@claude-flow/cli 3.63.9 → 3.65.0

package/dist/src/mods/compact-snapshots.d.ts

@@ -0,0 +1,21 @@
+/**
+ * ADR-505: `ruflo doctor` check for ruflo-mods compaction snapshots.
+ *
+ * The `compactSnapshot` option (default on) writes conversation text to
+ * `.claude-flow/sessions/compactions/`. `ruflo init` gitignores it through
+ * `.claude-flow/.gitignore` (`sessions/`); a project whose ignore rules lost
+ * that would commit transcripts. Warn-only: when snapshots exist and git does
+ * not ignore them. No snapshots, or not a git work tree, is a pass.
+ */
+export declare const COMPACTIONS_DIR = ".claude-flow/sessions/compactions";
+export type SnapshotHealth = {
+    status: 'pass' | 'warn';
+    message: string;
+    fix?: string;
+};
+/** `ignored`: git ignores the path; `not-ignored`: it would be committed; `no-git`: not a work tree or git missing. */
+export type IgnoreState = 'ignored' | 'not-ignored' | 'no-git';
+/** `git check-ignore -q`: exit 0 ignored, 1 not ignored, anything else (128: not a repo; ENOENT: no git) no answer. */
+export declare function gitIgnoreState(root: string, relPath: string): IgnoreState;
+export declare function compactSnapshotHealth(root: string, ignoreState?: (root: string, relPath: string) => IgnoreState): SnapshotHealth;
+//# sourceMappingURL=compact-snapshots.d.ts.map

package/dist/src/mods/compact-snapshots.js

@@ -0,0 +1,45 @@
+/**
+ * ADR-505: `ruflo doctor` check for ruflo-mods compaction snapshots.
+ *
+ * The `compactSnapshot` option (default on) writes conversation text to
+ * `.claude-flow/sessions/compactions/`. `ruflo init` gitignores it through
+ * `.claude-flow/.gitignore` (`sessions/`); a project whose ignore rules lost
+ * that would commit transcripts. Warn-only: when snapshots exist and git does
+ * not ignore them. No snapshots, or not a git work tree, is a pass.
+ */
+import { execFileSync } from 'node:child_process';
+import { readdirSync } from 'node:fs';
+import { join } from 'node:path';
+export const COMPACTIONS_DIR = '.claude-flow/sessions/compactions';
+/** `git check-ignore -q`: exit 0 ignored, 1 not ignored, anything else (128: not a repo; ENOENT: no git) no answer. */
+export function gitIgnoreState(root, relPath) {
+    try {
+        execFileSync('git', ['check-ignore', '-q', '--', relPath], { cwd: root, stdio: 'ignore', timeout: 5000 });
+        return 'ignored';
+    }
+    catch (error) {
+        return error.status === 1 ? 'not-ignored' : 'no-git';
+    }
+}
+export function compactSnapshotHealth(root, ignoreState = gitIgnoreState) {
+    let files;
+    try {
+        files = readdirSync(join(root, COMPACTIONS_DIR)).filter((name) => name.endsWith('.jsonl'));
+    }
+    catch {
+        files = [];
+    }
+    if (files.length === 0)
+        return { status: 'pass', message: 'no compaction snapshots in this project' };
+    const sample = `${COMPACTIONS_DIR}/${files.sort()[0]}`;
+    const state = ignoreState(root, sample);
+    if (state === 'not-ignored') {
+        return {
+            status: 'warn',
+            message: `${files.length} compaction snapshot(s) in ${COMPACTIONS_DIR}/ hold conversation text and git does not ignore them`,
+            fix: 'add .claude-flow/ (or .claude-flow/sessions/) to .gitignore, or set the ruflo-mods compactSnapshot option to false',
+        };
+    }
+    return { status: 'pass', message: `${files.length} compaction snapshot(s), ${state === 'ignored' ? 'ignored by git' : 'not in a git work tree'}` };
+}
+//# sourceMappingURL=compact-snapshots.js.map

