@claude-flow/cli 3.56.4 → 3.56.6

package/.claude/helpers/helpers.manifest.json

@@ -1,14 +1,14 @@
 {
   "manifest": {
-    "version": "3.56.4",
+    "version": "3.56.6",
     "files": {
       "auto-memory-hook.mjs": "381412515fb490def7d821ddfe1ebf8d9bee76e49a86e182806c0274f568bf15",
-      "hook-handler.cjs": "38fc235079ddcf74b62452a91b9e56703026a1a7682dcce3c635be5ad1c8ea19",
+      "hook-handler.cjs": "0f855c667b8d2d04cb4fe91b14b351d14c3dfb30516dcd9d7ae156acbe0a689d",
       "intelligence.cjs": "ac5033a77bcea9796856629d5d319bde9ab6b7edf0dcd0d4af187ce30af90836",
       "statusline.cjs": "d72417ecb38634011a19f095a30e07b9929e6f97663520172ece9be7491b2eaa",
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "Dhlixv3hNK+hc+t5recMVcHtVZ6ilyT4uN4YLuFsoSVwbTI6dt6VfzyZZXDjgfm6ei8NR9IHIjjmVgKkUmRBDw==",
+  "signature": "3wmXMrroE4WEmOLGOLYSxXlcB2GITYHa8xpd3Jwu/xLCyFsf+saWI4Vq8EsvCzuwC8u3XpKX7aWrvQchQK3oAg==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -213,6 +213,198 @@ function spawnDetachedAdvisorRefresh() {
   spawnDetachedHookRefresh('refresh-advisor');
 }
 
