@claude-flow/cli 3.55.0 → 3.56.0

package/dist/src/plugins/store/discovery.d.ts

@@ -32,6 +32,12 @@ export interface PluginDiscoveryResult {
     source?: string;
     fromCache?: boolean;
     error?: string;
+    /**
+     * True when the signed registry could not be fetched or verified and the CLI fell back to
+     * its built-in plugin list. That list is safe to use (fixed, first-party npm names), but it
+     * is NOT the verified registry, and callers must say so rather than report a discovery.
+     */
+    demo?: boolean;
 }
 /**
  * Plugin Discovery Service

package/dist/src/plugins/store/discovery.js

@@ -3,7 +3,6 @@
  * Discovers plugin registries via IPNS and fetches from IPFS
  * Parallel implementation to pattern store for plugins
  */
-import * as crypto from 'crypto';
 import { resolveIPNS, fetchFromIPFS, verifyEd25519Signature } from '../../transfer/ipfs/client.js';
 /**
  * Fetch real npm download stats for a package
@@ -115,7 +114,9 @@ export class PluginDiscoveryService {
                 success: true,
                 registry: cached.registry,
                 fromCache: true,
-                source: registry.name,
+                // A cached fallback is still the fallback: never relabel it as the real registry.
+                source: cached.demo ? `${registry.name} (demo)` : registry.name,
+                ...(cached.demo ? { demo: true } : {}),
             };
         }
         try {
@@ -223,13 +224,16 @@ export class PluginDiscoveryService {
         this.cache.set(registry.ipnsName, {
             registry: demoRegistry,
             timestamp: Date.now(),
+            demo: true,
         });
         return {
             success: true,
             registry: demoRegistry,
-            cid: `bafybeiplugin${crypto.randomBytes(16).toString('hex')}`,
+            // No CID: the built-in list was not fetched from IPFS. (This used to be a random
+            // `bafybeiplugin…` string, printed as "Registry CID" as if it were a real address.)
             source: `${registry.name} (demo)`,
             fromCache: false,
+            demo: true,
         };
     }
     /**

package/dist/src/ruvector/neural-router.js

@@ -288,8 +288,13 @@ async function resolveBackend(cfg) {
                     return r;
                 return {
                     route: (e) => {
-                        const result = r.route(e);
-                        return { ...result, predictedQuality: cal.transform(result.predictedQuality) };
+                        // Calibration can move a candidate across the quality bar. Select
+                        // from the calibrated predictions, not the raw router's old pick.
+                        const all = r.predictAll(e).map(c => ({ ...c, predictedQuality: cal.transform(c.predictedQuality) }));
+                        const clearing = all.filter(c => c.predictedQuality >= cfg.qualityBar)
+                            .sort((a, b) => a.costPerMTok - b.costPerMTok);
+                        const pick = clearing[0] ?? [...all].sort((a, b) => b.predictedQuality - a.predictedQuality)[0];
+                        return { ...pick, metBar: pick.predictedQuality >= cfg.qualityBar };
                     },
                     predictAll: (e) => r.predictAll(e).map(c => ({ ...c, predictedQuality: cal.transform(c.predictedQuality) })),
                 };

