@claude-flow/cli 3.72.0 → 3.72.2

package/plugins/ruflo-metaharness/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruflo-metaharness",
   "description": "MetaHarness integration for ruflo — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150's architectural constraint that MetaHarness remains an optional augmentation, never a required runtime dependency. As a mod (ADR-445): confirms flywheel promotion, keeps secrets out of inputs, /metaharness-mod, and a status file the console shows",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "repository": "https://github.com/ruvnet/ruflo",
   "author": {
     "name": "ruvnet",

package/plugins/ruflo-metaharness/scripts/_darwin.mjs

@@ -2,7 +2,7 @@
 //
 // Mirrors `_harness.mjs` for the umbrella `metaharness` / `harness` binaries,
 // but targets the separate darwin binary (`metaharness-darwin`) which is
-// published as its own npm package (`@metaharness/darwin@~0.12.0`).
+// published as its own npm package (`@metaharness/darwin@~0.13.0`).
 //
 // Shared plumbing (degraded classification, --json injection, trailing-JSON
 // parse, degraded emitter) lives in `_invoke.mjs`. What stays here is the
@@ -61,14 +61,14 @@ const DEFAULT_TIMEOUT_MS = 60_000;
 
 // Pinned semver range. The `~` allows patch upgrades without re-pinning.
 // Must cover the `@metaharness/darwin` optionalDependency range in
-// v3/@claude-flow/cli/package.json (`~0.12.0`). It sat at ~0.8.0 while that
-// range moved to ~0.9.0 (#2958), ~0.10.2 (#3262) and ~0.12.0 (#3219), because the pin-drift
+// v3/@claude-flow/cli/package.json (`~0.13.0`). It sat at ~0.8.0 while that
+// range moved to ~0.9.0 (#2958), ~0.10.2 (#3262), ~0.12.0 (#3219) and ~0.13.0 (GHSA-mjwg-5fm3-fx2p), because the pin-drift
 // guard only compared MH_DARWIN_PIN (distill-oracle.ts). This range picks
 // the darwin version the evolve / bench / security-bench tools run and the
 // gepa cache fallback installs; scripts/check-metaharness-pins.mjs now fails
 // when it no longer covers the declared range.
 const DARWIN_PKG = '@metaharness/darwin';
-const DARWIN_PIN_VERSION = '~0.12.0';
+const DARWIN_PIN_VERSION = '~0.13.0';
 const DARWIN_PIN = `${DARWIN_PKG}@${DARWIN_PIN_VERSION}`;
 
 const REASON_PREFIX = 'metaharness-darwin';

package/plugins/ruflo-metaharness/scripts/_harness.mjs

@@ -62,7 +62,7 @@ const DEFAULT_TIMEOUT_MS = 60_000;
 // moved to ^0.4.1 (b8ec03f34) because nothing compared the two;
 // scripts/check-metaharness-pins.mjs now fails when they diverge.
 const METAHARNESS_PKG = 'metaharness';
-const METAHARNESS_PIN_VERSION = '~0.4.1';
+const METAHARNESS_PIN_VERSION = '~0.4.20';
 
 const REASON_NOT_AVAILABLE = 'metaharness-not-available';
 

package/plugins/ruflo-metaharness/scripts/smoke.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Structural smoke test for ruflo-metaharness v0.4.0 (ADR-150 Phase 1).
+# Structural smoke test for ruflo-metaharness v0.4.1 (ADR-150 Phase 1).
 set -u
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 PASS=0
@@ -32,10 +32,10 @@ else
   bad "extraction-regex-rot: EXPECTED_TOOLS=$EXPECTED_TOOLS EXPECTED_SUBS=$EXPECTED_SUBS"
 fi
 
-step "1. plugin.json declares 0.4.0 with adr-150 keywords"
+step "1. plugin.json declares 0.4.1 with adr-150 keywords"
 v=$(grep -E '"version"' "$ROOT/.claude-plugin/plugin.json" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-if [[ "$v" != "0.4.0" ]]; then
-  bad "expected 0.4.0, got '$v'"
+if [[ "$v" != "0.4.1" ]]; then
+  bad "expected 0.4.1, got '$v'"
 else
   miss=""
   for k in ruflo metaharness harness scorecard genome mcp-scan threat-model router adr-150 adr-148 adr-149 optional-dependency graceful-degradation subprocess phase-1-mvp; do