claude-flow 3.21.0 → 3.22.0

package/v3/@claude-flow/cli/dist/src/init/memory-package-resolver.js

@@ -0,0 +1,118 @@
+/**
+ * Memory Package Resolver (#2545)
+ *
+ * `@claude-flow/memory` is an *optionalDependency* of `@claude-flow/cli`. On the
+ * documented `npx ruflo` install path it lands in the npx cache
+ * (`~/.npm/_npx/<hash>/node_modules`), which is NOT on the node_modules walk-up
+ * path from the user's project. The SessionStart auto-memory hook therefore
+ * could never resolve it and self-learning silently no-op'd.
+ *
+ * At init time, however, the CLI *can* resolve the package from its own module
+ * context (it is installed alongside the CLI in that same npx cache). We resolve
+ * it once and record the absolute path in a machine-local project sidecar
+ * (`.claude-flow/memory-package.json`). The hook reads this sidecar first, so it
+ * reuses the copy npx already downloaded — no second install, no vendoring.
+ *
+ * This module is deliberately dependency-free and best-effort: nothing here ever
+ * throws into the init/doctor flow.
+ */
+import { createRequire } from 'module';
+import * as fs from 'fs';
+import * as path from 'path';
+export const MEMORY_PACKAGE = '@claude-flow/memory';
+/** Project-relative path of the resolver sidecar written by init / doctor --fix. */
+export const MEMORY_SIDECAR_REL = path.join('.claude-flow', 'memory-package.json');
+/**
+ * Resolve `@claude-flow/memory`'s main entry from the CLI's own module context.
+ * Returns the absolute dist path, or null when the optional dependency is absent
+ * (e.g. installed with `--omit=optional`).
+ */
+export function resolveMemoryPackageFromCli() {
+    try {
+        const require = createRequire(import.meta.url);
+        return require.resolve(MEMORY_PACKAGE);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve `@claude-flow/memory` the same way the runtime hook does, from a target
+ * project directory: sidecar → project package.json → node_modules walk-up.
+ * Used by `doctor` so its verdict matches what the hook will actually experience.
+ */
+export function resolveMemoryPackageFromProject(targetDir) {
+    // 1. Sidecar written by a previous init / doctor --fix
+    try {
+        const sidecar = path.join(targetDir, MEMORY_SIDECAR_REL);
+        if (fs.existsSync(sidecar)) {
+            const rec = JSON.parse(fs.readFileSync(sidecar, 'utf-8'));
+            if (rec?.distPath && fs.existsSync(rec.distPath))
+                return rec.distPath;
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    // 2. createRequire from the project's package.json (direct/transitive dep)
+    try {
+        const require = createRequire(path.join(targetDir, 'package.json'));
+        return require.resolve(MEMORY_PACKAGE);
+    }
+    catch {
+        /* fall through */
+    }
+    // 3. node_modules walk-up from the project root
+    let dir = path.resolve(targetDir);
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const candidate = path.join(dir, 'node_modules', '@claude-flow', 'memory', 'dist', 'index.js');
+        if (fs.existsSync(candidate))
+            return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+/** Read the version of the resolved memory package (dist/index.js → ../package.json). */
+export function readMemoryPackageVersion(distPath) {
+    try {
+        const pkgJson = path.resolve(path.dirname(distPath), '..', 'package.json');
+        if (fs.existsSync(pkgJson)) {
+            const parsed = JSON.parse(fs.readFileSync(pkgJson, 'utf-8'));
+            return parsed.version ?? null;
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    return null;
+}
+/**
+ * Best-effort: resolve `@claude-flow/memory` from the CLI and record its path in
+ * the project sidecar so the runtime hook can find it on the npx install path.
+ * Returns the written record, or null when the package is not resolvable from the
+ * CLI (in which case the hook fails loud and `doctor` flags it).
+ */
+export function recordMemoryPackagePath(targetDir, resolvedBy = 'init') {
+    const distPath = resolveMemoryPackageFromCli();
+    if (!distPath)
+        return null;
+    const record = {
+        distPath,
+        version: readMemoryPackageVersion(distPath),
+        resolvedBy,
+        resolvedAt: new Date().toISOString(),
+    };
+    try {
+        fs.mkdirSync(path.join(targetDir, '.claude-flow'), { recursive: true });
+        fs.writeFileSync(path.join(targetDir, MEMORY_SIDECAR_REL), JSON.stringify(record, null, 2), 'utf-8');
+        return record;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=memory-package-resolver.js.map