package/dist/src/services/claim-service.js

@@ -16,6 +16,7 @@ import { EventEmitter } from 'events';
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
+import { readClaimsStore } from './claims-store.js';
 // ============================================================================
 // Default Configuration
 // ============================================================================
@@ -57,28 +58,29 @@ export class ClaimService extends EventEmitter {
         // Load existing claims
         await this.loadClaims();
     }
-    async loadClaims() {
-        const claimsFile = path.join(this.storagePath, 'claims.json');
-        if (fs.existsSync(claimsFile)) {
-            try {
-                const data = JSON.parse(fs.readFileSync(claimsFile, 'utf-8'));
-                for (const claim of data.claims || []) {
-                    claim.claimedAt = new Date(claim.claimedAt);
-                    claim.statusChangedAt = new Date(claim.statusChangedAt);
-                    if (claim.expiresAt)
-                        claim.expiresAt = new Date(claim.expiresAt);
-                    this.claims.set(claim.issueId, claim);
-                }
-            }
-            catch {
-                // Start fresh if file is corrupted
-            }
+    loadClaims() {
+        const data = readClaimsStore(path.join(this.storagePath, 'claims.json'));
+        const claims = new Map();
+        const stealable = new Map();
+        for (const claim of Object.values(data.claims)) {
+            claim.claimedAt = new Date(claim.claimedAt);
+            claim.statusChangedAt = new Date(claim.statusChangedAt);
+            if (claim.expiresAt)
+                claim.expiresAt = new Date(claim.expiresAt);
+            claims.set(claim.issueId, claim);
+        }
+        for (const [id, info] of Object.entries(data.stealable)) {
+            stealable.set(id, { ...info, stealableAt: new Date(info.stealableAt) });
         }
+        this.claims = claims;
+        this.stealableInfo = stealable;
     }
     async saveClaims() {
         const claimsFile = path.join(this.storagePath, 'claims.json');
         const data = {
-            claims: Array.from(this.claims.values()),
+            ...readClaimsStore(claimsFile),
+            claims: Object.fromEntries(this.claims),
+            stealable: Object.fromEntries(this.stealableInfo),
             savedAt: new Date().toISOString(),
         };
         fs.writeFileSync(claimsFile, JSON.stringify(data, null, 2));
@@ -87,6 +89,7 @@ export class ClaimService extends EventEmitter {
     // Core Claiming
     // ==========================================================================
     async claim(issueId, claimant) {
+        this.loadClaims();
         // Check if already claimed
         const existing = this.claims.get(issueId);
         if (existing && existing.status !== 'stealable') {
@@ -116,6 +119,7 @@ export class ClaimService extends EventEmitter {
         return { success: true, claim };
     }
     async release(issueId, claimant) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim) {
             throw new Error(`Issue ${issueId} is not claimed`);
@@ -137,6 +141,7 @@ export class ClaimService extends EventEmitter {
     // Handoffs
     // ==========================================================================
     async requestHandoff(issueId, from, to, reason) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim) {
             throw new Error(`Issue ${issueId} is not claimed`);
@@ -158,6 +163,7 @@ export class ClaimService extends EventEmitter {
         });
     }
     async acceptHandoff(issueId, claimant) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim || claim.status !== 'handoff-pending') {
             throw new Error(`No pending handoff for issue ${issueId}`);
@@ -181,6 +187,7 @@ export class ClaimService extends EventEmitter {
         });
     }
     async rejectHandoff(issueId, claimant, reason) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim || claim.status !== 'handoff-pending') {
             throw new Error(`No pending handoff for issue ${issueId}`);
@@ -205,6 +212,7 @@ export class ClaimService extends EventEmitter {
     // Status Updates
     // ==========================================================================
     async updateStatus(issueId, status, note) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim) {
             throw new Error(`Issue ${issueId} is not claimed`);
@@ -227,6 +235,7 @@ export class ClaimService extends EventEmitter {
         });
     }
     async updateProgress(issueId, progress) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim) {
             throw new Error(`Issue ${issueId} is not claimed`);
@@ -235,6 +244,7 @@ export class ClaimService extends EventEmitter {
         await this.saveClaims();
     }
     async requestReview(issueId, reviewers) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim) {
             throw new Error(`Issue ${issueId} is not claimed`);
@@ -254,6 +264,7 @@ export class ClaimService extends EventEmitter {
     // Work Stealing
     // ==========================================================================
     async markStealable(issueId, info) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim) {
             throw new Error(`Issue ${issueId} is not claimed`);
@@ -273,6 +284,7 @@ export class ClaimService extends EventEmitter {
         });
     }
     async steal(issueId, stealer) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim) {
             return { success: false, error: `Issue ${issueId} is not claimed` };
@@ -309,6 +321,7 @@ export class ClaimService extends EventEmitter {
         return { success: true, claim, previousOwner, context: info };
     }
     async getStealable(agentType) {
+        this.loadClaims();
         const stealable = [];
         for (const claim of this.claims.values()) {
             if (claim.status !== 'stealable')
@@ -323,6 +336,7 @@ export class ClaimService extends EventEmitter {
         return stealable;
     }
     async contestSteal(issueId, originalClaimant, reason) {
+        this.loadClaims();
         const claim = this.claims.get(issueId);
         if (!claim) {
             throw new Error(`Issue ${issueId} is not claimed`);
@@ -340,6 +354,7 @@ export class ClaimService extends EventEmitter {
     // Load Balancing
     // ==========================================================================
     async getAgentLoad(agentId) {
+        this.loadClaims();
         const claims = [];
         let blockedCount = 0;
         for (const claim of this.claims.values()) {
@@ -362,6 +377,7 @@ export class ClaimService extends EventEmitter {
         };
     }
     async rebalance(swarmId) {
+        this.loadClaims();
         const result = { moved: [], suggested: [] };
         // Get all agent loads
         const agentLoads = new Map();
@@ -410,6 +426,7 @@ export class ClaimService extends EventEmitter {
     // Queries
     // ==========================================================================
     async getClaimedBy(claimant) {
+        this.loadClaims();
         return Array.from(this.claims.values()).filter(c => this.isSameClaimant(c.claimant, claimant));
     }
     async getAvailableIssues(_filters) {
@@ -418,18 +435,22 @@ export class ClaimService extends EventEmitter {
         return [];
     }
     async getIssueStatus(issueId) {
+        this.loadClaims();
         return this.claims.get(issueId) || null;
     }
     async getAllClaims() {
+        this.loadClaims();
         return Array.from(this.claims.values());
     }
     async getByStatus(status) {
+        this.loadClaims();
         return Array.from(this.claims.values()).filter(c => c.status === status);
     }
     // ==========================================================================
     // Auto-Management
     // ==========================================================================
     async expireStale(maxAgeMinutes) {
+        this.loadClaims();
         const threshold = maxAgeMinutes ?? this.config.staleThresholdMinutes;
         const now = Date.now();
         const expired = [];
@@ -445,7 +466,7 @@ export class ClaimService extends EventEmitter {
                     progress: claim.progress,
                     context: `Stale: No activity for ${Math.round(age)} minutes`,
                 });
-                expired.push(claim);
+                expired.push(this.claims.get(claim.issueId));
             }
         }
         return expired;

