@claude-flow/cli 3.48.0 → 3.50.0

package/dist/src/mcp-tools/memory-tools.js

@@ -42,7 +42,15 @@ const MAX_QUERY_LENGTH = 4096;
 // validateMemoryInput. Imported by sanitizeMemoryKey so write-side sanitization
 // and read-side rejection can never drift apart (the symmetry bug behind #1884).
 const DANGEROUS_KEY_CHARS = /[;&|`$(){}[\]<>!#\\\0]|\.\.[/\\]/g;
-const DANGEROUS_KEY_PATTERN = /[;&|`$(){}[\]<>!#\\\0]|\.\.[/\\]/;
+export const DANGEROUS_KEY_PATTERN = /[;&|`$(){}[\]<>!#\\\0]|\.\.[/\\]/;
+/**
+ * #3570: the one key rule for every memory write path (MCP store, CLI store,
+ * import). Plain `/` stays legal (`probe/x`); traversal and shell metacharacters
+ * do not. Returns the error message, or null when the key is acceptable.
+ */
+export function memoryKeyError(key) {
+    return DANGEROUS_KEY_PATTERN.test(key) ? 'Key contains disallowed characters' : null;
+}
 function validateMemoryInput(key, value, query, namespace) {
     if (key && key.length > MAX_KEY_LENGTH) {
         throw new Error(`Key exceeds maximum length of ${MAX_KEY_LENGTH} characters`);
@@ -54,9 +62,9 @@ function validateMemoryInput(key, value, query, namespace) {
         throw new Error(`Query exceeds maximum length of ${MAX_QUERY_LENGTH} characters`);
     }
     // Reject path traversal and shell metacharacters in keys/namespaces (#1425)
-    if (key && DANGEROUS_KEY_PATTERN.test(key)) {
-        throw new Error('Key contains disallowed characters');
-    }
+    const keyError = key ? memoryKeyError(key) : null;
+    if (keyError)
+        throw new Error(keyError);
     if (namespace && DANGEROUS_KEY_PATTERN.test(namespace)) {
         throw new Error('Namespace contains disallowed characters');
     }
@@ -413,6 +421,11 @@ export const memoryTools = [
                 };
             }
             validateMemoryInput(key, value, undefined, namespace);
+            // #3570: a namespace written here must be exportable and purgeable, so it
+            // passes the same validator export and purge use.
+            const vNs = validateIdentifier(namespace, 'namespace');
+            if (!vNs.valid)
+                throw new Error(vNs.error);
             const startTime = performance.now();
             try {
                 const result = await storeEntry({
@@ -1542,6 +1555,9 @@ export const memoryTools = [
             await ensureInitialized(dbPath);
             const { storeEntry } = await getMemoryFunctions();
             const t0 = Date.now();
+            // Values are re-embedded on import; count the vectors actually written
+            // rather than reporting a constant 0 next to entries that show a vector.
+            let vectors = 0;
             const inputPath = String(input.inputPath ?? '');
             if (!inputPath || !existsSync(inputPath))
                 return { error: `File not found: ${inputPath || '(empty)'}` };
@@ -1559,6 +1575,24 @@ export const memoryTools = [
                 if (!v.valid)
                     throw new Error(v.error);
             }
+            // #3570: validate every entry's namespace up front so a bad file writes nothing.
+            if (!nsOverride) {
+                for (const e of entries) {
+                    if (e && typeof e.key === 'string' && e.namespace !== undefined) {
+                        const v = validateIdentifier(String(e.namespace), 'namespace');
+                        if (!v.valid)
+                            throw new Error(v.error);
+                    }
+                }
+            }
+            // #3570 follow-up: keys get the same up-front, all-or-nothing check.
