@claude-flow/cli 3.54.1 → 3.56.0

package/plugins/ruflo-metaharness/scripts/_invoke.mjs

@@ -28,7 +28,8 @@
 //                             library entries (gepa) — never throws on absence
 //   - makeDegradedEmitter()   the ADR-150 rule-#3 exit-0 degraded payload
 //   - runRufloCli()           `memory store|list|retrieve` through the ruflo CLI
-//                             that ships this plugin (#3366) — replaces
+//                             that ships this plugin (#3366), else an installed
+//                             `ruflo` / `claude-flow` on PATH (#3558) — replaces
 //                             `npx @claude-flow/cli@latest` in 4 scripts
 //
 // WHAT DOES NOT LIVE HERE (the per-consumer parts):
@@ -40,11 +41,16 @@
 // stays meaningful on machines with a warm cache / local install):
 //   - RUFLO_METAHARNESS_CACHE_BASE   overrides ~/.ruflo as the cache root
 //   - RUFLO_METAHARNESS_SKIP_LOCAL=1 disables local node_modules resolution
+//   - RUFLO_PLUGIN_SKIP_LOCAL_CLI=1  resolveRufloCli() skips the shipping CLI /
+//                                    repo checkout (#3558; same name in
+//                                    ruflo-cost-tracker and ruflo-adr)
+//   - RUFLO_PLUGIN_SKIP_PATH_CLI=1   resolveRufloCli() skips `ruflo` /
+//                                    `claude-flow` on PATH (#3558)
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { basename, delimiter, dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const INSTALL_TIMEOUT_MS = 180_000; // npm install can be slow on cold cache
@@ -303,12 +309,77 @@ export function makeDegradedEmitter(pkg, pinVersion) {
 // exists next to bin/cli.js — mcp-launch.cjs resolveLocalCliBin()'s guard
 // against an unbuilt checkout — AND its package.json is named
 // @claude-flow/cli, a check added here so an unrelated directory two levels up
-// can never qualify. Unchanged:
+// can never qualify.
+// #3558: a Claude Code marketplace install copies the plugin to
+// ~/.claude/plugins/cache/<marketplace>/ruflo-metaharness/<version>/, where
+// neither candidate exists, so every memory call still went to npx @latest on
+// a machine with ruflo installed. A `ruflo`, then `claude-flow`, found on
+// PATH (ruflo-core ruflo-hook.cjs's order) is now tried before npx.
+// Unchanged:
 //   - CLI_CORE=1 still opts into `npx @claude-flow/cli-core@alpha` (ADR-100);
-//   - no usable local CLI (e.g. a marketplace clone with no build) still falls
-//     back to `npx @claude-flow/cli@latest`.
+//   - no usable local CLI and no ruflo on PATH still falls back to
+//     `npx @claude-flow/cli@latest`.
 const PLUGIN_SCRIPTS_DIR = dirname(fileURLToPath(import.meta.url));
 
+/** Case-insensitive env lookup — Windows env keys are not case-stable (`Path`). */
+function envValue(env, name) {
+  const key = Object.keys(env).find((k) => k.toLowerCase() === name.toLowerCase());
+  return key ? env[key] : undefined;
+}
+
+/**
+ * npm's Windows shim (`<prefix>/ruflo.cmd`, or `node_modules/.bin/ruflo.cmd`)
+ * cannot be spawned without a shell (CVE-2024-27980), so map it to the entry
+ * it wraps: the package's own `bin` field, which must resolve inside the
+ * package — ruflo-core's resolveNpmShim(). null when it is not such a shim.
