@claude-flow/cli 3.71.3 → 3.72.0

package/dist/src/mcp-tools/record-store.js

@@ -1,4 +1,18 @@
-import { readFileSync } from 'node:fs';
+import { chmodSync, copyFileSync, existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+/**
+ * Give a record map a null prototype. Record keys come from MCP tool input; on
+ * a plain object `__proto__` or `constructor` resolve to Object.prototype or a
+ * built-in, which a handler would then write into. A null-prototype map only
+ * ever returns its own records.
+ */
+export function nullPrototypeRecords(map) {
+    if (map && typeof map === 'object' && !Array.isArray(map)) {
+        Object.setPrototypeOf(map, null);
+        return map;
+    }
+    return Object.create(null);
+}
 /** Only an absent store is empty. Failed reads must never authorize replacement. */
 export function readRecordStore(path, collection, empty) {
     let text;
@@ -6,8 +20,11 @@ export function readRecordStore(path, collection, empty) {
         text = readFileSync(path, 'utf-8');
     }
     catch (error) {
-        if (error.code === 'ENOENT')
-            return empty();
+        if (error.code === 'ENOENT') {
+            const store = empty();
+            store[collection] = nullPrototypeRecords(store[collection]);
+            return store;
+        }
         throw error;
     }
     const store = JSON.parse(text);
@@ -16,6 +33,103 @@ export function readRecordStore(path, collection, empty) {
         || !records || typeof records !== 'object' || Array.isArray(records)) {
         throw new Error(`Invalid ${collection} store at ${path}; existing data was preserved`);
     }
+    nullPrototypeRecords(records);
     return store;
 }
+/**
+ * JSON object store read for workflow, hive-mind, and swarm (#4737).
+ * Same rule as {@link readRecordStore}: only a missing file is empty.
+ * A parse failure, a non-object document, or a document `accept` rejects is
+ * copied to `${path}.corrupt-<timestamp>` and thrown, so a later save cannot
+ * replace the original.
+ */
+export function readPreservedJsonStore(path, label, empty, accept = () => true) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf-8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return empty();
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        refuseCorruptStore(path, label, why);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) || !accept(parsed)) {
+        refuseCorruptStore(path, label);
+    }
+    return parsed;
+}
+function refuseCorruptStore(path, label, detail) {
+    let where = 'existing data was preserved';
+    try {
+        where = `corrupt file backed up to ${backupCorruptStore(path)}; existing data was preserved`;
+    }
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        where = `backup failed (${why}); existing data was preserved`;
+    }
+    const suffix = detail ? ` (${detail})` : '';
+    throw new Error(`Invalid ${label} store at ${path}${suffix}; ${where}`);
+}
+/**
+ * Copy `path` to `${path}.corrupt-<timestamp>` without removing the original.
+ * A backup with identical bytes is reused, so polling a corrupt store does not
+ * add a copy on every read.
+ */
+function backupCorruptStore(path) {
+    const existing = existingIdenticalBackup(path);
+    if (existing)
+        return existing;
+    const stamp = Date.now();
+    let backup = `${path}.corrupt-${stamp}`;
+    let n = 0;
+    while (existsSync(backup)) {
+        n += 1;
+        backup = `${path}.corrupt-${stamp}-${n}`;
+    }
+    copyFileSync(path, backup);
+    try {
+        chmodSync(backup, statSync(path).mode & 0o777);
+    }
+    catch {
+        /* content is already copied; mode is best-effort */
+    }
+    return backup;
+}
+function existingIdenticalBackup(path) {
+    const dir = dirname(path);
+    const prefix = `${basename(path)}.corrupt-`;
+    let current;
+    try {
+        current = readFileSync(path);
+    }
+    catch {
+        return null;
+    }
+    let names;
+    try {
+        names = readdirSync(dir).filter((name) => name.startsWith(prefix));
+    }
+    catch {
+        return null;
+    }
+    for (const name of names) {
+        const candidate = join(dir, name);
+        try {
+            if (statSync(candidate).size === current.length && readFileSync(candidate).equals(current))
+                return candidate;
+        }
+        catch {
+            /* unreadable candidate: keep looking */
+        }
+    }
+    return null;
+}
 //# sourceMappingURL=record-store.js.map

