitBufferSync(repoRoot, args, options = {}) {
+    return execFileSync('git', safeGitArgv(repoRoot, args), {
+        encoding: 'buffer',
+        stdio: ['ignore', 'pipe', options.stderr ?? 'pipe'],
+        maxBuffer: boundedMaxBuffer(options.maxBuffer),
+        ...(options.timeoutMs === undefined ? {} : { timeout: boundedTimeout(options.timeoutMs) }),
+        windowsHide: true,
+    });
+}
+function assertGitPath(value) {
+    if (value.length === 0 || value.includes('\0')) {
+        throw new Error('Git repository path is invalid');
+    }
+}
+function assertGitArgument(value) {
+    if (value.includes('\0'))
+        throw new Error('Git argument contains a NUL byte');
+}
+function boundedMaxBuffer(value) {
+    const resolved = value ?? DEFAULT_MAX_BUFFER;
+    if (!Number.isSafeInteger(resolved) || resolved < 1024 || resolved > 256 * 1024 * 1024) {
+        throw new Error('Git maxBuffer is outside the supported range');
+    }
+    return resolved;
+}
+function boundedTimeout(value) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > 120_000) {
+        throw new Error('Git timeout is outside the supported range');
+    }
+    return value;
+}
+//# sourceMappingURL=safe-git.js.map

package/node_modules/@claude-flow/security/dist/safe-git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-git.js","sourceRoot":"","sources":["../src/safe-git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAU,CAAC;AACpE,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAQ3C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAuB;IACnE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,IAAuB,EACvB,UAA8B,EAAE;IAEhC,OAAO,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE;QACtD,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QACnD,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,IAAuB,EACvB,UAA8B,EAAE;IAEhC,OAAO,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE;QACtD,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;QACnD,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,QAAQ,GAAG,KAAK,IAAI,kBAAkB,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,IAAI,IAAI,QAAQ,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.45.0",
+  "version": "3.46.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -98,10 +98,10 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@claude-flow/cli-core": "3.7.0-alpha.5",
+    "@claude-flow/cli-core": "3.7.0-alpha.6",
     "@claude-flow/codex": "3.0.3",
     "@claude-flow/mcp": "3.0.0-alpha.10",
-    "@claude-flow/neural": "3.0.0-alpha.9",
+    "@claude-flow/neural": "3.0.0-alpha.10",
     "@claude-flow/plugin-agent-federation": "1.0.0-alpha.18",
     "@claude-flow/security": "3.0.0-alpha.14",
     "@claude-flow/shared": "3.0.0-alpha.7",
@@ -125,11 +125,11 @@
     "ws": "^8.21.0",
     "yaml": "^2.8.0",
     "zod": "^3.22.0",
-    "@claude-flow/memory": "3.0.0-alpha.25"
+    "@claude-flow/memory": "3.0.0-alpha.26"
   },
   "optionalDependencies": {
     "@agntcy/slim-bindings": "2.0.0-alpha.5",
-    "@claude-flow/memory": "3.0.0-alpha.25",
+    "@claude-flow/memory": "3.0.0-alpha.26",
     "@metaharness/darwin": "~0.10.2",
     "@metaharness/flywheel": "~0.1.10",
     "@metaharness/radio": "~0.1.0",

package/plugins/ruflo-metaharness/agents/metaharness-architect.md

@@ -38,7 +38,7 @@ needs its own ADR.
 
 ## Tools (subprocess-only, no library imports)
 
-- All skills shell out to the pinned `metaharness` / `harness` binaries (`metaharness@~0.3.0`, local install or one-time versioned cache — never `@latest`) via the `_harness.mjs` shared helper.
+- All skills shell out to the pinned `metaharness` / `harness` binaries (`metaharness@~0.4.1`, local install or one-time versioned cache — never `@latest`) via the `_harness.mjs` shared helper.
 - 60s hard timeout per subprocess.
 - Output captured + parsed; `--json` flag forced unless the script opts out.
 - No `@metaharness/*` import statement appears outside the optional-router path in `v3/@claude-flow/cli/src/ruvector/neural-router.ts`.

