claude-flow 3.32.10 → 3.32.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.32.10",
+  "version": "3.32.12",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-26T22:06:31.105Z",
-  "gitSha": "8bc23e76",
+  "generatedAt": "2026-07-27T00:21:28.157Z",
+  "gitSha": "13a3421f",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/v3/@claude-flow/cli/dist/src/commands/swarm.js

@@ -300,12 +300,23 @@ const initCommand = {
             description: 'Enable V3 15-agent hierarchical mesh mode',
             type: 'boolean',
             default: false
-        }
+        },
+        {
+            // #2768 — dream-cycle SubagentPermissionDelegate. Ships a per-role
+            // capability manifest to `.swarm/permissions.jsonl` + an append-only
+            // audit trail. Task-tool prompts can consult the manifest; ruflo
+            // does NOT enforce at the syscall boundary (Claude Code owns that).
+            name: 'with-permissions',
+            description: 'Ship workspace-scoped permission manifest (preset: strict|standard|permissive) — dream-cycle #2768',
+            type: 'string',
+            choices: ['strict', 'standard', 'permissive'],
+        },
     ],
     action: async (ctx) => {
         let topology = ctx.flags.topology;
         const maxAgents = ctx.flags.maxAgents || 15;
         const v3Mode = ctx.flags.v3Mode;
+        const withPermissions = ctx.flags.withPermissions;
         // V3 mode enables hierarchical-mesh hybrid
         if (v3Mode) {
             topology = 'hierarchical-mesh';
@@ -377,6 +388,7 @@ const initCommand = {
                     maxAgents: result.config.maxAgents,
                     strategy: ctx.flags.strategy || 'development',
                     v3Mode,
+                    permissions: withPermissions ?? null,
                     initializedAt: result.initializedAt,
                     status: 'ready'
                 }, null, 2));
@@ -384,6 +396,35 @@ const initCommand = {
             catch {
                 // Ignore errors writing state file
             }
+            // #2768 — write the permission manifest + seed the audit trail.
+            // Optional: only fires when --with-permissions was passed. Missing
+            // module or failed I/O is non-critical; we log a dim warning and
+            // continue so a broken permission layer never blocks swarm init.
+            if (withPermissions) {
+                try {
+                    const [{ resolvePreset }, { writeGrants, appendAuditEvent }] = await Promise.all([
+                        import('../permission/permission-set.js'),
+                        import('../permission/permission-audit.js'),
+                    ]);
+                    const sets = resolvePreset(withPermissions);
+                    writeGrants(sets, swarmDir);
+                    for (const set of sets) {
+                        appendAuditEvent({
+                            agentId: 'swarm-init',
+                            role: set.role,
+                            event: 'granted',
+                            capability: `preset:${withPermissions}`,
+                            swarmId: result.swarmId,
+                            reason: `Initial grant from swarm init --with-permissions ${withPermissions}`,
+                        }, swarmDir);
+                    }
+                    output.writeln(output.dim(`  Wrote permission manifest (preset: ${withPermissions}, ${sets.length} roles) → .swarm/permissions.jsonl`));
+                    output.writeln(output.dim(`  Audit trail seeded → .swarm/permission-audit.jsonl`));
+                }
+                catch (err) {
+                    output.writeln(output.dim(`  ⚠ permission manifest skipped: ${err instanceof Error ? err.message : String(err)}`));
+                }
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
             }

