agentic-qe 3.11.0 → 3.11.1

package/.claude/helpers/intelligence.cjs

@@ -25,6 +25,10 @@ const PENDING_PATH = path.join(DATA_DIR, 'pending-insights.jsonl');
 const SESSION_DIR = path.join(process.cwd(), '.claude-flow', 'sessions');
 const SESSION_FILE = path.join(SESSION_DIR, 'current.json');
 
+// ── Safety limits (fixes #1530, #1531) ─────────────────────────────────────
+const MAX_DATA_FILE_SIZE = 10 * 1024 * 1024; // 10 MB — skip files larger than this
+const MAX_GRAPH_NODES = 5000;                 // skip PageRank if graph exceeds this
+
 // ── Stop words for trigram matching ──────────────────────────────────────────
 
 const STOP_WORDS = new Set([
@@ -46,6 +50,14 @@ function ensureDataDir() {
 }
 
 function readJSON(filePath) {
+  // Safety: skip files exceeding MAX_DATA_FILE_SIZE (#1531)
+  try {
+    const stat = fs.statSync(filePath);
+    if (stat.size > MAX_DATA_FILE_SIZE) {
+      process.stderr.write("[INTELLIGENCE] WARN: Skipping " + path.basename(filePath) + " (" + Math.round(stat.size / 1048576) + "MB exceeds 10MB limit)\n");
+      return null;
+    }
+  } catch { /* file may not exist yet */ }
   try {
     if (fs.existsSync(filePath)) return JSON.parse(fs.readFileSync(filePath, 'utf-8'));
   } catch { /* corrupt file — start fresh */ }
@@ -80,6 +92,63 @@ function jaccardSimilarity(setA, setB) {
   return intersection / (setA.size + setB.size - intersection);
 }
 
+// ── Deduplication helper (fixes #1518) ──────────────────────────────────────
+
+function deduplicateById(entries) {
+  if (!entries || !Array.isArray(entries)) return entries;
+  const seen = new Map();
+  for (const entry of entries) {
+    const id = entry.id || entry.key;
+    if (id) {
+      seen.set(id, entry);
+    } else {
+      seen.set(`__no_id_${seen.size}`, entry);
+    }
+  }
+  return Array.from(seen.values());
+}
+
+// ADR-095 G6 — content-hash dedup. The April audit measured 5,706 entries
+// in the auto-memory store with only ~20 unique by content; 5,686 dupes
+// were the same MEMORY.md sections imported from sibling project dirs
+// with different IDs. deduplicateById can't catch these (the IDs really
+// are different); we need a content fingerprint.
+//
+// Fast non-cryptographic fingerprint — collisions on 64-bit FNV-1a are
+// vanishingly rare for human prose at the scale of an auto-memory store.
+// Whitespace-normalized so trivially-different formatting doesn't bypass dedup.
+function fingerprintContent(text) {
+  if (typeof text !== 'string' || text.length === 0) return '0';
+  const norm = text.replace(/\s+/g, ' ').trim().toLowerCase();
+  // FNV-1a 64-bit (split into 32-bit halves to stay within Number safe int)
+  let h1 = 0x811c9dc5, h2 = 0xcbf29ce4;
+  for (let i = 0; i < norm.length; i++) {
+    const c = norm.charCodeAt(i);
+    h1 ^= c; h1 = Math.imul(h1, 0x01000193) >>> 0;
+    h2 ^= c; h2 = Math.imul(h2, 0x100000001b3 & 0xffffffff) >>> 0;
+  }
+  return `${h1.toString(16)}_${h2.toString(16)}_${norm.length}`;
+}
+
+function deduplicateByContent(entries) {
+  if (!entries || !Array.isArray(entries)) return entries;
+  const seen = new Map();
+  for (const entry of entries) {
+    const content = entry.content || entry.summary || entry.value || '';
+    const fp = fingerprintContent(typeof content === 'string' ? content : JSON.stringify(content));
+    if (!seen.has(fp)) {
+      seen.set(fp, entry);
+    } else {
+      // Keep the entry with the higher accessCount or earlier createdAt
+      const existing = seen.get(fp);
+      const existingAccess = existing.accessCount || 0;
+      const candidateAccess = entry.accessCount || 0;
+      if (candidateAccess > existingAccess) seen.set(fp, entry);
+    }
+  }
+  return Array.from(seen.values());
+}
+
 // ── Session state helpers ────────────────────────────────────────────────────
 
 function sessionGet(key) {
@@ -189,14 +258,24 @@ function buildEdges(entries) {
     }
   }
 