package/plugins/ruflo-metaharness/commands/ruflo-metaharness.md

@@ -4,7 +4,7 @@ description: MetaHarness integration — score, genome, mint, mcp-scan, threat-m
 ---
 
 MetaHarness integration commands. All shell out to the PINNED
-`metaharness`/`harness` binaries (`metaharness@~0.3.0` — resolved from a local
+`metaharness`/`harness` binaries (`metaharness@~0.4.1` — resolved from a local
 install or a one-time `~/.ruflo/metaharness-cache-<pin>` install, never
 `@latest`) via the `_harness.mjs` shared helper; no library imports on
 ruflo's boot path.

package/plugins/ruflo-metaharness/scripts/_darwin.mjs

@@ -2,16 +2,17 @@
 //
 // Mirrors `_harness.mjs` for the umbrella `metaharness` / `harness` binaries,
 // but targets the separate darwin binary (`metaharness-darwin`) which is
-// published as its own npm package (`@metaharness/darwin@~0.8.0`).
+// published as its own npm package (`@metaharness/darwin@~0.10.2`).
 //
 // Shared plumbing (degraded classification, --json injection, trailing-JSON
 // parse, degraded emitter) lives in `_invoke.mjs`. What stays here is the
 // genuinely-darwin part: the ASYNC STREAMING variant (`runDarwinAsync`) that
 // long `evolve` runs need for per-generation progress visibility.
 //
-// Three subcommands surfaced (matches darwin 0.8.x — same verbs as 0.3.x,
-// with GEPA-engine evolve flags added upstream: --selection modes,
-// --crossover, --epistasis, --curriculum, --mutator ruvllm, --sandbox):
+// Three subcommands surfaced (matches darwin 0.8.x-0.10.x — same verbs as
+// 0.3.x, with GEPA-engine evolve flags added upstream: --selection modes,
+// --crossover, --epistasis, --curriculum, --mutator ruvllm, --sandbox;
+// 0.10.x only ADDS `evolve-numeric`, which this helper does not surface):
 //   - `metaharness-darwin evolve <repo> [...]`         — harness self-improvement
 //   - `metaharness-darwin bench <create|verify> ...`   — bench-suite lifecycle
 //   - `metaharness-darwin security bench [...]`        — Darwin Shield (upstream ADR-155)
@@ -31,23 +32,43 @@
 //   matched to their --generations × --children × sandbox cost; the 60s
 //   default is for `bench verify` and `security bench --population 2 --cycles 1`
 //   smoke shapes only.
+//
+// RESOLUTION (#3366 — was `npx -y -p @metaharness/darwin@<pin>` on every call)
+//   Same order as _harness.mjs: (a) an installed @metaharness/darwin that
+//   satisfies the pin (the @claude-flow/cli optionalDependency — free), then
+//   (b) the one-time versioned `~/.ruflo/darwin-cache-<pin>` install that gepa
+//   already shares, then `process.execPath <abs bin>` with shell:false. The
+//   npx path had npm resolve the range on every evolve / bench /
+//   security-bench call (registry or npx cache state), ignored the copy ruflo
+//   ships, and could run a different darwin than the gepa import in the same
+//   plugin. (a) searches ruflo's own tree only — see findLocalPackageDir's
+//   `fromCwd` in _invoke.mjs.
 
 import { spawnSync, spawn } from 'node:child_process';
 import {
   classifyDegraded,
+  ensureCachedInstall,
+  findLocalPackageDir,
   importOptionalLibrary,
   injectJson,
   makeDegradedEmitter,
+  packageBinRelPath,
   parseTrailingJson,
+  resolvePackageBin,
 } from './_invoke.mjs';
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 
-// Pinned semver range. Bump in lock-step with optionalDependencies in
-// @claude-flow/cli/package.json + ruflo/package.json. The `~` allows
-// patch upgrades without re-pinning.
+// Pinned semver range. The `~` allows patch upgrades without re-pinning.
+// Must cover the `@metaharness/darwin` optionalDependency range in
+// v3/@claude-flow/cli/package.json (`~0.10.2`). It sat at ~0.8.0 while that
+// range moved to ~0.9.0 (#2958) and ~0.10.2 (#3262), because the pin-drift
+// guard only compared MH_DARWIN_PIN (distill-oracle.ts). This range picks
+// the darwin version the evolve / bench / security-bench tools run and the
+// gepa cache fallback installs; scripts/check-metaharness-pins.mjs now fails
+// when it no longer covers the declared range.
 const DARWIN_PKG = '@metaharness/darwin';
-const DARWIN_PIN_VERSION = '~0.8.0';
+const DARWIN_PIN_VERSION = '~0.10.2';
 const DARWIN_PIN = `${DARWIN_PKG}@${DARWIN_PIN_VERSION}`;
 
