claude-flow 3.25.6 → 3.26.1

package/v3/@claude-flow/cli/dist/src/services/fable-harness.js

@@ -79,6 +79,17 @@ const REFLECT_SYSTEM_PROMPT = [
     'Reply with ONLY a JSON array, one object per input id, no prose:',
     '[{"id":"...","failureClass":"<short label>","diagnosis":"<one sentence>","mutationHint":"<actionable>"}]',
 ].join('\n');
+const ADVISOR_SYSTEM_PROMPT = [
+    "You are RuFlo's co-pilot advisor: ONE short, proactive, actionable tip for",
+    'a developer, based on a single JSON object describing STRUCTURAL signals',
+    'from their current coding session (security scan status, swarm/agent',
+    'state, count of uncommitted files, context-window usage). There is no',
+    'prompt, command, or file content in the input — never assume or invent any.',
+    'If nothing in the snapshot genuinely warrants a tip, say so by returning',
+    'an empty array. Never pad with generic advice not grounded in the snapshot.',
+    'Reply with ONLY a JSON array containing zero or one object, no prose:',
+    '[] or [{"headline":"<=60 chars","detail":"<one actionable sentence>","confidence":0.0-1.0}]',
+].join('\n');
 // ── Default spawner (real CLI) ───────────────────────────────────────────────
 /**
  * Default `claude -p` spawner. Pipes the prompt via stdin (never as an argv
@@ -213,6 +224,24 @@ export class FableHarness {
         }
         return out;
     }
+    /**
+     * ADR-316 — one proactive co-pilot tip from a structural session snapshot
+     * (no raw prompt/command/file content). A single-item "batch" — same
+     * budget/cwd/parsing discipline as judgeBatch/reflectFailures, just with
+     * exactly one call instead of a loop. Returns null when disabled, over
+     * budget, or the model found nothing worth surfacing (an empty verdict
+     * array is a valid, non-error answer here, not a parse failure).
+     */
+    async adviseCoPilotTip(snapshot) {
+        if (!this.isEnabled())
+            return null;
+        if (this.spentUsd >= this.maxBudgetUsd)
+            return null;
+        const parsed = await this.runBatch(ADVISOR_SYSTEM_PROMPT, [snapshot]);
+        if (parsed.length === 0)
+            return null;
+        return normalizeCoPilotTip(parsed[0]);
+    }
     /** Build the argv for a `claude -p` call. Exposed shape for testability. */
     buildArgv(systemPrompt) {
         const perCallCap = Math.max(0, this.maxBudgetUsd - this.spentUsd);
@@ -321,6 +350,18 @@ function normalizeReflect(raw) {
         mutationHint: typeof o.mutationHint === 'string' ? o.mutationHint : '',
     };
 }
+function normalizeCoPilotTip(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const o = raw;
+    if (typeof o.headline !== 'string' || !o.headline.trim())
+        return null;
+    return {
+        headline: o.headline.slice(0, 80),
+        detail: typeof o.detail === 'string' ? o.detail.slice(0, 200) : '',
+        confidence: clamp01(typeof o.confidence === 'number' ? o.confidence : Number(o.confidence)),
+    };
+}
 function tryParseJson(s) {
     try {
         return JSON.parse(s);

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.25.6",
+  "version": "3.26.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -81,7 +81,8 @@
     "scripts/postinstall.cjs",
     ".claude",
     "plugins",
-    "README.md"
+    "README.md",
+    "catalog-manifest.json"
   ],
   "scripts": {
     "build": "tsc",
@@ -89,7 +90,7 @@
     "test:plugin-store": "npx tsx src/plugins/tests/standalone-test.ts",
     "test:pattern-store": "npx tsx src/transfer/store/tests/standalone-test.ts",
     "postinstall": "node ./scripts/postinstall.cjs",
-    "prepublishOnly": "cp ../../../README.md ./README.md && rm -rf plugins && mkdir -p plugins && cp -r ../../../plugins/ruflo-metaharness plugins/ && node scripts/sign-helpers.mjs && node scripts/verify-helpers.mjs",
+    "prepublishOnly": "cp ../../../README.md ./README.md && rm -rf plugins && mkdir -p plugins && cp -r ../../../plugins/ruflo-metaharness plugins/ && node scripts/generate-catalog-manifest.mjs && node scripts/sign-helpers.mjs && node scripts/verify-helpers.mjs",
     "release": "npm version prerelease --preid=alpha && npm run publish:all",
     "publish:all": "./scripts/publish.sh"
   },
@@ -119,6 +120,14 @@
     "tag": "latest"
   },
   "overrides": {
-    "protobufjs": ">=7.5.6"
+    "protobufjs": ">=7.5.6",
+    "js-yaml": ">=4.3.0",
+    "express": ">=4.22.2",
+    "qs": ">=6.15.2",
+    "@opentelemetry/core": ">=2.8.0",
+    "@opentelemetry/resources": ">=2.8.0",
+    "@opentelemetry/sdk-trace-base": ">=2.8.0",
+    "@opentelemetry/sdk-node": ">=0.220.0",
+    "agentdb": "$agentdb"
   }
 }

