@claude-flow/cli 3.7.0-alpha.81 → 3.7.0-alpha.82

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (218) hide show
  1. package/.claude/agents/core/coder.md +453 -0
  2. package/.claude/agents/core/researcher.md +369 -0
  3. package/.claude/agents/core/reviewer.md +520 -0
  4. package/.claude/agents/core/tester.md +512 -0
  5. package/.claude/agents/github/release-manager.md +2 -2
  6. package/.claude/agents/github/release-swarm.md +1 -1
  7. package/.claude/agents/github/repo-architect.md +2 -2
  8. package/.claude/agents/github/swarm-pr.md +1 -1
  9. package/.claude/agents/github/workflow-automation.md +2 -2
  10. package/.claude/agents/goal/goal-planner.md +73 -0
  11. package/.claude/agents/v3/adr-architect.md +184 -0
  12. package/.claude/agents/v3/memory-specialist.md +995 -0
  13. package/.claude/agents/v3/security-auditor.md +771 -0
  14. package/.claude/agents/v3/sparc-orchestrator.md +182 -0
  15. package/.claude/commands/flow-nexus/app-store.md +124 -0
  16. package/.claude/commands/flow-nexus/challenges.md +120 -0
  17. package/.claude/commands/flow-nexus/login-registration.md +65 -0
  18. package/.claude/commands/flow-nexus/neural-network.md +134 -0
  19. package/.claude/commands/flow-nexus/payments.md +116 -0
  20. package/.claude/commands/flow-nexus/sandbox.md +83 -0
  21. package/.claude/commands/flow-nexus/swarm.md +87 -0
  22. package/.claude/commands/flow-nexus/user-tools.md +152 -0
  23. package/.claude/commands/flow-nexus/workflow.md +115 -0
  24. package/.claude/commands/github/code-review-swarm.md +1 -1
  25. package/.claude/commands/github/issue-tracker.md +3 -3
  26. package/.claude/commands/github/release-manager.md +3 -5
  27. package/.claude/commands/github/release-swarm.md +1 -1
  28. package/.claude/commands/github/repo-architect.md +2 -2
  29. package/.claude/commands/github/swarm-issue.md +1 -4
  30. package/.claude/commands/github/swarm-pr.md +3 -6
  31. package/.claude/commands/github/sync-coordinator.md +1 -3
  32. package/.claude/commands/github/workflow-automation.md +2 -2
  33. package/.claude/helpers/github-safe.js +60 -95
  34. package/.claude/helpers/github-setup.sh +9 -26
  35. package/.claude/helpers/hook-handler.cjs +4 -12
  36. package/.claude/helpers/statusline.cjs +2 -31
  37. package/.claude/settings.json +1 -1
  38. package/README.md +38 -55
  39. package/dist/src/commands/daemon.d.ts +0 -20
  40. package/dist/src/commands/daemon.d.ts.map +1 -1
  41. package/dist/src/commands/daemon.js +5 -82
  42. package/dist/src/commands/daemon.js.map +1 -1
  43. package/dist/src/commands/doctor.d.ts.map +1 -1
  44. package/dist/src/commands/doctor.js +6 -17
  45. package/dist/src/commands/doctor.js.map +1 -1
  46. package/dist/src/commands/embeddings.d.ts.map +1 -1
  47. package/dist/src/commands/embeddings.js +9 -18
  48. package/dist/src/commands/embeddings.js.map +1 -1
  49. package/dist/src/commands/index.d.ts +26 -26
  50. package/dist/src/commands/index.d.ts.map +1 -1
  51. package/dist/src/commands/init.d.ts.map +1 -1
  52. package/dist/src/commands/init.js +1 -21
  53. package/dist/src/commands/init.js.map +1 -1
  54. package/dist/src/commands/memory.d.ts.map +1 -1
  55. package/dist/src/commands/memory.js +5 -43
  56. package/dist/src/commands/memory.js.map +1 -1
  57. package/dist/src/commands/start.js +1 -1
  58. package/dist/src/commands/start.js.map +1 -1
  59. package/dist/src/commands/swarm.js +1 -1
  60. package/dist/src/commands/swarm.js.map +1 -1
  61. package/dist/src/init/claudemd-generator.d.ts.map +1 -1
  62. package/dist/src/init/claudemd-generator.js +0 -1
  63. package/dist/src/init/claudemd-generator.js.map +1 -1
  64. package/dist/src/init/executor.d.ts.map +1 -1
  65. package/dist/src/init/executor.js +0 -41
  66. package/dist/src/init/executor.js.map +1 -1
  67. package/dist/src/init/helpers-generator.d.ts +0 -1
  68. package/dist/src/init/helpers-generator.d.ts.map +1 -1
  69. package/dist/src/init/helpers-generator.js +2 -19
  70. package/dist/src/init/helpers-generator.js.map +1 -1
  71. package/dist/src/init/settings-generator.d.ts.map +1 -1
  72. package/dist/src/init/settings-generator.js +15 -74
  73. package/dist/src/init/settings-generator.js.map +1 -1
  74. package/dist/src/init/statusline-generator.d.ts.map +1 -1
  75. package/dist/src/init/statusline-generator.js +31 -75
  76. package/dist/src/init/statusline-generator.js.map +1 -1
  77. package/dist/src/init/types.d.ts +0 -23
  78. package/dist/src/init/types.d.ts.map +1 -1
  79. package/dist/src/init/types.js +5 -18
  80. package/dist/src/init/types.js.map +1 -1
  81. package/dist/src/mcp-client.d.ts.map +1 -1
  82. package/dist/src/mcp-client.js +0 -12
  83. package/dist/src/mcp-client.js.map +1 -1
  84. package/dist/src/mcp-server.d.ts.map +1 -1
  85. package/dist/src/mcp-server.js +5 -38
  86. package/dist/src/mcp-server.js.map +1 -1
  87. package/dist/src/mcp-tools/agent-execute-core.d.ts.map +1 -1
  88. package/dist/src/mcp-tools/agent-execute-core.js +74 -141
  89. package/dist/src/mcp-tools/agent-execute-core.js.map +1 -1
  90. package/dist/src/mcp-tools/agent-tools.d.ts.map +1 -1
  91. package/dist/src/mcp-tools/agent-tools.js +4 -112
  92. package/dist/src/mcp-tools/agent-tools.js.map +1 -1
  93. package/dist/src/mcp-tools/browser-session-tools.d.ts.map +1 -1
  94. package/dist/src/mcp-tools/browser-session-tools.js +2 -13
  95. package/dist/src/mcp-tools/browser-session-tools.js.map +1 -1
  96. package/dist/src/mcp-tools/hive-mind-tools.d.ts.map +1 -1
  97. package/dist/src/mcp-tools/hive-mind-tools.js +0 -44
  98. package/dist/src/mcp-tools/hive-mind-tools.js.map +1 -1
  99. package/dist/src/mcp-tools/hooks-tools.d.ts +0 -2
  100. package/dist/src/mcp-tools/hooks-tools.d.ts.map +1 -1
  101. package/dist/src/mcp-tools/hooks-tools.js +6 -100
  102. package/dist/src/mcp-tools/hooks-tools.js.map +1 -1
  103. package/dist/src/mcp-tools/memory-tools.d.ts.map +1 -1
  104. package/dist/src/mcp-tools/memory-tools.js +7 -332
  105. package/dist/src/mcp-tools/memory-tools.js.map +1 -1
  106. package/dist/src/mcp-tools/ruvllm-tools.d.ts.map +1 -1
  107. package/dist/src/mcp-tools/ruvllm-tools.js +1 -17
  108. package/dist/src/mcp-tools/ruvllm-tools.js.map +1 -1
  109. package/dist/src/mcp-tools/session-tools.d.ts.map +1 -1
  110. package/dist/src/mcp-tools/session-tools.js +1 -125
  111. package/dist/src/mcp-tools/session-tools.js.map +1 -1
  112. package/dist/src/mcp-tools/swarm-tools.d.ts +0 -28
  113. package/dist/src/mcp-tools/swarm-tools.d.ts.map +1 -1
  114. package/dist/src/mcp-tools/swarm-tools.js +2 -4
  115. package/dist/src/mcp-tools/swarm-tools.js.map +1 -1
