@claude-flow/cli 3.56.7 → 3.56.9

package/dist/src/init/helpers-generator.js

@@ -478,7 +478,8 @@ module.exports = commands;
 }
 // Literal-word root guard mirrored in the mod and both shipped classic helpers.
 const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, depth = 0) {
-  let word = '', quote = '', started = false, redirect = false
+  // mask has one letter per character of word: 'u' unquoted, 'q' quoted or escaped (only unquoted braces expand).
+  let word = '', mask = '', quote = '', started = false, redirect = false
   let ansiNul = false // a NUL inside $'...' ends that string, as in bash
   let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
   const isRoot = (operand) => {
@@ -508,23 +509,92 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     if (c === 'c' && at + 1 < s.length) return [String.fromCharCode(s.charCodeAt(at + 1) & 31), at + 1]
     return ['\\' + c, at]
   }
-  const finishWord = () => {
-    if (!started) return false
-    // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
-    // Bound rescanning to four levels; beyond that retain its conservative check.
-    if (/[\s;&|()\x60]/.test(word)) {
-      if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
+  // Past the rescan bound (or the brace budget), a string is judged by its tokens: an rm and a possible root operand
+  // anywhere in it deny. Quote characters are dropped first, so r"m" is still rm; a path token with braces may expand to /.
+  const looseRootDelete = (text) => {
+    const tokens = text.replace(/["'\\]/g, '').split(/[\s;&|()\x60$]+/)
+    return tokens.some(t => t === 'rm' || t.endsWith('/rm')) && tokens.some(t => isRoot(t) || (t.includes('/') && /[{}]/.test(t)))
+  }
+  // Bash brace expansion of one word ({a,b} lists, nested or glued to text), and nothing else: no {1..3} sequences, and
+  // nothing inside parameter braces after a dollar sign. Only unquoted braces and commas count. Iterative and bounded:
+  // past BRACE_WORDS words or BRACE_CHARS characters of work in this call it returns undefined.
+  const BRACE_WORDS = 4096
+  let braceChars = 1_000_000
+  // The leftmost expandable group: an unquoted {...} with an unquoted comma at its own level, outside any dollar-brace parameter. One pass.
+  const firstGroup = (text, marks) => {
+    const stack = []
+    let dollars = 0
+    let best
+    for (let k = 0; k < text.length; k++) {
+      if (marks[k] !== 'u') continue
+      const c = text[k]
+      if (c === '{') {
+        const dollar = k > 0 && text[k - 1] === '$' && marks[k - 1] === 'u'
+        if (dollar) dollars++
+        stack.push({ open: k, commas: [], dollar: dollar || dollars > 0 })
+      } else if (c === ',' && stack.length > 0) stack[stack.length - 1].commas.push(k)
+      else if (c === '}' && stack.length > 0) {
+        const top = stack.pop()
+        if (top.dollar && text[top.open - 1] === '$' && marks[top.open - 1] === 'u') dollars--
+        if (!top.dollar && top.commas.length > 0 && (best === undefined || top.open < best[0])) best = [top.open, top.commas, k]
+      }
+    }
+    return best
+  }
+  const braceExpand = (text, marks) => {
+    const out = []
+    const todo = [[text, marks]]
+    while (todo.length > 0) {
+      const [t, m] = todo.pop()
+      if ((braceChars -= t.length) < 0) return undefined
+      const group = firstGroup(t, m)
+      if (group === undefined) {
+        out.push(t)
+        if (out.length > BRACE_WORDS) return undefined
+        continue
+      }
+      const [open, commas, close] = group
+      const cuts = [open, ...commas, close]
+      // Pushed in reverse, so the words come out in bash's left-to-right order.
