@claude-flow/cli 3.54.1 → 3.56.0

package/dist/src/commands/memory-backup.js

@@ -1,39 +1,53 @@
 import { output } from '../output.js';
-import { backupMemoryDb, defaultMemoryDbPath } from '../services/memory-backup.js';
+import { backupMemoryDb, backupProjectMemoryDbs } from '../services/memory-backup.js';
 export const backupCommand = {
     name: 'backup',
-    description: 'Snapshot the vector-memory DB (.swarm/memory.db) — WAL-safe, rotated, optional GCS offsite',
+    description: 'Snapshot active project memory stores — WAL-safe, rotated, optional GCS offsite',
     options: [
-        { name: 'db', description: 'Source DB (default: .swarm/memory.db)', type: 'string' },
+        { name: 'db', description: 'Source DB (default: configured CLI and AgentDB stores)', type: 'string' },
         { name: 'dir', description: 'Destination dir (default: .swarm/backups)', type: 'string' },
         { name: 'keep', description: 'Rotation — keep the newest N snapshots (default 7)', type: 'number', default: 7 },
         { name: 'gcs', description: 'Also upload the snapshot to a gs://bucket/prefix (offsite)', type: 'string' },
         { name: 'verbose', short: 'v', description: 'Verbose logging', type: 'boolean' },
     ],
     examples: [
-        { command: 'claude-flow memory backup', description: 'Snapshot to .swarm/backups, keep last 7' },
+        { command: 'claude-flow memory backup', description: 'Snapshot active project stores, keep last 7' },
         { command: 'claude-flow memory backup --keep 30', description: 'Keep a month of nightly snapshots' },
         { command: 'claude-flow memory backup --gcs gs://my-bucket/ruflo-backups', description: 'Also upload offsite to GCS' },
     ],
     action: async (ctx) => {
-        const r = await backupMemoryDb({
-            dbPath: ctx.flags.db || defaultMemoryDbPath(ctx.cwd),
+        const options = {
             destDir: ctx.flags.dir,
             keep: typeof ctx.flags.keep === 'number' ? ctx.flags.keep : 7,
             gcs: ctx.flags.gcs,
             verbose: ctx.flags.verbose === true,
-        });
+        };
+        const explicitDb = ctx.flags.db;
+        let r;
+        let receipts;
+        if (explicitDb) {
+            r = await backupMemoryDb({ ...options, dbPath: explicitDb });
+            receipts = [r];
+        }
+        else {
+            const project = await backupProjectMemoryDbs(ctx.cwd, options);
+            r = project;
+            receipts = project.backups;
+        }
         if (!r.backedUp) {
             // no-db is a benign "nothing to back up yet"; anything else is a real skip.
             if (r.skipped === 'no-db') {
-                output.printWarning('No memory DB found to back up (.swarm/memory.db). Nothing to do.');
+                output.printWarning('No memory DB found to back up. Nothing to do.');
                 return { success: true, data: r };
             }
             output.printError(`Backup skipped: ${r.skipped}`);
             return { success: false, exitCode: 1, data: r };
         }
         output.writeln();
-        output.writeln(output.success(`Backed up → ${r.path}`));
+        for (const receipt of receipts) {
+            if (receipt.backedUp)
+                output.writeln(output.success(`Backed up → ${receipt.path}`));
+        }
         output.printList([
             `Size:      ${Math.round((r.sizeBytes ?? 0) / 1024)} KB`,
             `Rotated:   ${r.rotatedAway?.length ?? 0} old snapshot(s) removed`,

package/dist/src/commands/memory.d.ts

@@ -1,7 +1,3 @@
-/**
- * V3 CLI Memory Command
- * Memory operations for AgentDB integration
- */
 import type { Command } from '../types.js';
 export declare const memoryCommand: Command;
 export default memoryCommand;

