@claude-flow/cli 3.63.3 → 3.63.5

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.63.3",
+    "version": "3.63.5",
     "files": {
       "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
       "hook-handler.cjs": "24502a3bcb78770971147940515c992e35b6736ae14ee2dc54e07d4cdef6a1d8",
@@ -9,6 +9,6 @@
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "Zz2QVu1NSwEjxVSpJ/h5IBcWqHfoOeTlJl0msaJ6ugwPelkwD+ejKGQ/weOBp++gxuXnFExbWmEKZOe/HMt1Cw==",
+  "signature": "G+rxSA+IVcyJKtcRpr+UAcy53YlkPTcC5WI9HN0Cdo+KHHGuh2dTOKGVg2Xw2Y09tJYdeFwymgLRTf9hxb/1DA==",
   "algorithm": "ed25519"
 }

package/README.md

@@ -244,7 +244,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
 | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
 | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
-| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.13/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
+| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.15/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
 
 #### Security & Compliance
 

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-26T16:17:30.971Z",
-  "gitSha": "29b9894d",
+  "generatedAt": "2026-10-27T19:04:24.259Z",
+  "gitSha": "d635d422",
   "catalog": {
     "agents": 177,
     "tools": 444,

package/dist/src/commands/hooks.js

@@ -2489,7 +2489,7 @@ const workerStatusCommand = {
                 });
                 if (result.summary) {
                     output.writeln();
-                    output.writeln(`Total: ${result.summary.total} | Running: ${output.highlight(String(result.summary.running))} | Completed: ${output.success(String(result.summary.completed))} | Failed: ${output.error(String(result.summary.failed))}`);
+                    output.writeln(`Total: ${result.summary.total} | Pending: ${String(result.summary.pending ?? 0)} | Running: ${output.highlight(String(result.summary.running))} | Completed: ${output.success(String(result.summary.completed))} | Failed: ${output.error(String(result.summary.failed))}`);
                 }
             }
             else {

package/dist/src/commands/mcp.js

@@ -8,7 +8,7 @@
 import { output } from '../output.js';
 import { confirm } from '../prompt.js';
 import { installParentDeathWatchdog } from '../runtime/parent-death-watchdog.js';
-import { getServerManager, getMCPServerStatus, resolveMcpHttpAuthToken, isLoopbackHost, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
+import { getServerManager, getMCPServerStatus, resolveMcpHttpAuthToken, ensureDefaultMcpToken, isUnauthenticatedHttpAllowed, isLoopbackHost, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
 import { listMCPTools, callMCPTool, hasTool } from '../mcp-client.js';
 // MCP tools categories
 const TOOL_CATEGORIES = [
@@ -187,6 +187,13 @@ const startCommand = {
             output.printError(error.message);
             return { success: false, exitCode: 1 };
         }
+        // Network transports never start open by default: with no token given, use the per-user one.
+        let defaultTokenFile;
+        if (!authToken && (transport === 'http' || transport === 'websocket') && !isUnauthenticatedHttpAllowed()) {
+            const made = ensureDefaultMcpToken();
+            authToken = made.token;
+            defaultTokenFile = made.file;
+        }
         const daemon = ctx.flags.daemon ?? false;
         const force = ctx.flags.force ?? false;
         output.writeln();
@@ -304,6 +311,8 @@ const startCommand = {
                 output.writeln(output.dim(`  RPC: http://${host}:${port}/rpc`));
                 if (authToken) {
                     output.writeln(output.dim('  Auth: bearer token required (Authorization: Bearer <token>); /health is public'));
+                    if (defaultTokenFile)
+                        output.writeln(output.dim(`  Token (none was given): ${defaultTokenFile} - set RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1 to run without one`));
                 }
                 else if (isLoopbackHost(host)) {
                     output.printWarning('No auth token set: any local process (and DNS-rebinding web pages) can call tools. Set RUFLO_MCP_HTTP_TOKEN to require a bearer token.');
@@ -314,6 +323,8 @@ const startCommand = {
             }
             else if (transport === 'websocket') {
                 output.writeln(output.dim(`  WebSocket: ws://${host}:${port}/ws`));
+                if (authToken)
+                    output.writeln(output.dim(`  Auth: bearer token required (Authorization: Bearer <token> or ?token=)${defaultTokenFile ? `; token in ${defaultTokenFile}` : ''}`));
             }
             if (daemon) {
                 output.writeln(output.dim('  Running in background mode'));

