@claude-flow/cli 3.56.6 → 3.56.8

package/.claude/helpers/auto-memory-hook.mjs

@@ -11,8 +11,10 @@
  *   node auto-memory-hook.mjs status   # Show bridge status
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { join, dirname, resolve } from 'path';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, rmdirSync, rmSync, statSync } from 'fs';
+import { execFileSync } from 'child_process';
+import { homedir } from 'os';
+import { join, dirname, resolve, sep } from 'path';
 import { fileURLToPath } from 'url';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -77,6 +79,66 @@ process.on('SIGINT', () => { gracefulExit('SIGINT'); });
 // Ensure data dir
 if (!existsSync(DATA_DIR)) mkdirSync(DATA_DIR, { recursive: true });
 
+// ============================================================================
+// Store write safety (#4058): intelligence.cjs read-modify-writes the same
+// file from the session-end hook, so writes are atomic (temp + rename) and
+// serialised by a short directory lock. The lock is advisory and fails open:
+// a hook must never hang, so after ~2 s it proceeds without it.
+// ============================================================================
+
+const LOCK_WAIT_MS = 2000;
+const LOCK_STALE_MS = 10000;
+function sleepSync(ms) { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); }
+
+function withStoreLock(storePath, fn) {
+  const lock = storePath + '.lock';
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  let held = false;
+  for (;;) {
+    try { mkdirSync(lock); held = true; break; } catch (e) {
+      if (!e || e.code !== 'EEXIST') break;
+      try {
+        if (Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS) { rmSync(lock, { recursive: true, force: true }); continue; }
+      } catch { /* lock vanished: retry */ }
+      if (Date.now() > deadline) break;
+      sleepSync(10);
+    }
+  }
+  try { return fn(); } finally { if (held) { try { rmdirSync(lock); } catch { /* already gone */ } } }
+}
+
+function writeFileAtomic(filePath, text) {
+  const tmp = filePath + '.' + process.pid + '.tmp';
+  try {
+    writeFileSync(tmp, text, 'utf-8');
+    renameSync(tmp, filePath);
+  } catch (e) {
+    try { unlinkSync(tmp); } catch { /* nothing to clean */ }
+    throw e;
+  }
+}
+
+// Claude Code shares one auto-memory directory across every worktree of a
+// repository, but findGitRoot() in the memory package stops at a worktree's
+// `.git` FILE and keys the directory by the worktree path (#4058). Resolve the
+// main checkout through git's common dir so both agree. No shell is involved.
+function mainCheckoutRoot(dir) {
+  try {
+    if (!statSync(join(dir, '.git')).isFile()) return null;
+    const common = execFileSync('git', ['rev-parse', '--git-common-dir'], { cwd: dir, encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    if (!common) return null;
+    const abs = resolve(dir, common);
+    return abs.endsWith('/.git') || abs.endsWith('\\.git') ? dirname(abs) : null;
+  } catch { return null; }
+}
+
+function worktreeMemoryDir() {
+  const main = mainCheckoutRoot(PROJECT_ROOT);
+  if (!main) return undefined;
+  const key = main.split(sep).join('/').replace(/[\/_:]/g, '-');
+  return join(process.env.HOME || process.env.USERPROFILE || homedir(), '.claude', 'projects', key, 'memory');
+}
+
 // ============================================================================
 // Simple JSON File Backend (implements IMemoryBackend interface)
 // ============================================================================
@@ -85,6 +147,8 @@ class JsonFileBackend {
   constructor(filePath) {
     this.filePath = filePath;
     this.entries = new Map();
+    this.loadedIds = new Set();
+    this.deletedIds = new Set();
   }
 
