@claude-flow/cli 3.47.1 → 3.49.0

package/plugins/ruflo-metaharness/scripts/oia-audit.mjs

@@ -24,6 +24,8 @@
 //   1  --alert-on-worst threshold exceeded
 //   2  config error or audit failure
 
+import { guardCliArgs } from './_cli-args.mjs';
+
 import { runRufloCli } from './_invoke.mjs';
 // iter 63 — SEVERITY_RANK + rankSeverity consolidated to _harness.mjs
 // (was local in iter 62; now shared with audit-trend + mcp-scan).
@@ -38,6 +40,13 @@ const NS = process.env.OIA_AUDIT_NAMESPACE || 'metaharness-audit';
 // resolution per call, possible version skew, fails without registry access).
 // CLI_CORE=1 still opts into `npx @claude-flow/cli-core@alpha`.
 
+guardCliArgs(import.meta.url, {
+  '--path': 'value',
+  '--dry-run': null,
+  '--alert-on-worst': 'value',
+  '--format': 'value',
+}, "Runs and persists an audit by default. --dry-run skips the memory write; analysis tools still run.");
+
 const ARGS = (() => {
   const a = { path: '.', format: 'json', dryRun: false, alertWorst: null };
   for (let i = 2; i < process.argv.length; i++) {

package/plugins/ruflo-metaharness/scripts/router-parallel-analyze.mjs

@@ -33,8 +33,16 @@
 //   1  --strict requested AND at least one criterion failed (NOT promotable)
 //   2  config error or input file missing/malformed
 
+import { guardCliArgs } from './_cli-args.mjs';
+
 import { readFileSync, existsSync } from 'node:fs';
 
+guardCliArgs(import.meta.url, {
+  '--input': 'value',
+  '--format': 'value',
+  '--strict': null,
+});
+
 const ARGS = (() => {
   const a = { input: '.swarm/router-parallel.jsonl', format: 'table', strict: false };
   for (let i = 2; i < process.argv.length; i++) {

package/plugins/ruflo-metaharness/scripts/score.mjs

@@ -16,8 +16,16 @@
 //   1  --alert-on-fit-below threshold breached
 //   2  config error or scoring failure
 
+import { guardCliArgs } from './_cli-args.mjs';
+
 import { runMetaharness, emitDegradedJsonAndExit } from './_harness.mjs';
 
+guardCliArgs(import.meta.url, {
+  '--path': 'value',
+  '--alert-on-fit-below': 'value',
+  '--format': 'value',
+});
+
 const ARGS = (() => {
   const a = { path: '.', format: 'json', alertFitBelow: null };
   for (let i = 2; i < process.argv.length; i++) {

package/plugins/ruflo-metaharness/scripts/security-bench.mjs

@@ -30,8 +30,19 @@
 //   1  --alert-on-fail and any acceptance gate failed
 //   2  config error or bench infrastructure failure
 
+import { guardCliArgs } from './_cli-args.mjs';
+
 import { runDarwinAsync, emitDarwinDegradedJsonAndExit } from './_darwin.mjs';
 
+guardCliArgs(import.meta.url, {
+  '--population': 'value',
+  '--cycles': 'value',
+  '--seed': 'value',
+  '--alert-on-fail': null,
+  '--format': 'value',
+  '--timeout-ms': 'value',
+}, "Runs the security benchmark. This command has no plan-only mode.");
+
 const ARGS = (() => {
   const a = {
     population: 2,

package/plugins/ruflo-metaharness/scripts/similarity.mjs

@@ -23,6 +23,8 @@
 //     a structured `{ degraded: true, reason: ... }` payload on stdout
 //   - CI-gate ready: smoke step 17y locks this contract
 
+import { guardCliArgs } from './_cli-args.mjs';
+
 import { readFileSync, existsSync } from 'node:fs';
 import { runRufloCli } from './_invoke.mjs';
 import { similarity } from './_similarity.mjs';
@@ -33,6 +35,16 @@ const NS = process.env.HARNESS_SIMILARITY_NAMESPACE || 'metaharness-audit';
 // resolution per call, possible version skew, fails without registry access).
 // CLI_CORE=1 still opts into `npx @claude-flow/cli-core@alpha`.
 