 const REASON_PREFIX = 'metaharness-darwin';
@@ -68,22 +89,71 @@ function buildArgv(args, wantJson) {
 // (This last-block parse is now the family-wide shared implementation.)
 const maybeParseJson = parseTrailingJson;
 
+const DARWIN_BIN = 'metaharness-darwin';
+
+/**
+ * Absolute path of the `metaharness-darwin` bin (see RESOLUTION above).
+ * Memoized per process, like _harness.mjs resolveMetaharnessBins().
+ */
+let RESOLVED = null;
+function resolveDarwinBin() {
+  if (RESOLVED) return RESOLVED;
+  // fromCwd:false — this lookup ends in a spawn of the bin with argv that
+  // comes from MCP input, so it only searches the ruflo install that owns
+  // this plugin, never the tool's cwd or its ancestors (see _invoke.mjs).
+  const localDir = findLocalPackageDir(DARWIN_PKG, DARWIN_PIN_VERSION, { fromCwd: false });
+  const localBin = localDir ? resolvePackageBin(localDir, DARWIN_BIN) : null;
+  if (localBin) return (RESOLVED = { ok: true, bin: localBin, source: 'local' });
+  let cached = ensureCachedInstall({ pkg: DARWIN_PKG, pinVersion: DARWIN_PIN_VERSION });
+  let cachedBin = cached.ok ? resolvePackageBin(cached.pkgDir, DARWIN_BIN) : null;
+  // The default cache probe is `<pkgDir>/package.json`, so a half-written
+  // cache — npm killed by the 180s install timeout, or two first calls
+  // installing into the same prefix — would count as installed forever and
+  // degrade every later call. npx repaired that by re-resolving; re-run the
+  // install once, probing the bin file itself, then give up (#3366).
+  if (cached.ok && !cachedBin) {
+    cached = ensureCachedInstall({
+      pkg: DARWIN_PKG,
+      pinVersion: DARWIN_PIN_VERSION,
+      cliRelPath: packageBinRelPath(cached.pkgDir, DARWIN_BIN) ?? 'dist/cli.js',
+    });
+    cachedBin = cached.ok ? resolvePackageBin(cached.pkgDir, DARWIN_BIN) : null;
+  }
+  if (cachedBin) return (RESOLVED = { ok: true, bin: cachedBin, source: 'cache' });
+  return (RESOLVED = {
+    ok: false,
+    stdout: cached.stdout ?? '',
+    stderr: cached.stderr ?? cached.error ?? `${DARWIN_PIN} has no ${DARWIN_BIN} bin`,
+  });
+}
+
+/** Same degraded shape the npx path produced when the package was unreachable. */
+function unavailable(resolved, start) {
+  return {
+    stdout: resolved.stdout, stderr: resolved.stderr,
+    exitCode: 127, json: null, durationMs: Date.now() - start,
+    degraded: true, reason: `${REASON_PREFIX}-not-available`,
+  };
+}
+
 /**
  * Sync invocation. Use for short subcommands (`bench verify`, smoke shapes).
  * Async variant below for long-running `evolve` calls.
  */
 export function runDarwin(args, opts = {}) {
   const start = Date.now();
+  const resolved = resolveDarwinBin();
+  if (!resolved.ok) return unavailable(resolved, start);
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const wantJson = opts.json !== false;
   const argv = buildArgv(args, wantJson);
-  const r = spawnSync('npx', ['-y', '-p', DARWIN_PIN, 'metaharness-darwin', ...argv], {
+  const r = spawnSync(process.execPath, [resolved.bin, ...argv], {
     stdio: ['ignore', 'pipe', 'pipe'],
     encoding: 'utf-8',
     timeout: timeoutMs,
     cwd: opts.cwd,
     env: { ...process.env, ...(opts.env || {}) },
-    shell: process.platform === 'win32',
+    shell: false,
   });
   const durationMs = Date.now() - start;
   const stdout = r.stdout || '';
@@ -119,14 +189,16 @@ export function runDarwin(args, opts = {}) {
 export function runDarwinAsync(args, opts = {}) {
   return new Promise((resolve) => {
     const start = Date.now();
+    const resolved = resolveDarwinBin();
+    if (!resolved.ok) { resolve(unavailable(resolved, start)); return; }
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const wantJson = opts.json !== false;
     const argv = buildArgv(args, wantJson);
-    const p = spawn('npx', ['-y', '-p', DARWIN_PIN, 'metaharness-darwin', ...argv], {
+    const p = spawn(process.execPath, [resolved.bin, ...argv], {
       stdio: ['ignore', 'pipe', 'pipe'],
       cwd: opts.cwd,
       env: { ...process.env, ...(opts.env || {}) },
-      shell: process.platform === 'win32',
+      shell: false,
     });
     let stdout = '', stderr = '', stderrBuf = '';
     p.stdout?.on('data', (d) => { stdout += d.toString(); });

