@claude-flow/cli 3.56.3 → 3.56.5

package/.claude/helpers/auto-memory-hook.mjs

@@ -17,11 +17,16 @@ import { fileURLToPath } from 'url';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+// Executable modules resolve only from the helper's own install root. A
+// home-level helper can serve an untrusted project, so CLAUDE_PROJECT_DIR must
+// never decide which JavaScript gets imported.
+const MODULE_ROOT = join(__dirname, '../..');
 // Home-level helpers can serve a different project. Keep the memory writer on
 // the same project root as intelligence.cjs, which reads CLAUDE_PROJECT_DIR.
+// PROJECT_ROOT is for data only.
 const PROJECT_ROOT = process.env.CLAUDE_PROJECT_DIR
   ? resolve(process.env.CLAUDE_PROJECT_DIR)
-  : join(__dirname, '../..');
+  : MODULE_ROOT;
 const DATA_DIR = join(PROJECT_ROOT, '.claude-flow', 'data');
 const STORE_PATH = join(DATA_DIR, 'auto-memory-store.json');
 
@@ -41,7 +46,7 @@ const dim = (msg) => console.log(`  ${DIM}${msg}${RESET}`);
 // told exactly how to fix it (on both stdout, so it shows in the Claude Code hook
 // transcript, and stderr, per the issue's requested channel).
 function warnMemoryUnavailable() {
-  const line1 = `[AutoMemory] @claude-flow/memory not resolvable from ${PROJECT_ROOT} — self-learning imports are DISABLED.`;
+  const line1 = `[AutoMemory] @claude-flow/memory not resolvable from ${MODULE_ROOT} — self-learning imports are DISABLED.`;
   const line2 = '             Fix: npm i -D @claude-flow/memory   (or re-run: npx ruflo@latest init, then npx ruflo@latest doctor --fix)';
   console.log(`${YELLOW}${line1}${RESET}`);
   console.log(`${YELLOW}${line2}${RESET}`);
@@ -175,7 +180,7 @@ async function loadMemoryPackage() {
   // project — so init resolves it from the CLI's own context and records the
   // absolute path here. This is the only strategy that works on that install.
   try {
-    const sidecar = join(PROJECT_ROOT, '.claude-flow', 'memory-package.json');
+    const sidecar = join(MODULE_ROOT, '.claude-flow', 'memory-package.json');
     if (existsSync(sidecar)) {
       const rec = JSON.parse(readFileSync(sidecar, 'utf-8'));
       if (rec?.distPath && existsSync(rec.distPath)) {
@@ -185,7 +190,7 @@ async function loadMemoryPackage() {
   } catch { /* fall through */ }
 
   // Strategy 1: Local dev (built dist)
-  const localDist = join(PROJECT_ROOT, 'v3/@claude-flow/memory/dist/index.js');
+  const localDist = join(MODULE_ROOT, 'v3/@claude-flow/memory/dist/index.js');
   if (existsSync(localDist)) {
     try {
       return await import(`file://${localDist}`);
@@ -196,7 +201,7 @@ async function loadMemoryPackage() {
   // when installed as a transitive dependency via npx ruflo / npx @claude-flow/cli@latest)
   try {
     const { createRequire } = await import('module');
-    const require = createRequire(join(PROJECT_ROOT, 'package.json'));
+    const require = createRequire(join(MODULE_ROOT, 'package.json'));
     return require('@claude-flow/memory');
   } catch { /* fall through */ }
 
@@ -205,8 +210,8 @@ async function loadMemoryPackage() {
     return await import('@claude-flow/memory');
   } catch { /* fall through */ }
 
-  // Strategy 4: Walk up from PROJECT_ROOT looking for @claude-flow/memory in any node_modules
-  let searchDir = PROJECT_ROOT;
+  // Strategy 4: Walk up from MODULE_ROOT looking for @claude-flow/memory in any node_modules
+  let searchDir = MODULE_ROOT;
   const { parse } = await import('path');
   while (searchDir !== parse(searchDir).root) {
     const candidate = join(searchDir, 'node_modules', '@claude-flow', 'memory', 'dist', 'index.js');
@@ -378,7 +383,7 @@ async function doStatus() {
   const memPkg = await loadMemoryPackage();
   const config = readConfig();
 
