@claude-flow/cli 3.71.4 → 3.72.0

package/dist/src/memory/intelligence.js

@@ -337,6 +337,12 @@ class LocalReasoningBank {
     persistenceEnabled;
     dirty = false;
     saveTimeout = null;
+    /** IDs changed locally since the last successful flush. */
+    dirtyIds = new Set();
+    /** IDs deleted locally; a disk copy must not be resurrected. */
+    deletedIds = new Set();
+    /** A local clear() must remove disk entries too. */
+    clearRequested = false;
     constructor(options) {
         this.maxSize = options.maxSize;
         this.persistenceEnabled = options.persistence !== false;
@@ -359,6 +365,7 @@ class LocalReasoningBank {
                     const totalLoaded = data.length;
                     // Group by content to deduplicate
                     const byContent = new Map();
+                    const removedIds = [];
                     for (const pattern of data) {
                         const key = pattern.content;
                         const existing = byContent.get(key);
@@ -372,10 +379,12 @@ class LocalReasoningBank {
                                     (pattern.lastUsedAt ?? 0) > (existing.lastUsedAt ?? 0))) {
                                 // Merge: adopt the higher usageCount sum
                                 pattern.usageCount = (pattern.usageCount ?? 0) + (existing.usageCount ?? 0);
+                                removedIds.push(existing.id);
                                 byContent.set(key, pattern);
                             }
                             else {
                                 existing.usageCount = (existing.usageCount ?? 0) + (pattern.usageCount ?? 0);
+                                removedIds.push(pattern.id);
                             }
                         }
                     }
@@ -387,15 +396,28 @@ class LocalReasoningBank {
                     const removed = totalLoaded - byContent.size;
                     if (removed > 0) {
                         console.log(`Deduplicated ${removed} patterns (${byContent.size} unique)`);
-                        // Persist the compacted set immediately so the file shrinks on disk
+                        // Persist the compacted set immediately so the file shrinks on disk.
+                        // Mark every kept row dirty so this compaction wins over the disk
+                        // copies, and tombstone the discarded duplicates.
+                        for (const pattern of byContent.values())
+                            this.dirtyIds.add(pattern.id);
+                        for (const id of removedIds)
+                            this.deletedIds.add(id);
                         this.dirty = true;
                         this.flushToDisk();
                     }
                 }
             }
         }
-        catch {
-            // Ignore load errors, start fresh
+        catch (error) {
+            // A corrupt patterns file must be preserved, not silently replaced by
+            // an empty bank on the next flush (#4735).
+            try {
+                const corruptPath = `${getPatternsPath()}.corrupt-${Date.now()}`;
+                renameSync(getPatternsPath(), corruptPath);
+                console.warn(`[intelligence] Corrupt patterns file moved to ${corruptPath}`);
+            }
+            catch { /* already absent or rename failed — never overwrite it below */ }
         }
     }
     /**
@@ -415,6 +437,11 @@ class LocalReasoningBank {
     }
     /**
      * Immediately flush patterns to disk
+     *
+     * Re-reads the file under the cooperating-writer lock and merges only the
+     * patterns this process changed, so a long-lived daemon cannot erase patterns
+     * written by another hook/process (#4735). Deletions and clear() are carried
+     * as tombstones; the write itself is temp-file + rename.
      */
     flushToDisk() {
         if (!this.persistenceEnabled || !this.dirty)
@@ -422,11 +449,52 @@ class LocalReasoningBank {
         try {
             ensureDataDir();
             const path = getPatternsPath();
-            writeFileSync(path, JSON.stringify(this.patternList, null, 2), 'utf-8');
-            this.dirty = false;