-  // Similarity edges within categories (Jaccard > 0.3)
+  // Similarity edges within categories (Jaccard > 0.3).
+  // ADR-095 G6 perf: hoist the trigram computation outside the inner
+  // loop. Previously we re-tokenized + re-trigrammed group[j] for every
+  // i — O(n²) extra work for nothing. Now compute once per entry.
   for (const cat of Object.keys(byCategory)) {
     const group = byCategory[cat];
+    if (group.length < 2) continue;
+
+    // Cache trigram sets for every entry in the group.
+    const triCache = new Array(group.length);
     for (let i = 0; i < group.length; i++) {
-      const triA = trigrams(tokenize(group[i].content || group[i].summary || ''));
+      triCache[i] = trigrams(tokenize(group[i].content || group[i].summary || ''));
+    }
+
+    for (let i = 0; i < group.length; i++) {
+      const triA = triCache[i];
       for (let j = i + 1; j < group.length; j++) {
-        const triB = trigrams(tokenize(group[j].content || group[j].summary || ''));
-        const sim = jaccardSimilarity(triA, triB);
+        const sim = jaccardSimilarity(triA, triCache[j]);
         if (sim > 0.3) {
           edges.push({
             sourceId: group[i].id,
@@ -236,15 +315,17 @@ function bootstrapFromMemoryFiles() {
   for (const base of candidates) {
     if (!fs.existsSync(base)) continue;
 
-    // For the projects dir, scan subdirectories for memory/
+    // For the projects dir, scope to CURRENT project only (not all 51+ dirs)
     if (base.endsWith('projects')) {
       try {
-        const projectDirs = fs.readdirSync(base);
-        for (const pdir of projectDirs) {
-          const memDir = path.join(base, pdir, 'memory');
-          if (fs.existsSync(memDir)) {
-            parseMemoryDir(memDir, entries);
-          }
+        // Match Claude Code's project-dir slug: every non-alphanumeric char -> '-'
+        // (e.g. "G:\\My Drive\\TJ_Vault" -> "G--My-Drive-TJ-Vault"). The old version
+        // only handled POSIX '/', so on Windows the slug kept ':' and '\\' and never
+        // matched the real <projects>/<slug>/memory dir — bootstrap found nothing (FIX 5).
+        const projectSlug = cwd.replace(/[^a-zA-Z0-9]/g, '-');
+        const memDir = path.join(base, projectSlug, 'memory');
+        if (fs.existsSync(memDir)) {
+          parseMemoryDir(memDir, entries);
         }
       } catch { /* skip */ }
     } else if (fs.existsSync(base)) {
@@ -255,6 +336,16 @@ function bootstrapFromMemoryFiles() {
   return entries;
 }
 
+// Truncation transparency (FIX 4): mark the cut with an ellipsis and warn under
+// debug, so later reasoning isn't silently built on severed text.
+const CLIP_DEBUG = !!(process.env.RUFLO_DEBUG || process.env.DEBUG);
+function clip(text, max, label) {
+  text = text == null ? '' : String(text);
+  if (text.length <= max) return text;
+  if (CLIP_DEBUG) process.stderr.write(`[INTELLIGENCE] WARN: truncated ${label || 'value'} from ${text.length} to ${max} chars\n`);
+  return text.slice(0, max - 1) + '…';
+}
+
 function parseMemoryDir(dir, entries) {
   try {
     const files = fs.readdirSync(dir).filter(f => f.endsWith('.md'));
@@ -265,17 +356,18 @@ function parseMemoryDir(dir, entries) {
 
