claude-flow 3.25.1 → 3.25.2

package/.claude/helpers/metrics-db.mjs

@@ -6,7 +6,7 @@
  */
 
 import initSqlJs from 'sql.js';
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync, openSync, writeSync, fsyncSync, closeSync, renameSync, rmSync } from 'fs';
 import { dirname, join, basename } from 'path';
 import { fileURLToPath } from 'url';
 import { execSync } from 'child_process';
@@ -138,7 +138,22 @@ async function initDatabase() {
 function persist() {
   const data = db.export();
   const buffer = Buffer.from(data);
-  writeFileSync(DB_PATH, buffer);
+  // Atomic write (issue #2584): temp → fsync → rename so a kill/OOM mid-flush
+  // or a concurrent writer can't leave a torn, malformed metrics.db image.
+  const tmp = `${DB_PATH}.tmp-${process.pid}-${Date.now().toString(36)}`;
+  let fd;
+  try {
+    fd = openSync(tmp, 'wx');
+    if (buffer.length > 0) writeSync(fd, buffer, 0, buffer.length, 0);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = undefined;
+    renameSync(tmp, DB_PATH);
+  } catch (e) {
+    if (fd !== undefined) { try { closeSync(fd); } catch { /* */ } }
+    try { rmSync(tmp, { force: true }); } catch { /* */ }
+    throw e;
+  }
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.25.1",
+  "version": "3.25.2",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/fs-secure.d.ts

@@ -16,6 +16,25 @@
  * sniff so legacy plaintext files keep working unchanged during the
  * incremental migration.
  */
+/**
+ * Crash-safe atomic file write (issue #2584).
+ *
+ * A plain `writeFileSync(dbPath, db.export())` of a large sql.js image is NOT
+ * crash-safe: a kill/OOM mid-write — or a second process rewriting the same
+ * path concurrently — leaves a half-written image, and reopening it yields
+ * `database disk image is malformed`. The corruption window scales with file
+ * size, so a 185 MB monolithic flush is especially exposed.
+ *
+ * This writes to a unique temp sibling, fsyncs the bytes to disk, then
+ * `rename()`s over the target. rename() is atomic on POSIX within one
+ * filesystem, so a reader/reopen sees either the old complete image or the new
+ * complete image — never a torn one. The directory entry is best-effort fsynced
+ * so the rename itself survives a crash. On any failure the temp file is
+ * removed and the original is left untouched.
+ */
+export declare function writeFileAtomic(path: string, data: Buffer, opts?: {
+    mode?: number;
+}): void;
 /**
  * Create a directory tree with mode 0700 (owner-only). No-op if exists.
  * Uses recursive: true so missing parents are created with the same mode.