   async initialize() {
@@ -92,7 +156,7 @@ class JsonFileBackend {
       try {
         const data = JSON.parse(readFileSync(this.filePath, 'utf-8'));
         if (Array.isArray(data)) {
-          for (const entry of data) this.entries.set(entry.id, entry);
+          for (const entry of data) { this.entries.set(entry.id, entry); this.loadedIds.add(entry.id); }
         }
       } catch { /* start fresh */ }
     }
@@ -117,17 +181,26 @@ class JsonFileBackend {
     this._persist();
     return e;
   }
-  async delete(id) { return this.entries.delete(id); }
+  async delete(id) { this.deletedIds.add(id); return this.entries.delete(id); }
   async query(opts) {
     let results = [...this.entries.values()];
     if (opts?.namespace) results = results.filter(e => e.namespace === opts.namespace);
-    if (opts?.type) results = results.filter(e => e.type === opts.type);
+    // MemoryQuery.type is the query mode (semantic|exact|prefix|tag|hybrid), not
+    // the entry's memory type: the bridge asks for { type: 'hybrid' } and a strict
+    // entry-type match returned nothing, so sync always reported 0 (#4058).
+    const MODES = ['semantic', 'exact', 'prefix', 'tag', 'hybrid'];
+    if (opts?.type && !MODES.includes(opts.type)) results = results.filter(e => e.type === opts.type);
+    if (opts?.memoryType) results = results.filter(e => e.type === opts.memoryType);
+    if (opts?.key) results = results.filter(e => e.key === opts.key);
+    if (opts?.keyPrefix) results = results.filter(e => typeof e.key === 'string' && e.key.startsWith(opts.keyPrefix));
+    if (Array.isArray(opts?.tags) && opts.tags.length) results = results.filter(e => opts.tags.every(t => (e.tags || []).includes(t)));
+    if (opts?.updatedAfter) results = results.filter(e => (e.updatedAt || 0) > opts.updatedAfter);
     if (opts?.limit) results = results.slice(0, opts.limit);
     return results;
   }
   async search() { return []; } // No vector search in JSON backend
   async bulkInsert(entries) { for (const e of entries) this.entries.set(e.id, e); this._persist(); }
-  async bulkDelete(ids) { let n = 0; for (const id of ids) { if (this.entries.delete(id)) n++; } this._persist(); return n; }
+  async bulkDelete(ids) { let n = 0; for (const id of ids) { this.deletedIds.add(id); if (this.entries.delete(id)) n++; } this._persist(); return n; }
   async count() { return this.entries.size; }
   async listNamespaces() {
     const ns = new Set();
@@ -137,7 +210,7 @@ class JsonFileBackend {
   async clearNamespace(ns) {
     let n = 0;
     for (const [id, e] of this.entries) {
-      if (e.namespace === ns) { this.entries.delete(id); n++; }
+      if (e.namespace === ns) { this.deletedIds.add(id); this.entries.delete(id); n++; }
     }
     this._persist();
     return n;
@@ -164,7 +237,22 @@ class JsonFileBackend {
 
   _persist() {
     try {
-      writeFileSync(this.filePath, JSON.stringify([...this.entries.values()], null, 2), 'utf-8');
+      withStoreLock(this.filePath, () => {
+        // Keep entries another writer (intelligence.cjs, a parallel hook) added
+        // after we loaded; ours win on the same id, and our own deletes stay deleted.
+        const merged = new Map(this.entries);
+        try {
+          const onDisk = JSON.parse(readFileSync(this.filePath, 'utf-8'));
+          if (Array.isArray(onDisk)) {
+            for (const e of onDisk) {
+              if (e && !merged.has(e.id) && !this.loadedIds.has(e.id) && !this.deletedIds.has(e.id)) merged.set(e.id, e);
+            }
+          }
+        } catch { /* missing or unreadable: write ours */ }
+        writeFileAtomic(this.filePath, JSON.stringify([...merged.values()], null, 2));
+        for (const id of merged.keys()) this.loadedIds.add(id);
+        this.entries = merged;
+      });
     } catch { /* best effort */ }
   }
 }
@@ -284,6 +372,8 @@ async function doImport() {
     workingDir: PROJECT_ROOT,
     syncMode: 'on-session-end',
   };
+  const wtDir = worktreeMemoryDir();
+  if (wtDir) bridgeConfig.memoryDir = wtDir;
 
   // Wire learning if enabled and available
   if (config.learningBridge.enabled && memPkg.LearningBridge) {
@@ -344,6 +434,8 @@ async function doSync() {
     workingDir: PROJECT_ROOT,
     syncMode: 'on-session-end',
   };
+  const wtDir = worktreeMemoryDir();
+  if (wtDir) bridgeConfig.memoryDir = wtDir;
 
   if (config.learningBridge.enabled && memPkg.LearningBridge) {
     bridgeConfig.learning = {
@@ -369,8 +461,11 @@ async function doSync() {
     dim(`└─ Backend entries: ${entryCount}`);
 
     // Curate MEMORY.md index with graph-aware ordering
+    let indexSkipped = null;
+    if (typeof bridge.on === 'function') bridge.on('index:skipped', (info) => { indexSkipped = info; });
     await bridge.curateIndex();
-    success('Curated MEMORY.md index');
+    if (indexSkipped) dim(`MEMORY.md index unchanged (${indexSkipped.reason || 'nothing to curate'})`);
+    else success('Curated MEMORY.md index');
   } catch (err) {
     dim(`Sync failed (non-critical): ${err.message}`);
   }
@@ -408,7 +503,11 @@ async function doStatus() {
 // Main
 // ============================================================================
 