  116. package/dist/src/mcp-tools/system-tools.d.ts.map +1 -1
  117. package/dist/src/mcp-tools/system-tools.js +0 -48
  118. package/dist/src/mcp-tools/system-tools.js.map +1 -1
  119. package/dist/src/mcp-tools/task-tools.d.ts.map +1 -1
  120. package/dist/src/mcp-tools/task-tools.js +0 -48
  121. package/dist/src/mcp-tools/task-tools.js.map +1 -1
  122. package/dist/src/mcp-tools/workflow-tools.d.ts.map +1 -1
  123. package/dist/src/mcp-tools/workflow-tools.js +0 -108
  124. package/dist/src/mcp-tools/workflow-tools.js.map +1 -1
  125. package/dist/src/memory/memory-bridge.d.ts +0 -4
  126. package/dist/src/memory/memory-bridge.d.ts.map +1 -1
  127. package/dist/src/memory/memory-bridge.js +8 -49
  128. package/dist/src/memory/memory-bridge.js.map +1 -1
  129. package/dist/src/memory/memory-initializer.d.ts +0 -4
  130. package/dist/src/memory/memory-initializer.d.ts.map +1 -1
  131. package/dist/src/memory/memory-initializer.js +6 -24
  132. package/dist/src/memory/memory-initializer.js.map +1 -1
  133. package/dist/src/plugins/store/discovery.d.ts +4 -15
  134. package/dist/src/plugins/store/discovery.d.ts.map +1 -1
  135. package/dist/src/plugins/store/discovery.js +18 -40
  136. package/dist/src/plugins/store/discovery.js.map +1 -1
  137. package/dist/src/prompt.d.ts +3 -3
  138. package/dist/src/prompt.d.ts.map +1 -1
  139. package/dist/src/ruvector/coverage-tools.js +6 -6
  140. package/dist/src/ruvector/coverage-tools.js.map +1 -1
  141. package/dist/src/ruvector/vector-db.d.ts.map +1 -1
  142. package/dist/src/ruvector/vector-db.js +12 -3
  143. package/dist/src/ruvector/vector-db.js.map +1 -1
  144. package/dist/src/services/headless-worker-executor.d.ts +1 -14
  145. package/dist/src/services/headless-worker-executor.d.ts.map +1 -1
  146. package/dist/src/services/headless-worker-executor.js +10 -54
  147. package/dist/src/services/headless-worker-executor.js.map +1 -1
  148. package/dist/src/services/worker-daemon.d.ts +0 -12
  149. package/dist/src/services/worker-daemon.d.ts.map +1 -1
  150. package/dist/src/services/worker-daemon.js +14 -68
  151. package/dist/src/services/worker-daemon.js.map +1 -1
  152. package/dist/tsconfig.tsbuildinfo +1 -1
  153. package/package.json +7 -10
  154. package/.claude/skills/agentdb-advanced/SKILL.md +0 -550
  155. package/.claude/skills/agentdb-learning/SKILL.md +0 -545
  156. package/.claude/skills/agentdb-memory-patterns/SKILL.md +0 -339
  157. package/.claude/skills/agentdb-optimization/SKILL.md +0 -509
  158. package/.claude/skills/agentdb-vector-search/SKILL.md +0 -339
  159. package/.claude/skills/browser/SKILL.md +0 -204
  160. package/.claude/skills/dual-mode/README.md +0 -71
  161. package/.claude/skills/dual-mode/dual-collect.md +0 -103
  162. package/.claude/skills/dual-mode/dual-coordinate.md +0 -85
  163. package/.claude/skills/dual-mode/dual-spawn.md +0 -81
  164. package/.claude/skills/flow-nexus-neural/SKILL.md +0 -727
  165. package/.claude/skills/flow-nexus-platform/SKILL.md +0 -1154
  166. package/.claude/skills/flow-nexus-swarm/SKILL.md +0 -604
  167. package/.claude/skills/github-code-review/SKILL.md +0 -1125
  168. package/.claude/skills/github-multi-repo/SKILL.md +0 -862
  169. package/.claude/skills/github-project-management/SKILL.md +0 -1262
  170. package/.claude/skills/github-release-management/SKILL.md +0 -1064
  171. package/.claude/skills/github-workflow-automation/SKILL.md +0 -1047
  172. package/.claude/skills/hooks-automation/SKILL.md +0 -1201
  173. package/.claude/skills/pair-programming/SKILL.md +0 -1202
  174. package/.claude/skills/reasoningbank-agentdb/SKILL.md +0 -446
  175. package/.claude/skills/reasoningbank-intelligence/SKILL.md +0 -201
  176. package/.claude/skills/skill-builder/SKILL.md +0 -910
  177. package/.claude/skills/sparc-methodology/SKILL.md +0 -1106
  178. package/.claude/skills/stream-chain/SKILL.md +0 -560
  179. package/.claude/skills/swarm-advanced/SKILL.md +0 -970
  180. package/.claude/skills/swarm-orchestration/SKILL.md +0 -179
  181. package/.claude/skills/v3-cli-modernization/SKILL.md +0 -872
  182. package/.claude/skills/v3-core-implementation/SKILL.md +0 -797
  183. package/.claude/skills/v3-ddd-architecture/SKILL.md +0 -442
  184. package/.claude/skills/v3-integration-deep/SKILL.md +0 -241
  185. package/.claude/skills/v3-mcp-optimization/SKILL.md +0 -777
  186. package/.claude/skills/v3-memory-unification/SKILL.md +0 -174
  187. package/.claude/skills/v3-performance-optimization/SKILL.md +0 -390
  188. package/.claude/skills/v3-security-overhaul/SKILL.md +0 -82
  189. package/.claude/skills/v3-swarm-coordination/SKILL.md +0 -340
  190. package/.claude/skills/verification-quality/SKILL.md +0 -691
  191. package/dist/src/__probe.d.ts +0 -2
  192. package/dist/src/__probe.d.ts.map +0 -1
  193. package/dist/src/__probe.js +0 -5
  194. package/dist/src/__probe.js.map +0 -1
  195. package/dist/src/commands/benchmark-cosign.d.ts +0 -29
  196. package/dist/src/commands/benchmark-cosign.d.ts.map +0 -1
  197. package/dist/src/commands/benchmark-cosign.js +0 -222
  198. package/dist/src/commands/benchmark-cosign.js.map +0 -1
  199. package/dist/src/commands/benchmark-verify.d.ts +0 -21
  200. package/dist/src/commands/benchmark-verify.d.ts.map +0 -1
  201. package/dist/src/commands/benchmark-verify.js +0 -202
  202. package/dist/src/commands/benchmark-verify.js.map +0 -1
  203. package/dist/src/mcp-tools/hive-consensus-runtime.d.ts +0 -149
  204. package/dist/src/mcp-tools/hive-consensus-runtime.d.ts.map +0 -1
  205. package/dist/src/mcp-tools/hive-consensus-runtime.js +0 -296
  206. package/dist/src/mcp-tools/hive-consensus-runtime.js.map +0 -1
  207. package/dist/src/mcp-tools/managed-agent-tools.d.ts +0 -22
  208. package/dist/src/mcp-tools/managed-agent-tools.d.ts.map +0 -1
  209. package/dist/src/mcp-tools/managed-agent-tools.js +0 -357
  210. package/dist/src/mcp-tools/managed-agent-tools.js.map +0 -1
  211. package/dist/src/memory/ann-router-registry.d.ts +0 -61
  212. package/dist/src/memory/ann-router-registry.d.ts.map +0 -1
  213. package/dist/src/memory/ann-router-registry.js +0 -72
  214. package/dist/src/memory/ann-router-registry.js.map +0 -1
  215. package/dist/src/memory/diskann-registry.d.ts +0 -56
  216. package/dist/src/memory/diskann-registry.d.ts.map +0 -1
  217. package/dist/src/memory/diskann-registry.js +0 -88
  218. package/dist/src/memory/diskann-registry.js.map +0 -1
package/.claude/commands/github/workflow-automation.md CHANGED
@@ -15,7 +15,7 @@ jobs:
15
15
  swarm-analysis:
16
16
  runs-on: ubuntu-latest
17
17
  steps:
18
- - uses: actions/checkout@v4
18
+ - uses: actions/checkout@v3
19
19
 
