@claude-flow/cli 3.54.1 → 3.55.0

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.54.1",
+    "version": "3.55.0",
     "files": {
       "auto-memory-hook.mjs": "c8d218526a3c34034c2a69de23f507f0eb0f70d59c16426a8edc849e6ac22529",
       "hook-handler.cjs": "34d2aacfb59a73ff94b1467bb57ab9d9c4af89c0e470aadf3bd0d74a503a658d",
@@ -9,6 +9,6 @@
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "GORi4ozu4COfL048CD+GWNMiX4hdXVrn2/tvRXWcj9OioRiUknKlfhNwkL6PVtcNar+5xDn7J9BzGFBrPgblCA==",
+  "signature": "FT6oLMAU2RXu8iAdlOFTNGcjYZ52pkhrGFgn3/oKJdtVab0etCzO24Nr2ut1Hr9kn3tRAqb6D8MZwKfcoSqlCQ==",
   "algorithm": "ed25519"
 }

package/bin/cli.js

@@ -301,7 +301,7 @@ if (isMCPMode) {
         }
 
         try {
-          const result = await callMCPTool(toolName, toolParams, { sessionId });
+          const result = await callMCPTool(toolName, toolParams, { sessionId, transport: 'stdio' });
           // Failed task outcomes are data; an explicit handler error is a tool failure.
           const isError = result !== null && typeof result === 'object'
             && typeof result.error === 'string' && result.error.trim().length > 0;

package/bin/mcp-server.js

@@ -190,7 +190,7 @@ async function handleMessage(message) {
         }
 
         try {
-          const result = await callMCPTool(toolName, toolParams, { sessionId });
+          const result = await callMCPTool(toolName, toolParams, { sessionId, transport: 'stdio' });
           return {
             jsonrpc: '2.0',
             id: message.id,

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-07T07:34:48.002Z",
-  "gitSha": "b9ce891c",
+  "generatedAt": "2026-10-07T17:32:59.615Z",
+  "gitSha": "2ab3f99f",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/commands/autopilot.js

@@ -181,8 +181,8 @@ const configCommand = {
     name: 'config',
     description: 'Configure max iterations, timeout, and task sources',
     options: [
-        { name: 'max-iterations', type: 'string', description: 'Max re-engagement iterations (1-1000)' },
-        { name: 'timeout', type: 'string', description: 'Timeout in minutes (1-1440)' },
+        { name: 'max-iterations', type: 'number', description: 'Max re-engagement iterations (1-1000)' },
+        { name: 'timeout', type: 'number', description: 'Timeout in minutes (1-1440)' },
         { name: 'task-sources', type: 'string', description: `Comma-separated task sources: ${[...VALID_TASK_SOURCES].join(', ')}` },
     ],
     action: async (ctx) => {

package/dist/src/commands/daemon.js

@@ -10,6 +10,11 @@ import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
 import { homedir } from 'os';
 import * as fs from 'fs';
+// #1968 / #3547: shared validator for `--workers <list>`, used both when
+// reading the flag into DaemonConfig (below) and when forwarding it to the
+// forked background child's argv (startBackgroundDaemon). One pattern, one
+// place, so the two paths can't drift out of sync on what they accept.
+const WORKERS_RE = /^[a-z][a-z0-9_-]*(,[a-z][a-z0-9_-]*)*$/;
 // Start daemon subcommand
 const startCommand = {
     name: 'start',
@@ -119,6 +124,22 @@ const startCommand = {
                 output.printWarning(`Ignoring invalid --ttl value: ${sanitize(rawTtl)}`);
             }
         }
+        // #3547 (#1968 follow-up): `--workers` was forwarded to the forked
+        // background child's argv (below, in startBackgroundDaemon) but never
+        // read into DaemonConfig here, so WorkerDaemon always fell back to
+        // DEFAULT_WORKERS (7 enabled) regardless of what was requested — in
+        // both foreground mode (this same action, run directly) and background
+        // mode (this same action, re-run in the forked child with --foreground
+        // and the forwarded --workers flag).
+        const rawWorkers = ctx.flags.workers;
+        if (typeof rawWorkers === 'string' && rawWorkers.length > 0) {
+            if (WORKERS_RE.test(rawWorkers)) {
+                config.enabledWorkers = rawWorkers.split(',');
+            }
+            else if (!quiet) {
+                output.printWarning(`Ignoring invalid --workers value: ${sanitize(rawWorkers)}`);
+            }
+        }
         // Check if background daemon already running (skip if we ARE the daemon process)
         //
         // #2407 — without an atomic lockfile, N concurrent `daemon start` calls
@@ -518,7 +539,6 @@ async function startBackgroundDaemon(projectRoot, quiet, forwarded = {}) {
     // through — argv goes straight to a forked process so reject anything
     // that doesn't look like a comma-separated worker-name list or one of
     // the allowed sandbox modes.
-    const WORKERS_RE = /^[a-z][a-z0-9_-]*(,[a-z][a-z0-9_-]*)*$/;
     if (typeof workers === 'string' && workers.length > 0 && WORKERS_RE.test(workers)) {
         forkArgs.push('--workers', workers);
     }

