@claude-flow/cli 3.56.5 → 3.56.7

package/.claude/helpers/auto-memory-hook.mjs

@@ -11,8 +11,10 @@
  *   node auto-memory-hook.mjs status   # Show bridge status
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { join, dirname, resolve } from 'path';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, rmdirSync, rmSync, statSync } from 'fs';
+import { execFileSync } from 'child_process';
+import { homedir } from 'os';
+import { join, dirname, resolve, sep } from 'path';
 import { fileURLToPath } from 'url';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -77,6 +79,66 @@ process.on('SIGINT', () => { gracefulExit('SIGINT'); });
 // Ensure data dir
 if (!existsSync(DATA_DIR)) mkdirSync(DATA_DIR, { recursive: true });
 
+// ============================================================================
+// Store write safety (#4058): intelligence.cjs read-modify-writes the same
+// file from the session-end hook, so writes are atomic (temp + rename) and
+// serialised by a short directory lock. The lock is advisory and fails open:
+// a hook must never hang, so after ~2 s it proceeds without it.
+// ============================================================================
+
+const LOCK_WAIT_MS = 2000;
+const LOCK_STALE_MS = 10000;
+function sleepSync(ms) { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); }
+
+function withStoreLock(storePath, fn) {
+  const lock = storePath + '.lock';
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  let held = false;
+  for (;;) {
+    try { mkdirSync(lock); held = true; break; } catch (e) {
+      if (!e || e.code !== 'EEXIST') break;
+      try {
+        if (Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS) { rmSync(lock, { recursive: true, force: true }); continue; }
+      } catch { /* lock vanished: retry */ }
+      if (Date.now() > deadline) break;
+      sleepSync(10);
+    }
+  }
+  try { return fn(); } finally { if (held) { try { rmdirSync(lock); } catch { /* already gone */ } } }
+}
+
+function writeFileAtomic(filePath, text) {
+  const tmp = filePath + '.' + process.pid + '.tmp';
+  try {
+    writeFileSync(tmp, text, 'utf-8');
+    renameSync(tmp, filePath);
+  } catch (e) {
+    try { unlinkSync(tmp); } catch { /* nothing to clean */ }
+    throw e;
+  }
+}
+
+// Claude Code shares one auto-memory directory across every worktree of a
+// repository, but findGitRoot() in the memory package stops at a worktree's
+// `.git` FILE and keys the directory by the worktree path (#4058). Resolve the
+// main checkout through git's common dir so both agree. No shell is involved.
+function mainCheckoutRoot(dir) {
+  try {
+    if (!statSync(join(dir, '.git')).isFile()) return null;
+    const common = execFileSync('git', ['rev-parse', '--git-common-dir'], { cwd: dir, encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    if (!common) return null;
+    const abs = resolve(dir, common);
+    return abs.endsWith('/.git') || abs.endsWith('\\.git') ? dirname(abs) : null;
+  } catch { return null; }
+}
+
+function worktreeMemoryDir() {
+  const main = mainCheckoutRoot(PROJECT_ROOT);
+  if (!main) return undefined;
+  const key = main.split(sep).join('/').replace(/[\/_:]/g, '-');
+  return join(process.env.HOME || process.env.USERPROFILE || homedir(), '.claude', 'projects', key, 'memory');
+}
+
 // ============================================================================
 // Simple JSON File Backend (implements IMemoryBackend interface)
 // ============================================================================
@@ -85,6 +147,8 @@ class JsonFileBackend {
   constructor(filePath) {
     this.filePath = filePath;
     this.entries = new Map();
+    this.loadedIds = new Set();
+    this.deletedIds = new Set();
   }
 