package/plugins/ruflo-metaharness/scripts/_harness.mjs

@@ -26,7 +26,8 @@
 //      arbitrary code on user machines on the very next skill invocation.
 //      The version is now PINNED to METAHARNESS_PIN_VERSION (tilde range —
 //      patch updates only) and only bumped deliberately, in lock-step with
-//      optionalDependencies in @claude-flow/cli + ruflo package.json.
+//      the range declared in @claude-flow/cli/package.json (enforced by
+//      scripts/check-metaharness-pins.mjs).
 //   2. PERF: @latest forced an npm-registry metadata check on EVERY call.
 //      Resolution is now (a) an already-installed local metaharness
 //      satisfying the pin (walk-up node_modules — free), then (b) a ONE-TIME
@@ -53,10 +54,15 @@ import {
 
 const DEFAULT_TIMEOUT_MS = 60_000;
 
-// Pinned semver range. Bump in lock-step with optionalDependencies in
-// @claude-flow/cli/package.json + ruflo/package.json. NEVER @latest.
+// Pinned semver range. NEVER @latest. Must cover the `metaharness` range
+// declared in v3/@claude-flow/cli/package.json (optional peer `^0.4.1`):
+// this constant decides which INSTALLED copy findLocalPackageDir() accepts,
+// so a range that misses the declared one rejects the copy ruflo ships and
+// npm-installs another at tool-call time. It sat at ~0.3.0 after the CLI
+// moved to ^0.4.1 (b8ec03f34) because nothing compared the two;
+// scripts/check-metaharness-pins.mjs now fails when they diverge.
 const METAHARNESS_PKG = 'metaharness';
-const METAHARNESS_PIN_VERSION = '~0.3.0';
+const METAHARNESS_PIN_VERSION = '~0.4.1';
 
 const REASON_NOT_AVAILABLE = 'metaharness-not-available';
 