package/dist/src/commands/memory.js

@@ -2,6 +2,7 @@
  * V3 CLI Memory Command
  * Memory operations for AgentDB integration
  */
+import { validateAppendConditions } from '../memory/append-conditions.js';
 import { output } from '../output.js';
 import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
@@ -110,6 +111,10 @@ const storeCommand = {
             type: 'boolean',
             default: false
         },
+        { name: 'embedding', type: 'boolean', description: 'Generate an embedding (default true; --no-embedding stores structured data only)' },
+        { name: 'append-conditions', type: 'string', description: 'JSON predicates checked atomically with a native append-only write' },
+        { name: 'require-native', type: 'boolean', description: 'Refuse whole-image and in-memory fallback memory writers' },
+        { name: 'append-only', type: 'boolean', description: 'Immutable insert; never update or resurrect an existing key' },
         {
             name: 'upsert',
             short: 'u',
@@ -233,7 +238,7 @@ const storeCommand = {
             size: Buffer.byteLength(value, 'utf8')
         };
         output.printInfo(`Storing in ${namespace}/${key}...`);
-        // Use direct sql.js storage with automatic embedding generation
+        // Use the canonical provider; embedding and native immutable append controls are explicit.
         try {
             const { storeEntry, resolveDbPath: _rdbStore } = await import('../memory/memory-initializer.js');
             const dbPath = _rdbStore(ctx.flags.path);
@@ -244,7 +249,10 @@ const storeCommand = {
                 key,
                 value,
                 namespace,
-                generateEmbeddingFlag: true, // Always generate embeddings for semantic search
+                generateEmbeddingFlag: ctx.flags.embedding !== false,
+                requireNative: ctx.flags.requireNative === true,
+                appendOnly: ctx.flags.appendOnly === true,
+                ...(typeof ctx.flags.appendConditions === 'string' ? { appendConditions: validateAppendConditions(JSON.parse(ctx.flags.appendConditions)) } : {}),
                 tags,
                 ttl,
                 upsert,

package/dist/src/commands/plugins.js

@@ -86,7 +86,15 @@ const listCommand = {
                 output.printError(result.error || 'Unknown error');
                 return { success: false, exitCode: 1 };
             }
-            spinner.succeed(`Registry discovered: ${result.registry.totalPlugins} plugins available`);
+            if (result.demo) {
+                // The signed registry was unavailable or failed verification (see ruvnet/ruflo#3211):
+                // say so instead of reporting a successful discovery over the built-in list.
+                spinner.stop(output.warning(`Signed plugin registry unavailable or unverified; showing the built-in list ` +
+                    `(${result.registry.totalPlugins} plugins)`));
+            }
+            else {
+                spinner.succeed(`Registry discovered: ${result.registry.totalPlugins} plugins available`);
+            }
             output.writeln();
             // Build search options
             const searchOptions = {
@@ -165,6 +173,10 @@ const listCommand = {
                 output.writeln(output.dim('(ratings: cached — cloud unavailable)'));
             }
             output.writeln(output.dim(`Source: ${result.source}${result.fromCache ? ' (cached)' : ''}`));
+            if (result.demo) {
+                output.writeln(output.warning('Not from the signed registry: download counts, ratings and trust labels are the ' +
+                    "CLI's built-in defaults, not verified registry data."));
+            }
             if (result.cid) {
                 output.writeln(output.dim(`Registry CID: ${result.cid.slice(0, 30)}...`));
             }

