@claude-flow/cli 3.51.1 → 3.52.1

package/dist/src/guidance/mod-sources.js

@@ -0,0 +1,123 @@
+/** Explicit export only: bind the compiled snapshots to immutable Git blobs. */
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { devNull } from 'node:os';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { createHash } from 'node:crypto';
+import { promisify } from 'node:util';
+import { safeGitArgv } from '@claude-flow/security/safe-git';
+const run = promisify(execFile);
+const OID = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
+export const MAX_GUIDANCE_SOURCE_BYTES = 1024 * 1024;
+/** Local reads only; no shell, Git hooks, filters, replacement refs or lazy fetch. */
+async function git(repo, args) {
+    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.toUpperCase().startsWith('GIT_')));
+    Object.assign(env, { GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: devNull, GIT_NO_LAZY_FETCH: '1', GIT_ALLOW_PROTOCOL: '', GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0' });
+    const { stdout } = await run('git', safeGitArgv(repo, ['--no-replace-objects', '--literal-pathspecs', '-c', `core.hooksPath=${devNull}`, '-c', 'protocol.allow=never', ...args]), {
+        encoding: 'buffer', env, maxBuffer: 2 * MAX_GUIDANCE_SOURCE_BYTES, timeout: 10_000, windowsHide: true,
+    });
+    return stdout;
+}
+/** Older Git ignores GIT_NO_LAZY_FETCH. Refuse all promisor configuration
+ * before reading objects, including repositories whose objects happen to exist.
+ * Shallow clones with ordinary local objects remain supported. */
+async function requireLocalObjects(repo) {
+    try {
+        await git(repo, ['config', '--get-regexp', '^(extensions\\.partialclone|remote\\..*\\.(promisor|partialclonefilter))$']);
+    }
+    catch (error) {
+        const result = error;
+        // git config returns 1 only for no matching entries. Other errors fail closed.
+        if (result.code === 1 && !result.signal && result.stdout?.length === 0 && result.stderr?.length === 0)
+            return;
+        throw error;
+    }
+    throw new Error('Offline mod export does not support partial clones or promisor repositories; use a checkout with local objects');
+}
+async function sourcePath(path) {
+    const absolute = resolve(path);
+    if (/[\u0000-\u001f\u007f]/.test(absolute))
+        throw new Error('Unsupported guidance source path');
+    const stat = await lstat(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink() || await realpath(absolute) !== absolute)
+        throw new Error('Guidance source must be a regular file without symlink components');
+    return absolute;
+}
+/** Descriptor based bounded read; never reread mutable bytes after verification. */
+async function sourceBytes(path) {
+    const file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.size > MAX_GUIDANCE_SOURCE_BYTES)
+            throw new Error('Guidance source exceeds 1 MiB or is not a regular file');
+        const bytes = Buffer.alloc(MAX_GUIDANCE_SOURCE_BYTES + 1);
+        let size = 0;
+        while (size < bytes.length) {
+            const { bytesRead } = await file.read(bytes, size, bytes.length - size, null);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+        }
+        if (size > MAX_GUIDANCE_SOURCE_BYTES)
+            throw new Error('Guidance source exceeds 1 MiB');
+        return bytes.subarray(0, size);
+    }
+    finally {
+        await file.close();
+    }
+}