package/v3/@claude-flow/cli/dist/src/init/statusline-generator.js

@@ -211,13 +211,24 @@ function getLocalAgentDB() {
     const memDb = path.join(CWD, '.swarm', 'memory.db');
     if (fs.existsSync(memDb)) {
       const Q = String.fromCharCode(34);
-      const sql = Q + 'SELECT (SELECT COUNT(*) FROM memory_entries WHERE embedding IS NOT NULL)||' + "'|'" + '||(SELECT COUNT(*) FROM vector_indexes);' + Q;
-      const out = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + sql, 1500);
-      if (out && out.indexOf('|') !== -1) {
-        const parts = out.split('|');
-        result.vectorCount = parseInt(parts[0], 10) || 0;
-        result.hasHnsw = (parseInt(parts[1], 10) || 0) > 0;
-      }
+      // Two INDEPENDENT statements -- do NOT combine into one. Coupling the
+      // vector count with the vector_indexes row count in a single statement
+      // meant that on a DB missing the vector_indexes table (older/agentdb-
+      // written DBs), the whole statement failed at PREPARE time (SQLite
+      // compiles the full SQL before running), so the valid memory_entries
+      // count was discarded too and the statusline showed Vectors 0 despite
+      // thousands of real vectors. Split so a missing table can only zero the
+      // HNSW flag, never the count. The init self-heal provisions the table so
+      // the flag recovers on the next ruflo init / MCP start.
+      const countSql = Q + 'SELECT COUNT(*) FROM memory_entries WHERE embedding IS NOT NULL;' + Q;
+      const vc = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + countSql, 1500);
+      if (vc) result.vectorCount = parseInt(vc, 10) || 0;
+      // HNSW flag: separate statement. If vector_indexes is absent, sqlite3
+      // exits non-zero and safeExec returns empty -- hasHnsw stays false (exact
+      // original semantics: at least one index-config row present).
+      const hnswSql = Q + 'SELECT COUNT(*) FROM vector_indexes;' + Q;
+      const hn = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + hnswSql, 1500);
+      if (hn) result.hasHnsw = (parseInt(hn, 10) || 0) > 0;
     }
   } catch { /* ignore */ }
   return result;

package/v3/@claude-flow/cli/dist/src/mcp-client.js

@@ -33,6 +33,10 @@ import { daaTools } from './mcp-tools/daa-tools.js';
 import { coordinationTools } from './mcp-tools/coordination-tools.js';
 import { browserTools } from './mcp-tools/browser-tools.js';
 import { browserSessionTools } from './mcp-tools/browser-session-tools.js';
+// ADR-175 — page-agent natural-language intent layer (browser_act). Always
+// registered; degrades to {degraded:true} at call time when page-agent or an
+// OpenAI-compatible LLM provider isn't available.
+import { browserIntentTools } from './mcp-tools/browser-intent-tools.js';
 import { execFileSync } from 'node:child_process';
 // Phase 6: AgentDB v3 controller tools
 import { agentdbTools } from './mcp-tools/agentdb-tools.js';
@@ -89,6 +93,14 @@ function getBrowserTools() {
 function getBrowserSessionTools() {
     return browserSessionTools;
 }
+/**
+ * ADR-175 `browser_act` — always registered like browserSessionTools; the
+ * handler itself resolves page-agent + LLM-provider availability at call
+ * time and returns `{degraded: true}` rather than throwing.
+ */
+function getBrowserIntentTools() {
+    return browserIntentTools;
+}
 /**
  * MCP Tool Registry
  * Maps tool names to their handler functions
@@ -127,6 +139,7 @@ registerTools([
     ...coordinationTools,
     ...getBrowserTools(),
     ...getBrowserSessionTools(),
+    ...getBrowserIntentTools(),
     // Phase 6: AgentDB v3 controller tools
     ...agentdbTools,
     // RuVector WASM tools

package/v3/@claude-flow/cli/dist/src/mcp-tools/agenticow-speculate-tools.js

@@ -115,11 +115,18 @@ export const agenticowSpeculateTools = [
             }
             // Build the generic {label, fn} candidates. Each fn ingests into its own
             // branch handle, then (for 'nearest') probes it so we can score.
+            // Map validated label → explicit branchPath so the branchPath() resolver
+            // below is O(1) instead of re-scanning + re-validating rawCandidates per
+            // candidate (explore() calls branchPath once per candidate → was O(n²)).
+            const explicitBranchPaths = new Map();
             const candidates = rawCandidates.map((c) => {
                 const label = validateLabel(String(c.label));
                 if (!Array.isArray(c.ingest) || c.ingest.length === 0) {
                     throw new Error(`candidate ${label} must ingest at least one vector`);
                 }
+                if (typeof c.branchPath === 'string' && c.branchPath) {
+                    explicitBranchPaths.set(label, c.branchPath);
+                }
                 const records = c.ingest.map((r) => ({
                     ...(Number.isInteger(r.id) ? { id: r.id } : {}),
                     vector: r.vector,
@@ -151,9 +158,9 @@ export const agenticowSpeculateTools = [
                 return 1 / (1 + Math.max(0, r.bestDistance));
             };
             const branchPath = (label) => {
-                const explicit = rawCandidates.find((c) => validateLabel(String(c.label)) === label)?.branchPath;
+                const explicit = explicitBranchPaths.get(label);
                 if (explicit)
-                    return resolveMemoryPath(String(explicit));
+                    return resolveMemoryPath(explicit);
                 return `${basePath}.spec-${safeSegment(label)}.rvf`;
             };
             // ADR-171 promotion gate. For pure memory A/B the `score` IS the chosen

