@claude-flow/cli 3.63.9 → 3.65.0

package/dist/src/memory/verified-reverify.js

@@ -0,0 +1,174 @@
+/**
+ * Re-verify before training (ADR-503 §2.3). Opt-in: `.claude-flow/config.json`
+ * `learningLoop.reverify: true`. Off by default because it runs project code.
+ *
+ * - The command comes only from a fixed allowlist built from the project's own
+ *   manifest (`package.json` scripts named test/typecheck/build/lint, or
+ *   `cargo test`/`cargo check` when `Cargo.toml` exists). A record's text is
+ *   never executed: it only selects, by its verifier *kind*, which allowlisted
+ *   check NOT to run.
+ * - Checks rotate round-robin across ingests, preferring one the record did
+ *   not use, so no single check is the one that counts.
+ * - The real runner works in a temporary detached `git worktree` at HEAD,
+ *   with a hard timeout; timeout, error or a non-zero exit downgrades the
+ *   record to `unknown`.
+ */
+import { execFile, spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+/** package.json scripts that may be re-run, in rotation order, and the kind each verifies. */
+const NPM_SCRIPTS = [
+    ['test', 'test'],
+    ['typecheck', 'typecheck'],
+    ['build', 'build'],
+    ['lint', 'lint'],
+];
+/**
+ * The allowlist for a project. Only the script NAMES are read from the
+ * manifest; the argv is fixed here (`npm run <name>`, `cargo test`, ...).
+ */
+export function reverifyChecks(root) {
+    const checks = [];
+    try {
+        const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+        const scripts = pkg && typeof pkg.scripts === 'object' && pkg.scripts !== null ? pkg.scripts : {};
+        for (const [name, kind] of NPM_SCRIPTS) {
+            if (typeof scripts[name] === 'string' && scripts[name].trim())
+                checks.push({ name: `npm:${name}`, kind, argv: ['npm', 'run', name] });
+        }
+    }
+    catch {
+        // no or unreadable package.json: no npm checks
+    }
+    if (existsSync(join(root, 'Cargo.toml'))) {
+        checks.push({ name: 'cargo:test', kind: 'test', argv: ['cargo', 'test'] });
+        checks.push({ name: 'cargo:check', kind: 'typecheck', argv: ['cargo', 'check'] });
+    }
+    return checks;
+}
+/**
+ * The check to run for a record decided by a `used` verifier: round-robin by
+ * `cursor` over the checks of another kind, or over all of them when every
+ * check is that kind. Null when the project has none.
+ */
+export function pickCheck(checks, used, cursor) {
+    if (checks.length === 0)
+        return null;
+    const others = checks.filter(c => c.kind !== used);
+    const pool = others.length > 0 ? others : checks;
+    return pool[Math.abs(Math.floor(cursor)) % pool.length];
+}
+const COMMIT = /^[0-9a-f]{40,64}$/;
+function git(args, cwd, timeout = 60_000) {
+    return new Promise((resolve, reject) => {
+        execFile('git', args, { cwd, timeout, maxBuffer: 1024 * 1024 }, (error, stdout) => (error ? reject(error) : resolve(String(stdout))));
+    });
+}
+/** Runs argv (no shell) in `cwd`; the whole process group is killed at the timeout. */
+function runCheck(argv, cwd, timeoutMs) {
+    return new Promise(resolve => {
+        let settled = false;
+        const finish = (status) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(status);
+        };
+        let child;
+        try {
+            child = spawn(argv[0], argv.slice(1), { cwd, shell: false, stdio: 'ignore', detached: process.platform !== 'win32', env: { ...process.env, CI: '1' } });
+        }
+        catch {
+            resolve('error');
+            return;
+        }
+        const timer = setTimeout(() => {
+            try {
+                if (child.pid && process.platform !== 'win32')
+                    process.kill(-child.pid, 'SIGKILL');
+                else
+                    child.kill('SIGKILL');
+            }
+            catch {
+                // already gone
+            }
+            finish('timeout');
+        }, timeoutMs);
+        child.on('error', () => finish('error'));
+        child.on('exit', code => finish(code === 0 ? 'pass' : 'fail'));
+    });
+}
+/**
+ * The real runner: a detached `git worktree` at HEAD in a temp directory, the
+ * root's `node_modules` linked in (a fresh worktree has none), the check run,
+ * the worktree removed. Any failure along the way is `error`.