package/dist/src/services/claims-store.d.ts

@@ -0,0 +1,3 @@
+/** Read legacy CLI arrays and MCP dictionaries; never replace unreadable state. */
+export declare function readClaimsStore(file: string): Record<string, unknown>;
+//# sourceMappingURL=claims-store.d.ts.map

package/dist/src/services/claims-store.js

@@ -0,0 +1,40 @@
+/** Shared on-disk shape for the CLI claim service and public MCP claim tools. */
+import { readFileSync } from 'node:fs';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Read legacy CLI arrays and MCP dictionaries; never replace unreadable state. */
+export function readClaimsStore(file) {
+    let text;
+    try {
+        text = readFileSync(file, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { claims: {}, stealable: {}, contests: {} };
+        throw error;
+    }
+    const data = JSON.parse(text);
+    if (!record(data) || (!Array.isArray(data.claims) && !record(data.claims))) {
+        throw new Error('Invalid claims store: expected a claims array or object');
+    }
+    const entries = Array.isArray(data.claims)
+        ? data.claims.map((claim) => [record(claim) ? claim.issueId : undefined, claim])
+        : Object.entries(data.claims);
+    const claims = Object.create(null);
+    for (const [id, claim] of entries) {
+        if (typeof id !== 'string' || !id || !record(claim) || claim.issueId !== id ||
+            !record(claim.claimant) || typeof claim.status !== 'string' ||
+            typeof claim.claimedAt !== 'string' || typeof claim.statusChangedAt !== 'string' ||
+            Object.hasOwn(claims, id)) {
+            throw new Error('Invalid claims store: malformed or duplicate claim');
+        }
+        claims[id] = claim;
+    }
+    for (const key of ['stealable', 'contests']) {
+        if (data[key] !== undefined && !record(data[key]))
+            throw new Error(`Invalid claims store: ${key} must be an object`);
+    }
+    return { ...data, claims, stealable: data.stealable ?? {}, contests: data.contests ?? {} };
+}
+//# sourceMappingURL=claims-store.js.map