package/dist/src/commands/policy.js

@@ -1,3 +1,4 @@
+import { anchorPosture } from '../services/policy-ledger-anchor.js';
 import { output } from '../output.js';
 import { autoMigratePolicyStateIfNeeded, evaluatePolicyRequest, loadPolicyState, revokePolicyApproval, setPolicyBudget, setPolicyMode, upsertPolicyRule, verifyPolicyLedger, } from '../services/policy-runtime.js';
 function argJson(value, label) {
@@ -19,12 +20,16 @@ function requireInteractiveAdministrator() {
         throw new Error('policy administration requires an interactive local terminal');
     }
 }
+// #3602: say what verify can and cannot prove.
+const LEDGER_TRUST_SCOPE = 'detects edits confined to state.json or to the project directory; '
+    + 'does not defend against an attacker who can rewrite both the project directory and ~/.config/ruflo (ADR-475)';
 export const policyCommand = {
     name: 'policy',
     description: 'Agentic policy engine — evaluate actions, manage rules/approvals, and verify the decision ledger (ADR-324)',
     options: [
         { name: 'mode', type: 'string', description: 'Policy mode: legacy | observe | enforce' },
         { name: 'project-root', type: 'string', description: 'Project root containing .claude-flow/policy' },
+        { name: 'establish-anchor', type: 'boolean', description: 'verify: explicitly anchor a ledger that has receipts but no anchor (interactive, logged with user and time)' },
     ],
     async action(context) {
         const args = context.args ?? [];
@@ -87,8 +92,11 @@ export const policyCommand = {
                 return print({ receipts: state.receipts });
             }
             if (operation === 'verify') {
-                const ledger = await verifyPolicyLedger(root);
-                const result = print(ledger);
+                const establishAnchor = flags['establish-anchor'] === true || flags.establishAnchor === true;
+                if (establishAnchor)
+                    requireInteractiveAdministrator();
+                const ledger = await verifyPolicyLedger(root, { establishAnchor });
+                const result = print({ ...ledger, anchors: anchorPosture(root), scope: LEDGER_TRUST_SCOPE });
                 return ledger.valid ? result : { ...result, success: false, exitCode: 1 };
             }
             throw new Error(`unknown policy operation: ${operation}`);

package/dist/src/commands/task.js

@@ -339,6 +339,18 @@ const statusCommand = {
                 includeLogs: ctx.flags.logs,
                 includeMetrics: true
             });
+            // The MCP tool answers an unknown id with status "not_found" and no other fields.
+            // Rendering that as a record printed "Task: undefined", "Invalid Date" and
+            // "undefined%" and exited 0, so scripts and agents took it as success.
+            if ((result.status) === 'not_found') {
+                if (ctx.flags.format === 'json') {
+                    output.printJson(result);
+                }
+                else {
+                    output.printError(`Task not found: ${taskId}`);
+                }
+                return { success: false, exitCode: 1 };
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
                 return { success: true, data: result };

package/dist/src/init/settings-generator.js

@@ -51,9 +51,9 @@ export function generateSettings(options) {
             pr: '🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)',
         };
     }
-    // Note: Claude Code expects 'model' to be a string, not an object
-    // Additional ruflo-specific model preferences live in claudeFlow.modelPreferences below
-    settings.model = 'claude-sonnet-5';
+    // #3527: deliberately no settings.model. Project settings outrank the user's
+    // own settings, so a pin here would silently override the model the user chose.
+    // Ruflo's own routing preferences live in claudeFlow.modelPreferences below.
     // Add Agent Teams configuration (experimental feature)
     settings.env = {
         // Enable Claude Code Agent Teams for multi-agent coordination

package/dist/src/mcp-server.d.ts

@@ -30,6 +30,12 @@ export interface MCPServerOptions {
     daemonize?: boolean;
     timeout?: number;
     requestTimeoutMs?: number;
+    /**
+     * Bearer token every HTTP request must present (`Authorization: Bearer <token>`).
+     * http transport only. Prefer RUFLO_MCP_HTTP_TOKEN / a token file over this
+     * field's CLI flag so the secret stays out of argv. Never logged or emitted.
+     */
+    authToken?: string;
 }
 /**
  * MCP Server status
@@ -49,6 +55,33 @@ export interface MCPServerStatus {
         metrics?: Record<string, number>;
     };
 }
+/** Exported for tests — see LOOPBACK_HOSTS. */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Explicit, documented opt-out of the non-loopback authorization gate in
+ * startHttpServer(). Exported for tests.
+ */
+export declare function isUnauthenticatedHttpAllowed(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The full startHttpServer() authorization gate, as a pure function:
+ * true means "refuse to start" (see the thrown error for why).
+ *
+ * A non-loopback bind is allowed when requests are authenticated (a bearer
+ * token is configured on the http transport) or the operator explicitly opts
+ * out with RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1. Loopback binds are never
+ * refused, with or without a token. Exported for tests.
+ */
+export declare function shouldRefuseUnauthenticatedHttp(host: string, env?: NodeJS.ProcessEnv, authenticated?: boolean): boolean;
+/**
+ * Resolve the HTTP bearer token. Precedence: explicit value (CLI flag), token
+ * file, then RUFLO_MCP_HTTP_TOKEN. An unset/empty env var means "no token";
+ * a token that is set but malformed throws, so a typo can never silently
+ * start the server unauthenticated. Exported for tests.
+ */
+export declare function resolveMcpHttpAuthToken(input?: {
+    token?: string;
+    tokenFile?: string;
+}, env?: NodeJS.ProcessEnv, readFile?: (p: string) => string): string | undefined;
 export declare function parseMcpToolSelection(value: string | undefined): string[] | 'all';
 /**
  * Apply the existing `--tools` contract to advertised schemas. A selector can