+            for (const e of entries) {
+                if (e && typeof e.key === 'string') {
+                    const keyError = memoryKeyError(e.key);
+                    if (keyError)
+                        throw new Error(`${keyError}: ${JSON.stringify(e.key)}`);
+                }
+            }
             let imported = 0;
             let skipped = 0;
             for (const e of entries) {
@@ -1569,8 +1603,11 @@ export const memoryTools = [
                 const value = typeof e.value === 'string' ? e.value : JSON.stringify(e.value ?? null);
                 try {
                     const result = await storeEntry({ key: e.key, value, namespace: nsOverride ?? e.namespace ?? 'default', upsert: input.merge !== false, dbPath });
-                    if (result.success)
+                    if (result.success) {
                         imported++;
+                        if (result.embedding)
+                            vectors++;
+                    }
                     else
                         skipped++;
                 }
@@ -1580,7 +1617,7 @@ export const memoryTools = [
             }
             return {
                 inputPath,
-                imported: { entries: imported, vectors: 0, patterns: 0 },
+                imported: { entries: imported, vectors, patterns: 0 },
                 skipped,
                 duration: Date.now() - t0,
             };

package/dist/src/mcp-tools/session-tools.d.ts

@@ -4,5 +4,20 @@
  * Tool definitions for session management with file persistence.
  */
 import { type MCPTool } from './types.js';
+/**
+ * #3573: what session_save learned about memory, so callers can say
+ * "not included" or "no store" instead of printing an invented 0.
+ */
+export interface MemoryCaptureReport {
+    requested: boolean;
+    status: 'not-requested' | 'captured' | 'no-store' | 'error';
+    entries: number;
+    sources: {
+        memoryDb: number;
+        agentdb: number;
+        legacyJson: number;
+    };
+    error?: string;
+}
 export declare const sessionTools: MCPTool[];
 //# sourceMappingURL=session-tools.d.ts.map

package/dist/src/mcp-tools/session-tools.js

@@ -69,17 +69,126 @@ function listSessions() {
     }
     return sessions;
 }
-// Load related stores for session data
-function loadRelatedStores(options) {
-    const data = {};
-    if (options.includeMemory) {
+/** Snapshot format written by session_save since #3573. */
+const MEMORY_SNAPSHOT_FORMAT = 'ruflo-session-memory/2';
+const MEMORY_PAGE_SIZE = 500;
+async function readLiveEntries(listEntries, dbPath, encryptWrites) {
+    const rows = [];
+    // Bounded: stop on a short page, once `total` rows are in hand, or after a
+    // hard cap, so a backend that ignores `offset` cannot loop forever.
+    for (let page = 0, offset = 0; page < 10_000; page++, offset += MEMORY_PAGE_SIZE) {
+        const result = await listEntries({
+            dbPath, includeContent: true, limit: MEMORY_PAGE_SIZE, offset,
+            ...(encryptWrites === undefined ? {} : { encryptWrites }),
+        });
+        if (!result.success)
+            throw new Error(result.error || `could not list ${dbPath}`);
+        rows.push(...result.entries);
+        if (result.entries.length < MEMORY_PAGE_SIZE || rows.length >= result.total)
+            break;
+    }
+    return rows;
+}
+/**
+ * #3573: capture the memory the user actually has.
+ *
+ * Before this, session_save read only the pre-SQLite `.claude-flow/memory/store.json`,
+ * which a current install never writes, so `--include-memory` saved nothing and
+ * reported "Memory Entries: 0". The snapshot now covers the same store `memory
+ * list` reads (resolveDbPath), plus rows that exist only in the sibling AgentDB
+ * store written by the MCP path, de-duplicated by namespace+key (default CLI
+ * writes are mirrored into AgentDB, so most rows are in both). A legacy
+ * store.json is still captured for backward compatibility.