+            withStatsFileLock(path, (canonicalPath) => {
+                let diskPatterns = [];
+                if (existsSync(canonicalPath)) {
+                    try {
+                        const parsed = JSON.parse(readFileSync(canonicalPath, 'utf-8'));
+                        if (!Array.isArray(parsed))
+                            throw new Error('patterns.json is not an array');
+                        diskPatterns = parsed;
+                    }
+                    catch {
+                        // Preserve the corrupt original instead of overwriting it with an
+                        // empty bank; the new file is written only after this rename.
+                        try {
+                            const corruptPath = `${canonicalPath}.corrupt-${Date.now()}`;
+                            renameSync(canonicalPath, corruptPath);
+                            console.warn(`[intelligence] Corrupt patterns file moved to ${corruptPath}`);
+                        }
+                        catch { /* leave the original in place */ }
+                    }
+                }
+                const merged = new Map();
+                if (!this.clearRequested) {
+                    for (const pattern of diskPatterns) {
+                        if (!this.deletedIds.has(pattern.id))
+                            merged.set(pattern.id, pattern);
+                    }
+                }
+                for (const pattern of this.patternList) {
+                    if (this.clearRequested || this.dirtyIds.has(pattern.id)) {
+                        merged.set(pattern.id, pattern);
+                    }
+                }
+                const list = [...merged.values()];
+                const tmp = `${canonicalPath}.${process.pid}.${Date.now()}.tmp`;
+                writeFileSync(tmp, JSON.stringify(list, null, 2), 'utf-8');
+                renameSync(tmp, canonicalPath);
+                this.patterns = new Map(list.map((pattern) => [pattern.id, pattern]));
+                this.patternList = list;
+                this.dirty = false;
+                this.dirtyIds.clear();
+                this.deletedIds.clear();
+                this.clearRequested = false;
+            });
         }
         catch (error) {
-            // Log but don't throw - persistence failures shouldn't break training
+            // Log but don't throw - persistence failures shouldn't break training.
             console.error('Failed to persist patterns:', error);
         }
     }
@@ -459,6 +527,7 @@ class LocalReasoningBank {
                 this.patternList[idx] = stored;
             }
             this.patterns.set(pattern.id, stored);
+            this.dirtyIds.add(pattern.id);
             this.saveToDisk();
             return false;
         }
@@ -474,6 +543,7 @@ class LocalReasoningBank {
                 }
                 // Keep the Map in sync with the mutated object
                 this.patterns.set(contentDupe.id, contentDupe);
+                this.dirtyIds.add(contentDupe.id);
                 this.saveToDisk();
                 return false;
             }
@@ -482,11 +552,14 @@ class LocalReasoningBank {
                 const oldest = this.patternList.shift();
                 if (oldest) {
                     this.patterns.delete(oldest.id);
+                    this.deletedIds.add(oldest.id);
+                    this.dirtyIds.delete(oldest.id);
                 }
             }
             this.patternList.push(stored);
         }
         this.patterns.set(pattern.id, stored);
+        this.dirtyIds.add(stored.id);
         // Trigger persistence (debounced)
         this.saveToDisk();
         return true;
@@ -583,6 +656,8 @@ class LocalReasoningBank {
         if (idx >= 0) {
             this.patternList.splice(idx, 1);
         }
+        this.dirtyIds.delete(id);
+        this.deletedIds.add(id);
         this.saveToDisk();
         return true;
     }
@@ -592,6 +667,9 @@ class LocalReasoningBank {
     clear() {
         this.patterns.clear();
         this.patternList = [];
+        this.dirtyIds.clear();
+        this.deletedIds.clear();
+        this.clearRequested = true;
         this.saveToDisk();
     }
 }