+// ── Settings-risk scan for the automatic SessionStart hook ────────────────
+//
+// Mirrors v3/@claude-flow/cli/src/init/settings-risk-scanner.ts's
+// `scanSettingsForRisk()`/`formatRiskFindingsAsWarnings()`. That TS scanner
+// already runs at `ruflo init`/`--upgrade` time and (via the
+// `hooks_session-restore` MCP/CLI tool handler) on an explicit
+// `session-restore` call — but neither covers the one path that actually
+// fires automatically, unconditionally, on every real Claude Code session
+// boot: THIS file, invoked as the `SessionStart` hook configured in
+// .claude/settings.json itself. That is precisely the persistence mechanism
+// used by the real 2026 "Mini Shai-Hulud" npm-worm campaign (a malicious
+// SessionStart hook written into settings.json re-fires on every session,
+// surviving removal of the original infected package) and the escalation
+// path closed by CVE-2026-25725 in Claude Code's own sandbox. hook-handler.cjs
+// has no build step and cannot import the TS module, so this is a deliberate
+// CJS port — keep the pattern lists in sync with settings-risk-scanner.ts;
+// see the logic-parity test guarding this.
+//
+// Advisory-only: never mutates settings.json, never blocks session-restore.
+// A missing settings.json or any JSON.parse failure yields zero findings
+// silently. Unlike the opt-in `hooks_session-restore` MCP-tool path (#3835,
+// which narrows its catch to SyntaxError only so a real scanner bug
+// surfaces), THIS path fires unconditionally on every real session boot —
+// an adversarial review of this exact candidate flagged that narrowing the
+// same way here would let a non-SyntaxError JSON.parse failure (e.g. a V8
+// RangeError on deeply-nested JSON) abort session-restore itself, not just
+// skip the scan. "Can't scan it" and "can't parse it" are the same case
+// here, so any parse failure degrades to zero findings.
+const SR_DANGEROUS_COMMAND_WORDS = [
+  'rm', 'rmdir', 'del', 'format', 'mkfs', 'dd', 'chmod', 'chown',
+  'kill', 'killall', 'pkill', 'reboot', 'shutdown', 'poweroff', 'halt',
+  'sudo', 'eval',
+];
+const SR_SHELL_EXEC_WORDS = ['bash', 'sh', 'zsh', 'python', 'python3', 'perl', 'ruby', 'eval'];
+const SR_DOWNLOADER_WORDS = ['curl', 'wget'];
+const SR_STANDALONE_RISK_PATTERNS = [
+  /\bInvoke-Expression\b/i,
+  /\biex\s*\(/i,
+  /\/dev\/tcp\//i,
+  /\bnc\s+-e\b/i,
+  /base64\s+(-d|--decode)\b/i,
+];
+const SR_RISKY_PREAPPROVE_WORDS = [...SR_DANGEROUS_COMMAND_WORDS, ...SR_SHELL_EXEC_WORDS, ...SR_DOWNLOADER_WORDS];
+
+// Encoded PowerShell (`powershell[.exe] ... -e|-enc|-encodedcommand <payload>`),
+// matched on whitespace-separated tokens in ONE linear pass. The earlier regex
+// (`powershell\\s+(?:\\S+\\s+)*?-e...`) is quadratic on repeated "powershell "
+// tokens (every start rescans the tail: 256KB measured ~2.5s, 1MB ~40s) because
+// the lazy token loop re-runs from each start. Same semantics: a token ending in
+// powershell/powershell.exe, then LATER a token that is exactly -e/-enc/
+// -encodedcommand, then at least one more token.
+function srHasEncodedPowershell(command) {
+  let seenPs = false;
+  let pendingEnc = false;
+  for (const raw of String(command).split(/\s+/)) {
+    if (!raw) continue;
+    if (pendingEnc) return true;
+    const t = raw.toLowerCase();
+    if (seenPs && (t === '-e' || t === '-enc' || t === '-encodedcommand')) pendingEnc = true;
+    else if (t.endsWith('powershell') || t.endsWith('powershell.exe')) seenPs = true;
+  }
+  return false;
+}
+
+function srWordBoundaryMatches(text, word) {
+  return new RegExp(`\\b${word}\\b`, 'i').test(text);
+}
+
+function srScanCommandStringForRisk(command) {
+  const reasons = [];
+  if (srHasEncodedPowershell(command) || SR_STANDALONE_RISK_PATTERNS.some((pattern) => pattern.test(command))) {
+    reasons.push('matches a known-dangerous execution pattern (encoded/remote command execution)');
+  }
+  const hasDownloader = SR_DOWNLOADER_WORDS.some((w) => srWordBoundaryMatches(command, w));
+  const hasShellExec = SR_SHELL_EXEC_WORDS.some((w) => srWordBoundaryMatches(command, w));
+  if (hasDownloader && hasShellExec) {
+    reasons.push('combines a downloader (curl/wget) with a shell/interpreter invocation in the same command');
+  }
+  for (const word of SR_DANGEROUS_COMMAND_WORDS) {
+    if (srWordBoundaryMatches(command, word)) {
+      reasons.push(`invokes dangerous command "${word}"`);
+    }
+  }
+  return reasons;
+}
+
+function srScanAllowRuleForRisk(rule) {
+  const trimmed = rule.trim();
+  const reasons = [];
+  if (/^Bash\(\s*\*\s*(:\s*\*\s*)?\)$/i.test(trimmed)) {
+    reasons.push('grants unrestricted Bash execution (wildcard allow rule)');
+  }
+  for (const word of SR_RISKY_PREAPPROVE_WORDS) {