   async initialize() {
@@ -92,7 +156,7 @@ class JsonFileBackend {
       try {
         const data = JSON.parse(readFileSync(this.filePath, 'utf-8'));
         if (Array.isArray(data)) {
-          for (const entry of data) this.entries.set(entry.id, entry);
+          for (const entry of data) { this.entries.set(entry.id, entry); this.loadedIds.add(entry.id); }
         }
       } catch { /* start fresh */ }
     }
@@ -117,17 +181,26 @@ class JsonFileBackend {
     this._persist();
     return e;
   }
-  async delete(id) { return this.entries.delete(id); }
+  async delete(id) { this.deletedIds.add(id); return this.entries.delete(id); }
   async query(opts) {
     let results = [...this.entries.values()];
     if (opts?.namespace) results = results.filter(e => e.namespace === opts.namespace);
-    if (opts?.type) results = results.filter(e => e.type === opts.type);
+    // MemoryQuery.type is the query mode (semantic|exact|prefix|tag|hybrid), not
+    // the entry's memory type: the bridge asks for { type: 'hybrid' } and a strict
+    // entry-type match returned nothing, so sync always reported 0 (#4058).
+    const MODES = ['semantic', 'exact', 'prefix', 'tag', 'hybrid'];
+    if (opts?.type && !MODES.includes(opts.type)) results = results.filter(e => e.type === opts.type);
+    if (opts?.memoryType) results = results.filter(e => e.type === opts.memoryType);
+    if (opts?.key) results = results.filter(e => e.key === opts.key);
+    if (opts?.keyPrefix) results = results.filter(e => typeof e.key === 'string' && e.key.startsWith(opts.keyPrefix));
+    if (Array.isArray(opts?.tags) && opts.tags.length) results = results.filter(e => opts.tags.every(t => (e.tags || []).includes(t)));
+    if (opts?.updatedAfter) results = results.filter(e => (e.updatedAt || 0) > opts.updatedAfter);
     if (opts?.limit) results = results.slice(0, opts.limit);
     return results;
   }
   async search() { return []; } // No vector search in JSON backend
   async bulkInsert(entries) { for (const e of entries) this.entries.set(e.id, e); this._persist(); }
-  async bulkDelete(ids) { let n = 0; for (const id of ids) { if (this.entries.delete(id)) n++; } this._persist(); return n; }
+  async bulkDelete(ids) { let n = 0; for (const id of ids) { this.deletedIds.add(id); if (this.entries.delete(id)) n++; } this._persist(); return n; }
   async count() { return this.entries.size; }
   async listNamespaces() {
     const ns = new Set();
@@ -137,7 +210,7 @@ class JsonFileBackend {
   async clearNamespace(ns) {
     let n = 0;
     for (const [id, e] of this.entries) {
-      if (e.namespace === ns) { this.entries.delete(id); n++; }
+      if (e.namespace === ns) { this.deletedIds.add(id); this.entries.delete(id); n++; }
     }
     this._persist();
     return n;
@@ -164,7 +237,22 @@ class JsonFileBackend {
 
   _persist() {
     try {
-      writeFileSync(this.filePath, JSON.stringify([...this.entries.values()], null, 2), 'utf-8');
+      withStoreLock(this.filePath, () => {
+        // Keep entries another writer (intelligence.cjs, a parallel hook) added
+        // after we loaded; ours win on the same id, and our own deletes stay deleted.
+        const merged = new Map(this.entries);
+        try {
+          const onDisk = JSON.parse(readFileSync(this.filePath, 'utf-8'));
+          if (Array.isArray(onDisk)) {
+            for (const e of onDisk) {
+              if (e && !merged.has(e.id) && !this.loadedIds.has(e.id) && !this.deletedIds.has(e.id)) merged.set(e.id, e);
+            }
+          }
+        } catch { /* missing or unreadable: write ours */ }
+        writeFileAtomic(this.filePath, JSON.stringify([...merged.values()], null, 2));
+        for (const id of merged.keys()) this.loadedIds.add(id);
+        this.entries = merged;
+      });
     } catch { /* best effort */ }
   }
 }
@@ -284,6 +372,8 @@ async function doImport() {
     workingDir: PROJECT_ROOT,
     syncMode: 'on-session-end',
   };
+  const wtDir = worktreeMemoryDir();
+  if (wtDir) bridgeConfig.memoryDir = wtDir;
 
   // Wire learning if enabled and available
   if (config.learningBridge.enabled && memPkg.LearningBridge) {
@@ -344,6 +434,8 @@ async function doSync() {
     workingDir: PROJECT_ROOT,
     syncMode: 'on-session-end',
   };
+  const wtDir = worktreeMemoryDir();
+  if (wtDir) bridgeConfig.memoryDir = wtDir;
 
   if (config.learningBridge.enabled && memPkg.LearningBridge) {
     bridgeConfig.learning = {
@@ -369,8 +461,11 @@ async function doSync() {
     dim(`└─ Backend entries: ${entryCount}`);
 