-const command = process.argv[2] || 'status';
+// Older settings.json files run `node -e "…import(file)" import`, where the
+// subcommand lands in argv[1] and argv[2] is empty, so both hooks fell through
+// to `status` and never imported or synced (#4058). Accept that shape too.
+const COMMANDS = ['import', 'sync', 'status'];
+const command = process.argv[2] || (COMMANDS.includes(process.argv[1]) ? process.argv[1] : 'status');
 
 // Dynamic import() failures can surface as unhandled rejections on a later
 // microtask even when the awaiting call site already caught them, which would

package/.claude/helpers/helpers.manifest.json

@@ -1,14 +1,14 @@
 {
   "manifest": {
-    "version": "3.56.6",
+    "version": "3.56.8",
     "files": {
-      "auto-memory-hook.mjs": "381412515fb490def7d821ddfe1ebf8d9bee76e49a86e182806c0274f568bf15",
+      "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
       "hook-handler.cjs": "0f855c667b8d2d04cb4fe91b14b351d14c3dfb30516dcd9d7ae156acbe0a689d",
-      "intelligence.cjs": "ac5033a77bcea9796856629d5d319bde9ab6b7edf0dcd0d4af187ce30af90836",
+      "intelligence.cjs": "f486be296eb2f0518f34b8f4453d9d0a988845e4aec6d18d8d47725aca6dd38b",
       "statusline.cjs": "d72417ecb38634011a19f095a30e07b9929e6f97663520172ece9be7491b2eaa",
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "3wmXMrroE4WEmOLGOLYSxXlcB2GITYHa8xpd3Jwu/xLCyFsf+saWI4Vq8EsvCzuwC8u3XpKX7aWrvQchQK3oAg==",
+  "signature": "ld9RNoF9lnGKjlUpofQLwCZgtE9Y5QiNNkYZLGsSQhZGp51JhBnHymH9YWpFC3F1HBslxRnea6U2TVczJKK5Bg==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/intelligence.cjs

@@ -108,9 +108,60 @@ function readJSON(filePath) {
   return null;
 }
 
+// Atomic (temp + rename): auto-memory-hook.mjs reads and writes the same store
+// from the session hooks, and a reader must never see a half-written file (#4058).
 function writeJSON(filePath, data) {
   ensureDataDir();
-  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf-8');
+  const tmp = filePath + '.' + process.pid + '.tmp';
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 2), 'utf-8');
+    fs.renameSync(tmp, filePath);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch { /* nothing to clean */ }
+    throw e;
+  }
+}
+
+// Short advisory directory lock shared with auto-memory-hook.mjs. It fails open
+// after ~2 s so a stuck lock can never hang a hook.
+function withStoreLock(filePath, fn) {
+  const lock = filePath + '.lock';
+  const deadline = Date.now() + 2000;
+  let held = false;
+  for (;;) {
+    try { fs.mkdirSync(lock); held = true; break; } catch (e) {
+      if (!e || e.code !== 'EEXIST') break;
+      try {
+        if (Date.now() - fs.statSync(lock).mtimeMs > 10000) { fs.rmSync(lock, { recursive: true, force: true }); continue; }
+      } catch { /* lock vanished: retry */ }
+      if (Date.now() > deadline) break;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+    }
+  }
+  try { return fn(); } finally { if (held) { try { fs.rmdirSync(lock); } catch { /* already gone */ } } }
+}
+
+// IDs present when the store was read. Take this BEFORE deduping: those passes
+// assign IDs to entries in place, and an entry that had none must still count as
+// ours (not as something another writer added).
+function storeIds(loaded) {
+  return new Set((Array.isArray(loaded) ? loaded : []).map((e) => e && e.id));
+}
+
+// Write the store, keeping entries another writer added after we read it.
+function writeStoreMerged(filePath, next, loadedIds) {
+  withStoreLock(filePath, () => {
+    let out = next;
+    try {
+      const current = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+      if (Array.isArray(current)) {
+        const have = new Set(next.map((e) => e && e.id));
+        const added = current.filter((e) => e && e.id != null && !loadedIds.has(e.id) && !have.has(e.id));
+        if (added.length) out = next.concat(added);
+      }
+    } catch { /* missing or unreadable: write ours */ }
+    writeJSON(filePath, out);
+  });
 }
 
 function tokenize(text) {
@@ -475,13 +526,14 @@ function init() {
   // Check if graph-state.json is fresh (within 60s of store)
   const graphState = readJSON(GRAPH_PATH);
   let store = readJSON(STORE_PATH);
+  const loadedIds = storeIds(store);
 
