agentic-qe 3.14.6 → 3.14.8

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.38.12
+3.51.1

package/.claude/helpers/auto-memory-hook.mjs

@@ -12,12 +12,21 @@
  */
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { join, dirname } from 'path';
+import { join, dirname, resolve } from 'path';
 import { fileURLToPath } from 'url';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
-const PROJECT_ROOT = join(__dirname, '../..');
+// Executable modules resolve only from the helper's own install root. A
+// home-level helper can serve an untrusted project, so CLAUDE_PROJECT_DIR must
+// never decide which JavaScript gets imported.
+const MODULE_ROOT = join(__dirname, '../..');
+// Home-level helpers can serve a different project. Keep the memory writer on
+// the same project root as intelligence.cjs, which reads CLAUDE_PROJECT_DIR.
+// PROJECT_ROOT is for data only.
+const PROJECT_ROOT = process.env.CLAUDE_PROJECT_DIR
+  ? resolve(process.env.CLAUDE_PROJECT_DIR)
+  : MODULE_ROOT;
 const DATA_DIR = join(PROJECT_ROOT, '.claude-flow', 'data');
 const STORE_PATH = join(DATA_DIR, 'auto-memory-store.json');
 
@@ -37,7 +46,7 @@ const dim = (msg) => console.log(`  ${DIM}${msg}${RESET}`);
 // told exactly how to fix it (on both stdout, so it shows in the Claude Code hook
 // transcript, and stderr, per the issue's requested channel).
 function warnMemoryUnavailable() {
-  const line1 = `[AutoMemory] @claude-flow/memory not resolvable from ${PROJECT_ROOT} — self-learning imports are DISABLED.`;
+  const line1 = `[AutoMemory] @claude-flow/memory not resolvable from ${MODULE_ROOT} — self-learning imports are DISABLED.`;
   const line2 = '             Fix: npm i -D @claude-flow/memory   (or re-run: npx ruflo@latest init, then npx ruflo@latest doctor --fix)';
   console.log(`${YELLOW}${line1}${RESET}`);
   console.log(`${YELLOW}${line2}${RESET}`);
@@ -171,7 +180,7 @@ async function loadMemoryPackage() {
   // project — so init resolves it from the CLI's own context and records the
   // absolute path here. This is the only strategy that works on that install.
   try {
-    const sidecar = join(PROJECT_ROOT, '.claude-flow', 'memory-package.json');
+    const sidecar = join(MODULE_ROOT, '.claude-flow', 'memory-package.json');
     if (existsSync(sidecar)) {
       const rec = JSON.parse(readFileSync(sidecar, 'utf-8'));
       if (rec?.distPath && existsSync(rec.distPath)) {
@@ -181,7 +190,7 @@ async function loadMemoryPackage() {
   } catch { /* fall through */ }
 
   // Strategy 1: Local dev (built dist)
-  const localDist = join(PROJECT_ROOT, 'v3/@claude-flow/memory/dist/index.js');
+  const localDist = join(MODULE_ROOT, 'v3/@claude-flow/memory/dist/index.js');
   if (existsSync(localDist)) {
     try {
       return await import(`file://${localDist}`);
@@ -192,7 +201,7 @@ async function loadMemoryPackage() {
   // when installed as a transitive dependency via npx ruflo / npx @claude-flow/cli@latest)
   try {
     const { createRequire } = await import('module');
-    const require = createRequire(join(PROJECT_ROOT, 'package.json'));
+    const require = createRequire(join(MODULE_ROOT, 'package.json'));
     return require('@claude-flow/memory');
   } catch { /* fall through */ }
 
@@ -201,8 +210,8 @@ async function loadMemoryPackage() {
     return await import('@claude-flow/memory');
   } catch { /* fall through */ }
 
-  // Strategy 4: Walk up from PROJECT_ROOT looking for @claude-flow/memory in any node_modules
-  let searchDir = PROJECT_ROOT;
+  // Strategy 4: Walk up from MODULE_ROOT looking for @claude-flow/memory in any node_modules
+  let searchDir = MODULE_ROOT;
   const { parse } = await import('path');
   while (searchDir !== parse(searchDir).root) {
     const candidate = join(searchDir, 'node_modules', '@claude-flow', 'memory', 'dist', 'index.js');
@@ -374,7 +383,7 @@ async function doStatus() {
   const memPkg = await loadMemoryPackage();
   const config = readConfig();
 