       // Parse markdown sections as separate entries
       const sections = content.split(/^##?\s+/m).filter(Boolean);
-      for (const section of sections) {
+      for (let sIdx = 0; sIdx < sections.length; sIdx++) {
+        const section = sections[sIdx];
         const lines = section.trim().split('\n');
         const title = lines[0].trim();
         const body = lines.slice(1).join('\n').trim();
         if (!body || body.length < 10) continue;
 
-        const id = `mem-${file.replace('.md', '')}-${title.replace(/[^a-z0-9]/gi, '-').toLowerCase().slice(0, 30)}`;
+        const id = `mem-${file.replace('.md', '')}-${title.replace(/[^a-z0-9]/gi, '-').toLowerCase().slice(0, 30)}-${sIdx}`;
         entries.push({
           id,
           key: title.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 50),
-          content: body.slice(0, 500),
+          content: clip(body, 500, 'memory content'),
           summary: title,
           namespace: file === 'MEMORY.md' ? 'core' : file.replace('.md', ''),
           type: 'semantic',
@@ -312,8 +404,27 @@ function init() {
     }
   }
 
+  // Deduplicate store entries by ID (fixes #1518 — 194MB → ~79KB)
+  let deduped = deduplicateById(store);
+  // ADR-095 G6: also dedupe by content fingerprint. The April audit
+  // measured 5,706 entries with only ~20 unique by content because the
+  // same MEMORY.md sections get imported from sibling project dirs with
+  // different IDs. deduplicateById can't catch that; deduplicateByContent
+  // can. Cuts the graph from O(n²) over near-identical duplicates down
+  // to O(unique²), which is the difference between a 100MB graph-state
+  // and a kilobytes-scale one for typical workloads.
+  const beforeContentDedup = deduped.length;
+  deduped = deduplicateByContent(deduped);
+  if (deduped.length < store.length) {
+    process.stderr.write(
+      `[INTELLIGENCE] Deduped store: ${store.length} -> ${deduped.length} entries ` +
+      `(by-id: ${store.length - beforeContentDedup} dropped, by-content: ${beforeContentDedup - deduped.length} dropped)\n`
+    );
+    writeJSON(STORE_PATH, deduped);
+  }
+
   // Skip rebuild if graph is fresh and store hasn't changed
-  if (graphState && graphState.nodeCount === store.length) {
+  if (graphState && graphState.nodeCount === deduped.length) {
     const age = Date.now() - (graphState.updatedAt || 0);
     if (age < 60000) {
       return {
@@ -324,9 +435,9 @@ function init() {
     }
   }
 
-  // Build nodes
+  // Build nodes from deduped entries
   const nodes = {};
-  for (const entry of store) {
+  for (const entry of deduped) {
     const id = entry.id || entry.key || `entry-${Math.random().toString(36).slice(2, 8)}`;
     nodes[id] = {
       id,
@@ -340,10 +451,17 @@ function init() {
   }
 
   // Build edges
-  const edges = buildEdges(store);
-
-  // Compute PageRank
-  const pageRanks = computePageRank(nodes, edges, 0.85, 30);
+  const edges = buildEdges(deduped);
+
+  // Compute PageRank (skip if graph too large — #1531)
+  const nodeCount = Object.keys(nodes).length;
+  let pageRanks = {};
+  if (nodeCount > MAX_GRAPH_NODES) {
+    process.stderr.write("[INTELLIGENCE] WARN: Graph has " + nodeCount + " nodes (>" + MAX_GRAPH_NODES + "), skipping PageRank\n");
+    for (const id of Object.keys(nodes)) pageRanks[id] = 1 / nodeCount;
+  } else {
+    pageRanks = computePageRank(nodes, edges, 0.85, 30);
+  }
 
   // Write graph state
   const graph = {
@@ -357,7 +475,7 @@ function init() {
   writeJSON(GRAPH_PATH, graph);
 