   // Bootstrap from MEMORY.md files if store is empty
   if (!store || !Array.isArray(store) || store.length === 0) {
     const bootstrapped = bootstrapFromMemoryFiles();
     if (bootstrapped.length > 0) {
       store = bootstrapped;
-      writeJSON(STORE_PATH, store);
+      writeStoreMerged(STORE_PATH, store, loadedIds);
     } else {
       return { nodes: 0, edges: 0, message: 'No memory entries to index' };
     }
@@ -503,7 +555,7 @@ function init() {
       `[INTELLIGENCE] Deduped store: ${store.length} -> ${deduped.length} entries ` +
       `(by-id: ${store.length - beforeContentDedup} dropped, by-content: ${beforeContentDedup - deduped.length} dropped)\n`
     );
-    writeJSON(STORE_PATH, deduped);
+    writeStoreMerged(STORE_PATH, deduped, loadedIds);
   }
 
   // Skip rebuild if graph is fresh and store hasn't changed. #2920: nodeCount
@@ -834,6 +886,7 @@ function consolidate() {
     return { entries: 0, edges: 0, newEntries: 0, message: 'No store to consolidate' };
   }
 
+  const loadedIds = storeIds(store);
   // Deduplicate store entries by ID before processing (fixes #1518)
   const preDedupCount = store.length;
   store = deduplicateById(store);
@@ -979,7 +1032,7 @@ function consolidate() {
   // RANKED_PATH are rewritten unconditionally just above; writing the
   // (already deduped, size-bounded per ADR-095 G6) store alongside them
   // costs nothing near the <500ms budget and removes the whole bug class.
-  writeJSON(STORE_PATH, store);
+  writeStoreMerged(STORE_PATH, store, loadedIds);
 
   // 9. Save snapshot for delta tracking
   const updatedGraph = readJSON(GRAPH_PATH);

package/README.md

@@ -49,6 +49,10 @@ npx -y ruflo@latest mcp start
 
 MCP exposes Ruflo tools to your client. The console and mods above are Claude Code integrations; hook support depends on the client.
 
+<img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Prefer a plain terminal? Optional.** The console also runs on its own, with no Claude Code: `npx ruflo tui` (add `--plain` to print one frame for scripts). It shows Overview, Cost, Swarm, Events and Missions, plus an optional AI page. [Terminal UI guide](docs/USERGUIDE.md#terminal-ui-optional)
+
+<p align="center"><img src="docs/assets/ruflo-tui-compact.svg" width="640" alt="Looping recording of the optional ruflo terminal UI cycling through Overview, Cost, Swarm, Events and Missions in a sample project"></p>
+
 [Compare install paths](#quick-start) · [Open the console](#console-walkthrough) · [User guide](docs/USERGUIDE.md)
 
 <div align="center">
@@ -116,9 +120,11 @@ User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM prov
 
 <p align="center"><img src="docs/assets/readme/console.svg" alt="Mission control: inspect agent work" width="100%"></p>
 
-<p align="center"><img src="docs/assets/ruflo-console-workflows.svg" width="952" height="964" alt="An animated recording of the ruflo console inside Claude Code: the boot (the neon sign and every area checked), then the Workflows page on a sample run: phases and agents with model, tokens and time; drilling from a run into one agent's activity, log and result; search; failure triage; cost; replay and compare; the control tab with a confirm card; and the mission autopilot panel"></p>
+<p align="center"><a href="https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg"><img src="docs/assets/ruflo-console-theme-compact.svg" width="100%" alt="Ruflo Orbital theme: animated boot checks, block logo, menu icons, rotating globe, swarm routing, six color palettes and responsive Theme Studio"></a></p>
+
+[Open animated demo](https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg) · [Theme Studio guide](plugins/ruflo-console/README.md) · [Workflow demo](docs/assets/ruflo-console-workflows.svg)
 
-<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Your agent cockpit.** Track workflows, agents, models, tokens and cost beside Claude Code. The animation shows startup checks and a **sample workflow**, not a live session.
+<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Your agent cockpit.** Track workflows, agents, models, tokens and cost beside Claude Code. The 38 second animation shows **Orbital and Theme Studio** through actual renderer frames, including boot checks, six palettes, customization, saved themes, JSON import and resizing. This compact 3.84 MB SVG retains all 456 frames. Native host and AI provider execution are not demonstrated.
 