-  const sidecar = join(PROJECT_ROOT, '.claude-flow', 'memory-package.json');
+  const sidecar = join(MODULE_ROOT, '.claude-flow', 'memory-package.json');
   const hasSidecar = existsSync(sidecar);
 
   console.log('\n=== Auto Memory Bridge Status ===\n');

package/.claude/helpers/helpers.manifest.json

@@ -1,14 +1,14 @@
 {
   "manifest": {
-    "version": "3.56.3",
+    "version": "3.56.5",
     "files": {
-      "auto-memory-hook.mjs": "c8d218526a3c34034c2a69de23f507f0eb0f70d59c16426a8edc849e6ac22529",
-      "hook-handler.cjs": "34d2aacfb59a73ff94b1467bb57ab9d9c4af89c0e470aadf3bd0d74a503a658d",
+      "auto-memory-hook.mjs": "381412515fb490def7d821ddfe1ebf8d9bee76e49a86e182806c0274f568bf15",
+      "hook-handler.cjs": "38fc235079ddcf74b62452a91b9e56703026a1a7682dcce3c635be5ad1c8ea19",
       "intelligence.cjs": "ac5033a77bcea9796856629d5d319bde9ab6b7edf0dcd0d4af187ce30af90836",
-      "statusline.cjs": "4a48353b4f1566fa4379b00fd0321b6676a22b6cc91fbbd8380ac5183d619468",
+      "statusline.cjs": "d72417ecb38634011a19f095a30e07b9929e6f97663520172ece9be7491b2eaa",
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "U1PReRNeRDIa3/64YWz99uxvI1OmVc3d53VBaVg9neZlrSC5LNaCGtMcGyIcrB2bA6jl4SHsHlbDvNcVH38UCw==",
+  "signature": "/MW5zFGHYeVuoNFAcDlUhkjIdDhPmBiUQTVJTz8Ku20SpFOoxpIXbgv01PxS5IloBqfmuDLieu++2cG55SIzAg==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -18,6 +18,10 @@ const fs = require('fs');
 const os = require('os');
 
 const helpersDir = __dirname;
+// The helper's own install root: the project for a project-local helper,
+// $HOME for a home-level one. CLI resolution starts here, never at the opened
+// project, so a home-level helper does not run code the project supplies.
+const helperRoot = path.resolve(helpersDir, '..', '..');
 
 // Resolve an installed @claude-flow/cli (or ruflo) bin — mirrors
 // statusline-generator.ts's resolveCliBin() candidate list. Used only to
@@ -38,12 +42,11 @@ const helpersDir = __dirname;
 function resolveCliBinForHook() {
   try {
     const home = os.homedir();
-    const cwd = process.cwd();
     const candidates = [
       path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'bin', 'cli.js'),
-      path.join(cwd, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
-      path.join(cwd, 'node_modules', 'ruflo', 'bin', 'cli.js'),
-      path.join(cwd, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(helperRoot, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(helperRoot, 'node_modules', 'ruflo', 'bin', 'cli.js'),
+      path.join(helperRoot, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
       // helpersDir is .claude/helpers/ inside the package itself when this
       // file is running from a real @claude-flow/cli install (not a project
       // that merely copied the helper) — its bin/ is two levels up.
@@ -77,14 +80,19 @@ function resolveCliBinForHook() {
 // render path, where local-first exists purely for per-render latency.
 // `--prefer-offline` avoids a registry round trip for the tarball when
 // already cached while still resolving the current `@latest` version.
+//
+// `--prefix helperRoot` makes npx resolve @claude-flow/cli from the helper's
+// install root instead of the cwd (the opened project); the spawned CLI still
+// runs with the project as its cwd.
+function cliSpawnArgs(cliBin, args, platform = process.platform) {
+  if (cliBin) return [process.execPath, [cliBin, ...args]];
+  return [platform === 'win32' ? 'npx.cmd' : 'npx', ['--prefer-offline', '--prefix', helperRoot, '@claude-flow/cli', ...args]];
+}
+
 function spawnDetachedHookRefresh(subcommand) {
   try {
     const { spawn } = require('child_process');
-    const cliBin = resolveCliBinForHook();
-    const cmd = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-    const spawnArgs = cliBin
-      ? [process.execPath, [cliBin, 'hooks', subcommand, '--quiet']]
-      : [cmd, ['--prefer-offline', '@claude-flow/cli', 'hooks', subcommand, '--quiet']];
+    const spawnArgs = cliSpawnArgs(resolveCliBinForHook(), ['hooks', subcommand, '--quiet']);
     const child = spawn(spawnArgs[0], spawnArgs[1], {
       detached: true,
       stdio: 'ignore',
@@ -151,10 +159,7 @@ function firstRunAutoEnableIfEligible() {
     const cliBin = resolveCliBinForHook();
     const runDetached = (args) => {
       try {
-        const spawnArgs = cliBin
-          ? [process.execPath, [cliBin, ...args]]
-          : [process.platform === 'win32' ? 'npx.cmd' : 'npx',
-             ['--prefer-offline', '@claude-flow/cli', ...args]];
+        const spawnArgs = cliSpawnArgs(cliBin, args);
         const child = spawn(spawnArgs[0], spawnArgs[1], {
           detached: true, stdio: 'ignore', env: process.env, windowsHide: true,
         });
@@ -772,4 +777,4 @@ if (require.main === module) {
 // Which sibling helpers loaded (all CommonJS, shipped as .cjs — #3555).
 const loadedHelpers = { router: !!router, session: !!session, memory: !!memory, intelligence: !!intelligence };
 