   // Build ranked context for fast lookup
-  const rankedEntries = store.map(entry => {
+  const rankedEntries = deduped.map(entry => {
     const id = entry.id;
     const content = entry.content || entry.value || '';
     const summary = entry.summary || entry.key || '';
@@ -515,11 +633,15 @@ function boostConfidence(ids, amount) {
 function consolidate() {
   ensureDataDir();
 
-  const store = readJSON(STORE_PATH);
+  let store = readJSON(STORE_PATH);
   if (!store || !Array.isArray(store)) {
     return { entries: 0, edges: 0, newEntries: 0, message: 'No store to consolidate' };
   }
 
+  // Deduplicate store entries by ID before processing (fixes #1518)
+  const preDedupCount = store.length;
+  store = deduplicateById(store);
+
   // 1. Process pending insights
   let newEntries = 0;
   if (fs.existsSync(PENDING_PATH)) {
@@ -595,8 +717,15 @@ function consolidate() {
     };
   }
 
-  // 5. Recompute PageRank
-  const pageRanks = computePageRank(nodes, edges, 0.85, 30);
+  // 5. Recompute PageRank (skip if graph too large — #1531)
+  const nodeCount = Object.keys(nodes).length;
+  let pageRanks = {};
+  if (nodeCount > MAX_GRAPH_NODES) {
+    process.stderr.write("[INTELLIGENCE] WARN: Graph has " + nodeCount + " nodes (>" + MAX_GRAPH_NODES + "), skipping PageRank in consolidate\n");
+    for (const id of Object.keys(nodes)) pageRanks[id] = 1 / nodeCount;
+  } else {
+    pageRanks = computePageRank(nodes, edges, 0.85, 30);
+  }
 
   // 6. Write updated graph
   writeJSON(GRAPH_PATH, {
@@ -636,8 +765,8 @@ function consolidate() {
     entries: rankedEntries,
   });
 
-  // 8. Persist updated store (with new insight entries)
-  if (newEntries > 0) writeJSON(STORE_PATH, store);
+  // 8. Persist updated store (deduped or with new insight entries)
+  if (newEntries > 0 || store.length < preDedupCount) writeJSON(STORE_PATH, store);
 
   // 9. Save snapshot for delta tracking
   const updatedGraph = readJSON(GRAPH_PATH);

package/.claude/helpers/post-commit

@@ -8,7 +8,7 @@ COMMIT_MSG=$(git log -1 --pretty=%B)
 echo "📊 Recording commit metrics..."
 
 # Notify claude-flow of commit
-npx --no-install ruflo hooks notify \
+npx @claude-flow/cli hooks notify \
   --message "Commit: $COMMIT_MSG" \
   --level info \
   --metadata '{"hash": "'$COMMIT_HASH'"}' 2>/dev/null || true

package/.claude/helpers/pre-commit

@@ -13,7 +13,7 @@ STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
 for FILE in $STAGED_FILES; do
   if [[ "$FILE" =~ \.(ts|js|tsx|jsx)$ ]]; then
     echo "  Validating: $FILE"
-    npx --no-install ruflo hooks pre-edit --file "$FILE" --validate-syntax 2>/dev/null || true
+    npx @claude-flow/cli hooks pre-edit --file "$FILE" --validate-syntax 2>/dev/null || true
   fi
 done
 

package/.claude/helpers/quick-start.sh

@@ -5,15 +5,15 @@ echo "🚀 Claude Flow Quick Start"
 echo "=========================="
 echo ""
 echo "1. Initialize a swarm:"
-echo "   npx ruflo swarm init --topology hierarchical"
+echo "   npx claude-flow swarm init --topology hierarchical"
 echo ""
 echo "2. Spawn agents:"
-echo "   npx ruflo agent spawn --type coder --name "API Developer""
+echo "   npx claude-flow agent spawn --type coder --name "API Developer""
 echo ""
 echo "3. Orchestrate tasks:"
-echo "   npx ruflo task orchestrate --task "Build REST API""
+echo "   npx claude-flow task orchestrate --task "Build REST API""
 echo ""
 echo "4. Monitor progress:"
-echo "   npx ruflo swarm monitor"
+echo "   npx claude-flow swarm monitor"
 echo ""
 echo "📚 For more examples, see .claude/commands/"