     // Curate MEMORY.md index with graph-aware ordering
+    let indexSkipped = null;
+    if (typeof bridge.on === 'function') bridge.on('index:skipped', (info) => { indexSkipped = info; });
     await bridge.curateIndex();
-    success('Curated MEMORY.md index');
+    if (indexSkipped) dim(`MEMORY.md index unchanged (${indexSkipped.reason || 'nothing to curate'})`);
+    else success('Curated MEMORY.md index');
   } catch (err) {
     dim(`Sync failed (non-critical): ${err.message}`);
   }
@@ -408,7 +503,11 @@ async function doStatus() {
 // Main
 // ============================================================================
 
-const command = process.argv[2] || 'status';
+// Older settings.json files run `node -e "…import(file)" import`, where the
+// subcommand lands in argv[1] and argv[2] is empty, so both hooks fell through
+// to `status` and never imported or synced (#4058). Accept that shape too.
+const COMMANDS = ['import', 'sync', 'status'];
+const command = process.argv[2] || (COMMANDS.includes(process.argv[1]) ? process.argv[1] : 'status');
 
 // Dynamic import() failures can surface as unhandled rejections on a later
 // microtask even when the awaiting call site already caught them, which would

package/.claude/helpers/helpers.manifest.json

@@ -1,14 +1,14 @@
 {
   "manifest": {
-    "version": "3.56.5",
+    "version": "3.56.7",
     "files": {
-      "auto-memory-hook.mjs": "381412515fb490def7d821ddfe1ebf8d9bee76e49a86e182806c0274f568bf15",
-      "hook-handler.cjs": "38fc235079ddcf74b62452a91b9e56703026a1a7682dcce3c635be5ad1c8ea19",
-      "intelligence.cjs": "ac5033a77bcea9796856629d5d319bde9ab6b7edf0dcd0d4af187ce30af90836",
+      "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
+      "hook-handler.cjs": "0f855c667b8d2d04cb4fe91b14b351d14c3dfb30516dcd9d7ae156acbe0a689d",
+      "intelligence.cjs": "f486be296eb2f0518f34b8f4453d9d0a988845e4aec6d18d8d47725aca6dd38b",
       "statusline.cjs": "d72417ecb38634011a19f095a30e07b9929e6f97663520172ece9be7491b2eaa",
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "/MW5zFGHYeVuoNFAcDlUhkjIdDhPmBiUQTVJTz8Ku20SpFOoxpIXbgv01PxS5IloBqfmuDLieu++2cG55SIzAg==",
+  "signature": "15NFpUZ8+naP4v/xuCBCl7IZ//YJPXQYotOg48V/Xw/uyCY1FXYeeL4a3Rwa+Bji0+CV4FRiZg61N6Zt+EStBg==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -213,6 +213,198 @@ function spawnDetachedAdvisorRefresh() {
   spawnDetachedHookRefresh('refresh-advisor');
 }
 