package/dist/src/commands/status.js

@@ -152,7 +152,7 @@ async function getSystemStatus() {
                 backend: 'none',
                 performance: { searchTime: 0, cacheHitRate: 0 }
             },
-            tasks: { total: 0, pending: 0, running: 0, completed: 0, failed: 0 },
+            tasks: { total: 0, pending: 0, running: 0, completed: 0, failed: 0, cancelled: 0 },
             performance: {
                 cpuUsage: 0,
                 memoryUsage: 0,
@@ -217,6 +217,7 @@ function displayStatus(status) {
             { status: 'Running', count: status.tasks.running },
             { status: 'Completed', count: status.tasks.completed },
             { status: 'Failed', count: status.tasks.failed },
+            { status: 'Cancelled', count: status.tasks.cancelled },
             { status: output.bold('Total'), count: status.tasks.total }
         ]
     });

package/dist/src/mcp-server.d.ts

@@ -77,6 +77,15 @@ export declare function isUnauthenticatedHttpAllowed(env?: NodeJS.ProcessEnv): b
  * refused, with or without a token. Exported for tests.
  */
 export declare function shouldRefuseUnauthenticatedHttp(host: string, env?: NodeJS.ProcessEnv, authenticated?: boolean): boolean;
+/**
+ * The bearer token a token-less `mcp start -t http|websocket` falls back to, so that a loopback
+ * server is never open to every local process. Kept in `~/.claude-flow/mcp-http-token` (mode 0600)
+ * so clients can read it; created on first use. Exported for tests.
+ */
+export declare function ensureDefaultMcpToken(homeDir?: string): {
+    token: string;
+    file: string;
+};
 /**
  * Resolve the HTTP bearer token. Precedence: explicit value (CLI flag), token
  * file, then RUFLO_MCP_HTTP_TOKEN. An unset/empty env var means "no token";

package/dist/src/mcp-server.js

@@ -19,7 +19,7 @@
 import { EventEmitter } from 'events';
 import { execFileSync } from 'child_process';
 import { request as httpRequestFn } from 'http';
-import { randomUUID } from 'crypto';
+import { randomUUID, randomBytes } from 'crypto';
 import * as path from 'path';
 import * as fs from 'fs';
 import * as os from 'os';
@@ -158,6 +158,28 @@ function raisedRateLimits(options) {
     }
     return raised;
 }
+/**
+ * The bearer token a token-less `mcp start -t http|websocket` falls back to, so that a loopback
+ * server is never open to every local process. Kept in `~/.claude-flow/mcp-http-token` (mode 0600)
+ * so clients can read it; created on first use. Exported for tests.
+ */
+export function ensureDefaultMcpToken(homeDir = os.homedir()) {
+    const dir = path.join(homeDir, '.claude-flow');
+    const file = path.join(dir, 'mcp-http-token');
+    try {
+        const existing = fs.readFileSync(file, 'utf8').trim();
+        if (AUTH_TOKEN_PATTERN.test(existing))
+            return { token: existing, file };
+    }
+    catch {
+        // none yet
+    }
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const token = randomBytes(32).toString('hex');
+    fs.writeFileSync(file, token + '\n', { mode: 0o600 });
+    fs.chmodSync(file, 0o600);
+    return { token, file };
+}
 /** Printable ASCII without space (RFC 6750 token-ish), 16-512 chars. */
 const AUTH_TOKEN_PATTERN = /^[\x21-\x7e]{16,512}$/;
 /**
@@ -824,11 +846,6 @@ export class MCPServerManager extends EventEmitter {
         // Authorization gate first, before any import or bind: a refused start must
         // not depend on (or touch) anything else.
         const authToken = this.options.authToken || undefined;
-        if (authToken && this.options.transport !== 'http') {
-            // The standalone websocket transport has no working token check, so a
-            // token there would be a false promise of protection.
-            throw new Error('An MCP HTTP auth token is only supported with --transport http');
-        }
         if (shouldRefuseUnauthenticatedHttp(this.options.host, process.env, !!authToken)) {
             // No ToolAuthorizer is wired below: @claude-flow/mcp's tool-call
             // authorization is fully opt-in (requireToolAuthorization/toolAuthorizer),