-  const sidecar = join(PROJECT_ROOT, '.claude-flow', 'memory-package.json');
+  const sidecar = join(MODULE_ROOT, '.claude-flow', 'memory-package.json');
   const hasSidecar = existsSync(sidecar);
 
   console.log('\n=== Auto Memory Bridge Status ===\n');

package/.claude/helpers/helpers.manifest.json

@@ -1,13 +1,14 @@
 {
   "manifest": {
-    "version": "3.38.12",
+    "version": "3.51.1",
     "files": {
-      "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
-      "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
+      "auto-memory-hook.mjs": "c8d218526a3c34034c2a69de23f507f0eb0f70d59c16426a8edc849e6ac22529",
+      "hook-handler.cjs": "fbd827dfac52e48ea1a576a4484826b6570c0fa710ca4c28faad63b003ac1274",
       "intelligence.cjs": "30e42ed7ec4ca5a94ac54fdb1330d2d47ac5f3fdeeef207753574723a9e77b5c",
-      "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
+      "statusline.cjs": "4a48353b4f1566fa4379b00fd0321b6676a22b6cc91fbbd8380ac5183d619468",
+      "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "8JINtA8uubiBqNQbsz8OL2fcc4xmKGk6gKPGoa1ib7/21nYDaYWiWrZB/4xli8AGUdmQuMS9GT6ANbpPjqAcCw==",
+  "signature": "D+NMHUsWriB+ZO/yQdOlrw4daC5sNvZxsDDxF7Y82SruJc7xd4icePgaDDntBVOq/znDpFZUCqqiUYX7sy0uCw==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -232,9 +232,9 @@ function safeRequire(modulePath) {
   return null;
 }
 
-const router = safeRequire(path.join(helpersDir, 'router.js'));
-const session = safeRequire(path.join(helpersDir, 'session.js'));
-const memory = safeRequire(path.join(helpersDir, 'memory.js'));
+const router = safeRequire(path.join(helpersDir, 'router.cjs'));
+const session = safeRequire(path.join(helpersDir, 'session.cjs'));
+const memory = safeRequire(path.join(helpersDir, 'memory.cjs'));
 const intelligence = safeRequire(path.join(helpersDir, 'intelligence.cjs'));
 
 // ── Intelligence timeout protection (fixes #1530, #1531) ───────────────────
@@ -286,6 +286,17 @@ async function readStdin() {
   });
 }
 
+// ADR-404: the ruflo mod (plugins/ruflo-mods) runs these events in-process
+// inside Claude Code and sets RUFLO_MODS_OWNS on the process, which every hook
+// started after inherits. An event named there is the mod's; returning here
+// keeps it from firing twice. Only side-effect events can be handed over:
+// guards such as pre-bash always run, whatever the variable says.
+const MOD_OWNABLE_EVENTS = new Set(['route', 'post-edit']);
+function ownedByMod(cmd, env = process.env) {
+  if (!MOD_OWNABLE_EVENTS.has(cmd)) return false;
+  return String(env.RUFLO_MODS_OWNS || '').split(',').some((owned) => owned.trim() === cmd);
+}
+
 function claimSideEffectEvent(family, stdinData, event) {
   if (/^(1|true|yes|on)$/i.test(process.env.RUFLO_DISABLE_HOOK_DEDUP || '')) return true;
   try {
@@ -312,6 +323,8 @@ function claimSideEffectEvent(family, stdinData, event) {
 }
 
 async function main() {
+  if (ownedByMod(command)) return;
+
   // Global safety timeout: hooks must NEVER hang (#1530, #1531)
   const safetyTimer = setTimeout(() => {
     process.stderr.write("[WARN] Hook handler global timeout (5s), forcing exit\n");
@@ -452,7 +465,8 @@ const handlers = {
     for (const d of dangerous) {
       if (cmd.includes(d)) {
         console.error(`[BLOCKED] Dangerous command detected: ${d}`);
-        process.exit(1);
+        // Claude Code PreToolUse: exit 2 blocks execution; exit 1 is non-blocking.
+        process.exit(2);
       }
     }
     console.log('[OK] Command validated');
@@ -585,11 +599,25 @@ const handlers = {
   }
 }
 