+ */
+async function captureMemorySnapshot() {
+    const report = {
+        requested: true, status: 'captured', entries: 0,
+        sources: { memoryDb: 0, agentdb: 0, legacyJson: 0 },
+    };
+    const entries = {};
+    let legacy;
+    const legacyPath = join(getProjectCwd(), STORAGE_DIR, 'memory', 'store.json');
+    if (existsSync(legacyPath)) {
         try {
-            const memoryPath = join(getProjectCwd(), STORAGE_DIR, 'memory', 'store.json');
-            if (existsSync(memoryPath)) {
-                data.memory = JSON.parse(readFileSync(memoryPath, 'utf-8'));
+            legacy = JSON.parse(readFileSync(legacyPath, 'utf-8'));
+            const legacyEntries = legacy.entries || {};
+            for (const [id, entry] of Object.entries(legacyEntries)) {
+                entries[id] = entry;
+                report.sources.legacyJson++;
             }
         }
-        catch { /* ignore */ }
+        catch { /* unreadable legacy file is not memory we can restore */ }
+    }
+    let sawStore = legacy !== undefined;
+    try {
+        const { listEntries, resolveDbPath } = await import('../memory/memory-initializer.js');
+        const primary = resolveDbPath();
+        const seen = new Set();
+        if (existsSync(primary)) {
+            sawStore = true;
+            for (const row of await readLiveEntries(listEntries, primary)) {
+                const id = `${row.namespace}::${row.key}`;
+                seen.add(id);
+                entries[id] = {
+                    key: row.key, value: row.content ?? '', namespace: row.namespace,
+                    provenanceType: row.provenanceType, source: 'memory-db',
+                };
+                report.sources.memoryDb++;
+            }
+        }
+        let sibling = null;
+        try {
+            const { siblingAgentDbPath } = await import('../memory/memory-bridge.js');
+            sibling = siblingAgentDbPath(primary);
+        }
+        catch { /* no bridge, no sibling store */ }
+        if (sibling && existsSync(sibling)) {
+            sawStore = true;
+            // The AgentDB store is read by native SQLite and must stay plaintext.
+            for (const row of await readLiveEntries(listEntries, sibling, false)) {
+                const id = `${row.namespace}::${row.key}`;
+                if (seen.has(id))
+                    continue;
+                seen.add(id);
+                entries[id] = {
+                    key: row.key, value: row.content ?? '', namespace: row.namespace,
+                    provenanceType: row.provenanceType, source: 'agentdb',
+                };
+                report.sources.agentdb++;
+            }
+        }
+    }
+    catch (e) {
+        report.status = 'error';
+        report.error = e.message;
+    }
+    report.entries = Object.keys(entries).length;
+    if (report.status !== 'error' && !sawStore)
+        report.status = 'no-store';
+    if (report.entries === 0 && legacy === undefined) {
+        return { report };
+    }
+    return {
+        memory: {
+            format: MEMORY_SNAPSHOT_FORMAT,
+            entries,
+            ...(legacy !== undefined ? { legacy } : {}),
+        },
+        report,
+    };
+}
+// Load related stores for session data
+async function loadRelatedStores(options) {
+    const data = {};
+    let memoryCapture = {
+        requested: false, status: 'not-requested', entries: 0,
+        sources: { memoryDb: 0, agentdb: 0, legacyJson: 0 },
+    };
+    if (options.includeMemory) {
+        const captured = await captureMemorySnapshot();
+        memoryCapture = captured.report;
+        if (captured.memory)
+            data.memory = captured.memory;
     }
     if (options.includeTasks) {
         try {
@@ -99,7 +208,92 @@ function loadRelatedStores(options) {
         }
         catch { /* ignore */ }
     }
-    return data;
+    return { data, memoryCapture };
+}
+/** Count entries in a memory snapshot of either format. */
+function countMemoryEntries(memory) {
+    if (!memory || typeof memory !== 'object')
+        return 0;
+    return Object.keys(memory.entries || {}).length;
+}
+/**
+ * Restore a memory snapshot into the live store and report what was actually
+ * written. #3573: the previous restore swallowed every write failure and then
+ * echoed the count recorded at save time.
+ */
+async function restoreMemorySnapshot(memory) {
+    const outcome = { restored: 0, failed: 0, errors: [] };
+    const isV2 = memory.format === MEMORY_SNAPSHOT_FORMAT;
+    // Legacy snapshots are the old store.json itself; v2 snapshots carry it
+    // under `legacy` only when one existed at save time.