package/dist/src/mcp-tools/agentbbs-federation.js

@@ -51,7 +51,7 @@
  * @module @claude-flow/cli/mcp-tools/agentbbs-federation
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, chmodSync } from 'node:fs';
-import { join } from 'node:path';
+import { isAbsolute, join, relative, resolve } from 'node:path';
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { createRequire } from 'node:module';
 // Lazy, CommonJS-style load of node:http: an ESM `import … from 'node:http'`
@@ -132,7 +132,13 @@ function peersPath(basePath) {
     return join(basePath, 'peers.json');
 }
 function roomLogPath(basePath, roomId) {
-    return join(basePath, `room-${roomId}.jsonl`);
+    // The room id reaches a file name: validate it, then make sure the result stays under basePath.
+    validateRoomId(roomId);
+    const file = join(basePath, `room-${roomId}.jsonl`);
+    const rel = relative(resolve(basePath), resolve(file));
+    if (rel.startsWith('..') || isAbsolute(rel))
+        throw new Error('Invalid room id');
+    return file;
 }
 /**
  * Load or create this host's long-lived Ed25519 identity.

package/dist/src/mcp-tools/agentbbs-tools.js

@@ -35,7 +35,7 @@
  * @module @claude-flow/cli/mcp-tools/agentbbs
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
-import { resolve, isAbsolute, join } from 'node:path';
+import { resolve, isAbsolute, join, relative } from 'node:path';
 import { randomBytes, createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { getNodeIdentity, signEnvelope, addPeer, removePeer, readPeers, syncRoomFromPeer, serveFederation, validateRoomId as fedValidateRoomId, MAX_PEERS, MAX_HOPS, } from './agentbbs-federation.js';
@@ -88,6 +88,9 @@ function validateRoomLabel(label) {
     if (!/^[A-Za-z0-9_.\-:/@#]+$/.test(label)) {
         throw new Error('roomLabel may only contain [A-Za-z0-9_.\\-:/@#]');
     }
+    // The label becomes part of the room id, and the room id part of a file name.
+    if (label.includes('..'))
+        throw new Error('roomLabel must not contain ..');
     return label;
 }
 function validateRoomId(roomId) {
@@ -120,7 +123,12 @@ function roomIdFromLabel(label) {
     return `${norm}-${h}`;
 }
 function roomLogPath(basePath, roomId) {
-    return join(basePath, `room-${roomId}.jsonl`);
+    validateRoomId(roomId);
+    const file = join(basePath, `room-${roomId}.jsonl`);
+    const rel = relative(resolve(basePath), resolve(file));
+    if (rel.startsWith('..') || isAbsolute(rel))
+        throw new Error('roomId escapes the BBS directory');
+    return file;
 }
 function roomsRegistryPath(basePath) {
     return join(basePath, 'rooms.json');

package/dist/src/mcp-tools/hooks-tools.js

@@ -4817,6 +4817,7 @@ export const hooksWorkerStatus = {
             workers,
             summary: {
                 total: workers.length,
+                pending: workers.filter(w => w.status === 'pending').length,
                 running: workers.filter(w => w.status === 'running').length,
                 completed: workers.filter(w => w.status === 'completed').length,
                 failed: workers.filter(w => w.status === 'failed').length,