package/dist/src/mcp-tools/security-tools.d.ts

@@ -10,6 +10,15 @@
  * Created with ❤️ by ruv.io
  */
 import type { MCPTool } from './types.js';
+/**
+ * Pattern-pack selection for the shared defender (#4785, ADR-517), read once
+ * per process from RUFLO_AIDEFENCE_PACKS:
+ *   unset/empty  current default (option omitted)
+ *   true|false   all enabled packs | built-in patterns only
+ *   a,b,c        exactly the named packs
+ * Anything else is refused rather than silently falling back.
+ */
+export declare function aidefencePackSelection(raw?: string | undefined): boolean | string[] | undefined;
 /**
  * Export all security tools
  */

package/dist/src/mcp-tools/security-tools.js

@@ -33,6 +33,42 @@ const wrapperStats = {
     quickScanCalls: 0,
     quickScanThreats: 0,
 };
+const KNOWN_PACKS = new Set([
+    'core',
+    'tool_invocation',
+    'exfil_url',
+    'encoded_instruction',
+    'slack_markup_forgery',
+    'instruction_override_i18n',
+]);
+/**
+ * Pattern-pack selection for the shared defender (#4785, ADR-517), read once
+ * per process from RUFLO_AIDEFENCE_PACKS:
+ *   unset/empty  current default (option omitted)
+ *   true|false   all enabled packs | built-in patterns only
+ *   a,b,c        exactly the named packs
+ * Anything else is refused rather than silently falling back.
+ */
+export function aidefencePackSelection(raw = process.env.RUFLO_AIDEFENCE_PACKS) {
+    const value = raw?.trim();
+    if (!value)
+        return undefined;
+    const lower = value.toLowerCase();
+    if (lower === 'true')
+        return true;
+    if (lower === 'false')
+        return false;
+    const names = value.split(',').map(name => name.trim()).filter(Boolean);
+    const unknown = names.filter(name => !KNOWN_PACKS.has(name));
+    if (names.length === 0 || unknown.length > 0) {
+        throw new Error(`Invalid RUFLO_AIDEFENCE_PACKS=${JSON.stringify(value)}: use true, false, or a comma list of ${[...KNOWN_PACKS].join(', ')}`);
+    }
+    return [...new Set(names)];
+}
+function aidefenceOptions() {
+    const packs = aidefencePackSelection();
+    return packs === undefined ? { enableLearning: true } : { enableLearning: true, packs };
+}
 /**
  * Get or create AIDefence instance (throws if unavailable)
  */
@@ -44,7 +80,7 @@ async function getAIDefence() {
     // First attempt - try to load via dynamic import (ESM)
     try {
         const aidefence = await import(packageName);
-        const instance = aidefence.createAIDefence({ enableLearning: true });
+        const instance = aidefence.createAIDefence(aidefenceOptions());
         if (!instance) {
             throw new Error('createAIDefence returned null');
         }
@@ -81,7 +117,7 @@ async function getAIDefence() {
     // the module cache is stable across the await boundary.
     try {
         const aidefence = await import(packageName);
-        const instance = aidefence.createAIDefence({ enableLearning: true });
+        const instance = aidefence.createAIDefence(aidefenceOptions());
         if (instance) {
             aidefenceInstance = instance;
             console.error(`[claude-flow] ${packageName} loaded after install (resolver path)`);
@@ -95,7 +131,7 @@ async function getAIDefence() {
         const modulePath = require.resolve(packageName);
         const cacheBust = `?t=${Date.now()}`;
         const aidefence = await import(`file://${modulePath}${cacheBust}`);
-        const instance = aidefence.createAIDefence({ enableLearning: true });
+        const instance = aidefence.createAIDefence(aidefenceOptions());
         if (!instance) {
             throw new Error('createAIDefence returned null after install');
         }