package/dist/src/mods/headless-check.d.ts

@@ -0,0 +1,58 @@
+/**
+ * ADR-510 §2.4 — `ruflo doctor --component headless-plugins`: do ruflo mods
+ * actually run under `claude -p` on this machine?
+ *
+ * Runs `claude -p --plugin-dir <ruflo-mods> --output-format stream-json
+ * --verbose "reply ok"` in a throwaway project that has a `.claude-flow/`
+ * directory, then reports:
+ *   - whether the init event lists ruflo-mods from that folder;
+ *   - whether `plugin_errors` is empty (Claude Code omits the key when none);
+ *   - whether the mod's session heartbeat (`.claude-flow/mods/session.json`)
+ *     was written — the proof that its function hooks ran.
+ *
+ * The runner is injectable so tests never spawn `claude` or need a key.
+ * Without any model credential the check is skipped (warn), never spawned.
+ */
+import { type PluginPaths } from './plugin-paths.js';
+export declare const HEADLESS_TIMEOUT_MS = 60000;
+export declare const HEARTBEAT: string;
+export interface HeadlessRun {
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    timedOut?: boolean;
+}
+export type HeadlessRunner = (argv: string[], env: NodeJS.ProcessEnv, cwd: string, timeoutMs: number) => Promise<HeadlessRun>;
+export interface HeadlessCheck {
+    name: string;
+    status: 'pass' | 'warn' | 'fail';
+    message: string;
+    fix?: string;
+}
+export interface HeadlessCheckDeps {
+    runner?: HeadlessRunner;
+    resolve?: () => PluginPaths;
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    /** Throwaway project dir factory (must be removable afterwards). */
+    makeProject?: () => string;
+    exists?: (path: string) => boolean;
+    timeoutMs?: number;
+    model?: string;
+}
+export declare const spawnHeadless: HeadlessRunner;
+/** A model credential Claude Code could use; without one the check would only fail on auth. */
+export declare function hasModelCredential(env: NodeJS.ProcessEnv, configDir: string, exists?: (p: string) => boolean): boolean;
+interface InitEvent {
+    plugins?: Array<{
+        name?: string;
+        path?: string;
+        source?: string;
+    }>;
+    plugin_errors?: unknown[];
+}
+/** The `system/init` event of a stream-json run, if any. */
+export declare function findInitEvent(stdout: string): InitEvent | null;
+export declare function checkHeadlessPlugins(deps?: HeadlessCheckDeps): Promise<HeadlessCheck>;
+export {};
+//# sourceMappingURL=headless-check.d.ts.map