+    const legacyJson = isV2 ? memory.legacy : memory;
+    if (legacyJson !== undefined) {
+        const memoryDir = join(getProjectCwd(), STORAGE_DIR, 'memory');
+        if (!existsSync(memoryDir))
+            mkdirRestricted(memoryDir);
+        writeFileRestricted(join(memoryDir, 'store.json'), JSON.stringify(legacyJson, null, 2));
+    }
+    const entries = memory.entries;
+    if (!entries)
+        return outcome;
+    let storeEntry;
+    let isValidProvenanceType = () => false;
+    try {
+        const mod = await import('../memory/memory-initializer.js');
+        storeEntry = mod.storeEntry;
+        try {
+            if (typeof mod.isValidProvenanceType === 'function')
+                isValidProvenanceType = mod.isValidProvenanceType;
+        }
+        catch { /* optional: without it, provenance is simply not carried over */ }
+    }
+    catch (e) {
+        outcome.failed = Object.keys(entries).length;
+        outcome.errors.push(`memory store unavailable: ${e.message}`);
+        return outcome;
+    }
+    for (const entry of Object.values(entries)) {
+        const key = entry.key || entry.id || '';
+        const value = entry.value || entry.content || '';
+        if (!key || !value) {
+            outcome.failed++;
+            continue;
+        }
+        try {
+            // A snapshot from another version may carry a provenance value this one
+            // rejects; drop it rather than fail an otherwise-good row.
+            const provenance = entry.provenanceType && entry.provenanceType !== 'unknown'
+                && isValidProvenanceType(entry.provenanceType) ? entry.provenanceType : undefined;
+            const result = await storeEntry({
+                key,
+                value,
+                namespace: entry.namespace || 'restored',
+                upsert: true,
+                ...(provenance ? { provenanceType: provenance } : {}),
+            });
+            if (result && result.success === false) {
+                outcome.failed++;
+                if (result.error && outcome.errors.length < 5)
+                    outcome.errors.push(`${key}: ${result.error}`);
+            }
+            else {
+                outcome.restored++;
+            }
+        }
+        catch (e) {
+            outcome.failed++;
+            if (outcome.errors.length < 5)
+                outcome.errors.push(`${key}: ${e.message}`);
+        }
+    }
+    return outcome;
+}
+/** A session record is an object that carries at least one of its defining fields. */
+function isSessionRecordLike(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const v = value;
+    return 'data' in v || 'stats' in v || 'sessionId' in v || 'savedAt' in v;
 }
 export const sessionTools = [
     {
@@ -129,7 +323,7 @@ export const sessionTools = [
             }
             const sessionId = `session-${Date.now()}-${randomUUID().slice(0, 8)}`;
             // Load related data based on options
-            const data = loadRelatedStores({
+            const { data, memoryCapture } = await loadRelatedStores({
                 includeMemory: input.includeMemory,
                 includeTasks: input.includeTasks,
                 includeAgents: input.includeAgents,
@@ -138,7 +332,7 @@ export const sessionTools = [
             const stats = {
                 tasks: data.tasks ? Object.keys(data.tasks.tasks || {}).length : 0,
                 agents: data.agents ? Object.keys(data.agents.agents || {}).length : 0,
-                memoryEntries: data.memory ? Object.keys(data.memory.entries || {}).length : 0,
+                memoryEntries: countMemoryEntries(data.memory),
                 totalSize: 0,
             };
             const session = {
@@ -158,6 +352,7 @@ export const sessionTools = [
                 name: session.name,
                 savedAt: session.savedAt,
                 stats: session.stats,
+                memoryCapture,
                 path: getSessionPath(sessionId),
             };
         },
@@ -207,35 +402,11 @@ export const sessionTools = [
                 }
             }
             if (session) {
-                // Restore data to respective stores (legacy JSON for backward compat).
-                // audit_1776853149979: tighten perms on the restored stores too.
+                // Restore data to respective stores. audit_1776853149979: tighten
+                // perms on the restored stores too.