+      for (let c = cuts.length - 2; c >= 0; c--) {
+        const from = cuts[c] + 1, to = cuts[c + 1]
+        todo.push([t.slice(0, open) + t.slice(from, to) + t.slice(close + 1), m.slice(0, open) + m.slice(from, to) + m.slice(close + 1)])
+      }
+      if (todo.length > BRACE_WORDS) return undefined
     }
-    if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
-    else if (!optionsEnded && word === '--') optionsEnded = true
-    else if (!optionsEnded && word.startsWith('-')) {
+    return out
+  }
+  const takeWord = (w) => {
+    if (!inRm) inRm = w === 'rm' || w.endsWith('/rm')
+    else if (!optionsEnded && w === '--') optionsEnded = true
+    else if (!optionsEnded && w.startsWith('-')) {
       // GNU getopt accepts any unambiguous long-option prefix: --r, --recur, --forc.
-      recursive = recursive || (word.length > 2 && '--recursive'.startsWith(word)) || /^-[a-z]*r[a-z]*$/.test(word)
-      force = force || (word.length > 2 && '--force'.startsWith(word)) || /^-[a-z]*f[a-z]*$/.test(word)
-    } else root = root || isRoot(word)
-    word = ''; started = false
+      recursive = recursive || (w.length > 2 && '--recursive'.startsWith(w)) || (/^-[a-z]*$/.test(w) && w.includes('r'))
+      force = force || (w.length > 2 && '--force'.startsWith(w)) || (/^-[a-z]*$/.test(w) && w.includes('f'))
+    } else root = root || isRoot(w)
     return inRm && recursive && force && root
   }
+  const finishWord = () => {
+    if (!started) return false
+    const text = word, marks = mask
+    word = ''; mask = ''; started = false
+    // Literal shell strings (e.g. sh -c 'rm -rf /', or sh -c '{rm,-rf,/}') also carried the old guard.
+    // Bound rescanning to four levels; beyond that judge the string by its tokens.
+    if (/[\s;&|()\x60{]/.test(text)) {
+      if (depth < 4 ? hasRootDelete(text, depth + 1) : looseRootDelete(text)) return true
+    }
+    // An unquoted {a,b} becomes separate words, as bash expands it: rm -rf {/*,} is rm -rf /*.
+    const words = text.includes('{') ? braceExpand(text, marks) : [text]
+    if (words === undefined) {
+      // Too many alternatives to check: one of them may be the root (an rm in progress fails closed), or the
+      // list itself may spell the rm: judge its tokens.
+      if (inRm) root = true
+      if (looseRootDelete(text.replace(/[{},]/g, ' '))) return true
+      return takeWord(text)
+    }
+    for (const w of words) if (w !== '' && takeWord(w)) return true
+    return false
+  }
   // A command substitution's body, from just after its opening backtick. Bash removes a
   // backslash only before $, a backtick or a backslash (and " inside double quotes) and
   // drops backslash-newline; any other backslash stays for the nested scan.
@@ -538,7 +608,7 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
       }
       body += command[j]
     }
-    return [j, depth < 4 ? hasRootDelete(body, depth + 1) : body.includes('rm -rf /')]
+    return [j, depth < 4 ? hasRootDelete(body, depth + 1) : looseRootDelete(body)]
   }
   const finishCommand = () => {
     const denied = inRm && recursive && force && root
@@ -555,8 +625,8 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
         else if (char === '\\' && i + 1 < command.length) {
           const [text, last] = ansiEscape(command, i + 1)
           i = last
-          if (!ansiNul) { const nul = text.indexOf('\0'); if (nul < 0) word += text; else { word += text.slice(0, nul); ansiNul = true } }
-        } else if (!ansiNul) word += char
+          if (!ansiNul) { const nul = text.indexOf('\0'); const kept = nul < 0 ? text : text.slice(0, nul); word += kept; mask += 'q'.repeat(kept.length); if (nul >= 0) ansiNul = true }