20
20
  - name: Initialize Swarm
21
21
  uses: ruvnet/swarm-action@v1
@@ -63,7 +63,7 @@ jobs:
63
63
  detect-and-build:
64
64
  runs-on: ubuntu-latest
65
65
  steps:
66
- - uses: actions/checkout@v4
66
+ - uses: actions/checkout@v3
67
67
 
68
68
  - name: Detect Languages
69
69
  id: detect
package/.claude/helpers/github-safe.js CHANGED
@@ -1,43 +1,34 @@
1
1
  #!/usr/bin/env node
2
+
2
3
  /**
3
- * Safe GitHub CLI Helper — v1.0.0
4
- *
5
- * Prevents injection issues when using `gh` commands with untrusted content
6
- * (PR bodies, issue bodies, comment bodies) by routing the body through a
7
- * temp file and using `--body-file` rather than interpolating into shell args.
4
+ * Safe GitHub CLI Helper
8
5
  *
9
- * ADR-127 Phase 2 hardening:
10
- * - GITHUB_SAFE_VERSION exported for smoke assertions.
11
- * - Explicit 256KB body cap: rejects oversized bodies before any temp-file
12
- * write, matching the GitHub API `body` field limit.
13
- * - Strict error handling: all execSync calls inside try/catch; cleanup in
14
- * finally; non-zero exit on any error.
15
- * - GITHUB_SAFE_DRY_RUN=1 env-var skips the actual `gh` exec for testing.
6
+ * Prevents two classes of issue when calling `gh`:
7
+ * 1. Timeout / shell-quoting bugs when issue/PR bodies contain backticks,
8
+ * `$(...)`, or other special characters — bodies go through a temp file
9
+ * via `--body-file` instead of being inlined in the command line.
10
+ * 2. Command injection (audit_1776853149979 finding) — args were
11
+ * previously concatenated into a shell string and passed to
12
+ * `execSync`, so a caller passing `; rm -rf …` would have it
13
+ * executed by /bin/sh. Now uses `execFileSync('gh', argArray)`
14
+ * which goes through execve directly with no shell interpretation.
16
15
  *
17
16
  * Usage:
18
- * ./github-safe.js issue comment 123 "Message with \`backticks\`"
17
+ * ./github-safe.js issue comment 123 "Message with `backticks`"
19
18
  * ./github-safe.js pr create --title "Title" --body "Complex body"
20
19
  */
21
20
 
22
- import { execSync, execFileSync } from 'child_process';
21
+ import { execFileSync } from 'child_process';
23
22
  import { writeFileSync, unlinkSync } from 'fs';
24
23
  import { tmpdir } from 'os';
25
24
  import { join } from 'path';
26
25
  import { randomBytes } from 'crypto';
27
26
 
28
- // Version constant — asserted by smoke-github-safe-injection.mjs.
29
- export const GITHUB_SAFE_VERSION = '1.0.0';
30
-
31
- // Maximum body size allowed (bytes). The GitHub API enforces 65536 chars for
32
- // issue/PR bodies; the CLI is more lenient but the 256KB limit is a
33
- // conservative safety cap that prevents accidental oversized writes.
34
- const MAX_BODY_BYTES = 256 * 1024;
35
-
36
27
  const args = process.argv.slice(2);
37
28
 
38
29
  if (args.length < 2) {
39
30
  console.log(`
40
- Safe GitHub CLI Helper v${GITHUB_SAFE_VERSION}
31
+ Safe GitHub CLI Helper
41
32
 
42
33
  Usage:
43
34
  ./github-safe.js issue comment <number> <body>
@@ -45,18 +36,44 @@ Usage:
45
36
  ./github-safe.js issue create --title <title> --body <body>
46
37
  ./github-safe.js pr create --title <title> --body <body>
47
38
 
48
- This helper prevents injection issues with special characters:
49
- - Backticks in code examples
50
- - Command substitution $(...)
51
- - Semicolons and other shell metacharacters
52
- - Oversized bodies (> 256 KB rejected)
39
+ Bodies with backticks, command substitution, and other special shell
40
+ characters are routed through a tempfile via --body-file. All gh args
41
+ are passed via execFileSync (no shell interpretation).
53
42
  `);
54
43
  process.exit(1);
55
44
  }
56
45
 