-// Hooks must ALWAYS exit 0 — Claude Code treats non-zero as "hook error"
-// and skips all subsequent hooks for the event.
-process.exitCode = 0;
-main().catch((e) => {
-  try { console.log(`[WARN] Hook handler error: ${e.message}`); } catch (_) {}
-}).finally(() => {
-  process.exit(0);
-});
+// Non-blocking hooks exit 0; pre-bash denials exit 2 to block PreToolUse.
+// A denial exits immediately, before the normal completion path below.
+//
+// Only dispatch when run directly (node hook-handler.cjs <cmd>). When
+// require()'d by a test, expose the internals instead of reading stdin and
+// calling process.exit — the 2026-06-15 fix (cb1e93e8d) added this guard and
+// the exports for tests/hook-handler-runwithtimeout.test.cjs; the 2026-07-04
+// helper sync (a5f86ad0a) dropped both, so the test died with
+// "runWithTimeout is not a function" once the Test Suite job ran again.
+if (require.main === module) {
+  process.exitCode = 0;
+  main().catch((e) => {
+    try { console.log(`[WARN] Hook handler error: ${e.message}`); } catch (_) {}
+  }).finally(() => {
+    process.exit(0);
+  });
+}
+
+// Which sibling helpers loaded (all CommonJS, shipped as .cjs — #3555).
+const loadedHelpers = { router: !!router, session: !!session, memory: !!memory, intelligence: !!intelligence };
+
+module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS };

package/.claude/helpers/memory.cjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+/**
+ * Ruflo Memory Helper
+ * Simple key-value memory for cross-session context
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const MEMORY_DIR = path.join(process.cwd(), '.claude-flow', 'data');
+const MEMORY_FILE = path.join(MEMORY_DIR, 'memory.json');
+
+function loadMemory() {
+  try {
+    if (fs.existsSync(MEMORY_FILE)) {
+      return JSON.parse(fs.readFileSync(MEMORY_FILE, 'utf-8'));
+    }
+  } catch (e) {
+    // Ignore
+  }
+  return {};
+}
+
+function saveMemory(memory) {
+  fs.mkdirSync(MEMORY_DIR, { recursive: true });
+  fs.writeFileSync(MEMORY_FILE, JSON.stringify(memory, null, 2));
+}
+
+const commands = {
+  get: (key) => {
+    const memory = loadMemory();
+    const value = key ? memory[key] : memory;
+    console.log(JSON.stringify(value, null, 2));
+    return value;
+  },
+
+  set: (key, value) => {
+    if (!key) {
+      console.error('Key required');
+      return;
+    }
+    const memory = loadMemory();
+    memory[key] = value;
+    memory._updated = new Date().toISOString();
+    saveMemory(memory);
+    console.log(`Set: ${key}`);
+  },
+
+  delete: (key) => {
+    if (!key) {
+      console.error('Key required');
+      return;
+    }
+    const memory = loadMemory();
+    delete memory[key];
+    saveMemory(memory);
+    console.log(`Deleted: ${key}`);
+  },
+
+  clear: () => {
+    saveMemory({});
+    console.log('Memory cleared');
+  },
+
+  keys: () => {
+    const memory = loadMemory();
+    const keys = Object.keys(memory).filter(k => !k.startsWith('_'));
+    console.log(keys.join('\n'));
+    return keys;
+  },
+};
+
+// CLI — only when run directly, never when require()d by hook-handler.cjs
+// (local patch, agentic-qe#837: it used to dispatch on the caller's argv).
+if (require.main === module) {
+  const [,, command, key, ...valueParts] = process.argv;
+  const value = valueParts.join(' ');
+
+  if (command && commands[command]) {
+    commands[command](key, value);
+  } else {
+    console.log('Usage: memory.cjs <get|set|delete|clear|keys> [key] [value]');
+  }
+}
+
+module.exports = commands;