+    if (new RegExp(`^Bash\\(\\s*${word}\\s*(:| |\\))`, 'i').test(trimmed)) {
+      reasons.push(`pre-allows "${word}" with no per-call confirmation`);
+    }
+  }
+  return reasons;
+}
+
+// Strips ANSI/control characters from untrusted text before it's ever
+// embedded in a warning string printed to the terminal (same rationale as
+// settings-risk-scanner.ts's sanitizeForDisplay()).
+function srSanitizeForDisplay(text) {
+  // eslint-disable-next-line no-control-regex
+  return text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
+}
+
+function srBuildSnippet(text) {
+  const clean = srSanitizeForDisplay(text);
+  return clean.length > 120 ? `${clean.slice(0, 120)}…` : clean;
+}
+
+function srScanSettingsForRisk(settings) {
+  const findings = [];
+  const hooks = settings && settings.hooks;
+  if (hooks && typeof hooks === 'object') {
+    for (const [eventName, groups] of Object.entries(hooks)) {
+      if (!Array.isArray(groups)) continue;
+      groups.forEach((group, groupIdx) => {
+        const hookList = group && group.hooks;
+        if (!Array.isArray(hookList)) return;
+        hookList.forEach((h, hookIdx) => {
+          if (!h || typeof h.command !== 'string') return;
+          for (const reason of srScanCommandStringForRisk(h.command)) {
+            findings.push({
+              location: `hooks.${eventName}[${groupIdx}].hooks[${hookIdx}]`,
+              snippet: srBuildSnippet(h.command),
+              reason,
+            });
+          }
+        });
+      });
+    }
+  }
+  const allow = settings && settings.permissions && settings.permissions.allow;
+  if (Array.isArray(allow)) {
+    allow.forEach((rule, idx) => {
+      if (typeof rule !== 'string') return;
+      for (const reason of srScanAllowRuleForRisk(rule)) {
+        findings.push({
+          location: `permissions.allow[${idx}]`,
+          snippet: srBuildSnippet(rule),
+          reason,
+        });
+      }
+    });
+  }
+  return findings;
+}
+
+function srFormatRiskFindingsAsWarnings(findings) {
+  return findings.map((f) => `${f.location}: ${f.reason} — "${f.snippet}"`);
+}
+
+// Location + reason only, no snippet — see scanSessionStartSettingsForRisk's
+// doc comment for why the automatic boot path deliberately drops it.
+function srFormatRiskFindingsForAutomaticBoot(findings) {
+  return findings.map((f) => `${f.location}: ${f.reason}`);
+}
+
+// Reads and scans THIS project's own .claude/settings.json. Returns a
+// (possibly empty) array of warning strings; never throws on a
+// missing/malformed file.
+//
+// Deliberately omits the matched snippet (unlike srFormatRiskFindingsAsWarnings,
+// which `init`/`--upgrade` uses and which DOES include it): this function's
+// only caller is the 'session-restore' handler below, whose stdout is read
+// back into the live Claude Code session as context — not a human reading a
+// terminal. Printing up to 120 characters of attacker-controlled settings.json
+// content into that context is a prompt-injection path even with control
+// characters stripped (flagged by review on PR #4053). The location and
+// static reason string are both scanner-generated, never attacker content.
+function scanSessionStartSettingsForRisk() {
+  const projectRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
+  let raw;
+  try {
+    raw = fs.readFileSync(settingsPath, 'utf-8');
+  } catch (e) {
+    return []; // no settings.json (or unreadable) — nothing to scan
+  }
+  let settings;
+  try {
+    settings = JSON.parse(raw);
+  } catch (e) {
+    return []; // can't parse it, so can't scan it — never block session-restore for this
+  }
+  if (!settings || typeof settings !== 'object') return [];
+  return srFormatRiskFindingsForAutomaticBoot(srScanSettingsForRisk(settings));
+}
+
 // Safe require with stdout suppression - the helper modules have CLI
 // sections that run unconditionally on require(), so we mute console
 // during the require to prevent noisy output.
@@ -651,6 +843,11 @@ const handlers = {
     // Fully non-blocking (detached spawn) so session-restore latency
     // is unchanged.
     firstRunAutoEnableIfEligible();
+    // Advisory-only settings.json risk scan — see scanSessionStartSettingsForRisk's
+    // own doc comment for why this runs specifically on this automatic path.
+    for (const warning of scanSessionStartSettingsForRisk()) {
+      console.log(`[WARN] ${warning}`);
+    }
     if (session) {
       // Try restore first, fall back to start
       const existing = session.restore && session.restore();
@@ -777,4 +974,4 @@ if (require.main === module) {
 // Which sibling helpers loaded (all CommonJS, shipped as .cjs — #3555).
 const loadedHelpers = { router: !!router, session: !!session, memory: !!memory, intelligence: !!intelligence };
 