+        } else if (!ansiNul) { word += char; mask += 'q' }
         continue
       }
       if (char === quote) quote = ''
@@ -566,20 +636,20 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
         // The substitution is gone from the word, as bash's empty output is (a quoted empty substitution glued to -rf leaves -rf).
         // A # right after it is still inside the word: a placeholder keeps a rescan (sh -c "...")
         // from reading it as the start of a comment.
-        if (command[end + 1] === '#') word += '\u0001'
+        if (command[end + 1] === '#') { word += '\u0001'; mask += 'q' }
         i = end
       }
       else if (quote === '"' && char === '\\' && i + 1 < command.length &&
         (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
           command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
         const next = command[++i]
-        if (next !== '\n') word += next
-      } else word += char
+        if (next !== '\n') { word += next; mask += 'q' }
+      } else { word += char; mask += 'q' }
       continue
     }
     if (char === '\\' && i + 1 < command.length) {
       const next = command[++i]
-      if (next !== '\n') { word += next; started = true }
+      if (next !== '\n') { word += next; mask += 'q'; started = true }
     } else if (char === '\x60' && command.indexOf('\x60', i + 1) > i) {
       // Command substitution: scan the body as its own command; the substitution
       // stays inside the enclosing word, so the rm being parsed keeps its state,
@@ -602,10 +672,26 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
       redirect = char === '<' || char === '>'
       if (!redirectionAmpersand && (char === '\n' || ';|&()'.includes(char)) && finishCommand()) return true
     } else {
-      word += char; started = true
+      word += char; mask += 'u'; started = true
     }
   }
   return finishWord() || finishCommand()
+}
+
+// A fork bomb's definition as bash reads it, whatever the spacing or the name: f(){ f|f& }, function f { f|f& },
+// function f(){ f|f& }. Defining one is the danger: the call may come anywhere later.
+function hasForkBomb(command) {
+  const s = command.replace(/\s+/g, '')
+  for (let brace = s.indexOf('{'); brace >= 0; brace = s.indexOf('{', brace + 1)) {
+    const end = s.startsWith('()', brace - 2) ? brace - 2 : brace
+    let start = end
+    while (start > 0 && end - start < 72 && /[a-z0-9_:.-]/.test(s[start - 1])) start--
+    const run = s.slice(start, end)
+    for (const name of run.startsWith('function') && run.length > 8 ? [run, run.slice(8)] : [run]) {
+      if (name && s.startsWith(name + '|' + name + '&}', brace + 1)) return true
+    }
+  }
+  return false
 }`;
 /**
  * Generate hook-handler.cjs (cross-platform hook dispatcher)
@@ -816,7 +902,7 @@ export function generateHookHandler() {
         "    var dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\\\', ':(){:|:&};:'];",
         ROOT_DELETE_CHECK_SOURCE.split('\n').map((line) => '    ' + line).join('\n'),
         '    for (var i = 0; i < dangerous.length; i++) {',
-        "      if (dangerous[i] === 'rm -rf /' ? hasRootDelete(cmd) : cmd.includes(dangerous[i])) {",
+        "      if (dangerous[i] === 'rm -rf /' ? hasRootDelete(cmd) : dangerous[i] === ':(){:|:&};:' ? hasForkBomb(cmd) : cmd.includes(dangerous[i])) {",
         "        console.error('[BLOCKED] Dangerous command detected: ' + dangerous[i]);",
         '        // Claude Code PreToolUse: exit 2 blocks execution; exit 1 is non-blocking.',
         '        process.exit(2);',