package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-intent-tools.d.ts

@@ -0,0 +1,162 @@
+/**
+ * Browser Intent MCP Tools — ADR-175 page-agent integration.
+ *
+ * Adds a natural-language INTENT layer on top of the low-level selector-based
+ * `browser_*` tools (browser-tools.ts, driven by the `agent-browser` CLI).
+ * `browser_act({ task })` lets a caller say "Click the login button" instead
+ * of chaining browser_snapshot + browser_click.
+ *
+ * Backing library: `page-agent` (npm, MIT, https://github.com/alibaba/page-agent)
+ * — in-page injected JS that turns the DOM into text and lets an LLM execute
+ * natural-language intents via `agent.execute('Click login')`.
+ *
+ * ============================================================================
+ * VERIFIED API (recorded 2026-07-04 against page-agent@1.11.0 — `npm view
+ * page-agent`, the published README, and the actual npm tarball contents).
+ * Deviations from the original integration brief are called out inline.
+ * ============================================================================
+ *
+ * - Package layout changed since the brief was written: `page-agent` is now a
+ *   thin composition of `@page-agent/core` + `@page-agent/llms` +
+ *   `@page-agent/page-controller` + `@page-agent/ui`. The npm package is
+ *   ESM-only (`"type":"module"`) and ships two builds:
+ *     - `dist/esm/page-agent.js` — the Node/bundler ESM entry.
+ *     - `dist/iife/page-agent.demo.js` — a self-contained browser IIFE that
+ *       sets `window.PageAgent = <class>` (this is what we inject).
+ *
+ * - DEVIATION #1 (load-bearing): `await import('page-agent')` is NOT a safe
+ *   availability probe in Node. Empirically, importing the ESM entry throws
+ *   `ReferenceError: window is not defined` — even when the package IS
+ *   correctly installed — because `@page-agent/core`'s module graph touches
+ *   DOM globals at import time (it's designed to run in a browser, not Node).
+ *   This differs from the agenticow-loader.ts pattern used elsewhere in this
+ *   repo (dynamic `import()` + catch `ERR_MODULE_NOT_FOUND`), which only
+ *   works for pure-Node optional deps. Instead we detect availability via
+ *   `require.resolve('page-agent')` — path resolution only, never executes
+ *   module code — the same technique `browser-session-tools.ts` already uses
+ *   to resolve the local `ruvector` CLI bin without invoking it.
+ *
+ * - DEVIATION #2: the IIFE bundle unconditionally (also) auto-constructs a
+ *   DEMO `PageAgent` instance via `setTimeout`, pointed at Alibaba's public
+ *   sandbox endpoint (`model: 'qwen3.5-plus'`, a `page-ag-testing-*.run`
+ *   baseURL, `apiKey: 'NA'`) UNLESS the bundle is loaded via a real
+ *   `<script src="...?autoInit=false">` tag — the guard reads
+ *   `document.currentScript.src`, which is `null` when the bundle runs via
+ *   `eval`/CDP (our only injection path through the `agent-browser`
+ *   primitive set). Left alone, every `browser_act` call would leak page
+ *   content to Alibaba's test endpoint using a placeholder key. We strip the
+ *   demo auto-init tail (`stripDemoAutoInit`) before injecting rather than
+ *   relying on the query-param guard.
+ *
+ * - Constructor: `new PageAgent({ model, baseURL, apiKey, language })` —
+ *   `apiKey` is OPTIONAL on the type (`LLMConfig.apiKey?: string`), confirmed
+ *   in `@page-agent/llms`' `LLMConfig` interface.
+ *
+ * - `execute(task: string): Promise<ExecutionResult>` where
+ *   `ExecutionResult = { success: boolean; data: string; history: HistoricalEvent[] }`
+ *   — DEVIATION #3: NOT `{ success, result, steps }` as sketched in the
+ *   original brief. We map `data` → `result` and `history.length` → `steps`
+ *   in the tool's own return shape, and also pass `history` through for
+ *   callers that want the full step trace.
+ *
+ * - LLM transport: confirmed via `@page-agent/llms`' `OpenAIClient` — a
+ *   single non-streaming `POST ${baseURL}/chat/completions` with
+ *   `Authorization: Bearer ${apiKey}` and OpenAI tool-calling JSON. This is
+ *   why a bare `ANTHROPIC_API_KEY` cannot be handed to page-agent directly:
+ *   Anthropic's native API is a different shape (`/v1/messages`, different
+ *   tool-call format). We require an OpenAI-*compatible* endpoint — reusing