+ */
+function npmShimEntry(shim, name) {
+  try {
+    const shimDir = dirname(shim);
+    const pkgDir = basename(shimDir).toLowerCase() === '.bin'
+      ? join(shimDir, '..', name)
+      : join(shimDir, 'node_modules', name);
+    const pj = JSON.parse(readFileSync(join(pkgDir, 'package.json'), 'utf-8'));
+    const declared = typeof pj.bin === 'string' ? pj.bin : pj.bin?.[name];
+    if (typeof declared !== 'string') return null;
+    const entry = realpathSync(join(pkgDir, declared));
+    const rel = relative(realpathSync(pkgDir), entry);
+    if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel) || !statSync(entry).isFile()) return null;
+    return entry;
+  } catch { return null; }
+}
+
+/**
+ * `ruflo`, then `claude-flow`, on PATH → `{ command, args, shell, source }`,
+ * else null. fs-only like ruflo-core's resolveCommandPath(): no `which` /
+ * `where` shell per call. Relative PATH entries (including the empty one) are
+ * skipped so a `ruflo` file inside the project being worked on is never run.
+ * On win32 only an npm shim that maps to its JS entry counts; anything else
+ * is skipped rather than run through cmd.exe. `env` / `platform` are
+ * parameters so the win32 branch is testable on POSIX.
+ */
+export function findRufloOnPath(env = process.env, platform = process.platform) {
+  const dirs = (envValue(env, 'PATH') || '')
+    .split(platform === 'win32' ? ';' : delimiter)
+    .filter((d) => isAbsolute(d));
+  for (const name of ['ruflo', 'claude-flow']) {
+    for (const dir of dirs) {
+      if (platform === 'win32') {
+        const shim = join(dir, `${name}.cmd`);
+        const entry = existsSync(shim) ? npmShimEntry(shim, name) : null;
+        if (entry) return { command: process.execPath, args: [entry], shell: false, source: 'path' };
+        continue;
+      }
+      const file = join(dir, name);
+      try {
+        accessSync(file, constants.X_OK);
+        if (statSync(file).isFile()) return { command: file, args: [], shell: false, source: 'path' };
+      } catch { /* keep searching */ }
+    }
+  }
+  return null;
+}
+
 let RUFLO_CLI = null;
 /** `{ command, args, shell, source }` for invoking the ruflo CLI. Memoized. */
 export function resolveRufloCli() {
@@ -316,7 +387,7 @@ export function resolveRufloCli() {
   if (process.env.CLI_CORE === '1') {
     return (RUFLO_CLI = { command: 'npx', args: ['@claude-flow/cli-core@alpha'], shell: process.platform === 'win32', source: 'npx-cli-core' });
   }
-  const candidates = [
+  const candidates = process.env.RUFLO_PLUGIN_SKIP_LOCAL_CLI === '1' ? [] : [
     join(PLUGIN_SCRIPTS_DIR, '..', '..', '..'),                              // published: <cli>/plugins/ruflo-metaharness/scripts
     join(PLUGIN_SCRIPTS_DIR, '..', '..', '..', 'v3', '@claude-flow', 'cli'), // repo checkout / marketplace clone
   ];
@@ -329,6 +400,8 @@ export function resolveRufloCli() {
       }
     } catch { /* not this layout — try the next */ }
   }
+  const onPath = process.env.RUFLO_PLUGIN_SKIP_PATH_CLI === '1' ? null : findRufloOnPath();
+  if (onPath) return (RUFLO_CLI = onPath);
   return (RUFLO_CLI = { command: 'npx', args: ['@claude-flow/cli@latest'], shell: process.platform === 'win32', source: 'npx' });
 }
 

package/plugins/ruflo-metaharness/scripts/smoke.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Structural smoke test for ruflo-metaharness v0.2.3 (ADR-150 Phase 1).