package/dist/src/mods/headless-check.js

@@ -0,0 +1,137 @@
+/**
+ * ADR-510 §2.4 — `ruflo doctor --component headless-plugins`: do ruflo mods
+ * actually run under `claude -p` on this machine?
+ *
+ * Runs `claude -p --plugin-dir <ruflo-mods> --output-format stream-json
+ * --verbose "reply ok"` in a throwaway project that has a `.claude-flow/`
+ * directory, then reports:
+ *   - whether the init event lists ruflo-mods from that folder;
+ *   - whether `plugin_errors` is empty (Claude Code omits the key when none);
+ *   - whether the mod's session heartbeat (`.claude-flow/mods/session.json`)
+ *     was written — the proof that its function hooks ran.
+ *
+ * The runner is injectable so tests never spawn `claude` or need a key.
+ * Without any model credential the check is skipped (warn), never spawned.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { ENABLE_ENV } from './install.js';
+import { claudeConfigDir } from './plugin-resolve.js';
+import { resolvePluginPaths } from './plugin-paths.js';
+export const HEADLESS_TIMEOUT_MS = 60_000;
+export const HEARTBEAT = join('.claude-flow', 'mods', 'session.json');
+const PLUGIN = 'ruflo-mods';
+const NAME = 'Headless plugins (ADR-510)';
+export const spawnHeadless = (argv, env, cwd, timeoutMs) => new Promise((done) => {
+    let stdout = '';
+    let stderr = '';
+    let timedOut = false;
+    let child;
+    try {
+        child = spawn('claude', argv, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+    }
+    catch (e) {
+        done({ exitCode: null, stdout: '', stderr: e instanceof Error ? e.message : String(e) });
+        return;
+    }
+    const timer = setTimeout(() => {
+        timedOut = true;
+        try {
+            child.kill('SIGTERM');
+        }
+        catch { /* already gone */ }
+    }, timeoutMs);
+    child.stdout?.on('data', (d) => { stdout += d.toString(); });
+    child.stderr?.on('data', (d) => { stderr += d.toString(); });
+    child.on('error', (e) => { clearTimeout(timer); done({ exitCode: null, stdout, stderr: e.message, timedOut }); });
+    child.on('close', (code) => { clearTimeout(timer); done({ exitCode: code, stdout, stderr, timedOut }); });
+});
+/** A model credential Claude Code could use; without one the check would only fail on auth. */
+export function hasModelCredential(env, configDir, exists = existsSync) {
+    const keys = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_BASE_URL', 'CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX'];
+    if (keys.some((k) => !!env[k]))
+        return true;
+    // macOS keeps the login in the keychain, which we cannot see from here.
+    if (process.platform === 'darwin')
+        return true;
+    return exists(join(configDir, '.credentials.json'));
+}
+/** The `system/init` event of a stream-json run, if any. */
+export function findInitEvent(stdout) {
+    for (const line of stdout.split('\n')) {
+        const t = line.trim();
+        if (!t.startsWith('{'))
+            continue;
+        try {
+            const ev = JSON.parse(t);
+            if (ev.type === 'system' && ev.subtype === 'init')
+                return ev;
+        }
+        catch {
+            // not a JSON line
+        }
+    }
+    return null;
+}
+const canonical = (p) => {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+};
+export async function checkHeadlessPlugins(deps = {}) {
+    const env = deps.env ?? process.env;
+    const exists = deps.exists ?? existsSync;
+    const paths = (deps.resolve ?? (() => resolvePluginPaths([PLUGIN], { env, home: deps.home })))();
+    const mods = paths.resolved.find((p) => p.name === PLUGIN);
+    if (!mods) {
+        const why = paths.missing.find((m) => m.name === PLUGIN)?.reason ?? 'not found';
+        return { name: NAME, status: 'warn', message: `${PLUGIN} not found (${why}); headless workers run without it`, fix: 'ruflo mods install' };
+    }
+    const configDir = claudeConfigDir(env, deps.home ?? homedir());
+    if (!deps.runner && !hasModelCredential(env, configDir, exists)) {
+        return { name: NAME, status: 'warn', message: `skipped: no model credential for claude -p (${PLUGIN} resolves to ${mods.path})`, fix: 'set ANTHROPIC_API_KEY or run `claude login`, then re-run' };
+    }
+    const project = (deps.makeProject ?? (() => mkdtempSync(join(tmpdir(), 'ruflo-headless-'))))();
+    try {
+        mkdirSync(join(project, '.claude-flow'), { recursive: true });
+        const argv = ['-p', 'reply ok', '--plugin-dir', mods.path, '--output-format', 'stream-json', '--verbose', '--model', deps.model ?? 'haiku'];
+        const runEnv = { ...env, CLAUDE_ENTRYPOINT: 'worker' };
+        if (runEnv[ENABLE_ENV] === undefined)
+            runEnv[ENABLE_ENV] = '1';
+        delete runEnv.CLAUDE_SESSION_ID;
+        delete runEnv.CLAUDE_PARENT_SESSION_ID;
+        const run = await (deps.runner ?? spawnHeadless)(argv, runEnv, project, deps.timeoutMs ?? HEADLESS_TIMEOUT_MS);
+        if (run.timedOut) {
+            return { name: NAME, status: 'fail', message: `claude -p did not finish in ${(deps.timeoutMs ?? HEADLESS_TIMEOUT_MS) / 1000}s` };
+        }
+        const init = findInitEvent(run.stdout);
+        if (!init) {
+            const tail = (run.stderr || run.stdout).trim().split('\n').slice(-1)[0] ?? '';
+            return { name: NAME, status: 'fail', message: `no init event from claude -p (exit ${run.exitCode})${tail ? `: ${tail.slice(0, 200)}` : ''}`, fix: 'ruflo doctor -c claude' };
+        }
+        const want = canonical(mods.path);
+        const listed = (init.plugins ?? []).some((p) => p.name === PLUGIN && typeof p.path === 'string' && canonical(p.path) === want);
+        const errors = Array.isArray(init.plugin_errors) ? init.plugin_errors : [];
+        const heartbeat = exists(join(project, HEARTBEAT));
+        const facts = `init lists ${PLUGIN}: ${listed ? 'yes' : 'no'}; plugin_errors: ${errors.length === 0 ? 'none' : JSON.stringify(errors).slice(0, 200)}; heartbeat: ${heartbeat ? 'written' : 'absent'}`;
+        if (!listed || errors.length > 0) {
+            return { name: NAME, status: 'fail', message: `${facts} (${mods.path})`, fix: `claude -p --plugin-dir ${JSON.stringify(mods.path)} --output-format stream-json --verbose "reply ok"` };
+        }
+        if (!heartbeat) {
+            return { name: NAME, status: 'warn', message: `${facts}: the plugin loads but its function hooks did not run (Claude Code too old, or ${ENABLE_ENV}=0)` };
+        }
+        return { name: NAME, status: 'pass', message: `${facts} (${mods.source}: ${mods.path})` };
+    }
+    finally {
+        try {
+            rmSync(project, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+    }
+}
+//# sourceMappingURL=headless-check.js.map