46
+ // Whitelist of gh top-level commands we forward. Restricting this is
47
+ // defense-in-depth even though execFileSync would already block shell
48
+ // metacharacters in args.
49
+ const ALLOWED_COMMANDS = new Set(['issue', 'pr', 'repo', 'api', 'workflow', 'run', 'release', 'auth', 'gist']);
50
+
57
51
  const [command, subcommand, ...restArgs] = args;
58
52
 
59
- // Handle commands that need body content
53
+ if (!ALLOWED_COMMANDS.has(command)) {
54
+ console.error(`Refusing to forward unknown gh command: ${command}`);
55
+ console.error(`Allowed: ${Array.from(ALLOWED_COMMANDS).join(', ')}`);
56
+ process.exit(1);
57
+ }
58
+
59
+ // Build the final argv that gets passed to execFileSync.
60
+ // IMPORTANT: never join into a shell string. Each element is one argv slot.
61
+ function runGh(argv) {
62
+ try {
63
+ execFileSync('gh', argv, {
64
+ stdio: 'inherit',
65
+ timeout: 30000,
66
+ // shell:false is the default — kept explicit so a future refactor
67
+ // doesn't accidentally turn it on.
68
+ shell: false,
69
+ });
70
+ } catch (error) {
71
+ console.error('Error:', error?.message ?? String(error));
72
+ process.exit(1);
73
+ }
74
+ }
75
+
76
+ // Handle commands that take body content
60
77
  if ((command === 'issue' || command === 'pr') &&
61
78
  (subcommand === 'comment' || subcommand === 'create')) {
62
79
 
@@ -64,11 +81,10 @@ if ((command === 'issue' || command === 'pr') &&
64
81
  let body = '';
65
82
 
66
83
  if (subcommand === 'comment' && restArgs.length >= 2) {
67
- // Simple format: github-safe.js issue comment 123 "body"
84
+ // Positional: github-safe.js issue comment 123 "body"
68
85
  body = restArgs[1];
69
86
  bodyIndex = 1;
70
87
  } else {
71
- // Flag format: --body "content"
72
88
  bodyIndex = restArgs.indexOf('--body');
73
89
  if (bodyIndex !== -1 && bodyIndex < restArgs.length - 1) {
74
90
  body = restArgs[bodyIndex + 1];
@@ -76,81 +92,30 @@ if ((command === 'issue' || command === 'pr') &&
76
92
  }
77
93
 
78
94
  if (body) {
79
- // Enforce 256KB cap before any file I/O.
80
- const bodyBytes = Buffer.byteLength(body, 'utf8');
81
- if (bodyBytes > MAX_BODY_BYTES) {
82
- console.error(
83
- `[ERROR] Body exceeds maximum allowed size (${bodyBytes} bytes > ${MAX_BODY_BYTES} bytes). ` +
84
- 'GitHub API body fields are capped at 256KB. Truncate the body before passing it to github-safe.js.'
85
- );
86
- process.exit(1);
87
- }
88
-
89
- // Use temporary file for body content — never interpolate into argv.
90
95
  const tmpFile = join(tmpdir(), `gh-body-${randomBytes(8).toString('hex')}.tmp`);
91
-
92
96
  try {
93
97
  writeFileSync(tmpFile, body, 'utf8');
94
98
 
95
- // Build new command with --body-file
96
- const newArgs = [...restArgs];
99
+ // Build the gh argv with --body-file instead of --body / inline body
100
+ const finalArgs = [command, subcommand, ...restArgs];
101
+ const offset = 2; // command + subcommand
97
102
  if (subcommand === 'comment' && bodyIndex === 1) {
98
- // Replace positional body arg with --body-file
99
- newArgs[1] = '--body-file';
100
- newArgs.push(tmpFile);
103
+ finalArgs[offset + 1] = '--body-file';
104
+ finalArgs.push(tmpFile);
101
105
  } else if (bodyIndex !== -1) {
102
- // Replace --body flag pair with --body-file
103
- newArgs[bodyIndex] = '--body-file';
104
- newArgs[bodyIndex + 1] = tmpFile;
105
- }
106
-
107
- // Skip actual gh exec in dry-run mode (used by smoke tests).
108
- if (process.env.GITHUB_SAFE_DRY_RUN === '1') {
109
- const ghArgs = [command, subcommand, ...newArgs];
110
- console.log(`[DRY-RUN] gh ${ghArgs.join(' ')}`);
111
- process.exit(0);
106
+ finalArgs[offset + bodyIndex] = '--body-file';
107
+ finalArgs[offset + bodyIndex + 1] = tmpFile;
112
108
  }
113
109
 
114
- const ghArgv = [command, subcommand, ...newArgs];
115
- console.log(`Executing: gh ${ghArgv.join(' ')}`);
116
-
117
- // Use execFileSync to avoid shell interpolation — args are passed as an
118
- // array so shell metacharacters in tmpFile path cannot be exploited.
119
- execFileSync('gh', ghArgv, {
120
- stdio: 'inherit',
121
- timeout: 30000,
122
- });
123
-
124
- } catch (error) {
125
- console.error('[ERROR]', error.message);
126
- process.exit(1);
110
+ runGh(finalArgs);
127
111
  } finally {
128
- // Always clean up the temp file.
129
- try { unlinkSync(tmpFile); } catch (_) { /* ignore cleanup errors */ }
112
+ try { unlinkSync(tmpFile); } catch { /* ignore cleanup errors */ }
130
113
  }
131
114
  } else {
132
- // No body content — execute normally (no injection risk for args).
133
- if (process.env.GITHUB_SAFE_DRY_RUN === '1') {
134
- console.log(`[DRY-RUN] gh ${args.join(' ')}`);
135
- process.exit(0);
136
- }
137
- try {
138
- execFileSync('gh', args, { stdio: 'inherit' });
139
- } catch (error) {
140
- console.error('[ERROR]', error.message);
141
- process.exit(1);
142
- }
115
+ // No body — forward all args as-is (still via execFileSync)
116
+ runGh(args);
143
117
  }
144
118
  } else {
145
- // Non-body commands — execute normally.
146
- if (process.env.GITHUB_SAFE_DRY_RUN === '1') {
147
- console.log(`[DRY-RUN] gh ${args.join(' ')}`);
148
- process.exit(0);
149
- }
150
- try {
151
- execFileSync('gh', args, { stdio: 'inherit' });
152
- } catch (error) {
153
- console.error('[ERROR]', error.message);
154
- process.exit(1);
155
- }
119
+ // Other gh subcommands — forward as-is
120
+ runGh(args);
156
121
  }
package/.claude/helpers/github-setup.sh CHANGED
@@ -1,44 +1,27 @@
1
1
  #!/bin/bash
2
- # Security rationale: set -euo pipefail ensures that:
3
- # -e — exit immediately if any command fails (no silent failures)
4
- # -u — treat unset variables as errors (prevents empty-string expansion bugs)
5
- # -o pipefail — pipeline fails if any command in it fails (not just last)
6
- # This matches the ADR-127 Phase 2 requirement for github-setup.sh hardening.
7
- set -euo pipefail
8
-
9
2
  # Setup GitHub integration for Claude Flow
10
3
 