 <img src="docs/assets/readme/console-icon-inspect.svg" width="28" height="28" alt=""> **Inspect any run.** Open agent logs and results, search, triage failures, replay and compare. Start with `npx ruflo init`, restart Claude Code, then `/ruflo`. [Full console tour](docs/assets/ruflo-console-walkthrough-wide.gif).
 
@@ -136,7 +142,7 @@ User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM prov
 4. **Verify the result.** Check that Missions contains the goal and Overview records the action. Creating a mission does not mean the feature has been implemented.
 5. **Keep control.** **Take back control** pauses Claude's console tools. A later call should be refused until you restore control.
 
-**What the recording demonstrates:** a real Claude Haiku session with `write + auto`, mission creation, page navigation, a refused swarm stop, and control being taken back. The steps above use `ask` so you approve creation yourself. The separate workflow animation uses sample data; neither is evidence of completed swarm work or memory recall.
+**What the recording demonstrates:** a real Claude Haiku session with `write + auto`, mission creation, page navigation, a refused swarm stop, and control being taken back. The steps above use `ask` so you approve creation yourself. The linked workflow animation uses sample data, while the theme demo replays renderer frames. Neither is evidence of completed swarm work or memory recall.
 
 [Implementation and recorded test findings](v3/docs/adr/ADR-444-claude-controls-the-console.md) · [Reproduction script](plugins/ruflo-console/scripts/e2e-control.sh)
 

package/bin/cli.js

@@ -257,7 +257,7 @@ if (isMCPMode) {
             serverInfo: { name: 'ruflo', version: VERSION },
             capabilities: {
               tools: { listChanged: true },
-              resources: { subscribe: true, listChanged: true },
+              resources: {},
             },
           },
         };
@@ -322,6 +322,16 @@ if (isMCPMode) {
         }
       }
 
+      // A declared capability must be served (ADR-490): no resources are exposed, so list answers are empty and a read is "not found".
+      case 'resources/list':
+        return { jsonrpc: '2.0', id: message.id, result: { resources: [] } };
+
+      case 'resources/templates/list':
+        return { jsonrpc: '2.0', id: message.id, result: { resourceTemplates: [] } };
+
+      case 'resources/read':
+        return { jsonrpc: '2.0', id: message.id, error: { code: -32002, message: 'Resource not found' } };
+
       case 'notifications/initialized':
         return null;
 

package/bin/mcp-server.js

@@ -146,7 +146,7 @@ async function handleMessage(message) {
             serverInfo: { name: 'ruflo', version: VERSION },
             capabilities: {
               tools: { listChanged: true },
-              resources: { subscribe: true, listChanged: true },
+              resources: {},
             },
           },
         };
@@ -208,6 +208,16 @@ async function handleMessage(message) {
         }
       }
 
+      // A declared capability must be served (ADR-490): no resources are exposed, so list answers are empty and a read is "not found".
+      case 'resources/list':
+        return { jsonrpc: '2.0', id: message.id, result: { resources: [] } };
+
+      case 'resources/templates/list':
+        return { jsonrpc: '2.0', id: message.id, result: { resourceTemplates: [] } };
+
+      case 'resources/read':
+        return { jsonrpc: '2.0', id: message.id, error: { code: -32002, message: 'Resource not found' } };
+
       case 'notifications/initialized':
         console.error(`[${new Date().toISOString()}] INFO [claude-flow-mcp] Client initialized`);
         return null; // No response for notifications

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-11T16:40:50.905Z",
-  "gitSha": "5905d40b",
+  "generatedAt": "2026-10-12T17:29:00.623Z",
+  "gitSha": "4f1b3e96",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/commands/coverage-reader.d.ts

@@ -0,0 +1,29 @@
+interface CoverageFileEntry {
+    filePath: string;
+    lines: number;
+    branches: number;
+    functions: number;
+    statements: number;
+}
+interface CoverageData {
+    found: boolean;
+    source: string;
+    entries: CoverageFileEntry[];
+    summary: {
+        totalFiles: number;
+        overallLineCoverage: number;
+        overallBranchCoverage: number;
+        overallFunctionCoverage: number;
+        overallStatementCoverage: number;
+    };
+}
+/**
+ * Read coverage data from disk. Checks these locations in order:
+ * 1. coverage/coverage-summary.json (Jest/Istanbul)
+ * 2. coverage/lcov.info (lcov format)
+ * 3. coverage/coverage-final.json (Istanbul counters)
+ * 4. .nyc_output/out.json (nyc counters or legacy summary)
+ */
+export declare function readCoverageFromDisk(): CoverageData;
+export {};
+//# sourceMappingURL=coverage-reader.d.ts.map