+                let memoryRestore;
                 if (input.restoreMemory !== false && session.data?.memory) {
-                    const memoryDir = join(getProjectCwd(), STORAGE_DIR, 'memory');
-                    if (!existsSync(memoryDir))
-                        mkdirRestricted(memoryDir);
-                    writeFileRestricted(join(memoryDir, 'store.json'), JSON.stringify(session.data.memory, null, 2));
-                    // Also populate active sql.js SQLite database so memory-tools can find entries
-                    try {
-                        const { storeEntry } = await import('../memory/memory-initializer.js');
-                        const memoryData = session.data.memory;
-                        if (memoryData.entries) {
-                            for (const entry of Object.values(memoryData.entries)) {
-                                const key = entry.key || entry.id || '';
-                                const value = entry.value || entry.content || '';
-                                if (key && value) {
-                                    await storeEntry({
-                                        key,
-                                        value,
-                                        namespace: entry.namespace || 'restored',
-                                        upsert: true,
-                                    });
-                                }
-                            }
-                        }
-                    }
-                    catch {
-                        // Legacy JSON restore is the fallback -- sql.js import may not be available
-                    }
+                    memoryRestore = await restoreMemorySnapshot(session.data.memory);
                 }
                 if (input.restoreTasks !== false && session.data?.tasks) {
                     const taskDir = join(getProjectCwd(), STORAGE_DIR, 'tasks');
@@ -260,6 +431,11 @@ export const sessionTools = [
                     },
                     restoredAt: new Date().toISOString(),
                     stats: session.stats,
+                    // #3573: counts actually written, not the count recorded at save time.
+                    ...(memoryRestore ? {
+                        memoryRestore,
+                        stats: { ...session.stats, memoryEntriesRestored: memoryRestore.restored },
+                    } : {}),
                 };
             }
             return {
@@ -484,30 +660,40 @@ export const sessionTools = [
         // #1916: `ruflo session import <file>` referenced an unregistered
         // `session_import` tool. Reads a session JSON and re-saves it locally.
         name: 'session_import',
-        description: 'Import a session JSON file (produced by session_export) into the local session store and optionally activate it. Use when native Read is wrong because the file is a structured session record that must be re-registered (new id, stats recomputed) rather than just read. For reading the file, native Read is fine. Pair with session_export on the source.',
+        description: 'Import a session (produced by session_export) into the local session store and optionally activate it. Pass either inputPath (a session JSON file) or data (the session record itself). Use when native Read is wrong because the file is a structured session record that must be re-registered (new id, stats recomputed) rather than just read. For reading the file, native Read is fine. Pair with session_export on the source.',
         category: 'session',
         inputSchema: {
             type: 'object',
             properties: {
-                inputPath: { type: 'string', description: 'Path to the session JSON file to import' },
+                inputPath: { type: 'string', description: 'Path to the session JSON file to import (or pass data)' },
+                data: { type: 'object', description: 'The session record itself, as written by session_export (or pass inputPath)' },
                 name: { type: 'string', description: 'Override the imported session name' },
