@claude-flow/cli 3.56.8 → 3.56.10

package/dist/src/commands/analyze.js

@@ -97,11 +97,19 @@ const diffCommand = {
         output.printInfo(`Analyzing diff: ${output.highlight(ref)}`);
         try {
             // Call MCP tool for diff analysis
+            // Shape returned by the analyze_diff MCP tool (ruvector/diff-classifier.ts).
+            // Typed from the classifier itself so the renderer cannot drift from it again.
             const result = await callMCPTool('analyze_diff', {
                 ref,
-                includeFileRisks: verbose,
+                // Always request file risks: the handler computes them anyway, and the
+                // high-risk file list below is derived from them.
+                includeFileRisks: true,
                 includeReviewers: showReviewers || showAll,
             });
+            if (result.error) {
+                output.printError(`Diff analysis failed: ${result.message ?? 'unknown error'}`);
+                return { success: false, exitCode: 1 };
+            }
             // JSON output
             if (formatType === 'json') {
                 output.printJson(result);
@@ -110,13 +118,18 @@ const diffCommand = {
             output.writeln();
             // Summary box
             const files = result.files || [];
-            const risk = result.risk || { overall: 'unknown', score: 0, breakdown: { fileCount: 0, totalChanges: 0, highRiskFiles: [], securityConcerns: [], breakingChanges: [], testCoverage: 'unknown' } };
-            const classification = result.classification || { category: 'unknown', confidence: 0, reasoning: '' };
+            const fileRisks = result.fileRisks || [];
+            const risk = result.risk || { overall: 'low', score: 0, breakdown: { low: 0, medium: 0, high: 0, critical: 0 } };
+            const classification = result.classification;
+            const category = classification?.primary ?? 'unknown';
+            const secondary = classification?.secondary?.length ? classification.secondary.join(', ') : '';
+            const totalChanges = files.reduce((sum, f) => sum + f.additions + f.deletions, 0);
+            const highRiskFiles = fileRisks.filter((r) => r.risk === 'high' || r.risk === 'critical').map((r) => r.file);
             output.printBox([
                 `Ref: ${result.ref || 'HEAD'}`,
                 `Files: ${files.length}`,
                 `Risk: ${getRiskDisplay(risk.overall)} (${risk.score}/100)`,
-                `Type: ${classification.category}${classification.subcategory ? ` (${classification.subcategory})` : ''}`,
+                `Type: ${category}${secondary ? ` (${secondary})` : ''}`,
                 ``,
                 result.summary || 'No summary available',
             ].join('\n'), 'Diff Analysis');
@@ -128,33 +141,28 @@ const diffCommand = {
                 output.printTable({
                     columns: [
                         { key: 'metric', header: 'Metric', width: 25 },
-                        { key: 'value', header: 'Value', width: 30 },
+                        { key: 'value', header: 'Value', width: 42 },
                     ],
                     data: [
                         { metric: 'Overall Risk', value: getRiskDisplay(risk.overall) },
                         { metric: 'Risk Score', value: `${risk.score}/100` },
-                        { metric: 'Files Changed', value: risk.breakdown.fileCount },
-                        { metric: 'Total Lines Changed', value: risk.breakdown.totalChanges },
-                        { metric: 'Test Coverage', value: risk.breakdown.testCoverage },
+                        { metric: 'Files Changed', value: files.length },
+                        { metric: 'Total Lines Changed', value: totalChanges },
+                        { metric: 'Files by Risk', value: `low ${risk.breakdown.low} / medium ${risk.breakdown.medium} / high ${risk.breakdown.high} / critical ${risk.breakdown.critical}` },
                     ],
                 });
-                // Security concerns
-                if (risk.breakdown.securityConcerns.length > 0) {
-                    output.writeln();
-                    output.writeln(output.bold(output.warning('Security Concerns')));
-                    output.printList(risk.breakdown.securityConcerns.map(c => output.warning(c)));