package/plugins/ruflo-metaharness/scripts/_invoke.mjs

@@ -21,9 +21,15 @@
 //                             invalidate stale caches automatically
 //   - findLocalPackageDir()   walk-up node_modules resolution so an already
 //                             installed optionalDependency is used for free
+//   - resolvePackageBin()     realpath'd bin-map entry of a resolved package
+//                             (#3366 — lets _darwin/_redblue run the installed
+//                             copy instead of npx / a cache install)
 //   - importOptionalLibrary() bare-import → cached-install fallback for
 //                             library entries (gepa) — never throws on absence
 //   - makeDegradedEmitter()   the ADR-150 rule-#3 exit-0 degraded payload
+//   - runRufloCli()           `memory store|list|retrieve` through the ruflo CLI
+//                             that ships this plugin (#3366) — replaces
+//                             `npx @claude-flow/cli@latest` in 4 scripts
 //
 // WHAT DOES NOT LIVE HERE (the per-consumer parts):
 //   - _redblue's node-direct isMain workaround rationale
@@ -36,7 +42,7 @@
 //   - RUFLO_METAHARNESS_SKIP_LOCAL=1 disables local node_modules resolution
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -102,11 +108,22 @@ export function satisfiesTildeRange(version, pinVersion) {
  * user's ruflo install shipped with). Returns the package dir or null.
  * When `pinVersion` is given, only a copy satisfying the pin is accepted —
  * a stale major/minor in an ancestor node_modules is skipped, not used.
+ *
+ * `{ fromCwd: false }` (#3366) searches ONLY the ruflo install that owns this
+ * plugin. The $CWD walk reaches every ancestor of the tool's working
+ * directory, i.e. directories the user's project — or anything above it —
+ * controls. That is tolerable for the pre-existing `metaharness` lookup,
+ * which this PR does not change, but the two lookups added here (_darwin,
+ * _redblue) END IN A SPAWN of the package's bin with MCP-supplied argv, so
+ * they stay inside ruflo's own tree and fall back to the pinned cache
+ * install instead.
  */
-export function findLocalPackageDir(pkg, pinVersion) {
+export function findLocalPackageDir(pkg, pinVersion, { fromCwd = true } = {}) {
   if (process.env.RUFLO_METAHARNESS_SKIP_LOCAL === '1') return null;
   const segments = pkg.split('/');
-  const starts = [dirname(fileURLToPath(import.meta.url)), process.cwd()];
+  const starts = fromCwd
+    ? [dirname(fileURLToPath(import.meta.url)), process.cwd()]
+    : [dirname(fileURLToPath(import.meta.url))];
   const seen = new Set();
   for (const start of starts) {
     let dir = start;
@@ -131,17 +148,51 @@ export function findLocalPackageDir(pkg, pinVersion) {
   return null;
 }
 