+ *   this CLI's own Tier-3 fallback ladder from `agent-execute-core.ts`
+ *   (OpenRouter, then Ollama Cloud), or an explicit override.
+ *
+ * ARCHITECTURAL CONSTRAINT (mirrors metaharness-tools.ts / agenticow-tools.ts)
+ * `page-agent` lives in `optionalDependencies`. Every code path degrades to
+ * `{ degraded: true }` — never throws — when the package or an LLM provider
+ * isn't available.
+ *
+ * KEY-SAFETY CONSTRAINT (load-bearing): page-agent's LLM calls happen FROM
+ * the browser page context (it's client-side injected JS), so its `apiKey`
+ * config field is necessarily visible to whatever we inject into the page.
+ * To avoid ever placing a real provider key into a page-context string, we
+ * start a short-lived local HTTP proxy (`startLocalLLMProxy`) bound to
+ * 127.0.0.1 that holds the REAL key server-side and injects the real
+ * `Authorization` header itself; the page only ever sees the proxy's
+ * loopback URL plus a constant placeholder string (`PLACEHOLDER_API_KEY`).
+ *
+ * @module @claude-flow/cli/mcp-tools/browser-intent
+ */
+import type { MCPTool } from './types.js';
+export interface PageAgentBundle {
+    /** Package root directory (contains package.json). */
+    root: string;
+    /** Absolute path to the browser-injectable IIFE bundle. */
+    iifePath: string;
+    version: string;
+}
+/**
+ * Locate the installed `page-agent` package's browser bundle without ever
+ * executing its module code. `resolvePkg` is injectable for tests (DI over
+ * module mocking, since `vi.mock('page-agent', ...)` cannot simulate absence
+ * for a package we deliberately never `import()`).
+ */
+export declare function locatePageAgentBundle(resolvePkg?: (id: string) => string): PageAgentBundle | null;
+export interface ResolvedLLMConfig {
+    baseURL: string;
+    apiKey: string;
+    model: string;
+    source: 'explicit' | 'openrouter' | 'ollama';
+}
+export declare function resolvePageAgentLLMConfig(env?: NodeJS.ProcessEnv): ResolvedLLMConfig | null;
+export declare const PLACEHOLDER_API_KEY = "ruflo-proxied-key";
+export interface LLMProxyHandle {
+    url: string;
+    close: () => void;
+}
+export declare function startLocalLLMProxy(real: {
+    baseURL: string;
+    apiKey: string;
+}): Promise<LLMProxyHandle>;
+/** Thrown when a bundle still contains a demo/sandbox endpoint after stripping. */
+export declare class DemoLeakError extends Error {
+    readonly signature: string;
+    constructor(signature: string);
+}
+/** Returns the first demo-leak signature found in `source`, or null if clean. */
+export declare function findDemoLeak(source: string): string | null;
+/**
+ * Strip the demo bundle's auto-init tail so injecting it via eval doesn't spin
+ * up a second `window.pageAgent` pointed at Alibaba's sandbox endpoint. This is
+ * best-effort at the text level; the real guarantee is the fail-closed
+ * `findDemoLeak` firewall enforced in `buildPageAgentInjection`, NOT this strip.
+ */
+export declare function stripDemoAutoInit(iifeSource: string): string;
+export declare const BROWSER_ACT_RESULT_GLOBAL = "__ruflo_browser_act_result__";
+export interface PageAgentPageConfig {
+    baseURL: string;
+    apiKey: string;
+    model: string;
+    language?: string;
+}
+/**
+ * Build the full script to hand to `browser_eval` / `agent-browser eval`:
+ * the (demo-stripped) IIFE bundle, followed by our own controlled
+ * construction + `execute()` call whose settled result lands on a window
+ * global we can poll for.
+ *
+ * KEY-SAFETY: `pageConfig.apiKey` MUST be `PLACEHOLDER_API_KEY` (or another
+ * non-secret placeholder) — callers are responsible for routing the real key
+ * through `startLocalLLMProxy` first. This function only assembles strings;
+ * it does not itself guarantee key safety, so callers MUST NOT pass a real
+ * key here (see `browserIntentTools` handler for the enforced call site).
+ */
+export declare function buildPageAgentInjection(iifeSource: string, pageConfig: PageAgentPageConfig, task: string): string;
+export declare function recordBrowserTrajectory(entry: {
+    task: string;
+    url?: string;
+    success: boolean;
+    dataPreview: string;
+    steps: number;
+    source: string;
+}): Promise<boolean>;
+export declare const browserIntentTools: MCPTool[];
+export default browserIntentTools;
+//# sourceMappingURL=browser-intent-tools.d.ts.map