11
- echo "Setting up GitHub integration..."
4
+ echo "🔗 Setting up GitHub integration..."
12
5
 
13
6
  # Check for gh CLI
14
7
  if ! command -v gh &> /dev/null; then
15
- echo "WARNING: GitHub CLI (gh) not found"
8
+ echo "⚠️ GitHub CLI (gh) not found"
16
9
  echo "Install from: https://cli.github.com/"
17
10
  echo "Continuing without GitHub features..."
18
11
  else
19
- echo "OK: GitHub CLI found"
20
-
21
- # Check auth status and scope sufficiency.
22
- # `gh auth status` exits non-zero when not authenticated.
23
- # We additionally parse for "Token scopes" to verify we have at least
24
- # 'repo' scope, which is required for PR/issue operations.
25
- if gh auth status 2>&1 | grep -q "Logged in"; then
26
- echo "OK: GitHub authentication active"
27
- # Verify repo scope is present for PR/issue operations.
28
- if gh auth status 2>&1 | grep -q "repo"; then
29
- echo "OK: 'repo' scope available"
30
- else
31
- echo "WARNING: 'repo' scope not confirmed — PR/issue operations may fail"
32
- echo "Run: gh auth login --scopes repo,read:org"
33
- fi
12
+ echo "✅ GitHub CLI found"
13
+
14
+ # Check auth status
15
+ if gh auth status &> /dev/null; then
16
+ echo "✅ GitHub authentication active"
34
17
  else
35
- echo "WARNING: Not authenticated with GitHub"
18
+ echo "⚠️ Not authenticated with GitHub"
36
19
  echo "Run: gh auth login"
37
20
  fi
38
21
  fi
39
22
 
40
23
  echo ""
41
- echo "GitHub swarm commands available:"
24
+ echo "📦 GitHub swarm commands available:"
42
25
  echo " - npx claude-flow github swarm"
43
26
  echo " - npx claude-flow repo analyze"
44
27
  echo " - npx claude-flow pr enhance"
package/.claude/helpers/hook-handler.cjs CHANGED
@@ -112,12 +112,8 @@ async function main() {
112
112
  const toolInput = hookInput.toolInput || hookInput.tool_input || {};
113
113
  const toolName = hookInput.toolName || hookInput.tool_name || '';
114
114
 
115
- // Merge stdin data into prompt resolution: prefer stdin fields, then env, then argv.
116
- // `toolInput` is an object (e.g. {command:"ls"}) — it's truthy but not a string,
117
- // so falling back to it directly bound `prompt` to the object and tripped
118
- // `.toLowerCase()` / `.substring()` on every Bash hook (#1944). Use the
119
- // `.command` field instead, which is the actual string the hook needs.
120
- const prompt = hookInput.prompt || hookInput.command || toolInput.command
115
+ // Merge stdin data into prompt resolution: prefer stdin fields, then env, then argv
116
+ const prompt = hookInput.prompt || hookInput.command || toolInput
121
117
  || process.env.PROMPT || process.env.TOOL_INPUT_command || args.join(' ') || '';
122
118
 
123
119
  const handlers = {
@@ -148,12 +144,8 @@ const handlers = {
148
144
  },
149
145
 
150
146
  'pre-bash': () => {
151
- // Basic command safety check — prefer stdin command data from Claude Code.
152
- // String() wrap is belt-and-suspenders for #2017: even if a future regression
153
- // re-binds `prompt` or `hookInput.command` to a non-string, `.toLowerCase()`
154
- // can no longer throw a TypeError that the global try/catch would swallow
155
- // (silently exiting 0 and letting the dangerous command through).
156
- const cmd = String(hookInput.command || toolInput.command || prompt || '').toLowerCase();
147
+ // Basic command safety check — prefer stdin command data from Claude Code
148
+ const cmd = (hookInput.command || prompt).toLowerCase();
157
149
  const dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\', ':(){:|:&};:'];
158
150
  for (const d of dangerous) {
159
151
  if (cmd.includes(d)) {
package/.claude/helpers/statusline.cjs CHANGED
@@ -25,37 +25,8 @@
25
25
  /* eslint-disable @typescript-eslint/no-var-requires */
26
26
  const fs = require('fs');
27
27
  const path = require('path');
28
- const os = require('os');
29
28
  const { execSync, execFileSync } = require('child_process');
30
29
 
31
- // Read the installed plugin version once at startup. Probe the plugin's own
32
- // install location first (`~/.claude/plugins/marketplaces/ruflo/package.json`),
33
- // then npm-style installs, then the source-checkout location. The previous
34
- // code hardcoded `RuFlo V3.5` in the header — so users on alpha.27+ still
35
- // saw V3.5 in the statusline even though `ruflo doctor` reported the real
36
- // version (#1951).
37
- let RUFLO_VERSION = '3.6';
38
- try {
39
- const home = os.homedir();
40
- const cwd = process.cwd();
41
- const pkgPaths = [
42
- path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'package.json'),
43
- path.join(cwd, 'node_modules', '@claude-flow', 'cli', 'package.json'),
44
- path.join(cwd, 'node_modules', 'ruflo', 'package.json'),
45
- path.join(cwd, 'v3', '@claude-flow', 'cli', 'package.json'),
46
- ];
47
- for (const p of pkgPaths) {
48
- if (!fs.existsSync(p)) continue;
49
- try {
50
- const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
51
- if (pkg && typeof pkg.version === 'string' && pkg.version.length > 0) {
52
- RUFLO_VERSION = pkg.version;
53
- break;
54
- }
55
- } catch { /* malformed package.json — try next */ }
56
- }
57
- } catch { /* fall through to the hardcoded default */ }
58
-
59
30
  // Configuration
60
31
  const CONFIG = {
61
32
  enabled: true,
@@ -431,7 +402,7 @@ function generateStatusline() {
431
402
  const lines = [];
432
403
 
433
404
  // Header Line
434
- let header = `${c.bold}${c.brightPurple}▊ RuFlo V${RUFLO_VERSION} ${c.reset}`;
405
+ let header = `${c.bold}${c.brightPurple}▊ RuFlo V3.5 ${c.reset}`;
435
406
  header += `${swarm.coordinationActive ? c.brightCyan : c.dim}● ${c.brightCyan}${user.name}${c.reset}`;
436
407
  if (user.gitBranch) {
437
408
  header += ` ${c.dim}│${c.reset} ${c.brightBlue}⎇ ${user.gitBranch}${c.reset}`;
@@ -537,7 +508,7 @@ function generateSafeStatusline() {
537
508
  const lines = [];
538
509
 
