@claude-flow/cli 3.51.1 → 3.52.0

package/plugins/ruflo-metaharness/scripts/smoke.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Structural smoke test for ruflo-metaharness v0.1.1 (ADR-150 Phase 1).
+# Structural smoke test for ruflo-metaharness v0.2.3 (ADR-150 Phase 1).
 set -u
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 PASS=0
@@ -32,10 +32,10 @@ else
   bad "extraction-regex-rot: EXPECTED_TOOLS=$EXPECTED_TOOLS EXPECTED_SUBS=$EXPECTED_SUBS"
 fi
 
-step "1. plugin.json declares 0.1.1 with adr-150 keywords"
+step "1. plugin.json declares 0.2.3 with adr-150 keywords"
 v=$(grep -E '"version"' "$ROOT/.claude-plugin/plugin.json" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-if [[ "$v" != "0.1.1" ]]; then
-  bad "expected 0.1.1, got '$v'"
+if [[ "$v" != "0.2.3" ]]; then
+  bad "expected 0.2.3, got '$v'"
 else
   miss=""
   for k in ruflo metaharness harness scorecard genome mcp-scan threat-model router adr-150 adr-148 adr-149 optional-dependency graceful-degradation subprocess phase-1-mvp; do
@@ -1066,10 +1066,13 @@ done
 grep -q "from './_harness.mjs'" "$F" 2>/dev/null || miss="$miss not-using-production-parser"
 # Gate flag exposed
 grep -q -- "--max-mean-us" "$F" 2>/dev/null || miss="$miss no-gate-flag"
-# Runtime: bench produces sub-5μs results across all categories
-node "$F" --iters 10000 --max-mean-us 5 >/dev/null 2>&1 || miss="$miss runtime-fails-or-perf-blew-5us"
+# Runtime: the parse bench stays an order of magnitude inside its regression ceiling. 30us on the MEDIAN: the CI runner measured p50 6.05us for the 5-finding payload (local 1us), so the old 5us ceiling failed there on speed alone; 30us is 5x the CI median and still trips on a 10x regression.
+# The median, not the mean: a scheduler pause on a loaded CI runner moves the mean and flaked this step in the fleet smoke.
+grep -q -- "--gate-stat" "$F" 2>/dev/null || miss="$miss no-gate-stat-flag"
+# On failure keep the bench's own output on stderr (the fleet JSON report captures stderrTail): the reason was invisible in CI before.
+bench_out=$(node "$F" --iters 10000 --max-mean-us 30 --gate-stat p50 2>&1) || { miss="$miss runtime-fails-or-perf-blew-30us"; printf '%s\n' "$bench_out" | tail -15 >&2; }
 # Runtime: gate trips on absurd ceiling
-if node "$F" --iters 10000 --max-mean-us 0.0001 >/dev/null 2>&1; then
+if node "$F" --iters 10000 --max-mean-us 0.0001 --gate-stat p50 >/dev/null 2>&1; then
   miss="$miss gate-failed-to-trip"
 fi
 [[ -z "$miss" ]] && ok || bad "$miss"
@@ -2449,5 +2452,24 @@ LOADER="$ROOT/../../v3/@claude-flow/cli/src/commands/index.ts"
 grep -q "eject: () => import" "$LOADER" 2>/dev/null || miss="$miss not-registered-in-loader"
 [[ -z "$miss" ]] && ok || bad "$miss"
 