package/dist/src/services/distill-tuning.js

@@ -43,6 +43,7 @@ import * as crypto from 'crypto';
 import { runDistillation } from './memory-distillation.js';
 import { distillTrajectoryContent } from '../memory/structured-distill.js';
 import { cosineSim } from '../memory/hybrid-retrieval.js';
+import { loadBetterSqlite3 } from '../memory/shared-sqlite.js';
 // ── Grid defaults (requirement 1) ───────────────────────────────────────
 export const DEFAULT_GRID_BATCH_SIZE = [100, 200, 500];
 export const DEFAULT_GRID_DEDUP_DISTANCE = [0.05, 0.1, 0.15, 0.2, 0.3];
@@ -71,7 +72,22 @@ export async function tuneDistillation(options) {
     if (!dbPath || !fs.existsSync(dbPath)) {
         throw new Error(`tuneDistillation: source db not found at ${dbPath}`);
     }
-    const Database = await loadBetterSqlite3();
+    // #3883 — resolve the SAME better-sqlite3 copy AgentDB resolves (shared-sqlite.ts),
+    // not a separately-imported copy. Verified: every `new Database(...)` call in this
+    // module (readCopy below, and tmpCopy inside evaluateCandidate) opens a temp file
+    // copy made via fs.copyFileSync — `dbPath`/`sourceDbPath` themselves are NEVER
+    // opened with a DB connection anywhere in this module (see module header
+    // "Isolation" section). So the #3693 identity hazard (two better-sqlite3 copies
+    // fighting over one live file's -wal/-shm sidecars) does not apply to today's
+    // call sites here — AgentDB never holds a live handle on a temp copy. This swap
+    // is for consistency with the shared loader's contract, not an active fix.
+    let Database;
+    try {
+        Database = await loadBetterSqlite3();
+    }
+    catch {
+        Database = null;
+    }
     if (!Database) {
         throw new Error('tuneDistillation: better-sqlite3 unavailable — cannot run the tuning harness');
     }
@@ -498,13 +514,4 @@ function safeUnlink(p) {
         }
     }
 }
-async function loadBetterSqlite3() {
-    try {
-        const mod = 'better-sqlite3';
-        return (await import(mod)).default;
-    }
-    catch {
-        return null;
-    }
-}
 //# sourceMappingURL=distill-tuning.js.map

package/dist/src/services/memory-backup.d.ts

@@ -20,6 +20,13 @@ export interface BackupResult {
     skipped?: string;
 }
 export declare function defaultMemoryDbPath(cwd?: string): string;
+export interface ProjectBackupResult extends BackupResult {
+    backups: Array<BackupResult & {
+        dbPath: string;
+    }>;
+}
+/** Back up the active project stores; an explicit full-file override stays single-store. */
+export declare function backupProjectMemoryDbs(cwd: string, opts?: Omit<BackupOptions, 'dbPath'>): Promise<ProjectBackupResult>;
 export declare function backupMemoryDb(opts?: BackupOptions): Promise<BackupResult>;
 export interface RestoreResult {
     restored: boolean;