+// ── Settings-risk scan for the automatic SessionStart hook ────────────────
+//
+// Mirrors v3/@claude-flow/cli/src/init/settings-risk-scanner.ts's
+// `scanSettingsForRisk()`/`formatRiskFindingsAsWarnings()`. That TS scanner
+// already runs at `ruflo init`/`--upgrade` time and (via the
+// `hooks_session-restore` MCP/CLI tool handler) on an explicit
+// `session-restore` call — but neither covers the one path that actually
+// fires automatically, unconditionally, on every real Claude Code session
+// boot: THIS file, invoked as the `SessionStart` hook configured in
+// .claude/settings.json itself. That is precisely the persistence mechanism
+// used by the real 2026 "Mini Shai-Hulud" npm-worm campaign (a malicious
+// SessionStart hook written into settings.json re-fires on every session,
+// surviving removal of the original infected package) and the escalation
+// path closed by CVE-2026-25725 in Claude Code's own sandbox. hook-handler.cjs
+// has no build step and cannot import the TS module, so this is a deliberate
+// CJS port — keep the pattern lists in sync with settings-risk-scanner.ts;
+// see the logic-parity test guarding this.
+//
+// Advisory-only: never mutates settings.json, never blocks session-restore.
+// A missing settings.json or any JSON.parse failure yields zero findings
+// silently. Unlike the opt-in `hooks_session-restore` MCP-tool path (#3835,
+// which narrows its catch to SyntaxError only so a real scanner bug
+// surfaces), THIS path fires unconditionally on every real session boot —
+// an adversarial review of this exact candidate flagged that narrowing the
+// same way here would let a non-SyntaxError JSON.parse failure (e.g. a V8
+// RangeError on deeply-nested JSON) abort session-restore itself, not just
+// skip the scan. "Can't scan it" and "can't parse it" are the same case
+// here, so any parse failure degrades to zero findings.
+const SR_DANGEROUS_COMMAND_WORDS = [
+  'rm', 'rmdir', 'del', 'format', 'mkfs', 'dd', 'chmod', 'chown',
+  'kill', 'killall', 'pkill', 'reboot', 'shutdown', 'poweroff', 'halt',
+  'sudo', 'eval',
+];
+const SR_SHELL_EXEC_WORDS = ['bash', 'sh', 'zsh', 'python', 'python3', 'perl', 'ruby', 'eval'];
+const SR_DOWNLOADER_WORDS = ['curl', 'wget'];
+const SR_STANDALONE_RISK_PATTERNS = [
+  /\bInvoke-Expression\b/i,
+  /\biex\s*\(/i,
+  /\/dev\/tcp\//i,
+  /\bnc\s+-e\b/i,
+  /base64\s+(-d|--decode)\b/i,
+];
+const SR_RISKY_PREAPPROVE_WORDS = [...SR_DANGEROUS_COMMAND_WORDS, ...SR_SHELL_EXEC_WORDS, ...SR_DOWNLOADER_WORDS];
+
+// Encoded PowerShell (`powershell[.exe] ... -e|-enc|-encodedcommand <payload>`),
+// matched on whitespace-separated tokens in ONE linear pass. The earlier regex
+// (`powershell\\s+(?:\\S+\\s+)*?-e...`) is quadratic on repeated "powershell "
+// tokens (every start rescans the tail: 256KB measured ~2.5s, 1MB ~40s) because
+// the lazy token loop re-runs from each start. Same semantics: a token ending in
+// powershell/powershell.exe, then LATER a token that is exactly -e/-enc/
+// -encodedcommand, then at least one more token.
+function srHasEncodedPowershell(command) {
+  let seenPs = false;
+  let pendingEnc = false;
+  for (const raw of String(command).split(/\s+/)) {
+    if (!raw) continue;
+    if (pendingEnc) return true;
+    const t = raw.toLowerCase();
+    if (seenPs && (t === '-e' || t === '-enc' || t === '-encodedcommand')) pendingEnc = true;
+    else if (t.endsWith('powershell') || t.endsWith('powershell.exe')) seenPs = true;
+  }
+  return false;
+}
+
+function srWordBoundaryMatches(text, word) {
+  return new RegExp(`\\b${word}\\b`, 'i').test(text);
+}
+
+function srScanCommandStringForRisk(command) {
+  const reasons = [];
+  if (srHasEncodedPowershell(command) || SR_STANDALONE_RISK_PATTERNS.some((pattern) => pattern.test(command))) {
+    reasons.push('matches a known-dangerous execution pattern (encoded/remote command execution)');
+  }
+  const hasDownloader = SR_DOWNLOADER_WORDS.some((w) => srWordBoundaryMatches(command, w));
+  const hasShellExec = SR_SHELL_EXEC_WORDS.some((w) => srWordBoundaryMatches(command, w));
+  if (hasDownloader && hasShellExec) {
+    reasons.push('combines a downloader (curl/wget) with a shell/interpreter invocation in the same command');
+  }
+  for (const word of SR_DANGEROUS_COMMAND_WORDS) {
+    if (srWordBoundaryMatches(command, word)) {
+      reasons.push(`invokes dangerous command "${word}"`);
+    }
+  }
+  return reasons;
+}
+
+function srScanAllowRuleForRisk(rule) {
+  const trimmed = rule.trim();
+  const reasons = [];
+  if (/^Bash\(\s*\*\s*(:\s*\*\s*)?\)$/i.test(trimmed)) {
+    reasons.push('grants unrestricted Bash execution (wildcard allow rule)');
+  }
+  for (const word of SR_RISKY_PREAPPROVE_WORDS) {