package/dist/src/memory/memory-initializer.d.ts

@@ -361,7 +361,9 @@ export declare function loadEmbeddingModel(options?: {
  * own embedder is real or stubbed). Set `backend` truthfully by the path that
  * actually produced the vector. Do NOT change the embedding math.
  */
-export declare function generateEmbedding(text: string): Promise<{
+export declare function generateEmbedding(text: string, options?: {
+    normalize?: boolean;
+}): Promise<{
     embedding: number[];
     dimensions: number;
     model: string;
@@ -382,7 +384,9 @@ export declare function generateEmbedding(text: string): Promise<{
  *
  * Keeping the local chain as its own export breaks that cycle structurally.
  */
-export declare function generateLocalEmbedding(text: string): Promise<{
+export declare function generateLocalEmbedding(text: string, options?: {
+    normalize?: boolean;
+}): Promise<{
     embedding: number[];
     dimensions: number;
     model: string;

package/dist/src/memory/memory-initializer.js

@@ -2253,7 +2253,12 @@ async function loadLocalEmbeddingChain(verbose = false, startTime = Date.now())
  * own embedder is real or stubbed). Set `backend` truthfully by the path that
  * actually produced the vector. Do NOT change the embedding math.
  */
-export async function generateEmbedding(text) {
+export async function generateEmbedding(text, options) {
+    // #4724: AgentDB embed() has no normalize switch and always returns a unit
+    // vector. A raw request has to use the local chain, which can skip L2.
+    if (options?.normalize === false) {
+        return generateLocalEmbedding(text, { normalize: false });
+    }
     // ADR-053: Try AgentDB v3 bridge first
     const bridge = await getBridge();
     if (bridge) {
@@ -2283,7 +2288,9 @@ export async function generateEmbedding(text) {
  *
  * Keeping the local chain as its own export breaks that cycle structurally.
  */
-export async function generateLocalEmbedding(text) {
+export async function generateLocalEmbedding(text, options) {
+    // Default true keeps the historical unit-norm embedding math.
+    const normalize = options?.normalize !== false;
     // Ensure the LOCAL model is loaded. #3375: this must not go through
     // loadEmbeddingModel(), which is bridge-first — when the bridge answered
     // there, no local model was ever loaded and this function always returned
@@ -2314,7 +2321,7 @@ export async function generateLocalEmbedding(text) {
     // Use ONNX model if available
     if (state.model && typeof state.model === 'function') {
         try {
-            const output = await state.model(text, { pooling: 'mean', normalize: true });
+            const output = await state.model(text, { pooling: 'mean', normalize });
             // Handle @xenova/transformers (output.data), ruvector (plain array) and
             // typed-array (ReasoningBank Float32Array, #3114) formats. DataView is an
             // ArrayBuffer view without an iterator (Array.from gives []), so exclude it.
@@ -2338,7 +2345,7 @@ export async function generateLocalEmbedding(text) {
     // Deterministic hash-based fallback (for testing/demo without ONNX).
     // AUDIT #3: backend='mock' — these vectors do NOT carry real semantics.
     (await import('./embedding-policy.js')).enforceNoStub('memory-initializer.generateLocalEmbedding'); // "no stubs" strict mode
-    const embedding = generateHashEmbedding(text, state.dimensions);
+    const embedding = generateHashEmbedding(text, state.dimensions, normalize);
     return {
         embedding,
         dimensions: state.dimensions,
@@ -2401,7 +2408,7 @@ export async function generateBatchEmbeddings(texts, options) {
  * Generate deterministic hash-based embedding
  * Not semantic, but deterministic and useful for testing
  */
-function generateHashEmbedding(text, dimensions) {
+function generateHashEmbedding(text, dimensions, normalize = true) {
     const embedding = new Array(dimensions).fill(0);
     // Simple hash-based approach for reproducibility
     const words = text.toLowerCase().split(/\s+/);
@@ -2413,7 +2420,9 @@ function generateHashEmbedding(text, dimensions) {
             embedding[idx] += Math.sin(charCode * 0.1) * 0.1;
         }
     }
-    // Normalize to unit vector
+    // Normalize to unit vector unless the caller asked for the raw vector (#4724).
+    if (!normalize)
+        return embedding;
     const magnitude = Math.sqrt(embedding.reduce((sum, v) => sum + v * v, 0)) || 1;
     return embedding.map(v => v / magnitude);
 }