-module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS, resolveCliBinForHook, cliSpawnArgs, helperRoot };
+module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS, resolveCliBinForHook, cliSpawnArgs, helperRoot, scanSessionStartSettingsForRisk, srFormatRiskFindingsForAutomaticBoot, srScanSettingsForRisk, srScanCommandStringForRisk, srScanAllowRuleForRisk, SR_DANGEROUS_COMMAND_WORDS, SR_SHELL_EXEC_WORDS, SR_DOWNLOADER_WORDS, SR_STANDALONE_RISK_PATTERNS };

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-11T01:01:00.018Z",
-  "gitSha": "f6781f1a",
+  "generatedAt": "2026-10-11T16:40:50.905Z",
+  "gitSha": "5905d40b",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/init/helper-commands.js

@@ -30,20 +30,38 @@ export function helperScopeFor(targetDir) {
         return 'project';
     return canonical(targetDir) === canonical(os.homedir()) ? 'user' : 'project';
 }
+/**
+ * Windows hook command (#4045). It must not go through `cmd /c`: under Git Bash
+ * MSYS rewrites `/c` into a path, cmd starts interactively and executes the
+ * hook's stdin JSON, and any `>` in that text creates a file. A single
+ * `node -e` has no shell syntax to misread (no cmd, no `%VAR%`, no `<>|&$` and
+ * no inner double quotes), so cmd, PowerShell and Git Bash pass it through
+ * unchanged. The script and its subcommand stay in one string, because the
+ * ruflo-mods ownership rule matches `hook-handler.cjs <subcommand>`. Project
+ * scope prefers the project's helper and falls back to the user profile's
+ * (#1943); user scope never looks at the project. The helper runs as a child
+ * with inherited stdio so stdin, stdout and the exit status pass through (a
+ * `require` would skip the helper's `require.main === module` entry point).
+ */
+function windowsHookCommand(script, subcommand, scope) {
+    // Ternaries, not `||`: the command carries no pipe or ampersand at all.
+    const home = "(e.USERPROFILE?e.USERPROFILE:e.HOME?e.HOME:'.')";
+    const pick = scope === 'user'
+        ? `f=p.join(${home},a[0]);`
+        : "f=p.join(e.CLAUDE_PROJECT_DIR?e.CLAUDE_PROJECT_DIR:'.',a[0]);" +
+            `if(!fs.existsSync(f))f=p.join(${home},a[0]);`;
+    const js = `var a='${[script, subcommand].filter(Boolean).join(' ')}'.split(' '),e=process.env,fs=require('fs'),p=require('path'),f;` + pick +
+        "var r=require('child_process').spawnSync(process.execPath,[f].concat(a.slice(1)),{stdio:'inherit'});" +
+        'process.exit(r.status===null?1:r.status)';
+    return `node -e "${js}"`;
+}
 /** Command that runs `node <script> <subcommand>` for a hook. */
 export function helperHookCommand(script, subcommand, scope, windows = IS_WINDOWS) {
-    const winScript = script.replace(/\//g, '\\');
     const arg = subcommand ? ` ${subcommand}` : '';
-    if (scope === 'user') {
-        return windows
-            ? `cmd /c "node "%USERPROFILE%\\${winScript}"${arg}"`
-            : `sh -c 'exec node "\${HOME}/${script}"${arg}'`;
-    }
-    if (windows) {
-        // cmd.exe equivalent of the sh probe below. `IF EXIST` checks the
-        // project-local path; falls back to %USERPROFILE% if missing.
-        return `cmd /c "IF EXIST \"%CLAUDE_PROJECT_DIR%\\${winScript}\" (node \"%CLAUDE_PROJECT_DIR%\\${winScript}\"${arg}) ELSE (node \"%USERPROFILE%\\${winScript}\"${arg})"`;
-    }
+    if (windows)
+        return windowsHookCommand(script, subcommand, scope);
+    if (scope === 'user')
+        return `sh -c 'exec node "\${HOME}/${script}"${arg}'`;
     // POSIX sh: prefer project-local helpers, fall back to $HOME/.claude/.
     // eslint-disable-next-line no-template-curly-in-string
     const projVar = '${CLAUDE_PROJECT_DIR:-.}';
@@ -102,6 +120,17 @@ const IF_EXIST_PREAMBLE = /"IF EXIST "%CLAUDE_PROJECT_DIR%\\\.claude\\helpers\\[
  * commands (other scripts, redirects, chains) are left alone.
  */
 export function pinToUserHelpers(command, windows = IS_WINDOWS) {
+    // The #4045 Windows form: recognised only when it is exactly what ruflo generates.
+    const generated = /^node -e "var a='\.claude\/helpers\/([\w.-]+)((?: [\w:.=-]+)*)'\.split\(' '\)/.exec(command);
+    if (generated) {
+        if (!RUFLO_HELPERS.includes(generated[1]))
+            return null;
+        const script = `.claude/helpers/${generated[1]}`;
+        const subcommand = generated[2].trim();
+        return command === helperHookCommand(script, subcommand, 'project', true)
+            ? helperHookCommand(script, subcommand, 'user', true)
+            : null;
+    }
     const refs = [...command.matchAll(HELPER_REF)];
     if (refs.length === 0)
         return null;