+    if (new RegExp(`^Bash\\(\\s*${word}\\s*(:| |\\))`, 'i').test(trimmed)) {
+      reasons.push(`pre-allows "${word}" with no per-call confirmation`);
+    }
+  }
+  return reasons;
+}
+
+// Strips ANSI/control characters from untrusted text before it's ever
+// embedded in a warning string printed to the terminal (same rationale as
+// settings-risk-scanner.ts's sanitizeForDisplay()).
+function srSanitizeForDisplay(text) {
+  // eslint-disable-next-line no-control-regex
+  return text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
+}
+
+function srBuildSnippet(text) {
+  const clean = srSanitizeForDisplay(text);
+  return clean.length > 120 ? `${clean.slice(0, 120)}…` : clean;
+}
+
+function srScanSettingsForRisk(settings) {
+  const findings = [];
+  const hooks = settings && settings.hooks;
+  if (hooks && typeof hooks === 'object') {
+    for (const [eventName, groups] of Object.entries(hooks)) {
+      if (!Array.isArray(groups)) continue;
+      groups.forEach((group, groupIdx) => {
+        const hookList = group && group.hooks;
+        if (!Array.isArray(hookList)) return;
+        hookList.forEach((h, hookIdx) => {
+          if (!h || typeof h.command !== 'string') return;
+          for (const reason of srScanCommandStringForRisk(h.command)) {
+            findings.push({
+              location: `hooks.${eventName}[${groupIdx}].hooks[${hookIdx}]`,
+              snippet: srBuildSnippet(h.command),
+              reason,
+            });
+          }
+        });
+      });
+    }
+  }
+  const allow = settings && settings.permissions && settings.permissions.allow;
+  if (Array.isArray(allow)) {
+    allow.forEach((rule, idx) => {
+      if (typeof rule !== 'string') return;
+      for (const reason of srScanAllowRuleForRisk(rule)) {
+        findings.push({
+          location: `permissions.allow[${idx}]`,
+          snippet: srBuildSnippet(rule),
+          reason,
+        });
+      }
+    });
+  }
+  return findings;
+}
+
+function srFormatRiskFindingsAsWarnings(findings) {
+  return findings.map((f) => `${f.location}: ${f.reason} — "${f.snippet}"`);
+}
+
+// Location + reason only, no snippet — see scanSessionStartSettingsForRisk's
+// doc comment for why the automatic boot path deliberately drops it.
+function srFormatRiskFindingsForAutomaticBoot(findings) {
+  return findings.map((f) => `${f.location}: ${f.reason}`);
+}
+
+// Reads and scans THIS project's own .claude/settings.json. Returns a
+// (possibly empty) array of warning strings; never throws on a
+// missing/malformed file.
+//
+// Deliberately omits the matched snippet (unlike srFormatRiskFindingsAsWarnings,
+// which `init`/`--upgrade` uses and which DOES include it): this function's
+// only caller is the 'session-restore' handler below, whose stdout is read
+// back into the live Claude Code session as context — not a human reading a
+// terminal. Printing up to 120 characters of attacker-controlled settings.json
+// content into that context is a prompt-injection path even with control
+// characters stripped (flagged by review on PR #4053). The location and
+// static reason string are both scanner-generated, never attacker content.
+function scanSessionStartSettingsForRisk() {
+  const projectRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
+  let raw;
+  try {
+    raw = fs.readFileSync(settingsPath, 'utf-8');
+  } catch (e) {
+    return []; // no settings.json (or unreadable) — nothing to scan
+  }
+  let settings;
+  try {
+    settings = JSON.parse(raw);
+  } catch (e) {
+    return []; // can't parse it, so can't scan it — never block session-restore for this
+  }
+  if (!settings || typeof settings !== 'object') return [];
+  return srFormatRiskFindingsForAutomaticBoot(srScanSettingsForRisk(settings));
+}
+
 // Safe require with stdout suppression - the helper modules have CLI
 // sections that run unconditionally on require(), so we mute console
 // during the require to prevent noisy output.
@@ -651,6 +843,11 @@ const handlers = {
     // Fully non-blocking (detached spawn) so session-restore latency
     // is unchanged.
     firstRunAutoEnableIfEligible();
+    // Advisory-only settings.json risk scan — see scanSessionStartSettingsForRisk's
+    // own doc comment for why this runs specifically on this automatic path.
+    for (const warning of scanSessionStartSettingsForRisk()) {
+      console.log(`[WARN] ${warning}`);
+    }
     if (session) {
       // Try restore first, fall back to start
       const existing = session.restore && session.restore();
@@ -777,4 +974,4 @@ if (require.main === module) {
 // Which sibling helpers loaded (all CommonJS, shipped as .cjs — #3555).
 const loadedHelpers = { router: !!router, session: !!session, memory: !!memory, intelligence: !!intelligence };
 