package/.claude/coordinator/config.json

@@ -1,24 +0,0 @@
-{
-  "version": "1.0",
-  "startedAt": "2026-07-08T02:30:00Z",
-  "policy": "full-autopilot",
-  "safety": {
-    "requireCiGreen": true,
-    "requireNoConflict": true,
-    "requireIdleHours": 0,
-    "maxTicks": 30,
-    "tickIntervalSeconds": 600,
-    "excludeIfCodeownersBlock": true
-  },
-  "targetPRs": [
-    {"num": 2517, "adr": null, "cluster": "security", "grade": "A", "note": "AgentDB retrieval poisoning 93-100% ASR"},
-    {"num": 2537, "adr": null, "cluster": "memory", "grade": "B", "note": "AutoMem RL loop — needs ADR renumber (collides w/ #2527 on 167)"},
-    {"num": 2577, "adr": 176, "cluster": "performance", "grade": "A", "note": "PolyKV shared KV pool 97.7% reduction"},
-    {"num": 2589, "adr": null, "cluster": "security", "grade": "A", "note": "VMG + RepE IPI — needs ADR renumber (collides w/ #2598 on 178)"},
-    {"num": 2598, "adr": null, "cluster": "intelligence", "grade": "B", "note": "SkillRL — needs ADR renumber (collides w/ #2589 on 178)"}
-  ],
-  "adrCollisions": [
-    {"conflictingPRs": [2589, 2598], "originalAdr": 178, "resolution": "earlier-wins", "reason": "2589 (dream 2026-07-06) beats 2598 (dream 2026-07-07)"},
-    {"conflictingPRs": [2527, 2537], "originalAdr": 167, "resolution": "earlier-wins", "reason": "2527 (dream 2026-07-02) beats 2537 (dream 2026-07-03) — but 2527 not in scope so 2537 gets it if 2527 is also renumbered"}
-  ]
-}

package/.claude/coordinator/state.json

@@ -1,37 +0,0 @@
-{
-  "tick": 5,
-  "terminated": true,
-  "terminationReason": "main-preexisting-red-cannot-autopilot",
-  "closed": [],
-  "merged": [2589],
-  "blocked": [2517, 2537, 2577, 2598],
-  "adrAssignments": {
-    "2517": 180,
-    "2537": 181,
-    "2577": 182,
-    "2598": 183,
-    "2589": 178
-  },
-  "routingWeights": {
-    "parallel-renumber-adr": -1,
-    "centralized-adr-pre-assign": 2,
-    "convert-ready-when-green": 1,
-    "single-action-per-tick": 1,
-    "gh-pr-merge-admin-squash": 1,
-    "rebase-onto-main-when-shared-blocker": 2,
-    "force-remove-stale-worktree": 1,
-    "inline-fix-when-workflow-stalls": 1,
-    "diagnose-main-before-per-pr-fix": 3,
-    "terminate-loop-when-main-red-and-not-caused-by-scope": 2
-  },
-  "cumulativeReward": 14,
-  "ticksSpent": 5,
-  "completedAt": "2026-07-08T03:15:00Z",
-  "achievements": [
-    "Landed PR #2589 (security VMG+RepE IPI) — first dream merge in weeks",
-    "Resolved 4 ADR-number collisions (178/180/181/182/183) that had built up across in-flight dreams",
-    "Rebased 4 stale dream branches onto main to inherit v3.25.3 fixes",
-    "Learned + persisted routing weights via 5 tick cycles"
-  ],
-  "handoff": "Main has 7 preexisting failing checks (Build V3 all platforms, Witness verify all platforms, graph schema smoke ADR-130 P1). All 4 remaining PRs (#2517, #2537, #2577, #2598) are draft=false + mergeable + at latest ADR numbers + rebased to main tip. They will auto-merge via a re-fired coordinator OR via `gh pr merge --admin --squash` once main goes green. Recommendation: file a `fix/main-v3-ci-red` triage issue first, unblock main, then re-fire the coordinator with `/loop 10m` OR merge the 4 PRs manually with --admin since they only add ADR markdown."
-}