+/** A commit label alone is insufficient. Both supplied files must match its blobs. */
+export async function readModGuidanceSources(input) {
+    if (!OID.test(input.revision))
+        throw new Error('--revision must be a full immutable source commit SHA');
+    const rootPath = await sourcePath(input.rootPath);
+    let repo;
+    try {
+        repo = (await git(dirname(rootPath), ['rev-parse', '--show-toplevel'])).toString('utf8').replace(/\r?\n$/, '');
+        repo = await realpath(repo);
+    }
+    catch {
+        throw new Error('Guidance source requires a local Git repository');
+    }
+    await requireLocalObjects(repo);
+    try {
+        if ((await git(repo, ['cat-file', '-t', input.revision])).toString('utf8').trim() !== 'commit')
+            throw new Error('not a commit');
+        if ((await git(repo, ['rev-parse', '--verify', `${input.revision}^{commit}`])).toString('utf8').trim() !== input.revision)
+            throw new Error('abbreviated commit');
+    }
+    catch {
+        throw new Error('Guidance source requires an existing full immutable commit');
+    }
+    const read = async (path) => {
+        const absolute = await sourcePath(path);
+        const rel = relative(repo, absolute);
+        if (!rel || isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`))
+            throw new Error('Guidance sources must belong to the same Git repository');
+        const sourceRepo = (await git(dirname(absolute), ['rev-parse', '--show-toplevel'])).toString('utf8').replace(/\r?\n$/, '');
+        if (await realpath(sourceRepo) !== repo)
+            throw new Error('Guidance sources must belong to the same Git repository');
+        await requireLocalObjects(repo);
+        const gitPath = rel.split(sep).join('/');
+        const tree = (await git(repo, ['ls-tree', '-z', '--full-tree', input.revision, '--', gitPath])).toString('utf8');
+        const match = /^(100644|100755) blob ([a-f0-9]{40}|[a-f0-9]{64})\t([^\0]+)\0$/.exec(tree);
+        if (!match || match[3] !== gitPath)
+            throw new Error('Guidance source must be a regular tracked blob in the supplied commit');
+        const blobId = match[2];
+        const blobSize = Number((await git(repo, ['cat-file', '-s', blobId])).toString('utf8').trim());
+        if (!Number.isSafeInteger(blobSize) || blobSize < 0 || blobSize > MAX_GUIDANCE_SOURCE_BYTES)
+            throw new Error('Committed guidance source exceeds 1 MiB');
+        const committed = await git(repo, ['cat-file', 'blob', blobId]);
+        const bytes = await sourceBytes(absolute);
+        if (!bytes.equals(committed))
+            throw new Error('Guidance source bytes differ from the supplied commit; commit the reviewed source before exporting');
+        // Preserve a BOM in the compiler snapshot; reject invalid UTF-8 rather than replacing bytes.
+        const content = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+        return { content, binding: { path: gitPath, blobId, sha256: createHash('sha256').update(bytes).digest('hex'), byteLength: bytes.length } };
+    };
+    const root = await read(rootPath);
+    const local = input.localPath === undefined ? undefined : await read(input.localPath);
+    return { sourceRevision: input.revision, rootContent: root.content, localContent: local?.content, sources: { root: root.binding, ...(local ? { local: local.binding } : {}) } };
+}
+//# sourceMappingURL=mod-sources.js.map