package/dist/src/parser.js

@@ -134,7 +134,6 @@ export class CommandParser {
         // command, because that's what caused `daemon start` to resolve as `start`
         // with `daemon` left as a positional.
         let resolvedCmd;
-        let resolvedSub;
         const resolvedCommands = [];
         let sawFirstPositional = false;
         for (let index = 0; index < args.length; index++) {
@@ -173,16 +172,16 @@ export class CommandParser {
                 const child = parent.subcommands.find(sc => sc.name === arg || sc.aliases?.includes(arg));
                 if (child) {
                     resolvedCommands.push(child);
-                    resolvedSub ??= child;
                     continue;
                 }
             }
             // A positional that is not the next subcommand ends the command path.
             break;
         }
-        const { aliases, booleanFlags, stringFlags } = this.getFlagScope(resolvedCommands);
+        const { aliases, booleanFlags, stringFlags, arrayFlags } = this.getFlagScope(resolvedCommands);
         let i = 0;
         let parsingFlags = true;
+        let commandSlotAvailable = true;
         while (i < args.length) {
             const arg = args[i];
             // Check for end of flags marker
@@ -194,8 +193,17 @@ export class CommandParser {
             // Handle flags
             if (parsingFlags && arg.startsWith('-')) {
                 const parseResult = this.parseFlag(args, i, aliases, booleanFlags, stringFlags);
+                // Array declarations retain text and accumulate repeated occurrences.
+                for (const key of arrayFlags) {
+                    const value = parseResult.flags[key];
+                    if (value !== undefined && value !== true && value !== false) {
+                        const previous = result.flags[key];
+                        parseResult.flags[key] = [...(Array.isArray(previous) ? previous : []), String(value)];
+                    }
+                }
                 // Apply to result flags
-                Object.assign(result.flags, parseResult.flags);
+                const { _: ignoredPositionals, ...parsedFlags } = parseResult.flags;
+                Object.assign(result.flags, parsedFlags);
                 i = parseResult.nextIndex;
                 continue;
             }
@@ -203,7 +211,9 @@ export class CommandParser {
             // Fix for #1596: treat lazy command names as commands here too so that
             // downstream dispatch sees `commandPath = ['daemon', 'start']` instead of
             // `commandPath = ['start'], positional = ['daemon']`.
-            if (result.command.length === 0 && this.isKnownCommandName(arg)) {
+            const isCommandSlot = commandSlotAvailable && parsingFlags;
+            commandSlotAvailable = false;
+            if (isCommandSlot && this.isKnownCommandName(arg)) {
                 // This is a command
                 result.command.push(arg);
                 // Check for subcommand (level 1) — only possible for sync commands
@@ -248,7 +258,7 @@ export class CommandParser {
         // `default: true` silently dropped and reached the action handler as
         // `undefined`. That trapped `memory store --upsert` and every other
         // subcommand that leaned on a per-flag default.
-        this.applyDefaults(result.flags, resolvedCmd, resolvedSub);
+        this.applyDefaults(result.flags, resolvedCommands);
         return result;
     }
     parseFlag(args, index, aliases, booleanFlags, stringFlags) {
@@ -472,11 +482,18 @@ export class CommandParser {
                     aliases[option.short] = option.name;
             }
         }
+        const arrayFlags = new Set((this.options.arrayFlags ?? []).map(flag => this.normalizeKey(flag)));
+        for (const flag of arrayFlags)
+            stringFlags.add(flag);
         const layers = [this.globalOptions, ...commands.map(command => command.options ?? [])];
         for (const options of layers) {
             for (const option of options) {
                 const key = this.normalizeKey(option.name);
-                if (option.type === 'string')
+                if (option.type === 'array')
+                    arrayFlags.add(key);
+                else if (option.type)
+                    arrayFlags.delete(key);
+                if (option.type === 'string' || option.type === 'array')
                     stringFlags.add(key);
                 else if (option.type)
                     stringFlags.delete(key);
@@ -488,7 +505,7 @@ export class CommandParser {
         }
         for (const flag of stringFlags)
             booleanFlags.delete(flag);
-        return { aliases, booleanFlags, stringFlags };
+        return { aliases, booleanFlags, stringFlags, arrayFlags };
     }
     getBooleanFlags() {
         const flags = new Set();
@@ -526,23 +543,16 @@ export class CommandParser {
         }
         return flags;
     }
-    applyDefaults(flags, command, subcommand) {
-        // #2775: apply defaults from globals AND the resolved command/subcommand.
-        // Subcommand > command > global (later writes lose to earlier — because
-        // we only set when `undefined`, so the FIRST option definition that
-        // supplies a default wins; walk narrow-to-broad so subcommand options
-        // apply before broader ones do).
-        const layers = [];
-        if (subcommand?.options)
-            layers.push(subcommand.options);
-        if (command?.options)
-            layers.push(command.options);
+    applyDefaults(flags, commands) {
+        // Walk every resolved command from narrow to broad so nested defaults
+        // have the same precedence as their declared flag types.
+        const layers = [...commands].reverse().map(command => command.options ?? []);
         layers.push(this.globalOptions);
         for (const layer of layers) {
             for (const opt of layer) {
                 const key = this.normalizeKey(opt.name);
                 if (flags[key] === undefined && opt.default !== undefined) {
-                    flags[key] = opt.default;
+                    flags[key] = (Array.isArray(opt.default) ? [...opt.default] : opt.default);
                 }
             }
         }
@@ -551,7 +561,7 @@ export class CommandParser {
             for (const [key, value] of Object.entries(this.options.defaults)) {
                 const normalizedKey = this.normalizeKey(key);
                 if (flags[normalizedKey] === undefined) {
-                    flags[normalizedKey] = value;
+                    flags[normalizedKey] = (Array.isArray(value) ? [...value] : value);
                 }
             }
         }
@@ -572,7 +582,7 @@ export class CommandParser {
             // followed by another flag) is parsed as boolean `true`. Commands then treat `true` as
             // the value: `hooks route --task` crashed with "task.trim is not a function" and
             // `memory retrieve --key` looked up the key "true". Report it instead.
-            if ((opt.type === 'string' || opt.type === 'number') && flags[key] === true) {
+            if ((opt.type === 'string' || opt.type === 'number' || opt.type === 'array') && flags[key] === true) {
                 errors.push(`Option --${opt.name} needs a value`);
             }
             // Check choices

