@claude-flow/cli 3.72.1 → 3.72.2

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.72.1",
+    "version": "3.72.2",
     "files": {
       "auto-memory-hook.mjs": "6078bd1c6b02dd3f80097f8d7f28904d48b3cdf7a534d2aa13966590694ca403",
       "hook-handler.cjs": "31db0f7492fbd8b2e48ea9adbc1ba293dfed1e006666d20e93ea76e158986947",
@@ -10,6 +10,6 @@
       "learning-loop.cjs": "d046cd6f8efb7dd40e1d2451516c181fc8b26477aefb1124c0df5f52a23f9190"
     }
   },
-  "signature": "xOPNAkZaRFxW1eLWGKMWxYTKSag+Q6LH2zEvMSKUkICLeNN5KDOOBmd9G6nqQqqj2W9Yj+iNPgo6fMvxM7KgAw==",
+  "signature": "5RMg2Vt/R7xAPg+7/pY9fUkypu0bwOIKuBsMHvJtcnWxhreO1Ljk2M9HDOD8C5CO5QDALr07wfBXheMnoZFyCw==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-11-06T02:50:18.000Z",
-  "gitSha": "29b327ee",
+  "generatedAt": "2026-11-06T13:58:28.616Z",
+  "gitSha": "b7bc909d",
   "catalog": {
     "agents": 177,
     "tools": 451,

package/dist/src/commands/neural.js

@@ -1526,7 +1526,9 @@ const benchmarkCommand = {
                 // when it isn't installed — install-safety / Build V3 pattern from #2586).
                 const attentionPkg = '@ruvector/attention';
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- dynamic import of optional native WASM module with no type declarations
-                const attention = await import(attentionPkg);
+                // @ruvector/attention is CommonJS: under import() its classes sit on `default`.
+                const attentionMod = await import(attentionPkg);
+                const attention = (attentionMod.default ?? attentionMod);
                 // Manual benchmark since benchmarkAttention has a binding bug
                 const benchmarkMechanism = async (name, mechanism) => {
                     const query = new Float32Array(dim);
@@ -1546,10 +1548,10 @@ const benchmarkCommand = {
                     }
                     // Warmup
                     for (let i = 0; i < 10; i++)
-                        mechanism.computeRaw(query, keys, values);
+                        mechanism.compute(query, keys, values);
                     const start = performance.now();
                     for (let i = 0; i < iterations; i++) {
-                        mechanism.computeRaw(query, keys, values);
+                        mechanism.compute(query, keys, values);
                     }
                     const elapsed = performance.now() - start;
                     return {

package/dist/src/mcp-tools/browser-session-tools.d.ts

@@ -13,9 +13,9 @@
  *     AgentDB index). They do not inline a replay engine; replay
  *     enumerates trajectory steps and returns them for the caller to dispatch.
  *   - ruvector resolution is local-first: if a locally installed `ruvector`
- *     package is found (the CLI already depends on ruvector@0.2.27), its bin
+ *     package is found (the CLI depends on ruvector ^0.3.11), its bin
  *     is spawned directly with `node`; otherwise we fall back to
- *     `npx -y ruvector@0.2.27`. The previous 0.2.25 pin forced cold npx
+ *     `npx -y ruvector@0.3.12`. The previous 0.2.25 pin forced cold npx
  *     downloads of a *second* ruvector version — 4 per browser session.
  *   - Best-effort: missing dependencies (no `ruvector`, no `agent-browser`,
  *     no AgentDB controller) degrade gracefully with a structured error

package/dist/src/mcp-tools/browser-session-tools.js

@@ -13,9 +13,9 @@
  *     AgentDB index). They do not inline a replay engine; replay
  *     enumerates trajectory steps and returns them for the caller to dispatch.
  *   - ruvector resolution is local-first: if a locally installed `ruvector`
- *     package is found (the CLI already depends on ruvector@0.2.27), its bin
+ *     package is found (the CLI depends on ruvector ^0.3.11), its bin
  *     is spawned directly with `node`; otherwise we fall back to
- *     `npx -y ruvector@0.2.27`. The previous 0.2.25 pin forced cold npx
+ *     `npx -y ruvector@0.3.12`. The previous 0.2.25 pin forced cold npx
  *     downloads of a *second* ruvector version — 4 per browser session.
  *   - Best-effort: missing dependencies (no `ruvector`, no `agent-browser`,
  *     no AgentDB controller) degrade gracefully with a structured error
@@ -25,9 +25,9 @@ import { validateIdentifier, validateText } from './validate-input.js';
 import { browserUrlError } from './browser-argv.js';
 // Pin matches the version in this package's own dependency tree so the npx
 // fallback never downloads a second ruvector. Subcommand surface verified
-// against ruvector@0.2.27 --help: `rvf create/compact/status/derive/segments`
+// against ruvector@0.3.12 --help (and earlier 0.2.27): `rvf create/compact/status/derive/segments`
 // and `hooks trajectory-begin/step/end` all exist with the flags used below.
-const RUVECTOR_PIN = 'ruvector@0.2.27';
+const RUVECTOR_PIN = 'ruvector@0.3.12';
 const RVF_DIR_DEFAULT = '.ruflo/browser-sessions';
 async function shell(cmd, args, opts = {}) {
     const { execFile } = await import('node:child_process');