package/dist/src/mods/headless-plugins.d.ts

@@ -0,0 +1,44 @@
+/**
+ * ADR-510 §2.2 — give a headless `claude -p` worker its ruflo plugins.
+ *
+ * Every place ruflo builds a `claude -p` command line passes its argv and env
+ * through `withHeadlessPlugins`. It appends `--plugin-dir <path>` per plugin
+ * in the worker profile (default: ruflo-mods) and sets
+ * `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1` unless the caller set it (a caller's
+ * `0` stays `0`). A caller's own `--plugin-dir` for the same plugin is never
+ * duplicated.
+ *
+ * A plugin that cannot be resolved does not stop the worker: it is logged once
+ * per process ("plugin <name> not found; worker runs without it") and returned
+ * in `missing` for the worker's status.
+ *
+ * Profile override: `RUFLO_HEADLESS_PLUGINS` is a comma list of plugin names;
+ * `none` (or an empty value) turns plugin loading off.
+ */
+import { type ResolveOptions, type PluginPaths } from './plugin-paths.js';
+export declare const DEFAULT_WORKER_PLUGINS: readonly string[];
+export declare const PROFILE_ENV = "RUFLO_HEADLESS_PLUGINS";
+export interface HeadlessPluginOptions extends ResolveOptions {
+    /** Plugin names to load; defaults to the env profile, else DEFAULT_WORKER_PLUGINS. */
+    profile?: readonly string[];
+    /** Where the once-per-process warning goes (default: stderr). */
+    warn?: (line: string) => void;
+    /** Injectable resolver, for tests. */
+    resolver?: (names: readonly string[], opts: ResolveOptions) => PluginPaths;
+}
+export interface HeadlessPluginResult<E> {
+    argv: string[];
+    env: E;
+    /** Plugins loaded via --plugin-dir by this call (not the caller's own). */
+    added: string[];
+    /** Plugins in the profile that could not be resolved. */
+    missing: string[];
+}
+/** For tests: forget which missing plugins were already logged. */
+export declare function resetHeadlessPluginWarnings(): void;
+/** The worker profile: explicit, else RUFLO_HEADLESS_PLUGINS, else ruflo-mods. */
+export declare function workerProfile(env?: NodeJS.ProcessEnv, explicit?: readonly string[]): string[];
+/** Every `--plugin-dir` value already in argv (both `--plugin-dir x` and `--plugin-dir=x`). */
+export declare function existingPluginDirs(argv: readonly string[]): string[];
+export declare function withHeadlessPlugins<E extends Record<string, string | undefined>>(argv: readonly string[], env: E, opts?: HeadlessPluginOptions): HeadlessPluginResult<E>;
+//# sourceMappingURL=headless-plugins.d.ts.map