package/v3/@claude-flow/cli/dist/src/fs-secure.js

@@ -16,8 +16,76 @@
  * sniff so legacy plaintext files keep working unchanged during the
  * incremental migration.
  */
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
 import { decryptBuffer, encryptBuffer, getKey, isEncryptedBlob, isEncryptionEnabled, } from './encryption/vault.js';
+/**
+ * Crash-safe atomic file write (issue #2584).
+ *
+ * A plain `writeFileSync(dbPath, db.export())` of a large sql.js image is NOT
+ * crash-safe: a kill/OOM mid-write — or a second process rewriting the same
+ * path concurrently — leaves a half-written image, and reopening it yields
+ * `database disk image is malformed`. The corruption window scales with file
+ * size, so a 185 MB monolithic flush is especially exposed.
+ *
+ * This writes to a unique temp sibling, fsyncs the bytes to disk, then
+ * `rename()`s over the target. rename() is atomic on POSIX within one
+ * filesystem, so a reader/reopen sees either the old complete image or the new
+ * complete image — never a torn one. The directory entry is best-effort fsynced
+ * so the rename itself survives a crash. On any failure the temp file is
+ * removed and the original is left untouched.
+ */
+export function writeFileAtomic(path, data, opts = {}) {
+    const mode = opts.mode ?? 0o600;
+    const dir = dirname(path);
+    const tmp = join(dir, `.${basename(path)}.tmp-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`);
+    let fd;
+    try {
+        fd = openSync(tmp, 'wx', mode);
+        if (data.length > 0)
+            writeSync(fd, data, 0, data.length, 0);
+        fsyncSync(fd); // durability: force bytes to disk BEFORE the rename
+        closeSync(fd);
+        fd = undefined;
+        renameSync(tmp, path); // atomic swap — readers never see a torn image
+        try {
+            chmodSync(path, mode);
+        }
+        catch {
+            // Windows / FS without POSIX modes — silently skip.
+        }
+        // Best-effort: fsync the directory so the rename survives a power loss.
+        try {
+            const dfd = openSync(dir, 'r');
+            try {
+                fsyncSync(dfd);
+            }
+            finally {
+                closeSync(dfd);
+            }
+        }
+        catch {
+            // Directory fsync unsupported (e.g. Windows) — the rename is still atomic.
+        }
+    }
+    catch (e) {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                /* already closed */
+            }
+        }
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* temp never created / already gone */
+        }
+        throw e;
+    }
+}
 /**
  * Create a directory tree with mode 0700 (owner-only). No-op if exists.
  * Uses recursive: true so missing parents are created with the same mode.
@@ -45,20 +113,11 @@ export function writeFileRestricted(path, data, optsOrEncoding = 'utf-8') {
         const plaintext = Buffer.isBuffer(data) ? data : Buffer.from(data, encoding);
         payload = encryptBuffer(plaintext, getKey());
     }
-    // For encrypted payloads we always have a Buffer — pass through without an
-    // encoding so writeFileSync doesn't try to text-decode it.
-    if (Buffer.isBuffer(payload)) {
-        writeFileSync(path, payload);
-    }
-    else {
-        writeFileSync(path, payload, encoding);
-    }
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        // Windows / FS without POSIX modes — silently skip.
-    }
+    // Atomic write (temp → fsync → rename) so a torn/concurrent flush can never
+    // leave a half-written file — the failure mode behind issue #2584. Buffers go
+    // straight through; strings are encoded first (default utf-8).
+    const buf = Buffer.isBuffer(payload) ? payload : Buffer.from(payload, encoding);
+    writeFileAtomic(path, buf, { mode: 0o600 });
 }
 export function readFileMaybeEncrypted(path, encoding = 'utf-8') {
     const raw = readFileSync(path);

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.d.ts

@@ -262,6 +262,9 @@ export declare function recoverMemoryDatabase(dbPath: string, opts?: {
     backupPath?: string;
     rows?: number;
     reason?: string;
+    restoredFromBackup?: boolean;
+    from?: string;
+    restoreReason?: string;
 }>;
 export declare function repairVectorIndexes(dbPath: string, opts?: {
     verbose?: boolean;