-module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS };
+module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS, resolveCliBinForHook, cliSpawnArgs, helperRoot };

package/.claude/helpers/learning-service.mjs

@@ -26,9 +26,12 @@ import Database from 'better-sqlite3';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+// Executable modules resolve only from the helper's own install root; a
+// home-level helper can serve an untrusted project. PROJECT_ROOT is data only.
+const MODULE_ROOT = join(__dirname, '../..');
 const PROJECT_ROOT = process.env.CLAUDE_PROJECT_DIR
   ? resolve(process.env.CLAUDE_PROJECT_DIR)
-  : join(__dirname, '../..');
+  : MODULE_ROOT;
 const DATA_DIR = join(PROJECT_ROOT, '.claude-flow/learning');
 const DB_PATH = join(DATA_DIR, 'patterns.db');
 const METRICS_PATH = join(DATA_DIR, 'learning-metrics.json');
@@ -463,7 +466,7 @@ class EmbeddingService {
 
     try {
       // Dynamically import agentic-flow OptimizedEmbedder
-      const agenticFlowPath = join(PROJECT_ROOT, 'node_modules/agentic-flow/dist/embeddings/optimized-embedder.js');
+      const agenticFlowPath = join(MODULE_ROOT, 'node_modules/agentic-flow/dist/embeddings/optimized-embedder.js');
 
       if (existsSync(agenticFlowPath)) {
         const { getOptimizedEmbedder } = await import(agenticFlowPath);

package/.claude/helpers/session.cjs

@@ -6,9 +6,41 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 
 const SESSION_DIR = path.join(process.cwd(), '.claude-flow', 'sessions');
 const SESSION_FILE = path.join(SESSION_DIR, 'current.json');
+// Archive names are generated by start(); anything else in current.json is
+// untrusted project content and must never pick a path.
+const SESSION_ID = /^session-\d+$/;
+
+// current.json lives in the opened project. A symlink there must never be read
+// or written through, so only a regular file counts as an active session.
+function hasSessionFile() {
+  try { return fs.lstatSync(SESSION_FILE).isFile(); } catch { return false; }
+}
+
+function archiveId(id) {
+  return SESSION_ID.test(String(id)) ? String(id) : `session-${Date.now()}`;
+}
+
+// The session directory must resolve inside the project (no symlinked escape).
+function assertSessionDirContained() {
+  const root = fs.realpathSync(process.cwd());
+  // Resolve the deepest part of the path that exists (lstat: a symlink counts),
+  // so a symlinked .claude-flow is refused before anything is created under it.
+  let dir = SESSION_DIR;
+  for (;;) {
+    try { fs.lstatSync(dir); break; } catch { /* not created yet */ }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const rel = path.relative(root, fs.realpathSync(dir));
+  if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+    throw new Error('Session directory resolves outside the project');
+  }
+}
 