                 activate: { type: 'boolean', description: 'Restore the imported session into the active stores' },
             },
-            required: ['inputPath'],
         },
         handler: async (input) => {
-            const inputPath = String(input.inputPath ?? '');
-            if (!inputPath || !existsSync(inputPath))
-                return { error: `File not found: ${inputPath || '(empty)'}` };
             let parsed;
-            try {
-                parsed = JSON.parse(readFileSync(inputPath, 'utf-8'));
+            if (input.data !== undefined && input.data !== null) {
+                parsed = input.data;
+            }
+            else {
+                const inputPath = String(input.inputPath ?? '');
+                if (!inputPath)
+                    return { error: 'Provide inputPath (a session JSON file) or data (a session record)' };
+                if (!existsSync(inputPath))
+                    return { error: `File not found: ${inputPath}` };
+                try {
+                    parsed = JSON.parse(readFileSync(inputPath, 'utf-8'));
+                }
+                catch (e) {
+                    return { error: `Invalid session JSON: ${e.message}` };
+                }
             }
-            catch (e) {
-                return { error: `Invalid session JSON: ${e.message}` };
+            if (!isSessionRecordLike(parsed)) {
+                return { error: 'Not a session record: expected an object produced by session export' };
             }
             const newId = `session-${Date.now()}-${randomUUID().slice(0, 8)}`;
-            const stats = parsed.stats || { tasks: 0, agents: 0, memoryEntries: 0, totalSize: 0 };
+            const stats = { tasks: 0, agents: 0, memoryEntries: 0, totalSize: 0, ...(parsed.stats || {}) };
             const session = {
                 sessionId: newId,
                 name: input.name ? String(input.name) : (parsed.name || 'imported-session'),

package/dist/src/memory/memory-initializer.js

@@ -15,6 +15,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import { createRequire } from 'node:module';
 import { readFileMaybeEncrypted, writeFileAtomic, writeFileRestricted } from '../fs-secure.js';
 import { restoreMemoryDbFromBackup } from '../services/memory-backup.js';
+import { validateIdentifier } from '../mcp-tools/validate-input.js';
 /**
  * ADR-323 — typed memory provenance. Distinguishes WHO/WHAT wrote a memory
  * entry (a user's stated claim vs an agent's own output vs a tool result vs
@@ -3392,11 +3393,13 @@ export async function withMemoryDbLock(dbPath, fn) {
         }
     }
 }
-const NAMESPACE_PATTERN = /^[A-Za-z0-9._-]{1,128}$/;
 export async function purgeNamespace(options) {
     const { namespace, dbPath: customPath } = options;
-    if (!NAMESPACE_PATTERN.test(namespace)) {
-        return { success: false, deletedCount: 0, remainingEntries: 0, error: `Invalid namespace: ${namespace}` };
+    // #3570: the same validator store, import and export use, so any namespace
+    // that can be written can also be purged (`team:alice` included).
+    const vNs = validateIdentifier(namespace, 'namespace');
+    if (!vNs.valid) {
+        return { success: false, deletedCount: 0, remainingEntries: 0, error: `Invalid namespace: ${vNs.error}` };
     }
     const swarmDir = getMemoryRoot();
     const dbPath = customPath ? path.resolve(customPath) : path.join(swarmDir, 'memory.db');

package/dist/src/mods/claude-installs.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Which Claude Code binaries a shell would find, and whether the one it runs
+ * can load mods (ADR-404). Mods are on by default from Claude Code 2.1.287;
+ * from 2.1.277 they load with CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1; older
+ * builds predate them. A server-side rollout switch can still hold them off
+ * on any version (reported separately). A stale install earlier on PATH
+ * (a 2.1.107 npm-global beside a current native one, say) silently decides.