+# M1-M3. The mod (ADR-445): hooks module registered, files within the 500-line rule, no network or process access in the hooks
+step "M1. mod: hooks.json names register.ts, every hook file is present and under 500 lines"
+mod_ok=1
+grep -q '"./register.ts"' "$ROOT/hooks/hooks.json" || mod_ok=0
+for f in options screen guard register; do
+  [[ -f "$ROOT/hooks/$f.ts" ]] || mod_ok=0
+  [[ $(wc -l < "$ROOT/hooks/$f.ts" 2>/dev/null || echo 9999) -le 500 ]] || mod_ok=0
+done
+[[ $mod_ok -eq 1 ]] && ok || bad "mod hooks incomplete or too long"
+
+step "M2. mod: guard defaults on (userConfig), the command name is metaharness-mod"
+node -e '
+const c = require(process.argv[1]).userConfig || {}
+process.exit(c.guard && c.guard.default === "on" ? 0 : 1)
+' "$ROOT/.claude-plugin/plugin.json" && grep -q "'metaharness-mod'" "$ROOT/hooks/register.ts" && ok || bad "userConfig defaults or command name wrong"
+
+step "M3. mod: hooks never touch the network or spawn a process"
+if grep -nE '\$\.(http|process)\.|child_process|fetch\(' "$ROOT"/hooks/*.ts >/dev/null; then bad "network or process call in hooks"; else ok; fi
+
 printf "\n%s passed, %s failed\n" "$PASS" "$FAIL"
 [[ $FAIL -eq 0 ]] || exit 1

package/plugins/ruflo-metaharness/tests/register.test.ts

@@ -0,0 +1,117 @@
+import type { On } from 'claude-code'
+import { describe, expect, test, tier } from 'claude-code/testing'
+
+tier('user')
+
+const ROOT = '/work'
+const P = 'mcp__plugin_ruflo-core_ruflo__'
+const START = { surface: 'terminal', isInteractive: true, cwd: ROOT } as const
+const slash = (args: string) => ({ command: 'metaharness-mod', args, origin: { kind: 'composer' }, presentation: { isFullscreen: false, columns: 100 } }) as const
+const TOOLS = ["metaharness_score","metaharness_flywheel"].map(name => ({ name: P + name, description: '', mcp: true }))
+
+/** The world beneath the mod: a project root, a file map, the connected tools, and a stub that answers every tool call. */
+function world(on: On, tools = TOOLS) {
+  const files = new Map<string, string>()
+  const registered: string[] = []
+  on('session.start', ($, e) => ({ cwd: e.cwd }))
+  on('session.root', () => ({ value: ROOT }))
+  on('command.register', ($, e) => (registered.push(e.name), { value: { command: e.name } }))
+  on('fs.write', ($, e) => (files.set(e.path, e.text), { value: undefined }))
+  on('tool.list', () => ({ value: tools }))
+  on('clock.now', () => ({ value: Date.now() }))
+  on('tool.call', () => ({ result: 'ran' }))
+  return { files, registered, status: () => JSON.parse(files.get(`${ROOT}/.claude-flow/metaharness-mod/status.json`) ?? '{}') }
+}
+
+const attempt = async ($: Parameters<Parameters<typeof test>[2]>[0], call: object) =>
+  JSON.stringify(await $.tool.call(call as never).then(r => r, (e: unknown) => ({ text: String(e) })))
+
+describe('guard', () => {
+  test('refuses: flywheel promote without confirm, and never echoes the secret', async ($, on) => {
+    world(on)
+    await $.session.start(START)
+    const out = await attempt($, { tool: P + 'metaharness_flywheel', operation: 'promote', receiptId: 'r1' })
+    expect(out).not.toContain('ran')
+    expect(out).toContain('ruflo-metaharness')
+    expect(out).not.toContain('ghp_')
+    expect(out).not.toContain('abcd1234')
+    expect(out).not.toContain('Zx9Qm2')
+  })
+
+  test('refuses: secret in an input, and never echoes the secret', async ($, on) => {
+    world(on)
+    await $.session.start(START)
+    const out = await attempt($, { tool: P + 'metaharness_score', path: `/repo token ghp_${'a1B2'.repeat(10)}` })
+    expect(out).not.toContain('ran')
+    expect(out).toContain('ruflo-metaharness')
+    expect(out).not.toContain('ghp_')
+    expect(out).not.toContain('abcd1234')
+    expect(out).not.toContain('Zx9Qm2')
+  })
+
+  test('passes good calls through', async ($, on) => {
+    world(on)
+    await $.session.start(START)
+    expect(await attempt($, { tool: P + 'metaharness_flywheel', operation: 'promote', receiptId: 'r1', confirm: true })).toContain('ran') // promote with confirm