package/dist/src/commands/hive-mind.js

@@ -1016,6 +1016,13 @@ const consensusCommand = {
         const action = ctx.flags.action || 'list';
         try {
             const result = await callMCPTool('hive-mind_consensus', { action, proposalId: ctx.flags.proposalId, type: ctx.flags.type, value: ctx.flags.value, vote: ctx.flags.vote === 'yes', voterId: ctx.flags.voterId, hiveToken: getHiveTokenForCli() });
+            if (result.error) {
+                if (ctx.flags.format === 'json')
+                    output.printJson(result);
+                else
+                    output.printError(`Consensus error: ${String(result.error)}`);
+                return { success: false, exitCode: 1, data: result };
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
                 return { success: true, data: result };

package/dist/src/commands/mcp.js

@@ -8,7 +8,7 @@
 import { output } from '../output.js';
 import { confirm } from '../prompt.js';
 import { installParentDeathWatchdog } from '../runtime/parent-death-watchdog.js';
-import { getServerManager, getMCPServerStatus, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
+import { getServerManager, getMCPServerStatus, resolveMcpHttpAuthToken, isLoopbackHost, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
 import { listMCPTools, callMCPTool, hasTool } from '../mcp-client.js';
 // MCP tools categories
 const TOOL_CATEGORIES = [
@@ -71,6 +71,16 @@ const startCommand = {
             description: 'HTTP request timeout in milliseconds (default 30000; env RUFLO_MCP_REQUEST_TIMEOUT_MS)',
             type: 'number'
         },
+        {
+            name: 'auth-token-file',
+            description: 'Read the HTTP bearer token from this file (http transport). Preferred over --auth-token; env RUFLO_MCP_HTTP_TOKEN also works',
+            type: 'string'
+        },
+        {
+            name: 'auth-token',
+            description: 'HTTP bearer token (16+ printable ASCII chars). Visible in argv/ps - prefer RUFLO_MCP_HTTP_TOKEN or --auth-token-file',
+            type: 'string'
+        },
         {
             name: 'daemon',
             short: 'd',
@@ -90,6 +100,8 @@ const startCommand = {
         { command: 'claude-flow mcp start', description: 'Start with defaults (stdio)' },
         { command: 'claude-flow mcp start -p 8080 -t http', description: 'Start HTTP server' },
         { command: 'claude-flow mcp start -t http --request-timeout-ms 120000', description: 'Allow slower cold-start HTTP tools' },
+        { command: 'RUFLO_MCP_HTTP_TOKEN=<16+ chars> claude-flow mcp start -t http', description: 'HTTP server requiring "Authorization: Bearer <token>" on every request (except GET /health)' },
+        { command: 'RUFLO_MCP_HTTP_TOKEN=<16+ chars> claude-flow mcp start -t http --host 0.0.0.0', description: 'Non-loopback bind: allowed only with a token (or RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1)' },
         { command: 'claude-flow mcp start -d', description: 'Start as daemon' },
         { command: 'claude-flow mcp start -f', description: 'Force restart (kill existing)' }
     ],
@@ -109,6 +121,17 @@ const startCommand = {
             output.printError('Request timeout must be an integer from 1 to 3600000 milliseconds');
             return { success: false, exitCode: 1 };
         }
+        let authToken;
+        try {
+            authToken = resolveMcpHttpAuthToken({
+                token: (ctx.flags.authToken ?? ctx.flags['auth-token']),
+                tokenFile: (ctx.flags.authTokenFile ?? ctx.flags['auth-token-file']),
+            });
+        }
+        catch (error) {
+            output.printError(error.message);
+            return { success: false, exitCode: 1 };
+        }
         const daemon = ctx.flags.daemon ?? false;
         const force = ctx.flags.force ?? false;
         output.writeln();
@@ -166,6 +189,7 @@ const startCommand = {
             port,
             tools: !tools || tools === 'all' ? 'all' : tools.split(','),
             ...(requestTimeoutMs === undefined ? {} : { requestTimeoutMs }),
+            ...(authToken ? { authToken } : {}),
             daemonize: daemon,
         };
         try {
@@ -218,6 +242,15 @@ const startCommand = {
             if (transport === 'http') {
                 output.writeln(output.dim(`  Health: http://${host}:${port}/health`));
                 output.writeln(output.dim(`  RPC: http://${host}:${port}/rpc`));
+                if (authToken) {
+                    output.writeln(output.dim('  Auth: bearer token required (Authorization: Bearer <token>); /health is public'));
+                }
+                else if (isLoopbackHost(host)) {
+                    output.printWarning('No auth token set: any local process (and DNS-rebinding web pages) can call tools. Set RUFLO_MCP_HTTP_TOKEN to require a bearer token.');
+                }
+                else {
+                    output.printWarning('Running UNAUTHENTICATED on a non-loopback host (RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP is set).');
+                }
             }
             else if (transport === 'websocket') {
                 output.writeln(output.dim(`  WebSocket: ws://${host}:${port}/ws`));
@@ -596,6 +629,7 @@ const execCommand = {
             const startTime = performance.now();
             const result = await callMCPTool(tool, params, {
                 sessionId: `cli-${Date.now().toString(36)}`,
+                transport: 'cli',
                 requestId: `exec-${Date.now()}`,
             });
             const duration = performance.now() - startTime;

