@claude-flow/cli 3.7.0-alpha.8 → 3.7.0-alpha.80

package/.claude/agents/github/release-manager.md

@@ -577,9 +577,9 @@ jobs:
   release-validation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: '20'
       - name: Install and Test

package/.claude/agents/github/release-swarm.md

@@ -312,7 +312,7 @@ jobs:
   release-swarm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           

package/.claude/agents/github/repo-architect.md

@@ -184,8 +184,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with: { node-version: '20' }
       - run: npm install && npm test`,
     message: "ci: Standardize integration workflow across repositories",

package/.claude/agents/github/swarm-pr.md

@@ -80,7 +80,7 @@ jobs:
   swarm-handler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Handle Swarm Command
         run: |
           if [[ "${{ github.event.comment.body }}" == /swarm* ]]; then

package/.claude/agents/github/workflow-automation.md

@@ -320,7 +320,7 @@ jobs:
   swarm-analysis:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       
       - name: Initialize Swarm
         uses: ruvnet/swarm-action@v1
@@ -368,7 +368,7 @@ jobs:
   detect-and-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       
       - name: Detect Languages
         id: detect

package/.claude/commands/github/code-review-swarm.md

@@ -243,7 +243,7 @@ jobs:
   swarm-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           

package/.claude/commands/github/issue-tracker.md

@@ -88,7 +88,7 @@ mcp__github__add_issue_comment {
   - Final validation and merge preparation
   
   ---
-  🤖 Generated with Claude Code using ruv-swarm coordination`
+  `
 }
 
 // Store progress in swarm memory
@@ -206,9 +206,10 @@ mcp__github__update_issue {
 Updates will be posted automatically by swarm agents during implementation.
 
 ---
-🤖 Generated with Claude Code
 ```
 
+<!-- last-updated: 2026-05-21 — ADR-127 -->
+
 ### Bug Report Template:
 ```markdown
 ## 🐛 Bug Report
@@ -244,7 +245,6 @@ Updates will be posted automatically by swarm agents during implementation.
 - **Tester**: Validation and testing
 
 ---
-🤖 Generated with Claude Code
 ```
 
 ## Best Practices

package/.claude/commands/github/release-manager.md

@@ -167,10 +167,12 @@ This release was coordinated using ruv-swarm agents:
 This release is production-ready with comprehensive validation and testing.
 
 ---
-🤖 Generated with Claude Code using ruv-swarm coordination`
+`
 }
 ```
 
+<!-- last-updated: 2026-05-21 — ADR-127 -->
+
 ## Batch Release Workflow
 
 ### Complete Release Pipeline:
@@ -310,9 +312,9 @@ jobs:
   release-validation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: '20'
       - name: Install and Test

package/.claude/commands/github/release-swarm.md

@@ -273,7 +273,7 @@ jobs:
   release-swarm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           

package/.claude/commands/github/repo-architect.md

@@ -153,8 +153,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with: { node-version: '20' }
       - run: npm install && npm test`,
     message: "ci: Standardize integration workflow across repositories",

package/.claude/commands/github/swarm-issue.md

@@ -259,9 +259,12 @@ jobs:
         uses: ruvnet/swarm-action@v1
         with:
           command: |
-            if [[ "${{ github.event.label.name }}" == "swarm-ready" ]]; then
+            LABEL_NAME_FILE=$(mktemp)
+            printf '%s' "${{ github.event.label.name }}" > "$LABEL_NAME_FILE"
+            if grep -qx 'swarm-ready' "$LABEL_NAME_FILE"; then
               npx ruv-swarm github issue-init ${{ github.event.issue.number }}
             fi
+            rm -f "$LABEL_NAME_FILE"
 ```
 
 ### Issue Board Integration

package/.claude/commands/github/swarm-pr.md

@@ -44,14 +44,17 @@ jobs:
   swarm-handler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Handle Swarm Command
         run: |
-          if [[ "${{ github.event.comment.body }}" == /swarm* ]]; then
+          COMMENT_BODY_FILE=$(mktemp)
+          printf '%s' "${{ github.event.comment.body }}" > "$COMMENT_BODY_FILE"
+          if grep -q '^/swarm' "$COMMENT_BODY_FILE"; then
             npx ruv-swarm github handle-comment \
               --pr ${{ github.event.pull_request.number }} \
-              --comment "${{ github.event.comment.body }}"
+              --comment-file "$COMMENT_BODY_FILE"
           fi
+          rm -f "$COMMENT_BODY_FILE"
 ```
 