 // #2307: Atomic write — serialize to a per-process temp file, then rename()
 // into place. rename() is atomic on the same filesystem, so concurrent writers
@@ -18,9 +50,12 @@ const SESSION_FILE = path.join(SESSION_DIR, 'current.json');
 // tail dangling past the end (valid JSON + trailing garbage = parse error).
 // Temp name includes process.pid so concurrent writers don't collide on it.
 // Same class as #1707 (metrics) / #1637 (daemon-state) — session.js was missed.
+// The temp file is created exclusively (never through a planted symlink) and
+// rename() replaces a symlinked target instead of writing through it.
 function atomicWrite(file, data) {
-  const tmp = `${file}.tmp.${process.pid}`;
-  fs.writeFileSync(tmp, data);
+  assertSessionDirContained();
+  const tmp = `${file}.tmp.${process.pid}.${crypto.randomBytes(6).toString('hex')}`;
+  fs.writeFileSync(tmp, data, { flag: 'wx' });
   fs.renameSync(tmp, file);
 }
 
@@ -40,6 +75,7 @@ const commands = {
       },
     };
 
+    assertSessionDirContained();
     fs.mkdirSync(SESSION_DIR, { recursive: true });
     atomicWrite(SESSION_FILE, JSON.stringify(session, null, 2));
 
@@ -48,7 +84,7 @@ const commands = {
   },
 
   restore: () => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       console.log('No session to restore');
       return null;
     }
@@ -70,7 +106,7 @@ const commands = {
   },
 
   end: () => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       console.log('No active session');
       return null;
     }
@@ -79,12 +115,12 @@ const commands = {
     session.endedAt = new Date().toISOString();
     session.duration = Date.now() - new Date(session.startedAt).getTime();
 
-    // Archive session
-    const archivePath = path.join(SESSION_DIR, `${session.id}.json`);
-    atomicWrite(archivePath, JSON.stringify(session, null, 2));
+    // Archive session under a validated name; a crafted id cannot pick the path.
+    const id = archiveId(session.id);
+    atomicWrite(path.join(SESSION_DIR, `${id}.json`), JSON.stringify(session, null, 2));
     fs.unlinkSync(SESSION_FILE);
 
-    console.log(`Session ended: ${session.id}`);
+    console.log(`Session ended: ${id}`);
     console.log(`Duration: ${Math.round(session.duration / 1000 / 60)} minutes`);
     console.log(`Metrics: ${JSON.stringify(session.metrics)}`);
 
@@ -92,7 +128,7 @@ const commands = {
   },
 
   status: () => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       console.log('No active session');
       return null;
     }
@@ -109,7 +145,7 @@ const commands = {
   },
 
   update: (key, value) => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       console.log('No active session');
       return null;
     }
@@ -123,7 +159,7 @@ const commands = {
   },
 
   get: (key) => {
-    if (!fs.existsSync(SESSION_FILE)) return null;
+    if (!hasSessionFile()) return null;
     try {
       const session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf-8'));
       return key ? (session.context || {})[key] : session.context;
@@ -131,7 +167,7 @@ const commands = {
   },
 
   metric: (name) => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       return null;
     }
 

package/.claude/helpers/statusline.cjs

@@ -43,6 +43,10 @@ const CONFIG = {
 };
 