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js

@@ -11,7 +11,8 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { createRequire } from 'node:module';
-import { readFileMaybeEncrypted, writeFileRestricted } from '../fs-secure.js';
+import { readFileMaybeEncrypted, writeFileAtomic, writeFileRestricted } from '../fs-secure.js';
+import { restoreMemoryDbFromBackup } from '../services/memory-backup.js';
 /**
  * #2356 — cached, synchronous capability probe for @ruvector/core. `getHNSWStatus`
  * is sync and is called by `neural status` in a fresh process that never warms
@@ -1182,6 +1183,16 @@ async function activateControllerRegistry(dbPath, verbose) {
 export async function recoverMemoryDatabase(dbPath, opts = {}) {
     if (!dbPath || !fs.existsSync(dbPath))
         return { recovered: false, reason: 'no-db' };
+    // Fallback for when the in-place rebuild can't produce a verified DB (issue
+    // #2584): rebuild-from-corrupt salvages nothing when the damage is total, so
+    // restore the newest integrity-ok backup instead of leaving the store dead.
+    const restoreFromBackup = async (reason) => {
+        const r = await restoreMemoryDbFromBackup(dbPath, { verbose: opts.verbose });
+        if (r.restored) {
+            return { recovered: true, restoredFromBackup: true, backupPath: r.corruptBackupPath, rows: r.rows, from: r.from };
+        }
+        return { recovered: false, reason, restoreReason: r.skipped };
+    };
     let Database;
     try {
         // Module name behind a variable so TS does not statically resolve the
@@ -1190,7 +1201,7 @@ export async function recoverMemoryDatabase(dbPath, opts = {}) {
         Database = (await import(mod)).default;
     }
     catch {
-        return { recovered: false, reason: 'no-native' };
+        return await restoreFromBackup('no-native');
     }
     const ts = Date.now();
     const tmpPath = `${dbPath}.recovering-${ts}`;
@@ -1287,9 +1298,9 @@ export async function recoverMemoryDatabase(dbPath, opts = {}) {
             }
             catch { /* */ }
             if (opts.verbose) {
-                console.log(`memory DB auto-recovery aborted (integrity=${integ}, rows ${dstRows}/${srcRows}) — original untouched`);
+                console.log(`memory DB rebuild-in-place failed (integrity=${integ}, rows ${dstRows}/${srcRows}) — trying newest good backup`);
             }
-            return { recovered: false, reason: 'verify-failed' };
+            return await restoreFromBackup('verify-failed');
         }
         // Back up the corrupt DB, then atomically swap in the verified rebuild.
         fs.copyFileSync(dbPath, bakPath);
@@ -1323,8 +1334,8 @@ export async function recoverMemoryDatabase(dbPath, opts = {}) {
         }
         catch { /* */ }
         if (opts.verbose)
-            console.log(`memory DB auto-recovery error: ${e?.message ?? e}`);
-        return { recovered: false, reason: 'error' };
+            console.log(`memory DB rebuild-in-place error (${e?.message ?? e}) — trying newest good backup`);
+        return await restoreFromBackup('error');
     }
 }
 export async function repairVectorIndexes(dbPath, opts = {}) {
@@ -1717,9 +1728,9 @@ export async function applyTemporalDecay(dbPath) {
     `;
         db.run(decayQuery, [now, now, now]);
         const changes = db.getRowsModified();
-        // Save
+        // Save (atomic — issue #2584: a torn full-image flush corrupts the store)
         const data = db.export();
-        fs.writeFileSync(path_, Buffer.from(data));
+        writeFileAtomic(path_, Buffer.from(data));
         db.close();
         return {
             success: true,

package/v3/@claude-flow/cli/dist/src/services/memory-backup.d.ts

@@ -21,4 +21,33 @@ export interface BackupResult {
 }
 export declare function defaultMemoryDbPath(cwd?: string): string;
 export declare function backupMemoryDb(opts?: BackupOptions): Promise<BackupResult>;
+export interface RestoreResult {
+    restored: boolean;
+    /** The backup file that was restored. */
+    from?: string;
+    /** memory_entries count in the restored DB (-1 if it couldn't be verified). */
+    rows?: number;
+    /** Where the corrupt live DB was parked before the swap. */
+    corruptBackupPath?: string;
+    skipped?: string;
+}
+/**
+ * Restore the newest integrity-ok backup over a corrupt/malformed memory DB
+ * (issue #2584).
+ *
+ * The in-place rebuild path (`recoverMemoryDatabase`) rebuilds FROM the corrupt
+ * image, so when the damage is bad enough that `sqlite3 .recover` salvages
+ * nothing, that rebuild also salvages nothing and every `memory_store` keeps
+ * erroring. This is the missing fallback: scan `<db dir>/backups/` newest-first,
+ * pick the newest snapshot that passes `PRAGMA integrity_check` (and has rows),
+ * park the corrupt live DB at `<db>.corrupt-<ts>.bak`, then ATOMICALLY install
+ * the good backup (copy → fsync → rename, no full-image buffer in memory). Drops
+ * stale -wal/-shm. Non-destructive on failure: the live DB is only replaced once
+ * a verified backup is in hand.
+ */
+export declare function restoreMemoryDbFromBackup(dbPath: string, opts?: {
+    destDir?: string;
+    timestamp?: number;
+    verbose?: boolean;
+}): Promise<RestoreResult>;
 //# sourceMappingURL=memory-backup.d.ts.map