 ## PR Label Integration

package/.claude/commands/github/sync-coordinator.md

@@ -137,10 +137,12 @@ This integration uses ruv-swarm agents for:
 - Memory-based state management
 
 ---
-🤖 Generated with Claude Code using ruv-swarm coordination`
+`
 }
 ```
 
+<!-- last-updated: 2026-05-21 — ADR-127 -->
+
 ## Batch Synchronization Example
 
 ### Complete Package Sync Workflow:

package/.claude/commands/github/workflow-automation.md

@@ -15,7 +15,7 @@ jobs:
   swarm-analysis:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       
       - name: Initialize Swarm
         uses: ruvnet/swarm-action@v1
@@ -63,7 +63,7 @@ jobs:
   detect-and-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       
       - name: Detect Languages
         id: detect

package/.claude/helpers/github-safe.js

@@ -1,34 +1,43 @@
 #!/usr/bin/env node
-
 /**
- * Safe GitHub CLI Helper
+ * Safe GitHub CLI Helper — v1.0.0
+ *
+ * Prevents injection issues when using `gh` commands with untrusted content
+ * (PR bodies, issue bodies, comment bodies) by routing the body through a
+ * temp file and using `--body-file` rather than interpolating into shell args.
  *
- * Prevents two classes of issue when calling `gh`:
- * 1. Timeout / shell-quoting bugs when issue/PR bodies contain backticks,
- *    `$(...)`, or other special characters — bodies go through a temp file
- *    via `--body-file` instead of being inlined in the command line.
- * 2. Command injection (audit_1776853149979 finding) — args were
- *    previously concatenated into a shell string and passed to
- *    `execSync`, so a caller passing `; rm -rf …` would have it
- *    executed by /bin/sh. Now uses `execFileSync('gh', argArray)`
- *    which goes through execve directly with no shell interpretation.
+ * ADR-127 Phase 2 hardening:
+ *   - GITHUB_SAFE_VERSION exported for smoke assertions.
+ *   - Explicit 256KB body cap: rejects oversized bodies before any temp-file
+ *     write, matching the GitHub API `body` field limit.
+ *   - Strict error handling: all execSync calls inside try/catch; cleanup in
+ *     finally; non-zero exit on any error.
+ *   - GITHUB_SAFE_DRY_RUN=1 env-var skips the actual `gh` exec for testing.
  *
  * Usage:
- *   ./github-safe.js issue comment 123 "Message with `backticks`"
+ *   ./github-safe.js issue comment 123 "Message with \`backticks\`"
  *   ./github-safe.js pr create --title "Title" --body "Complex body"
  */
 
-import { execFileSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
 import { writeFileSync, unlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { join } from 'path';
 import { randomBytes } from 'crypto';
 
+// Version constant — asserted by smoke-github-safe-injection.mjs.
+export const GITHUB_SAFE_VERSION = '1.0.0';
+
+// Maximum body size allowed (bytes).  The GitHub API enforces 65536 chars for
+// issue/PR bodies; the CLI is more lenient but the 256KB limit is a
+// conservative safety cap that prevents accidental oversized writes.
+const MAX_BODY_BYTES = 256 * 1024;
+
 const args = process.argv.slice(2);
 
 if (args.length < 2) {
   console.log(`
-Safe GitHub CLI Helper
+Safe GitHub CLI Helper v${GITHUB_SAFE_VERSION}
 
 Usage:
   ./github-safe.js issue comment <number> <body>
@@ -36,44 +45,18 @@ Usage:
   ./github-safe.js issue create --title <title> --body <body>
   ./github-safe.js pr create --title <title> --body <body>
 
-Bodies with backticks, command substitution, and other special shell
-characters are routed through a tempfile via --body-file. All gh args
-are passed via execFileSync (no shell interpretation).
+This helper prevents injection issues with special characters:
+- Backticks in code examples
+- Command substitution $(...)
+- Semicolons and other shell metacharacters
+- Oversized bodies (> 256 KB rejected)
 `);
   process.exit(1);
 }
 
-// Whitelist of gh top-level commands we forward. Restricting this is
-// defense-in-depth even though execFileSync would already block shell
-// metacharacters in args.
-const ALLOWED_COMMANDS = new Set(['issue', 'pr', 'repo', 'api', 'workflow', 'run', 'release', 'auth', 'gist']);
-
 const [command, subcommand, ...restArgs] = args;
 
-if (!ALLOWED_COMMANDS.has(command)) {
-  console.error(`Refusing to forward unknown gh command: ${command}`);
-  console.error(`Allowed: ${Array.from(ALLOWED_COMMANDS).join(', ')}`);
-  process.exit(1);
-}
-
-// Build the final argv that gets passed to execFileSync.
-// IMPORTANT: never join into a shell string. Each element is one argv slot.
-function runGh(argv) {
-  try {
-    execFileSync('gh', argv, {
-      stdio: 'inherit',
-      timeout: 30000,
-      // shell:false is the default — kept explicit so a future refactor
-      // doesn't accidentally turn it on.
-      shell: false,
-    });
-  } catch (error) {
-    console.error('Error:', error?.message ?? String(error));
-    process.exit(1);
-  }
-}
-
-// Handle commands that take body content
+// Handle commands that need body content
 if ((command === 'issue' || command === 'pr') &&
     (subcommand === 'comment' || subcommand === 'create')) {
 
@@ -81,10 +64,11 @@ if ((command === 'issue' || command === 'pr') &&
   let body = '';
 
   if (subcommand === 'comment' && restArgs.length >= 2) {
-    // Positional: github-safe.js issue comment 123 "body"
+    // Simple format: github-safe.js issue comment 123 "body"
     body = restArgs[1];
     bodyIndex = 1;
   } else {
+    // Flag format: --body "content"
     bodyIndex = restArgs.indexOf('--body');
     if (bodyIndex !== -1 && bodyIndex < restArgs.length - 1) {
       body = restArgs[bodyIndex + 1];
@@ -92,30 +76,81 @@ if ((command === 'issue' || command === 'pr') &&
   }
 
   if (body) {
+    // Enforce 256KB cap before any file I/O.
+    const bodyBytes = Buffer.byteLength(body, 'utf8');
+    if (bodyBytes > MAX_BODY_BYTES) {
+      console.error(
+        `[ERROR] Body exceeds maximum allowed size (${bodyBytes} bytes > ${MAX_BODY_BYTES} bytes). ` +
+        'GitHub API body fields are capped at 256KB. Truncate the body before passing it to github-safe.js.'
+      );
+      process.exit(1);
+    }
+
+    // Use temporary file for body content — never interpolate into argv.
     const tmpFile = join(tmpdir(), `gh-body-${randomBytes(8).toString('hex')}.tmp`);
+
     try {
       writeFileSync(tmpFile, body, 'utf8');
 
-      // Build the gh argv with --body-file instead of --body / inline body
-      const finalArgs = [command, subcommand, ...restArgs];
-      const offset = 2; // command + subcommand
+      // Build new command with --body-file
+      const newArgs = [...restArgs];
       if (subcommand === 'comment' && bodyIndex === 1) {
-        finalArgs[offset + 1] = '--body-file';
-        finalArgs.push(tmpFile);
+        // Replace positional body arg with --body-file
+        newArgs[1] = '--body-file';
+        newArgs.push(tmpFile);
       } else if (bodyIndex !== -1) {
-        finalArgs[offset + bodyIndex] = '--body-file';
-        finalArgs[offset + bodyIndex + 1] = tmpFile;
+        // Replace --body flag pair with --body-file
+        newArgs[bodyIndex] = '--body-file';
+        newArgs[bodyIndex + 1] = tmpFile;
+      }
+
+      // Skip actual gh exec in dry-run mode (used by smoke tests).
+      if (process.env.GITHUB_SAFE_DRY_RUN === '1') {