package/.claude/coordinator/tick-log/tick-01.json

@@ -1,17 +0,0 @@
-{
-  "tick": 1,
-  "completedAt": "2026-07-08T02:33:00Z",
-  "durationSeconds": 141,
-  "assessed": 5,
-  "advanced": 5,
-  "merged": 0,
-  "renumbered": 4,
-  "readyForCi": 1,
-  "totalReward": 5,
-  "coordinatorMistake": {
-    "type": "parallel-race-adr-allocation",
-    "description": "4 independent assessors each picked ADR-180 as next-free. Result: 4 PRs now all claim ADR-180.",
-    "affectedPRs": [2517, 2537, 2577, 2598]
-  },
-  "lessonLearned": "Future ticks: PRE-ASSIGN ADR numbers centrally before fanning out. Never let parallel agents pick numbers independently."
-}

package/.claude/coordinator/tick-log/tick-02.json

@@ -1,17 +0,0 @@
-{
-  "tick": 2,
-  "completedAt": "2026-07-08T02:36:00Z",
-  "durationSeconds": 106,
-  "collisionFixesSucceeded": 3,
-  "advancesSucceeded": 2,
-  "mergedThisTick": [2589],
-  "renumberedThisTick": [
-    {"pr": 2537, "adr": 181},
-    {"pr": 2577, "adr": 182},
-    {"pr": 2598, "adr": 183}
-  ],
-  "ciRunningThisTick": [2517],
-  "totalReward": 5,
-  "cumulativeReward": 10,
-  "lesson": "Central pre-assignment resolved the parallel-race collision that tick 1 created. Reward pattern confirms centralized-adr-pre-assign > parallel-renumber-adr."
-}

package/.claude/coordinator/tick-log/tick-03.json

@@ -1,17 +0,0 @@
-{
-  "tick": 3,
-  "completedAt": "2026-07-08T02:59:00Z",
-  "durationSeconds": 69,
-  "assessed": 4,
-  "advanced": 0,
-  "merged": 0,
-  "totalReward": 0,
-  "cumulativeReward": 10,
-  "sharedBlocker": {
-    "type": "old-base-missing-2578-fix",
-    "description": "All 4 remaining dream branches predate the #2578 phantom-subpath fix that landed in v3.25.3 (PR #2602). Their old midstream-aware-loader.ts still imports from 'agentic-flow/transport/loader' → TS errors on Build V3.",
-    "affectedPRs": [2517, 2537, 2577, 2598],
-    "resolution": "rebase all 4 onto latest main; the fix is already there"
-  },
-  "lessonLearned": "Old-base branches get free fixes on rebase after main advances. Detect the shared-blocker pattern (same failure mode across N PRs) → try rebase before per-PR fixes."
-}

package/.claude/coordinator/tick-log/tick-04.json

@@ -1,14 +0,0 @@
-{
-  "tick": 4,
-  "completedAt": "2026-07-08T03:03:00Z",
-  "durationSeconds": 92,
-  "rebased": [2517, 2537, 2577, 2598],
-  "convertedReady": [2537, 2577, 2598],
-  "coordinatorMistakes": [
-    {"type": "schema-drift", "description": "3 rebase agents returned prNum=0 instead of the target PR number; downstream Convert-Ready phase failed on nonexistent PR #0"},
-    {"type": "stale-worktree", "description": "Tick 1's worktree wf_ea2955a6-e74-10 held dream/2026-07-07-intelligence; tick 4's #2598 agent couldn't checkout. Fixed inline with git worktree remove --force + inline rebase."}
-  ],
-  "totalReward": 4,
-  "cumulativeReward": 14,
-  "lesson": "Workflow agents must inject their prNum into the return payload (prompt-side templating). Force-remove worktrees at end of prior workflow OR clean up before spawning new ones. Sometimes inline main-context work is faster than another workflow round."
-}