+ */
+export const gitWorktreeRunner = async (root, check, timeoutMs) => {
+    let commit = null;
+    const base = mkdtempSync(join(tmpdir(), 'ruflo-reverify-'));
+    const dir = join(base, 'wt');
+    let added = false;
+    try {
+        const head = (await git(['rev-parse', 'HEAD'], root, 10_000)).trim();
+        if (!COMMIT.test(head))
+            return { status: 'error', commit: null };
+        commit = head;
+        await git(['worktree', 'add', '--detach', dir, head], root);
+        added = true;
+        if (existsSync(join(root, 'node_modules')) && !existsSync(join(dir, 'node_modules')))
+            symlinkSync(join(root, 'node_modules'), join(dir, 'node_modules'), 'dir');
+        return { status: await runCheck(check.argv, dir, timeoutMs), commit };
+    }
+    catch {
+        return { status: 'error', commit };
+    }
+    finally {
+        if (added)
+            await git(['worktree', 'remove', '--force', dir], root).catch(() => undefined);
+        rmSync(base, { recursive: true, force: true });
+        if (added)
+            await git(['worktree', 'prune'], root).catch(() => undefined);
+    }
+};
+/** A runner that never settles still ends: past the deadline its outcome is `timeout`. */
+function withDeadline(run, ms) {
+    let timer;
+    const deadline = new Promise(resolve => {
+        timer = setTimeout(() => resolve({ status: 'timeout', commit: null }), ms);
+        timer.unref?.();
+    });
+    return Promise.race([run, deadline]).finally(() => clearTimeout(timer));
+}
+/** One ingest's re-verification: picks per record, runs each distinct check at most once, never throws. */
+export class ReverifySession {
+    root;
+    cursor;
+    timeoutMs;
+    runner;
+    results = new Map();
+    checks;
+    ran = 0;
+    constructor(root, cursor, timeoutMs, runner, checks) {
+        this.root = root;
+        this.cursor = cursor;
+        this.timeoutMs = timeoutMs;
+        this.runner = runner;
+        this.checks = checks ?? reverifyChecks(root);
+    }
+    /** Re-verifies a success decided by a `used` verifier. The record's own command and task are never passed. */
+    async verify(used) {
+        const check = pickCheck(this.checks, used, this.cursor);
+        if (!check)
+            return { check: null, outcome: { status: 'error', commit: null } };
+        let pending = this.results.get(check.name);
+        if (!pending) {
+            this.ran++;
+            pending = withDeadline(Promise.resolve().then(() => this.runner(this.root, check, this.timeoutMs)), this.timeoutMs + Math.min(this.timeoutMs, 30_000)).then(o => (o && ['pass', 'fail', 'timeout', 'error'].includes(o.status) ? { status: o.status, commit: typeof o.commit === 'string' && COMMIT.test(o.commit) ? o.commit : null } : { status: 'error', commit: null }), () => ({ status: 'error', commit: null }));
+            this.results.set(check.name, pending);
+        }
+        return { check: check.name, outcome: await pending };
+    }
+}
+//# sourceMappingURL=verified-reverify.js.map

package/dist/src/missions/schemas.d.ts

@@ -45,12 +45,12 @@ export declare const missionRecordSchema: z.ZodObject<{
         digest: z.ZodString;
         taskGraphRef: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        revision: number;
         digest: string;
+        revision: number;
         taskGraphRef: string;
     }, {
-        revision: number;
         digest: string;
+        revision: number;
         taskGraphRef: string;
     }>;
     policyRef: z.ZodString;
@@ -74,54 +74,54 @@ export declare const missionRecordSchema: z.ZodObject<{
     updatedAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     createdAt: string;
-    state: "completed" | "cancelled" | "failed" | "running" | "queued" | "paused" | "blocked" | "draft" | "planned" | "awaitingAuthorization" | "pauseRequested" | "verifying" | "cancelRequested";
+    updatedAt: string;
     schemaVersion: 1;
-    revision: number;
-    objective: string;
-    plan: {
+    state: "completed" | "cancelled" | "failed" | "blocked" | "running" | "paused" | "queued" | "draft" | "planned" | "awaitingAuthorization" | "pauseRequested" | "verifying" | "cancelRequested";
+    acceptance: {
         revision: number;
+        criteriaDigest: string;
+    };
+    plan: {
         digest: string;