+/**
+ * Absolute path of `binName` from the package.json `bin` map of an already
+ * resolved package dir (findLocalPackageDir / ensureCachedInstall), or null.
+ * Read from the bin map rather than hardcoded, same as _harness.mjs.
+ *
+ * REALPATH'd on purpose (#3366): pnpm and other symlinked layouts hand us a
+ * symlinked package dir, and @metaharness/redblue's CLI only dispatches when
+ * `import.meta.url === file://${process.argv[1]}` (see _redblue.mjs) — Node
+ * reports import.meta.url as the REAL path, so argv[1] has to be one too or
+ * the CLI exits 0 having done nothing.
+ */
+export function resolvePackageBin(pkgDir, binName) {
+  const rel = packageBinRelPath(pkgDir, binName);
+  if (!rel) return null;
+  try {
+    const abs = join(pkgDir, rel);
+    return existsSync(abs) ? realpathSync(abs) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The package.json `bin` entry for `binName`, as declared (relative), or null. */
+export function packageBinRelPath(pkgDir, binName) {
+  try {
+    const pj = JSON.parse(readFileSync(join(pkgDir, 'package.json'), 'utf-8'));
+    const rel = typeof pj.bin === 'string' ? pj.bin : pj.bin?.[binName];
+    return rel || null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * One-time versioned cache install of a PINNED range. Generalizes
  * gepa.mjs:98-121 / _redblue.mjs:72-102. The cache dir is
  * `<base>/<shortname>-cache-<pin-digits>` (e.g. redblue-cache-0.1.4,
- * darwin-cache-0.8.0, metaharness-cache-0.3.0) so existing caches created
+ * darwin-cache-0.10.2, metaharness-cache-0.4.1) so existing caches created
  * by the pre-consolidation helpers remain valid, and bumping the pin
- * invalidates stale installs automatically.
+ * invalidates stale installs automatically (the pre-bump darwin-cache-0.8.0
+ * and metaharness-cache-0.3.0 dirs are simply no longer selected).
  *
  * @param {object} spec
  * @param {string} spec.pkg          npm package name (may be scoped)
- * @param {string} spec.pinVersion   tilde range, e.g. '~0.3.0'
+ * @param {string} spec.pinVersion   tilde range, e.g. '~0.4.1'
  * @param {string} [spec.cliRelPath] path inside the package that must exist
  *                                   post-install (also returned as cliPath)
  * @param {number} [spec.timeoutMs]  install timeout (default 180s)
@@ -228,3 +279,66 @@ export function makeDegradedEmitter(pkg, pinVersion) {
     process.exit(0);
   };
 }
+
+// ---------------------------------------------------------------------------
+// The ruflo CLI that ships this plugin (#3366)
+// ---------------------------------------------------------------------------
+// audit-list / audit-trend / oia-audit / similarity read and write the
+// `metaharness-audit` memory namespace through the ruflo CLI. They used to
+// spawn `npx @claude-flow/cli@latest memory …`, which on every call:
+//   - resolved `latest` through the npm registry (the "metadata check on
+//     EVERY call" _harness.mjs removed for its own npx path); without registry
+//     access it fails, so oia_audit reports `persisted: false` and audit_list
+//     silently reports 0 records;
+//   - could run a DIFFERENT @claude-flow/cli than the one that spawned the
+//     tool (npx cache vs registry skew — #3306), i.e. another memory backend /
+//     schema than the MCP server's own memory_* tools see;
+//   - cold-fetched the whole CLI when the npx cache was empty (#3145, #3154).
+// The plugin is published INSIDE @claude-flow/cli
+// (<cli>/plugins/ruflo-metaharness/scripts — see prepare-publish.mjs), and the
+// MCP server / `ruflo metaharness` dispatcher locate it by walking up from
+// their own dist/, so the owning CLI is two directories above this plugin.
+// It is run with process.execPath + bin/cli.js (the mcp-launch.cjs /
+// daemon-autostart.ts pattern). A candidate only counts when dist/src/index.js
+// exists next to bin/cli.js — mcp-launch.cjs resolveLocalCliBin()'s guard
+// against an unbuilt checkout — AND its package.json is named
+// @claude-flow/cli, a check added here so an unrelated directory two levels up
+// can never qualify. Unchanged:
+//   - CLI_CORE=1 still opts into `npx @claude-flow/cli-core@alpha` (ADR-100);
+//   - no usable local CLI (e.g. a marketplace clone with no build) still falls
+//     back to `npx @claude-flow/cli@latest`.
+const PLUGIN_SCRIPTS_DIR = dirname(fileURLToPath(import.meta.url));
+
+let RUFLO_CLI = null;
+/** `{ command, args, shell, source }` for invoking the ruflo CLI. Memoized. */
+export function resolveRufloCli() {
+  if (RUFLO_CLI) return RUFLO_CLI;
+  if (process.env.CLI_CORE === '1') {
+    return (RUFLO_CLI = { command: 'npx', args: ['@claude-flow/cli-core@alpha'], shell: process.platform === 'win32', source: 'npx-cli-core' });
+  }
+  const candidates = [
+    join(PLUGIN_SCRIPTS_DIR, '..', '..', '..'),                              // published: <cli>/plugins/ruflo-metaharness/scripts
+    join(PLUGIN_SCRIPTS_DIR, '..', '..', '..', 'v3', '@claude-flow', 'cli'), // repo checkout / marketplace clone
+  ];
+  for (const dir of candidates) {
+    try {
+      const bin = join(dir, 'bin', 'cli.js');
+      const pj = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf-8'));
+      if (pj.name === '@claude-flow/cli' && existsSync(bin) && existsSync(join(dir, 'dist', 'src', 'index.js'))) {
+        return (RUFLO_CLI = { command: process.execPath, args: [bin], shell: false, source: 'local' });
+      }
+    } catch { /* not this layout — try the next */ }
+  }
+  return (RUFLO_CLI = { command: 'npx', args: ['@claude-flow/cli@latest'], shell: process.platform === 'win32', source: 'npx' });
+}
+
+/** spawnSync the ruflo CLI with `args` (e.g. ['memory', 'list', …]); same result shape as before. */
+export function runRufloCli(args, opts = {}) {
+  const cli = resolveRufloCli();
+  return spawnSync(cli.command, [...cli.args, ...args], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+    encoding: 'utf-8',
+    shell: cli.shell,
+    ...opts,
+  });
+}