package/dist/src/commands/policy.js

@@ -1,3 +1,4 @@
+import { anchorPosture } from '../services/policy-ledger-anchor.js';
 import { output } from '../output.js';
 import { autoMigratePolicyStateIfNeeded, evaluatePolicyRequest, loadPolicyState, revokePolicyApproval, setPolicyBudget, setPolicyMode, upsertPolicyRule, verifyPolicyLedger, } from '../services/policy-runtime.js';
 function argJson(value, label) {
@@ -19,12 +20,16 @@ function requireInteractiveAdministrator() {
         throw new Error('policy administration requires an interactive local terminal');
     }
 }
+// #3602: say what verify can and cannot prove.
+const LEDGER_TRUST_SCOPE = 'detects edits confined to state.json or to the project directory; '
+    + 'does not defend against an attacker who can rewrite both the project directory and ~/.config/ruflo (ADR-475)';
 export const policyCommand = {
     name: 'policy',
     description: 'Agentic policy engine — evaluate actions, manage rules/approvals, and verify the decision ledger (ADR-324)',
     options: [
         { name: 'mode', type: 'string', description: 'Policy mode: legacy | observe | enforce' },
         { name: 'project-root', type: 'string', description: 'Project root containing .claude-flow/policy' },
+        { name: 'establish-anchor', type: 'boolean', description: 'verify: explicitly anchor a ledger that has receipts but no anchor (interactive, logged with user and time)' },
     ],
     async action(context) {
         const args = context.args ?? [];
@@ -87,8 +92,11 @@ export const policyCommand = {
                 return print({ receipts: state.receipts });
             }
             if (operation === 'verify') {
-                const ledger = await verifyPolicyLedger(root);
-                const result = print(ledger);
+                const establishAnchor = flags['establish-anchor'] === true || flags.establishAnchor === true;
+                if (establishAnchor)
+                    requireInteractiveAdministrator();
+                const ledger = await verifyPolicyLedger(root, { establishAnchor });
+                const result = print({ ...ledger, anchors: anchorPosture(root), scope: LEDGER_TRUST_SCOPE });
                 return ledger.valid ? result : { ...result, success: false, exitCode: 1 };
             }
             throw new Error(`unknown policy operation: ${operation}`);