+guardCliArgs(import.meta.url, {
+  '--a': 'value',
+  '--b': 'value',
+  '--a-key': 'value',
+  '--b-key': 'value',
+  '--per-dimension': null,
+  '--format': 'value',
+  '--alert-below': 'value',
+});
+
 const ARGS = (() => {
   const a = {
     aFile: null, bFile: null,

package/plugins/ruflo-metaharness/scripts/test-cli-help.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// Hermetic CLI entry-point checks: no optional tools, network, or real memory writes.
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { cpSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const scripts = ['audit-list', 'audit-trend', 'bench', 'bench-parse-mcp-scan', 'bench-recordpair-overhead',
+  'bench-similarity', 'drift-from-history', 'evolve', 'genome', 'gepa', 'learn', 'mcp-scan', 'mint',
+  'oia-audit', 'router-parallel-analyze', 'score', 'security-bench', 'similarity', 'threat-model'];
+let root;
+let entryDir;
+let cwd;
+let guard;
+before(() => {
+  root = mkdtempSync(join(tmpdir(), 'metaharness-help-'));
+  entryDir = join(root, 'scripts');
+  cwd = join(root, 'workspace');
+  mkdirSync(cwd);
+  cpSync(dirname(fileURLToPath(import.meta.url)), entryDir, { recursive: true });
+  guard = join(root, 'guard.cjs');
+  writeFileSync(guard, `
+    const cp = require('node:child_process');
+    const fs = require('node:fs');
+    const append = fs.appendFileSync;
+    const blocked = name => (...args) => {
+      append(process.env.ATTEMPT_LOG, name + '\\n');
+      throw new Error('test blocked side effect: ' + name);
+    };
+    for (const name of ['spawn', 'spawnSync', 'exec', 'execSync', 'execFile', 'execFileSync', 'fork']) cp[name] = blocked(name);
+    for (const name of ['writeFileSync', 'appendFileSync', 'mkdirSync', 'mkdtempSync', 'renameSync', 'unlinkSync', 'rmSync']) fs[name] = blocked(name);
+    require('node:module').syncBuiltinESMExports();
+  `);
+});
+after(() => rmSync(root, { recursive: true, force: true }));
+
+function invoke(script, args) {
+  const log = join(root, 'attempts');
+  rmSync(log, { force: true });
+  const result = spawnSync(process.execPath, ['--require', guard, join(entryDir, script + '.mjs'), ...args], {
+    cwd, encoding: 'utf8', timeout: 3000,
+    env: { ...process.env, HOME: root, USERPROFILE: root, ATTEMPT_LOG: log, NODE_OPTIONS: '' },
+  });
+  return { ...result, attempts: existsSync(log) ? readFileSync(log, 'utf8') : '' };
+}
+
+for (const script of scripts) {
+  for (const flag of ['--help', '-h']) {
+    test(`${script} ${flag} prints help before any side effects`, () => {
+      const result = invoke(script, [flag]);
+      assert.equal(result.status, 0, result.stderr);
+      assert.match(result.stdout, /Usage:/);
+      assert.equal(result.attempts, '', 'no subprocess or write may be attempted');
+      assert.deepEqual(readdirSync(cwd), []);
+    });
+  }
+  test(`${script} rejects an unknown flag without running`, () => {
+    const result = invoke(script, ['--definitely-unknown']);
+    assert.equal(result.status, 2, result.stderr);
+    assert.match(result.stderr, /Unknown argument/);
+    assert.equal(result.attempts, '');
+  });
+}
+for (const args of [['--path'], ['--path', '--dry-run']]) test(`missing option value ${args.join(' ')} does not run`, () => {
+  const result = invoke('oia-audit', args);
+  assert.equal(result.status, 2);
+  assert.match(result.stderr, /requires a value/);
+  assert.equal(result.attempts, '');
+});

package/plugins/ruflo-metaharness/scripts/threat-model.mjs

@@ -4,10 +4,18 @@
 // USAGE
 //   node scripts/threat-model.mjs --path . --fail-on high --format json
 
+import { guardCliArgs } from './_cli-args.mjs';
+
 import { runHarness, emitDegradedJsonAndExit } from './_harness.mjs';
 
 const SEVERITY_RANK = { clean: 0, low: 1, medium: 2, high: 3 };
 
+guardCliArgs(import.meta.url, {
+  '--path': 'value',
+  '--fail-on': 'value',
+  '--format': 'value',
+});
+
 const ARGS = (() => {
   const a = { path: '.', format: 'json', failOn: 'high' };
   for (let i = 2; i < process.argv.length; i++) {