package/dist/src/mcp-tools/session-tools.js

@@ -3,11 +3,13 @@
  *
  * Tool definitions for session management with file persistence.
  */
-import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { gunzipSync } from 'node:zlib';
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { containedWritePath } from './path-containment.js';
+import { MAX_IMPORT_BYTES, readImportFile } from './import-limits.js';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 function isRecord(value) {
@@ -351,41 +353,6 @@ function isSessionRecordLike(value) {
     const v = value;
     return 'data' in v || 'stats' in v || 'sessionId' in v || 'savedAt' in v;
 }
-/**
- * SECURITY: `outputPath` comes from MCP tool input. Resolve it against the
- * project root and require the real (symlink-resolved) parent directory to stay
- * inside the real project root, and refuse an existing symlink as the target,
- * so session_export cannot write files elsewhere on the host. The CLI's
- * `session export` writes its own file and does not pass outputPath.
- */
-function containedExportPath(outputPath) {
-    if (!outputPath || outputPath.includes('\0'))
-        return null;
-    try {
-        const root = realpathSync(getProjectCwd());
-        const abs = resolve(root, outputPath);
-        const parent = realpathSync(dirname(abs));
-        const target = join(parent, basename(abs));
-        const rel = relative(root, target);
-        if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
-            return null;
-        const existing = lstatOrNull(target);
-        if (existing && (existing.isSymbolicLink() || !existing.isFile()))
-            return null;
-        return target;
-    }
-    catch {
-        return null;
-    }
-}
-function lstatOrNull(p) {
-    try {
-        return lstatSync(p);
-    }
-    catch {
-        return null;
-    }
-}
 export const sessionTools = [
     {
         name: 'session_save',
@@ -740,7 +707,7 @@ export const sessionTools = [
             let path = null;
             const outputPath = input.outputPath ? String(input.outputPath) : null;
             if (outputPath) {
-                const target = containedExportPath(outputPath);
+                const target = containedWritePath(outputPath);
                 if (!target)
                     return { sessionId, error: 'outputPath must be a file inside the project directory (no symlinks)' };
                 try {
@@ -763,7 +730,7 @@ export const sessionTools = [
         inputSchema: {
             type: 'object',
             properties: {
-                inputPath: { type: 'string', description: 'Path to the session JSON file to import (or pass data)' },
+                inputPath: { type: 'string', description: 'Path to the session JSON file to import (or pass data); file and gzip output are each limited to 16 MiB' },
                 data: { type: 'object', description: 'The session record itself, as written by session_export (or pass inputPath)' },
                 name: { type: 'string', description: 'Override the imported session name' },
                 activate: { type: 'boolean', description: 'Restore the imported session into the active stores' },
@@ -781,8 +748,9 @@ export const sessionTools = [
                 if (!existsSync(inputPath))
                     return { error: `File not found: ${inputPath}` };
                 try {
-                    const bytes = readFileSync(inputPath);
-                    const content = bytes[0] === 0x1f && bytes[1] === 0x8b ? gunzipSync(bytes) : bytes;
+                    const bytes = readImportFile(inputPath);
+                    const content = bytes[0] === 0x1f && bytes[1] === 0x8b
+                        ? gunzipSync(bytes, { maxOutputLength: MAX_IMPORT_BYTES }) : bytes;
                     parsed = JSON.parse(content.toString('utf-8'));
                 }
                 catch (e) {