package/dist/src/services/memory-backup.js

@@ -15,9 +15,37 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { readFileMaybeEncrypted } from '../fs-secure.js';
+import { loadBetterSqlite3 } from '../memory/shared-sqlite.js';
+import { resolveMemoryRoot } from '../memory/memory-root.js';
 export function defaultMemoryDbPath(cwd = process.cwd()) {
     return path.join(cwd, '.swarm', 'memory.db');
 }
+/** Back up the active project stores; an explicit full-file override stays single-store. */
+export async function backupProjectMemoryDbs(cwd, opts = {}) {
+    const override = process.env.CLAUDE_FLOW_DB_PATH;
+    let sources;
+    if (override && override.trim().length > 0) {
+        sources = [path.resolve(cwd, override)];
+    }
+    else {
+        const root = resolveMemoryRoot(cwd);
+        sources = [path.join(root, 'memory.db'), path.join(root, 'agentdb-memory.db')];
+    }
+    const backups = [];
+    for (const dbPath of sources) {
+        backups.push({ ...await backupMemoryDb({ ...opts, dbPath }), dbPath });
+    }
+    const successful = backups.filter(result => result.backedUp);
+    const failed = backups.find(result => !result.backedUp && result.skipped !== 'no-db');
+    return {
+        ...successful[0],
+        backedUp: successful.length > 0 && !failed,
+        sizeBytes: successful.reduce((sum, result) => sum + (result.sizeBytes ?? 0), 0),
+        rotatedAway: successful.flatMap(result => result.rotatedAway ?? []),
+        skipped: failed?.skipped ?? (successful.length === 0 ? 'no-db' : undefined),
+        backups,
+    };
+}
 /** ISO timestamp safe for filenames (no ':' or '.'). */
 function fileStamp(ms) {
     return new Date(ms).toISOString().replace(/[:.]/g, '-');
@@ -228,8 +256,7 @@ export async function restoreMemoryDbFromBackup(dbPath, opts = {}) {
     // encrypted snapshots and provides the same checks on WASM-only hosts.
     let Database = null;
     try {
-        const mod = 'better-sqlite3';
-        Database = (await import(mod)).default;
+        Database = await loadBetterSqlite3();
     }
     catch {
         /* use the sql.js verifier */

package/dist/src/services/memory-distillation.js

@@ -27,6 +27,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { distillTrajectoryContent, serialiseDistilled } from '../memory/structured-distill.js';
+import { loadBetterSqlite3 } from '../memory/shared-sqlite.js';
 function emptyReport(dryRun, extra = {}) {
     return {
         processed: 0, episodes: 0, episodeEmbeddings: 0,
@@ -104,8 +105,7 @@ export async function runDistillation(options) {
         return emptyReport(dryRun, { skipped: 'no-db' });
     let Database;
     try {
-        const mod = 'better-sqlite3';
-        Database = (await import(mod)).default;
+        Database = await loadBetterSqlite3();
     }
     catch {
         return emptyReport(dryRun, { skipped: 'better-sqlite3 unavailable' });

package/dist/src/services/worker-daemon.d.ts

@@ -69,6 +69,8 @@ export interface DaemonConfig {
     workers: WorkerConfig[];
     enabledWorkers?: string[];
 }
+/** Parse only worker types the daemon can actually schedule. */
+export declare function parseEnabledWorkers(value: string): WorkerType[];
 /**
  * Worker Daemon - Manages background workers with Node.js
  */
@@ -368,8 +370,8 @@ export declare class WorkerDaemon extends EventEmitter {
      */
     private runConsolidateWorker;
     /**
-     * Nightly memory-DB backup worker (24h interval). Takes a WAL-safe, consistent
-     * snapshot of .swarm/memory.db with rotation (keep last N). Never throws — a
+     * Nightly memory-DB backup worker (24h interval). Takes WAL-safe, consistent
+     * snapshots of the active CLI and AgentDB stores with rotation (keep last N). Never throws — a
      * worker must not crash the daemon; a skip/error is written to the metrics
      * file. Opt-out by omitting `backup` from `-w`; offsite GCS is opt-in via
      * RUFLO_BACKUP_GCS (a gs:// prefix), retention via RUFLO_BACKUP_KEEP.