package/dist/src/mods/headless-plugins.js

@@ -0,0 +1,92 @@
+/**
+ * ADR-510 §2.2 — give a headless `claude -p` worker its ruflo plugins.
+ *
+ * Every place ruflo builds a `claude -p` command line passes its argv and env
+ * through `withHeadlessPlugins`. It appends `--plugin-dir <path>` per plugin
+ * in the worker profile (default: ruflo-mods) and sets
+ * `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1` unless the caller set it (a caller's
+ * `0` stays `0`). A caller's own `--plugin-dir` for the same plugin is never
+ * duplicated.
+ *
+ * A plugin that cannot be resolved does not stop the worker: it is logged once
+ * per process ("plugin <name> not found; worker runs without it") and returned
+ * in `missing` for the worker's status.
+ *
+ * Profile override: `RUFLO_HEADLESS_PLUGINS` is a comma list of plugin names;
+ * `none` (or an empty value) turns plugin loading off.
+ */
+import { realpathSync } from 'node:fs';
+import { basename, resolve } from 'node:path';
+import { ENABLE_ENV } from './install.js';
+import { resolvePluginPaths } from './plugin-paths.js';
+export const DEFAULT_WORKER_PLUGINS = ['ruflo-mods'];
+export const PROFILE_ENV = 'RUFLO_HEADLESS_PLUGINS';
+const warned = new Set();
+/** For tests: forget which missing plugins were already logged. */
+export function resetHeadlessPluginWarnings() {
+    warned.clear();
+}
+/** The worker profile: explicit, else RUFLO_HEADLESS_PLUGINS, else ruflo-mods. */
+export function workerProfile(env = process.env, explicit) {
+    if (explicit)
+        return [...explicit];
+    const raw = env[PROFILE_ENV];
+    if (raw === undefined)
+        return [...DEFAULT_WORKER_PLUGINS];
+    const names = raw.split(',').map((s) => s.trim()).filter(Boolean);
+    return names.length === 1 && names[0].toLowerCase() === 'none' ? [] : names;
+}
+function canonical(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/** Every `--plugin-dir` value already in argv (both `--plugin-dir x` and `--plugin-dir=x`). */
+export function existingPluginDirs(argv) {
+    const dirs = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--plugin-dir' && i + 1 < argv.length)
+            dirs.push(argv[++i]);
+        else if (a.startsWith('--plugin-dir='))
+            dirs.push(a.slice('--plugin-dir='.length));
+    }
+    return dirs;
+}
+export function withHeadlessPlugins(argv, env, opts = {}) {
+    const profile = workerProfile(opts.env ?? env, opts.profile);
+    const outArgv = [...argv];
+    const outEnv = { ...env };
+    if (profile.length === 0)
+        return { argv: outArgv, env: outEnv, added: [], missing: [] };
+    const resolver = opts.resolver ?? resolvePluginPaths;
+    const { resolved, missing } = resolver(profile, { ...opts, env: opts.env ?? env });
+    const own = existingPluginDirs(argv);
+    const ownPaths = new Set(own.map(canonical));
+    const ownNames = new Set(own.map((d) => basename(resolve(d))));
+    const added = [];
+    for (const plugin of resolved) {
+        // The caller already passes this plugin (same folder, or its own copy of it).
+        if (ownPaths.has(canonical(plugin.path)) || ownNames.has(plugin.name))
+            continue;
+        outArgv.push('--plugin-dir', plugin.path);
+        added.push(plugin.name);
+    }
+    // A caller-supplied copy of a "missing" plugin is not missing.
+    const stillMissing = missing.filter((m) => !ownNames.has(m.name)).map((m) => m.name);
+    if ((added.length > 0 || own.length > 0) && outEnv[ENABLE_ENV] === undefined) {
+        outEnv[ENABLE_ENV] = '1';
+    }
+    const warn = opts.warn ?? ((line) => process.stderr.write(`${line}\n`));
+    for (const name of stillMissing) {
+        if (warned.has(name))
+            continue;
+        warned.add(name);
+        warn(`plugin ${name} not found; worker runs without it`);
+    }
+    return { argv: outArgv, env: outEnv, added, missing: stillMissing };
+}
+//# sourceMappingURL=headless-plugins.js.map

package/dist/src/mods/install-trust.d.ts

@@ -0,0 +1,28 @@
+import { type PluginVerification } from '../plugins/marketplace-trust/signature.js';
+import { type ModPlugin } from './install.js';
+import { type ReadFs } from './plugin-resolve.js';
+/**
+ * Scan each plugin the clone carries. Returns the plugin ids whose install must
+ * not run, each with the reason; prints every finding; records --accept-risk.
+ */
+export declare function scanBeforeInstall(root: string, clone: string | null, plugins: readonly ModPlugin[], acceptRisk: ReadonlySet<string>, fs?: ReadFs, 
+/** Lines already printed / overrides already recorded by an earlier scan in the same run (scanned before enabling, then again after the clone refresh). */
+seen?: Set<string>): {
+    blocked: Map<string, string>;
+};
+/** Verify the clone's ruflo plugins and write the status file; prints one line per non-verified plugin. */
+export declare function verifyAndRecord(configDir: string, clone: string | null, names: readonly string[], home?: string): PluginVerification[];
+export interface SignatureFinding {
+    name: string;
+    status: 'pass' | 'warn';
+    message: string;
+    fix?: string;
+}
+/**
+ * `ruflo mods doctor` (§2.1): one finding per ruflo mod plugin from its clone
+ * and install-cache signatures; writes the status file the mod's trust gate
+ * reads. `modified` / `bad-signature` warn: they are enforced only under
+ * modTrust: refuse-risky, since a local checkout is always modified.
+ */
+export declare function signatureFindings(configDir: string, clone: string | null, names: readonly string[], home?: string): SignatureFinding[];
+//# sourceMappingURL=install-trust.d.ts.map