package/dist/src/init/helpers-generator.js

@@ -433,6 +433,75 @@ if (command && commands[command]) {
 module.exports = commands;
 `;
 }
+// Literal-word root guard mirrored in the mod and both shipped classic helpers.
+const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, depth = 0) {
+  let word = '', quote = '', started = false, redirect = false
+  let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
+  const isRoot = (operand) => {
+    if (!operand.startsWith('/')) return false
+    const parts = []
+    for (const part of operand.split('/')) {
+      if (!part || part === '.') continue
+      if (part === '..') parts.pop()
+      else parts.push(part)
+    }
+    return parts.length === 0 || /[*?\[]/.test(parts[0])
+  }
+  const finishWord = () => {
+    if (!started) return false
+    // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
+    // Bound rescanning to four levels; beyond that retain its conservative check.
+    if (word.includes('rm') && /[\s;&|()]/.test(word)) {
+      if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
+    }
+    if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
+    else if (!optionsEnded && word === '--') optionsEnded = true
+    else if (!optionsEnded && word.startsWith('-')) {
+      recursive = recursive || word === '--recursive' || /^-[a-z]*r[a-z]*$/.test(word)
+      force = force || word === '--force' || /^-[a-z]*f[a-z]*$/.test(word)
+    } else root = root || isRoot(word)
+    word = ''; started = false
+    return inRm && recursive && force && root
+  }
+  const finishCommand = () => {
+    const denied = inRm && recursive && force && root
+    inRm = optionsEnded = recursive = force = root = false
+    return denied
+  }
+  for (let i = 0; i < command.length; i++) {
+    const char = command[i]
+    const redirectionAmpersand = char === '&' && (redirect || command[i + 1] === '>')
+    redirect = false
+    if (quote) {
+      if (char === quote) quote = ''
+      else if (quote === '"' && char === '\\' && i + 1 < command.length &&
+        (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
+          command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
+        const next = command[++i]
+        if (next !== '\n') word += next
+      } else word += char
+      continue
+    }
+    if (char === '\\' && i + 1 < command.length) {
+      const next = command[++i]
+      if (next !== '\n') { word += next; started = true }
+    } else if (char === '"' || char === "'") {
+      quote = char; started = true
+    } else if (char === '#' && !started) {
+      while (i < command.length && command[i] !== '\n') i++
+      if (finishCommand()) return true
+    } else if (char === ' ' || char === '\t' || char === '\r' || char === '\n' ||
+      ';|&()<>'.includes(char)) {
+      if (finishWord()) return true
+      // Redirections separate words, but later operands still belong to rm.
+      redirect = char === '<' || char === '>'
+      if (!redirectionAmpersand && (char === '\n' || ';|&()'.includes(char)) && finishCommand()) return true
+    } else {
+      word += char; started = true
+    }
+  }
+  return finishWord() || finishCommand()
+}`;
 /**
  * Generate hook-handler.cjs (cross-platform hook dispatcher)
  * This is the inline fallback when file copy from the package fails.
@@ -569,13 +638,14 @@ export function generateHookHandler() {
         '    }',
         '    if (router && router.routeTask) {',
         '      const result = router.routeTask(prompt);',
+        "      const row = (text) => '| ' + text.substring(0, 60).padEnd(60) + ' |';",
         '      var output = [];',
         "      output.push('[INFO] Routing task: ' + (prompt.substring(0, 80) || '(no prompt)'));",
         "      output.push('');",
         "      output.push('+------------------- Primary Recommendation -------------------+');",
-        "      output.push('| Agent: ' + result.agent.padEnd(53) + '|');",
-        "      output.push('| Confidence: ' + (result.confidence * 100).toFixed(1) + '%' + ' '.repeat(44) + '|');",
-        "      output.push('| Reason: ' + result.reason.substring(0, 53).padEnd(53) + '|');",
+        "      output.push(row('Agent: ' + result.agent));",
+        "      output.push(row('Confidence: ' + (result.confidence * 100).toFixed(1) + '%'));",
+        "      output.push(row('Reason: ' + (result.reason || '')));",
         "      output.push('+--------------------------------------------------------------+');",
         "      console.log(output.join('\\n'));",
         '    } else {',
@@ -637,8 +707,9 @@ export function generateHookHandler() {
         "  'pre-bash': () => {",
         "    var cmd = String(hookInput.command || toolInputObj.command || prompt || '').toLowerCase();",
         "    var dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\\\', ':(){:|:&};:'];",
+        ROOT_DELETE_CHECK_SOURCE.split('\n').map((line) => '    ' + line).join('\n'),
         '    for (var i = 0; i < dangerous.length; i++) {',
-        '      if (cmd.includes(dangerous[i])) {',
+        "      if (dangerous[i] === 'rm -rf /' ? hasRootDelete(cmd) : cmd.includes(dangerous[i])) {",
         "        console.error('[BLOCKED] Dangerous command detected: ' + dangerous[i]);",
         '        // Claude Code PreToolUse: exit 2 blocks execution; exit 1 is non-blocking.',
         '        process.exit(2);',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.51.1",
+  "version": "3.52.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/plugins/ruflo-metaharness/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruflo-metaharness",
-  "description": "MetaHarness integration for ruflo — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150's architectural constraint that MetaHarness remains an optional augmentation, never a required runtime dependency",
-  "version": "0.1.1",
+  "description": "MetaHarness integration for ruflo — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150's architectural constraint that MetaHarness remains an optional augmentation, never a required runtime dependency. As a mod (ADR-445): confirms flywheel promotion, keeps secrets out of inputs, /metaharness-mod, and a status file the console shows",
+  "version": "0.2.3",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet"
@@ -27,6 +27,22 @@
     "namespace-routing",
     "verified",
     "ci",
-    "phase-1-mvp"
-  ]
+    "phase-1-mvp",
+    "mod",
+    "function-hooks",
+    "guard"
+  ],
+  "userConfig": {
+    "guard": {
+      "type": "string",
+      "title": "Guard",
+      "description": "Refuse tool calls that are clearly harmful in this plugin's domain (see README, As a mod).",
+      "required": false,
+      "default": "on",
+      "options": [
+        "on",
+        "off"
+      ]
+    }
+  }
 }