+        revision: number;
         taskGraphRef: string;
     };
+    objective: string;
     missionId: string;
-    updatedAt: string;
     tenantId: string;
     workspaceId: string;
     ownerPrincipalId: string;
+    revision: number;
     policyRef: string;
     budgetRef: string;
     executionMode: "durable-executor" | "session-bound";
     evidenceRefs: string[];
-    acceptance: {
-        revision: number;
-        criteriaDigest: string;
-    };
     lastEventSequence: number;
     authorizationRef?: string | undefined;
 }, {
     createdAt: string;
-    state: "completed" | "cancelled" | "failed" | "running" | "queued" | "paused" | "blocked" | "draft" | "planned" | "awaitingAuthorization" | "pauseRequested" | "verifying" | "cancelRequested";
+    updatedAt: string;
     schemaVersion: 1;
-    revision: number;
-    objective: string;
-    plan: {
+    state: "completed" | "cancelled" | "failed" | "blocked" | "running" | "paused" | "queued" | "draft" | "planned" | "awaitingAuthorization" | "pauseRequested" | "verifying" | "cancelRequested";
+    acceptance: {
         revision: number;
+        criteriaDigest: string;
+    };
+    plan: {
         digest: string;
+        revision: number;
         taskGraphRef: string;
     };
+    objective: string;
     missionId: string;
-    updatedAt: string;
     tenantId: string;
     workspaceId: string;
     ownerPrincipalId: string;
+    revision: number;
     policyRef: string;
     budgetRef: string;
     executionMode: "durable-executor" | "session-bound";
     evidenceRefs: string[];
-    acceptance: {
-        revision: number;
-        criteriaDigest: string;
-    };
     lastEventSequence: number;
     authorizationRef?: string | undefined;
 }>;
@@ -207,15 +207,15 @@ export declare const budgetSpecSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     currency: string;
     ceilingMinor: number;
-    tokens?: number | undefined;
     concurrency?: number | undefined;
+    tokens?: number | undefined;
     wallTimeSeconds?: number | undefined;
     retries?: number | undefined;
 }, {
     currency: string;
     ceilingMinor: number;
-    tokens?: number | undefined;
     concurrency?: number | undefined;
+    tokens?: number | undefined;
     wallTimeSeconds?: number | undefined;
     retries?: number | undefined;
 }>;
@@ -301,15 +301,15 @@ export declare const planBodySchema: z.ZodObject<{
     }, "strict", z.ZodTypeAny, {
         currency: string;
         ceilingMinor: number;
-        tokens?: number | undefined;
         concurrency?: number | undefined;
+        tokens?: number | undefined;
         wallTimeSeconds?: number | undefined;
         retries?: number | undefined;
     }, {
         currency: string;
         ceilingMinor: number;
-        tokens?: number | undefined;
         concurrency?: number | undefined;
+        tokens?: number | undefined;
         wallTimeSeconds?: number | undefined;
         retries?: number | undefined;
     }>;
@@ -340,8 +340,8 @@ export declare const planBodySchema: z.ZodObject<{
     budget: {
         currency: string;
         ceilingMinor: number;
-        tokens?: number | undefined;
         concurrency?: number | undefined;
+        tokens?: number | undefined;
         wallTimeSeconds?: number | undefined;
         retries?: number | undefined;
     };
@@ -372,8 +372,8 @@ export declare const planBodySchema: z.ZodObject<{
     budget: {
         currency: string;
         ceilingMinor: number;
-        tokens?: number | undefined;
         concurrency?: number | undefined;
+        tokens?: number | undefined;
         wallTimeSeconds?: number | undefined;
         retries?: number | undefined;
     };
@@ -397,11 +397,11 @@ export declare const createInputSchema: z.ZodObject<{
     requestId: z.ZodString;
     objective: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    objective: string;
     requestId: string;
-}, {
     objective: string;
+}, {
     requestId: string;
+    objective: string;
 }>;
 export declare const planInputSchema: z.ZodObject<{
     requestId: z.ZodString;
@@ -489,15 +489,15 @@ export declare const planInputSchema: z.ZodObject<{
         }, "strict", z.ZodTypeAny, {
             currency: string;
             ceilingMinor: number;
-            tokens?: number | undefined;
             concurrency?: number | undefined;