package/dist/src/mcp-tools/http-fetch-tools.d.ts

@@ -15,7 +15,7 @@
  *   - DEFAULT-REFUSES Authorization / Cookie / X-Auth-* (CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1 opt-in)
  *   - hard timeout 30s default, 60s ceiling
  *   - response truncated to 256KB default, 1MB ceiling
- *   - no redirects auto-followed beyond fetch's default; status reported as-is
+ *   - redirects followed manually, max 10, every hop re-validated by the same allowlist
  *
  * @module @claude-flow/cli/mcp-tools/http-fetch
  */

package/dist/src/mcp-tools/http-fetch-tools.js

@@ -15,7 +15,7 @@
  *   - DEFAULT-REFUSES Authorization / Cookie / X-Auth-* (CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1 opt-in)
  *   - hard timeout 30s default, 60s ceiling
  *   - response truncated to 256KB default, 1MB ceiling
- *   - no redirects auto-followed beyond fetch's default; status reported as-is
+ *   - redirects followed manually, max 10, every hop re-validated by the same allowlist
  *
  * @module @claude-flow/cli/mcp-tools/http-fetch
  */
@@ -23,6 +23,8 @@ const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 60_000;
 const DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024; // 256 KB
 const MAX_RESPONSE_BYTES = 1024 * 1024; // 1 MB
+const MAX_REDIRECTS = 10;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 const DEFAULT_USER_AGENT = 'ruflo-http-fetch/1.0';
 const FORBIDDEN_HEADER_PREFIXES = ['x-auth-', 'x-api-key'];
 const FORBIDDEN_HEADERS_EXACT = ['authorization', 'cookie', 'set-cookie', 'proxy-authorization'];
@@ -230,13 +232,97 @@ export async function httpFetchExecute(input) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await fetch(parsed.toString(), {
-            method,
-            headers,
-            body: method === 'GET' || method === 'HEAD' ? undefined : body,
-            signal: controller.signal,
-            // Keep redirect default ('follow') — caller sees final status/url.
-        });
+        let currentUrl = parsed;
+        let currentMethod = method;
+        let currentBody = body;
+        let response;
+        let redirects = 0;
+        // Do not let fetch follow redirects on its own: only the initial URL was
+        // validated, so an automatic follow could reach loopback/RFC1918 or switch
+        // protocols after passing the allowlist. Every hop is validated with the
+        // same rules; sensitive headers are dropped when the origin changes.
+        while (true) {
+            response = await fetch(currentUrl.toString(), {
+                method: currentMethod,
+                headers,
+                body: currentMethod === 'GET' || currentMethod === 'HEAD' ? undefined : currentBody,
+                signal: controller.signal,
+                redirect: 'manual',
+            });
+            if (!REDIRECT_STATUSES.has(response.status))
+                break;
+            const location = response.headers.get('location');
+            if (!location)
+                break;
+            if (redirects++ >= MAX_REDIRECTS) {
+                try {
+                    await response.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return {
+                    success: false,
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: {},
+                    body: '',
+                    bodyTruncated: false,
+                    bytesRead: 0,
+                    durationMs: Date.now() - startedAt,
+                    url: currentUrl.toString(),
+                    method,
+                    error: `too many redirects (max ${MAX_REDIRECTS})`,
+                    errorCode: 'REDIRECT_LIMIT',
+                };
+            }
+            let nextUrl;
+            try {
+                nextUrl = validateUrl(new URL(location, currentUrl).toString());
+            }
+            catch (e) {
+                try {
+                    await response.body?.cancel();
+                }
+                catch { /* ignore */ }
+                const err = e;
+                return {
+                    success: false,
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: {},
+                    body: '',
+                    bodyTruncated: false,
+                    bytesRead: 0,
+                    durationMs: Date.now() - startedAt,
+                    url: currentUrl.toString(),
+                    method,
+                    error: `redirect blocked: ${err.message}`,
+                    errorCode: err.code ?? 'REDIRECT_BLOCKED',
+                };
+            }
+            // The redirect response body is not returned; release the connection
+            // before issuing the next request. A body-less 3xx is also fine.
+            try {
+                await response.body?.cancel();
+            }
+            catch { /* ignore */ }
+            if (nextUrl.origin !== currentUrl.origin) {
+                for (const key of Object.keys(headers)) {
+                    const lower = key.toLowerCase();
+                    if (lower === 'authorization' || lower === 'cookie' || lower === 'proxy-authorization') {
+                        delete headers[key];
+                    }
+                }
+            }
+            // Match fetch's redirect method rules: 303 becomes GET except for
+            // GET/HEAD, while 301/302 only rewrite POST to GET. 307/308 preserve
+            // both method and body.
+            if ((response.status === 303 && currentMethod !== 'GET' && currentMethod !== 'HEAD') ||
+                ((response.status === 301 || response.status === 302) && currentMethod === 'POST')) {
+                currentMethod = 'GET';
+                currentBody = undefined;
+            }
+            currentUrl = nextUrl;
+        }
         // Drain the body with byte budget. Use array-buffer first to bound size
         // deterministically before decoding to UTF-8.
         const reader = response.body?.getReader();
@@ -286,7 +372,7 @@ export async function httpFetchExecute(input) {
             bodyTruncated,
             bytesRead,
             durationMs: Date.now() - startedAt,
-            url: parsed.toString(),
+            url: currentUrl.toString(),
             method,
         };
     }

