claude-flow 3.30.2 → 3.30.4

package/.claude/helpers/hidden-hook.vbs

@@ -0,0 +1,43 @@
+' hidden-hook.vbs — Windowless launcher for Claude Code hooks on Windows.
+'
+' Workaround for anthropics/claude-code#14828 / #70200 — Claude Code's
+' child_process.spawn for hook commands is missing windowsHide/CREATE_NO_WINDOW,
+' so every hook fire flashes a visible cmd.exe window. This shim is invoked via
+' wscript.exe (a GUI-subsystem host with no console), so Claude Code's outer
+' spawn attaches no console. Internally it runs node hidden via
+' WScript.Shell.Run(cmd, 0, True).
+'
+' Usage from settings.local.json:
+'   "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" hook-handler.cjs pre-bash"
+'
+' TRADE-OFF: wscript.exe has no stdin. Claude Code sends hook event data as
+' JSON via stdin, so hooks routed through this shim run WITHOUT their event
+' payload. Most ruflo hooks (env-var driven) still work; hooks like `route`
+' that need the user's prompt will have reduced context.
+'
+' Exit code from the wrapped node process is propagated back to Claude Code.
+
+Option Explicit
+
+If WScript.Arguments.Count < 1 Then
+    WScript.Quit 2
+End If
+
+Dim shell, cmd, i, arg
+Set shell = CreateObject("WScript.Shell")
+
+' Resolve helpers dir from this script's own path (avoids env-var dependency)
+Dim scriptDir
+scriptDir = Left(WScript.ScriptFullName, InStrRev(WScript.ScriptFullName, "\"))
+
+' First arg is the hook-handler script name (e.g. "hook-handler.cjs"),
+' remaining args are passed through to node.
+cmd = "node """ & scriptDir & WScript.Arguments(0) & """"
+For i = 1 To WScript.Arguments.Count - 1
+    arg = WScript.Arguments(i)
+    arg = Replace(arg, """", "\""")
+    cmd = cmd & " """ & arg & """"
+Next
+
+' 0 = SW_HIDE, True = wait for completion (propagates exit code synchronously)
+WScript.Quit shell.Run(cmd, 0, True)

package/.claude/helpers/hook-handler.cjs

@@ -89,6 +89,10 @@ function spawnDetachedHookRefresh(subcommand) {
       detached: true,
       stdio: 'ignore',
       env: process.env,
+      // Windows: without this, npx.cmd's cmd.exe wrapper flashes a visible
+      // console window every time a hook fires a background refresh. Runs
+      // hidden instead. No-op on POSIX.
+      windowsHide: true,
     });
     child.unref();
   } catch (e) { /* best-effort only */ }
@@ -98,105 +102,6 @@ function spawnDetachedFunnelRefresh() {
   spawnDetachedHookRefresh('refresh-funnel');
 }
 