 const CWD = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+// The helper's own install root: the project for a project-local helper,
+// $HOME for a home-level one. The CLI is resolved from here, never from CWD,
+// so a home-level statusline does not run code the opened project supplies.
+const HELPER_ROOT = path.resolve(__dirname, '..', '..');
 // Replaced by statusline-generator with the package root of the CLI that
 // installed this helper. This survives custom npm prefixes and bundled Node
 // runtimes whose process.execPath belongs to a different tree (#2811).
@@ -111,9 +115,9 @@ function resolveCliBinCandidates() {
     const home = os.homedir();
     candidates.push(
       path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'bin', 'cli.js'),
-      path.join(CWD, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
-      path.join(CWD, 'node_modules', 'ruflo', 'bin', 'cli.js'),
-      path.join(CWD, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(HELPER_ROOT, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(HELPER_ROOT, 'node_modules', 'ruflo', 'bin', 'cli.js'),
+      path.join(HELPER_ROOT, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
     );
     try {
       const binDir = path.dirname(process.execPath);
@@ -237,9 +241,15 @@ function getStatuslineData() {
   // intelligence and an empty promo row (the memo cache that keeps the row
   // populated across CLI hiccups is only ever written from a SUCCESSFUL
   // delegation, so it could never get seeded on Windows either).
+  // These command lines go through a shell, so a path the shell would interpret
+  // (a quote, $, backtick, %, !, newline, or a backslash on POSIX) is never
+  // interpolated: the directory name is chosen by whoever made the checkout.
+  const shellSafe = (p) => !/["`$%!\r\n]/.test(p) && (process.platform === 'win32' || !p.includes('\\'));
   const cmds = resolveCliBinCandidates()
+    .filter((bin) => shellSafe(bin) && shellSafe(process.execPath))
     .map((bin) => '"' + process.execPath + '" "' + bin + '" hooks statusline --json')
-    .concat(['npx --prefer-offline @claude-flow/cli hooks statusline --json']);
+    // --prefix: npx resolves the package from HELPER_ROOT, not the project.
+    .concat(shellSafe(HELPER_ROOT) ? ['npx --prefer-offline --prefix "' + HELPER_ROOT + '" @claude-flow/cli hooks statusline --json'] : []);
   for (const cmd of cmds) {
     try {
       const raw = execSync(

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-09T21:52:00.476Z",
-  "gitSha": "8c60c8c7",
+  "generatedAt": "2026-10-11T02:06:08.884Z",
+  "gitSha": "72255a2f",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/commands/doctor.js

@@ -9,6 +9,7 @@ import { existsSync, readFileSync, statSync, openSync, readSync, closeSync } fro
 import { join, dirname } from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { createHash } from 'crypto';
+import { ownInstallAncestors } from '../plugins/own-install.js';
 import { execSync, exec, execFile } from 'child_process';
 import { promisify } from 'util';
 import { decodeKey, isEncryptionEnabled } from '../encryption/vault.js';
@@ -2045,26 +2046,19 @@ async function checkMetaharnessIntegration() {
     // `dist/src/commands/doctor.js` (built) or `src/commands/doctor.ts`
     // (dev) until we find a directory containing `plugins/ruflo-metaharness/`.
     const candidates = [];
-    // Strategy 1: walk up from this module's own URL — covers npx + global install.
+    // Walk up from this module's own URL — covers npx, global and project-local
+    // installs and monorepo dev. The plugin found here is imported below, so it
+    // must come from this CLI's own install, never from the cwd (the project).
     try {
+        // Bounded at node_modules: a project-local install must not reach the project.
         const selfDir = dirname(fileURLToPath(import.meta.url));
-        let q = selfDir;
-        for (let i = 0; i < 8; i++) {
+        for (const q of ownInstallAncestors(selfDir)) {
             candidates.push(join(q, 'plugins', 'ruflo-metaharness'));
-            q = dirname(q);
         }
     }
     catch {
-        // import.meta.url unavailable under some bundlers — fall through to cwd walk.
-    }
-    // Strategy 2: walk up from cwd — covers monorepo dev (running from a sub-package).
-    let p = process.cwd();
-    for (let i = 0; i < 8; i++) {
-        candidates.push(join(p, 'plugins', 'ruflo-metaharness'));
-        p = dirname(p);
+        // import.meta.url unavailable under some bundlers — the plugin is reported absent.
     }
-    // Strategy 3: explicit node_modules path relative to cwd — covers project-local install.
-    candidates.push(join(process.cwd(), 'node_modules', '@claude-flow', 'cli', 'plugins', 'ruflo-metaharness'));
     let pluginDir = null;
     for (const c of candidates) {
         if (existsSync(join(c, 'scripts', '_harness.mjs'))) {

