@claude-flow/cli 3.71.4 → 3.72.1

package/dist/src/mcp-tools/x-federation-join.js

@@ -1,14 +1,53 @@
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join, dirname } from 'node:path';
-// ADR-125 precedence: tool args (relayHttp / relayWs / keyFile) take precedence over the
-// RUFLO_X_RELAY_HTTP / RUFLO_X_RELAY_WS / RUFLO_NOSTR_KEY_FILE env vars, which precede defaults.
+import { join, dirname, isAbsolute, relative, resolve } from 'node:path';
+// Host configuration precedes defaults. Caller key overrides stay under ~/.ruflo;
+// a caller relayWs must match the configured relay. relayHttp keeps ADR-125 precedence.
 const HTTP_BASE = (o) => (o || process.env.RUFLO_X_RELAY_HTTP || 'https://relay.ruv.io').replace(/\/$/, '');
 const RELAY_WS = (o) => o || process.env.RUFLO_X_RELAY_WS || 'wss://relay.ruv.io';
 const KEY_FILE = () => process.env.RUFLO_NOSTR_KEY_FILE || join(homedir(), '.ruflo', 'nostr.key');
 const hex = (b) => Buffer.from(b).toString('hex');
 const unhex = (h) => Uint8Array.from(Buffer.from(h, 'hex'));
+function callerKeyFile(value) {
+    // Host configuration is trusted; an MCP argument cannot select a different host file.
+    if (value === undefined)
+        return KEY_FILE();
+    if (typeof value !== 'string' || !value)
+        throw new Error('keyFile must name a file under ~/.ruflo');
+    const root = resolve(homedir(), '.ruflo');
+    const target = resolve(value);
+    const rel = relative(root, target);
+    if (!rel || rel === '..' || rel.startsWith('../') || rel.startsWith('..\\') || isAbsolute(rel)) {
+        throw new Error('keyFile must name a file under ~/.ruflo');
+    }
+    for (let current = target;; current = dirname(current)) {
+        try {
+            if (lstatSync(current).isSymbolicLink())
+                throw new Error('keyFile must not follow symlinks');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (relative(root, current) === '')
+            break;
+    }
+    return target;
+}
+function configuredRelay(value) {
+    const configured = new URL(RELAY_WS());
+    if (value !== undefined && typeof value !== 'string')
+        throw new Error('relayWs must be the configured relay URL');
+    const requested = new URL(value === undefined ? configured.href : value);
+    const localTestRelay = Boolean(process.env.RUFLO_X_RELAY_WS)
+        && configured.protocol === 'ws:' && ['localhost', '127.0.0.1', '[::1]'].includes(configured.hostname);
+    if ((!localTestRelay && configured.protocol !== 'wss:') || requested.href !== configured.href
+        || requested.username || requested.password || requested.hash) {
+        throw new Error('relayWs must use wss and match the configured relay (explicit loopback ws configuration is allowed)');
+    }
+    return requested.href;
+}
 async function loadNostrTools() {
     try {
         return (await import('nostr-tools/pure'));
@@ -24,7 +63,7 @@ export function loadOrCreateKey(nt, file = KEY_FILE()) {
     }
     mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
     const sk = nt.generateSecretKey();
-    writeFileSync(file, hex(sk), { mode: 0o600 });
+    writeFileSync(file, hex(sk), { mode: 0o600, flag: 'wx' });
     return { sk, pubkey: nt.getPublicKey(sk), created: true };
 }
 export function nip98Header(nt, sk, url, method, body) {
@@ -80,24 +119,26 @@ export const xFederationJoinTools = [{
                 code: { type: 'string', description: 'Optional private invite code (v2.…), for invite-only relays.' },
                 gatewayUrl: { type: 'string', description: 'Public registration gateway origin; defaults to https://x.ruv.io.' },
                 relayHttp: { type: 'string', description: 'Relay HTTPS base for the claim; takes precedence over RUFLO_X_RELAY_HTTP.' },
-                relayWs: { type: 'string', description: 'Relay wss URL for NIP-42; takes precedence over RUFLO_X_RELAY_WS.' },
-                keyFile: { type: 'string', description: 'Key file path; takes precedence over RUFLO_NOSTR_KEY_FILE (default ~/.ruflo/nostr.key).' }