539
510
  // Header Line
540
- let header = `${c.bold}${c.brightPurple}▊ RuFlo V${RUFLO_VERSION} ${c.reset}`;
511
+ let header = `${c.bold}${c.brightPurple}▊ RuFlo V3.5 ${c.reset}`;
541
512
  header += `${swarm.coordinationActive ? c.brightCyan : c.dim}● ${c.brightCyan}${user.name}${c.reset}`;
542
513
  if (user.gitBranch) {
543
514
  header += ` ${c.dim}│${c.reset} ${c.brightBlue}⎇ ${user.gitBranch}${c.reset}`;
package/.claude/settings.json CHANGED
@@ -115,7 +115,7 @@
115
115
  ]
116
116
  },
117
117
  "attribution": {
118
- "commit": "Co-Authored-By: ruflo-bot <ruflo-bot@users.noreply.github.com>",
118
+ "commit": "Co-Authored-By: claude-flow <ruv@ruv.net>",
119
119
  "pr": "Generated with [claude-flow](https://github.com/ruvnet/claude-flow)"
120
120
  },
121
121
  "claudeFlow": {
package/README.md CHANGED
@@ -1,25 +1,17 @@
1
1
  <div align="center">
2
2
 
3
- [![Ruflo Banner](ruflo/assets/ruflo-small.jpeg)](https://cognitum.one/agentic-engineering)
3
+ [![Ruflo Banner](ruflo/assets/ruflo-small.jpeg)](https://flo.ruv.io/)
4
4
 
5
5
  [![Try the UI Beta — flo.ruv.io](https://img.shields.io/badge/_Try_the_UI_Beta-flo.ruv.io-6366f1?style=for-the-badge&logoColor=white&logo=svelte)](https://flo.ruv.io/)
6
6
  [![Goal Planner — goal.ruv.io](https://img.shields.io/badge/_Goal_Planner-goal.ruv.io-8b5cf6?style=for-the-badge&logoColor=white&logo=react)](https://goal.ruv.io/)
7
7
  [![Live Agents — goal.ruv.io/agents](https://img.shields.io/badge/_Live_Agents-goal.ruv.io%2Fagents-10b981?style=for-the-badge&logoColor=white&logo=react)](https://goal.ruv.io/agents)
8
8
 
9
- [![npm version (ruflo)](https://img.shields.io/npm/v/ruflo?label=ruflo&style=for-the-badge&logo=npm&color=cb3837)](https://www.npmjs.com/package/ruflo)
10
- [![Ecosystem downloads](https://img.shields.io/badge/ecosystem%20downloads-22.2M%2B-blue?style=for-the-badge&logo=npm)](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.proof.json)
11
- [![Git clones (14d)](https://img.shields.io/badge/git%20clones%2014d-115k-blueviolet?style=for-the-badge&logo=github)](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.ledger.json)
12
-
13
9
  [![Star on GitHub](https://img.shields.io/github/stars/ruvnet/claude-flow?style=for-the-badge&logo=github&color=gold)](https://github.com/ruvnet/claude-flow)
14
10
  [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://opensource.org/licenses/MIT)
15
11
  [![Claude Code](https://img.shields.io/badge/Claude%20Code-Plugin-D97757?style=for-the-badge&logoColor=white&logo=anthropic)](https://github.com/ruvnet/claude-flow)
16
12
  [![Codex Plugin](https://img.shields.io/badge/Codex-Plugin-412991?style=for-the-badge&logoColor=white&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI%2BPHBhdGggZmlsbD0id2hpdGUiIGQ9Ik0yMi4yODIgOS44MjFhNS45ODUgNS45ODUgMCAwIDAtLjUxNi00LjkxIDYuMDQ2IDYuMDQ2IDAgMCAwLTYuNTEtMi45QTYuMDY1IDYuMDY1IDAgMCAwIDQuOTgxIDQuMThhNS45ODUgNS45ODUgMCAwIDAtMy45OTggMi45IDYuMDQ2IDYuMDQ2IDAgMCAwIC43NDMgNy4wOTcgNS45OCA1Ljk4IDAgMCAwIC41MSA0LjkxMSA2LjA1MSA2LjA1MSAwIDAgMCA2LjUxNSAyLjlBNS45ODUgNS45ODUgMCAwIDAgMTMuMjYgMjRhNi4wNTYgNi4wNTYgMCAwIDAgNS43NzItNC4yMDYgNS45OSA1Ljk5IDAgMCAwIDMuOTk4LTIuOSA2LjA1NiA2LjA1NiAwIDAgMC0uNzQ3LTcuMDczek0xMy4yNiAyMi40M2E0LjQ3NiA0LjQ3NiAwIDAgMS0yLjg3Ni0xLjA0bC4xNDItLjA4IDQuNzc4LTIuNzU4YS43OTUuNzk1IDAgMCAwIC4zOTMtLjY4MXYtNi43MzdsMi4wMiAxLjE2OGEuMDcxLjA3MSAwIDAgMSAuMDM4LjA1MnY1LjU4M2E0LjUwNCA0LjUwNCAwIDAgMS00LjQ5NSA0LjQ5NHpNMy42IDE4LjMwNGE0LjQ3IDQuNDcgMCAwIDEtLjUzNS0zLjAxNGwuMTQyLjA4NSA0Ljc4MyAyLjc1OWEuNzcxLjc3MSAwIDAgMCAuNzgxIDBsNS44NDMtMy4zNjl2Mi4zMzJhLjA4LjA4IDAgMCAxLS4wMzMuMDYyTDkuNzQgMTkuOTVhNC41IDQuNSAwIDAgMS02LjE0LTEuNjQ2ek0yLjM0IDcuODk2YTQuNDg1IDQuNDg1IDAgMCAxIDIuMzY2LTEuOTczVjExLjZhLjc2Ni43NjYgMCAwIDAgLjM4OC42NzdsNS44MTUgMy4zNTQtMi4wMiAxLjE2OGEuMDc2LjA3NiAwIDAgMS0uMDcyIDBsLTQuODMtMi43ODZBNC41MDQgNC41MDQgMCAwIDEgMi4zNCA3Ljg3MnptMTYuNTk3IDMuODU1LTUuODMzLTMuMzg3IDIuMDE2LTEuMTY1YS4wNzYuMDc2IDAgMCAxIC4wNzEgMGw0LjgzIDIuNzkxYTQuNDk0IDQuNDk0IDAgMCAxLS42NzYgOC4xMDR2LTUuNjc3YS43OS43OSAwIDAgMC0uNDA3LS42Njd6bTIuMDEtMy4wMjMtLjE0MS0uMDg1LTQuNzc0LTIuNzgyYS43NzYuNzc2IDAgMCAwLS43ODUgMEw5LjQwOSA5LjIzVjYuODk3YS4wNjYuMDY2IDAgMCAxIC4wMjgtLjA2Mmw0LjgzLTIuNzg3YTQuNDk5IDQuNDk5IDAgMCAxIDYuNjggNC42NnpNOC4zMDcgMTIuODYzbC0yLjAyLTEuMTY0YS4wOC4wOCAwIDAgMS0uMDM4LS4wNTdWNi4wNzRhNC40OTkgNC40OTkgMCAwIDEgNy4zNzYtMy40NTRsLS4xNDIuMDgtNC43NzggMi43NThhLjc5NS43OTUgMCAwIDAtLjM5My42ODJ6bTEuMDk3LTIuMzY2IDIuNjAyLTEuNSAyLjYwNyAxLjV2Mi45OTlsLTIuNTk3IDEuNS0yLjYwNy0xLjVaIi8%2BPC9zdmc%2B)](https://www.npmjs.com/package/@claude-flow/codex)
17
13
  [![🕸️ RuVector Graph Ai](https://img.shields.io/badge/RuVector_Agentic-DB-06b6d4?style=for-the-badge&logoColor=white&logo=graphql)](https://github.com/ruvnet/ruvector)
18
14
 