-// ADR-318/319: first-run auto-enable of spinner verbs (default ON) +
-// announcements (default OFF, explicit opt-in). Fires ONCE per install
-// (marker at ~/.ruflo/first-run-enabled.json), then never again —
-// subsequent sessions see the marker and skip.
-//
-// Split posture rationale:
-//   - Spinner verbs = low-intrusion (per-spin flash, append-mode mix
-//     with Claude Code defaults, moderate visibility over time). Default ON.
-//     Disclosure notification + one-command disable satisfies the ethical bar.
-//   - Announcements = higher-intrusion (prominent line at every Claude Code
-//     startup, more attention per view). Default OFF; opt-in via
-//     RUFLO_AUTO_ENABLE_ANNOUNCEMENTS=1 or explicit `ruflo announcements enable`.
-//
-// Gates (spinner is default-on unless any is TRUE):
-//   - RUFLO_NO_AUTO_ENABLE truthy (master opt-out — kills both)
-//   - RUFLO_NO_AUTO_ENABLE_SPINNER truthy (spinner-only opt-out)
-//   - CI / GITHUB_ACTIONS truthy
-//   - stdout is not a TTY (piped, non-interactive)
-//   - Marker file already exists
-//
-// Announcements needs the same gates PLUS RUFLO_AUTO_ENABLE_ANNOUNCEMENTS=1.
-//
-// Marker is written even if the spawns fail — auto-enable is a "we tried once"
-// contract, not "keep trying until success." Users can run enable manually.
-function firstRunAutoEnableIfEligible() {
-  try {
-    const path = require('path');
-    const fs = require('fs');
-    const os = require('os');
-    const truthy = (v) => v && !/^(0|false|off|no)$/i.test(String(v));
-    if (truthy(process.env.RUFLO_NO_AUTO_ENABLE)) return;
-    if (process.env.CI || process.env.GITHUB_ACTIONS) return;
-    if (process.stdout && process.stdout.isTTY === false) return;
-    const markerPath = path.join(os.homedir(), '.ruflo', 'first-run-enabled.json');
-    if (fs.existsSync(markerPath)) return;
-
-    const enableSpinner = !truthy(process.env.RUFLO_NO_AUTO_ENABLE_SPINNER);
-    const enableAnnouncements = truthy(process.env.RUFLO_AUTO_ENABLE_ANNOUNCEMENTS);
-
-    // Nothing to do — user opted out of both. Skip marker write so if they
-    // change their mind and re-enable env vars later, first-run still fires.
-    if (!enableSpinner && !enableAnnouncements) return;
-
-    // Spawn the enable commands detached + non-blocking. Any failure
-    // (missing CLI, refused state, etc.) is silent — auto-enable is
-    // best-effort and MUST NOT block session-restore. Uses execPath +
-    // resolved cli.js directly rather than spawnDetachedHookRefresh
-    // because that helper hardcodes 'hooks' as the top-level command.
-    const { spawn } = require('child_process');
-    const cliBin = resolveCliBinForHook();
-    const runDetached = (args) => {
-      try {
-        const spawnArgs = cliBin
-          ? [process.execPath, [cliBin, ...args]]
-          : [process.platform === 'win32' ? 'npx.cmd' : 'npx',
-             ['--prefer-offline', '@claude-flow/cli', ...args]];
-        const child = spawn(spawnArgs[0], spawnArgs[1], {
-          detached: true, stdio: 'ignore', env: process.env, windowsHide: true,
-        });
-        child.unref();
-      } catch { /* best-effort */ }
-    };
-    if (enableSpinner) runDetached(['spinner', 'enable', '--yes']);
-    if (enableAnnouncements) runDetached(['announcements', 'enable', '--yes']);
-
-    try {
-      fs.mkdirSync(path.dirname(markerPath), { recursive: true, mode: 0o700 });
-      fs.writeFileSync(
-        markerPath,
-        JSON.stringify({
-          _ts: Date.now(),
-          source: 'session-restore-hook',
-          enabled: { spinner: enableSpinner, announcements: enableAnnouncements },
-        }, null, 2),
-        { encoding: 'utf-8', mode: 0o600 }
-      );
-    } catch { /* ignore — best effort */ }
-
-    // Notification tells user exactly what happened. stderr so it doesn't
-    // corrupt any downstream JSON stdout consumer.
-    try {
-      const parts = [];
-      if (enableSpinner) parts.push('spinner verbs');
-      if (enableAnnouncements) parts.push('startup announcements');
-      const disableCmds = [];
-      if (enableSpinner) disableCmds.push('`ruflo spinner disable`');
-      if (enableAnnouncements) disableCmds.push('`ruflo announcements disable`');
-      process.stderr.write(
-        '[ruflo] First-run: enabled ' + parts.join(' + ') + '. ' +
-        'Disable anytime with ' + disableCmds.join(' / ') + '. ' +
-        (enableSpinner && !enableAnnouncements
-          ? 'Announcements stay opt-in — set RUFLO_AUTO_ENABLE_ANNOUNCEMENTS=1 to enable those too. '
-          : '') +
-        'Restart Claude Code once to see the changes take effect.\n'
-      );
-    } catch { /* ignore */ }
-  } catch { /* auto-enable must never break session-restore */ }
-}
-
 // Same fallback-aware pattern as spawnDetachedFunnelRefresh() above, for
 // ADR-316's co-pilot advisor tip. Safe to call on EVERY session-restore:
 // refresh-advisor's own action checks consent + a 24h TTL BEFORE spending
@@ -444,11 +349,6 @@ const handlers = {
   },
 
   'session-restore': async () => {
-    // ADR-318/319 first-run auto-enable — fire once per install, never
-    // re-fires after user disables. Respects RUFLO_NO_AUTO_ENABLE + CI.
-    // Fully non-blocking (detached spawn) so session-restore latency
-    // is unchanged.
-    firstRunAutoEnableIfEligible();
     if (session) {
       // Try restore first, fall back to start
       const existing = session.restore && session.restore();

package/.claude/settings.json

@@ -1,6 +1,5 @@
 {
-  "model": "claude-opus-4-7",
-  "_comment_skillListingBudgetFraction": "#1834 — repo has 367 SKILL.md files (5x duplicates of common skills) across .agents/skills, .claude/skills, archive/v2/.claude/skills, v3/@claude-flow/{cli,mcp}/.claude/skills. With Claude Code's default 1% budget, ~378 descriptions get truncated. Bumping to 6% covers the actual usage (5.5%). Long-term fix is to prune the duplicates and archive paths (see #1834).",
+  "model": "claude-sonnet-5",
   "skillListingBudgetFraction": 0.06,
   "customInstructions": "Follow the project's CLAUDE.md guidelines. Use concurrent execution for all operations. Prioritize v3 implementation with security-first development, 15-agent swarm coordination, phased performance optimization, and cross-platform helper automation.",
   "env": {
@@ -166,7 +165,7 @@
     "version": "3.6.11",
     "enabled": true,
     "modelPreferences": {
-      "default": "claude-opus-4-7",
+      "default": "claude-sonnet-5",
       "routing": "claude-haiku-4-5-20251001"
     },
     "agentTeams": {

