@claude-flow/cli 3.72.1 → 3.73.0

package/dist/src/init/first-win.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The concrete result `ruflo init` ends with (adoption plan item 1): a quick,
+ * local snapshot of the user's own project, plus one prompt to paste into
+ * Claude Code. Replaces a list of commands with something about *their* repo.
+ *
+ * Local only: `git` with argument arrays (no shell), a hard timeout per call,
+ * no network. Any failure returns null and init prints nothing extra.
+ */
+export interface ProjectSnapshot {
+    files: number;
+    languages: string[];
+    hotFile?: {
+        path: string;
+        changes: number;
+    };
+    testCommand?: string;
+}
+/** Snapshot of the project at `cwd`, or null when it is not a git repo with code. */
+export declare function snapshotProject(cwd: string, timeoutMs?: number): ProjectSnapshot | null;
+/** The one prompt to paste into Claude Code, specific to this project. */
+export declare function firstPrompt(s: ProjectSnapshot | null): string;
+/** Lines for init's closing summary. Empty when there is nothing useful to say. */
+export declare function snapshotLines(s: ProjectSnapshot | null): string[];
+//# sourceMappingURL=first-win.d.ts.map

package/dist/src/init/first-win.js

@@ -0,0 +1,97 @@
+/**
+ * The concrete result `ruflo init` ends with (adoption plan item 1): a quick,
+ * local snapshot of the user's own project, plus one prompt to paste into
+ * Claude Code. Replaces a list of commands with something about *their* repo.
+ *
+ * Local only: `git` with argument arrays (no shell), a hard timeout per call,
+ * no network. Any failure returns null and init prints nothing extra.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { extname, join } from 'node:path';
+const LANGUAGE = {
+    '.ts': 'TypeScript', '.tsx': 'TypeScript', '.js': 'JavaScript', '.jsx': 'JavaScript', '.mjs': 'JavaScript', '.cjs': 'JavaScript',
+    '.py': 'Python', '.rs': 'Rust', '.go': 'Go', '.java': 'Java', '.kt': 'Kotlin', '.rb': 'Ruby', '.php': 'PHP',
+    '.cs': 'C#', '.cpp': 'C++', '.cc': 'C++', '.c': 'C', '.h': 'C', '.swift': 'Swift', '.scala': 'Scala',
+    '.vue': 'Vue', '.svelte': 'Svelte', '.dart': 'Dart', '.ex': 'Elixir', '.exs': 'Elixir', '.lua': 'Lua',
+};
+// Files a "riskiest module" suggestion should never point at.
+const NOT_CODE = /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|Cargo\.lock|go\.sum|CHANGELOG[^/]*|README[^/]*|\.github\/|\.claude\/|\.claude-flow\/|dist\/|build\/|node_modules\/)/i;
+function git(cwd, args, timeoutMs) {
+    const r = spawnSync('git', args, { cwd, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] });
+    return r.status === 0 && typeof r.stdout === 'string' ? r.stdout : null;
+}
+function testCommandFor(cwd) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf8'));
+        const t = pkg.scripts?.test;
+        if (t && !/no test specified/i.test(t))
+            return 'npm test';
+    }
+    catch { /* not a node project */ }
+    if (existsSync(join(cwd, 'Cargo.toml')))
+        return 'cargo test';
+    if (existsSync(join(cwd, 'go.mod')))
+        return 'go test ./...';
+    if (existsSync(join(cwd, 'pyproject.toml')) || existsSync(join(cwd, 'pytest.ini')))
+        return 'pytest';
+    return undefined;
+}
+/** Snapshot of the project at `cwd`, or null when it is not a git repo with code. */
+export function snapshotProject(cwd, timeoutMs = 2000) {
+    try {
+        const listed = git(cwd, ['ls-files', '-z'], timeoutMs);
+        if (!listed)
+            return null;
+        const files = listed.split('\0').filter(Boolean);
+        if (files.length === 0)
+            return null;
+        const counts = new Map();
+        for (const f of files) {
+            const lang = LANGUAGE[extname(f).toLowerCase()];
+            if (lang)
+                counts.set(lang, (counts.get(lang) ?? 0) + 1);
+        }
+        const languages = [...counts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([l]) => l);
+        // Most-changed code file in the last 90 days (bounded to 500 commits).
+        let hotFile;
+        const log = git(cwd, ['log', '--since=90.days', '--max-count=500', '--name-only', '--pretty=format:'], timeoutMs);
+        if (log) {
+            const tracked = new Set(files);
+            const churn = new Map();
+            for (const line of log.split('\n')) {
+                const p = line.trim();
+                if (!p || NOT_CODE.test(p) || !tracked.has(p) || !LANGUAGE[extname(p).toLowerCase()])
+                    continue;
+                churn.set(p, (churn.get(p) ?? 0) + 1);
+            }
+            const top = [...churn.entries()].sort((a, b) => b[1] - a[1])[0];
+            if (top && top[1] >= 2)
+                hotFile = { path: top[0], changes: top[1] };
+        }
+        return { files: files.length, languages, hotFile, testCommand: testCommandFor(cwd) };
+    }
+    catch {
+        return null;
+    }
+}
+/** The one prompt to paste into Claude Code, specific to this project. */
+export function firstPrompt(s) {
+    if (s?.hotFile) {
+        const verify = s.testCommand ? ` and run \`${s.testCommand}\` to prove it` : '';
+        return `Use a ruflo swarm to review ${s.hotFile.path} (the most-changed file here): find the riskiest logic, add tests for it${verify}, and summarise what you changed.`;
+    }
+    return 'Use a ruflo swarm to review this repo: find the riskiest module, write tests for it, and summarise what you changed.';
+}
+/** Lines for init's closing summary. Empty when there is nothing useful to say. */
+export function snapshotLines(s) {
+    if (!s)
+        return [];
+    const lines = [`${s.files.toLocaleString('en-US')} tracked file${s.files === 1 ? '' : 's'}${s.languages.length ? ` · ${s.languages.join(', ')}` : ''}`];
+    if (s.hotFile)
+        lines.push(`Most-changed file (90 days): ${s.hotFile.path} (${s.hotFile.changes} commits)`);
+    if (s.testCommand)
+        lines.push(`Tests: ${s.testCommand}`);
+    return lines;
+}
+//# sourceMappingURL=first-win.js.map