+        const ghArgs = [command, subcommand, ...newArgs];
+        console.log(`[DRY-RUN] gh ${ghArgs.join(' ')}`);
+        process.exit(0);
       }
 
-      runGh(finalArgs);
+      const ghArgv = [command, subcommand, ...newArgs];
+      console.log(`Executing: gh ${ghArgv.join(' ')}`);
+
+      // Use execFileSync to avoid shell interpolation — args are passed as an
+      // array so shell metacharacters in tmpFile path cannot be exploited.
+      execFileSync('gh', ghArgv, {
+        stdio: 'inherit',
+        timeout: 30000,
+      });
+
+    } catch (error) {
+      console.error('[ERROR]', error.message);
+      process.exit(1);
     } finally {
-      try { unlinkSync(tmpFile); } catch { /* ignore cleanup errors */ }
+      // Always clean up the temp file.
+      try { unlinkSync(tmpFile); } catch (_) { /* ignore cleanup errors */ }
     }
   } else {
-    // No body — forward all args as-is (still via execFileSync)
-    runGh(args);
+    // No body content — execute normally (no injection risk for args).
+    if (process.env.GITHUB_SAFE_DRY_RUN === '1') {
+      console.log(`[DRY-RUN] gh ${args.join(' ')}`);
+      process.exit(0);
+    }
+    try {
+      execFileSync('gh', args, { stdio: 'inherit' });
+    } catch (error) {
+      console.error('[ERROR]', error.message);
+      process.exit(1);
+    }
   }
 } else {
-  // Other gh subcommands — forward as-is
-  runGh(args);
+  // Non-body commands — execute normally.
+  if (process.env.GITHUB_SAFE_DRY_RUN === '1') {
+    console.log(`[DRY-RUN] gh ${args.join(' ')}`);
+    process.exit(0);
+  }
+  try {
+    execFileSync('gh', args, { stdio: 'inherit' });
+  } catch (error) {
+    console.error('[ERROR]', error.message);
+    process.exit(1);
+  }
 }

package/.claude/helpers/github-setup.sh

@@ -1,27 +1,44 @@
 #!/bin/bash
+# Security rationale: set -euo pipefail ensures that:
+#   -e  — exit immediately if any command fails (no silent failures)
+#   -u  — treat unset variables as errors (prevents empty-string expansion bugs)
+#   -o pipefail — pipeline fails if any command in it fails (not just last)
+# This matches the ADR-127 Phase 2 requirement for github-setup.sh hardening.
+set -euo pipefail
+
 # Setup GitHub integration for Claude Flow
 
-echo "🔗 Setting up GitHub integration..."
+echo "Setting up GitHub integration..."
 
 # Check for gh CLI
 if ! command -v gh &> /dev/null; then
-    echo "⚠️  GitHub CLI (gh) not found"
+    echo "WARNING: GitHub CLI (gh) not found"
     echo "Install from: https://cli.github.com/"
     echo "Continuing without GitHub features..."
 else
-    echo "✅ GitHub CLI found"
-    
-    # Check auth status
-    if gh auth status &> /dev/null; then
-        echo "✅ GitHub authentication active"
+    echo "OK: GitHub CLI found"
+
+    # Check auth status and scope sufficiency.
+    # `gh auth status` exits non-zero when not authenticated.
+    # We additionally parse for "Token scopes" to verify we have at least
+    # 'repo' scope, which is required for PR/issue operations.
+    if gh auth status 2>&1 | grep -q "Logged in"; then
+        echo "OK: GitHub authentication active"
+        # Verify repo scope is present for PR/issue operations.
+        if gh auth status 2>&1 | grep -q "repo"; then
+            echo "OK: 'repo' scope available"
+        else
+            echo "WARNING: 'repo' scope not confirmed — PR/issue operations may fail"
+            echo "Run: gh auth login --scopes repo,read:org"
+        fi
     else
-        echo "⚠️  Not authenticated with GitHub"
+        echo "WARNING: Not authenticated with GitHub"
         echo "Run: gh auth login"
     fi
 fi
 
 echo ""
-echo "📦 GitHub swarm commands available:"