19
- [![RuFlo Agentic Appliance](v3/docs/assets/RuFlo-agentic-appliance.png)](https://cognitum.one/appliance)
20
-
21
- [![ruFlo Summit — Budapest, June 2–3, 2026](v3/docs/assets/ruFlo-Summit.jpg)](https://github.com/ruvnet/ruflo/issues/1967)
22
-
23
15
  # Ruflo
24
16
 
25
17
  **Multi-agent AI orchestration for Claude Code**
@@ -72,108 +64,101 @@ There are **two different install paths** with very different surface areas. Pic
72
64
  # Install core + any plugins you need
73
65
  /plugin install ruflo-core@ruflo
74
66
  /plugin install ruflo-swarm@ruflo
75
- /plugin install ruflo-rag-memory@ruflo
76
- /plugin install ruflo-neural-trader@ruflo
67
+ /plugin install ruflo-autopilot@ruflo
68
+ /plugin install ruflo-federation@ruflo
77
69
  ```
78
70
 
79
71
  This adds slash commands and agent definitions only. The Ruflo MCP server is NOT registered, so `memory_store`, `swarm_init`, `agent_spawn`, etc. won't be callable from Claude. For the full loop, use Path B below.
80
72
 
81
73
  <details>
82
- <summary><strong>🔌 All 33 plugins</strong></summary>
74
+ <summary><strong>🔌 All 32 plugins</strong></summary>
83
75
 
84
76
  #### Core & Orchestration
85
77
 
86
78
  | Plugin | What it does |
87
79
  |--------|-------------|
88
- | [**ruflo-core**](plugins/ruflo-core/README.md) | Foundation — server, health checks, plugin discovery |
89
- | [**ruflo-swarm**](plugins/ruflo-swarm/README.md) | Coordinate multiple agents as a team |
90
- | [**ruflo-autopilot**](plugins/ruflo-autopilot/README.md) | Let agents run autonomously in a loop |
91
- | [**ruflo-loop-workers**](plugins/ruflo-loop-workers/README.md) | Schedule background tasks on a timer |
92
- | [**ruflo-workflows**](plugins/ruflo-workflows/README.md) | Reusable multi-step task templates |
93
- | [**ruflo-federation**](plugins/ruflo-federation/README.md) | Agents on different machines collaborate securely |
80
+ | **ruflo-core** | Foundation — server, health checks, plugin discovery |
81
+ | **ruflo-swarm** | Coordinate multiple agents as a team |
82
+ | **ruflo-autopilot** | Let agents run autonomously in a loop |
83
+ | **ruflo-loop-workers** | Schedule background tasks on a timer |
84
+ | **ruflo-workflows** | Reusable multi-step task templates |
85
+ | **ruflo-federation** | Agents on different machines collaborate securely |
94
86
 
95
87
  #### Memory & Knowledge
96
88
 
97
89
  | Plugin | What it does |
98
90
  |--------|-------------|
99
- | [**ruflo-agentdb**](plugins/ruflo-agentdb/README.md) | Fast vector database for agent memory |
100
- | [**ruflo-rag-memory**](plugins/ruflo-rag-memory/README.md) | Smart retrieval — hybrid search, graph hops, diversity ranking |
101
- | [**ruflo-rvf**](plugins/ruflo-rvf/README.md) | Save and restore agent memory across sessions |
102
- | [**ruflo-ruvector**](plugins/ruflo-ruvector/README.md) | [`ruvector`](https://npmjs.com/package/ruvector) — GPU-accelerated search, Graph RAG, 103 tools |
103
- | [**ruflo-knowledge-graph**](plugins/ruflo-knowledge-graph/README.md) | Build and traverse entity relationship maps |
91
+ | **ruflo-agentdb** | Fast vector database for agent memory |
92
+ | **ruflo-rag-memory** | Smart retrieval — hybrid search, graph hops, diversity ranking |
93
+ | **ruflo-rvf** | Save and restore agent memory across sessions |
94
+ | **ruflo-ruvector** | [`ruvector`](https://npmjs.com/package/ruvector) — GPU-accelerated search, Graph RAG, 103 tools |
95
+ | **ruflo-knowledge-graph** | Build and traverse entity relationship maps |
104
96
 
105
97
  #### Intelligence & Learning
106
98
 
107
99
  | Plugin | What it does |
108
100
  |--------|-------------|
109
- | [**ruflo-intelligence**](plugins/ruflo-intelligence/README.md) | Agents learn from past successes and get smarter |
110
- | [**ruflo-graph-intelligence**](plugins/ruflo-graph-intelligence/) | Sublinear graph reasoning — PageRank, delta updates, complexity-aware execution (ADR-123) |
111
- | [**ruflo-daa**](plugins/ruflo-daa/README.md) | Dynamic agent behavior and cognitive patterns |
112
- | [**ruflo-ruvllm**](plugins/ruflo-ruvllm/README.md) | Run local LLMs (Ollama, etc.) with smart routing |
113
- | [**ruflo-goals**](plugins/ruflo-goals/README.md) | Break big goals into plans and track progress |
101
+ | **ruflo-intelligence** | Agents learn from past successes and get smarter |
102
+ | **ruflo-daa** | Dynamic agent behavior and cognitive patterns |
103
+ | **ruflo-ruvllm** | Run local LLMs (Ollama, etc.) with smart routing |
104
+ | **ruflo-goals** | Break big goals into plans and track progress |
114
105
 
115
106
  #### Code Quality & Testing
116
107
 
117
108
  | Plugin | What it does |
118
109
  |--------|-------------|
119
- | [**ruflo-testgen**](plugins/ruflo-testgen/README.md) | Find missing tests and generate them automatically |
120
- | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
121
- | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
122
- | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
110
+ | **ruflo-testgen** | Find missing tests and generate them automatically |
111
+ | **ruflo-browser** | Automate browser testing with Playwright |
112
+ | **ruflo-jujutsu** | Analyze git diffs, score risk, suggest reviewers |
113
+ | **ruflo-docs** | Generate and maintain documentation automatically |
123
114
 
124
115
  #### Security & Compliance
125
116
 
126
117
  | Plugin | What it does |
127
118
  |--------|-------------|
128
- | [**ruflo-security-audit**](plugins/ruflo-security-audit/README.md) | Scan for vulnerabilities and CVEs |
129
- | [**ruflo-aidefence**](plugins/ruflo-aidefence/README.md) | Block prompt injection, detect PII, safety scanning |
119
+ | **ruflo-security-audit** | Scan for vulnerabilities and CVEs |
120
+ | **ruflo-aidefence** | Block prompt injection, detect PII, safety scanning |
130
121
 
131
122
  #### Architecture & Methodology
132
123
 
133
124
  | Plugin | What it does |
134
125
  |--------|-------------|
135
- | [**ruflo-adr**](plugins/ruflo-adr/README.md) | Track architecture decisions with a living record |
136
- | [**ruflo-ddd**](plugins/ruflo-ddd/README.md) | Scaffold domain-driven design — contexts, aggregates, events |
137
- | [**ruflo-sparc**](plugins/ruflo-sparc/README.md) | Guided 5-phase development methodology with quality gates |
126
+ | **ruflo-adr** | Track architecture decisions with a living record |
127
+ | **ruflo-ddd** | Scaffold domain-driven design — contexts, aggregates, events |
128
+ | **ruflo-sparc** | Guided 5-phase development methodology with quality gates |
138
129
 
139
130
  #### DevOps & Observability
140
131
 
141
132
  | Plugin | What it does |
142
133
  |--------|-------------|
143
- | [**ruflo-migrations**](plugins/ruflo-migrations/README.md) | Manage database schema changes safely |
144
- | [**ruflo-observability**](plugins/ruflo-observability/README.md) | Structured logs, traces, and metrics in one place |
145
- | [**ruflo-cost-tracker**](plugins/ruflo-cost-tracker/README.md) | Track token usage, set budgets, get cost alerts |
134
+ | **ruflo-migrations** | Manage database schema changes safely |
135
+ | **ruflo-observability** | Structured logs, traces, and metrics in one place |
136
+ | **ruflo-cost-tracker** | Track token usage, set budgets, get cost alerts |
146
137
 
147
138
  #### Extensibility
148
139
 
149
140
  | Plugin | What it does |
150
141
  |--------|-------------|
151
- | [**ruflo-agent**](plugins/ruflo-agent/README.md) | Run agents — local WASM sandbox (rvagent) + Anthropic Claude Managed Agents (cloud) |
152
- | [**ruflo-plugin-creator**](plugins/ruflo-plugin-creator/README.md) | Scaffold, validate, and publish your own plugins |
142
+ | **ruflo-wasm** | Run sandboxed WebAssembly agents |
143
+ | **ruflo-plugin-creator** | Scaffold, validate, and publish your own plugins |
153
144
 
154
145
  #### Domain-Specific
155
146
 
156
147
  | Plugin | What it does |
157
148
  |--------|-------------|
158
- | [**ruflo-iot-cognitum**](plugins/ruflo-iot-cognitum/README.md) | IoT device management — trust scoring, anomaly detection, fleets |
159
- | [**ruflo-neural-trader**](plugins/ruflo-neural-trader/README.md) | [`neural-trader`](https://npmjs.com/package/neural-trader) — AI trading with 4 agents, backtesting, 112+ tools |
160
- | [**ruflo-market-data**](plugins/ruflo-market-data/README.md) | Ingest market data, vectorize OHLCV, detect patterns |
149
+ | **ruflo-iot-cognitum** | IoT device management — trust scoring, anomaly detection, fleets |
150
+ | **ruflo-neural-trader** | [`neural-trader`](https://npmjs.com/package/neural-trader) — AI trading with 4 agents, backtesting, 112+ tools |
151
+ | **ruflo-market-data** | Ingest market data, vectorize OHLCV, detect patterns |
161
152
 
162
153
  </details>
163
154
 
164
155
  ### CLI Install
165
156
 
166
- **macOS / Linux / WSL / Git-Bash:**
167
-
168
157
  ```bash
169
- # One-line install (POSIX shells only — see Windows note below)
158
+ # One-line install
170
159
  curl -fsSL https://cdn.jsdelivr.net/gh/ruvnet/ruflo@main/scripts/install.sh | bash
171
- ```
172
-
173
- **All platforms (including native Windows PowerShell / cmd):**
174
160
 
175
- ```bash
176
- # Interactive setup wizard — runs identically on every platform
161
+ # Or via npx (interactive setup)
177
162
  npx ruflo@latest init wizard
178
163
 
179
164
  # Quick non-interactive init
@@ -183,8 +168,6 @@ npx ruflo@latest init wizard
183
168
  npm install -g ruflo@latest
184
169
  ```
185
170
 
186
- > 💡 **Windows users:** the `curl ... | bash` form needs a POSIX shell (Git-Bash, WSL, MSYS). The `npx ruflo@latest init wizard` line works natively in PowerShell and cmd. If you hit an `'bash' is not recognized` error, use the `npx` line instead — both end up running the same init flow.
187
-
188
171
  ### MCP Server
189
172
 
190
173
  ```bash
package/dist/src/commands/daemon.d.ts CHANGED
@@ -3,26 +3,6 @@
3
3
  * Manages background worker daemon (Node.js-based, similar to shell helpers)
4
4
  */
5
5
  import type { Command } from '../types.js';
6
- /**
7
- * #1914: Resolve the `--workspace` flag to an absolute path, or return null
8
- * if it is absent / not a usable string. Rejects values with null bytes or
9
- * shell metacharacters (defence-in-depth — the value is later embedded in a
10
- * forked child's argv and compared against `ps`/`tasklist` output).
11
- */
12
- export declare function resolveWorkspaceFlag(raw: unknown): string | null;
13
- /**
14
- * #1914: True when a process command line (from `ps -eo command` on POSIX or
15
- * the tasklist Window Title column on Windows) belongs to a daemon started
16
- * for `workspaceRoot`. The launcher (`startBackgroundDaemon`) always appends
17
- * `--workspace <root>` as the FINAL argv entry, so an exact trailing match
18
- * after stripping trailing whitespace/quotes is unambiguous — even for
19
- * workspace paths containing spaces — and never a bare path-prefix match,
20
- * so workspace `/a/proj` does not reap `/a/proj-other`'s daemon. A daemon
21
- * whose argv puts `--workspace` mid-list (only possible via a hand-rolled
22
- * invocation) simply won't be auto-reaped — `daemon stop` still handles it
23
- * via the PID file.
24
- */
25
- export declare function daemonCommandLineBelongsToWorkspace(commandLine: string, workspaceRoot: string): boolean;
26
6
  export declare const daemonCommand: Command;
27
7
  export default daemonCommand;
28
8
  //# sourceMappingURL=daemon.d.ts.map
package/dist/src/commands/daemon.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AA2O1E;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mCAAmC,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEvG;AAq0BD,eAAO,MAAM,aAAa,EAAE,OA+D3B,CAAC;AAEF,eAAe,aAAa,CAAC"}
1
+ {"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AAu/B1E,eAAO,MAAM,aAAa,EAAE,OA+D3B,CAAC;AAEF,eAAe,aAAa,CAAC"}