-                }
-                // Breaking changes
-                if (risk.breakdown.breakingChanges.length > 0) {
+                // Risk factors reported by the classifier
+                const riskFactors = classification?.riskFactors ?? [];
+                if (riskFactors.length > 0) {
                     output.writeln();
-                    output.writeln(output.bold(output.error('Potential Breaking Changes')));
-                    output.printList(risk.breakdown.breakingChanges.map(c => output.error(c)));
+                    output.writeln(output.bold(output.warning('Risk Factors')));
+                    output.printList(riskFactors.map(c => output.warning(c)));
                 }
                 // High risk files
-                if (risk.breakdown.highRiskFiles.length > 0) {
+                if (highRiskFiles.length > 0) {
                     output.writeln();
                     output.writeln(output.bold('High Risk Files'));
-                    output.printList(risk.breakdown.highRiskFiles.map(f => output.warning(f)));
+                    output.printList(highRiskFiles.map(f => output.warning(f)));
                 }
             }
             // Classification
@@ -168,13 +176,16 @@ const diffCommand = {
                         { key: 'value', header: 'Value', width: 40 },
                     ],
                     data: [
-                        { field: 'Category', value: classification.category },
-                        { field: 'Subcategory', value: classification.subcategory || '-' },
-                        { field: 'Confidence', value: `${(classification.confidence * 100).toFixed(0)}%` },
+                        { field: 'Category', value: category },
+                        { field: 'Secondary', value: secondary || '-' },
+                        { field: 'Confidence', value: `${((classification?.confidence ?? 0) * 100).toFixed(0)}%` },
+                        { field: 'Impact', value: classification?.impactLevel ?? '-' },
                     ],
                 });
-                output.writeln();
-                output.writeln(output.dim(`Reasoning: ${classification.reasoning}`));
+                if (classification?.testingStrategy?.length) {
+                    output.writeln();
+                    output.writeln(output.dim(`Testing strategy: ${classification.testingStrategy.join(', ')}`));
+                }
             }
             // Reviewers
             if (showReviewers || showAll) {
@@ -190,13 +201,13 @@ const diffCommand = {
                 }
             }
             // Verbose file-level details
-            if (verbose && result.fileRisks) {
+            if (verbose && fileRisks.length > 0) {
                 output.writeln();
                 output.writeln(output.bold('File-Level Analysis'));
                 output.writeln(output.dim('-'.repeat(50)));
                 output.printTable({
                     columns: [
-                        { key: 'path', header: 'File', width: 40 },
+                        { key: 'file', header: 'File', width: 40 },
                         { key: 'risk', header: 'Risk', width: 12, format: (v) => getRiskDisplay(String(v)) },
                         { key: 'score', header: 'Score', width: 8, align: 'right' },
                         { key: 'reasons', header: 'Reasons', width: 30, format: (v) => {
@@ -204,7 +215,7 @@ const diffCommand = {
                                 return reasons.slice(0, 2).join('; ');
                             } },
                     ],
-                    data: result.fileRisks,
+                    data: fileRisks.map((r) => ({ ...r })),
                 });
             }
             // Files changed table
@@ -219,7 +230,7 @@ const diffCommand = {
                         { key: 'additions', header: '+', width: 8, align: 'right', format: (v) => output.success(`+${v}`) },
                         { key: 'deletions', header: '-', width: 8, align: 'right', format: (v) => output.error(`-${v}`) },
                     ],
-                    data: files.slice(0, 20),
+                    data: files.slice(0, 20).map((f) => ({ ...f })),
                 });
                 if (files.length > 20) {
                     output.writeln(output.dim(`  ... and ${files.length - 20} more files`));