package/.claude/helpers/router.js

@@ -1,7 +1,16 @@
 #!/usr/bin/env node
 /**
  * Claude Flow Agent Router
- * Routes tasks to optimal agents based on learned patterns
+ *
+ * Static keyword router that suggests an agent for a task description.
+ * NOTE: This is *not* a learned model. It is a heuristic table; "confidence"
+ * is reported as a heuristic prior, not a calibrated probability.
+ *
+ * #2257 fix: patterns are now word-boundary-anchored so short tokens like
+ * `cd`, `ci`, `ui`, `add`, `structure` no longer match inside unrelated
+ * words (`decision`, `infrastructure`, `address`, `addendum`). Default
+ * confidence dropped from 0.8 to 0.6 to better reflect that this is a
+ * static heuristic, not a learned classifier.
  */
 
 const AGENT_CAPABILITIES = {
@@ -15,52 +24,82 @@ const AGENT_CAPABILITIES = {
   devops: ['ci-cd', 'docker', 'deployment', 'infrastructure'],
 };
 
-const TASK_PATTERNS = {
+// Each entry is an array of tokens. Tokens are alternation-friendly:
+//   - multi-word phrases ("unit test") match as phrases
+//   - single tokens are wrapped with \b … \b word boundaries at match time
+const TASK_PATTERNS = [
   // Code patterns
-  'implement|create|build|add|write code': 'coder',
-  'test|spec|coverage|unit test|integration': 'tester',
-  'review|audit|check|validate|security': 'reviewer',
-  'research|find|search|documentation|explore': 'researcher',
-  'design|architect|structure|plan': 'architect',
+  { tokens: ['implement', 'create', 'build', 'add', 'write code', 'refactor', 'debug'], agent: 'coder' },
+  { tokens: ['test', 'tests', 'spec', 'coverage', 'unit test', 'integration test'], agent: 'tester' },
+  { tokens: ['review', 'audit', 'check', 'validate', 'security'], agent: 'reviewer' },
+  { tokens: ['research', 'find', 'search', 'documentation', 'explore'], agent: 'researcher' },
+  { tokens: ['design', 'architect', 'architecture', 'structure', 'plan'], agent: 'architect' },
 
   // Domain patterns
-  'api|endpoint|server|backend|database': 'backend-dev',
-  'ui|frontend|component|react|css|style': 'frontend-dev',
-  'deploy|docker|ci|cd|pipeline|infrastructure': 'devops',
-};
+  { tokens: ['api', 'endpoint', 'server', 'backend', 'database'], agent: 'backend-dev' },
+  { tokens: ['ui', 'frontend', 'component', 'react', 'css', 'style'], agent: 'frontend-dev' },
+  // 'cd' / 'ci' are kept but require word boundaries via \b — they will not
+  // match inside "decision" or "specific". 'cd' as a literal command in a
+  // task description ("set up cd pipeline") still matches.
+  { tokens: ['deploy', 'docker', 'ci', 'cd', 'ci/cd', 'pipeline', 'infrastructure', 'devops'], agent: 'devops' },
+];
+
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+// Build an anchored alternation regex from a token list.
+//   - multi-word phrases (containing whitespace or '/') match literally
+//   - single tokens are wrapped with \b boundaries so 'cd' won't match "decide"
+function buildPattern(tokens) {
+  const alternatives = tokens.map((tok) => {
+    const escaped = escapeRegex(tok.toLowerCase());
+    if (/\s|\//.test(tok)) {
+      // Phrase: whitespace/'/' on each side acts as a natural boundary
+      return escaped;
+    }
+    return `\\b${escaped}\\b`;
+  });
+  return new RegExp(`(?:${alternatives.join('|')})`, 'i');
+}
+
+const COMPILED_PATTERNS = TASK_PATTERNS.map((entry) => ({
+  agent: entry.agent,
+  tokens: entry.tokens,
+  regex: buildPattern(entry.tokens),
+}));
 
 function routeTask(task) {
-  const taskLower = task.toLowerCase();
+  const taskLower = String(task ?? '').toLowerCase();
 