+echo "GitHub swarm commands available:"
 echo "  - npx claude-flow github swarm"
 echo "  - npx claude-flow repo analyze"
 echo "  - npx claude-flow pr enhance"

package/.claude/helpers/hook-handler.cjs

@@ -112,8 +112,12 @@ async function main() {
   const toolInput = hookInput.toolInput || hookInput.tool_input || {};
   const toolName = hookInput.toolName || hookInput.tool_name || '';
 
-  // Merge stdin data into prompt resolution: prefer stdin fields, then env, then argv
-  const prompt = hookInput.prompt || hookInput.command || toolInput
+  // Merge stdin data into prompt resolution: prefer stdin fields, then env, then argv.
+  // `toolInput` is an object (e.g. {command:"ls"}) — it's truthy but not a string,
+  // so falling back to it directly bound `prompt` to the object and tripped
+  // `.toLowerCase()` / `.substring()` on every Bash hook (#1944). Use the
+  // `.command` field instead, which is the actual string the hook needs.
+  const prompt = hookInput.prompt || hookInput.command || toolInput.command
     || process.env.PROMPT || process.env.TOOL_INPUT_command || args.join(' ') || '';
 
 const handlers = {
@@ -144,8 +148,12 @@ const handlers = {
   },
 
   'pre-bash': () => {
-    // Basic command safety check — prefer stdin command data from Claude Code
-    const cmd = (hookInput.command || prompt).toLowerCase();
+    // Basic command safety check — prefer stdin command data from Claude Code.
+    // String() wrap is belt-and-suspenders for #2017: even if a future regression
+    // re-binds `prompt` or `hookInput.command` to a non-string, `.toLowerCase()`
+    // can no longer throw a TypeError that the global try/catch would swallow
+    // (silently exiting 0 and letting the dangerous command through).
+    const cmd = String(hookInput.command || toolInput.command || prompt || '').toLowerCase();
     const dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\', ':(){:|:&};:'];
     for (const d of dangerous) {
       if (cmd.includes(d)) {

package/.claude/helpers/statusline.cjs

@@ -25,8 +25,37 @@
 /* eslint-disable @typescript-eslint/no-var-requires */
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const { execSync, execFileSync } = require('child_process');
 
+// Read the installed plugin version once at startup. Probe the plugin's own
+// install location first (`~/.claude/plugins/marketplaces/ruflo/package.json`),
+// then npm-style installs, then the source-checkout location. The previous
+// code hardcoded `RuFlo V3.5` in the header — so users on alpha.27+ still
+// saw V3.5 in the statusline even though `ruflo doctor` reported the real
+// version (#1951).
+let RUFLO_VERSION = '3.6';
+try {
+  const home = os.homedir();
+  const cwd = process.cwd();
+  const pkgPaths = [
+    path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'package.json'),
+    path.join(cwd, 'node_modules', '@claude-flow', 'cli', 'package.json'),
+    path.join(cwd, 'node_modules', 'ruflo', 'package.json'),
+    path.join(cwd, 'v3', '@claude-flow', 'cli', 'package.json'),
+  ];
+  for (const p of pkgPaths) {
+    if (!fs.existsSync(p)) continue;
+    try {
+      const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
+      if (pkg && typeof pkg.version === 'string' && pkg.version.length > 0) {
+        RUFLO_VERSION = pkg.version;
+        break;
+      }
+    } catch { /* malformed package.json — try next */ }
+  }
+} catch { /* fall through to the hardcoded default */ }
+
 // Configuration
 const CONFIG = {
   enabled: true,
@@ -402,7 +431,7 @@ function generateStatusline() {
   const lines = [];
 
   // Header Line
-  let header = `${c.bold}${c.brightPurple}▊ RuFlo V3.5 ${c.reset}`;