package/dist/src/commands/claims.js

@@ -5,7 +5,8 @@
  * Created with ❤️ by ruv.io
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { resolve, dirname, join } from 'node:path';
+import { homedir } from 'node:os';
 import { output } from '../output.js';
 const CLAIMS_CONFIG_PATHS = [
     '.claude-flow/claims.json',
@@ -15,7 +16,9 @@ function getClaimsConfigPaths() {
     return [
         resolve(CLAIMS_CONFIG_PATHS[0]),
         resolve(CLAIMS_CONFIG_PATHS[1]),
-        resolve(process.env.HOME || '~', '.config/claude-flow/claims.json'),
+        // os.homedir(), not $HOME: HOME is normally unset on Windows, and the old
+        // `process.env.HOME || '~'` fallback resolved to a literal <cwd>/~ folder.
+        join(homedir(), '.config', 'claude-flow', 'claims.json'),
     ];
 }
 function loadClaimsConfig() {
@@ -152,18 +155,13 @@ const checkCommand = {
         const spinner = output.createSpinner({ text: 'Evaluating claim...', spinner: 'dots' });
         spinner.start();
         const fs = await import('fs');
-        const path = await import('path');
         // Real claims evaluation from config file
         let isGranted = false;
         let reason = 'Claim not found in policy';
         let policySource = 'default';
         try {
             // Check for claims config file
-            const claimsConfigPaths = [
-                path.resolve('.claude-flow/claims.json'),
-                path.resolve('claude-flow.claims.json'),
-                path.resolve(process.env.HOME || '~', '.config/claude-flow/claims.json'),
-            ];
+            const claimsConfigPaths = getClaimsConfigPaths();
             let claimsConfig = {
                 // Default policy - allows basic operations
                 roles: {