+    expect(await attempt($, { tool: P + 'metaharness_flywheel', operation: 'status' })).toContain('ran') // flywheel status
+    expect(await attempt($, { tool: P + 'metaharness_score', path: '.' })).toContain('ran') // score
+  })
+
+  test('turning that option off lets the call through', { options: { guard: 'off' } }, async ($, on) => {
+    world(on)
+    await $.session.start(START)
+    expect(await attempt($, { tool: P + 'metaharness_flywheel', operation: 'promote', receiptId: 'r1' })).toContain('ran')
+  })
+
+  test('ignores tools that belong to someone else', async ($, on) => {
+    world(on)
+    await $.session.start(START)
+    expect(await attempt($, { tool: P + 'some_other_tool', value: `token ghp_${'a1B2'.repeat(10)}` })).toContain('ran')
+  })
+})
+
+describe('status file and /metaharness-mod', () => {
+  test('the status file is written at session start with the shape the console reads', async ($, on) => {
+    const w = world(on)
+    await $.session.start(START)
+    expect(w.registered).toEqual(['metaharness-mod'])
+    expect(w.status()).toMatchObject({ version: 1, guard: true, total: 0, blocked: 0, calls: {} })
+    expect(typeof w.status().updatedMs).toBe('number')
+  })
+
+  test('counters move when own tools run and when the guard refuses', async ($, on) => {
+    const w = world(on)
+    await $.session.start(START)
+    await attempt($, { tool: P + 'metaharness_score', path: '.' })
+    await attempt($, { tool: P + 'metaharness_flywheel', operation: 'promote', receiptId: 'r1' })
+    expect(w.status()).toMatchObject({ total: 1, blocked: 1 })
+    expect(Object.keys(w.status().calls)).toHaveLength(1)
+    expect(JSON.stringify(w.status())).not.toContain('ghp_')
+  })
+
+  test('status, tools, recent, scan and help answer locally', async ($, on) => {
+    world(on)
+    await $.session.start(START)
+    expect((await $.command.run(slash('status'))).text).toContain('guard on')
+    expect((await $.command.run(slash('tools'))).text).toContain('metaharness_score')
+    expect((await $.command.run(slash('recent'))).text).toContain('Nothing')
+    expect((await $.command.run(slash(`scan key ghp_${'a1B2'.repeat(10)}`))).text).toContain('github token')
+    expect((await $.command.run(slash('scan plain words'))).text).toContain('Nothing found')
+    expect((await $.command.run(slash(''))).text).toContain('/metaharness-mod status')
+    expect((await $.command.run(slash('what is this'))).text).toContain('Unknown')
+  })
+
+  test('tools says so plainly when none are connected', async ($, on) => {
+    world(on, [])
+    await $.session.start(START)
+    expect((await $.command.run(slash('tools'))).text).toContain('None of this plugin')
+  })
+})
+
+describe('defaults', () => {
+  test('with no options the guard is on', async ($, on) => {
+    const w = world(on)
+    await $.session.start(START)
+    expect(w.status().guard).toBe(true)
+  })
+})

package/plugins/ruflo-metaharness/tests/textsof.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, test, tier } from 'claude-code/testing'
+
+import { textsOf } from '../hooks/guard'
+import { hasSecret } from '../hooks/screen'
+
+tier('user')
+
+const AWS = `AKIA${'IOSFODNN7EXAMPLE'}`
+const BIG = 'QUJD'.repeat(10_000)
+const found = (input: unknown) => textsOf(input).some(hasSecret)
+
+describe('what the guard reads', () => {
+  test('a key name leads its string value, so an object-shaped assignment is caught', () => {
+    expect(found({ meta: { api_key: 'abcdef1234567890abcdef' } })).toBe(true)
+    expect(found({ meta: { maxTokens: 4096, name: 'refresh policy' } })).toBe(false)
+  })
+
+  test('a long field does not starve the fields after it', () => {
+    expect(found({ value: BIG, note: AWS })).toBe(true)
+    expect(found({ a: BIG, b: BIG, c: BIG, d: 'plain text' })).toBe(false)
+  })
+})

package/plugins/ruflo-metaharness/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "./.claude-plugin/types/tsconfig.json"
+}