+# Structural smoke test for ruflo-metaharness v0.2.4 (ADR-150 Phase 1).
 set -u
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 PASS=0
@@ -32,10 +32,10 @@ else
   bad "extraction-regex-rot: EXPECTED_TOOLS=$EXPECTED_TOOLS EXPECTED_SUBS=$EXPECTED_SUBS"
 fi
 
-step "1. plugin.json declares 0.2.3 with adr-150 keywords"
+step "1. plugin.json declares 0.2.4 with adr-150 keywords"
 v=$(grep -E '"version"' "$ROOT/.claude-plugin/plugin.json" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-if [[ "$v" != "0.2.3" ]]; then
-  bad "expected 0.2.3, got '$v'"
+if [[ "$v" != "0.2.4" ]]; then
+  bad "expected 0.2.4, got '$v'"
 else
   miss=""
   for k in ruflo metaharness harness scorecard genome mcp-scan threat-model router adr-150 adr-148 adr-149 optional-dependency graceful-degradation subprocess phase-1-mvp; do

package/plugins/ruflo-metaharness/scripts/test-cli-resolution-3558.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+// test-cli-resolution-3558.mjs — regression test for #3558: in a Claude Code
+// marketplace install, metaharness memory calls must use the ruflo CLI that
+// is already installed on PATH, not `npx @claude-flow/cli@latest`.
+//
+// #3366 taught resolveRufloCli() (_invoke.mjs) two local layouts: the
+// @claude-flow/cli that ships the plugin, and a repo checkout. A marketplace
+// install is neither — the plugin is copied to
+// ~/.claude/plugins/cache/<marketplace>/ruflo-metaharness/<version>/ — so it
+// still fell through to npx @latest on a machine with ruflo installed.
+//
+// Hermetic: the plugin is copied into a temp plugin-cache layout; PATH holds
+// only temp dirs with fake `ruflo` / `claude-flow` / `npx` scripts that log
+// their argv. No network, no real CLI. The end-to-end cases use POSIX sh
+// fakes and are skipped on win32; the win32 shim-mapping case runs everywhere.
+//
+// USAGE
+//   node --test plugins/ruflo-metaharness/scripts/test-cli-resolution-3558.mjs
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { delimiter, dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const PLUGIN_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const posixOnly = { skip: process.platform === 'win32' ? 'fake CLIs are POSIX sh scripts' : false };
+
+const write = (file, body, mode) => {
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, body);
+  if (mode) chmodSync(file, mode);
+};
+
+let TMP, CACHE, LOG, WITH_RUFLO, WITH_CLAUDE_FLOW, NPX_ONLY, PROJECT, baseEnv;
+before(() => {
+  // realpath: macOS tmpdir() is /var/… while resolved paths come back as /private/var/…
+  TMP = realpathSync(mkdtempSync(join(tmpdir(), 'metaharness-cli-resolution-')));
+  const home = join(TMP, 'home');
+  CACHE = join(home, '.claude', 'plugins', 'cache', 'ruflo', 'ruflo-metaharness', '0.0.0-test');
+  cpSync(PLUGIN_ROOT, CACHE, { recursive: true });
+  LOG = join(TMP, 'calls.log');
+  const fake = (dir, name) => write(join(dir, name),
+    `#!/bin/sh\nprintf '%s %s\\n' "${name}" "$*" >> "${LOG}"\ncase "$*" in *"memory list"*) echo '[]' ;; *) echo '[OK] done' ;; esac\n`, 0o755);
+  WITH_RUFLO = join(TMP, 'bin-ruflo');
+  fake(WITH_RUFLO, 'ruflo');
+  fake(WITH_RUFLO, 'claude-flow');
+  WITH_CLAUDE_FLOW = join(TMP, 'bin-claude-flow');