package/dist/src/commands/daemon.js

@@ -164,37 +164,44 @@ const startCommand = {
                 fs.mkdirSync(stateDir, { recursive: true });
             }
             catch { /* exists */ }
-            try {
-                lockFd = fs.openSync(lockFile, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
-                fs.writeSync(lockFd, String(process.pid));
-            }
-            catch (e) {
-                if (e.code === 'EEXIST') {
-                    // Another `daemon start` is mid-spawn. Wait up to 5s for it to
-                    // finish, then re-check the PID file. If the holder crashed
-                    // mid-spawn, fall through and reset; killStaleDaemons + a fresh
-                    // attempt will recover.
-                    const deadline = Date.now() + 5000;
-                    while (Date.now() < deadline) {
-                        await new Promise((r) => setTimeout(r, 100));
-                        const winnerPid = getBackgroundDaemonPid(projectRoot);
-                        if (winnerPid && isProcessRunning(winnerPid)) {
-                            if (!quiet) {
-                                output.printWarning(`Daemon already running in background (PID: ${winnerPid}). Stop it first with: daemon stop`);
-                            }
-                            return { success: true };
+            lockFd = tryAcquireDaemonLock(lockFile);
+            if (lockFd === null) {
+                // Another `daemon start` is mid-spawn. Wait for it while its holder
+                // is alive; only a lock whose holder is DEAD is stale and may be
+                // retaken — atomically, via O_EXCL again, never by proceeding
+                // lockless. The old fixed 5s timeout + unlink let every waiter
+                // through on Windows, where the holder's killStaleDaemons
+                // (`tasklist /v`) routinely takes longer than that, and each waiter
+                // then forked its own daemon (3 per workspace observed).
+                const waitMs = Number(process.env.RUFLO_DAEMON_LOCK_WAIT_MS) > 0
+                    ? Number(process.env.RUFLO_DAEMON_LOCK_WAIT_MS)
+                    : 60_000;
+                const deadline = Date.now() + waitMs;
+                while (lockFd === null) {
+                    const winnerPid = getBackgroundDaemonPid(projectRoot);
+                    if (winnerPid && isProcessRunning(winnerPid)) {
+                        if (!quiet) {
+                            output.printWarning(`Daemon already running in background (PID: ${winnerPid}). Stop it first with: daemon stop`);
                         }
+                        return { success: true };
                     }
-                    // Stale lockfile from a crashed prior attempt — clear it and
-                    // proceed without a held lock. Worst case we double-spawn ONCE
-                    // and the killStaleDaemons sweep below cleans up.
-                    try {
-                        fs.unlinkSync(lockFile);
+                    if (daemonLockIsStale(lockFile)) {
+                        try {
+                            fs.unlinkSync(lockFile);
+                        }
+                        catch { /* raced with another taker */ }
+                        lockFd = tryAcquireDaemonLock(lockFile);
+                        continue;
                     }
-                    catch { /* ignore */ }
-                }
-                else {
-                    throw e;
+                    if (Date.now() >= deadline) {
+                        // A live process is still starting the daemon. Spawning another
+                        // would be the duplicate this lock exists to prevent.
+                        if (!quiet) {
+                            output.printWarning('Another `daemon start` is still in progress for this workspace; not starting a second daemon.');
+                        }
+                        return { success: true };
+                    }
+                    await new Promise((r) => setTimeout(r, 100));
                 }
             }
             // Dedup check while holding the lock.
@@ -298,15 +305,22 @@ const startCommand = {
             // NOTE: Do NOT write PID file here — startDaemon() writes it internally.
             // Writing it before startDaemon() causes checkExistingDaemon() to detect
             // our own PID and return early, leaving no workers scheduled (#1478 Bug 1).
-            // Clean up PID file on exit
+            // Clean up PID file on exit — only if it is OURS. A process that lost
+            // the singleton race must never delete the winner's PID file, or the
+            // next auto-start sees "no daemon" and forks yet another one.
             const cleanup = () => {
                 try {
-                    if (fs.existsSync(pidFile)) {
+                    if (fs.existsSync(pidFile) && fs.readFileSync(pidFile, 'utf-8').trim() === String(process.pid)) {
                         fs.unlinkSync(pidFile);
                     }
                 }
                 catch { /* ignore */ }
             };
+            // WorkerDaemon.start() declines (returns without running) when another
+            // live daemon already owns daemon.pid. Such a process must exit rather
+            // than park on the keep-alive below: it has no workers and no TTL, so
+            // it would linger as an idle duplicate forever.
+            const declined = (d) => !d.getStatus().running;
             process.on('exit', cleanup);
             process.on('SIGINT', () => { cleanup(); process.exit(0); });
             process.on('SIGTERM', () => { cleanup(); process.exit(0); });
@@ -319,6 +333,11 @@ const startCommand = {
                 spinner.start();
                 const daemon = await startDaemon(projectRoot, config);
                 const status = daemon.getStatus();
+                if (declined(daemon)) {
+                    spinner.stop();
+                    output.printWarning(`Daemon already running (PID: ${getBackgroundDaemonPid(projectRoot) ?? 'unknown'}); not starting a second one.`);
+                    return { success: true };
+                }
                 spinner.succeed('Worker daemon started (foreground mode)');
                 output.writeln();
                 output.printBox([
@@ -371,7 +390,9 @@ const startCommand = {
                 await new Promise(() => { }); // Never resolves - daemon runs until killed
             }
             else {
-                await startDaemon(projectRoot, config);
+                const daemon = await startDaemon(projectRoot, config);
+                if (declined(daemon))
+                    return { success: true };
                 setInterval(() => { }, 60_000); // Keep alive with ref'd handle (#1478)
                 await new Promise(() => { }); // Keep alive
             }
@@ -910,6 +931,40 @@ function getBackgroundDaemonPid(projectRoot) {
         return null;
     }
 }
+/**
+ * Atomically create the launcher lock and stamp it with our PID.
+ * Returns the fd, or null when another process holds the lock.
+ */
+function tryAcquireDaemonLock(lockFile) {
+    try {
+        const fd = fs.openSync(lockFile, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
+        fs.writeSync(fd, String(process.pid));
+        return fd;
+    }
+    catch (e) {
+        if (e.code === 'EEXIST')
+            return null;
+        throw e;
+    }
+}
+/**
+ * A lock is stale only when its holder is gone. An empty lock is the brief
+ * window between O_EXCL create and the PID write, so it counts as held
+ * unless it has been empty for a while (holder crashed in that window).
+ */
+function daemonLockIsStale(lockFile) {
+    try {
+        const raw = fs.readFileSync(lockFile, 'utf-8').trim();
+        const pid = parseInt(raw, 10);
+        if (!raw || Number.isNaN(pid)) {
+            return Date.now() - fs.statSync(lockFile).mtimeMs > 10_000;
+        }
+        return pid !== process.pid && !isProcessRunning(pid);
+    }
+    catch {
+        return false; // vanished: the next O_EXCL attempt decides
+    }
+}
 /**
  * Check if a process is running
  */

