claude-flow 3.16.0 → 3.16.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.16.0",
+  "version": "3.16.2",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",
@@ -81,14 +81,14 @@
   "overrides": {
     "ruvector": "^0.2.27",
     "better-sqlite3": ">=12.8.0",
-    "hono": ">=4.11.4",
+    "hono": ">=4.12.25",
     "@ruvector/rvf-wasm": "0.1.5",
-    "@hono/node-server": ">=1.19.10",
+    "@hono/node-server": ">=1.19.14",
     "flatted": ">=3.4.0",
     "tar": ">=7.5.11",
     "picomatch": ">=4.0.3",
     "path-to-regexp": ">=8.2.1",
-    "undici": ">=7.18.0",
+    "undici": ">=8.5.0",
     "minimatch": ">=10.0.0",
     "@isaacs/brace-expansion": ">=5.0.1",
     "cacache": ">=20.0.0",
@@ -106,8 +106,11 @@
     "@opentelemetry/exporter-prometheus": ">=0.217.0",
     "axios": ">=1.13.2",
     "fast-uri": ">=3.1.0",
-    "vite": ">=6.4.6",
-    "ws": ">=8.21.0"
+    "vite": ">=8.0.16",
+    "ws": ">=8.21.0",
+    "@grpc/grpc-js": ">=1.14.4",
+    "form-data": ">=4.0.6",
+    "http-proxy-middleware": ">=3.0.7"
   },
   "devDependencies": {
     "@openai/codex": "^0.98.0",
@@ -116,7 +119,7 @@
     "eslint": "^8.0.0",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "vitest": "^1.0.0"
+    "vitest": "^3.2.6"
   },
   "engines": {
     "node": ">=20.0.0"