package/dist/src/production/monitoring.d.ts

@@ -71,6 +71,7 @@ export declare class MonitoringHooks {
     private healthStatus;
     private startTime;
     private activeRequests;
+    private requestGeneration;
     private requestCount;
     private errorCount;
     private healthChecks;

package/dist/src/production/monitoring.js

@@ -37,6 +37,7 @@ export class MonitoringHooks {
     healthStatus;
     startTime = Date.now();
     activeRequests = 0;
+    requestGeneration = 0;
     requestCount = 0;
     errorCount = 0;
     healthChecks = new Map();
@@ -101,9 +102,14 @@ export class MonitoringHooks {
         this.activeRequests++;
         this.requestCount++;
         const startTime = Date.now();
+        const generation = this.requestGeneration;
+        let completed = false;
         this.counter('request_started', 1, { requestId });
         // Return end function
         return () => {
+            if (completed || generation !== this.requestGeneration)
+                return;
+            completed = true;
             this.activeRequests--;
             const duration = Date.now() - startTime;
             this.responseTimes.push(duration);
@@ -156,7 +162,7 @@ export class MonitoringHooks {
             catch (error) {
                 checks[name] = {
                     status: 'unhealthy',
-                    message: error.message,
+                    message: error instanceof Error ? error.message : String(error),
                     lastCheck: Date.now(),
                     responseTimeMs: Date.now() - startTime,
                 };
@@ -168,13 +174,13 @@ export class MonitoringHooks {
             checks,
             timestamp: Date.now(),
         };
-        return this.healthStatus;
+        return structuredClone(this.healthStatus);
     }
     /**
      * Get current health status
      */
     getHealthStatus() {
-        return this.healthStatus;
+        return structuredClone(this.healthStatus);
     }
     // ============================================================================
     // Performance Metrics
@@ -217,7 +223,7 @@ export class MonitoringHooks {
         if (level) {
             filtered = filtered.filter(a => a.level === level);
         }
-        return filtered;
+        return filtered.map(alert => ({ ...alert }));
     }
     /**
      * Acknowledge an alert
@@ -248,7 +254,7 @@ export class MonitoringHooks {
         if (since) {
             filtered = filtered.filter(m => m.timestamp >= since);
         }
-        return filtered;
+        return filtered.map(metric => ({ ...metric, labels: { ...metric.labels } }));
     }
     /**
      * Get all metrics summary
@@ -278,6 +284,7 @@ export class MonitoringHooks {
      * Reset all metrics
      */
     reset() {
+        this.requestGeneration++;
         this.metrics = [];
         this.responseTimes = [];
         this.alerts = [];
@@ -308,7 +315,13 @@ export class MonitoringHooks {
             const recentAlert = this.alerts.find(a => a.metric === name &&
                 !a.acknowledged &&
                 Date.now() - a.timestamp < 60000);
-            if (!recentAlert) {
+            if (recentAlert && level === 'critical' && recentAlert.level !== 'critical') {
+                Object.assign(recentAlert, {
+                    level, value, threshold, timestamp: Date.now(),
+                    message: `${name} exceeded ${level} threshold: ${value} >= ${threshold}`,
+                });
+            }
+            else if (!recentAlert) {
                 this.alerts.push({
                     id: `alert_${Date.now()}_${Math.random().toString(36).substring(7)}`,
                     level,