+ */
+export declare const MODS_DEFAULT_ON = "2.1.287";
+export declare const MODS_FIRST = "2.1.277";
+export interface ClaudeInstall {
+    path: string;
+    version: string | null;
+}
+export type VersionOf = (path: string) => string | null;
+/** a < b for dotted numeric versions. */
+export declare function versionLess(a: string, b: string): boolean;
+/** `claude --version` of one binary, bounded; null when it cannot say. */
+export declare const defaultVersionOf: VersionOf;
+/** Every `claude` on PATH, in PATH order (the first is what runs), plus ~/.local/bin. */
+export declare function findClaudeInstalls(env: NodeJS.ProcessEnv, home: string, versionOf?: VersionOf): ClaudeInstall[];
+export interface InstallsFinding {
+    status: 'pass' | 'warn';
+    message: string;
+    fix?: string;
+}
+/** The doctor's reading of what `claude` resolves to and what else is installed. */
+export declare function judgeInstalls(installs: readonly ClaudeInstall[], enableEnvSet: boolean): InstallsFinding;
+//# sourceMappingURL=claude-installs.d.ts.map

package/dist/src/mods/claude-installs.js

@@ -0,0 +1,83 @@
+/**
+ * Which Claude Code binaries a shell would find, and whether the one it runs
+ * can load mods (ADR-404). Mods are on by default from Claude Code 2.1.287;
+ * from 2.1.277 they load with CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1; older
+ * builds predate them. A server-side rollout switch can still hold them off
+ * on any version (reported separately). A stale install earlier on PATH
+ * (a 2.1.107 npm-global beside a current native one, say) silently decides.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, realpathSync, statSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+export const MODS_DEFAULT_ON = '2.1.287';
+export const MODS_FIRST = '2.1.277';
+const parse = (v) => v.split('.').map((n) => Number(n));
+/** a < b for dotted numeric versions. */
+export function versionLess(a, b) {
+    const x = parse(a);
+    const y = parse(b);
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        if ((x[i] ?? 0) !== (y[i] ?? 0))
+            return (x[i] ?? 0) < (y[i] ?? 0);
+    }
+    return false;
+}
+/** `claude --version` of one binary, bounded; null when it cannot say. */
+export const defaultVersionOf = (path) => {
+    try {
+        const out = execFileSync(path, ['--version'], { encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] });
+        return out.match(/\d+\.\d+\.\d+/)?.[0] ?? null;
+    }
+    catch {
+        return null;
+    }
+};
+/** Every `claude` on PATH, in PATH order (the first is what runs), plus ~/.local/bin. */
+export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
+    const names = process.platform === 'win32' ? ['claude.exe', 'claude.cmd', 'claude'] : ['claude'];
+    const dirs = [...(env.PATH ?? '').split(delimiter).filter(Boolean), join(home, '.local', 'bin')];
+    const seen = new Set();
+    const installs = [];
+    for (const dir of dirs) {
+        for (const name of names) {
+            const path = join(dir, name);
+            let real;
+            try {
+                if (!existsSync(path) || !statSync(path).isFile())
+                    continue;
+                real = realpathSync(path);
+            }
+            catch {
+                continue;
+            }
+            if (seen.has(real))
+                continue;
+            seen.add(real);
+            installs.push({ path, version: versionOf(path) });
+        }
+    }
+    return installs;
+}
+/** The doctor's reading of what `claude` resolves to and what else is installed. */
+export function judgeInstalls(installs, enableEnvSet) {
+    if (installs.length === 0)
+        return { status: 'warn', message: 'no claude binary on PATH', fix: 'install Claude Code >= 2.1.287' };
+    const [first] = installs;
+    const others = installs.slice(1).filter((i) => i.version !== first.version);
+    const mixed = others.length
+        ? `; also installed: ${others.map((i) => `${i.path} (${i.version ?? 'unknown'})`).join(', ')}. The first on PATH runs; a stale one can shadow a current one.`
+        : '';
+    const runs = `${first.path} (${first.version ?? 'version unknown'})`;
+    if (!first.version)
+        return { status: 'warn', message: `claude resolves to ${runs}${mixed}` };
+    if (!versionLess(first.version, MODS_DEFAULT_ON)) {
+        return { status: others.length ? 'warn' : 'pass', message: `claude resolves to ${runs}: mods on by default${mixed}` };
+    }
+    if (!versionLess(first.version, MODS_FIRST)) {
+        return enableEnvSet
+            ? { status: others.length ? 'warn' : 'pass', message: `claude resolves to ${runs}: mods load with CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 (set)${mixed}` }
+            : { status: 'warn', message: `claude resolves to ${runs}: below ${MODS_DEFAULT_ON}, mods need CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 (not set)${mixed}`, fix: `upgrade to >= ${MODS_DEFAULT_ON}, or export CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1` };
+    }
+    return { status: 'warn', message: `claude resolves to ${runs}: predates mods (< ${MODS_FIRST}); classic hooks handle every event${mixed}`, fix: `upgrade to >= ${MODS_DEFAULT_ON} and remove the stale install from PATH` };
+}
+//# sourceMappingURL=claude-installs.js.map