package/v3/@claude-flow/cli/dist/src/services/memory-backup.js

@@ -91,4 +91,108 @@ export async function backupMemoryDb(opts = {}) {
     }
     return { backedUp: true, path: destPath, sizeBytes, rotatedAway, gcsUri };
 }
+/**
+ * Restore the newest integrity-ok backup over a corrupt/malformed memory DB
+ * (issue #2584).
+ *
+ * The in-place rebuild path (`recoverMemoryDatabase`) rebuilds FROM the corrupt
+ * image, so when the damage is bad enough that `sqlite3 .recover` salvages
+ * nothing, that rebuild also salvages nothing and every `memory_store` keeps
+ * erroring. This is the missing fallback: scan `<db dir>/backups/` newest-first,
+ * pick the newest snapshot that passes `PRAGMA integrity_check` (and has rows),
+ * park the corrupt live DB at `<db>.corrupt-<ts>.bak`, then ATOMICALLY install
+ * the good backup (copy → fsync → rename, no full-image buffer in memory). Drops
+ * stale -wal/-shm. Non-destructive on failure: the live DB is only replaced once
+ * a verified backup is in hand.
+ */
+export async function restoreMemoryDbFromBackup(dbPath, opts = {}) {
+    if (!dbPath)
+        return { restored: false, skipped: 'no-db-path' };
+    const destDir = opts.destDir ?? path.join(path.dirname(dbPath), 'backups');
+    let snaps;
+    try {
+        snaps = fs
+            .readdirSync(destDir)
+            .filter(f => /^memory-.*\.db$/.test(f))
+            .map(f => path.join(destDir, f))
+            .sort() // ISO-stamped names sort chronologically
+            .reverse(); // newest first
+    }
+    catch {
+        return { restored: false, skipped: 'no-backups-dir' };
+    }
+    if (!snaps.length)
+        return { restored: false, skipped: 'no-backups' };
+    // better-sqlite3 verifies a candidate's integrity. Absent (WASM-only host) →
+    // accept the newest non-empty snapshot, flagged rows=-1 (unverified).
+    let Database = null;
+    try {
+        const mod = 'better-sqlite3';
+        Database = (await import(mod)).default;
+    }
+    catch {
+        /* verifier unavailable — trust newest non-empty */
+    }
+    let chosen = null;
+    for (const file of snaps) {
+        try {
+            if (Database) {
+                const db = new Database(file, { readonly: true });
+                const integ = String(db.pragma('integrity_check', { simple: true }) ?? '');
+                let rows = 0;
+                try {
+                    rows = db.prepare('SELECT COUNT(*) AS c FROM memory_entries').get()?.c ?? 0;
+                }
+                catch { /* no entries table — not a usable memory DB */ }
+                db.close();
+                if (integ.toLowerCase() === 'ok' && rows > 0) {
+                    chosen = { file, rows };
+                    break;
+                }
+            }
+            else if (fs.statSync(file).size > 0) {
+                chosen = { file, rows: -1 };
+                break;
+            }
+        }
+        catch { /* unreadable snapshot — try the next-older one */ }
+    }
+    if (!chosen)
+        return { restored: false, skipped: 'no-integrity-ok-backup' };
+    const ts = opts.timestamp ?? Date.now();
+    const corruptBackupPath = `${dbPath}.corrupt-${ts}.bak`;
+    const tmp = `${dbPath}.restoring-${ts}`;
+    try {
+        if (fs.existsSync(dbPath))
+            fs.copyFileSync(dbPath, corruptBackupPath);
+        fs.copyFileSync(chosen.file, tmp); // stream copy — no 185MB buffer
+        const fd = fs.openSync(tmp, 'r+');
+        try {
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        } // durable before swap
+        fs.renameSync(tmp, dbPath); // atomic install
+        for (const s of ['-wal', '-shm']) {
+            try {
+                fs.rmSync(`${dbPath}${s}`, { force: true });
+            }
+            catch { /* */ }
+        }
+    }
+    catch (e) {
+        try {
+            fs.rmSync(tmp, { force: true });
+        }
+        catch { /* */ }
+        return { restored: false, skipped: `install failed: ${e?.message ?? e}` };
+    }
+    if (opts.verbose) {
+        console.log(`memory DB restored from backup ${path.basename(chosen.file)}` +
+            (chosen.rows >= 0 ? ` (${chosen.rows} rows)` : ' (unverified)') +
+            `. Corrupt original saved to ${corruptBackupPath}`);
+    }
+    return { restored: true, from: chosen.file, rows: chosen.rows, corruptBackupPath };
+}
 //# sourceMappingURL=memory-backup.js.map

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.25.1",
+  "version": "3.25.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",