package/.claude/helpers/router.cjs

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+/**
+ * Claude Flow Agent Router
+ *
+ * Static keyword router that suggests an agent for a task description.
+ * NOTE: This is *not* a learned model. It is a heuristic table; "confidence"
+ * is reported as a heuristic prior, not a calibrated probability.
+ *
+ * #2257 fix: patterns are now word-boundary-anchored so short tokens like
+ * `cd`, `ci`, `ui`, `add`, `structure` no longer match inside unrelated
+ * words (`decision`, `infrastructure`, `address`, `addendum`). Default
+ * confidence dropped from 0.8 to 0.6 to better reflect that this is a
+ * static heuristic, not a learned classifier.
+ */
+
+const AGENT_CAPABILITIES = {
+  coder: ['code-generation', 'refactoring', 'debugging', 'implementation'],
+  tester: ['unit-testing', 'integration-testing', 'coverage', 'test-generation'],
+  reviewer: ['code-review', 'security-audit', 'quality-check', 'best-practices'],
+  researcher: ['web-search', 'documentation', 'analysis', 'summarization'],
+  architect: ['system-design', 'architecture', 'patterns', 'scalability'],
+  'backend-dev': ['api', 'database', 'server', 'authentication'],
+  'frontend-dev': ['ui', 'react', 'css', 'components'],
+  devops: ['ci-cd', 'docker', 'deployment', 'infrastructure'],
+};
+
+// Each entry is an array of tokens. Tokens are alternation-friendly:
+//   - multi-word phrases ("unit test") match as phrases
+//   - single tokens are wrapped with \b … \b word boundaries at match time
+const TASK_PATTERNS = [
+  // Code patterns
+  { tokens: ['implement', 'create', 'build', 'add', 'write code', 'refactor', 'debug'], agent: 'coder' },
+  { tokens: ['test', 'tests', 'testing', 'spec', 'specs', 'coverage', 'unit test', 'integration test'], agent: 'tester' },
+  { tokens: ['review', 'audit', 'check', 'validate', 'security'], agent: 'reviewer' },
+  { tokens: ['research', 'find', 'search', 'documentation', 'explore'], agent: 'researcher' },
+  { tokens: ['design', 'architect', 'architecture', 'structure', 'plan'], agent: 'architect' },
+
+  // Domain patterns
+  { tokens: ['api', 'endpoint', 'server', 'backend', 'database'], agent: 'backend-dev' },
+  { tokens: ['ui', 'frontend', 'component', 'react', 'css', 'style'], agent: 'frontend-dev' },
+  // 'cd' / 'ci' are kept but require word boundaries via \b — they will not
+  // match inside "decision" or "specific". 'cd' as a literal command in a
+  // task description ("set up cd pipeline") still matches.
+  { tokens: ['deploy', 'docker', 'ci', 'cd', 'ci/cd', 'pipeline', 'infrastructure', 'devops'], agent: 'devops' },
+];
+
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+// Build an anchored alternation regex from a token list.
+//   - multi-word phrases (containing whitespace or '/') match literally
+//   - single tokens are wrapped with \b boundaries so 'cd' won't match "decide"
+function buildPattern(tokens) {
+  const alternatives = tokens.map((tok) => {
+    const escaped = escapeRegex(tok.toLowerCase());
+    if (/\s|\//.test(tok)) {
+      // Phrase: whitespace/'/' on each side acts as a natural boundary
+      return escaped;
+    }
+    return `\\b${escaped}\\b`;
+  });
+  return new RegExp(`(?:${alternatives.join('|')})`, 'i');
+}
+
+const COMPILED_PATTERNS = TASK_PATTERNS.map((entry) => ({
+  agent: entry.agent,
+  tokens: entry.tokens,
+  regex: buildPattern(entry.tokens),
+}));
+
+function routeTask(task) {
+  const taskLower = String(task ?? '').toLowerCase();
+
+  for (const entry of COMPILED_PATTERNS) {
+    if (entry.regex.test(taskLower)) {
+      return {
+        agent: entry.agent,
+        // Heuristic prior, not a learned probability — see file header.
+        confidence: 0.6,
+        reason: `Matched keyword(s) from: ${entry.tokens.join('|')}`,
+      };
+    }
+  }
+
+  return {
+    agent: 'coder',
+    confidence: 0.3,
+    reason: 'Default routing - no specific keyword matched',
+  };
+}
+
+// CLI
+if (require.main === module) {
+  const task = process.argv.slice(2).join(' ');
+  if (task) {
+    const result = routeTask(task);
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log('Usage: router.cjs <task description>');
+    console.log('\nAvailable agents:', Object.keys(AGENT_CAPABILITIES).join(', '));
+  }
+}
+
+module.exports = { routeTask, AGENT_CAPABILITIES, TASK_PATTERNS, buildPattern };