+                relayWs: { type: 'string', description: 'Relay wss URL for NIP-42; must match RUFLO_X_RELAY_WS or the default relay.' },
+                keyFile: { type: 'string', description: 'Caller-selected file under ~/.ruflo (no symlinks). Omit to use host RUFLO_NOSTR_KEY_FILE or ~/.ruflo/nostr.key.' }
             }, required: [] },
         handler: async (input) => {
             const i = input;
-            const nt = await loadNostrTools();
             // Validate input before the optional-dependency check so a bad code fails fast and identically
             // whether or not nostr-tools is present.
             if (i.code !== undefined && !/^v2\.[A-Za-z0-9._-]{8,}$/.test(i.code))
                 throw new Error('invite code must look like v2.<token>');
+            const registrationBase = i.code ? undefined : secureBase(i.gatewayUrl || process.env.RUFLO_X_GATEWAY_URL || 'https://x.ruv.io');
+            const keyFile = callerKeyFile(i.keyFile);
+            const relayWs = configuredRelay(i.relayWs);
+            const nt = await loadNostrTools();
             if (!nt)
                 return { degraded: true, reason: 'nostr-tools not installed', hint: 'npm i -g nostr-tools  (secp256k1 signing is not in node:crypto)' };
-            const registrationBase = i.code ? undefined : secureBase(i.gatewayUrl || process.env.RUFLO_X_GATEWAY_URL || 'https://x.ruv.io');
-            const { sk, pubkey, created } = loadOrCreateKey(nt, i.keyFile);
+            const { sk, pubkey, created } = loadOrCreateKey(nt, keyFile);
             // Existing members need no new grant. In particular never downgrade/re-admit
             // their key just because they run join again.
             if (!i.code) {
-                const existing = await verifyMembership(nt, sk, RELAY_WS(i.relayWs));
+                const existing = await verifyMembership(nt, sk, relayWs);
                 if (existing.ok)
                     return { ok: true, pubkey, keyCreated: created, membershipVerified: true, alreadyMember: true };
             }
@@ -108,7 +149,7 @@ export const xFederationJoinTools = [{
                 r = await fetch(url, { method: 'POST', redirect: 'error', headers: { Authorization: nip98Header(nt, sk, url, 'POST', body), 'Content-Type': 'application/json' }, body, signal: AbortSignal.timeout(20_000) });
             }
             catch {
-                const check = await verifyMembership(nt, sk, RELAY_WS(i.relayWs));
+                const check = await verifyMembership(nt, sk, relayWs);
                 if (check.ok)
                     return { ok: true, pubkey, keyCreated: created, membershipVerified: true };
                 throw new Error('Admission response unavailable and relay membership unverified. Keep your local key and retry; do not create another identity.');
@@ -117,12 +158,12 @@ export const xFederationJoinTools = [{
             if (!r.ok) {
                 // A lost acknowledgment can follow a successful grant. Check with the
                 // relay before declaring failure; never silently generate a second key.
-                const check = await verifyMembership(nt, sk, RELAY_WS(i.relayWs));
+                const check = await verifyMembership(nt, sk, relayWs);
                 if (check.ok)
                     return { ok: true, pubkey, keyCreated: created, membershipVerified: true };
                 throw new Error(`join rejected (${r.status}): ${claim.error ?? claim.message ?? 'unknown'}`);
             }
-            const auth = await verifyMembership(nt, sk, RELAY_WS(i.relayWs));
+            const auth = await verifyMembership(nt, sk, relayWs);
             return { ok: auth.ok, pubkey, keyCreated: created, role: claim.role ?? 'member', membershipVerified: auth.ok, ...(auth.ok ? {} : { reason: auth.reason }),
                 next: 'Publish kind-1 events tagged ["t","ruflo-swarm"] — or run `ruflo federation sync` to read the swarm.' };
         },