package/dist/src/commands/memory.js

@@ -3,6 +3,7 @@
  * Memory operations for AgentDB integration
  */
 import { validateAppendConditions } from '../memory/append-conditions.js';
+import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.js';
 import { output } from '../output.js';
 import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
@@ -430,7 +431,7 @@ const searchCommand = {
             // default to 0.7, which silently re-broke #2558: `memory search` matched
             // content word-for-word and still returned nothing. Regression guard:
             // __tests__/memory-search-recall-2558.test.ts.
-            default: 0.3
+            default: 0.2
         },
         {
             name: 'type',
@@ -499,7 +500,9 @@ const searchCommand = {
         // coalescing preserves an explicit zero. Fallback aligned with the
         // option's declared `default: 0.7` (was `0.3` — the two disagreed
         // and --help advertised a default the code did not honor).
-        const threshold = ctx.flags.threshold ?? 0.3;
+        const threshold = ctx.flags.threshold ?? DEFAULT_SEARCH_THRESHOLD;
+        // The parser fills the option's declared default, so an untouched flag arrives as the default value.
+        const thresholdWasDefault = ctx.flags.threshold === undefined || ctx.flags.threshold === DEFAULT_SEARCH_THRESHOLD;
         const searchType = ctx.flags.type || 'semantic';
         const buildHnsw = (ctx.flags['build-hnsw'] || ctx.flags.buildHnsw);
         const requestedIntent = ctx.flags.intent || 'mixed';
@@ -738,6 +741,15 @@ const searchCommand = {
             output.writeln();
             if (results.length === 0) {
                 output.printWarning('No results found');
+                if (thresholdWasDefault) {
+                    const near = await nearMisses(searchEntries, { query, namespace, provenanceFilter, dbPath: dbPathSearch });
+                    if (near) {
+                        output.writeln(output.dim(`  ${near.hint.replace(' in nearMisses', ' below').replace('Pass threshold: 0', 'Pass --threshold 0')}`));
+                        for (const n of near.nearMisses) {
+                            output.writeln(output.dim(`    ${n.similarity.toFixed(2)}  ${n.namespace}/${n.key}`));
+                        }
+                    }
+                }
                 await warnIfSiblingHasRows(ctx.flags.path);
                 output.writeln(output.dim('Try: claude-flow memory store -k "key" --value "data"'));
                 return { success: true, data: [] };

package/dist/src/commands/security-code-patterns.d.ts

@@ -6,8 +6,8 @@
  *  - every rule is tested after comment text is blanked, so a comment naming `child_process.execFile` or `eval(` is
  *    not a finding;
  *  - eval needs a word start: "retrieval (" in prose is not a call; `eval(` and `window.eval(` still are;
- *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and no longer skips
- *    execSync as `exec[^S]` did;
+ *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and also catches
+ *    dynamic exec/execSync command strings when the import was on another line;
  *  - a pg placeholder such as `$${paramCount + 1}` is a parameter number, not a value in the SQL text. It is exempt only
  *    when its expression is a number, a loop letter, `params.length`-style, or a name containing `param` or `placeholder`, it
  *    stands where SQL takes a value, and it is not inside a quoted SQL string.