package/dist/src/commands/hooks.js

@@ -4171,18 +4171,15 @@ const tokenOptimizeCommand = {
         try {
             // Check if agentic-flow v3 is available
             const rb = await import('agentic-flow/reasoningbank').catch(() => null);
+            // No root-entry fallback: importing 'agentic-flow' runs its CLI main()
+            // in 3.0.0-alpha.x, and the root re-exports this same reasoningbank
+            // module, so it cannot load when this subpath did not.
             if (rb) {
                 agenticFlowAvailable = true;
                 if (typeof rb.retrieveMemories === 'function') {
                     reasoningBank = rb;
                 }
             }
-            else {
-                // Legacy check for older agentic-flow
-                const af = await import('agentic-flow').catch(() => null);
-                if (af)
-                    agenticFlowAvailable = true;
-            }
             const versionLabel = agenticFlowAvailable ? `agentic-flow v3 detected (ReasoningBank: ${reasoningBank ? 'active' : 'unavailable'})` : 'agentic-flow not available (using fallbacks)';
             spinner.succeed(versionLabel);
             output.writeln();

package/dist/src/commands/init.js

@@ -50,16 +50,9 @@ async function resolveCodexInitializer(cwd) {
     const resolutionStrategies = [
         // Strategy 1: Direct import (works if installed as CLI dependency)
         async () => (await import(codexModuleId)).CodexInitializer,
-        // Strategy 2: Project node_modules (works if installed in user's project)
-        async () => {
-            const projectPath = path.join(cwd, 'node_modules', '@claude-flow', 'codex', 'dist', 'index.js');
-            if (fs.existsSync(projectPath)) {
-                const mod = await import(`file://${projectPath}`);
-                return mod.CodexInitializer;
-            }
-            throw new Error('Not found in project');
-        },
-        // Strategy 3: Global node_modules
+        // (No project node_modules strategy: init must not import code the
+        // target project supplies.)
+        // Strategy 2: Global node_modules
         async () => {
             const { execSync } = await import('child_process');
             const globalPath = execSync('npm root -g', { encoding: 'utf-8' }).trim();

package/dist/src/commands/metaharness.js

@@ -38,6 +38,8 @@ import { spawnSync } from 'child_process';
 import { existsSync, readFileSync } from 'fs';
 import { join, dirname, resolve } from 'path';
 import { fileURLToPath } from 'url';
+import { homedir } from 'os';
+import { ownPluginDirs } from '../plugins/own-install.js';
 import { runFlywheelWorker } from '../services/harness-flywheel-runtime.js';
 import { listFlywheelReceipts, promoteFlywheelCandidate, readFlywheelTransactionState, resetSequentialEvidence, verifyFlywheelLedger, } from '../services/flywheel-transaction.js';
 import { evaluatePolicyRequest } from '../services/policy-runtime.js';
@@ -213,20 +215,13 @@ async function dispatchFlywheel(operation, positional, flags) {
  * `prepublishOnly`).
  */
 function locatePluginScripts(requiredScript) {
-    const candidates = [];
-    // Up from the cli dist dir
-    let p = resolve(__dirname);
-    for (let i = 0; i < 8; i++) {
-        candidates.push(join(p, 'plugins', 'ruflo-metaharness', 'scripts'));
-        candidates.push(join(p, '..', 'plugins', 'ruflo-metaharness', 'scripts'));
-        p = dirname(p);
-    }
-    // Also try from cwd (covers the "npx ruflo" case where the user is
-    // sitting in their own repo and `npx ruflo metaharness score` should
-    // score THAT repo using the LOCAL plugin if present).
-    const cwd = process.cwd();
-    candidates.push(join(cwd, 'plugins', 'ruflo-metaharness', 'scripts'));
-    candidates.push(join(cwd, 'node_modules', '@claude-flow', 'cli', 'plugins', 'ruflo-metaharness', 'scripts'));
+    // Up from the cli dist dir, bounded at node_modules: a project-local install
+    // must not reach the project.
+    const candidates = ownPluginDirs(__dirname, 'ruflo-metaharness', 'scripts');
+    // The scripts are executed, so they come from this CLI's own install (or the
+    // user's marketplace checkout), never from the cwd: scoring a repo must not
+    // run plugin code that repo supplies. The repo is still the scoring target.
+    candidates.push(join(homedir(), '.claude', 'plugins', 'marketplaces', 'ruflo', 'plugins', 'ruflo-metaharness', 'scripts'));
     for (const c of candidates) {
         if (!existsSync(join(c, '_harness.mjs')))
             continue;