package/dist/src/mcp-tools/agent-tools.js

@@ -12,6 +12,7 @@ import { validateIdentifier, validateText, validateAgentSpawn } from './validate
 import { executeAgentTask } from './agent-execute-core.js';
 import { AGENT_HEALTH_WINDOW, summarizeAgentExecutions } from './agent-health-metrics.js';
 import { pheromoneAgentEligibility } from './swarm-tools.js';
+import { noteFirstAgentRun } from '../funnel/activation.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const AGENT_DIR = 'agents';
@@ -425,6 +426,7 @@ export const agentTools = [
                 catch { /* COW branch is best-effort; agent already registered */ }
             }
             // Include deterministic codemod routing info if applicable
+            noteFirstAgentRun('cli'); // activation funnel (opt-in; no-op without telemetry consent)
             const response = {
                 success: true,
                 agentId,

package/dist/src/mcp-tools/browser-session-tools.d.ts

@@ -13,9 +13,9 @@
  *     AgentDB index). They do not inline a replay engine; replay
  *     enumerates trajectory steps and returns them for the caller to dispatch.
  *   - ruvector resolution is local-first: if a locally installed `ruvector`
- *     package is found (the CLI already depends on ruvector@0.2.27), its bin
+ *     package is found (the CLI depends on ruvector ^0.3.11), its bin
  *     is spawned directly with `node`; otherwise we fall back to
- *     `npx -y ruvector@0.2.27`. The previous 0.2.25 pin forced cold npx
+ *     `npx -y ruvector@0.3.12`. The previous 0.2.25 pin forced cold npx
  *     downloads of a *second* ruvector version — 4 per browser session.
  *   - Best-effort: missing dependencies (no `ruvector`, no `agent-browser`,
  *     no AgentDB controller) degrade gracefully with a structured error

package/dist/src/mcp-tools/browser-session-tools.js

@@ -13,9 +13,9 @@
  *     AgentDB index). They do not inline a replay engine; replay
  *     enumerates trajectory steps and returns them for the caller to dispatch.
  *   - ruvector resolution is local-first: if a locally installed `ruvector`
- *     package is found (the CLI already depends on ruvector@0.2.27), its bin
+ *     package is found (the CLI depends on ruvector ^0.3.11), its bin
  *     is spawned directly with `node`; otherwise we fall back to
- *     `npx -y ruvector@0.2.27`. The previous 0.2.25 pin forced cold npx
+ *     `npx -y ruvector@0.3.12`. The previous 0.2.25 pin forced cold npx
  *     downloads of a *second* ruvector version — 4 per browser session.
  *   - Best-effort: missing dependencies (no `ruvector`, no `agent-browser`,
  *     no AgentDB controller) degrade gracefully with a structured error
@@ -25,9 +25,9 @@ import { validateIdentifier, validateText } from './validate-input.js';
 import { browserUrlError } from './browser-argv.js';
 // Pin matches the version in this package's own dependency tree so the npx
 // fallback never downloads a second ruvector. Subcommand surface verified
-// against ruvector@0.2.27 --help: `rvf create/compact/status/derive/segments`
+// against ruvector@0.3.12 --help (and earlier 0.2.27): `rvf create/compact/status/derive/segments`
 // and `hooks trajectory-begin/step/end` all exist with the flags used below.
-const RUVECTOR_PIN = 'ruvector@0.2.27';
+const RUVECTOR_PIN = 'ruvector@0.3.12';
 const RVF_DIR_DEFAULT = '.ruflo/browser-sessions';
 async function shell(cmd, args, opts = {}) {
     const { execFile } = await import('node:child_process');