package/dist/src/mcp-tools/hooks-tools.js

@@ -2224,8 +2224,24 @@ export const hooksBuildAgents = {
                 return { success: false, error: v.error };
         }
         const outputDir = resolve(getProjectCwd(), params.outputDir || './agents');
+        // validatePath allows absolute paths, so keep the real output dir inside
+        // the real project root (CWE-22/59): configs are only ever project files.
+        let realProjectRoot;
+        try {
+            realProjectRoot = nodeFs.realpathSync(getProjectCwd());
+        }
+        catch {
+            realProjectRoot = getProjectCwd();
+        }
+        if (!isInsideRealRoot(realProjectRoot, outputDir)) {
+            return { success: false, error: 'outputDir must be inside the project directory' };
+        }
         const focus = params.focus || 'all';
-        const format = params.format || 'yaml';
+        // format is spliced into each file name; only the two supported formats.
+        const format = params.format === undefined ? 'yaml' : params.format;
+        if (format !== 'yaml' && format !== 'json') {
+            return { success: false, error: 'format must be "yaml" or "json"' };
+        }
         const persist = params.persist !== false; // Default to true
         const agents = [
             { type: 'coder', configFile: join(outputDir, `coder.${format}`), capabilities: ['code-generation', 'refactoring', 'debugging'], optimizations: ['flash-attention', 'token-reduction'] },

package/dist/src/mcp-tools/neural-tools.js

@@ -72,7 +72,7 @@ function activeChampionParams() {
 // command, because mcp-client statically imports this module. ensureEmbeddings()
 // keeps the exact same tier chain and degraded/fallback semantics, but only
 // pays the cost when a handler actually needs an embedding.
-// Tier 0 (ADR-089): ruvector@0.2.27 bundled ONNX (no sharp dep, fixes ADR-086's
+// Tier 0 (ADR-089): ruvector bundled ONNX (since 0.2.27) (no sharp dep, fixes ADR-086's
 //   silent-fallback bug at source; closes the chain described in ruvnet/ruvector#523).
 // Tier 1: agentic-flow v3 ReasoningBank (was Tier 1 — broken on darwin-arm64 without sharp)
 // Tier 2-3: @claude-flow/embeddings
@@ -110,7 +110,7 @@ function ensureEmbeddings() {
                 }
             }
             catch { /* not configured — fall through */ }
-            // Tier 0: ruvector@0.2.27 — bundled all-MiniLM-L6-v2 + parallel worker pool.
+            // Tier 0: ruvector (CLI dependency) — bundled all-MiniLM-L6-v2 + parallel worker pool.
             // Probe with isOnnxAvailable() and verify an actual embed succeeds (avoids
             // the type-load-success-but-runtime-fails trap from ADR-086). The probe now
             // runs on first embed request instead of at import time.
@@ -133,7 +133,7 @@ function ensureEmbeddings() {
                                 return Array.isArray(v) ? v : Array.from(v);
                             },
                         };
-                        embeddingServiceName = 'ruvector@0.2.27 (bundled all-MiniLM-L6-v2)';
+                        embeddingServiceName = 'ruvector (bundled all-MiniLM-L6-v2)';
                     }
                 }
                 catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.72.1",
+  "version": "3.72.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -104,7 +104,7 @@
     "@claude-flow/cli-core": "3.7.5",
     "@claude-flow/codex": "3.0.6",
     "@claude-flow/mcp": "3.1.6",
-    "@claude-flow/neural": "3.0.2",
+    "@claude-flow/neural": "3.0.3",
     "@claude-flow/plugin-agent-federation": "1.0.5",
     "@claude-flow/security": "3.0.6",
     "@claude-flow/shared": "3.0.7",
@@ -142,7 +142,7 @@
     "agentdb": "^3.3.0",
     "agentic-flow": "^3.0.0",
     "better-sqlite3": "^12.9.0",
-    "ruvector": "^0.3.11",
+    "ruvector": "^0.3.13",
     "nostr-tools": "^2.7.0",
     "@ruvector/learning-wasm": "0.1.29",
     "agent-booster": "^0.2.2"