package/dist/src/mcp-server.js

@@ -104,8 +104,72 @@ function processStartToken(pid) {
     }
 }
 /**
- * Default configuration
+ * Hosts treated as same-machine-only for MCP HTTP tool-call authorization
+ * purposes (see startHttpServer's non-loopback authorization gate below).
+ * Deliberately exact-string matching only (no DNS resolution) so anything
+ * not spelled exactly one of these three fails closed rather than open.
  */
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+/** Exported for tests — see LOOPBACK_HOSTS. */
+export function isLoopbackHost(host) {
+    return LOOPBACK_HOSTS.has(host);
+}
+/**
+ * Explicit, documented opt-out of the non-loopback authorization gate in
+ * startHttpServer(). Exported for tests.
+ */
+export function isUnauthenticatedHttpAllowed(env = process.env) {
+    const v = env.RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP;
+    return v === '1' || v === 'true';
+}
+/**
+ * The full startHttpServer() authorization gate, as a pure function:
+ * true means "refuse to start" (see the thrown error for why).
+ *
+ * A non-loopback bind is allowed when requests are authenticated (a bearer
+ * token is configured on the http transport) or the operator explicitly opts
+ * out with RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1. Loopback binds are never
+ * refused, with or without a token. Exported for tests.
+ */
+export function shouldRefuseUnauthenticatedHttp(host, env = process.env, authenticated = false) {
+    return !isLoopbackHost(host) && !authenticated && !isUnauthenticatedHttpAllowed(env);
+}
+/** Printable ASCII without space (RFC 6750 token-ish), 16-512 chars. */
+const AUTH_TOKEN_PATTERN = /^[\x21-\x7e]{16,512}$/;
+/**
+ * Resolve the HTTP bearer token. Precedence: explicit value (CLI flag), token
+ * file, then RUFLO_MCP_HTTP_TOKEN. An unset/empty env var means "no token";
+ * a token that is set but malformed throws, so a typo can never silently
+ * start the server unauthenticated. Exported for tests.
+ */
+export function resolveMcpHttpAuthToken(input = {}, env = process.env, readFile = (p) => fs.readFileSync(p, 'utf8')) {
+    let raw;
+    let source = '';
+    if (input.token !== undefined) {
+        raw = input.token;
+        source = '--auth-token';
+    }
+    else if (input.tokenFile !== undefined) {
+        source = '--auth-token-file';
+        try {
+            raw = readFile(input.tokenFile).replace(/\r?\n$/, '');
+        }
+        catch {
+            throw new Error('Could not read the MCP HTTP auth token file given to --auth-token-file');
+        }
+    }
+    else if (env.RUFLO_MCP_HTTP_TOKEN !== undefined && env.RUFLO_MCP_HTTP_TOKEN !== '') {
+        raw = env.RUFLO_MCP_HTTP_TOKEN;
+        source = 'RUFLO_MCP_HTTP_TOKEN';
+    }
+    if (raw === undefined)
+        return undefined;
+    if (!AUTH_TOKEN_PATTERN.test(raw)) {
+        // The value is deliberately not echoed.
+        throw new Error(`Invalid MCP HTTP auth token from ${source}: it must be 16-512 printable ASCII characters with no spaces`);
+    }
+    return raw;
+}
 const DEFAULT_OPTIONS = {
     transport: 'stdio',
     host: 'localhost',
@@ -239,7 +303,7 @@ export class MCPServerManager extends EventEmitter {
         }
         const startTime = performance.now();
         this.startTime = new Date();
-        this.emit('starting', { options: this.options });
+        this.emit('starting', { options: { ...this.options, authToken: this.options.authToken ? '[redacted]' : undefined } });
         try {
             if (this.options.transport === 'stdio') {
                 // For stdio transport, spawn the server process
@@ -671,7 +735,7 @@ export class MCPServerManager extends EventEmitter {
                         }
                     }
                     try {