package/dist/src/memory/intelligence.d.ts

@@ -152,6 +152,12 @@ declare class LocalReasoningBank {
     private persistenceEnabled;
     private dirty;
     private saveTimeout;
+    /** IDs changed locally since the last successful flush. */
+    private dirtyIds;
+    /** IDs deleted locally; a disk copy must not be resurrected. */
+    private deletedIds;
+    /** A local clear() must remove disk entries too. */
+    private clearRequested;
     constructor(options: {
         maxSize: number;
         persistence?: boolean;
@@ -168,6 +174,11 @@ declare class LocalReasoningBank {
     private saveToDisk;
     /**
      * Immediately flush patterns to disk
+     *
+     * Re-reads the file under the cooperating-writer lock and merges only the
+     * patterns this process changed, so a long-lived daemon cannot erase patterns
+     * written by another hook/process (#4735). Deletions and clear() are carried
+     * as tombstones; the write itself is temp-file + rename.
      */
     flushToDisk(): void;
     /**

package/dist/src/memory/intelligence.js

@@ -337,6 +337,12 @@ class LocalReasoningBank {
     persistenceEnabled;
     dirty = false;
     saveTimeout = null;
+    /** IDs changed locally since the last successful flush. */
+    dirtyIds = new Set();
+    /** IDs deleted locally; a disk copy must not be resurrected. */
+    deletedIds = new Set();
+    /** A local clear() must remove disk entries too. */
+    clearRequested = false;
     constructor(options) {
         this.maxSize = options.maxSize;
         this.persistenceEnabled = options.persistence !== false;
@@ -359,6 +365,7 @@ class LocalReasoningBank {
                     const totalLoaded = data.length;
                     // Group by content to deduplicate
                     const byContent = new Map();
+                    const removedIds = [];
                     for (const pattern of data) {
                         const key = pattern.content;
                         const existing = byContent.get(key);
@@ -372,10 +379,12 @@ class LocalReasoningBank {
                                     (pattern.lastUsedAt ?? 0) > (existing.lastUsedAt ?? 0))) {
                                 // Merge: adopt the higher usageCount sum
                                 pattern.usageCount = (pattern.usageCount ?? 0) + (existing.usageCount ?? 0);
+                                removedIds.push(existing.id);
                                 byContent.set(key, pattern);
                             }
                             else {
                                 existing.usageCount = (existing.usageCount ?? 0) + (pattern.usageCount ?? 0);
+                                removedIds.push(pattern.id);
                             }
                         }
                     }
@@ -387,15 +396,28 @@ class LocalReasoningBank {
                     const removed = totalLoaded - byContent.size;
                     if (removed > 0) {
                         console.log(`Deduplicated ${removed} patterns (${byContent.size} unique)`);
-                        // Persist the compacted set immediately so the file shrinks on disk
+                        // Persist the compacted set immediately so the file shrinks on disk.
+                        // Mark every kept row dirty so this compaction wins over the disk
+                        // copies, and tombstone the discarded duplicates.
+                        for (const pattern of byContent.values())
+                            this.dirtyIds.add(pattern.id);
+                        for (const id of removedIds)
+                            this.deletedIds.add(id);
                         this.dirty = true;
                         this.flushToDisk();
                     }
                 }
             }
         }
-        catch {
-            // Ignore load errors, start fresh
+        catch (error) {
+            // A corrupt patterns file must be preserved, not silently replaced by
+            // an empty bank on the next flush (#4735).
+            try {
+                const corruptPath = `${getPatternsPath()}.corrupt-${Date.now()}`;
+                renameSync(getPatternsPath(), corruptPath);
+                console.warn(`[intelligence] Corrupt patterns file moved to ${corruptPath}`);
+            }
+            catch { /* already absent or rename failed — never overwrite it below */ }
         }
     }
     /**
@@ -415,6 +437,11 @@ class LocalReasoningBank {
     }
     /**
      * Immediately flush patterns to disk
+     *
+     * Re-reads the file under the cooperating-writer lock and merges only the
+     * patterns this process changed, so a long-lived daemon cannot erase patterns