package/dist/src/ruvector/model-router.d.ts

@@ -90,6 +90,11 @@ export interface ModelRouterConfig {
      */
     priorDecay: number;
 }
+/** Request-local preferences; omitted or false keeps the existing scoring. */
+export interface ModelRoutingPreferences {
+    preferCost?: boolean;
+    preferSpeed?: boolean;
+}
 /**
  * Routing decision result
  */
@@ -241,7 +246,7 @@ export declare class ModelRouter {
      * 'bandit-fallback'` (neural was enabled but declined) or
      * `'heuristic'` (neural was disabled).
      */
-    route(task: string, embedding?: number[]): Promise<ModelRoutingResult>;
+    route(task: string, embedding?: number[], preferences?: ModelRoutingPreferences): Promise<ModelRoutingResult>;
     /**
      * Analyze task complexity
      */

package/dist/src/ruvector/model-router.js

@@ -395,7 +395,7 @@ export class ModelRouter {
      * 'bandit-fallback'` (neural was enabled but declined) or
      * `'heuristic'` (neural was disabled).
      */
-    async route(task, embedding) {
+    async route(task, embedding, preferences = {}) {
         const startTime = performance.now();
         // Analyze task complexity
         const complexity = this.analyzeComplexity(task, embedding);
@@ -473,7 +473,7 @@ export class ModelRouter {
                 // Silent — neural path is best-effort.
             }
         }
-        const scores = this.computeModelScores(complexity);
+        const scores = this.computeModelScores(complexity, preferences);
         const adjustedScores = this.applyCircuitBreaker(scores);
         // A/B mode: compute the pure-bandit pick alongside the hybrid pick so
         // we can log disagreement. Both samples are drawn from the same Beta
@@ -717,17 +717,29 @@ export class ModelRouter {
     /**
      * Compute scores for each model
      */
-    computeModelScores(complexity) {
+    computeModelScores(complexity, preferences) {
         const { score } = complexity;
         // Base scoring: inverse relationship with complexity
         // Low complexity → haiku scores high
         // High complexity → opus scores high
-        return {
+        const scores = {
             haiku: Math.max(0, 1 - score * 2), // Drops off quickly as complexity rises
             sonnet: 1 - Math.abs(score - 0.5) * 2, // Peaks at medium complexity
             opus: Math.min(1, score * 1.5), // Rises with complexity
             inherit: 0.1, // Low baseline unless explicitly needed
         };
+        for (const model of ['haiku', 'sonnet', 'opus']) {
+            const capabilities = MODEL_CAPABILITIES[model];
+            // Preferences must not boost a tier beyond its task capability.
+            // Circuit-breaker penalties and uncertainty escalation still apply.
+            if (score > capabilities.maxComplexity)
+                continue;
+            if (preferences.preferCost)
+                scores[model] *= 2 - capabilities.costMultiplier;
+            if (preferences.preferSpeed)
+                scores[model] *= capabilities.speedMultiplier;
+        }
+        return scores;
     }
     /**
      * Apply circuit breaker adjustments