package/dist/src/mcp-tools/system-tools.js

@@ -633,6 +633,7 @@ export const systemTools = [
                 running: tasks.filter(t => t.status === 'in_progress').length,
                 completed: tasks.filter(t => t.status === 'completed').length,
                 failed: tasks.filter(t => t.status === 'failed').length,
+                cancelled: tasks.filter(t => t.status === 'cancelled').length,
             };
         },
     },

package/dist/src/mcp-tools/task-tools.js

@@ -208,7 +208,9 @@ export const taskTools = [
             // Apply filters
             if (input.status) {
                 // Support comma-separated status values. 'all' (sent by `status tasks`) means no status filter.
-                const statuses = input.status.split(',').map(s => s.trim());
+                // Each value goes through statusOf, the reader task_update uses, so "done", "canceled",
+                // "running" or "Completed" match the stored status rather than matching nothing.
+                const statuses = input.status.split(',').map(s => s.trim()).map(s => statusOf(s) ?? s);
                 if (!statuses.includes('all')) {
                     tasks = tasks.filter(t => statuses.includes(t.status));
                 }

package/dist/src/mcp-tools/workflow-tools.js

@@ -20,7 +20,9 @@ function parseCondition(when) {
     if (expression === 'true' || expression === 'false') {
         return { constant: expression === 'true' };
     }
-    const match = expression.match(/^([a-zA-Z_]\w*)\s*===?\s*(?:'([^']*)'|"([^"]*)"|(-?\d+(?:\.\d+)?)|(true|false))$/);
+    // Variable names follow the `{{…}}` interpolation syntax, so a condition can
+    // read a task step's output, stored as `<stepId>.output` (`step-1.output`).
+    const match = expression.match(/^([a-zA-Z_][\w.-]*)\s*===?\s*(?:'([^']*)'|"([^"]*)"|(-?\d+(?:\.\d+)?)|(true|false))$/);
     if (!match) {
         return new Error('condition config.when must compare a variable to a quoted string, number, or boolean using == or ===');
     }