package/plugins/ruflo-metaharness/README.md

@@ -70,3 +70,15 @@ This means:
 - [Research dossier](https://gist.github.com/ruvnet/19d166ff9acf368c9da4172d91ac9113) — full graded-evidence sourcing
 - [Upstream](https://github.com/ruvnet/agent-harness-generator) — `metaharness` source
 - ADR-148/149 — `@metaharness/router` cost-optimal routing (sibling integration)
+
+## As a mod
+
+This plugin ships a function-hook mod (ADR-445, `hooks/register.ts`). It makes no network call, spawns no process and makes no model call.
+
+- **Guard** (tighten-only, on by default): Refuses any `metaharness_*` input that holds a key, token or password (MetaHarness writes its inputs to audit memory), and `metaharness_flywheel` `promote` / `evidence-reset` unless the call carries `confirm: true`. A refusal never echoes the secret.
+- **`/metaharness-mod`**: `status`, `recent`, `tools` (which of this plugin's tools are connected) and `scan <text>` (would the guard refuse it). Answered locally.
+- **Status file**: `.claude-flow/metaharness-mod/status.json` (`{version: 1, updatedMs, guard, calls, total, blocked, recent}`, counters only, never tool input), written at session start and after every call to this plugin's tools.
+
+Options (`userConfig`): `guard` (on).
+
+Test it: `claude plugin validate plugins/ruflo-metaharness`, `claude plugin test plugins/ruflo-metaharness`, `bash plugins/ruflo-metaharness/scripts/smoke.sh`.

package/plugins/ruflo-metaharness/hooks/guard.ts

@@ -0,0 +1,27 @@
+import { hasSecret } from './screen'
+import type { ModOptions } from './options'
+import { textsOf } from './screen'
+export { textsOf }
+
+/** `mcp__<server>__<tool>` into its tool half; tool names never hold a double underscore. */
+export function shortName(name: string): string {
+  const at = name.lastIndexOf('__')
+  return name.startsWith('mcp__') && at > 5 ? name.slice(at + 2) : name
+}
+
+const field = (input: unknown, key: string): unknown => (typeof input === 'object' && input !== null ? (input as Record<string, unknown>)[key] : undefined)
+
+
+/** The tools this plugin owns: every `metaharness_*` tool. */
+export const isOwn = (name: string, _input?: unknown): boolean => name.startsWith('metaharness_')
+
+/** The reason a call is refused, or undefined when it may go. Never names or echoes a secret. */
+export function verdict(name: string, input: unknown, _opts: ModOptions, _calls: Record<string, number>): string | undefined {
+  if (textsOf(input).some(hasSecret)) {
+    return 'ruflo-metaharness: this input holds what looks like a secret (a key, token or password). MetaHarness records its inputs in audit memory; pass a path or a reference instead.'
+  }
+  if (name === 'metaharness_flywheel' && ['promote', 'evidence-reset'].includes(String(field(input, 'operation'))) && field(input, 'confirm') !== true) {
+    return 'ruflo-metaharness: promoting a receipt or resetting evidence changes the active harness. Ask the user, then retry with confirm: true.'
+  }
+  return undefined
+}

package/plugins/ruflo-metaharness/hooks/hooks.json

@@ -0,0 +1,4 @@
+{
+  "description": "MetaHarness as a mod (ADR-445): a tighten-only guard on the metaharness tools (promotion needs an explicit confirm, no secrets in inputs), a status file the console reads, and /metaharness-mod.",
+  "modules": ["./register.ts"]
+}

package/plugins/ruflo-metaharness/hooks/options.ts

@@ -0,0 +1,14 @@
+import type { PluginOptions } from 'claude-code'
+
+/** The plugin's `userConfig`, validated: a bad value is the default (guard on). */
+export type ModOptions = { readonly guard: boolean; readonly extra: Readonly<Record<string, unknown>> }
+
+// BEGIN SHARED FLAG (generated by scripts/sync-mod-screen.mjs; edit plugins/ruflo-agentdb/hooks/options.ts)
+export const flag = (value: unknown, fallback: boolean) =>
+  value === true || value === 'true' || value === 'on' ? true : value === false || value === 'false' || value === 'off' ? false : fallback
+// END SHARED FLAG
+
+export function readOptions(options: PluginOptions | undefined): ModOptions {
+  const o = options ?? {}
+  return { guard: flag(o.guard, true), extra: {} }
+}

