claude-flow 3.16.0 → 3.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.16.0",
+  "version": "3.16.1",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/daemon.js

@@ -98,14 +98,26 @@ const startCommand = {
         // dedup is process-atomic. Lock holder gets to spawn; competing callers
         // see EEXIST, wait briefly, then re-read the PID file (which the holder
         // has now written), and return "already running" cleanly.
+        // #2484 — previously the lockfile was released BEFORE startBackgroundDaemon
+        // ran, opening a race window where a concurrent caller could see no lock
+        // AND no PID file (PID hadn't been written yet) and proceed to fork ITS
+        // OWN background daemon. EDortta reported 4 identical daemons per Claude
+        // Code session on v3.10.37 under exactly this pattern (MCP startup
+        // racing with a sibling invocation).
+        //
+        // Fix: hold the lock across the entire spawn lifecycle (dedup check →
+        // killStaleDaemons → fork → PID file write), so the lock-loser ALWAYS
+        // sees either a live lock or a populated PID file, never the empty
+        // window in between.
+        let lockFd = null;
+        let lockFile = '';
         if (!isDaemonProcess) {
             const stateDir = join(resolve(projectRoot), '.claude-flow');
-            const lockFile = join(stateDir, 'daemon.lock');
+            lockFile = join(stateDir, 'daemon.lock');
             try {
                 fs.mkdirSync(stateDir, { recursive: true });
             }
             catch { /* exists */ }
-            let lockFd = null;
             try {
                 lockFd = fs.openSync(lockFile, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
                 fs.writeSync(lockFd, String(process.pid));
@@ -139,22 +151,33 @@ const startCommand = {
                     throw e;
                 }
             }
+            // Dedup check while holding the lock.
             try {
                 const bgPid = getBackgroundDaemonPid(projectRoot);
                 if (bgPid && isProcessRunning(bgPid)) {
                     if (!quiet) {
                         output.printWarning(`Daemon already running in background (PID: ${bgPid}). Stop it first with: daemon stop`);
                     }
+                    // Release the lock on the early-return path.
+                    if (lockFd !== null) {
+                        try {
+                            fs.closeSync(lockFd);
+                        }
+                        catch { /* ignore */ }
+                        try {
+                            fs.unlinkSync(lockFile);
+                        }
+                        catch { /* ignore */ }
+                    }
                     return { success: true };
                 }
                 // #1551: Kill any stale daemon processes that weren't tracked by PID file
                 await killStaleDaemons(projectRoot, quiet);
             }
-            finally {
-                // Release the lock so the lock-loser can re-check (or the next
-                // legitimate invocation can spawn). startBackgroundDaemon below
-                // writes the PID file synchronously before returning so the
-                // post-release re-check finds it.
+            catch (e) {
+                // Anything that throws here MUST still release the lock before
+                // rethrowing so we don't leave the lockfile behind for future
+                // invocations to wait on for 5s before recovering.
                 if (lockFd !== null) {
                     try {
                         fs.closeSync(lockFd);
@@ -164,23 +187,58 @@ const startCommand = {
                         fs.unlinkSync(lockFile);
                     }
                     catch { /* ignore */ }
+                    lockFd = null;
                 }
+                throw e;
             }
         }
-        // Background mode (default): fork a detached process.
+        // Background mode (default): fork a detached process. The lock (if held)
+        // is released AFTER startBackgroundDaemon's PID file write completes —
+        // see the cleanup inside startBackgroundDaemon's caller path below.
         // #1968: previously only forwarded resource thresholds — `--workers`,
         // `--headless`, and `--sandbox` were dropped on the floor when the
         // launcher forked the foreground child, so `daemon start --workers map`
         // got the full default worker set instead.
         if (!foreground) {
-            return startBackgroundDaemon(projectRoot, quiet, {
-                maxCpuLoad: rawMaxCpu,
-                minFreeMemory: rawMinMem,
-                workers: ctx.flags.workers,
-                headless: ctx.flags.headless,
-                sandbox: ctx.flags.sandbox,
-                ttl: rawTtl,
-            });
+            try {
+                return await startBackgroundDaemon(projectRoot, quiet, {
+                    maxCpuLoad: rawMaxCpu,
+                    minFreeMemory: rawMinMem,
+                    workers: ctx.flags.workers,
+                    headless: ctx.flags.headless,
+                    sandbox: ctx.flags.sandbox,
+                    ttl: rawTtl,
+                });
+            }
+            finally {
+                // Release the lock NOW — startBackgroundDaemon has either written
+                // the PID file (success path) or thrown (in which case the next
+                // caller's killStaleDaemons sweep handles the orphan).
+                if (lockFd !== null) {
+                    try {
+                        fs.closeSync(lockFd);
+                    }
+                    catch { /* ignore */ }
+                    try {
+                        fs.unlinkSync(lockFile);
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+        }
+        // Foreground path: release the lock before we start the (potentially
+        // long-running) foreground daemon so other callers can dedup against
+        // our PID file (foreground writes its own PID).
+        if (lockFd !== null) {
+            try {
+                fs.closeSync(lockFd);
+            }
+            catch { /* ignore */ }
+            try {
+                fs.unlinkSync(lockFile);
+            }
+            catch { /* ignore */ }
+            lockFd = null;
         }
         // Foreground mode: run in current process (blocks terminal)
         try {

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.16.0",
+  "version": "3.16.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",