package/dist/src/mcp-server.d.ts

@@ -30,6 +30,12 @@ export interface MCPServerOptions {
     daemonize?: boolean;
     timeout?: number;
     requestTimeoutMs?: number;
+    /**
+     * Bearer token every HTTP request must present (`Authorization: Bearer <token>`).
+     * http transport only. Prefer RUFLO_MCP_HTTP_TOKEN / a token file over this
+     * field's CLI flag so the secret stays out of argv. Never logged or emitted.
+     */
+    authToken?: string;
 }
 /**
  * MCP Server status
@@ -49,6 +55,33 @@ export interface MCPServerStatus {
         metrics?: Record<string, number>;
     };
 }
+/** Exported for tests — see LOOPBACK_HOSTS. */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Explicit, documented opt-out of the non-loopback authorization gate in
+ * startHttpServer(). Exported for tests.
+ */
+export declare function isUnauthenticatedHttpAllowed(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The full startHttpServer() authorization gate, as a pure function:
+ * true means "refuse to start" (see the thrown error for why).
+ *
+ * A non-loopback bind is allowed when requests are authenticated (a bearer
+ * token is configured on the http transport) or the operator explicitly opts
+ * out with RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1. Loopback binds are never
+ * refused, with or without a token. Exported for tests.
+ */
+export declare function shouldRefuseUnauthenticatedHttp(host: string, env?: NodeJS.ProcessEnv, authenticated?: boolean): boolean;
+/**
+ * Resolve the HTTP bearer token. Precedence: explicit value (CLI flag), token
+ * file, then RUFLO_MCP_HTTP_TOKEN. An unset/empty env var means "no token";
+ * a token that is set but malformed throws, so a typo can never silently
+ * start the server unauthenticated. Exported for tests.
+ */
+export declare function resolveMcpHttpAuthToken(input?: {
+    token?: string;
+    tokenFile?: string;
+}, env?: NodeJS.ProcessEnv, readFile?: (p: string) => string): string | undefined;
 export declare function parseMcpToolSelection(value: string | undefined): string[] | 'all';
 /**
  * Apply the existing `--tools` contract to advertised schemas. A selector can