package/.claude/settings.local.json

@@ -0,0 +1,78 @@
+{
+  "_comment": "Windows-only override — routes HOOKS through wscript.exe hidden-hook.vbs to work around anthropics/claude-code#14828 / #70200 (missing windowsHide/CREATE_NO_WINDOW on hook spawns). Gitignored; delete or empty to restore normal .claude/settings.json behavior. Trade-offs: (1) wscript has no stdin/stdout, so hooks routed through here run without their JSON event payload and cannot print output back to Claude Code — most ruflo hooks tolerate this. (2) statusLine is NOT overridden here because it requires stdout; it falls back to .claude/settings.json's direct node invocation, which will still flash on Windows until Claude Code adds windowsHide to its statusLine spawn. See .claude/helpers/hidden-hook.vbs.",
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" hook-handler.cjs pre-bash",
+            "timeout": 5000
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" hook-handler.cjs post-edit",
+            "timeout": 10000
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" hook-handler.cjs route",
+            "timeout": 10000
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" hook-handler.cjs session-restore",
+            "timeout": 15000
+          },
+          {
+            "type": "command",
+            "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" auto-memory-hook.mjs import",
+            "timeout": 8000
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" hook-handler.cjs session-end",
+            "timeout": 10000
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" auto-memory-hook.mjs sync",
+            "timeout": 10000
+          }
+        ]
+      }
+    ]
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.30.2",
+  "version": "3.30.4",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-14T20:51:31.912Z",
-  "gitSha": "5fb50348",
+  "generatedAt": "2026-07-15T15:16:42.332Z",
+  "gitSha": "3e9122a3",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/v3/@claude-flow/cli/dist/src/init/settings-generator.js

@@ -52,8 +52,8 @@ export function generateSettings(options) {
         };
     }
     // Note: Claude Code expects 'model' to be a string, not an object
-    // Model preferences are stored in claudeFlow settings instead
-    // settings.model = 'claude-sonnet-4-5-20250929'; // Uncomment if you want to set a default model
+    // Additional ruflo-specific model preferences live in claudeFlow.modelPreferences below
+    settings.model = 'claude-sonnet-5';
     // Add Agent Teams configuration (experimental feature)
     settings.env = {
         // Enable Claude Code Agent Teams for multi-agent coordination
@@ -74,7 +74,7 @@ export function generateSettings(options) {
             shell: platform.shell,
         },
         modelPreferences: {
-            default: 'claude-opus-4-8',
+            default: 'claude-sonnet-5',
             routing: 'claude-haiku-4-5-20251001',
         },
         agentTeams: {

package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.d.ts

@@ -33,7 +33,7 @@ export interface AgentRecord {
     openrouterModel?: string;
     lastResult?: Record<string, unknown>;
 }
-export declare const DEFAULT_ANTHROPIC_MODEL = "claude-sonnet-4-6";
+export declare const DEFAULT_ANTHROPIC_MODEL = "claude-sonnet-5";
 export declare function modelRejectsSamplingParams(model: string): boolean;
 export interface AnthropicCallInput {
     prompt: string;

package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js

@@ -35,13 +35,15 @@ function saveAgentStore(store) {
 // #1906/#2232 — Current model ids (Claude 4.x family):
 //   Opus 4.8    → claude-opus-4-8   (current, the `opus` alias)
 //   Opus 4.7    → claude-opus-4-7   (prior pin, reachable via `opus-4.7`)
-//   Sonnet 4.6  → claude-sonnet-4-6
+//   Sonnet 5    → claude-sonnet-5   (current, the `sonnet` alias)
+//   Sonnet 4.6  → claude-sonnet-4-6 (prior pin, reachable via `sonnet-4.6`)
 //   Haiku 4.5   → claude-haiku-4-5-20251001
-// `inherit` and the various defaults below all map to Sonnet 4.6.
-export const DEFAULT_ANTHROPIC_MODEL = 'claude-sonnet-4-6';
+// `inherit` and the various defaults below all map to Sonnet 5.
+export const DEFAULT_ANTHROPIC_MODEL = 'claude-sonnet-5';
 const MODEL_MAP = {
     haiku: 'claude-haiku-4-5-20251001',
-    sonnet: 'claude-sonnet-4-6',
+    sonnet: 'claude-sonnet-5',
+    'sonnet-4.6': 'claude-sonnet-4-6',
     opus: 'claude-opus-4-8',
     'opus-4.7': 'claude-opus-4-7',
     inherit: DEFAULT_ANTHROPIC_MODEL,

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.30.2",
+  "version": "3.30.4",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",