+     * written by another hook/process (#4735). Deletions and clear() are carried
+     * as tombstones; the write itself is temp-file + rename.
      */
     flushToDisk() {
         if (!this.persistenceEnabled || !this.dirty)
@@ -422,11 +449,52 @@ class LocalReasoningBank {
         try {
             ensureDataDir();
             const path = getPatternsPath();
-            writeFileSync(path, JSON.stringify(this.patternList, null, 2), 'utf-8');
-            this.dirty = false;
+            withStatsFileLock(path, (canonicalPath) => {
+                let diskPatterns = [];
+                if (existsSync(canonicalPath)) {
+                    try {
+                        const parsed = JSON.parse(readFileSync(canonicalPath, 'utf-8'));
+                        if (!Array.isArray(parsed))
+                            throw new Error('patterns.json is not an array');
+                        diskPatterns = parsed;
+                    }
+                    catch {
+                        // Preserve the corrupt original instead of overwriting it with an
+                        // empty bank; the new file is written only after this rename.
+                        try {
+                            const corruptPath = `${canonicalPath}.corrupt-${Date.now()}`;
+                            renameSync(canonicalPath, corruptPath);
+                            console.warn(`[intelligence] Corrupt patterns file moved to ${corruptPath}`);
+                        }
+                        catch { /* leave the original in place */ }
+                    }
+                }
+                const merged = new Map();
+                if (!this.clearRequested) {
+                    for (const pattern of diskPatterns) {
+                        if (!this.deletedIds.has(pattern.id))
+                            merged.set(pattern.id, pattern);
+                    }
+                }
+                for (const pattern of this.patternList) {
+                    if (this.clearRequested || this.dirtyIds.has(pattern.id)) {
+                        merged.set(pattern.id, pattern);
+                    }
+                }
+                const list = [...merged.values()];
+                const tmp = `${canonicalPath}.${process.pid}.${Date.now()}.tmp`;
+                writeFileSync(tmp, JSON.stringify(list, null, 2), 'utf-8');
+                renameSync(tmp, canonicalPath);
+                this.patterns = new Map(list.map((pattern) => [pattern.id, pattern]));
+                this.patternList = list;
+                this.dirty = false;
+                this.dirtyIds.clear();
+                this.deletedIds.clear();
+                this.clearRequested = false;
+            });
         }
         catch (error) {
-            // Log but don't throw - persistence failures shouldn't break training
+            // Log but don't throw - persistence failures shouldn't break training.
             console.error('Failed to persist patterns:', error);
         }
     }
@@ -459,6 +527,7 @@ class LocalReasoningBank {
                 this.patternList[idx] = stored;
             }
             this.patterns.set(pattern.id, stored);
+            this.dirtyIds.add(pattern.id);
             this.saveToDisk();
             return false;
         }
@@ -474,6 +543,7 @@ class LocalReasoningBank {
                 }
                 // Keep the Map in sync with the mutated object
                 this.patterns.set(contentDupe.id, contentDupe);
+                this.dirtyIds.add(contentDupe.id);
                 this.saveToDisk();
                 return false;
             }
@@ -482,11 +552,14 @@ class LocalReasoningBank {
                 const oldest = this.patternList.shift();
                 if (oldest) {
                     this.patterns.delete(oldest.id);
+                    this.deletedIds.add(oldest.id);
+                    this.dirtyIds.delete(oldest.id);
                 }
             }
             this.patternList.push(stored);
         }
         this.patterns.set(pattern.id, stored);
+        this.dirtyIds.add(stored.id);
         // Trigger persistence (debounced)
         this.saveToDisk();
         return true;
@@ -583,6 +656,8 @@ class LocalReasoningBank {
         if (idx >= 0) {
             this.patternList.splice(idx, 1);
         }
+        this.dirtyIds.delete(id);
+        this.deletedIds.add(id);
         this.saveToDisk();
         return true;
     }
@@ -592,6 +667,9 @@ class LocalReasoningBank {
     clear() {
         this.patterns.clear();
         this.patternList = [];
+        this.dirtyIds.clear();
+        this.deletedIds.clear();
+        this.clearRequested = true;
         this.saveToDisk();
     }
 }