package/.claude/coordinator/tick-log/tick-05.json

@@ -1,16 +0,0 @@
-{
-  "tick": 5,
-  "completedAt": "2026-07-08T03:15:00Z",
-  "durationSeconds": 33,
-  "assessed": 4,
-  "mergeEligible": 0,
-  "merged": 0,
-  "totalReward": 0,
-  "cumulativeReward": 14,
-  "terminalDiagnosis": {
-    "type": "main-preexisting-red",
-    "description": "Main's latest v3-ci run (sha a444930d8, post-#2589 merge) has 7 failing checks preexisting: Build V3 (macos/ubuntu/windows) [TS type errors in plugin-agent-federation], Witness verify (signed manifest) [macos/ubuntu/windows], graph schema smoke (ADR-130 P1). ALL 4 remaining dream PRs inherit these failures. They can NEVER pass CI while main is red.",
-    "canCoordinatorFixThis": false,
-    "reasoning": "Multi-platform TS type errors + witness manifest issues + graph schema audit = multi-hour repo-level work that needs human architectural decisions (revert vs fix upstream, which shim signatures to accept). Beyond the coordinator's 10-min autopilot scope."
-  }
-}

package/.claude/settings.local.json

@@ -1,11 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(mkdir -p /tmp/ruflo-smoke)",
-      "Bash(rm -rf /tmp/ruflo-smoke/*)",
-      "Read(//tmp/**)",
-      "Bash(npm pack *)",
-      "WebFetch(domain:www.npmjs.com)"
-    ]
-  }
-}

package/v3/@claude-flow/cli/dist/src/ruvector/lattice-wasm.d.ts

@@ -1,14 +0,0 @@
-/** Default package name (ruvnet WASM convention); override with RUFLO_LATTICE_WASM_PKG. */
-export declare const LATTICE_WASM_PKG: string;
-export type LatticeModel = 'minilm' | 'bge' | 'paraphrase-minilm' | 'qwen3-0.6b' | string;
-export declare const DEFAULT_LATTICE_MODEL: LatticeModel;
-/** Is the Lattice WASM embedder installed + initializable? Cached; never throws. */
-export declare function latticeAvailable(): Promise<boolean>;
-/** The models Lattice reports (empty until availability is probed). */
-export declare function latticeModels(): LatticeModel[];
-/**
- * Embed `text` with `model` via Lattice WASM. Returns null on any failure so the
- * caller can fall through to the next tier. Never throws.
- */
-export declare function latticeEmbed(text: string, model?: LatticeModel): Promise<number[] | null>;
-//# sourceMappingURL=lattice-wasm.d.ts.map

