@claude-flow/cli 3.63.0 → 3.63.2

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.63.0",
+    "version": "3.63.2",
     "files": {
       "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
       "hook-handler.cjs": "24502a3bcb78770971147940515c992e35b6736ae14ee2dc54e07d4cdef6a1d8",
@@ -9,6 +9,6 @@
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "xwg3vfgr6Zy0tIcVGzVhiqL9TmbFIrx6gJFzkQ3AhX0Ei38/t4EVIR7GSB2dlXJ0CrrSvWVohDHGNbIpo92CBQ==",
+  "signature": "6+Obx8HZs73gmcPZ6JJH6sBZf3OGb1DC5p5p0K8QhMAAr1QwhKu2uNPv36NmjpsbOTJ0MpidudSRt4fP/ToVBA==",
   "algorithm": "ed25519"
 }

package/README.md

@@ -244,7 +244,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
 | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
 | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
-| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.12/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
+| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.13/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
 
 #### Security & Compliance
 

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-25T03:04:54.913Z",
-  "gitSha": "e2dae2f7",
+  "generatedAt": "2026-10-26T14:15:30.738Z",
+  "gitSha": "a52ae16e",
   "catalog": {
     "agents": 177,
     "tools": 444,

package/dist/src/mcp-tools/agentbbs-tools.js

@@ -441,14 +441,19 @@ export const agentbbsTools = [
             const logPath = roomLogPath(basePath, roomId);
             const all = readEnvelopes(logPath);
             let slice = all;
+            let resuming = false;
             if (sinceEnvelopeId) {
                 const idx = all.findIndex(e => e.envelopeId === sinceEnvelopeId);
-                slice = idx >= 0 ? all.slice(idx + 1) : all;
+                resuming = idx >= 0;
+                slice = resuming ? all.slice(idx + 1) : all;
             }
             // Dedup by envelopeId before applying the limit — a relay replay or a
             // double-append must not surface the same envelope twice to a watcher.
             const deduped = dedupEnvelopes(slice);
-            const envelopes = deduped.slice(-limit);
+            // A watcher resuming after sinceEnvelopeId gets the oldest envelopes
+            // first, so passing the last returned id pages through the rest when
+            // hasMore is set. Without a cursor, it gets the most recent window.
+            const envelopes = resuming ? deduped.slice(0, limit) : deduped.slice(-limit);
             return {
                 success: true,
                 roomId,

package/dist/src/mcp-tools/http-fetch-tools.js

@@ -61,11 +61,33 @@ export function validateUrl(rawUrl) {
 function isPrivateOrLoopback(host) {
     if (host === 'localhost' || host === 'localhost.localdomain')
         return true;
-    // IPv6 loopback
-    if (host === '::1' || host === '[::1]')
-        return true;
+    // Node's URL parser keeps brackets in `.hostname` for every IPv6 literal
+    // (e.g. "[::1]", "[fc00::1]", "[::ffff:7f00:1]"). Strip them once so every
+    // check below operates on the bare address — without this, the fc00::/7
+    // and fe80::/10 checks further down never match anything (they test
+    // `startsWith('fc'/'fe80:')` against a string starting with "["), and an
+    // IPv4-mapped-IPv6 literal (`::ffff:a.b.c.d`, which Node normalizes to a
+    // canonical `::ffff:xxxx:yyyy` hex form) sails through both the IPv4 and
+    // IPv6 branches untested — a live SSRF bypass (e.g. `::ffff:127.0.0.1` or
+    // `::ffff:169.254.169.254` reaching loopback / cloud-metadata targets).
+    const bare = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+    if (bare === '::1')
+        return true; // IPv6 loopback
+    // IPv4-mapped IPv6 — decode back to dotted-decimal and recurse into the
+    // IPv4 check below so it inherits every existing private/loopback/
+    // link-local/CGNAT rule instead of needing its own copy.
+    const mappedHex = bare.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (mappedHex) {
+        const hi = parseInt(mappedHex[1], 16);
+        const lo = parseInt(mappedHex[2], 16);
+        const decoded = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+        return isPrivateOrLoopback(decoded);
+    }
+    const mappedDecimal = bare.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (mappedDecimal)
+        return isPrivateOrLoopback(mappedDecimal[1]);
     // IPv4 numeric checks
-    const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    const m = bare.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
     if (m) {
         const a = Number(m[1]);
         const b = Number(m[2]);
@@ -85,12 +107,18 @@ function isPrivateOrLoopback(host) {
             return true; // CGNAT
         return false;
     }
-    // IPv6 bracketed addresses and other special forms — be conservative and
-    // accept only public-looking literals. Reject obvious private/local forms.
-    if (host.startsWith('fc') || host.startsWith('fd'))
+    // IPv6 special forms — be conservative and accept only public-looking
+    // literals. Reject obvious private/local forms.
+    if (bare.startsWith('fc') || bare.startsWith('fd'))
         return true; // fc00::/7 ULA
-    if (host.startsWith('fe80:'))
+    if (bare.startsWith('fe80:'))
         return true; // link-local
+    // KNOWN LIMITATION (pre-existing, not introduced by the bracket-stripping /
+    // IPv4-mapped-IPv6 fix above; flagged by an independent adversarial review):
+    // `::` (IPv6 unspecified/"any", the analog of 0.0.0.0, which the IPv4 branch
+    // above does block), IPv6 multicast (ff00::/8), and NAT64 (64:ff9b::/96) are
+    // not covered. Left as a follow-up hardening item rather than scope-creeping
+    // this patch.
     return false;
 }
 export function validateHeaders(headers) {

package/dist/src/mcp-tools/managed-agent-tools.js

@@ -54,6 +54,9 @@ async function maRequest(method, path, body, timeoutMs = 30_000) {
     const key = apiKey();
     if (!key)
         return { ok: false, status: 0, error: NEEDS_KEY.error };
+    // encodeURIComponent leaves '.' and '..' alone, so an id of '..' would walk up the API path (/v1/sessions/.. is /v1/).
+    if (path.split('?')[0].split('/').some(segment => segment === '.' || segment === '..'))
+        return { ok: false, status: 0, error: 'Invalid managed resource id' };
     try {
         const res = await fetch(`${apiBase()}/v1${path}`, {
             method, headers: headers(key), redirect: 'error',

package/dist/src/services/flywheel-transaction.js

@@ -91,6 +91,11 @@ function atomicWriteJson(file, value) {
         fs.closeSync(fd);
     }
     fs.renameSync(tmp, file);
+    // Windows cannot flush a directory handle (FlushFileBuffers fails with EPERM on NTFS), and there the journaled rename needs no such step.
+    // Skipping it there is the same rule policy-runtime's syncDirectory follows (#3398). On POSIX a failure here means the rename may not be
+    // durable, so it still reaches the caller (#4492).
+    if (process.platform === 'win32')
+        return;
     const dirFd = fs.openSync(path.dirname(file), fs.constants.O_RDONLY);
     try {
         fs.fsyncSync(dirFd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.63.0",
+  "version": "3.63.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",