package/dist/src/memory/memory-initializer.d.ts

@@ -361,7 +361,9 @@ export declare function loadEmbeddingModel(options?: {
  * own embedder is real or stubbed). Set `backend` truthfully by the path that
  * actually produced the vector. Do NOT change the embedding math.
  */
-export declare function generateEmbedding(text: string): Promise<{
+export declare function generateEmbedding(text: string, options?: {
+    normalize?: boolean;
+}): Promise<{
     embedding: number[];
     dimensions: number;
     model: string;
@@ -382,7 +384,9 @@ export declare function generateEmbedding(text: string): Promise<{
  *
  * Keeping the local chain as its own export breaks that cycle structurally.
  */
-export declare function generateLocalEmbedding(text: string): Promise<{
+export declare function generateLocalEmbedding(text: string, options?: {
+    normalize?: boolean;
+}): Promise<{
     embedding: number[];
     dimensions: number;
     model: string;

package/dist/src/memory/memory-initializer.js

@@ -2253,7 +2253,12 @@ async function loadLocalEmbeddingChain(verbose = false, startTime = Date.now())
  * own embedder is real or stubbed). Set `backend` truthfully by the path that
  * actually produced the vector. Do NOT change the embedding math.
  */
-export async function generateEmbedding(text) {
+export async function generateEmbedding(text, options) {
+    // #4724: AgentDB embed() has no normalize switch and always returns a unit
+    // vector. A raw request has to use the local chain, which can skip L2.
+    if (options?.normalize === false) {
+        return generateLocalEmbedding(text, { normalize: false });
+    }
     // ADR-053: Try AgentDB v3 bridge first
     const bridge = await getBridge();
     if (bridge) {
@@ -2283,7 +2288,9 @@ export async function generateEmbedding(text) {
  *
  * Keeping the local chain as its own export breaks that cycle structurally.
  */
-export async function generateLocalEmbedding(text) {
+export async function generateLocalEmbedding(text, options) {
+    // Default true keeps the historical unit-norm embedding math.
+    const normalize = options?.normalize !== false;
     // Ensure the LOCAL model is loaded. #3375: this must not go through
     // loadEmbeddingModel(), which is bridge-first — when the bridge answered
     // there, no local model was ever loaded and this function always returned
@@ -2314,7 +2321,7 @@ export async function generateLocalEmbedding(text) {
     // Use ONNX model if available
     if (state.model && typeof state.model === 'function') {
         try {
-            const output = await state.model(text, { pooling: 'mean', normalize: true });
+            const output = await state.model(text, { pooling: 'mean', normalize });
             // Handle @xenova/transformers (output.data), ruvector (plain array) and
             // typed-array (ReasoningBank Float32Array, #3114) formats. DataView is an
             // ArrayBuffer view without an iterator (Array.from gives []), so exclude it.
@@ -2338,7 +2345,7 @@ export async function generateLocalEmbedding(text) {
     // Deterministic hash-based fallback (for testing/demo without ONNX).
     // AUDIT #3: backend='mock' — these vectors do NOT carry real semantics.
     (await import('./embedding-policy.js')).enforceNoStub('memory-initializer.generateLocalEmbedding'); // "no stubs" strict mode
-    const embedding = generateHashEmbedding(text, state.dimensions);
+    const embedding = generateHashEmbedding(text, state.dimensions, normalize);
     return {
         embedding,
         dimensions: state.dimensions,
@@ -2401,7 +2408,7 @@ export async function generateBatchEmbeddings(texts, options) {
  * Generate deterministic hash-based embedding
  * Not semantic, but deterministic and useful for testing
  */
-function generateHashEmbedding(text, dimensions) {
+function generateHashEmbedding(text, dimensions, normalize = true) {
     const embedding = new Array(dimensions).fill(0);
     // Simple hash-based approach for reproducibility
     const words = text.toLowerCase().split(/\s+/);
@@ -2413,7 +2420,9 @@ function generateHashEmbedding(text, dimensions) {
             embedding[idx] += Math.sin(charCode * 0.1) * 0.1;
         }
     }
-    // Normalize to unit vector
+    // Normalize to unit vector unless the caller asked for the raw vector (#4724).
+    if (!normalize)
+        return embedding;
     const magnitude = Math.sqrt(embedding.reduce((sum, v) => sum + v * v, 0)) || 1;
     return embedding.map(v => v / magnitude);
 }