+            tokens?: number | undefined;
             wallTimeSeconds?: number | undefined;
             retries?: number | undefined;
         }, {
             currency: string;
             ceilingMinor: number;
-            tokens?: number | undefined;
             concurrency?: number | undefined;
+            tokens?: number | undefined;
             wallTimeSeconds?: number | undefined;
             retries?: number | undefined;
         }>;
@@ -528,8 +528,8 @@ export declare const planInputSchema: z.ZodObject<{
         budget: {
             currency: string;
             ceilingMinor: number;
-            tokens?: number | undefined;
             concurrency?: number | undefined;
+            tokens?: number | undefined;
             wallTimeSeconds?: number | undefined;
             retries?: number | undefined;
         };
@@ -560,8 +560,8 @@ export declare const planInputSchema: z.ZodObject<{
         budget: {
             currency: string;
             ceilingMinor: number;
-            tokens?: number | undefined;
             concurrency?: number | undefined;
+            tokens?: number | undefined;
             wallTimeSeconds?: number | undefined;
             retries?: number | undefined;
         };
@@ -601,8 +601,8 @@ export declare const planInputSchema: z.ZodObject<{
         budget: {
             currency: string;
             ceilingMinor: number;
-            tokens?: number | undefined;
             concurrency?: number | undefined;
+            tokens?: number | undefined;
             wallTimeSeconds?: number | undefined;
             retries?: number | undefined;
         };
@@ -638,8 +638,8 @@ export declare const planInputSchema: z.ZodObject<{
         budget: {
             currency: string;
             ceilingMinor: number;
-            tokens?: number | undefined;
             concurrency?: number | undefined;
+            tokens?: number | undefined;
             wallTimeSeconds?: number | undefined;
             retries?: number | undefined;
         };
@@ -687,13 +687,13 @@ export declare const requestActionInputSchema: z.ZodObject<{
     action: z.ZodEnum<["pause", "resume", "cancel", "requestAuthorization", "admit"]>;
     reason: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
-    action: "pause" | "resume" | "cancel" | "admit" | "requestAuthorization";
+    action: "pause" | "resume" | "cancel" | "requestAuthorization" | "admit";
     requestId: string;
     missionId: string;
     expectedRevision: number;
     reason?: string | undefined;
 }, {
-    action: "pause" | "resume" | "cancel" | "admit" | "requestAuthorization";
+    action: "pause" | "resume" | "cancel" | "requestAuthorization" | "admit";
     requestId: string;
     missionId: string;
     expectedRevision: number;

package/dist/src/mods/apply.d.ts

@@ -18,6 +18,8 @@ export interface ApplyOptions {
     skipInTestEnv?: boolean;
     /** The marketplace to declare when the settings have none (default github ruvnet/ruflo). */
     marketplace?: MarketplaceEntry;
+    /** ADR-509 §2.2: plugins (name or id) to install past a high scan finding; each override is recorded. */
+    acceptRisk?: readonly string[];
     /** Injectable for tests. */
     exec?: Exec;
 }

package/dist/src/mods/apply.js

@@ -7,9 +7,10 @@
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { output } from '../output.js';
-import { installMod, MARKETPLACE_NAME, MARKETPLACE_SOURCE, MOD_PLUGINS, readRecord, recordClaudeInstalled, scopeOfSettingsFile, uninstallMod, } from './install.js';
+import { disableBlockedPlugins, installMod, MARKETPLACE_NAME, MARKETPLACE_SOURCE, MOD_PLUGIN_IDS, MOD_PLUGINS, readRecord, readSettingsFile, settingsFileFor, recordClaudeInstalled, scopeOfSettingsFile, uninstallMod, } from './install.js';
 import { findClaudeBinary, installArgv, marketplaceArgv, repairPluginInstall, uninstallArgv, uninstallPlugins } from './plugin-repair.js';
 import { claudeConfigDir, describeSource, installedState, marketplaceState, repairCommands, resolveFindings, sameSource } from './plugin-resolve.js';
+import { scanBeforeInstall, verifyAndRecord } from './install-trust.js';
 /** One line per thing a run added; empty on a re-run. */
 export function describeAdded(added) {
     return [
@@ -68,14 +69,39 @@ function noteRewrite(file, before) {
         // Not ours to judge further.