-  // Check patterns
-  for (const [pattern, agent] of Object.entries(TASK_PATTERNS)) {
-    const regex = new RegExp(pattern, 'i');
-    if (regex.test(taskLower)) {
+  for (const entry of COMPILED_PATTERNS) {
+    if (entry.regex.test(taskLower)) {
       return {
-        agent,
-        confidence: 0.8,
-        reason: `Matched pattern: ${pattern}`,
+        agent: entry.agent,
+        // Heuristic prior, not a learned probability — see file header.
+        confidence: 0.6,
+        reason: `Matched keyword(s) from: ${entry.tokens.join('|')}`,
       };
     }
   }
 
-  // Default to coder for unknown tasks
   return {
     agent: 'coder',
-    confidence: 0.5,
-    reason: 'Default routing - no specific pattern matched',
+    confidence: 0.3,
+    reason: 'Default routing - no specific keyword matched',
   };
 }
 
 // CLI
-const task = process.argv.slice(2).join(' ');
-
-if (task) {
-  const result = routeTask(task);
-  console.log(JSON.stringify(result, null, 2));
-} else {
-  console.log('Usage: router.js <task description>');
-  console.log('\nAvailable agents:', Object.keys(AGENT_CAPABILITIES).join(', '));
+if (require.main === module) {
+  const task = process.argv.slice(2).join(' ');
+  if (task) {
+    const result = routeTask(task);
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log('Usage: router.js <task description>');
+    console.log('\nAvailable agents:', Object.keys(AGENT_CAPABILITIES).join(', '));
+  }
 }
 
-module.exports = { routeTask, AGENT_CAPABILITIES, TASK_PATTERNS };
+module.exports = { routeTask, AGENT_CAPABILITIES, TASK_PATTERNS, buildPattern };

package/.claude/helpers/ruflo-hook.cjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+/**
+ * ruflo-hook.cjs — cross-platform Node.js port of ruflo-hook.sh (#2132)
+ *
+ * Deployed to .claude/helpers/ during ruflo init. On Windows, the
+ * generated .claude/settings.json hooks point here instead of the
+ * plugin's bash-only ruflo-hook.sh.
+ *
+ * Always exits 0 — hook subcommands are best-effort telemetry and must
+ * never block a Claude Code turn.
+ */
+
+'use strict';
+
+const { spawnSync, execSync } = require('child_process');
+const fs = require('fs');
+
+function done() { process.exit(0); }
+
+function commandExists(cmd) {
+  try {
+    const r = execSync(
+      process.platform === 'win32' ? 'where ' + cmd : 'command -v ' + cmd,
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+    );
+    return r.trim().length > 0;
+  } catch { return false; }
+}
+
+function invokeHook(bin, binArgs, hookArgs, stdinData) {
+  const args = [...binArgs, ...hookArgs];
+  const result = spawnSync(bin, args, {
+    shell: process.platform === 'win32',
+    input: stdinData || '',
+    encoding: 'utf8',
+    stdio: ['pipe', 'ignore', 'ignore'],
+    timeout: 30_000,
+  });
+  return result.status === 0;
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  if (args.length === 0) done();
+
+  const [subcommand, ...rest] = args;
+
+  let stdinData = '';
+  try { stdinData = fs.readFileSync(0, 'utf8'); } catch { stdinData = ''; }
+
+  const hookArgs = ['hooks', subcommand, ...rest];
+
+  if (commandExists('ruflo')) { invokeHook('ruflo', [], hookArgs, stdinData); done(); }
+  if (commandExists('claude-flow')) { invokeHook('claude-flow', [], hookArgs, stdinData); done(); }
+  invokeHook('npx', ['--prefer-offline', '--yes', 'ruflo@latest'], hookArgs, stdinData);
+  done();
+}
+
+main();

package/.claude/helpers/session.js

@@ -10,6 +10,20 @@ const path = require('path');
 const SESSION_DIR = path.join(process.cwd(), '.claude-flow', 'sessions');
 const SESSION_FILE = path.join(SESSION_DIR, 'current.json');
 