+  let header = `${c.bold}${c.brightPurple}▊ RuFlo V${RUFLO_VERSION} ${c.reset}`;
   header += `${swarm.coordinationActive ? c.brightCyan : c.dim}● ${c.brightCyan}${user.name}${c.reset}`;
   if (user.gitBranch) {
     header += `  ${c.dim}│${c.reset}  ${c.brightBlue}⎇ ${user.gitBranch}${c.reset}`;
@@ -508,7 +537,7 @@ function generateSafeStatusline() {
   const lines = [];
 
   // Header Line
-  let header = `${c.bold}${c.brightPurple}▊ RuFlo V3.5 ${c.reset}`;
+  let header = `${c.bold}${c.brightPurple}▊ RuFlo V${RUFLO_VERSION} ${c.reset}`;
   header += `${swarm.coordinationActive ? c.brightCyan : c.dim}● ${c.brightCyan}${user.name}${c.reset}`;
   if (user.gitBranch) {
     header += `  ${c.dim}│${c.reset}  ${c.brightBlue}⎇ ${user.gitBranch}${c.reset}`;

package/.claude/helpers/statusline.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 /**
- * RuFlo V3.5 Statusline Generator
- * Displays real-time V3 implementation progress and system status
+ * RuFlo Statusline Generator
+ * Displays real-time V3 implementation progress and system status.
+ * Version is read from the installed @claude-flow/cli package.json at
+ * runtime — #1892 fix: previously hardcoded to V3.5 which drifted from
+ * the actual installed alpha series.
  *
  * Usage: node statusline.js [--json] [--compact]
  */
@@ -10,6 +13,34 @@ const fs = require('fs');
 const path = require('path');
 const { execSync, execFileSync } = require('child_process');
 
+// #1892 — derive RuFlo banner version from the installed cli package.json
+// so the statusline never drifts from `ruflo doctor`. Falls back to a
+// generic "RuFlo" label only if every resolution path fails.
+function resolveBannerVersion() {
+  const candidates = [
+    // Local-checkout / monorepo case
+    path.join(__dirname, '..', '..', 'package.json'),
+    // npm-installed-as-dep case
+    path.join(__dirname, '..', '..', '..', '@claude-flow', 'cli', 'package.json'),
+    // npm-installed-globally case
+    path.join(__dirname, '..', '..', '..', 'cli', 'package.json'),
+  ];
+  for (const p of candidates) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
+      if (pkg.name && pkg.name.includes('claude-flow') && typeof pkg.version === 'string') {
+        // Render as "V<major>.<minor>" so the banner stays compact —
+        // patch+pre-release detail still shows under `doctor`.
+        const m = pkg.version.match(/^(\d+)\.(\d+)/);
+        if (m) return `V${m[1]}.${m[2]}`;
+        return `V${pkg.version}`;
+      }
+    } catch {/* try next */}
+  }
+  return ''; // empty → header just says "RuFlo"
+}
+const BANNER_VERSION = resolveBannerVersion();
+
 // Configuration
 const CONFIG = {
   enabled: true,
@@ -246,8 +277,8 @@ function generateStatusline() {
   const system = getSystemMetrics();
   const lines = [];
 
-  // Header Line
-  let header = `${c.bold}${c.brightPurple}▊ RuFlo V3.5 ${c.reset}`;
+  // Header Line — #1892: BANNER_VERSION resolved at module load from package.json
+  let header = `${c.bold}${c.brightPurple}▊ RuFlo${BANNER_VERSION ? ' ' + BANNER_VERSION : ''} ${c.reset}`;
   header += `${swarm.coordinationActive ? c.brightCyan : c.dim}● ${c.brightCyan}${user.name}${c.reset}`;
   if (user.gitBranch) {
     header += `  ${c.dim}│${c.reset}  ${c.brightBlue}⎇ ${user.gitBranch}${c.reset}`;

package/.claude/settings.json

@@ -115,7 +115,7 @@
     ]
   },
   "attribution": {
-    "commit": "Co-Authored-By: claude-flow <ruv@ruv.net>",
+    "commit": "Co-Authored-By: ruflo-bot <ruflo-bot@users.noreply.github.com>",
     "pr": "Generated with [claude-flow](https://github.com/ruvnet/claude-flow)"
   },
   "claudeFlow": {