package/plugins/ruflo-metaharness/hooks/register.ts

@@ -0,0 +1,108 @@
+import type { Hook, Register } from 'claude-code'
+
+import { isOwn, shortName, verdict } from './guard'
+import { readOptions, type ModOptions } from './options'
+import { scan } from './screen'
+
+const COMMAND = 'metaharness-mod'
+const STATUS_PATH = '.claude-flow/metaharness-mod/status.json'
+const RECENT = 5
+
+type Dollar = Parameters<Hook<'session.start'>>[0]
+
+/** Everything one session of the mod keeps: its settings, per-tool counters, what was refused and the project root. */
+type Session = {
+  readonly opts: ModOptions
+  readonly calls: Record<string, number>
+  blocked: number
+  readonly recent: string[]
+  root?: string
+}
+
+const total = (s: Session) => Object.values(s.calls).reduce((a, b) => a + b, 0)
+
+function note(s: Session, line: string): void {
+  s.recent.push(line)
+  if (s.recent.length > RECENT) s.recent.splice(0, s.recent.length - RECENT)
+}
+
+/** The status file the console reads; `version` lets it refuse a shape it does not know. Counters only, never tool input. */
+async function flush($: Dollar, s: Session): Promise<void> {
+  if (s.root === undefined) return
+  const body = { version: 1, updatedMs: await $.clock.now(), guard: s.opts.guard, ...s.opts.extra, calls: s.calls, total: total(s), blocked: s.blocked, recent: s.recent }
+  try {
+    await $.fs.write(`${s.root}/${STATUS_PATH}`, `${JSON.stringify(body, null, 2)}\n`)
+  } catch {
+    /* the status file is a courtesy */
+  }
+}
+
+/** The connected tools this plugin owns, by short name. */
+async function connected($: Dollar): Promise<string[]> {
+  const tools = await $.tool.list()
+  return tools.filter(t => t.mcp && isOwn(shortName(t.name))).map(t => shortName(t.name))
+}
+
+const HELP = ['/metaharness-mod status', '/metaharness-mod scan <text>', '/metaharness-mod recent', '/metaharness-mod tools'].join('\n')
+
+async function answer($: Dollar, s: Session, args: string): Promise<string> {
+  const [verb = '', ...rest] = args.trim().split(/\s+/)
+  const arg = rest.join(' ')
+  if (verb === '' || verb === 'help') return HELP
+  if (verb === 'status') {
+    const per = Object.entries(s.calls).map(([k, v]) => `${k} ${v}`).join(' · ')
+    return [`guard ${s.opts.guard ? 'on' : 'off'}${Object.entries(s.opts.extra).map(([k, v]) => ` · ${k} ${String(v)}`).join('')}`, `${total(s)} call${total(s) === 1 ? '' : 's'}${per ? ` (${per})` : ''} · refused ${s.blocked}`].join('\n')
+  }
+  if (verb === 'recent') return s.recent.length ? s.recent.map(r => `- ${r}`).join('\n') : 'Nothing has gone through this session.'
+  if (verb === 'tools') {
+    const names = await connected($)
+    return names.length ? names.join('\n') : 'None of this plugin\'s tools are connected. Connect the ruflo MCP server and try again.'
+  }
+  if (verb === 'scan') {
+    if (arg === '') return 'usage: /metaharness-mod scan <text>'
+    const found = scan(arg)
+    return found.secrets.length ? `The guard would refuse that (${found.secrets.join(', ')}).` : 'Nothing found: the guard would let that through.'
+  }
+  return `Unknown: ${verb}\n${HELP}`
+}
+
+/**
+ * MetaHarness as a mod (ADR-445): a tighten-only guard on this plugin's own tools, a status file the console reads, and `/metaharness-mod`.
+ * No network, no process, no model call.
+ */
+export const register: Register = (on, options) => {
+  const s: Session = { opts: readOptions(options), calls: {}, blocked: 0, recent: [] }
+
+  on('session.start', async ($, e, next) => {
+    const result = await next(e)
+    s.root = (await $.session.root()) as string | undefined
+    try {
+      await $.command.register({ name: COMMAND, description: 'MetaHarness mod: status, scan <text>, recent, tools' })
+    } catch {
+      /* a name taken by another plugin must not stop the mod */
+    }
+    await flush($, s)
+    return result
+  })
+
+  on('tool.call', async ($, e, next) => {
+    const name = shortName(e.tool)
+    if (!isOwn(name, e)) return next(e)
+    if (s.opts.guard) {
+      const reason = verdict(name, e, s.opts, s.calls)
+      if (reason !== undefined) {
+        s.blocked++
+        note(s, `refused ${name}`)
+        await flush($, s)
+        return { deny: reason }
+      }
+    }
+    s.calls[name] = (s.calls[name] ?? 0) + 1
+    note(s, name)
+    await flush($, s)
+    return next(e)
+  })
+
+  /** `/metaharness-mod`: the plugin's own commands are prompt commands, which no hook can answer. */
+  on('command.run', { command: COMMAND }, async ($, e) => ({ text: await answer($, s, typeof e.args === 'string' ? e.args : '') }))
+}