     }
 }
+/** The marketplace the settings file already declares, else the requested one. */
+function declaredMarketplace(root, scope, requested) {
+    try {
+        const markets = readSettingsFile(settingsFileFor(root, scope)).extraKnownMarketplaces;
+        return markets?.[MARKETPLACE_NAME] ?? requested;
+    }
+    catch {
+        return requested;
+    }
+}
 export async function applyMods(root, opts) {
-    const install = installMod(root, opts.scope, opts.dryRun === true, undefined, opts.marketplace ?? MARKETPLACE_SOURCE);
     const configDir = claudeConfigDir(process.env, homedir());
+    const acceptRisk = new Set(opts.acceptRisk ?? []);
+    const seen = new Set();
+    const blocked = new Map();
+    const told = new Set();
+    // ADR-509 §2.2: Claude Code loads an enabled plugin straight from the
+    // marketplace clone, install or not. So where a clone already exists, scan it
+    // BEFORE enabling anything from it, and never enable what the scan blocks.
+    const preClone = opts.dryRun ? null : marketplaceState(configDir).location;
+    const scannable = declaredMarketplace(root, opts.scope, opts.marketplace ?? MARKETPLACE_SOURCE).source.source !== 'directory';
+    if (preClone && scannable) {
+        for (const [id, why] of scanBeforeInstall(root, preClone, MOD_PLUGINS, acceptRisk, undefined, seen).blocked)
+            blocked.set(id, why);
+    }
+    const install = installMod(root, opts.scope, opts.dryRun === true, MOD_PLUGIN_IDS.filter((id) => !blocked.has(id)), opts.marketplace ?? MARKETPLACE_SOURCE);
+    // A blocked plugin enabled by an earlier run (or by hand) is turned off too.
+    turnOff(root, install, blocked, told);
     const lines = describeAdded(install.added);
     // Only what is enabled in the file: `claude plugin install` would flip a
     // plugin someone set to false back to true.
     const enabled = (install.next.enabledPlugins ?? {});
-    const plugins = MOD_PLUGINS.filter((p) => enabled[p.id] === true);
+    const plugins = MOD_PLUGINS.filter((p) => enabled[p.id] === true && !blocked.has(p.id));
     // The marketplace the file declares wins: a person's own declaration is kept and used.
     const declared = install.next.extraKnownMarketplaces?.[MARKETPLACE_NAME] ?? MARKETPLACE_SOURCE;
     const market = marketplaceState(configDir);
@@ -111,16 +137,25 @@ export async function applyMods(root, opts) {
         for (const line of repairCommands(root, opts.scope, k, plugins, declared))
             output.writeln(`  ${line}`);
     };
-    if (opts.pluginInstall === false)
-        return { install, resolvable: true, skipped: '--no-plugin-install' };
+    // The `claude` step may not run below: say what is enabled without a scan.