+  fake(WITH_CLAUDE_FLOW, 'claude-flow');
+  NPX_ONLY = join(TMP, 'bin-npx');
+  fake(NPX_ONLY, 'npx');
+  PROJECT = join(TMP, 'project');
+  mkdirSync(PROJECT);
+  baseEnv = { ...process.env, HOME: home, USERPROFILE: home, RUFLO_METAHARNESS_CACHE_BASE: join(TMP, 'empty-cache-base') };
+  for (const k of ['CLI_CORE', 'RUFLO_PLUGIN_SKIP_LOCAL_CLI', 'RUFLO_PLUGIN_SKIP_PATH_CLI', 'NODE_OPTIONS']) delete baseEnv[k];
+});
+after(() => rmSync(TMP, { recursive: true, force: true }));
+
+const calls = () => (existsSync(LOG) ? readFileSync(LOG, 'utf-8').trim().split('\n').filter(Boolean) : []);
+/** resolveRufloCli() as seen from `scriptsDir`, in a fresh process. */
+function resolved(env, scriptsDir = join(CACHE, 'scripts')) {
+  const src = `import { resolveRufloCli } from ${JSON.stringify(pathToFileURL(join(scriptsDir, '_invoke.mjs')).href)};\nconsole.log(JSON.stringify(resolveRufloCli()));`;
+  const r = spawnSync(process.execPath, ['--input-type=module', '-e', src], { cwd: PROJECT, encoding: 'utf-8', env: { ...baseEnv, ...env } });
+  assert.equal(r.status, 0, r.stderr);
+  return JSON.parse(r.stdout);
+}
+function auditList(env, scriptsDir = join(CACHE, 'scripts')) {
+  rmSync(LOG, { force: true });
+  const r = spawnSync(process.execPath, [join(scriptsDir, 'audit-list.mjs'), '--format', 'json'], { cwd: PROJECT, encoding: 'utf-8', timeout: 30_000, env: { ...baseEnv, ...env } });
+  assert.equal(r.status, 0, r.stderr);
+  return calls();
+}
+const pathOf = (...dirs) => dirs.join(delimiter);
+
+test('win32: npm\'s ruflo.cmd shim maps to `node <package bin>`, never cmd.exe', async () => {
+  const { findRufloOnPath } = await import(pathToFileURL(join(PLUGIN_ROOT, 'scripts', '_invoke.mjs')).href);
+  const prefix = join(TMP, 'win-prefix');
+  write(join(prefix, 'ruflo.cmd'), '@ECHO off\r\n');
+  write(join(prefix, 'node_modules', 'ruflo', 'package.json'), JSON.stringify({ name: 'ruflo', bin: { ruflo: 'bin/ruflo.js' } }));
+  write(join(prefix, 'node_modules', 'ruflo', 'bin', 'ruflo.js'), '');
+  assert.deepEqual(findRufloOnPath({ Path: prefix }, 'win32'),
+    { command: process.execPath, args: [realpathSync(join(prefix, 'node_modules', 'ruflo', 'bin', 'ruflo.js'))], shell: false, source: 'path' });
+  const bare = join(TMP, 'win-bare');
+  write(join(bare, 'ruflo.cmd'), '@ECHO off\r\n');
+  assert.equal(findRufloOnPath({ PATH: bare }, 'win32'), null, 'a ruflo.cmd that is not an npm package shim is skipped, not run through cmd.exe');
+});
+
+test('plugin-cache install: the installed `ruflo` on PATH serves memory calls, not npx', posixOnly, () => {
+  const env = { PATH: pathOf(WITH_RUFLO, NPX_ONLY) };
+  assert.deepEqual(resolved(env), { command: join(WITH_RUFLO, 'ruflo'), args: [], shell: false, source: 'path' });
+  const c = auditList(env);
+  assert.ok(c.some((l) => l.startsWith('ruflo memory list --namespace metaharness-audit')), c.join(' | ') || 'no CLI called');
+  assert.deepEqual(c.filter((l) => l.startsWith('npx ')), []);
+});
+
+test('no `ruflo` but `claude-flow` on PATH → claude-flow', posixOnly, () => {
+  const c = auditList({ PATH: pathOf(WITH_CLAUDE_FLOW, NPX_ONLY) });
+  assert.ok(c.some((l) => l.startsWith('claude-flow memory list')), c.join(' | '));