package/dist/src/init/settings-risk-scanner.js

@@ -44,7 +44,6 @@ const DOWNLOADER_WORDS = ['curl', 'wget'];
 const STANDALONE_RISK_PATTERNS = [
     /\bInvoke-Expression\b/i,
     /\biex\s*\(/i,
-    /powershell(\.exe)?\s+.*-e(nc(odedcommand)?)?\s+\S/i,
     /\/dev\/tcp\//i,
     /\bnc\s+-e\b/i,
     /base64\s+(-d|--decode)\b/i,
@@ -54,17 +53,37 @@ const STANDALONE_RISK_PATTERNS = [
 // own the way `rm`/`chmod` are — pre-approving them removes the human
 // review step for exactly the commands download-and-execute attacks use.
 const RISKY_PREAPPROVE_WORDS = [...DANGEROUS_COMMAND_WORDS, ...SHELL_EXEC_WORDS, ...DOWNLOADER_WORDS];
+// Encoded PowerShell (`powershell[.exe] ... -e|-enc|-encodedcommand <payload>`),
+// matched on whitespace-separated tokens in ONE linear pass. The earlier regex
+// (`powershell\\s+(?:\\S+\\s+)*?-e...`) is quadratic on repeated "powershell "
+// tokens (every start rescans the tail: 256KB measured ~2.5s, 1MB ~40s) because
+// the lazy token loop re-runs from each start. Same semantics: a token ending in
+// powershell/powershell.exe, then LATER a token that is exactly -e/-enc/
+// -encodedcommand, then at least one more token.
+function hasEncodedPowershell(command) {
+    let seenPs = false;
+    let pendingEnc = false;
+    for (const raw of command.split(/\s+/)) {
+        if (!raw)
+            continue;
+        if (pendingEnc)
+            return true;
+        const t = raw.toLowerCase();
+        if (seenPs && (t === '-e' || t === '-enc' || t === '-encodedcommand'))
+            pendingEnc = true;
+        else if (t.endsWith('powershell') || t.endsWith('powershell.exe'))
+            seenPs = true;
+    }
+    return false;
+}
 function wordBoundaryMatches(text, word) {
     return new RegExp(`\\b${word}\\b`, 'i').test(text);
 }
 /** Reasons a single hook `command` string looks risky (empty = clean). */
 export function scanCommandStringForRisk(command) {
     const reasons = [];
-    for (const pattern of STANDALONE_RISK_PATTERNS) {
-        if (pattern.test(command)) {
-            reasons.push('matches a known-dangerous execution pattern (encoded/remote command execution)');
-            break;
-        }
+    if (hasEncodedPowershell(command) || STANDALONE_RISK_PATTERNS.some((pattern) => pattern.test(command))) {
+        reasons.push('matches a known-dangerous execution pattern (encoded/remote command execution)');
     }
     const hasDownloader = DOWNLOADER_WORDS.some((w) => wordBoundaryMatches(command, w));
     const hasShellExec = SHELL_EXEC_WORDS.some((w) => wordBoundaryMatches(command, w));

package/dist/src/mcp-tools/hooks-tools.js

@@ -3305,19 +3305,23 @@ export const hooksTrajectoryEnd = {
             }
             catch { /* intelligence module not loadable — keep sona-only behaviour */ }
         }
-        // #2351: when an agent calls trajectory-end with no recorded steps but a
-        // non-empty `feedback` string, the feedback was previously dropped on the
-        // floor — `patternsExtracted` reported 0 and `pattern-search` never
-        // surfaced it. Step-less trajectories are the common case for LLM agents
-        // (nothing forces step logging mid-task), and feedback is often the most
-        // distilled lesson available. Route it through the same store + embed
-        // path that pattern-store uses so it becomes searchable. Best-effort:
-        // failures here must not turn the trajectory-end call itself into a
-        // failure — the trajectory record was already persisted above.
+        // #2351: when an agent calls trajectory-end with a non-empty `feedback`
+        // string, the feedback was previously dropped on the floor —
+        // `patternsExtracted` reported 0 and `pattern-search` never surfaced it.
+        // Route it through the same store + embed path that pattern-store uses
+        // so it becomes searchable. Best-effort: failures here must not turn the
+        // trajectory-end call itself into a failure — the trajectory record was
+        // already persisted above.
+        //
+        // #3662: #2351's original fix gated this on `!hasSteps` (step-less
+        // trajectories only). The common start -> step -> end path (the one real
+        // agents actually use) therefore recorded SONA state while leaving the
+        // feedback unindexed. Non-empty feedback is promoted regardless of
+        // whether steps were recorded — a trajectory's steps and its distilled
+        // feedback are not mutually exclusive evidence.
         let feedbackDistilled = { stored: false };
-        const hasSteps = !!trajectory && trajectory.steps.length > 0;
         const trimmedFeedback = typeof feedback === 'string' ? feedback.trim() : '';
-        if (trajectory && !hasSteps && trimmedFeedback.length > 0) {
+        if (trajectory && trimmedFeedback.length > 0) {
             const distilledPatternId = `pattern-feedback-${trajectoryId}-${Date.now()}`;
             const patternMetadata = {
                 sourceTrajectoryId: trajectoryId,