package/dist/src/mods/install-trust.js

@@ -0,0 +1,127 @@
+/**
+ * ADR-509 on the `ruflo mods install` / `ruflo init` (mods) path: scan each
+ * plugin in the refreshed marketplace clone before `claude plugin install`
+ * (§2.2), and after the install verify the clone against its signatures and
+ * write the status file the ruflo-mods trust gate reads (§2.1): per plugin the
+ * worst of its clone and install-cache copies, and each copy by its directory.
+ */
+import { homedir } from 'node:os';
+import { dirname } from 'node:path';
+import { output } from '../output.js';
+import { formatScanFinding, gateScan, scanPluginDir } from '../plugins/marketplace-trust/scan.js';
+import { describeVerification } from '../plugins/marketplace-trust/signature.js';
+import { verifyClone, verifyInstallCache, writeVerifyStatus } from '../plugins/marketplace-trust/verify-status.js';
+import { recordAcceptedRisk } from './install.js';
+import { pluginManifestIn, nodeReadFs } from './plugin-resolve.js';
+const nameOf = (id) => id.split('@')[0];
+/**
+ * Scan each plugin the clone carries. Returns the plugin ids whose install must
+ * not run, each with the reason; prints every finding; records --accept-risk.
+ */
+export function scanBeforeInstall(root, clone, plugins, acceptRisk, fs = nodeReadFs, 
+/** Lines already printed / overrides already recorded by an earlier scan in the same run (scanned before enabling, then again after the clone refresh). */
+seen = new Set()) {
+    const blocked = new Map();
+    if (!clone)
+        return { blocked };
+    const byName = new Map();
+    const findings = plugins.flatMap((p) => {
+        const manifest = pluginManifestIn(clone, p.id, fs);
+        if (!fs.exists(manifest))
+            return [];
+        byName.set(nameOf(p.id), p.id);
+        return scanPluginDir(nameOf(p.id), dirname(dirname(manifest)));
+    });
+    // --accept-risk takes the plugin name or its id (name@ruflo).
+    const accept = new Set([...acceptRisk].map(nameOf));
+    const gate = gateScan(findings, accept);
+    for (const f of findings) {
+        const line = formatScanFinding(f);
+        if (seen.has(line))
+            continue;
+        seen.add(line);
+        if (f.severity === 'high')
+            output.writeln(`${output.error('✗')} scan ${line}`);
+        else
+            output.writeln(output.dim(`  scan ${line}`));
+    }
+    for (const name of gate.blocked) {
+        const id = byName.get(name) ?? name;
+        const first = gate.findings.find((f) => f.plugin === name && f.severity === 'high');
+        blocked.set(id, `not installed: high scan finding in ${first.file} (${first.rule}); review it, then re-run with --accept-risk ${name}`);
+    }
+    const at = new Date().toISOString();
+    const accepted = gate.accepted.filter((plugin) => !seen.has(`accepted:${plugin}`));
+    for (const plugin of accepted)
+        seen.add(`accepted:${plugin}`);
+    recordAcceptedRisk(root, accepted.map((plugin) => ({
+        plugin,
+        at,
+        findings: gate.findings.filter((f) => f.plugin === plugin && f.severity === 'high').map(formatScanFinding),
+    })));
+    for (const plugin of accepted)
+        output.printWarning(`--accept-risk ${plugin}: installing past its high scan finding(s); recorded in .claude-flow/mods/install.json`);
+    return { blocked };
+}
+/** Verify the clone's ruflo plugins and write the status file; prints one line per non-verified plugin. */
+export function verifyAndRecord(configDir, clone, names, home = homedir()) {
+    if (!clone)
+        return [];
+    let results;
+    let cache;
+    try {
+        results = verifyClone(clone, names);
+        // The install cache is what Claude Code loads an installed plugin from: it is recorded too (worst of both).
+        cache = verifyInstallCache(configDir, 'ruflo', names);
+        writeVerifyStatus(configDir, clone, results, home, cache);
+    }
+    catch (error) {
+        output.printWarning(`plugin signature check skipped: ${error.message}`);
+        return [];
+    }
+    for (const r of cache)
+        if (r.result === 'modified' || r.result === 'bad-signature')
+            output.writeln(`${output.error('✗')} signature (install cache) ${describeVerification(r)}`);
+    for (const r of results) {
+        if (r.result === 'verified')
+            output.writeln(`${output.success('✓')} signature ${r.plugin}: verified`);
+        else if (r.result !== 'unsigned')
+            output.writeln(`${output.error('✗')} signature ${describeVerification(r)}`);
+    }
+    const unsigned = results.filter((r) => r.result === 'unsigned').map((r) => r.plugin);
+    if (unsigned.length)
+        output.writeln(output.dim(`  signature: unsigned (no .claude-plugin/signature.json): ${unsigned.join(', ')}`));
+    return results;
+}
+/**
+ * `ruflo mods doctor` (§2.1): one finding per ruflo mod plugin from its clone
+ * and install-cache signatures; writes the status file the mod's trust gate
+ * reads. `modified` / `bad-signature` warn: they are enforced only under
+ * modTrust: refuse-risky, since a local checkout is always modified.
+ */
+export function signatureFindings(configDir, clone, names, home = homedir()) {
+    if (!clone)
+        return [];
+    let results;
+    let cache;
+    try {
+        results = verifyClone(clone, names);
+        cache = verifyInstallCache(configDir, 'ruflo', names);
+        writeVerifyStatus(configDir, clone, results, home, cache);
+    }
+    catch (error) {
+        return [{ name: 'plugin signatures', status: 'warn', message: `could not check: ${error.message}` }];
+    }
+    const rows = [...results.map((r) => ({ r, where: 'clone' })), ...cache.map((r) => ({ r, where: 'install cache' }))];
+    return rows.map(({ r, where }) => ({
+        name: `signature ${r.plugin} (${where})`,
+        // `unsigned` is reported, not warned: a clone from before the first signed release has no signature.json,
+        // and a --strict doctor gate must not fail on that alone. modified / bad-signature warn.
+        status: r.result === 'verified' || r.result === 'unsigned' ? 'pass' : 'warn',
+        message: r.result === 'unsigned' ? `${r.plugin}: unsigned (no .claude-plugin/signature.json in this release)` : describeVerification(r),
+        ...(r.result === 'modified' || r.result === 'bad-signature'
+            ? { fix: 'claude plugin marketplace update ruflo (a local checkout is always modified; enforced only with modTrust: refuse-risky)' }
+            : {}),
+    }));
+}
+//# sourceMappingURL=install-trust.js.map