+    const unscanned = () => {
+        if (!preClone && scannable && plugins.length)
+            output.printWarning(`No ruflo marketplace clone yet, so nothing was scanned (ADR-509): ${plugins.map((p) => p.id).join(', ')} enabled unscanned; Claude Code clones it on the first trusted start. Run ruflo mods install again after that to scan it.`);
+    };
+    if (opts.pluginInstall === false) {
+        unscanned();
+        return { install, resolvable: blocked.size === 0, skipped: '--no-plugin-install' };
+    }
     if (opts.skipInTestEnv && (process.env.VITEST || process.env.CI)) {
         output.writeln(output.dim(`claude plugin step skipped (${process.env.VITEST ? 'VITEST' : 'CI'} set).`));
+        unscanned();
         manual();
         return { install, resolvable: false, skipped: 'test or CI environment' };
     }
     const claude = findClaudeBinary(process.env, homedir());
     if (!claude) {
         output.printWarning('No runnable claude binary on PATH: the plugins are enabled in settings, not installed.');
+        unscanned();
         manual();
         return { install, resolvable: false, skipped: 'no claude on PATH' };
     }
@@ -130,8 +165,21 @@ export async function applyMods(root, opts) {
     // Never claim (and so never uninstall) a plugin that was installed before, or one ruflo did not enable.
     const before = new Set(plugins.filter((p) => installedState(root, configDir, p.id).installed).map((p) => p.id));
     const textBefore = readText(install.settingsFile);
-    const repair = await repairPluginInstall({ projectRoot: root, scope: opts.scope, configDir, claude, plugins, marketplace: declared, exec: opts.exec });
+    const repair = await repairPluginInstall({
+        projectRoot: root, scope: opts.scope, configDir, claude, plugins, marketplace: declared, exec: opts.exec,
+        // ADR-509 §2.2: scan the refreshed clone before any install (a directory marketplace has no install step to gate).
+        beforeInstall: (clone) => {
+            const gate = scanBeforeInstall(root, clone, plugins, acceptRisk, undefined, seen);
+            for (const [id, why] of gate.blocked)
+                blocked.set(id, why);
+            return gate;
+        },
+    });
     printSteps(repair.steps);
+    // The refresh may have brought a finding the first scan did not see: that plugin is turned off as well.
+    turnOff(root, install, blocked, told);
+    // ADR-509 §2.1: verify what Claude Code will load and leave the result for the mod's trust gate.
+    verifyAndRecord(configDir, marketplaceState(configDir).location, plugins.map((p) => p.id.split('@')[0]));
     if (declared.source.source === 'directory' && repair.ok)
         output.writeln(output.dim(`Directory marketplace: plugins load live from ${declared.source.path} (no clone, no install).`));
     const enabledByRuflo = new Set(readRecord(root)?.files[install.settingsFile]?.plugins ?? []);
@@ -141,8 +189,8 @@ export async function applyMods(root, opts) {
         .filter((id) => !before.has(id) && enabledByRuflo.has(id));
     recordClaudeInstalled(root, install.settingsFile, ours);
     noteRewrite(install.settingsFile, textBefore);
-    const failed = resolveFindings(root, opts.scope, configDir, undefined, plugins.map((p) => p.id), declared).filter((f) => f.status === 'fail');
-    if (repair.ok && failed.length === 0)
+    const failed = resolveFindings(root, opts.scope, configDir, undefined, plugins.filter((p) => !blocked.has(p.id)).map((p) => p.id), declared).filter((f) => f.status === 'fail');
+    if (repair.ok && failed.length === 0 && blocked.size === 0)
         return { install, resolvable: true };
     for (const f of failed)
         output.writeln(`${output.error('✗')} ${f.name}: ${f.message}`);
@@ -150,6 +198,18 @@ export async function applyMods(root, opts) {
     manual(now.known && sameSource(now.source, declared.source));
     return { install, resolvable: false };
 }
+/** ADR-509 §2.2: turn off (enabledPlugins + install record) each blocked plugin, and say so. */
+function turnOff(root, install, blocked, told) {
+    if (install.dryRun || blocked.size === 0)
+        return;
+    const off = disableBlockedPlugins(root, install.settingsFile, [...blocked.keys()]);
+    for (const [id, why] of blocked) {
+        if (told.has(id) && !off.includes(id))
+            continue; // already said, and nothing changed since
+        told.add(id);
+        output.writeln(`${output.error('✗')} ${id}: ${off.includes(id) ? `enabledPlugins["${id}"] removed from ${install.settingsFile}` : 'not enabled'}; ${why}`);
+    }
+}
 /**
  * `ruflo mods uninstall`: `claude plugin uninstall` exactly the plugins ruflo
  * installed, then remove exactly the settings keys it added.