package/dist/src/services/worker-daemon.js

@@ -12,7 +12,7 @@
  */
 import { ConfigFileManager } from './config-file-manager.js';
 import { EventEmitter } from 'events';
-import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, unlinkSync } from 'fs';
+import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, unlinkSync, renameSync, statSync } from 'fs';
 import { cpus, homedir } from 'os';
 import { join } from 'path';
 import { createRequire } from 'node:module';
@@ -31,6 +31,8 @@ import { getRepoSupervisorRegistry } from './repo-supervisor.js';
 // Daemon config is read synchronously from the constructor. In an ESM build,
 // bare `require` is undefined, so use a module-relative require for YAML.
 const requireYaml = createRequire(import.meta.url);
+const DAEMON_LOG_MAX_BYTES = 5 * 1024 * 1024;
+const DAEMON_LOG_BACKUPS = 3;
 // Default worker configurations with improved intervals (P0 fix: map 5min -> 15min)
 const DEFAULT_WORKERS = [
     { type: 'map', intervalMs: 15 * 60 * 1000, offsetMs: 0, priority: 'normal', description: 'Codebase mapping', enabled: true },
@@ -1543,7 +1545,7 @@ export class WorkerDaemon extends EventEmitter {
             rawOutputPreview: typeof result.output === 'string' ? result.output.slice(0, 2000) : undefined,
             rawOutputLength: typeof result.output === 'string' ? result.output.length : 0,
         };
-        writeFileSync(metricsFile, JSON.stringify(persisted, null, 2));
+        writeFileAtomic(metricsFile, Buffer.from(JSON.stringify(persisted, null, 2)));
     }
     // Worker implementations
     async runMapWorker() {
@@ -1564,7 +1566,7 @@ export class WorkerDaemon extends EventEmitter {
             },
             scannedAt: Date.now(),
         };
-        writeFileSync(metricsFile, JSON.stringify(map, null, 2));
+        writeFileAtomic(metricsFile, Buffer.from(JSON.stringify(map, null, 2)));
         return map;
     }
     /**
@@ -1596,7 +1598,7 @@ export class WorkerDaemon extends EventEmitter {
             ],
             note: 'Local fallback checks file presence only; it does not scan source contents.',
         };
-        writeFileSync(auditFile, JSON.stringify(audit, null, 2));
+        writeFileAtomic(auditFile, Buffer.from(JSON.stringify(audit, null, 2)));
         return audit;
     }
     /**
@@ -1620,7 +1622,7 @@ export class WorkerDaemon extends EventEmitter {
             },
             note: 'Install Claude Code CLI for AI-powered optimization suggestions',
         };
-        writeFileSync(optimizeFile, JSON.stringify(perf, null, 2));
+        writeFileAtomic(optimizeFile, Buffer.from(JSON.stringify(perf, null, 2)));
         return perf;
     }
     /**
@@ -1662,7 +1664,7 @@ export class WorkerDaemon extends EventEmitter {
                 memoryCleaned: 0,
                 duplicatesRemoved: 0,
             };
-            writeFileSync(consolidateFile, JSON.stringify(disabledResult, null, 2));
+            writeFileAtomic(consolidateFile, Buffer.from(JSON.stringify(disabledResult, null, 2)));
             return disabledResult;
         }
         let report;
@@ -1689,7 +1691,7 @@ export class WorkerDaemon extends EventEmitter {
                 memoryCleaned: 0,
                 duplicatesRemoved: 0,
             };
-            writeFileSync(consolidateFile, JSON.stringify(errorResult, null, 2));
+            writeFileAtomic(consolidateFile, Buffer.from(JSON.stringify(errorResult, null, 2)));
             return errorResult;
         }
         for (const store of stores) {
@@ -1733,7 +1735,7 @@ export class WorkerDaemon extends EventEmitter {
                 skipped: part.skipped,
             })),
         };
-        writeFileSync(consolidateFile, JSON.stringify(result, null, 2));
+        writeFileAtomic(consolidateFile, Buffer.from(JSON.stringify(result, null, 2)));
         return result;
     }
     /**
@@ -1775,7 +1777,7 @@ export class WorkerDaemon extends EventEmitter {
             this.log('warn', `Backup worker failed: ${message}`);
             result = { timestamp: new Date().toISOString(), backedUp: false, error: message };
         }
-        writeFileSync(backupFile, JSON.stringify(result, null, 2));
+        writeFileAtomic(backupFile, Buffer.from(JSON.stringify(result, null, 2)));
         return result;
     }
     /**
@@ -1814,7 +1816,7 @@ export class WorkerDaemon extends EventEmitter {
             this.log('warn', `Harness worker failed: ${message}`);
             result = { timestamp: new Date().toISOString(), ran: false, error: message };
         }
-        writeFileSync(harnessFile, JSON.stringify(result, null, 2));
+        writeFileAtomic(harnessFile, Buffer.from(JSON.stringify(result, null, 2)));
         return result;
     }
     /**
@@ -1835,7 +1837,7 @@ export class WorkerDaemon extends EventEmitter {
             gaps: [],
             note: 'Install Claude Code CLI for AI-powered test gap analysis',
         };
-        writeFileSync(testGapsFile, JSON.stringify(result, null, 2));
+        writeFileAtomic(testGapsFile, Buffer.from(JSON.stringify(result, null, 2)));
         return result;
     }
     /**
@@ -1916,7 +1918,7 @@ export class WorkerDaemon extends EventEmitter {
                 uptime: process.uptime(),
             },
         };
-        writeFileSync(benchmarkFile, JSON.stringify(result, null, 2));
+        writeFileAtomic(benchmarkFile, Buffer.from(JSON.stringify(result, null, 2)));
         return result;
     }
     /**
@@ -2020,6 +2022,22 @@ export class WorkerDaemon extends EventEmitter {
         // Also write to log file
         try {
             const logFile = join(this.config.logDir, 'daemon.log');
+            // Keep three generations. Rotate before the next complete record
+            // crosses 5 MiB; a single oversized record is preserved intact.
+            if (existsSync(logFile)) {
+                const size = statSync(logFile).size;
+                if (size > 0 && size + Buffer.byteLength(logMessage + '\n') > DAEMON_LOG_MAX_BYTES) {
+                    const oldest = `${logFile}.${DAEMON_LOG_BACKUPS}`;
+                    if (existsSync(oldest))
+                        unlinkSync(oldest);
+                    for (let generation = DAEMON_LOG_BACKUPS - 1; generation >= 1; generation--) {
+                        const previous = `${logFile}.${generation}`;
+                        if (existsSync(previous))
+                            renameSync(previous, `${logFile}.${generation + 1}`);
+                    }
+                    renameSync(logFile, `${logFile}.1`);
+                }
+            }
             appendFileSync(logFile, logMessage + '\n');
         }
         catch {