+  assert.deepEqual(c.filter((l) => l.startsWith('npx ')), []);
+});
+
+test('no installed CLI → still `npx @claude-flow/cli@latest` (unchanged fallback)', posixOnly, () => {
+  const env = { PATH: pathOf(NPX_ONLY) };
+  assert.equal(resolved(env).source, 'npx');
+  const c = auditList(env);
+  assert.ok(c.some((l) => l.startsWith('npx @claude-flow/cli@latest memory list')), c.join(' | '));
+});
+
+test('CLI_CORE=1 still opts into `npx @claude-flow/cli-core@alpha` (ADR-100)', posixOnly, () => {
+  const c = auditList({ PATH: pathOf(WITH_RUFLO, NPX_ONLY), CLI_CORE: '1' });
+  assert.ok(c.some((l) => l.startsWith('npx @claude-flow/cli-core@alpha memory list')), c.join(' | '));
+  assert.deepEqual(c.filter((l) => l.startsWith('ruflo ')), []);
+});
+
+test('RUFLO_PLUGIN_SKIP_PATH_CLI=1 skips the PATH lookup (test seam)', posixOnly, () => {
+  assert.equal(resolved({ PATH: pathOf(WITH_RUFLO, NPX_ONLY), RUFLO_PLUGIN_SKIP_PATH_CLI: '1' }).source, 'npx');
+});
+
+test('a `ruflo` in the working directory is never run via a relative PATH entry', posixOnly, () => {
+  write(join(PROJECT, 'ruflo'), '#!/bin/sh\nexit 0\n', 0o755);
+  try {
+    assert.equal(resolved({ PATH: ['', '.', NPX_ONLY].join(delimiter) }).source, 'npx');
+  } finally {
+    rmSync(join(PROJECT, 'ruflo'));
+  }
+});
+
+test('published layout: the @claude-flow/cli that ships the plugin still wins over PATH (#3366)', posixOnly, () => {
+  const cli = join(TMP, 'published', 'node_modules', '@claude-flow', 'cli');
+  const scripts = join(cli, 'plugins', 'ruflo-metaharness', 'scripts');
+  cpSync(join(PLUGIN_ROOT, 'scripts'), scripts, { recursive: true });
+  write(join(cli, 'package.json'), JSON.stringify({ name: '@claude-flow/cli', version: '0.0.0-test', type: 'module' }));
+  write(join(cli, 'dist', 'src', 'index.js'), 'export {};\n');
+  write(join(cli, 'bin', 'cli.js'), `import { appendFileSync } from 'node:fs';\nappendFileSync(${JSON.stringify(LOG)}, 'shipping-cli ' + process.argv.slice(2).join(' ') + '\\n');\nconsole.log('[]');\n`);
+  const env = { PATH: pathOf(WITH_RUFLO, NPX_ONLY) };
+  assert.equal(resolved(env, scripts).source, 'local');
+  const c = auditList(env, scripts);
+  assert.ok(c.some((l) => l.startsWith('shipping-cli memory list')), c.join(' | '));
+  assert.deepEqual(c.filter((l) => !l.startsWith('shipping-cli ')), []);
+});

package/plugins/ruflo-metaharness/scripts/test-no-tool-time-npx.mjs

@@ -156,6 +156,11 @@ else process.exit(2);
   const baseEnv = { ...process.env, PATH: `${TRAP}:${process.env.PATH}`, RUFLO_METAHARNESS_CACHE_BASE: join(TMP, 'empty-cache-base') };
   delete baseEnv.RUFLO_METAHARNESS_SKIP_LOCAL;
   delete baseEnv.CLI_CORE;
+  delete baseEnv.RUFLO_PLUGIN_SKIP_LOCAL_CLI;
+  // #3558: Phase 4 asserts the npx fallback; an installed `ruflo` on the
+  // developer's PATH would now be preferred over it. PATH resolution has its
+  // own test (test-cli-resolution-3558.mjs).
+  baseEnv.RUFLO_PLUGIN_SKIP_PATH_CLI = '1';
   const trapped = () => (existsSync(TRAP_LOG) ? readFileSync(TRAP_LOG, 'utf-8').trim() : '');
   const resetTrap = () => rmSync(TRAP_LOG, { force: true });
   const run = (script, args, env = baseEnv, scriptsDir = PLUGIN_SCRIPTS, cwd = PROJECT) => {