package/dist/src/mcp-server.js

@@ -104,8 +104,72 @@ function processStartToken(pid) {
     }
 }
 /**
- * Default configuration
+ * Hosts treated as same-machine-only for MCP HTTP tool-call authorization
+ * purposes (see startHttpServer's non-loopback authorization gate below).
+ * Deliberately exact-string matching only (no DNS resolution) so anything
+ * not spelled exactly one of these three fails closed rather than open.
  */
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+/** Exported for tests — see LOOPBACK_HOSTS. */
+export function isLoopbackHost(host) {
+    return LOOPBACK_HOSTS.has(host);
+}
+/**
+ * Explicit, documented opt-out of the non-loopback authorization gate in
+ * startHttpServer(). Exported for tests.
+ */
+export function isUnauthenticatedHttpAllowed(env = process.env) {
+    const v = env.RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP;
+    return v === '1' || v === 'true';
+}
+/**
+ * The full startHttpServer() authorization gate, as a pure function:
+ * true means "refuse to start" (see the thrown error for why).
+ *
+ * A non-loopback bind is allowed when requests are authenticated (a bearer
+ * token is configured on the http transport) or the operator explicitly opts
+ * out with RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1. Loopback binds are never
+ * refused, with or without a token. Exported for tests.
+ */
+export function shouldRefuseUnauthenticatedHttp(host, env = process.env, authenticated = false) {
+    return !isLoopbackHost(host) && !authenticated && !isUnauthenticatedHttpAllowed(env);
+}
+/** Printable ASCII without space (RFC 6750 token-ish), 16-512 chars. */
+const AUTH_TOKEN_PATTERN = /^[\x21-\x7e]{16,512}$/;
+/**
+ * Resolve the HTTP bearer token. Precedence: explicit value (CLI flag), token
+ * file, then RUFLO_MCP_HTTP_TOKEN. An unset/empty env var means "no token";
+ * a token that is set but malformed throws, so a typo can never silently
+ * start the server unauthenticated. Exported for tests.
+ */
+export function resolveMcpHttpAuthToken(input = {}, env = process.env, readFile = (p) => fs.readFileSync(p, 'utf8')) {
+    let raw;
+    let source = '';
+    if (input.token !== undefined) {
+        raw = input.token;
+        source = '--auth-token';
+    }
+    else if (input.tokenFile !== undefined) {
+        source = '--auth-token-file';
+        try {
+            raw = readFile(input.tokenFile).replace(/\r?\n$/, '');
+        }
+        catch {
+            throw new Error('Could not read the MCP HTTP auth token file given to --auth-token-file');
+        }
+    }
+    else if (env.RUFLO_MCP_HTTP_TOKEN !== undefined && env.RUFLO_MCP_HTTP_TOKEN !== '') {
+        raw = env.RUFLO_MCP_HTTP_TOKEN;
+        source = 'RUFLO_MCP_HTTP_TOKEN';
+    }
+    if (raw === undefined)
+        return undefined;
+    if (!AUTH_TOKEN_PATTERN.test(raw)) {
+        // The value is deliberately not echoed.
+        throw new Error(`Invalid MCP HTTP auth token from ${source}: it must be 16-512 printable ASCII characters with no spaces`);
+    }
+    return raw;
+}
 const DEFAULT_OPTIONS = {
     transport: 'stdio',
     host: 'localhost',
@@ -239,7 +303,7 @@ export class MCPServerManager extends EventEmitter {
         }
         const startTime = performance.now();
         this.startTime = new Date();
-        this.emit('starting', { options: this.options });
+        this.emit('starting', { options: { ...this.options, authToken: this.options.authToken ? '[redacted]' : undefined } });
         try {
             if (this.options.transport === 'stdio') {
                 // For stdio transport, spawn the server process
@@ -671,7 +735,7 @@ export class MCPServerManager extends EventEmitter {
                         }
                     }
                     try {
-                        const result = await callMCPTool(toolName, toolParams, { sessionId });
+                        const result = await callMCPTool(toolName, toolParams, { sessionId, transport: 'stdio' });
                         const isError = hasToolError(result);
                         trackRequest(toolName, !isError);
                         return {
@@ -725,6 +789,31 @@ export class MCPServerManager extends EventEmitter {
      * Start HTTP server in-process
      */
     async startHttpServer() {
+        // Authorization gate first, before any import or bind: a refused start must
+        // not depend on (or touch) anything else.
+        const authToken = this.options.authToken || undefined;
+        if (authToken && this.options.transport !== 'http') {
+            // The standalone websocket transport has no working token check, so a
+            // token there would be a false promise of protection.
+            throw new Error('An MCP HTTP auth token is only supported with --transport http');
+        }
+        if (shouldRefuseUnauthenticatedHttp(this.options.host, process.env, !!authToken)) {
+            // No ToolAuthorizer is wired below: @claude-flow/mcp's tool-call
+            // authorization is fully opt-in (requireToolAuthorization/toolAuthorizer),
+            // so without this check every registered tool (memory_*, hooks_*,
+            // agentdb_*, hive-mind_*, ...) would be callable by any client that can
+            // reach this host:port, unauthenticated — the same shape as
+            // CVE-2026-81735 (CVSS 10/10, UI-TARS-desktop mcp-http-server: optional
+            // auth middleware never wired by the integrating CLI + a non-loopback
+            // bind). Loopback stays unaffected; this only gates an explicit
+            // non-default `--host`. A configured bearer token (below) lifts the gate.
+            throw new Error(`Refusing to start the MCP HTTP server on non-loopback host "${this.options.host}": ` +
+                'this server is unauthenticated unless a token is set, so every registered MCP tool ' +
+                'would be reachable over the network. Set RUFLO_MCP_HTTP_TOKEN (or --auth-token-file) ' +
+                'to require a bearer token, bind to a loopback host (127.0.0.1, ::1, or localhost), or set ' +
+                'RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1 to acknowledge the risk and proceed ' +
+                '(e.g. when a trusted reverse proxy or network boundary already enforces auth).');
+        }
         // Dynamically import the MCP server package
         // FIX for issue #942: Use proper package import instead of broken relative path
         const { createMCPServer } = await import('@claude-flow/mcp');
@@ -747,7 +836,7 @@ export class MCPServerManager extends EventEmitter {
             cacheTTL: tool.cacheTTL,
             handler: async (input, context) => {
                 try {
-                    const result = await callMCPTool(tool.name, input || {}, { sessionId: context?.sessionId || fallbackSessionId });
+                    const result = await callMCPTool(tool.name, input || {}, { sessionId: context?.sessionId || fallbackSessionId, transport: this.options.transport === 'websocket' ? 'websocket' : 'http' });
                     trackRequest(tool.name, !hasToolError(result));
                     return result;
                 }
@@ -770,6 +859,9 @@ export class MCPServerManager extends EventEmitter {
             enableMetrics: true,
             enableCaching: true,
             requestTimeout: this.options.requestTimeoutMs,
+            auth: authToken
+                ? { enabled: true, method: 'token', tokens: [authToken] }
+                : undefined,
         }, logger);
         const registration = mcpServer.registerTools(cliTools);
         if (registration.failed.length > 0) {

package/dist/src/mcp-tools/hive-mind-tools.d.ts

@@ -6,10 +6,8 @@
 import { type MCPTool } from './types.js';
 /**
  * Read the current hiveToken directly off disk, for same-machine callers
- * that already have filesystem access to hive state (the CLI's own
- * `hive-mind join/leave/consensus` subcommands) -- NOT exposed over any MCP
- * tool response (in particular, not hive-mind_status), since that's a
- * remote-reachable surface a capability token must not leak through.
+ * (the CLI's own `hive-mind join/leave/consensus` subcommands) -- NOT exposed
+ * over any MCP tool response.
  */
 export declare function getHiveTokenForCli(): string | undefined;
 export declare const hiveMindTools: MCPTool[];