package/dist/src/production/rate-limiter.js

@@ -90,6 +90,7 @@ export class RateLimiter {
      */
     getStatus(operation, userId) {
         const limits = this.getLimits(operation);
+        const capacity = Math.floor(limits.maxRequests * this.config.burstMultiplier);
         const bucketKey = userId && this.config.perUserLimits
             ? `${operation}:${userId}`
             : `global:${operation}`;
@@ -98,8 +99,8 @@ export class RateLimiter {
         if (!bucket) {
             return {
                 current: 0,
-                limit: limits.maxRequests,
-                remaining: limits.maxRequests,
+                limit: capacity,
+                remaining: capacity,
                 resetAt: now + limits.windowMs,
             };
         }
@@ -107,8 +108,8 @@ export class RateLimiter {
         const validRequests = bucket.requests.filter(t => t > now - limits.windowMs);
         return {
             current: validRequests.length,
-            limit: limits.maxRequests,
-            remaining: Math.max(0, limits.maxRequests - validRequests.length),
+            limit: capacity,
+            remaining: Math.max(0, capacity - validRequests.length),
             resetAt: validRequests.length > 0
                 ? validRequests[0] + limits.windowMs
                 : now + limits.windowMs,

package/dist/src/production/retry.js

@@ -74,6 +74,9 @@ function fibonacci(n) {
  * Check if an error should be retried
  */
 function shouldRetryError(error, attempt, config) {
+    // Exhaustion always takes precedence over custom retry policies.
+    if (attempt >= config.maxAttempts)
+        return false;
     // Check custom retry function
     if (config.shouldRetry) {
         return config.shouldRetry(error, attempt);

package/dist/src/services/config-file-manager.js

@@ -123,16 +123,16 @@ export class ConfigFileManager {
         this.selectProject(cwd);
         // A targeted update must not persist unrelated defaults (notably the
         // default memory path, which would relocate an existing memory store).
-        const config = this.config ?? this.load(cwd) ?? {};
+        const config = structuredClone(this.config ?? this.load(cwd) ?? {});
         if (Object.hasOwn(config, key)) {
             config[key] = value;
         }
         else {
             setNestedValue(config, key, value);
         }
-        this.config = config;
         const targetPath = this.configPath ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
         this.writeAtomic(targetPath, config);
+        this.config = config;
         this.configPath = targetPath;
     }
     /** Create a new config file with defaults */
@@ -271,7 +271,7 @@ export function parseConfigValue(value) {
         return parseFloat(value);
     try {
         const parsed = JSON.parse(value);
-        if (typeof parsed === 'object')
+        if (typeof parsed === 'object' || (typeof parsed === 'number' && Number.isFinite(parsed)))
             return parsed;
     }
     catch { /* not JSON, use as string */ }

package/dist/src/services/policy-ledger-anchor.js

@@ -14,10 +14,28 @@
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
-import { homedir } from 'node:os';
+import { homedir, userInfo } from 'node:os';
 const LOG_FILE = 'ledger-anchors.json';
 const MIRROR_FILE = 'ledger-anchor-head.json';
 export const anchorLogPath = (projectRoot) => join(resolve(projectRoot), '.claude-flow', 'policy', LOG_FILE);
+/**
+ * The home directory trust material lives under: $HOME when it is an absolute path, else the account's home. An empty or relative
+ * $HOME (an unset variable in a wrapper script, `HOME=. cmd`) would make join() yield a path relative to the working directory and
+ * drop the HMAC key and anchor mirror into the project; that is never wanted, so it falls back to the account home or refuses.
+ */
+function trustHome() {
+    const home = homedir();
+    if (home && isAbsolute(home))
+        return home;
+    let account = '';
+    try {
+        account = userInfo().homedir;
+    }
+    catch { /* no account entry for this uid */ }
+    if (account && isAbsolute(account))
+        return account;
+    throw new Error('policy-trust-home-unresolved: $HOME is empty or relative and this account has no home directory; set HOME to an absolute path');
+}
 /**
  * Directory holding per-project trust material (anchor mirror, HMAC key).
  * Resolved from the environment at call time (#3919): $XDG_CONFIG_HOME when it
@@ -26,7 +44,7 @@ export const anchorLogPath = (projectRoot) => join(resolve(projectRoot), '.claud
  * user who already has trust state under the legacy ~/.config keeps using it.
  */
 export function policyTrustRoot() {
-    const legacy = join(homedir(), '.config', 'ruflo', 'policy-trust');
+    const legacy = join(trustHome(), '.config', 'ruflo', 'policy-trust');
     const xdg = process.env.XDG_CONFIG_HOME;
     if (!xdg || !isAbsolute(xdg))
         return legacy;