package/dist/src/mcp-tools/hooks-tools.js

@@ -2224,8 +2224,24 @@ export const hooksBuildAgents = {
                 return { success: false, error: v.error };
         }
         const outputDir = resolve(getProjectCwd(), params.outputDir || './agents');
+        // validatePath allows absolute paths, so keep the real output dir inside
+        // the real project root (CWE-22/59): configs are only ever project files.
+        let realProjectRoot;
+        try {
+            realProjectRoot = nodeFs.realpathSync(getProjectCwd());
+        }
+        catch {
+            realProjectRoot = getProjectCwd();
+        }
+        if (!isInsideRealRoot(realProjectRoot, outputDir)) {
+            return { success: false, error: 'outputDir must be inside the project directory' };
+        }
         const focus = params.focus || 'all';
-        const format = params.format || 'yaml';
+        // format is spliced into each file name; only the two supported formats.
+        const format = params.format === undefined ? 'yaml' : params.format;
+        if (format !== 'yaml' && format !== 'json') {
+            return { success: false, error: 'format must be "yaml" or "json"' };
+        }
         const persist = params.persist !== false; // Default to true
         const agents = [
             { type: 'coder', configFile: join(outputDir, `coder.${format}`), capabilities: ['code-generation', 'refactoring', 'debugging'], optimizations: ['flash-attention', 'token-reduction'] },

package/dist/src/mcp-tools/neural-tools.js

@@ -72,7 +72,7 @@ function activeChampionParams() {
 // command, because mcp-client statically imports this module. ensureEmbeddings()
 // keeps the exact same tier chain and degraded/fallback semantics, but only
 // pays the cost when a handler actually needs an embedding.
-// Tier 0 (ADR-089): ruvector@0.2.27 bundled ONNX (no sharp dep, fixes ADR-086's
+// Tier 0 (ADR-089): ruvector bundled ONNX (since 0.2.27) (no sharp dep, fixes ADR-086's
 //   silent-fallback bug at source; closes the chain described in ruvnet/ruvector#523).
 // Tier 1: agentic-flow v3 ReasoningBank (was Tier 1 — broken on darwin-arm64 without sharp)
 // Tier 2-3: @claude-flow/embeddings
@@ -110,7 +110,7 @@ function ensureEmbeddings() {
                 }
             }
             catch { /* not configured — fall through */ }
-            // Tier 0: ruvector@0.2.27 — bundled all-MiniLM-L6-v2 + parallel worker pool.
+            // Tier 0: ruvector (CLI dependency) — bundled all-MiniLM-L6-v2 + parallel worker pool.
             // Probe with isOnnxAvailable() and verify an actual embed succeeds (avoids
             // the type-load-success-but-runtime-fails trap from ADR-086). The probe now
             // runs on first embed request instead of at import time.
@@ -133,7 +133,7 @@ function ensureEmbeddings() {
                                 return Array.isArray(v) ? v : Array.from(v);
                             },
                         };
-                        embeddingServiceName = 'ruvector@0.2.27 (bundled all-MiniLM-L6-v2)';
+                        embeddingServiceName = 'ruvector (bundled all-MiniLM-L6-v2)';
                     }
                 }
                 catch {

package/dist/src/mcp-tools/swarm-tools.js

@@ -9,6 +9,7 @@ import { join } from 'node:path';
 import { nullPrototypeRecords, readPreservedJsonStore } from './record-store.js';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
+import { noteFirstAgentRun } from '../funnel/activation.js';
 import { createApscState, isApscAgentEligible, normalizeApscConfig, recordApscSignal, } from '../services/pheromone-adaptive.js';
 // Swarm state persistence
 const SWARM_DIR = '.claude-flow/swarm';
@@ -283,6 +284,7 @@ export const swarmTools = [
             const store = loadSwarmStore();
             store.swarms[swarmId] = swarmState;
             saveSwarmStore(store);
+            noteFirstAgentRun('cli'); // activation funnel (opt-in; no-op without telemetry consent)
             return {
                 success: true,
                 swarmId,