package/v3/@claude-flow/cli/dist/src/commands/daemon.js

@@ -98,14 +98,26 @@ const startCommand = {
         // dedup is process-atomic. Lock holder gets to spawn; competing callers
         // see EEXIST, wait briefly, then re-read the PID file (which the holder
         // has now written), and return "already running" cleanly.
+        // #2484 — previously the lockfile was released BEFORE startBackgroundDaemon
+        // ran, opening a race window where a concurrent caller could see no lock
+        // AND no PID file (PID hadn't been written yet) and proceed to fork ITS
+        // OWN background daemon. EDortta reported 4 identical daemons per Claude
+        // Code session on v3.10.37 under exactly this pattern (MCP startup
+        // racing with a sibling invocation).
+        //
+        // Fix: hold the lock across the entire spawn lifecycle (dedup check →
+        // killStaleDaemons → fork → PID file write), so the lock-loser ALWAYS
+        // sees either a live lock or a populated PID file, never the empty
+        // window in between.
+        let lockFd = null;
+        let lockFile = '';
         if (!isDaemonProcess) {
             const stateDir = join(resolve(projectRoot), '.claude-flow');
-            const lockFile = join(stateDir, 'daemon.lock');
+            lockFile = join(stateDir, 'daemon.lock');
             try {
                 fs.mkdirSync(stateDir, { recursive: true });
             }
             catch { /* exists */ }
-            let lockFd = null;
             try {
                 lockFd = fs.openSync(lockFile, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
                 fs.writeSync(lockFd, String(process.pid));
@@ -139,22 +151,33 @@ const startCommand = {
                     throw e;
                 }
             }
+            // Dedup check while holding the lock.
             try {
                 const bgPid = getBackgroundDaemonPid(projectRoot);
                 if (bgPid && isProcessRunning(bgPid)) {
                     if (!quiet) {
                         output.printWarning(`Daemon already running in background (PID: ${bgPid}). Stop it first with: daemon stop`);
                     }
+                    // Release the lock on the early-return path.
+                    if (lockFd !== null) {
+                        try {
+                            fs.closeSync(lockFd);
+                        }
+                        catch { /* ignore */ }
+                        try {
+                            fs.unlinkSync(lockFile);
+                        }
+                        catch { /* ignore */ }
+                    }
                     return { success: true };
                 }
                 // #1551: Kill any stale daemon processes that weren't tracked by PID file
                 await killStaleDaemons(projectRoot, quiet);
             }
-            finally {
-                // Release the lock so the lock-loser can re-check (or the next
-                // legitimate invocation can spawn). startBackgroundDaemon below
-                // writes the PID file synchronously before returning so the
-                // post-release re-check finds it.
+            catch (e) {
+                // Anything that throws here MUST still release the lock before
+                // rethrowing so we don't leave the lockfile behind for future
+                // invocations to wait on for 5s before recovering.
                 if (lockFd !== null) {
                     try {
                         fs.closeSync(lockFd);
@@ -164,23 +187,58 @@ const startCommand = {
                         fs.unlinkSync(lockFile);
                     }
                     catch { /* ignore */ }
+                    lockFd = null;
                 }
+                throw e;
             }
         }
-        // Background mode (default): fork a detached process.
+        // Background mode (default): fork a detached process. The lock (if held)
+        // is released AFTER startBackgroundDaemon's PID file write completes —
+        // see the cleanup inside startBackgroundDaemon's caller path below.
         // #1968: previously only forwarded resource thresholds — `--workers`,
         // `--headless`, and `--sandbox` were dropped on the floor when the
         // launcher forked the foreground child, so `daemon start --workers map`
         // got the full default worker set instead.
         if (!foreground) {
-            return startBackgroundDaemon(projectRoot, quiet, {
-                maxCpuLoad: rawMaxCpu,
-                minFreeMemory: rawMinMem,
-                workers: ctx.flags.workers,
-                headless: ctx.flags.headless,
-                sandbox: ctx.flags.sandbox,
-                ttl: rawTtl,
-            });
+            try {
+                return await startBackgroundDaemon(projectRoot, quiet, {
+                    maxCpuLoad: rawMaxCpu,
+                    minFreeMemory: rawMinMem,
+                    workers: ctx.flags.workers,
+                    headless: ctx.flags.headless,
+                    sandbox: ctx.flags.sandbox,
+                    ttl: rawTtl,
+                });
+            }
+            finally {
+                // Release the lock NOW — startBackgroundDaemon has either written
+                // the PID file (success path) or thrown (in which case the next
+                // caller's killStaleDaemons sweep handles the orphan).
+                if (lockFd !== null) {
+                    try {
+                        fs.closeSync(lockFd);
+                    }
+                    catch { /* ignore */ }
+                    try {
+                        fs.unlinkSync(lockFile);
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+        }
+        // Foreground path: release the lock before we start the (potentially
+        // long-running) foreground daemon so other callers can dedup against
+        // our PID file (foreground writes its own PID).
+        if (lockFd !== null) {
+            try {
+                fs.closeSync(lockFd);
+            }
+            catch { /* ignore */ }
+            try {
+                fs.unlinkSync(lockFile);
+            }
+            catch { /* ignore */ }
+            lockFd = null;
         }
         // Foreground mode: run in current process (blocks terminal)
         try {

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.16.0",
+  "version": "3.16.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -93,7 +93,7 @@
   },
   "devDependencies": {
     "typescript": "^5.3.0",
-    "vitest": "^4.0.16"
+    "vitest": "^4.1.0"
   },
   "dependencies": {
     "@claude-flow/cli-core": "3.7.0-alpha.5",

package/v3/@claude-flow/guidance/package.json

@@ -147,7 +147,7 @@
   "devDependencies": {
     "@types/node": "^20.10.0",
     "typescript": "^5.3.0",
-    "vitest": "^4.0.16"
+    "vitest": "^4.1.0"
   },
   "engines": {
     "node": ">=20.0.0"

package/v3/@claude-flow/shared/package.json

@@ -32,7 +32,7 @@
     "cors": "^2.8.5",
     "express": "^4.21.0",
     "helmet": "^7.1.0",
-    "vitest": "^4.0.16",
+    "vitest": "^4.1.0",
     "ws": "^8.16.0",
     "zod": "^3.22.4"
   },