package/plugins/ruflo-metaharness/scripts/_redblue.mjs

@@ -32,6 +32,16 @@
 // (file separately — when fixed, we could go back to a bin-shim pattern,
 // though the node-direct cached path is now the family-wide standard anyway).
 //
+// INSTALLED COPY FIRST (#3366): an @metaharness/redblue already on disk that
+// satisfies the pin (a ruflo 3.42.4 install carries 0.1.4, via metaharness /
+// ruvector) is used before the cache install, same order as _harness.mjs /
+// _darwin.mjs. Previously the first call always ran `npm install` into the
+// cache even with that copy present.
+// Whichever copy is chosen, its CLI path is realpath'd
+// (_invoke.resolvePackageBin / realpathSync): a pnpm-symlinked package dir,
+// or a cache base under a symlink such as macOS /tmp -> /private/tmp, would
+// otherwise hit the same isMain mismatch described above.
+//
 // CONTRACT (matches runMetaharness/runDarwin):
 //   - returns `{ stdout, stderr, exitCode, durationMs, degraded, reason? }`
 //   - subprocess hard timeout (default 120s; --mock-judge runs are seconds)
@@ -47,12 +57,15 @@
 //   $OPENROUTER_API_KEY which we never inject.
 
 import { spawnSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import {
   classifyDegraded,
   ensureCachedInstall,
+  findLocalPackageDir,
   makeDegradedEmitter,
+  resolvePackageBin,
 } from './_invoke.mjs';
 
 const DEFAULT_TIMEOUT_MS = 120_000;
@@ -80,8 +93,15 @@ export function runRedblue(args, opts = {}) {
   const start = Date.now();
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
 
-  // 1. Ensure redblue is installed in our cache dir (one-time install).
-  const install = ensureCachedInstall({
+  // 0. An installed copy satisfying the pin — free, no npm (#3366).
+  //    fromCwd:false: the resolved bin is SPAWNED with argv that comes from
+  //    MCP input, so only ruflo's own tree is searched, never the tool's cwd
+  //    or its ancestors (see findLocalPackageDir in _invoke.mjs).
+  const localDir = findLocalPackageDir(REDBLUE_PKG, REDBLUE_PIN_VERSION, { fromCwd: false });
+  const localCli = localDir ? resolvePackageBin(localDir, 'redblue') : null;
+
+  // 1. Otherwise ensure redblue is installed in our cache dir (one-time install).
+  const install = localCli ? { ok: true, cliPath: localCli } : ensureCachedInstall({
     pkg: REDBLUE_PKG,
     pinVersion: REDBLUE_PIN_VERSION,
     cliRelPath: CLI_REL_PATH,
@@ -99,15 +119,22 @@ export function runRedblue(args, opts = {}) {
     };
   }
 
-  // 2. Invoke `node <real-path-to-cli> <args>` so upstream's isMain check
-  //    succeeds (argv[1] matches import.meta.url).
-  const r = spawnSync('node', [install.cliPath, ...args], {
+  // 2. Invoke `<this node> <real-path-to-cli> <args>` so upstream's isMain
+  //    check succeeds (argv[1] matches import.meta.url) — realpath'd, see
+  //    header. process.execPath + shell:false, like _darwin/_harness: the
+  //    argv carries MCP-supplied values (--config / --out / --in), and with
+  //    shell:true on win32 Node hands cmd.exe one unquoted string, so a value
+  //    such as `x.yaml & whoami` would run as a command (and a path with a
+  //    space — `C:\Program Files\…` — would break). node needs no shell.
+  let cliPath = install.cliPath;
+  try { cliPath = realpathSync(cliPath); } catch { /* missing — node's MODULE_NOT_FOUND → degraded below */ }
+  const r = spawnSync(process.execPath, [cliPath, ...args], {
     stdio: ['ignore', 'pipe', 'pipe'],
     encoding: 'utf-8',
     timeout: timeoutMs,
     cwd: opts.cwd,
     env: { ...process.env, ...(opts.env || {}) },
-    shell: process.platform === 'win32',
+    shell: false,
   });
   const durationMs = Date.now() - start;
   const stdout = r.stdout || '';