package/dist/src/transfer/storage/gcs.js

@@ -7,6 +7,7 @@
  */
 import * as crypto from 'crypto';
 import * as fs from 'fs';
+import { tmpdir } from 'node:os';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
 /**
@@ -92,7 +93,7 @@ export async function uploadToGCS(content, options = {}) {
     }
     console.log(`[GCS] Uploading to gs://${config.bucket}/${objectPath}...`);
     // Write content to temp file
-    const tempDir = process.env.TMPDIR || '/tmp';
+    const tempDir = tmpdir();
     const tempFile = path.join(tempDir, `claude-flow-upload-${Date.now()}.json`);
     fs.writeFileSync(tempFile, content);
     try {
@@ -151,7 +152,7 @@ export async function downloadFromGCS(uri, config) {
     const cfg = config || getGCSConfig();
     console.log(`[GCS] Downloading from ${uri}...`);
     // Write to temp file first
-    const tempDir = process.env.TMPDIR || '/tmp';
+    const tempDir = tmpdir();
     const tempFile = path.join(tempDir, `claude-flow-download-${Date.now()}.json`);
     try {
         // Download using gcloud storage cp (array form prevents shell injection)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.71.4",
+  "version": "3.72.0",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/plugins/ruflo-metaharness/.claude-plugin/plugin.json

@@ -2,6 +2,7 @@
   "name": "ruflo-metaharness",
   "description": "MetaHarness integration for ruflo — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150's architectural constraint that MetaHarness remains an optional augmentation, never a required runtime dependency. As a mod (ADR-445): confirms flywheel promotion, keeps secrets out of inputs, /metaharness-mod, and a status file the console shows",
   "version": "0.4.0",
+  "repository": "https://github.com/ruvnet/ruflo",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet"