@claude-flow/cli 3.73.0 → 3.74.1

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.73.0",
+    "version": "3.74.1",
     "files": {
       "auto-memory-hook.mjs": "6078bd1c6b02dd3f80097f8d7f28904d48b3cdf7a534d2aa13966590694ca403",
       "hook-handler.cjs": "31db0f7492fbd8b2e48ea9adbc1ba293dfed1e006666d20e93ea76e158986947",
@@ -10,6 +10,6 @@
       "learning-loop.cjs": "d046cd6f8efb7dd40e1d2451516c181fc8b26477aefb1124c0df5f52a23f9190"
     }
   },
-  "signature": "JPs8pGUFfkmmIj+GpqM7snJ1AX9IJS8olXiwHgZjSTKCIcK0aERAd+Wjy3jfBbK1V8mqP+ZWeX8CRr4aA+3BDA==",
+  "signature": "m7PiBVjpmQ0IvydivjKnvxzOUnRfRuhGTSZfJrJG+RPI8tfTTEU5Ah2knCTHXF/fTwdAiCEvzJvLf1vBv9fdCA==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-11-09T01:20:38.869Z",
-  "gitSha": "a8b3304b",
+  "generatedAt": "2026-11-09T06:36:19.466Z",
+  "gitSha": "2d590fc0",
   "catalog": {
     "agents": 177,
     "tools": 451,

package/dist/src/commands/doctor.js

@@ -2214,13 +2214,15 @@ async function checkMetaharnessDeclaredPackages() {
         if (!root)
             return { name: NAME, status: 'warn', message: 'could not locate the @claude-flow/cli package root' };
         const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8'));
-        const declared = Object.keys(pkg.optionalDependencies ?? {}).filter((n) => n === 'metaharness' || n.startsWith('@metaharness/'));
+        // ADR-526: @metaharness/darwin is a regular dependency; the rest stay optional.
+        const declared = Object.keys({ ...(pkg.dependencies ?? {}), ...(pkg.optionalDependencies ?? {}) })
+            .filter((n) => n === 'metaharness' || n.startsWith('@metaharness/'));
         if (declared.length === 0) {
             return {
                 name: NAME,
                 status: 'fail',
-                message: 'no @metaharness/* packages declared in optionalDependencies — the dependency contract regressed (peer-only declarations are never installed)',
-                fix: 'Restore @metaharness/darwin, @metaharness/flywheel, @metaharness/radio, @metaharness/turn-credit to optionalDependencies in @claude-flow/cli',
+                message: 'no @metaharness/* packages declared in dependencies or optionalDependencies — the dependency contract regressed (peer-only declarations are never installed)',
+                fix: 'Restore @metaharness/darwin to dependencies and @metaharness/flywheel, @metaharness/radio, @metaharness/turn-credit to optionalDependencies in @claude-flow/cli',
             };
         }
         // Node resolution: nearest node_modules wins, walking upward from the CLI root.

package/dist/src/mcp-tools/memory-tools.js

@@ -434,6 +434,10 @@ export const memoryTools = [
                     items: { type: 'string' },
                     description: 'Optional tags for filtering',
                 },
+                metadata: {
+                    type: 'object',
+                    description: 'Optional JSON object stored with the entry (e.g. { confidence: 0.9 }, which AutoMemoryBridge reads for sync eligibility). Replaces any existing metadata on upsert.',
+                },
                 ttl: { type: 'number', description: 'Time-to-live in seconds (optional)' },
                 upsert: { type: 'boolean', description: 'Update existing key instead of failing (default: true, matching CLI `memory store`; set false for strict-insert). #2775 parity.' },
                 provenance_type: {
@@ -465,6 +469,18 @@ export const memoryTools = [
             // ADR-323: leave undefined when omitted so storeEntry's own default
             // ('unknown') applies uniformly across the CLI, MCP tool, and other callers.
             const provenanceType = input.provenance_type;
+            // #1426: metadata must be a plain JSON object; reject arrays, null and scalars.
+            const rawMetadata = input.metadata;
+            if (rawMetadata !== undefined && (typeof rawMetadata !== 'object' || rawMetadata === null || Array.isArray(rawMetadata))) {
+                return {
+                    success: false,
+                    key,
+                    stored: false,
+                    hasEmbedding: false,
+                    error: 'metadata must be a JSON object',
+                };
+            }
+            const metadata = rawMetadata;
             if (!value) {
                 return {
                     success: false,
@@ -488,6 +504,7 @@ export const memoryTools = [
                     namespace,
                     generateEmbeddingFlag: true,
                     tags,
+                    metadata,
                     ttl,
                     upsert,
                     provenanceType,

package/dist/src/mcp-tools/metaharness-tools.js

@@ -54,6 +54,7 @@ import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { ownPluginDirs } from '../plugins/own-install.js';
 import { runFlywheelWorker } from '../services/harness-flywheel-runtime.js';
+import { benchVerify, gepaOp } from '../metaharness/darwin-lib.js';
 import { evaluatePolicyRequest } from '../services/policy-runtime.js';
 import { listFlywheelReceipts, promoteFlywheelCandidate, readFlywheelTransactionState, resetSequentialEvidence, verifyFlywheelLedger, } from '../services/flywheel-transaction.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -523,6 +524,13 @@ export const metaharnessTools = [
             required: ['op'],
         },
         handler: async (input) => {
+            // ADR-526: verify runs in-process (darwin is a regular dependency);
+            // create still goes through the darwin CLI, which owns the scaffold task.
+            if (input.op === 'verify') {
+                const inProc = await benchVerify(String(input.suite ?? ''));
+                if (inProc)
+                    return { success: inProc.exitCode === 0, data: inProc.json, degraded: false, exitCode: inProc.exitCode };
+            }
             const args = ['--op', String(input.op)];
             if (input.repo)
                 args.push('--repo', String(input.repo));
@@ -665,6 +673,17 @@ export const metaharnessTools = [
             required: ['op'],
         },
         handler: async (input) => {
+            // ADR-526: GEPA genome ops run in-process; the plugin script is the fallback.
+            const inProc = await gepaOp({
+                op: String(input.op),
+                path: input.path ? String(input.path) : undefined,
+                transcript: input.transcript ? String(input.transcript) : undefined,
+                ext: input.ext ? String(input.ext) : undefined,
+                glob: input.glob ? String(input.glob) : undefined,
+                alertOnInvalid: input.alertOnInvalid === true,
+            });
+            if (inProc)
+                return { success: inProc.exitCode === 0, data: inProc.json, degraded: false, exitCode: inProc.exitCode };
             const args = ['--op', String(input.op)];
             if (input.path)
                 args.push('--path', String(input.path));

package/dist/src/memory/memory-bridge.d.ts

@@ -74,6 +74,8 @@ export declare function bridgeStoreEntry(options: {
     namespace?: string;
     generateEmbeddingFlag?: boolean;
     tags?: string[];
+    /** #1426: JSON object persisted to the metadata column. */
+    metadata?: Record<string, unknown>;
     ttl?: number;
     dbPath?: string;
     upsert?: boolean;

package/dist/src/memory/memory-bridge.js

@@ -1182,7 +1182,7 @@ export async function bridgeStoreEntry(options) {
         }
         catch { /* vector_indexes may not exist on legacy DBs — fall through */ }
         const stmt = ctx.db.prepare(insertSql);
-        const insert = () => stmt.run(id, key, namespace, value, embeddingJson, dimensions || null, model, tags.length > 0 ? JSON.stringify(tags) : null, '{}', provenanceType, now, now, ttl ? now + (ttl * 1000) : null);
+        const insert = () => stmt.run(id, key, namespace, value, embeddingJson, dimensions || null, model, tags.length > 0 ? JSON.stringify(tags) : null, JSON.stringify(options.metadata ?? {}), provenanceType, now, now, ttl ? now + (ttl * 1000) : null);
         let runResult;
         try {
             runResult = options.appendOnly

package/dist/src/memory/memory-initializer.d.ts

@@ -444,6 +444,8 @@ export declare function storeEntry(options: {
     namespace?: string;
     generateEmbeddingFlag?: boolean;
     tags?: string[];
+    /** #1426: JSON object persisted to the metadata column. */
+    metadata?: Record<string, unknown>;
     ttl?: number;
     dbPath?: string;
     upsert?: boolean;

package/dist/src/memory/memory-initializer.js

@@ -2733,7 +2733,7 @@ export async function storeEntry(options) {
                     embeddingDimensions,
                     embeddingModel,
                     tags.length > 0 ? JSON.stringify(tags) : null,
-                    '{}',
+                    JSON.stringify(options.metadata ?? {}),
                     persistedProvenance,
                     now,
                     now,

package/dist/src/metaharness/darwin-lib.d.ts

@@ -0,0 +1,68 @@
+/**
+ * In-process access to @metaharness/darwin (ADR-526).
+ *
+ * darwin is a regular dependency of the CLI, so the long-lived MCP server can
+ * import it once and answer `metaharness_bench --op verify` and every
+ * `metaharness_gepa` op without spawning `node bench.mjs` → `node darwin/cli.js`
+ * per call. Each function returns the same {exitCode, json} pair the plugin
+ * script would have produced, so callers keep the existing
+ * {success, data, degraded, exitCode} contract.
+ *
+ * Graceful degradation (ADR-150 rule 3) still holds: if the import fails, every
+ * function returns null and the caller falls back to the subprocess path.
+ */
+import { readFileSync } from 'node:fs';
+export interface DarwinResult {
+    exitCode: number;
+    /** Parsed payload, or null where the script would have printed only to stderr. */
+    json: unknown;
+}
+type DarwinRoot = {
+    bench: {
+        loadSuite(path: string): Promise<{
+            id: string;
+            version: string;
+            tasks: unknown[];
+        }>;
+        verifySuite(suite: unknown): {
+            ok: boolean;
+            actual: string;
+        };
+    };
+};
+type DarwinGepa = {
+    loadGenome(read: typeof readFileSync, path: string): unknown;
+    loadCand6Genome(): unknown;
+    validateGenome(genome: unknown): unknown[];
+    buildSystemFromGenome(genome: unknown, ext?: string, glob?: string): string;
+    analyzeTranscript(entries: unknown[]): unknown;
+    CAND6_GENOME_PATH: string;
+};
+export declare function loadDarwin(): Promise<DarwinRoot | null>;
+export declare function loadDarwinGepa(): Promise<DarwinGepa | null>;
+/** Test hook: forget the cached modules. */
+export declare function resetDarwinCache(): void;
+/**
+ * `bench verify <suite>` in-process. Mirrors plugins/ruflo-metaharness/scripts/bench.mjs:
+ * exit 2 + no payload for a missing path, exit 1 when the suite fails to load
+ * (darwin's loadSuite throws on tamper) or its hash does not match, exit 0 otherwise.
+ * Returns null when darwin cannot be imported.
+ */
+export declare function benchVerify(suitePath: string): Promise<DarwinResult | null>;
+export interface GepaInput {
+    op: string;
+    path?: string;
+    transcript?: string;
+    ext?: string;
+    glob?: string;
+    alertOnInvalid?: boolean;
+}
+/**
+ * GEPA genome ops in-process. Mirrors plugins/ruflo-metaharness/scripts/gepa.mjs,
+ * including its exit codes: 2 for input errors (no payload), 1 for an invalid
+ * genome with alertOnInvalid, 0 otherwise. Returns null when darwin/gepa cannot
+ * be imported.
+ */
+export declare function gepaOp(input: GepaInput): Promise<DarwinResult | null>;
+export {};
+//# sourceMappingURL=darwin-lib.d.ts.map

package/dist/src/metaharness/darwin-lib.js

@@ -0,0 +1,150 @@
+/**
+ * In-process access to @metaharness/darwin (ADR-526).
+ *
+ * darwin is a regular dependency of the CLI, so the long-lived MCP server can
+ * import it once and answer `metaharness_bench --op verify` and every
+ * `metaharness_gepa` op without spawning `node bench.mjs` → `node darwin/cli.js`
+ * per call. Each function returns the same {exitCode, json} pair the plugin
+ * script would have produced, so callers keep the existing
+ * {success, data, degraded, exitCode} contract.
+ *
+ * Graceful degradation (ADR-150 rule 3) still holds: if the import fails, every
+ * function returns null and the caller falls back to the subprocess path.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+// The specifiers are held in variables so a missing package degrades at
+// runtime instead of failing the CLI's own type-check or bundling.
+const ROOT_SPEC = '@metaharness/darwin';
+const GEPA_SPEC = '@metaharness/darwin/gepa';
+let rootPromise = null;
+let gepaPromise = null;
+export function loadDarwin() {
+    rootPromise ??= import(ROOT_SPEC).then((m) => m, () => null);
+    return rootPromise;
+}
+export function loadDarwinGepa() {
+    gepaPromise ??= import(GEPA_SPEC).then((m) => m, () => null);
+    return gepaPromise;
+}
+/** Test hook: forget the cached modules. */
+export function resetDarwinCache() {
+    rootPromise = null;
+    gepaPromise = null;
+}
+/**
+ * `bench verify <suite>` in-process. Mirrors plugins/ruflo-metaharness/scripts/bench.mjs:
+ * exit 2 + no payload for a missing path, exit 1 when the suite fails to load
+ * (darwin's loadSuite throws on tamper) or its hash does not match, exit 0 otherwise.
+ * Returns null when darwin cannot be imported.
+ */
+export async function benchVerify(suitePath) {
+    const darwin = await loadDarwin();
+    if (!darwin)
+        return null;
+    if (!suitePath || !existsSync(resolve(suitePath)))
+        return { exitCode: 2, json: null };
+    const start = Date.now();
+    const file = resolve(suitePath);
+    try {
+        const suite = await darwin.bench.loadSuite(file);
+        const check = darwin.bench.verifySuite(suite);
+        const tasks = Array.isArray(suite.tasks) ? suite.tasks.length : 0;
+        const data = {
+            op: 'verify',
+            suiteId: suite.id,
+            version: suite.version,
+            tasks,
+            hashOk: check.ok,
+            hash: check.actual,
+            // Same line the darwin CLI prints, so readers of the old shape keep working.
+            stdoutTail: `Suite ${suite.id}@${suite.version}: ${tasks} tasks, hash ${check.ok ? 'OK' : 'MISMATCH'} (${String(check.actual).slice(0, 12)}…)\n`,
+            durationMs: Date.now() - start,
+        };
+        return { exitCode: check.ok ? 0 : 1, json: { success: check.ok, data, generatedAt: new Date().toISOString() } };
+    }
+    catch (e) {
+        const data = { op: 'verify', error: e instanceof Error ? e.message : String(e), durationMs: Date.now() - start };
+        return { exitCode: 1, json: { success: false, data, generatedAt: new Date().toISOString() } };
+    }
+}
+const GEPA_OPS = ['genome', 'validate', 'render', 'analyze'];
+function readJson(path) {
+    try {
+        return { ok: true, value: JSON.parse(readFileSync(path, 'utf8')) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+/**
+ * GEPA genome ops in-process. Mirrors plugins/ruflo-metaharness/scripts/gepa.mjs,
+ * including its exit codes: 2 for input errors (no payload), 1 for an invalid
+ * genome with alertOnInvalid, 0 otherwise. Returns null when darwin/gepa cannot
+ * be imported.
+ */
+export async function gepaOp(input) {
+    if (!GEPA_OPS.includes(input.op))
+        return { exitCode: 2, json: null };
+    const gepa = await loadDarwinGepa();
+    if (!gepa)
+        return null;
+    const start = Date.now();
+    let out;
+    try {
+        const loadGenome = () => {
+            if (input.path) {
+                if (!existsSync(input.path))
+                    return null;
+                return { genome: gepa.loadGenome(readFileSync, input.path), source: input.path };
+            }
+            return { genome: gepa.loadCand6Genome(), source: gepa.CAND6_GENOME_PATH };
+        };
+        if (input.op === 'genome') {
+            const loaded = loadGenome();
+            if (!loaded)
+                return { exitCode: 2, json: null };
+            const errors = gepa.validateGenome(loaded.genome);
+            out = { op: 'genome', source: loaded.source, valid: errors.length === 0, errors, genome: loaded.genome };
+        }
+        else if (input.op === 'validate') {
+            let raw;
+            if (input.path) {
+                if (!existsSync(input.path))
+                    return { exitCode: 2, json: null };
+                const r = readJson(input.path);
+                if (!r.ok)
+                    return { exitCode: 2, json: null };
+                raw = r.value;
+            }
+            else {
+                raw = gepa.loadCand6Genome();
+            }
+            const errors = gepa.validateGenome(raw);
+            out = { op: 'validate', source: input.path ?? gepa.CAND6_GENOME_PATH, valid: errors.length === 0, errors };
+        }
+        else if (input.op === 'render') {
+            const loaded = loadGenome();
+            if (!loaded)
+                return { exitCode: 2, json: null };
+            const system = gepa.buildSystemFromGenome(loaded.genome, input.ext, input.glob);
+            out = { op: 'render', source: loaded.source, chars: system.length, system };
+        }
+        else {
+            if (!input.transcript || !existsSync(input.transcript))
+                return { exitCode: 2, json: null };
+            const r = readJson(input.transcript);
+            if (!r.ok || !Array.isArray(r.value))
+                return { exitCode: 2, json: null };
+            out = { op: 'analyze', source: input.transcript, entries: r.value.length, analysis: gepa.analyzeTranscript(r.value) };
+        }
+    }
+    catch {
+        // gepa.mjs exits 2 on any thrown error (its main().catch handler).
+        return { exitCode: 2, json: null };
+    }
+    out.durationMs = Date.now() - start;
+    const exitCode = input.alertOnInvalid && out.valid === false ? 1 : 0;
+    return { exitCode, json: out };
+}
+//# sourceMappingURL=darwin-lib.js.map