package/.claude/helpers/session.cjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+/**
+ * Ruflo Session Manager
+ * Handles session lifecycle: start, restore, end
+ *
+ * Local patch (agentic-qe#837): current.json lives in the opened project and
+ * is untrusted. Its contents must never decide where this helper writes, so
+ * the archive name is validated, symlinks are never written through, and the
+ * session directory must resolve inside the project.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const SESSION_DIR = path.join(process.cwd(), '.claude-flow', 'sessions');
+const SESSION_FILE = path.join(SESSION_DIR, 'current.json');
+const SESSION_ID = /^session-\d+$/;
+
+/** Read current.json; a symlink, non-file or corrupt JSON counts as no session. */
+function readSession() {
+  let stat;
+  try { stat = fs.lstatSync(SESSION_FILE); } catch { return null; }
+  if (!stat.isFile()) return null;
+  try {
+    const session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf-8'));
+    return session && typeof session === 'object' ? session : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The session directory must resolve inside the project (no symlinked escape). */
+function assertSessionDirContained() {
+  const root = fs.realpathSync(process.cwd());
+  const relative = path.relative(root, fs.realpathSync(SESSION_DIR));
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error('Session directory resolves outside the project');
+  }
+}
+
+/** Write via an exclusive temp file and rename, which replaces a symlink instead of following it. */
+function writeFile(file, data) {
+  assertSessionDirContained();
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tmp, data, { flag: 'wx' });
+  fs.renameSync(tmp, file);
+}
+
+const commands = {
+  start: () => {
+    const sessionId = `session-${Date.now()}`;
+    const session = {
+      id: sessionId,
+      startedAt: new Date().toISOString(),
+      cwd: process.cwd(),
+      context: {},
+      metrics: {
+        edits: 0,
+        commands: 0,
+        tasks: 0,
+        errors: 0,
+      },
+    };
+
+    fs.mkdirSync(SESSION_DIR, { recursive: true });
+    writeFile(SESSION_FILE, JSON.stringify(session, null, 2));
+
+    console.log(`Session started: ${sessionId}`);
+    return session;
+  },
+
+  restore: () => {
+    const session = readSession();
+    if (!session) {
+      console.log('No session to restore');
+      return null;
+    }
+
+    session.restoredAt = new Date().toISOString();
+    writeFile(SESSION_FILE, JSON.stringify(session, null, 2));
+
+    console.log(`Session restored: ${session.id}`);
+    return session;
+  },
+
+  end: () => {
+    const session = readSession();
+    if (!session) {
+      console.log('No active session');
+      return null;
+    }
+
+    session.endedAt = new Date().toISOString();
+    session.duration = Date.now() - new Date(session.startedAt).getTime();
+
+    // Archive session under a validated name only; a crafted id cannot pick the path.
+    const archiveId = SESSION_ID.test(String(session.id)) ? session.id : `session-${Date.now()}`;
+    writeFile(path.join(SESSION_DIR, `${archiveId}.json`), JSON.stringify(session, null, 2));
+    fs.unlinkSync(SESSION_FILE);
+
+    console.log(`Session ended: ${archiveId}`);
+    console.log(`Duration: ${Math.round(session.duration / 1000 / 60)} minutes`);
+    console.log(`Metrics: ${JSON.stringify(session.metrics)}`);
+
+    return session;
+  },
+
+  status: () => {
+    const session = readSession();
+    if (!session) {
+      console.log('No active session');
+      return null;
+    }
+
+    const duration = Date.now() - new Date(session.startedAt).getTime();
+
+    console.log(`Session: ${session.id}`);
+    console.log(`Started: ${session.startedAt}`);
+    console.log(`Duration: ${Math.round(duration / 1000 / 60)} minutes`);
+    console.log(`Metrics: ${JSON.stringify(session.metrics)}`);
+
+    return session;
+  },
+
+  update: (key, value) => {
+    const session = readSession();
+    if (!session) {
+      console.log('No active session');
+      return null;
+    }
+
+    if (!session.context || typeof session.context !== 'object') session.context = {};
+    session.context[key] = value;
+    session.updatedAt = new Date().toISOString();
+    writeFile(SESSION_FILE, JSON.stringify(session, null, 2));
+
+    return session;
+  },
+
+  metric: (name) => {
+    const session = readSession();
+    if (!session) {
+      return null;
+    }
+
+    if (session.metrics && typeof session.metrics[name] === 'number') {
+      session.metrics[name]++;
+      writeFile(SESSION_FILE, JSON.stringify(session, null, 2));
+    }
+
+    return session;
+  },
+};
+
+// CLI — only when run directly, never when require()d by hook-handler.cjs.
+if (require.main === module) {
+  const [,, command, ...args] = process.argv;
+
+  if (command && commands[command]) {
+    commands[command](...args);
+  } else {
+    console.log('Usage: session.cjs <start|restore|end|status|update|metric> [args]');
+  }
+}
+
+module.exports = commands;