package/dist/src/mcp-tools/swarm-tools.js

@@ -4,8 +4,9 @@
  * Tool definitions for swarm coordination with file-based state persistence.
  * Replaces previous stub implementations with real state tracking.
  */
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { closeSync, existsSync, mkdirSync, openSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { join } from 'node:path';
+import { nullPrototypeRecords, readPreservedJsonStore } from './record-store.js';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
 import { createApscState, isApscAgentEligible, normalizeApscConfig, recordApscSignal, } from '../services/pheromone-adaptive.js';
@@ -84,14 +85,18 @@ function reconcileOrphanSwarms(store) {
 // #2085 — exported so `agent-tools.ts agent_spawn` can push into
 // `swarm.agents` (the field `swarm_status` reads).
 export function loadSwarmStore() {
-    let store = { swarms: {}, version: '3.0.0' };
-    try {
-        const path = getSwarmStatePath();
-        if (existsSync(path)) {
-            store = JSON.parse(readFileSync(path, 'utf-8'));
-        }
-    }
-    catch { /* fall through with default */ }
+    // #4737: a parse error used to fall through to an empty store, and the next
+    // save (or orphan reconcile) overwrote swarm-state.json. Only a missing
+    // file is empty; corrupt bytes are copied aside and the error is reported.
+    const store = readPreservedJsonStore(getSwarmStatePath(), 'swarm', () => ({ swarms: {}, version: '3.0.0' }), (candidate) => {
+        const swarms = candidate.swarms;
+        return swarms === undefined || (!!swarms && typeof swarms === 'object' && !Array.isArray(swarms));
+    });
+    if (!store.swarms)
+        store.swarms = {};
+    // Record ids come from MCP input. A null prototype stops `__proto__` and
+    // `constructor` from resolving onto Object.prototype.
+    store.swarms = nullPrototypeRecords(store.swarms);
     // #1799 — reconcile orphans on every load and persist if anything changed.
     // Cheap (process.kill(pid, 0) is sub-millisecond) and means
     // `swarm_status`/`swarm_health` never see ghost "running" entries.
@@ -365,14 +370,18 @@ export const swarmTools = [
             }
             const store = loadSwarmStore();
             const swarmId = input.swarmId;
-            if (swarmId && store.swarms[swarmId]) {
+            if (swarmId && !store.swarms[swarmId]) {
+                return { success: false, error: `Swarm ${swarmId} not found` };
+            }
+            const { getLiveAgentIds } = await import('./agent-tools.js');
+            if (swarmId) {
                 const swarm = store.swarms[swarmId];
                 return {
                     swarmId: swarm.swarmId,
                     status: swarm.status,
                     topology: swarm.topology,
                     maxAgents: swarm.maxAgents,
-                    agentCount: swarm.agents.length,
+                    agentCount: getLiveAgentIds(swarm.agents).length,
                     taskCount: swarm.tasks.length,
                     config: swarm.config,
                     apsc: apscStateOf(swarm),
@@ -397,7 +406,7 @@ export const swarmTools = [
                 status: latest.status,
                 topology: latest.topology,
                 maxAgents: latest.maxAgents,
-                agentCount: latest.agents.length,
+                agentCount: getLiveAgentIds(latest.agents).length,
                 taskCount: latest.tasks.length,
                 config: latest.config,
                 apsc: apscStateOf(latest),
@@ -429,7 +438,7 @@ export const swarmTools = [
             const swarmId = input.swarmId;
             // Find the swarm
             let target;
-            if (swarmId && store.swarms[swarmId]) {
+            if (swarmId) {
                 target = store.swarms[swarmId];
             }
             else {
@@ -452,6 +461,19 @@ export const swarmTools = [
                     error: 'Swarm already terminated',
                 };
             }
+            const { agentTools, getLiveAgentIds } = await import('./agent-tools.js');
+            const terminateAgent = agentTools.find(tool => tool.name === 'agent_terminate');
+            let agentsTerminated = 0;
+            for (const agentId of getLiveAgentIds(target.agents)) {
+                const result = await terminateAgent.handler({
+                    agentId,
+                    force: input.graceful === false,
+                });
+                if (!result.success) {
+                    return { success: false, swarmId: target.swarmId, agentsTerminated, error: result.error };
+                }
+                agentsTerminated++;
+            }
             target.status = 'terminated';
             target.updatedAt = new Date().toISOString();
             saveSwarmStore(store);
@@ -460,7 +482,7 @@ export const swarmTools = [
                 swarmId: target.swarmId,
                 terminated: true,
                 graceful: input.graceful ?? true,
-                agentsTerminated: target.agents.length,
+                agentsTerminated,
                 terminatedAt: target.updatedAt,
             };
         },