-                        const result = await callMCPTool(toolName, toolParams, { sessionId });
+                        const result = await callMCPTool(toolName, toolParams, { sessionId, transport: 'stdio' });
                         const isError = hasToolError(result);
                         trackRequest(toolName, !isError);
                         return {
@@ -725,6 +789,31 @@ export class MCPServerManager extends EventEmitter {
      * Start HTTP server in-process
      */
     async startHttpServer() {
+        // Authorization gate first, before any import or bind: a refused start must
+        // not depend on (or touch) anything else.
+        const authToken = this.options.authToken || undefined;
+        if (authToken && this.options.transport !== 'http') {
+            // The standalone websocket transport has no working token check, so a
+            // token there would be a false promise of protection.
+            throw new Error('An MCP HTTP auth token is only supported with --transport http');
+        }
+        if (shouldRefuseUnauthenticatedHttp(this.options.host, process.env, !!authToken)) {
+            // No ToolAuthorizer is wired below: @claude-flow/mcp's tool-call
+            // authorization is fully opt-in (requireToolAuthorization/toolAuthorizer),
+            // so without this check every registered tool (memory_*, hooks_*,
+            // agentdb_*, hive-mind_*, ...) would be callable by any client that can
+            // reach this host:port, unauthenticated — the same shape as
+            // CVE-2026-81735 (CVSS 10/10, UI-TARS-desktop mcp-http-server: optional
+            // auth middleware never wired by the integrating CLI + a non-loopback
+            // bind). Loopback stays unaffected; this only gates an explicit
+            // non-default `--host`. A configured bearer token (below) lifts the gate.
+            throw new Error(`Refusing to start the MCP HTTP server on non-loopback host "${this.options.host}": ` +
+                'this server is unauthenticated unless a token is set, so every registered MCP tool ' +
+                'would be reachable over the network. Set RUFLO_MCP_HTTP_TOKEN (or --auth-token-file) ' +
+                'to require a bearer token, bind to a loopback host (127.0.0.1, ::1, or localhost), or set ' +
+                'RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1 to acknowledge the risk and proceed ' +
+                '(e.g. when a trusted reverse proxy or network boundary already enforces auth).');
+        }
         // Dynamically import the MCP server package
         // FIX for issue #942: Use proper package import instead of broken relative path
         const { createMCPServer } = await import('@claude-flow/mcp');
@@ -747,7 +836,7 @@ export class MCPServerManager extends EventEmitter {
             cacheTTL: tool.cacheTTL,
             handler: async (input, context) => {
                 try {
-                    const result = await callMCPTool(tool.name, input || {}, { sessionId: context?.sessionId || fallbackSessionId });
+                    const result = await callMCPTool(tool.name, input || {}, { sessionId: context?.sessionId || fallbackSessionId, transport: this.options.transport === 'websocket' ? 'websocket' : 'http' });
                     trackRequest(tool.name, !hasToolError(result));
                     return result;
                 }
@@ -770,6 +859,9 @@ export class MCPServerManager extends EventEmitter {
             enableMetrics: true,
             enableCaching: true,
             requestTimeout: this.options.requestTimeoutMs,
+            auth: authToken
+                ? { enabled: true, method: 'token', tokens: [authToken] }
+                : undefined,
         }, logger);
         const registration = mcpServer.registerTools(cliTools);
         if (registration.failed.length > 0) {