-module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS, resolveCliBinForHook, cliSpawnArgs, helperRoot };
+module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS, resolveCliBinForHook, cliSpawnArgs, helperRoot, scanSessionStartSettingsForRisk, srFormatRiskFindingsForAutomaticBoot, srScanSettingsForRisk, srScanCommandStringForRisk, srScanAllowRuleForRisk, SR_DANGEROUS_COMMAND_WORDS, SR_SHELL_EXEC_WORDS, SR_DOWNLOADER_WORDS, SR_STANDALONE_RISK_PATTERNS };

package/.claude/helpers/intelligence.cjs

@@ -108,9 +108,60 @@ function readJSON(filePath) {
   return null;
 }
 
+// Atomic (temp + rename): auto-memory-hook.mjs reads and writes the same store
+// from the session hooks, and a reader must never see a half-written file (#4058).
 function writeJSON(filePath, data) {
   ensureDataDir();
-  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf-8');
+  const tmp = filePath + '.' + process.pid + '.tmp';
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 2), 'utf-8');
+    fs.renameSync(tmp, filePath);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch { /* nothing to clean */ }
+    throw e;
+  }
+}
+
+// Short advisory directory lock shared with auto-memory-hook.mjs. It fails open
+// after ~2 s so a stuck lock can never hang a hook.
+function withStoreLock(filePath, fn) {
+  const lock = filePath + '.lock';
+  const deadline = Date.now() + 2000;
+  let held = false;
+  for (;;) {
+    try { fs.mkdirSync(lock); held = true; break; } catch (e) {
+      if (!e || e.code !== 'EEXIST') break;
+      try {
+        if (Date.now() - fs.statSync(lock).mtimeMs > 10000) { fs.rmSync(lock, { recursive: true, force: true }); continue; }
+      } catch { /* lock vanished: retry */ }
+      if (Date.now() > deadline) break;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+    }
+  }
+  try { return fn(); } finally { if (held) { try { fs.rmdirSync(lock); } catch { /* already gone */ } } }
+}
+
+// IDs present when the store was read. Take this BEFORE deduping: those passes
+// assign IDs to entries in place, and an entry that had none must still count as
+// ours (not as something another writer added).
+function storeIds(loaded) {
+  return new Set((Array.isArray(loaded) ? loaded : []).map((e) => e && e.id));
+}
+
+// Write the store, keeping entries another writer added after we read it.
+function writeStoreMerged(filePath, next, loadedIds) {
+  withStoreLock(filePath, () => {
+    let out = next;
+    try {
+      const current = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+      if (Array.isArray(current)) {
+        const have = new Set(next.map((e) => e && e.id));
+        const added = current.filter((e) => e && e.id != null && !loadedIds.has(e.id) && !have.has(e.id));
+        if (added.length) out = next.concat(added);
+      }
+    } catch { /* missing or unreadable: write ours */ }
+    writeJSON(filePath, out);
+  });
 }
 
 function tokenize(text) {
@@ -475,13 +526,14 @@ function init() {
   // Check if graph-state.json is fresh (within 60s of store)
   const graphState = readJSON(GRAPH_PATH);
   let store = readJSON(STORE_PATH);
+  const loadedIds = storeIds(store);
 
   // Bootstrap from MEMORY.md files if store is empty
   if (!store || !Array.isArray(store) || store.length === 0) {
     const bootstrapped = bootstrapFromMemoryFiles();
     if (bootstrapped.length > 0) {
       store = bootstrapped;
-      writeJSON(STORE_PATH, store);
+      writeStoreMerged(STORE_PATH, store, loadedIds);
     } else {
       return { nodes: 0, edges: 0, message: 'No memory entries to index' };
     }
@@ -503,7 +555,7 @@ function init() {
       `[INTELLIGENCE] Deduped store: ${store.length} -> ${deduped.length} entries ` +
       `(by-id: ${store.length - beforeContentDedup} dropped, by-content: ${beforeContentDedup - deduped.length} dropped)\n`
     );
-    writeJSON(STORE_PATH, deduped);
+    writeStoreMerged(STORE_PATH, deduped, loadedIds);
   }
 
   // Skip rebuild if graph is fresh and store hasn't changed. #2920: nodeCount
@@ -834,6 +886,7 @@ function consolidate() {
     return { entries: 0, edges: 0, newEntries: 0, message: 'No store to consolidate' };
   }
 