package/dist/src/mods/claude-installs.js

@@ -7,8 +7,8 @@
  * (a 2.1.107 npm-global beside a current native one, say) silently decides.
  */
 import { execFileSync } from 'node:child_process';
-import { existsSync, realpathSync, statSync } from 'node:fs';
-import { delimiter, join } from 'node:path';
+import { closeSync, existsSync, fstatSync, openSync, readSync, realpathSync, statSync } from 'node:fs';
+import { delimiter, dirname, join, resolve } from 'node:path';
 export const MODS_DEFAULT_ON = '2.1.287';
 export const MODS_FIRST = '2.1.277';
 const parse = (v) => v.split('.').map((n) => Number(n));
@@ -52,6 +52,98 @@ export const defaultVersionOf = (path) => {
         return null;
     }
 };
+/** Known npm/cmd-shim Node launcher forms (legacy basedir and basedir_win).
+ * Match the whole template, not comments or arbitrary shell code. Unknown npm
+ * versions/formats simply keep the independent probe result. Never execute it.
+ */
+const npmCmdShim = (entry, modern) => [
+    '@ECHO off', 'GOTO start', ':find_dp0', 'SET dp0=%~dp0', 'EXIT /b', ':start',
+    'SETLOCAL', 'CALL :find_dp0', '', 'IF EXIST "%dp0%\\node.exe" (',
+    '  SET "_prog=%dp0%\\node.exe"', ') ELSE (', '  SET "_prog=node"',
+    ...(!modern ? ['  SET PATHEXT=%PATHEXT:;.JS;=;%'] : []), ')', '',
+    'endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & '
+        + (modern ? 'set PATHEXT=%PATHEXT:;.JS;=;% & ' : '')
+        + `"%_prog%"  "%dp0%\\${entry.replaceAll('/', '\\')}" %*`, '',
+].join('\r\n');
+const npmPosixShim = (entry, modern) => [
+    '#!/bin/sh', 'basedir=$(dirname "$(echo "$0" | sed -e \'s,\\\\,/,g\')")',
+    ...(modern ? ['basedir_win="$basedir"'] : []), '',
+    modern ? 'case `uname -a` in' : 'case `uname` in',
+    ...(modern ? [
+        '  *CYGWIN*|*MINGW*|*MSYS*)', '    if command -v cygpath > /dev/null 2>&1; then',
+        '      basedir_win=`cygpath -w "$basedir"`', '    fi', '  ;;', '  *WSL2*)',
+        '    if command -v wslpath > /dev/null 2>&1; then',
+        '      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"',
+        '      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then',
+        '        echo "Error: wslpath failed to convert path. WSL environment may be misconfigured." >&2',
+        '        exit 1', '      fi', '    fi', '  ;;',
+    ] : [
+        '    *CYGWIN*|*MINGW*|*MSYS*)', '        if command -v cygpath > /dev/null 2>&1; then',
+        '            basedir=`cygpath -w "$basedir"`', '        fi', '    ;;',
+    ]), 'esac', '',
+    ...(modern ? [
+        'PROG_EXE="$basedir/node.exe"', 'if ! [ -x "$PROG_EXE" ]; then',
+        '  PROG_EXE="$basedir/node"', '  if ! [ -x "$PROG_EXE" ]; then',
+        '    PROG_EXE=node', '    if ! [ -x "$PROG_EXE" ]; then', '      PROG_EXE=node.exe',
+        '    fi', '  fi', 'fi', '', `exec "$PROG_EXE"  "$basedir_win/${entry}" "$@"`,
+    ] : [
+        'if [ -x "$basedir/node" ]; then', `  exec "$basedir/node"  "$basedir/${entry}" "$@"`,
+        'else ', `  exec node  "$basedir/${entry}" "$@"`, 'fi',
+    ]), '',
+].join('\n');
+// A no-shebang/native bin uses npm's direct-exec forms, not a Node wrapper.
+const npmDirectCmdShim = (entry) => [
+    '@ECHO off', 'GOTO start', ':find_dp0', 'SET dp0=%~dp0', 'EXIT /b', ':start',
+    'SETLOCAL', 'CALL :find_dp0', `"%dp0%\\${entry.replaceAll('/', '\\')}"   %*`, '',
+].join('\r\n');
+const npmDirectPosixShim = (entry, modern) => {
+    const nodeShim = npmPosixShim(entry, modern);