package/dist/src/memory/graph-edge-writer.js

@@ -32,6 +32,7 @@
 import * as path from 'path';
 import * as fs from 'fs';
 import * as crypto from 'crypto';
+import { execFileSync } from 'child_process';
 import { getMemoryRoot } from './memory-initializer.js';
 import { encodeEmbedding } from './embedding-quantization.js';
 import { loadBetterSqlite3 } from './shared-sqlite.js';
@@ -54,20 +55,41 @@ import { isEncryptedBlob } from '../encryption/vault.js';
 // skip the native open (it would only throw) and warn once per distinct
 // dbPath (not once per process — a process can legitimately touch more
 // than one encrypted store via a custom `dbPath` argument).
+/** Child-process body: print the first `argv[2]` bytes of `argv[1]` as hex. */
+const HEADER_READER = "const fs=require('fs');const fd=fs.openSync(process.argv[1],'r');const b=Buffer.alloc(Number(process.argv[2]));" +
+    "const n=fs.readSync(fd,b,0,b.length,0);process.stdout.write(b.subarray(0,n).toString('hex'))";
+const HEADER_READ_TIMEOUT_MS = 5000;
 /** Read just the first `len` bytes of a file without loading the whole file
- * into memory. Mirrors the pattern in commands/doctor.ts's readHeaderBytes
- * (not imported from there — this is a memory-layer module and must not
- * depend on the command layer). */
+ * into memory.
+ *
+ * #4040: on POSIX this never opens the file in THIS process. close(2) on any
+ * descriptor for an inode drops every advisory lock the process holds on it
+ * (https://www.sqlite.org/howtocorrupt.html), including the ones SQLite's own
+ * live handle holds - a second process then believes it is the only
+ * connection and checkpoints/deletes the WAL under us. This module (and the
+ * shared AgentDB handle) can own such a handle, so the header is read by a
+ * short-lived child: empty environment, one bounded read, 5 s timeout. Windows
+ * byte-range locks are per handle, not per process, so it reads in-process. */
 function readHeaderBytes(filePath, len) {
-    const fd = fs.openSync(filePath, 'r');
-    try {
-        const buf = Buffer.alloc(len);
-        const bytesRead = fs.readSync(fd, buf, 0, len, 0);
-        return buf.subarray(0, bytesRead);
-    }
-    finally {
-        fs.closeSync(fd);
+    if (process.platform === 'win32') {
+        const fd = fs.openSync(filePath, 'r');
+        try {
+            const buf = Buffer.alloc(len);
+            const bytesRead = fs.readSync(fd, buf, 0, len, 0);
+            return buf.subarray(0, bytesRead);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
     }
+    const hex = execFileSync(process.execPath, ['-e', HEADER_READER, filePath, String(len)], {
+        env: {},
+        timeout: HEADER_READ_TIMEOUT_MS,
+        maxBuffer: len * 2 + 64,
+        stdio: ['ignore', 'pipe', 'ignore'],
+        encoding: 'utf8',
+    });
+    return Buffer.from(hex, 'hex');
 }
 // RFE1 wire format is magic(4) + iv(12) + ciphertext(N) + tag(16); the
 // shortest possible blob is 32 bytes. 64 gives headroom.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.56.4",
+  "version": "3.56.6",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -98,13 +98,13 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@claude-flow/cli-core": "3.7.0",
+    "@claude-flow/cli-core": "3.7.1",
     "@claude-flow/codex": "3.0.3",
     "@claude-flow/mcp": "3.1.1",
     "@claude-flow/neural": "3.0.0",
     "@claude-flow/plugin-agent-federation": "1.0.1",
     "@claude-flow/security": "3.0.4",
-    "@claude-flow/shared": "3.0.2",
+    "@claude-flow/shared": "3.0.3",
     "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",