+// #2307: Atomic write — serialize to a per-process temp file, then rename()
+// into place. rename() is atomic on the same filesystem, so concurrent writers
+// (session-restore, metric, daemon workers, teammates) can't interleave partial
+// content. Without this, two non-atomic writeFileSync calls can race so that a
+// shorter payload overwrites a longer one in place, leaving the longer payload's
+// tail dangling past the end (valid JSON + trailing garbage = parse error).
+// Temp name includes process.pid so concurrent writers don't collide on it.
+// Same class as #1707 (metrics) / #1637 (daemon-state) — session.js was missed.
+function atomicWrite(file, data) {
+  const tmp = `${file}.tmp.${process.pid}`;
+  fs.writeFileSync(tmp, data);
+  fs.renameSync(tmp, file);
+}
+
 const commands = {
   start: () => {
     const sessionId = `session-${Date.now()}`;
@@ -27,7 +41,7 @@ const commands = {
     };
 
     fs.mkdirSync(SESSION_DIR, { recursive: true });
-    fs.writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2));
+    atomicWrite(SESSION_FILE, JSON.stringify(session, null, 2));
 
     console.log(`Session started: ${sessionId}`);
     return session;
@@ -39,9 +53,17 @@ const commands = {
       return null;
     }
 
-    const session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf-8'));
+    let session;
+    try {
+      session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf-8'));
+    } catch (e) {
+      // #2307: corrupted session file (e.g. from a pre-atomic-write race).
+      // Don't throw — start a fresh session so the hook recovers cleanly.
+      console.log(`Session file corrupted (${e.message}); starting fresh`);
+      return commands.start();
+    }
     session.restoredAt = new Date().toISOString();
-    fs.writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2));
+    atomicWrite(SESSION_FILE, JSON.stringify(session, null, 2));
 
     console.log(`Session restored: ${session.id}`);
     return session;
@@ -59,7 +81,7 @@ const commands = {
 
     // Archive session
     const archivePath = path.join(SESSION_DIR, `${session.id}.json`);
-    fs.writeFileSync(archivePath, JSON.stringify(session, null, 2));
+    atomicWrite(archivePath, JSON.stringify(session, null, 2));
     fs.unlinkSync(SESSION_FILE);
 
     console.log(`Session ended: ${session.id}`);
@@ -95,7 +117,7 @@ const commands = {
     const session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf-8'));
     session.context[key] = value;
     session.updatedAt = new Date().toISOString();
-    fs.writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2));
+    atomicWrite(SESSION_FILE, JSON.stringify(session, null, 2));
 
     return session;
   },
@@ -116,7 +138,7 @@ const commands = {
     const session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf-8'));
     if (session.metrics[name] !== undefined) {
       session.metrics[name]++;
-      fs.writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2));
+      atomicWrite(SESSION_FILE, JSON.stringify(session, null, 2));
     }
 
     return session;

package/.claude/helpers/setup-mcp.sh

@@ -11,8 +11,8 @@ if ! command -v claude &> /dev/null; then
 fi
 
 # Add MCP server
-echo "📦 Adding ruflo MCP server..."
-claude mcp add ruflo npx ruflo mcp start
+echo "📦 Adding Claude Flow MCP server..."
+claude mcp add claude-flow npx claude-flow mcp start
 
 echo "✅ MCP server setup complete!"
-echo "🎯 You can now use mcp__ruflo__ tools in Claude Code"
+echo "🎯 You can now use mcp__claude-flow__ tools in Claude Code"