package/dist/src/services/worker-daemon.js

@@ -24,7 +24,7 @@ import { HeadlessWorkerExecutor, isHeadlessWorker, } from './headless-worker-exe
 // incremental (rowid cursor), non-destructive, transactional, and
 // quick_check-gated, so it's safe to call unconditionally on every tick.
 import { runDistillation, defaultMemoryDbPath } from './memory-distillation.js';
-import { backupMemoryDb } from './memory-backup.js';
+import { backupProjectMemoryDbs } from './memory-backup.js';
 import { resolveGitWorkspaceIdentity } from './git-workspace-identity.js';
 import { getWorkspaceLeaseRegistry } from './workspace-lease.js';
 import { getRepoSupervisorRegistry } from './repo-supervisor.js';
@@ -43,6 +43,14 @@ const DEFAULT_WORKERS = [
     { type: 'predict', intervalMs: 10 * 60 * 1000, offsetMs: 0, priority: 'low', description: 'Predictive preloading', enabled: false },
     { type: 'document', intervalMs: 60 * 60 * 1000, offsetMs: 0, priority: 'low', description: 'Auto-documentation', enabled: false },
 ];
+/** Parse only worker types the daemon can actually schedule. */
+export function parseEnabledWorkers(value) {
+    const names = value.split(',');
+    if (!names.length || names.some(name => !DEFAULT_WORKERS.some(worker => worker.type === name))) {
+        throw new Error(`--workers must be a comma-separated list of: ${DEFAULT_WORKERS.map(worker => worker.type).join(',')}`);
+    }
+    return [...new Set(names)];
+}
 // Worker timeout — must exceed the longest per-worker headless timeout (15 min for audit/refactor).
 // Previously 5 min, which caused orphan processes when daemon timeout fired before executor timeout (#1117).
 const DEFAULT_WORKER_TIMEOUT_MS = 16 * 60 * 1000;
@@ -192,7 +200,7 @@ export class WorkerDaemon extends EventEmitter {
             aiWorkersEnabled: config?.aiWorkersEnabled
                 ?? fileConfig.aiWorkersEnabled
                 ?? (process.env.RUFLO_DAEMON_AI_WORKERS === '1'),
-            workers: config?.workers ?? DEFAULT_WORKERS,
+            workers: (config?.workers ?? DEFAULT_WORKERS).map(worker => ({ ...worker })),
             enabledWorkers: config?.enabledWorkers,
         };
         // #2935 — deferred from readDaemonConfigFromFile(): this.config (and
@@ -1627,8 +1635,8 @@ export class WorkerDaemon extends EventEmitter {
         return result;
     }
     /**
-     * Nightly memory-DB backup worker (24h interval). Takes a WAL-safe, consistent
-     * snapshot of .swarm/memory.db with rotation (keep last N). Never throws — a
+     * Nightly memory-DB backup worker (24h interval). Takes WAL-safe, consistent
+     * snapshots of the active CLI and AgentDB stores with rotation (keep last N). Never throws — a
      * worker must not crash the daemon; a skip/error is written to the metrics
      * file. Opt-out by omitting `backup` from `-w`; offsite GCS is opt-in via
      * RUFLO_BACKUP_GCS (a gs:// prefix), retention via RUFLO_BACKUP_KEEP.
@@ -1641,14 +1649,14 @@ export class WorkerDaemon extends EventEmitter {
         let result;
         try {
             const keepEnv = Number(process.env.RUFLO_BACKUP_KEEP);
-            const r = await backupMemoryDb({
-                dbPath: defaultMemoryDbPath(this.projectRoot),
+            const r = await backupProjectMemoryDbs(this.projectRoot, {
                 keep: Number.isFinite(keepEnv) && keepEnv > 0 ? keepEnv : 7,
                 gcs: process.env.RUFLO_BACKUP_GCS || undefined,
             });
             result = {
                 timestamp: new Date().toISOString(),
                 backedUp: r.backedUp,
+                backups: r.backups,
                 path: r.path,
                 sizeBytes: r.sizeBytes ?? 0,
                 rotatedAway: r.rotatedAway?.length ?? 0,

package/node_modules/@claude-flow/security/dist/oauth/callback-server.d.ts

@@ -1,6 +1,6 @@
 /**
  * Ephemeral-port localhost callback server for the browser-based OAuth flow
- * (ADR-306). A minimal single-request HTTP server — deliberately not a full
+ * (ADR-306). A minimal single-callback HTTP server — deliberately not a full
  * framework for one GET route that lives for one request and then shuts
  * down. A TypeScript port of meta-proxy's `src/oauth/callback_server.rs`.
  *
@@ -18,6 +18,7 @@ export declare class CallbackServer {
     private readonly server;
     readonly redirectUri: string;
     readonly port: number;
+    private readonly callback;
     private constructor();
     /**
      * Binds `127.0.0.1:0` (OS-assigned ephemeral port) and returns the server