package/dist/src/commands/security-code-patterns.js

@@ -6,14 +6,72 @@
  *  - every rule is tested after comment text is blanked, so a comment naming `child_process.execFile` or `eval(` is
  *    not a finding;
  *  - eval needs a word start: "retrieval (" in prose is not a call; `eval(` and `window.eval(` still are;
- *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and no longer skips
- *    execSync as `exec[^S]` did;
+ *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and also catches
+ *    dynamic exec/execSync command strings when the import was on another line;
  *  - a pg placeholder such as `$${paramCount + 1}` is a parameter number, not a value in the SQL text. It is exempt only
  *    when its expression is a number, a loop letter, `params.length`-style, or a name containing `param` or `placeholder`, it
  *    stands where SQL takes a value, and it is not inside a quoted SQL string.
  */
 /** No `g` flag, so `test` keeps no lastIndex between lines. */
 const re = (pattern) => (line) => pattern.test(line);
+/** Detect a dynamic shell command at an exec/execSync call site, independent of its import. */
+const interpolatedExec = (line) => {
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (quote !== null) {
+            if (ch === '\\') {
+                i++;
+                continue;
+            }
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === "'" || ch === '"' || ch === '`') {
+            quote = ch;
+            continue;
+        }
+        if (i > 0 && /[\w$]/.test(line[i - 1]))
+            continue;
+        const name = line.startsWith('execSync', i) ? 'execSync' : line.startsWith('exec', i) ? 'exec' : '';
+        if (!name)
+            continue;
+        let arg = i + name.length;
+        while (/\s/.test(line[arg] ?? ''))
+            arg++;
+        if (line[arg++] !== '(')
+            continue;
+        while (/\s/.test(line[arg] ?? ''))
+            arg++;
+        const delimiter = line[arg];
+        if (delimiter !== '`' && delimiter !== "'" && delimiter !== '"')
+            continue;
+        for (let end = arg + 1; end < line.length; end++) {
+            if (line[end] === '\\') {
+                end++;
+                continue;
+            }
+            if (delimiter === '`' && line[end] === '$' && line[end + 1] === '{')
+                return true;
+            if (line[end] !== delimiter)
+                continue;
+            if (delimiter !== '`') {
+                let next = end + 1;
+                while (/\s/.test(line[next] ?? ''))
+                    next++;
+                if (line[next++] === '+') {
+                    while (/\s/.test(line[next] ?? ''))
+                        next++;
+                    if (/[A-Za-z_$]/.test(line[next] ?? ''))
+                        return true;
+                }
+            }
+            break;
+        }
+    }
+    return false;
+};
 // A `.length` counts only on a param-, value- or arg-named array: `req.body.length` is whatever the client sent.
 const COUNTER = /^\s*(?:\d+|[ijkn]|(?:[A-Za-z_$][\w$]*(?:Params?|Placeholders?|Values?|Args?)|params?|placeholders?|values?|args?)\.length|[A-Za-z_$]*(?:[Pp]aram|[Pp]laceholder)[\w$]*)\s*(?:[+-]\s*\d+\s*)?$/;
 // Where a pg parameter stands in SQL: after a comparison, a list or call opener, or a clause keyword.
@@ -70,7 +128,7 @@ export const CODE_PATTERNS = [
     { match: re(/(?<![\w$])eval\s*\(/), type: 'Eval Usage', severity: 'medium', desc: 'eval() can execute arbitrary code' },
     { match: re(/innerHTML\s*=/), type: 'innerHTML', severity: 'medium', desc: 'XSS risk with innerHTML' },
     { match: re(/dangerouslySetInnerHTML/), type: 'React XSS', severity: 'medium', desc: 'React XSS risk' },
-    { match: re(/child_process.*exec/), type: 'Command Injection', severity: 'high', desc: 'Possible command injection' },
+    { match: line => /child_process.*exec/.test(line) || interpolatedExec(line), type: 'Command Injection', severity: 'high', desc: 'Possible command injection' },
     { match: line => sqlInterpolation(line) && sqlInterpolation(withoutPlaceholders(line)), type: 'SQL Injection', severity: 'high', desc: 'Possible SQL injection' },
 ];
 /**

package/dist/src/commands/security.d.ts

@@ -5,6 +5,30 @@
  * Created with ❤️ by ruv.io
  */
 import type { Command } from '../types.js';
+/**
+ * #4124: `npm audit` can fail without exiting through the vulnerability path.
+ * In a pnpm/yarn/bun project there is no package-lock.json, so it prints
+ * `{"error":{"code":"ENOLOCK",...}}`. That has no `vulnerabilities` key, and
+ * both `scan` and `cve` used to read it as a clean tree. Only a report with a
+ * `vulnerabilities` object counts as a scan; anything else is "could not scan".
+ */
+type NpmAuditVuln = {
+    severity: string;
+    via: Array<{
+        title?: string;
+        url?: string;
+        source?: number;
+        name?: string;
+    } | string>;
+};
+export type NpmAuditResult = {
+    ok: true;
+    vulnerabilities: Record<string, NpmAuditVuln>;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function interpretNpmAudit(raw: string, dir?: string): NpmAuditResult;
 export declare const securityCommand: Command;
 export default securityCommand;
 //# sourceMappingURL=security.d.ts.map