+    const preamble = nodeShim.slice(0, nodeShim.indexOf(modern ? 'PROG_EXE=' : 'if [ -x'));
+    return preamble + `exec "$basedir/${entry}"   "$@"\n`;
+};
+function npmShimTarget(path, cmd) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > 64 * 1024)
+            return null;
+        // Also cap the actual read if a file grows after stat.
+        const bytes = Buffer.alloc(64 * 1024 + 1);
+        let size = 0;
+        while (size < bytes.length) {
+            const n = readSync(fd, bytes, size, bytes.length - size, null);
+            if (!n)
+                break;
+            size += n;
+        }
+        if (size > 64 * 1024)
+            return null;
+        const text = bytes.subarray(0, size).toString('utf8').replace(/\r\n/g, '\n').trimEnd();
+        const targets = cmd
+            ? [...text.matchAll(/"%dp0%\\([^"\r\n]+)" +%\*$/gm)].map(m => m[1].replaceAll('\\', '/'))
+            : [...text.matchAll(/^\s*exec (?:[^\r\n]* )?"\$basedir(?:_win)?\/([^"\r\n]+)" +"\$@"$/gm)].map(m => m[1]);
+        const entry = targets[0];
+        if (!entry || targets.some(t => t !== entry) || !/^[a-zA-Z0-9@._ /-]+$/.test(entry) || entry.startsWith('/'))
+            return null;
+        const template = cmd ? npmCmdShim : npmPosixShim;
+        const normalize = (value) => value.replace(/\r\n/g, '\n').trimEnd();
+        const node = [false, true].some(modern => normalize(template(entry, modern)) === text);
+        const direct = cmd ? normalize(npmDirectCmdShim(entry)) === text
+            : [false, true].some(modern => normalize(npmDirectPosixShim(entry, modern)) === text);
+        if (!node && !direct)
+            return null;
+        const target = realpathSync(resolve(dirname(path), entry));
+        return statSync(target).isFile() ? { path: target, mode: node ? 'node' : 'direct' } : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
 /** Every `claude` on PATH, in PATH order (the first is what runs), plus ~/.local/bin. */
 export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
     const names = process.platform === 'win32' ? ['claude.exe', 'claude.cmd', 'claude'] : ['claude'];
@@ -59,6 +151,7 @@ export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
     const seen = new Set();
     const installs = [];
     for (const dir of dirs) {
+        let cmd;
         for (const name of names) {
             const path = join(dir, name);
             let real;
@@ -73,7 +166,19 @@ export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
             if (seen.has(real))
                 continue;
             seen.add(real);
-            installs.push({ path, version: versionOf(path) });
+            let version = versionOf(path);
+            if (process.platform === 'win32' && name === 'claude' && version === null && cmd?.version) {
+                const target = npmShimTarget(path, false);
+                const cmdTarget = npmShimTarget(cmd.path, true);
+                if (target && cmdTarget && target.path === cmdTarget.path && target.mode === cmdTarget.mode)
+                    version = cmd.version;
+            }
+            const install = { path, version };
+            installs.push(install);
+            // Only a .cmd actually probed in this directory can supply a version.
+            // A realpath-deduplicated alias in another directory proves nothing here.
+            if (name === 'claude.cmd')
+                cmd = install;
         }
     }
     return installs;