package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.d.ts

@@ -7,6 +7,7 @@ export interface WorkerCapabilityEnvelope {
     actions?: string[];
     resources?: string[];
     tools?: string[];
+    /** Opt-in per-tool ceiling: requires a trusted concurrency meter at dispatch. */
     maxConcurrency?: number;
     network?: boolean;
     destructive?: boolean;

package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/dual-mode/orchestrator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAYtC,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iBAAiB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,YAAY;IACpD,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,OAAO,CAAwC;IACvD,OAAO,CAAC,SAAS,CAAwC;IACzD;;0DAEsD;IACtD,OAAO,CAAC,iBAAiB,CAAC,CAAoB;gBAElC,MAAM,EAAE,cAAc;IA+BlC;;OAEG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BhE;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IA6CtD;;OAEG;YACW,eAAe;IAmF7B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAmBhC;;OAEG;YACW,mBAAmB;IAoBjC;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiElG;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA2D7B,2EAA2E;IAC3E,OAAO,CAAC,cAAc;IAsBtB;;OAEG;YACW,mBAAmB;IAejC;;OAEG;IACH,OAAO,CAAC,UAAU;YAyBJ,eAAe;IA4B7B,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,qBAAqB;IA4B7B,OAAO,CAAC,iBAAiB;IAuDzB,sEAAsE;IACtE,OAAO,CAAC,iBAAiB;IAOzB;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,QAAQ,GAAG,MAAM,CAAC;CACtC;AAED,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,2BAA2B,CAiC1F;AAED;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC;;OAEG;kCAC2B,MAAM,KAAG,YAAY,EAAE;IAoCrD;;OAEG;4BACqB,MAAM,KAAG,YAAY,EAAE;IA4B/C;;OAEG;0BACmB,MAAM,KAAG,YAAY,EAAE;CAoC9C,CAAC"}
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../../src/dual-mode/orchestrator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAYtC,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iBAAiB,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,YAAY;IACpD,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,OAAO,CAAwC;IACvD,OAAO,CAAC,SAAS,CAAwC;IACzD;;0DAEsD;IACtD,OAAO,CAAC,iBAAiB,CAAC,CAAoB;gBAElC,MAAM,EAAE,cAAc;IA+BlC;;OAEG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BhE;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IA6CtD;;OAEG;YACW,eAAe;IAmF7B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAmBhC;;OAEG;YACW,mBAAmB;IAoBjC;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiElG;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA2D7B,2EAA2E;IAC3E,OAAO,CAAC,cAAc;IAsBtB;;OAEG;YACW,mBAAmB;IAejC;;OAEG;IACH,OAAO,CAAC,UAAU;YAyBJ,eAAe;IA4B7B,OAAO,CAAC,qBAAqB;IAe7B,OAAO,CAAC,qBAAqB;IA4B7B,OAAO,CAAC,iBAAiB;IAuDzB,sEAAsE;IACtE,OAAO,CAAC,iBAAiB;IAOzB;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,QAAQ,GAAG,MAAM,CAAC;CACtC;AAED,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,2BAA2B,CAiC1F;AAED;;GAEG;AACH,eAAO,MAAM,sBAAsB;IACjC;;OAEG;kCAC2B,MAAM,KAAG,YAAY,EAAE;IAoCrD;;OAEG;4BACqB,MAAM,KAAG,YAAY,EAAE;IA4B/C;;OAEG;0BACmB,MAAM,KAAG,YAAY,EAAE;CAoC9C,CAAC"}

package/node_modules/@claude-flow/codex/dist/dual-mode/orchestrator.js

@@ -434,7 +434,9 @@ Remember: Other agents depend on your results in shared memory. Be concise and s
             actions: ['*'],
             resources: ['*'],
             tools: ['*'],
-            maxConcurrency: 1,
+            // MCP dispatch does not yet supply a worker-wide concurrency meter.
+            // Leave this dimension unconstrained unless the caller opts in; the
+            // scheduler still bounds worker processes with config.maxConcurrent.
             network: false,
             destructive: false,
             delegationDepth: 0,