package/dist/src/mods/install.d.ts

@@ -57,11 +57,20 @@ export interface Added {
      */
     claudeInstalled?: string[];
 }
+/** ADR-509 §2.2: an install that went ahead past a high scan finding because of --accept-risk <plugin>. */
+export interface AcceptedRisk {
+    plugin: string;
+    at: string;
+    /** The high findings accepted, as printed (`[high] plugin: file (rule) detail`). */
+    findings: string[];
+}
 export interface InstallRecord {
     version: 2;
     installedAt: string;
     /** What install added, per settings file it wrote. */
     files: Record<string, Added>;
+    /** ADR-509 §2.2: every --accept-risk override, newest last. */
+    acceptedRisk?: AcceptedRisk[];
 }
 type Settings = Record<string, unknown> & {
     enabledPlugins?: Record<string, unknown>;
@@ -89,8 +98,18 @@ export interface InstallResult {
 export declare function installMod(projectRoot: string, scope: Scope, dryRun?: boolean, plugins?: readonly string[], marketplace?: MarketplaceEntry): InstallResult;
 /** The install record, v1 (3.50.0: one file, ruflo-mods only) read as v2. */
 export declare function readRecord(projectRoot: string): InstallRecord | null;
+/** ADR-509 §2.2: record an --accept-risk override in .claude-flow/mods/install.json. */
+export declare function recordAcceptedRisk(projectRoot: string, entries: readonly AcceptedRisk[]): void;
 /** Note plugins ruflo installed with `claude plugin install` for one settings file. */
 export declare function recordClaudeInstalled(projectRoot: string, settingsFile: string, ids: readonly string[]): void;
+/**
+ * ADR-509 §2.2: a plugin whose scan blocked it must not stay enabled — Claude
+ * Code loads an enabled plugin straight from the marketplace clone, with or
+ * without an install. Removes `enabledPlugins[id]` (only when it is `true`: a
+ * `false` someone set is already off) and drops the id from what the record
+ * says ruflo added. Returns the ids it turned off.
+ */
+export declare function disableBlockedPlugins(projectRoot: string, settingsFile: string, ids: readonly string[]): string[];
 /** The scope a recorded settings file was written at. */
 export declare function scopeOfSettingsFile(file: string): Scope;
 export declare function uninstallMod(projectRoot: string, dryRun?: boolean): {