package/dist/src/services/worker-daemon.d.ts

@@ -428,7 +428,9 @@ export declare class WorkerDaemon extends EventEmitter {
     /**
      * Manually trigger a worker
      */
-    triggerWorker(type: WorkerType): Promise<WorkerResult>;
+    triggerWorker(type: WorkerType, opts?: {
+        manualTrigger?: boolean;
+    }): Promise<WorkerResult>;
     /**
      * Enable/disable a worker
      */

package/dist/src/services/worker-daemon.js

@@ -952,7 +952,7 @@ export class WorkerDaemon extends EventEmitter {
             }
             try {
                 this.log('info', `Dequeued ${trigger}${workerId ? ` (id=${workerId})` : ''} from MCP dispatch queue`);
-                await this.triggerWorker(trigger);
+                await this.triggerWorker(trigger, { manualTrigger: false });
             }
             catch (err) {
                 this.log('warn', `Queued worker ${trigger} failed: ${err.message}`);
@@ -1926,7 +1926,7 @@ export class WorkerDaemon extends EventEmitter {
     /**
      * Manually trigger a worker
      */
-    async triggerWorker(type) {
+    async triggerWorker(type, opts = {}) {
         const workerConfig = this.config.workers.find(w => w.type === type);
         if (!workerConfig) {
             throw new Error(`Unknown worker type: ${type}`);
@@ -1941,7 +1941,9 @@ export class WorkerDaemon extends EventEmitter {
         // #2661 root-fix — an explicit manual trigger bypasses the repository-
         // supervisor gate (still budget/dedup-gated) — see runWorkerLogic()'s
         // doc comment.
-        return this.executeWorker(workerConfig, { manualTrigger: true });
+        // Only an operator's own `daemon trigger` is manual. A file in daemon-queue/ can come from a
+        // cloned repo, so queue runs pass `manualTrigger: false` and stay behind the supervisor gate.
+        return this.executeWorker(workerConfig, { manualTrigger: opts.manualTrigger ?? true });
     }
     /**
      * Enable/disable a worker

package/node_modules/@claude-flow/mcp/dist/transport/websocket.d.ts

@@ -58,6 +58,8 @@ export declare class WebSocketTransport extends EventEmitter implements ITranspo
     getClientInfo(clientId: string): ClientConnection | undefined;
     disconnectClient(clientId: string, reason?: string): boolean;
     private setupWebSocketHandlers;
+    /** Token from `Authorization: Bearer` or `?token=`, compared in constant time. */
+    private upgradeHasValidToken;
     private handleMessage;
     private parseMessage;
     private serializeMessage;

package/node_modules/@claude-flow/mcp/dist/transport/websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../src/transport/websocket.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAmB,SAAS,EAAW,MAAM,IAAI,CAAC;AAGzD,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EAGb,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,OAAO,EACP,UAAU,EACX,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,IAAI,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,qBAAa,kBAAmB,SAAQ,YAAa,YAAW,UAAU;IAkBtE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAlBzB,SAAgB,IAAI,EAAE,aAAa,CAAe;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,mBAAmB,CAAC,CAAsB;IAClD,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,GAAG,CAAC,CAAkB;IAC9B,OAAO,CAAC,OAAO,CAA4C;IAC3D,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAAK;IAE9B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,gBAAgB,CAAK;gBAGV,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,wBAAwB;IAK7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA2CtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC3B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIxC,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAI5C,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAajD,gBAAgB,CAAC,YAAY,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9D,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBrF,UAAU,IAAI,MAAM,EAAE;IAItB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAI7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAA2B,GAAG,OAAO;IAc9E,OAAO,CAAC,sBAAsB;YA0DhB,aAAa;IAuE3B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,cAAc;IAsBtB,OAAO,CAAC,aAAa;CAMtB;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,wBAAwB,GAC/B,kBAAkB,CAEpB"}
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../src/transport/websocket.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAmB,SAAS,EAAW,MAAM,IAAI,CAAC;AAIzD,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EAGb,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,OAAO,EACP,UAAU,EACX,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,IAAI,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,qBAAa,kBAAmB,SAAQ,YAAa,YAAW,UAAU;IAkBtE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAlBzB,SAAgB,IAAI,EAAE,aAAa,CAAe;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,mBAAmB,CAAC,CAAsB;IAClD,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,GAAG,CAAC,CAAkB;IAC9B,OAAO,CAAC,OAAO,CAA4C;IAC3D,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAAK;IAE9B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,gBAAgB,CAAK;gBAGV,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,wBAAwB;IAK7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8CtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC3B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIxC,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAI5C,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAajD,gBAAgB,CAAC,YAAY,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9D,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBrF,UAAU,IAAI,MAAM,EAAE;IAItB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAI7D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAA2B,GAAG,OAAO;IAc9E,OAAO,CAAC,sBAAsB;IA4D9B,kFAAkF;IAClF,OAAO,CAAC,oBAAoB;YAiBd,aAAa;IAuE3B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,cAAc;IAsBtB,OAAO,CAAC,aAAa;CAMtB;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,wBAAwB,GAC/B,kBAAkB,CAEpB"}