package/v3/@claude-flow/cli/dist/src/ruvector/lattice-wasm.js

@@ -1,144 +0,0 @@
-/**
- * Lattice WASM embedder adapter — the primary embedding tier (ADR: embedding
- * substrate upgrade). Replaces hash placeholders with real semantic embeddings
- * and adds multiple models (miniLM, bge, multi-paraphrase-miniLM, GPU qwen3-0.6B).
- *
- * Built on the proven `@ruvector/ruvllm-wasm` optional-dependency convention:
- *   - dynamically imported (never a hard dependency),
- *   - WASM initialized from bundled bytes,
- *   - fully FAIL-CLOSED: if the package is absent, the WASM fails to init, or the
- *     embed API differs, `latticeAvailable()` returns false and callers fall
- *     through to the existing ruvector-ONNX → hash tiers with ZERO regression.
- *
- * The package specifier is configurable (`RUFLO_LATTICE_WASM_PKG`) so the exact
- * published name can be set without a code change; the API is probed tolerantly.
- * Opt-in for the GPU model: qwen3 is only selected when explicitly requested.
- */
-import { createRequire } from 'module';
-import { readFileSync } from 'fs';
-const require_ = createRequire(import.meta.url);
-/** Default package name (ruvnet WASM convention); override with RUFLO_LATTICE_WASM_PKG. */
-export const LATTICE_WASM_PKG = process.env.RUFLO_LATTICE_WASM_PKG || '@ruvector/lattice-wasm';
-export const DEFAULT_LATTICE_MODEL = process.env.RUFLO_EMBED_MODEL || 'minilm';
-/* eslint-disable @typescript-eslint/no-explicit-any */
-let _mod = null;
-let _ready = false;
-let _probed = false;
-let _available = false;
-let _models = [];
-async function loadModule() {
-    if (_mod)
-        return _mod;
-    const spec = LATTICE_WASM_PKG;
-    _mod = await import(spec).catch(() => null); // optional — absent ⇒ null ⇒ unavailable
-    return _mod;
-}
-async function ensureInit() {
-    if (_ready)
-        return true;
-    const mod = await loadModule();
-    if (!mod)
-        return false;
-    try {
-        // ruvnet WASM convention: initSync({ module: <wasm bytes> }); tolerate variants.
-        if (!_ready && typeof mod.initSync === 'function') {
-            let wasmBytes;
-            for (const cand of ['lattice_wasm_bg.wasm', 'lattice_bg.wasm', 'index_bg.wasm']) {
-                try {
-                    wasmBytes = readFileSync(require_.resolve(`${LATTICE_WASM_PKG}/${cand}`));
-                    break;
-                }
-                catch { /* try next */ }
-            }
-            mod.initSync(wasmBytes ? { module: wasmBytes } : undefined);
-        }
-        else if (typeof mod.default === 'function') {
-            await mod.default(); // some wasm-bindgen builds export an async default init
-        }
-        _ready = true;
-        return true;
-    }
-    catch {
-        return false; // init failed ⇒ fail closed
-    }
-}
-/** Extract a plain number[] from whatever shape the module's embed returns. */
-function toVec(r) {
-    const v = (r && typeof r === 'object' && 'embedding' in r) ? r.embedding : r;
-    if (!v)
-        return null;
-    if (Array.isArray(v))
-        return v;
-    if (v.length !== undefined)
-        return Array.from(v);
-    return null;
-}
-/** Is the Lattice WASM embedder installed + initializable? Cached; never throws. */
-export async function latticeAvailable() {
-    if (_probed)
-        return _available;
-    _probed = true;
-    try {
-        if (!(await ensureInit())) {
-            _available = false;
-            return false;
-        }
-        const mod = _mod;
-        // discover models (tolerant): listModels() / models / MODELS
-        try {
-            const list = typeof mod.listModels === 'function' ? mod.listModels() : (mod.models ?? mod.MODELS);
-            if (Array.isArray(list) && list.length)
-                _models = list;
-        }
-        catch { /* leave default */ }
-        if (!_models.length)
-            _models = [DEFAULT_LATTICE_MODEL];
-        // verify an actual embed succeeds (the ADR-086 "loads but runtime-fails" trap).
-        const probe = await latticeEmbedRaw('probe', DEFAULT_LATTICE_MODEL);
-        _available = !!probe && probe.length > 0;
-        return _available;
-    }
-    catch {
-        _available = false;
-        return false;
-    }
-}
-/** The models Lattice reports (empty until availability is probed). */
-export function latticeModels() { return [..._models]; }
-async function latticeEmbedRaw(text, model) {
-    const mod = _mod;
-    if (!mod)
-        return null;
-    // tolerant API probing across plausible wasm-bindgen surfaces.
-    const attempts = [
-        () => typeof mod.embed === 'function' ? mod.embed(text, model) : undefined,
-        () => typeof mod.embed === 'function' ? mod.embed(text) : undefined,
-        () => typeof mod.embedText === 'function' ? mod.embedText(text, model) : undefined,
-        () => typeof mod.Embedder === 'function' ? new mod.Embedder(model).embed(text) : undefined,
-    ];
-    for (const a of attempts) {
-        try {
-            const r = await a();
-            const v = toVec(r);
-            if (v)
-                return v;
-        }
-        catch { /* try next surface */ }
-    }
-    return null;
-}
-/**
- * Embed `text` with `model` via Lattice WASM. Returns null on any failure so the
- * caller can fall through to the next tier. Never throws.
- */
-export async function latticeEmbed(text, model = DEFAULT_LATTICE_MODEL) {
-    try {
-        if (!(await latticeAvailable()))
-            return null;
-        return await latticeEmbedRaw(text, model);
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=lattice-wasm.js.map