+  const loadedIds = storeIds(store);
   // Deduplicate store entries by ID before processing (fixes #1518)
   const preDedupCount = store.length;
   store = deduplicateById(store);
@@ -979,7 +1032,7 @@ function consolidate() {
   // RANKED_PATH are rewritten unconditionally just above; writing the
   // (already deduped, size-bounded per ADR-095 G6) store alongside them
   // costs nothing near the <500ms budget and removes the whole bug class.
-  writeJSON(STORE_PATH, store);
+  writeStoreMerged(STORE_PATH, store, loadedIds);
 
   // 9. Save snapshot for delta tracking
   const updatedGraph = readJSON(GRAPH_PATH);

package/bin/cli.js

@@ -257,7 +257,7 @@ if (isMCPMode) {
             serverInfo: { name: 'ruflo', version: VERSION },
             capabilities: {
               tools: { listChanged: true },
-              resources: { subscribe: true, listChanged: true },
+              resources: {},
             },
           },
         };
@@ -322,6 +322,16 @@ if (isMCPMode) {
         }
       }
 
+      // A declared capability must be served (ADR-490): no resources are exposed, so list answers are empty and a read is "not found".
+      case 'resources/list':
+        return { jsonrpc: '2.0', id: message.id, result: { resources: [] } };
+
+      case 'resources/templates/list':
+        return { jsonrpc: '2.0', id: message.id, result: { resourceTemplates: [] } };
+
+      case 'resources/read':
+        return { jsonrpc: '2.0', id: message.id, error: { code: -32002, message: 'Resource not found' } };
+
       case 'notifications/initialized':
         return null;
 

package/bin/mcp-server.js

@@ -146,7 +146,7 @@ async function handleMessage(message) {
             serverInfo: { name: 'ruflo', version: VERSION },
             capabilities: {
               tools: { listChanged: true },
-              resources: { subscribe: true, listChanged: true },
+              resources: {},
             },
           },
         };
@@ -208,6 +208,16 @@ async function handleMessage(message) {
         }
       }
 
+      // A declared capability must be served (ADR-490): no resources are exposed, so list answers are empty and a read is "not found".
+      case 'resources/list':
+        return { jsonrpc: '2.0', id: message.id, result: { resources: [] } };
+
+      case 'resources/templates/list':
+        return { jsonrpc: '2.0', id: message.id, result: { resourceTemplates: [] } };
+
+      case 'resources/read':
+        return { jsonrpc: '2.0', id: message.id, error: { code: -32002, message: 'Resource not found' } };
+
       case 'notifications/initialized':
         console.error(`[${new Date().toISOString()}] INFO [claude-flow-mcp] Client initialized`);
         return null; // No response for notifications

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-11T02:06:08.884Z",
-  "gitSha": "72255a2f",
+  "generatedAt": "2026-10-11T22:43:38.354Z",
+  "gitSha": "aac16fbd",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/commands/doctor-native-addon.d.ts

@@ -0,0 +1,23 @@
+export interface NativeAddonCheck {
+    name: string;
+    status: 'pass' | 'warn' | 'fail';
+    message: string;
+    fix?: string;
+}
+/** Node 24.19.0 up to, but not including, 24.22.0. Re-check this bound when a release ships the fix. */
+export declare function isAffectedNodeVersion(version: string): boolean;
+/** The Node version of the headers a copy was built against, from its config.gypi. */
+export declare function headersVersionFromGypi(gypi: string): string | null;
+/** `better-sqlite3` copies in node_modules next to, or one level under, each ancestor of the start dirs. */
+export declare function findBetterSqlite3Copies(startDirs: string[], maxDepth?: number): string[];
+export interface NativeAddonCheckDeps {
+    /** Runtime version, default process.versions.node. */
+    nodeVersion?: string;
+    /** Exact better-sqlite3 package directories to inspect (skips discovery). */
+    copies?: string[];
+    /** Directories to walk up from when discovering copies. */
+    startDirs?: string[];
+}
+/** Read-only: warn when a locally compiled better-sqlite3 was built against Node >= 24.19 headers on an affected runtime. */
+export declare function checkNativeAddonHeaders(deps?: NativeAddonCheckDeps): Promise<NativeAddonCheck>;
+//# sourceMappingURL=doctor-native-addon.d.ts.map