package/dist/src/mcp-tools/task-tools.js

@@ -93,6 +93,37 @@ function releaseAgents(agentIds, taskId) {
         }
     });
 }
+/**
+ * Stores `task_assign` may bind an agent from.
+ *
+ * The canonical file is `.claude-flow/agents/store.json`. `hive-mind_spawn`
+ * writes its workers to `.claude-flow/agents.json` instead (#1916), so an id
+ * that exists in either store is a real agent. A corrupt canonical store
+ * throws, matching the read this handler already performed, so a bad file is
+ * never replaced. The hive file stays best-effort: a corrupt copy must not
+ * hide agents that are present in the canonical store.
+ */
+function assignableAgentStores() {
+    const canonical = readRecordStore(join(getProjectCwd(), STORAGE_DIR, 'agents', 'store.json'), 'agents', () => ({ agents: {} }));
+    const stores = [canonical.agents];
+    const hivePath = join(getProjectCwd(), STORAGE_DIR, 'agents.json');
+    try {
+        if (!existsSync(hivePath))
+            return stores;
+        const parsed = JSON.parse(readFileSync(hivePath, 'utf-8'));
+        const agents = parsed?.agents;
+        if (agents && typeof agents === 'object' && !Array.isArray(agents)) {
+            stores.push(agents);
+        }
+    }
+    catch {
+        // Best-effort, same as updateAgents.
+    }
+    return stores;
+}
+function agentIsAssignable(id, stores) {
+    return stores.some((agents) => Object.prototype.hasOwnProperty.call(agents, id) && Boolean(agents[id]));
+}
 export const taskTools = [
     {
         name: 'task_create',
@@ -450,10 +481,20 @@ export const taskTools = [
             if (!task) {
                 return { taskId, error: 'Task not found' };
             }
+            // Completed and cancelled tasks are terminal (#4725). Assigning a
+            // completed task marks the agent busy, and task_complete then returns
+            // without releasing it; task_cancel refuses a finished task too, so
+            // nothing ever sets that agent back to idle.
+            if (task.status === 'completed' || task.status === 'cancelled') {
+                return {
+                    success: false,
+                    taskId,
+                    status: task.status,
+                    error: `Cannot assign a ${task.status} task`,
+                };
+            }
             const previouslyAssigned = [...task.assignedTo];
-            // Load agent store to sync worker state
-            const agentStorePath = join(getProjectCwd(), STORAGE_DIR, 'agents', 'store.json');
-            readRecordStore(agentStorePath, 'agents', () => ({ agents: {} }));
+            const agentStores = assignableAgentStores();
             if (input.unassign) {
                 // Revert previously assigned agents to idle
                 releaseAgents(previouslyAssigned, taskId);
@@ -461,6 +502,20 @@ export const taskTools = [
             }
             else {
                 const agentIds = input.agentIds || [];
+                // An id in neither store is a ghost owner: the task would go
+                // in_progress with nobody to do the work (#4725).
+                if (Array.isArray(agentIds)) {
+                    const missing = agentIds.filter((id) => typeof id === 'string' && !agentIsAssignable(id, agentStores));
+                    if (missing.length > 0) {
+                        const listed = missing.join(', ');
+                        return {
+                            success: false,
+                            taskId,
+                            status: task.status,
+                            error: missing.length === 1 ? `Agent not found: ${listed}` : `Agents not found: ${listed}`,
+                        };
+                    }
+                }
                 // Revert old agents to idle
                 releaseAgents(previouslyAssigned.filter((id) => !agentIds.includes(id)), taskId);
                 // Set new agents to active
@@ -569,21 +624,29 @@ export const taskTools = [
             const original = store.tasks[taskId];
             if (!original)
                 return { success: false, taskId, error: 'Task not found' };
+            const retainState = input.resetState === false;
             const newTaskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-            store.tasks[newTaskId] = {
+            const retry = {
                 taskId: newTaskId,
                 type: original.type,
                 description: original.description,
                 priority: original.priority,
                 status: 'pending',
-                progress: 0,
+                progress: retainState ? original.progress ?? 0 : 0,
                 assignedTo: [...original.assignedTo],
                 tags: [...original.tags, 'retry-of:' + taskId],
                 createdAt: new Date().toISOString(),
                 startedAt: null,
                 completedAt: null,
             };
+            if (retainState && original.result !== undefined)
+                retry.result = original.result;
+            store.tasks[newTaskId] = retry;
             saveTaskStore(store);
+            updateAgents(retry.assignedTo, (agent) => {
+                agent.status = 'busy';
+                agent.currentTask = newTaskId;
+            });
             return {
                 taskId,
                 newTaskId,