package/dist/src/mods/install.js

@@ -156,7 +156,10 @@ export function readRecord(projectRoot) {
                 const strings = (v) => (Array.isArray(v) ? v.filter((p) => typeof p === 'string') : []);
                 files[file] = { plugins: strings(a.plugins), marketplace: a.marketplace === true, env: a.env === true, claudeInstalled: strings(a.claudeInstalled) };
             }
-            return { version: 2, installedAt: String(parsed.installedAt ?? ''), files };
+            const accepted = Array.isArray(parsed.acceptedRisk)
+                ? parsed.acceptedRisk.filter(isRecord).map((r) => ({ plugin: String(r.plugin ?? ''), at: String(r.at ?? ''), findings: Array.isArray(r.findings) ? r.findings.map(String) : [] }))
+                : undefined;
+            return { version: 2, installedAt: String(parsed.installedAt ?? ''), files, ...(accepted?.length ? { acceptedRisk: accepted } : {}) };
         }
         if (parsed.version === 1 && typeof parsed.settingsFile === 'string' && isRecord(parsed.added)) {
             const a = parsed.added;
@@ -168,6 +171,14 @@ export function readRecord(projectRoot) {
         return null;
     }
 }
+/** ADR-509 §2.2: record an --accept-risk override in .claude-flow/mods/install.json. */
+export function recordAcceptedRisk(projectRoot, entries) {
+    if (entries.length === 0)
+        return;
+    const record = readRecord(projectRoot) ?? { version: 2, installedAt: new Date().toISOString(), files: {} };
+    record.acceptedRisk = [...(record.acceptedRisk ?? []), ...entries];
+    writeJson(join(resolve(projectRoot), INSTALL_RECORD), record);
+}
 /** Note plugins ruflo installed with `claude plugin install` for one settings file. */
 export function recordClaudeInstalled(projectRoot, settingsFile, ids) {
     const record = readRecord(projectRoot);
@@ -177,6 +188,32 @@ export function recordClaudeInstalled(projectRoot, settingsFile, ids) {
     entry.claudeInstalled = [...new Set([...(entry.claudeInstalled ?? []), ...ids])];
     writeJson(join(resolve(projectRoot), INSTALL_RECORD), record);
 }
+/**
+ * ADR-509 §2.2: a plugin whose scan blocked it must not stay enabled — Claude
+ * Code loads an enabled plugin straight from the marketplace clone, with or
+ * without an install. Removes `enabledPlugins[id]` (only when it is `true`: a
+ * `false` someone set is already off) and drops the id from what the record
+ * says ruflo added. Returns the ids it turned off.
+ */
+export function disableBlockedPlugins(projectRoot, settingsFile, ids) {
+    if (ids.length === 0 || !existsSync(settingsFile))
+        return [];
+    const settings = readSettingsFile(settingsFile);
+    const enabled = isRecord(settings.enabledPlugins) ? { ...settings.enabledPlugins } : {};
+    const off = ids.filter((id) => enabled[id] === true);
+    if (off.length) {
+        for (const id of off)
+            delete enabled[id];
+        writeJson(settingsFile, { ...settings, enabledPlugins: enabled });
+    }
+    const record = readRecord(projectRoot);
+    const entry = record?.files[settingsFile];
+    if (record && entry && entry.plugins.some((p) => ids.includes(p))) {
+        entry.plugins = entry.plugins.filter((p) => !ids.includes(p));
+        writeJson(join(resolve(projectRoot), INSTALL_RECORD), record);
+    }
+    return off;
+}
 /** The scope a recorded settings file was written at. */
 export function scopeOfSettingsFile(file) {
     return file.endsWith('settings.local.json') ? 'local' : 'project';