package/dist/src/mods/command-registry/schema.d.ts

@@ -192,8 +192,8 @@ export declare const inventorySourceSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     digest: string;
     sourcePath: string;
-    channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
     package: string;
+    channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
     observedInvocation: string;
     binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
     shippedIn: string[];
@@ -201,8 +201,8 @@ export declare const inventorySourceSchema: z.ZodObject<{
 }, {
     digest: string;
     sourcePath: string;
-    channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
     package: string;
+    channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
     observedInvocation: string;
     binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
     shippedIn: string[];
@@ -370,8 +370,8 @@ export declare const catalogEntrySchema: z.ZodObject<{
     }, "strict", z.ZodTypeAny, {
         digest: string;
         sourcePath: string;
-        channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
         package: string;
+        channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
         observedInvocation: string;
         binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
         shippedIn: string[];
@@ -379,8 +379,8 @@ export declare const catalogEntrySchema: z.ZodObject<{
     }, {
         digest: string;
         sourcePath: string;
-        channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
         package: string;
+        channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
         observedInvocation: string;
         binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
         shippedIn: string[];
@@ -391,8 +391,8 @@ export declare const catalogEntrySchema: z.ZodObject<{
     sources: {
         digest: string;
         sourcePath: string;
-        channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
         package: string;
+        channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
         observedInvocation: string;
         binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
         shippedIn: string[];
@@ -432,8 +432,8 @@ export declare const catalogEntrySchema: z.ZodObject<{
     sources: {
         digest: string;
         sourcePath: string;
-        channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
         package: string;
+        channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
         observedInvocation: string;
         binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
         shippedIn: string[];
@@ -636,8 +636,8 @@ export declare const commandCatalogSchema: z.ZodObject<{
         }, "strict", z.ZodTypeAny, {
             digest: string;
             sourcePath: string;
-            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             package: string;
+            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             observedInvocation: string;
             binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
             shippedIn: string[];
@@ -645,8 +645,8 @@ export declare const commandCatalogSchema: z.ZodObject<{
         }, {
             digest: string;
             sourcePath: string;
-            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             package: string;
+            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             observedInvocation: string;
             binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
             shippedIn: string[];
@@ -657,8 +657,8 @@ export declare const commandCatalogSchema: z.ZodObject<{
         sources: {
             digest: string;
             sourcePath: string;
-            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             package: string;
+            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             observedInvocation: string;
             binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
             shippedIn: string[];
@@ -698,8 +698,8 @@ export declare const commandCatalogSchema: z.ZodObject<{
         sources: {
             digest: string;
             sourcePath: string;
-            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             package: string;
+            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             observedInvocation: string;
             binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
             shippedIn: string[];
@@ -741,8 +741,8 @@ export declare const commandCatalogSchema: z.ZodObject<{
         sources: {
             digest: string;
             sourcePath: string;
-            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             package: string;
+            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             observedInvocation: string;
             binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
             shippedIn: string[];
@@ -787,8 +787,8 @@ export declare const commandCatalogSchema: z.ZodObject<{
         sources: {
             digest: string;
             sourcePath: string;
-            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             package: string;
+            channel: "repo-project-commands" | "cli-init-template" | "marketplace-plugin" | "source-plugin" | "mod-registration";
             observedInvocation: string;
             binding: "markdown-loader" | "mod-register" | "mod-middleware-on-markdown";
             shippedIn: string[];

package/dist/src/ruvector/ast-analyzer.d.ts

@@ -40,8 +40,7 @@ export interface ASTAnalysis {
 }
 export declare class ASTAnalyzer {
     private config;
-    private ruvectorEngine;
-    private useNative;
+    private readonly useNative;
     private analysisCache;
     constructor(config?: Partial<ASTAnalyzerConfig>);
     initialize(): Promise<void>;