package/dist/src/mcp-tools/terminal-tools.js

@@ -4,6 +4,7 @@
  * Terminal session management with real command execution.
  */
 import { getProjectCwd } from './types.js';
+import { nullPrototypeRecords } from './record-store.js';
 import { existsSync } from 'node:fs';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateEnv, validateIdentifier, validatePath, validateText } from './validate-input.js';
@@ -33,13 +34,17 @@ function loadTerminalStore() {
             // ADR-096 Phase 3: readFileMaybeEncrypted handles both legacy
             // plaintext stores and post-migration encrypted ones via the RFE1
             // magic-byte sniff.
-            return JSON.parse(readFileMaybeEncrypted(path, 'utf-8'));
+            const parsed = JSON.parse(readFileMaybeEncrypted(path, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                parsed.sessions = nullPrototypeRecords(parsed.sessions);
+                return parsed;
+            }
         }
     }
     catch {
         // Return empty store
     }
-    return { sessions: {}, version: '3.0.0' };
+    return { sessions: nullPrototypeRecords(undefined), version: '3.0.0' };
 }
 function saveTerminalStore(store) {
     ensureTerminalDir();
@@ -139,6 +144,15 @@ export const terminalTools = [
             }
             // Find or create default session
             let session = sessionId ? store.sessions[sessionId] : Object.values(store.sessions).find(s => s.status === 'active');
+            // #4730: terminal_close only flips status to "closed". Executing anyway
+            // ran the command and then wrote status back to "active", so a closed
+            // session kept accepting commands. Reject anything that is not active
+            // before the process is spawned and before that status write. When no
+            // sessionId was given, the lookup above already selected an active
+            // session (or we create one below).
+            if (session && session.status !== 'active') {
+                return { success: false, error: `Session is not active (${session.status})` };
+            }
             if (!session) {
                 // Create default session
                 const id = `term-${Date.now()}-${randomBytes(4).toString('hex')}`;

package/dist/src/mcp-tools/validate-input.d.ts

@@ -5,5 +5,7 @@
  * Was a 256-line byte-identical copy. Loads @claude-flow/security validators
  * when available, with lightweight fallback otherwise.
  */
+import { type ValidationResult } from '@claude-flow/cli-core/mcp-tools/validate-input';
 export * from '@claude-flow/cli-core/mcp-tools/validate-input';
+export declare function validateIdentifier(value: unknown, label: string): ValidationResult;
 //# sourceMappingURL=validate-input.d.ts.map

package/dist/src/mcp-tools/validate-input.js

@@ -5,5 +5,19 @@
  * Was a 256-line byte-identical copy. Loads @claude-flow/security validators
  * when available, with lightweight fallback otherwise.
  */
+import { validateIdentifier as coreValidateIdentifier, } from '@claude-flow/cli-core/mcp-tools/validate-input';
 export * from '@claude-flow/cli-core/mcp-tools/validate-input';
+/**
+ * Names that resolve to Object.prototype or a built-in when used as a key on a
+ * plain object. Identifiers key the JSON record stores, so they are refused.
+ * Move this check into cli-core on its next release.
+ */
+const RESERVED_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+export function validateIdentifier(value, label) {
+    const result = coreValidateIdentifier(value, label);
+    if (result.valid && RESERVED_KEYS.has(result.sanitized)) {
+        return { valid: false, sanitized: '', error: `${label} must not be a reserved name (${result.sanitized})` };
+    }
+    return result;
+}
 //# sourceMappingURL=validate-input.js.map

package/dist/src/mcp-tools/workflow-tools.js

@@ -8,6 +8,7 @@ import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier, validatePath, validateText } from './validate-input.js';
 import { executeAgentTask } from './agent-execute-core.js';
+import { readPreservedJsonStore } from './record-store.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const WORKFLOW_DIR = 'workflows';
@@ -73,19 +74,19 @@ function withRecordMaps(store, keys) {
     return store;
 }
 const WORKFLOW_MAPS = ['workflows', 'templates'];
+function isRecordMap(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
 function loadWorkflowStore() {
-    try {
-        const path = getWorkflowPath();
-        if (existsSync(path)) {
-            const data = JSON.parse(readFileSync(path, 'utf-8'));
-            if (data && typeof data === 'object' && !Array.isArray(data))
-                return withRecordMaps(data, WORKFLOW_MAPS);
-        }
-    }
-    catch {
-        // Return default store on error
-    }
-    return withRecordMaps({ workflows: {}, templates: {}, version: '3.0.0' }, WORKFLOW_MAPS);
+    // #4737: a parse error used to return an empty store, and the next save
+    // overwrote the file. Only a missing file is empty; corrupt bytes are
+    // copied aside and the error is reported.
+    const path = getWorkflowPath();
+    const data = readPreservedJsonStore(path, 'workflow', () => ({ workflows: {}, templates: {}, version: '3.0.0' }), (store) => WORKFLOW_MAPS.every((key) => {
+        const map = store[key];
+        return map === undefined || isRecordMap(map);
+    }));
+    return withRecordMaps(data, WORKFLOW_MAPS);
 }
 function saveWorkflowStore(store) {
     ensureWorkflowDir();