package/node_modules/@claude-flow/security/dist/oauth/callback-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../src/oauth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAeD,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,MAAM;aACP,WAAW,EAAE,MAAM;aACnB,IAAI,EAAE,MAAM;IAH9B,OAAO;IAMP;;;;;OAKG;WACU,IAAI,IAAI,OAAO,CAAC,cAAc,CAAC;IAa5C;;;;;OAKG;IACG,aAAa,CAAC,SAAS,SAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;CA0B7E"}
+{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../src/oauth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAeD,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,qBAAa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,MAAM;aACP,WAAW,EAAE,MAAM;aACnB,IAAI,EAAE,MAAM;IAJ9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO;IAkDP;;;;;OAKG;WACU,IAAI,IAAI,OAAO,CAAC,cAAc,CAAC;IAa5C;;;;;OAKG;IACG,aAAa,CAAC,SAAS,SAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;CAa7E"}

package/node_modules/@claude-flow/security/dist/oauth/callback-server.js

@@ -1,6 +1,6 @@
 /**
  * Ephemeral-port localhost callback server for the browser-based OAuth flow
- * (ADR-306). A minimal single-request HTTP server — deliberately not a full
+ * (ADR-306). A minimal single-callback HTTP server — deliberately not a full
  * framework for one GET route that lives for one request and then shuts
  * down. A TypeScript port of meta-proxy's `src/oauth/callback_server.rs`.
  *
@@ -28,10 +28,55 @@ export class CallbackServer {
     server;
     redirectUri;
     port;
+    callback;
     constructor(server, redirectUri, port) {
         this.server = server;
         this.redirectUri = redirectUri;
         this.port = port;
+        // Install the listener before bind() returns: opening the browser can
+        // deliver a callback before the caller reaches awaitCallback().
+        this.callback = new Promise((resolve) => {
+            let received = false;
+            this.server.on('request', (req, res) => {
+                let url;
+                try {
+                    url = new URL(req.url ?? '/', 'http://127.0.0.1');
+                }
+                catch {
+                    res.writeHead(400, { connection: 'close' });
+                    res.end();
+                    return;
+                }
+                if (url.pathname !== '/oauth/callback') {
+                    res.writeHead(404, { connection: 'close' });
+                    res.end();
+                    return;
+                }
+                if (req.method !== 'GET') {
+                    res.writeHead(405, { allow: 'GET', connection: 'close' });
+                    res.end();
+                    return;
+                }
+                if (received) {
+                    res.writeHead(409, { connection: 'close' });
+                    res.end();
+                    return;
+                }
+                received = true;
+                const result = {
+                    code: url.searchParams.get('code'),
+                    state: url.searchParams.get('state'),
+                    error: url.searchParams.get('error'),
+                };
+                res.writeHead(200, {
+                    'content-type': 'text/html; charset=utf-8',
+                    connection: 'close',
+                });
+                res.end(SUCCESS_PAGE);
+                this.server.close();
+                resolve(result);
+            });
+        });
     }
     /**
      * Binds `127.0.0.1:0` (OS-assigned ephemeral port) and returns the server
@@ -63,22 +108,9 @@ export class CallbackServer {
                 this.server.close();
                 reject(new CallbackTimeoutError());
             }, waitForMs);
-            this.server.once('request', (req, res) => {
+            this.callback.then((result) => {
                 clearTimeout(timer);
-                const url = new URL(req.url ?? '/oauth/callback', 'http://127.0.0.1');
-                const result = {
-                    code: url.searchParams.get('code'),
-                    state: url.searchParams.get('state'),
-                    error: url.searchParams.get('error'),
-                };
-                res.writeHead(200, {
-                    'content-type': 'text/html; charset=utf-8',
-                    connection: 'close',
-                });
-                res.end(SUCCESS_PAGE, () => {
-                    this.server.close();
-                    resolve(result);
-                });
+                resolve(result);
             });
         });
     }