package/dist/src/ruvector/ast-analyzer.js

@@ -22,24 +22,16 @@ const LANGUAGE_PATTERNS = {
 };
 export class ASTAnalyzer {
     config;
-    ruvectorEngine = null;
     useNative = false;
     analysisCache = new Map();
     constructor(config = {}) {
         this.config = { ...DEFAULT_CONFIG, ...config };
     }
     async initialize() {
-        try {
-            // @ruvector/ast is optional - gracefully fallback if not installed
-            const ruvector = await import('@ruvector/ast').catch(() => null);
-            if (ruvector) {
-                this.ruvectorEngine = ruvector.createASTAnalyzer?.(this.config);
-                this.useNative = !!this.ruvectorEngine;
-            }
-        }
-        catch {
-            this.useNative = false;
-        }
+        // Pure-JS analysis. This used to try `import('@ruvector/ast')`, a package that has
+        // never been published (npm 404), so it always fell through to here. ruvector@0.3's
+        // ASTParser needs the native tree-sitter grammars and is async-only, so it cannot
+        // back this synchronous analyzer.
     }
     analyze(code, filePath = 'unknown') {
         const startTime = performance.now();

package/dist/src/ruvector/coverage-router.d.ts

@@ -63,8 +63,7 @@ export interface CoverageRouteResult {
 }
 export declare class CoverageRouter {
     private config;
-    private ruvectorEngine;
-    private useNative;
+    private readonly useNative;
     private coverageHistory;
     constructor(config?: Partial<CoverageRouterConfig>);
     initialize(): Promise<void>;

package/dist/src/ruvector/coverage-router.js

@@ -37,24 +37,16 @@ const DEFAULT_CONFIG = {
 };
 export class CoverageRouter {
     config;
-    ruvectorEngine = null;
     useNative = false;
     coverageHistory = [];
     constructor(config = {}) {
         this.config = { ...DEFAULT_CONFIG, ...config };
     }
     async initialize() {
-        try {
-            // @ruvector/coverage is optional - gracefully fallback if not installed
-            const ruvector = await import('@ruvector/coverage').catch(() => null);
-            if (ruvector) {
-                this.ruvectorEngine = ruvector.createCoverageRouter?.(this.config);
-                this.useNative = !!this.ruvectorEngine;
-            }
-        }
-        catch {
-            this.useNative = false;
-        }
+        // Pure-JS analysis. This used to try `import('@ruvector/coverage')`, a package that
+        // has never been published (npm 404), so it always fell through to here.
+        // ruvector@0.3's parseIstanbulCoverage is a plain-JS parser equivalent to the parsers
+        // below.
     }
     parseCoverage(data, format = 'json') {
         switch (format) {

package/dist/src/ruvector/diff-classifier.d.ts

@@ -49,8 +49,7 @@ export interface DiffAnalysis {
 }
 export declare class DiffClassifier {
     private config;
-    private ruvectorEngine;
-    private useNative;
+    private readonly useNative;
     private classificationCache;
     constructor(config?: Partial<DiffClassifierConfig>);
     initialize(): Promise<void>;

package/dist/src/ruvector/diff-classifier.js

@@ -60,24 +60,15 @@ function isSecuritySensitivePath(path) {
 }
 export class DiffClassifier {
     config;
-    ruvectorEngine = null;
     useNative = false;
     classificationCache = new Map();
     constructor(config = {}) {
         this.config = { ...DEFAULT_CONFIG, ...config };
     }
     async initialize() {
-        try {
-            // @ruvector/diff is optional - gracefully fallback if not installed
-            const ruvector = await import('@ruvector/diff').catch(() => null);
-            if (ruvector) {
-                this.ruvectorEngine = ruvector.createDiffClassifier?.(this.config);
-                this.useNative = !!this.ruvectorEngine;
-            }
-        }
-        catch {
-            this.useNative = false;
-        }
+        // Pure-JS analysis. This used to try `import('@ruvector/diff')`, a package that has
+        // never been published (npm 404), so it always fell through to here. ruvector@0.3's
+        // parseDiff is a plain-JS parser equivalent to parseDiff() below.
     }
     parseDiff(diffContent) {
         const files = [];