@claude-flow/cli 3.54.0 → 3.54.1

package/dist/src/mods/probe.d.ts

@@ -29,5 +29,12 @@ export interface ProbeInputs {
     /** Reads for the plugin-resolution findings; the real filesystem when absent. */
     fs?: ReadFs;
 }
+declare const LEGACY_EVENTS: {
+    readonly route: "UserPromptSubmit";
+    readonly 'post-edit': "PostToolUse";
+};
+/** Which of route/post-edit the settings run through the CLI's own `hooks` command, in any of the files. */
+export declare function legacyCliHooks(files: readonly string[]): Array<keyof typeof LEGACY_EVENTS>;
 export declare function probeMods(inputs: ProbeInputs): Finding[];
+export {};
 //# sourceMappingURL=probe.d.ts.map

package/dist/src/mods/probe.js

@@ -33,6 +33,26 @@ export function managedSettingsPath(os = platform()) {
         return 'C:\\ProgramData\\ClaudeCode\\managed-settings.json';
     return '/etc/claude-code/managed-settings.json';
 }
+const LEGACY_EVENTS = { route: 'UserPromptSubmit', 'post-edit': 'PostToolUse' };
+/** Which of route/post-edit the settings run through the CLI's own `hooks` command, in any of the files. */
+export function legacyCliHooks(files) {
+    const commands = (event) => files.flatMap((f) => {
+        let groups;
+        try {
+            groups = get(readSettingsFile(f), 'hooks', event);
+        }
+        catch {
+            return [];
+        }
+        return Array.isArray(groups)
+            ? groups.flatMap((g) => (Array.isArray(g?.hooks) ? g.hooks.map((h) => h?.command).filter((c) => typeof c === 'string') : []))
+            : [];
+    });
+    return Object.keys(LEGACY_EVENTS).filter((sub) => {
+        const word = new RegExp(`(?:^|[\\s/"'])(?:@claude-flow/cli|claude-flow|ruflo)(?:@[\\w.-]+)?["']?\\s+hooks\\s+${sub}(?![\\w-])`);
+        return commands(LEGACY_EVENTS[sub]).some((c) => word.test(c));
+    });
+}
 export function probeMods(inputs) {
     const root = resolve(inputs.projectRoot);
     const home = inputs.home ?? homedir();
@@ -104,6 +124,14 @@ export function probeMods(inputs) {
     findings.push(managedOnly !== undefined && managedOnly !== false
         ? { name: 'managed policy', status: 'warn', message: 'allowManagedModsOnly is set: Claude Code refuses user mods; classic hooks stay in charge' }
         : { name: 'managed policy', status: 'pass', message: managed === undefined ? 'no managed settings' : 'user mods allowed (allowManagedModsOnly not set)' });
+    // 4a. Settings that still run the CLI's own `hooks route|post-edit` (what init
+    // wrote before hook-handler.cjs). That command never reads the handshake, so
+    // the mod stands down for those events (plugins/ruflo-mods/hooks/ownership.ts,
+    // legacyCliConfigured: keep the two patterns in step).
+    const legacy = legacyCliHooks(files);
+    if (legacy.length) {
+        findings.push({ name: 'legacy CLI hooks', status: 'warn', message: `settings run the CLI's own \`hooks ${legacy.join('` and `hooks ')}\`: the mod stands down for ${legacy.join(' and ')}, which that command keeps`, fix: 'ruflo init upgrade --settings (regenerate the settings hooks)' });
+    }
     // 4. Every classic helper a hook could run honours the handshake (the mod's
     // own rule, plugins/ruflo-mods/hooks/session.ts); else the mod stands down.
     const helpers = [...new Set([join(root, '.claude', 'helpers', 'hook-handler.cjs'), join(home, '.claude', 'helpers', 'hook-handler.cjs')])].filter(existsSync);
@@ -116,7 +144,7 @@ export function probeMods(inputs) {
         }
     });
     findings.push(helpers.length === 0
-        ? { name: 'classic handshake', status: 'pass', message: 'no hook-handler.cjs: the mod owns route and post-edit outright' }
+        ? { name: 'classic handshake', status: 'pass', message: legacy.length ? 'no hook-handler.cjs (see legacy CLI hooks)' : 'no hook-handler.cjs: the mod owns route and post-edit outright' }
         : stale.length === 0
             ? { name: 'classic handshake', status: 'pass', message: `${helpers.join(', ')} hand route and post-edit to the mod while it runs` }
             : { name: 'classic handshake', status: 'warn', message: `${stale.join(', ')} predate${stale.length === 1 ? 's' : ''} the handshake: the mod stands down and classic hooks keep route/post-edit`, fix: 'ruflo init --upgrade (refresh helpers in the project and in ~/.claude)' });

package/dist/src/production/monitoring.d.ts

@@ -147,6 +147,8 @@ export declare class MonitoringHooks {
      */
     reset(): void;
     private checkAlerts;
+    /** Drop metrics older than retentionMs (also applied on reads, #3855). */
+    private expireMetrics;
     private cleanupMetrics;
 }
 /**

package/dist/src/production/monitoring.js

@@ -243,6 +243,7 @@ export class MonitoringHooks {
      * Get metrics for a specific name
      */
     getMetrics(name, since) {
+        this.expireMetrics();
         let filtered = this.metrics.filter(m => m.name === name);
         if (since) {
             filtered = filtered.filter(m => m.timestamp >= since);
@@ -253,6 +254,7 @@ export class MonitoringHooks {
      * Get all metrics summary
      */
     getMetricsSummary() {
+        this.expireMetrics();
         const summary = {};
         for (const metric of this.metrics) {
             if (!summary[metric.name]) {
@@ -320,11 +322,14 @@ export class MonitoringHooks {
             }
         }
     }
+    /** Drop metrics older than retentionMs (also applied on reads, #3855). */
+    expireMetrics() {
+        const cutoff = Date.now() - this.config.retentionMs;
+        this.metrics = this.metrics.filter(m => m.timestamp > cutoff);
+    }
     cleanupMetrics() {
-        const now = Date.now();
-        const cutoff = now - this.config.retentionMs;
         // Remove old metrics
-        this.metrics = this.metrics.filter(m => m.timestamp > cutoff);
+        this.expireMetrics();
         // Limit total metrics
         if (this.metrics.length > this.config.maxMetrics) {
             this.metrics = this.metrics.slice(-this.config.maxMetrics);

package/dist/src/production/rate-limiter.js

@@ -41,12 +41,15 @@ export class RateLimiter {
         const limits = this.getLimits(operation);
         const now = Date.now();
         // Get or create bucket
-        const bucketKey = userId && this.config.perUserLimits
+        const trackedUser = userId && this.config.perUserLimits ? userId : undefined;
+        const bucketKey = trackedUser
             ? `${operation}:${userId}`
             : `global:${operation}`;
         let bucket = this.buckets.get(bucketKey);
         if (!bucket) {
             bucket = this.createBucket();
+            bucket.operation = operation;
+            bucket.userId = trackedUser;
             this.buckets.set(bucketKey, bucket);
             this.cleanupBuckets();
         }
@@ -133,10 +136,10 @@ export class RateLimiter {
     getStats() {
         const operationCounts = new Map();
         const users = new Set();
-        for (const [key, bucket] of this.buckets) {
-            const [operation, userId] = key.split(':');
-            if (userId)
-                users.add(userId);
+        for (const bucket of this.buckets.values()) {
+            const operation = bucket.operation;
+            if (bucket.userId)
+                users.add(bucket.userId);
             const current = operationCounts.get(operation) || 0;
             operationCounts.set(operation, current + bucket.requests.length);
         }

package/dist/src/production/retry.js

@@ -54,6 +54,8 @@ function calculateDelay(attempt, config, strategy = 'exponential') {
         const jitterRange = delay * config.jitter;
         delay += (Math.random() - 0.5) * 2 * jitterRange;
     }
+    // Enforce the configured maximum on the final (jittered) delay
+    delay = Math.min(delay, config.maxDelayMs);
     return Math.round(Math.max(0, delay));
 }
 /**

package/dist/src/services/git-workspace-identity.js

@@ -24,7 +24,7 @@
 import { createHash } from 'crypto';
 import { resolve } from 'path';
 import * as fs from 'fs';
-import { safeGitTextSync } from '@claude-flow/security/safe-git';
+import { safeGitBufferSync, safeGitTextSync } from '@claude-flow/security/safe-git';
 const GIT_TIMEOUT_MS = 3000;
 function git(cwd, ...args) {
     try {
@@ -37,6 +37,23 @@ function git(cwd, ...args) {
         return null;
     }
 }
+/**
+ * Path-valued git output: git terminates the record with a single LF, so strip
+ * only that. A full trim() would corrupt valid paths ending in whitespace.
+ */
+function gitPath(cwd, ...args) {
+    try {
+        const out = safeGitBufferSync(cwd, args, {
+            timeoutMs: GIT_TIMEOUT_MS,
+            stderr: 'ignore',
+        }).toString('utf8');
+        const rec = out.endsWith('\n') ? out.slice(0, -1) : out;
+        return rec.length > 0 ? rec : null;
+    }
+    catch {
+        return null;
+    }
+}
 function sha256(input) {
     return createHash('sha256').update(input).digest('hex');
 }
@@ -50,7 +67,7 @@ export function resolveGitWorkspaceIdentity(dir) {
     const resolved = resolve(dir);
     let stable = identityCache.get(resolved);
     if (!stable) {
-        const worktreeRoot = git(resolved, 'rev-parse', '--show-toplevel');
+        const worktreeRoot = gitPath(resolved, 'rev-parse', '--show-toplevel');
         if (!worktreeRoot) {
             stable = {
                 worktreeRoot: resolved,
@@ -63,7 +80,7 @@ export function resolveGitWorkspaceIdentity(dir) {
         else {
             // --git-common-dir may be relative to the worktree root (git < 2.31
             // and some invocation contexts) — resolve against it.
-            const rawCommon = git(worktreeRoot, 'rev-parse', '--git-common-dir') ?? '.git';
+            const rawCommon = gitPath(worktreeRoot, 'rev-parse', '--git-common-dir') ?? '.git';
             const commonGitDir = resolve(worktreeRoot, rawCommon);
             stable = {
                 worktreeRoot,

package/dist/src/services/worker-queue.d.ts

@@ -103,6 +103,7 @@ export declare class WorkerQueue extends EventEmitter {
     private workerId;
     private heartbeatTimer?;
     private processingTasks;
+    private retryTimers;
     private isShuttingDown;
     private maxConcurrent;
     private initialized;

package/dist/src/services/worker-queue.js

@@ -162,6 +162,7 @@ export class WorkerQueue extends EventEmitter {
     workerId;
     heartbeatTimer;
     processingTasks = new Set();
+    retryTimers = new Set();
     isShuttingDown = false;
     maxConcurrent = 1;
     initialized = false;
@@ -286,10 +287,13 @@ export class WorkerQueue extends EventEmitter {
             this.store.setTask(taskId, task);
             // Re-queue with delay (exponential backoff)
             const delay = Math.min(30000, 1000 * Math.pow(2, task.retryCount));
-            setTimeout(() => {
+            // Tracked so shutdown() can release it
+            const timer = setTimeout(() => {
+                this.retryTimers.delete(timer);
                 const queueName = this.getQueueName(task.workerType);
                 this.store.pushToQueue(queueName, taskId, PRIORITY_SCORES[task.priority]);
             }, delay);
+            this.retryTimers.add(timer);
             this.emit('taskRetrying', { taskId, retryCount: task.retryCount, delay });
         }
         else {
@@ -469,6 +473,10 @@ export class WorkerQueue extends EventEmitter {
         for (const taskId of this.processingTasks) {
             await this.fail(taskId, 'Worker shutdown', false);
         }
+        // Release scheduled retry timers (they would hold the process open)
+        for (const timer of this.retryTimers)
+            clearTimeout(timer);
+        this.retryTimers.clear();
         // Stop store cleanup
         this.store.stopCleanup();
         await this.unregisterWorker();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.54.0",
+  "version": "3.54.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -104,7 +104,7 @@
     "@claude-flow/neural": "3.0.0",
     "@claude-flow/plugin-agent-federation": "1.0.0",
     "@claude-flow/security": "3.0.1",
-    "@claude-flow/shared": "3.0.0",
+    "@claude-flow/shared": "3.0.1",
     "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",