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.js

@@ -1643,47 +1643,68 @@ export async function bridgeRecordFeedback(options) {
     try {
         let controller = 'none';
         let updated = 0;
-        // Try LearningSystem first (Phase 4)
-        const learningSystem = registry.get('learningSystem');
-        if (learningSystem) {
-            try {
-                if (typeof learningSystem.recordFeedback === 'function') {
-                    await learningSystem.recordFeedback({
-                        taskId: options.taskId, success: options.success, quality: options.quality,
-                        agent: options.agent, duration: options.duration, timestamp: Date.now(),
+        // Real intelligence-pipeline write (#2786 fix-3, 2026-07-26 sweep follow-up).
+        // The prior code called `learningSystem.recordFeedback/.record` and
+        // `reasoningBank.recordOutcome/.record` — none of those methods exist on
+        // the LocalSonaCoordinator / LocalReasoningBank instances the bridge
+        // actually wires into the registry (see initializeIntelligence in
+        // memory/intelligence.ts). The silent catch made it look successful.
+        //
+        // The REAL public API is `intelligence.recordTrajectory(steps, verdict)`
+        // — same call `hooks_post-command` already uses (hooks-tools.ts).
+        // It initializes lazily, embeds the step, and drives both the SONA
+        // coordinator and pattern distillation.
+        try {
+            const intelligence = await import('./intelligence.js');
+            const verdict = options.success ? 'success' : 'failure';
+            const recorded = await intelligence.recordTrajectory([{
+                    type: 'action',
+                    content: `Task ${options.taskId} completed by ${options.agent || 'unknown'} — success=${options.success}, quality=${options.quality.toFixed(3)}`,
+                    metadata: {
+                        taskId: options.taskId,
+                        agent: options.agent,
+                        quality: options.quality,
+                        duration: options.duration,
                         // ADR-147 P2: forward spawn-tree lineage if present
-                        parentAgentId: options.parentAgentId, depth: options.depth,
-                    });
-                    controller = 'learningSystem';
-                    updated++;
-                }
-                else if (typeof learningSystem.record === 'function') {
-                    await learningSystem.record(options.taskId, options.quality, options.success ? 'success' : 'failure');
-                    controller = 'learningSystem';
-                    updated++;
-                }
+                        parentAgentId: options.parentAgentId,
+                        depth: options.depth,
+                    },
+                    timestamp: Date.now(),
+                }], verdict);
+            if (recorded) {
+                controller = 'intelligence';
+                updated++;
             }
-            catch { /* API mismatch — skip */ }
         }
-        // Also record in ReasoningBank for pattern reinforcement
+        catch {
+            // Intelligence init failed (missing embeddings backend etc.). Fall
+            // through to the memory-store write below — that always succeeds via
+            // sql.js fallback so feedback is never fully lost.
+        }
+        // Optional pattern store: if the caller supplied learned patterns,
+        // add them to LocalReasoningBank via its real `.store()` method (the
+        // one method that DOES exist on the class).
         const reasoningBank = registry.get('reasoningBank');
-        if (reasoningBank) {
-            try {
-                if (typeof reasoningBank.recordOutcome === 'function') {
-                    await reasoningBank.recordOutcome({
-                        taskId: options.taskId, verdict: options.success ? 'success' : 'failure',
-                        score: options.quality, timestamp: Date.now(),
-                    });
-                    controller = controller === 'none' ? 'reasoningBank' : `${controller}+reasoningBank`;
-                    updated++;
-                }
-                else if (typeof reasoningBank.record === 'function') {
-                    await reasoningBank.record(options.taskId, options.quality);
-                    controller = controller === 'none' ? 'reasoningBank' : `${controller}+reasoningBank`;
-                    updated++;
+        if (reasoningBank && Array.isArray(options.patterns) && options.patterns.length) {
+            for (const pattern of options.patterns) {
+                try {
+                    if (typeof reasoningBank.store === 'function') {
+                        reasoningBank.store({
+                            id: `feedback-pattern-${options.taskId}-${updated}`,
+                            content: pattern,
+                            category: options.agent || 'general',
+                            confidence: options.quality,
+                            source: 'bridge-feedback',
+                        });
+                        updated++;
+                    }
                 }
+                catch { /* pattern rejected — non-critical */ }
             }
-            catch { /* API mismatch — skip */ }
+            if (updated > 0 && controller === 'intelligence')
+                controller = 'intelligence+reasoningBank';
+            else if (updated > 0 && controller === 'none')
+                controller = 'reasoningBank';
         }
         // Phase 4: SkillLibrary promotion for high-quality patterns
         if (options.success && options.quality >= 0.9 && options.patterns?.length) {

package/v3/@claude-flow/cli/dist/src/permission/permission-audit.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Append-only permission audit log for swarm subagents (dream-cycle #2768).
+ *
+ * Every grant / check / deny / revoke event is written to
+ * `.swarm/permission-audit.jsonl` — one JSON object per line, no rewrites,
+ * no deletes. Persistence follows the same discipline as ruflo's other
+ * append-only ledgers (routing-outcomes, funnel-events) so downstream
+ * readers can tail without truncation risk.
+ */
+/** A single permission-audit event. */
+export interface AuditEvent {
+    /** ISO-8601 timestamp. */
+    timestamp: string;
+    /** Opaque agent identifier — matches Task tool `name:` or a swarm-assigned slot id. */
+    agentId: string;
+    /** Symbolic role — matches PermissionSet.role. */
+    role: string;
+    /** Event class. */
+    event: 'granted' | 'checked' | 'denied' | 'revoked';
+    /** Free-form capability descriptor (`tool:Bash`, `path:src/**`, `net:api.github.com`). */
+    capability: string;
+    /** Optional swarm-scope identifier. */
+    swarmId?: string;
+    /** Optional human-readable reason. */
+    reason?: string;
+    /** Auto-generated event id for correlation. */
+    eventId: string;
+}
+/** Resolve `.swarm/permission-audit.jsonl` under the given (or cwd's) swarm dir. */
+export declare function auditLogPath(swarmDir?: string): string;
+/** Resolve `.swarm/permissions.jsonl` — the current-grants manifest. */
+export declare function grantsPath(swarmDir?: string): string;
+/** Append a single audit event. Never throws — failures are non-critical. */
+export declare function appendAuditEvent(event: Omit<AuditEvent, 'eventId' | 'timestamp'>, swarmDir?: string): void;
+/** Read every audit event. Used by review tooling. */
+export declare function readAuditLog(swarmDir?: string): AuditEvent[];
+/** Write the current grants manifest (overwrites) — one line per role. */
+export declare function writeGrants(grants: unknown[], swarmDir?: string): void;
+/** Read the current grants manifest. */
+export declare function readGrants(swarmDir?: string): unknown[];
+//# sourceMappingURL=permission-audit.d.ts.map

package/v3/@claude-flow/cli/dist/src/permission/permission-audit.js

@@ -0,0 +1,88 @@
+/**
+ * Append-only permission audit log for swarm subagents (dream-cycle #2768).
+ *
+ * Every grant / check / deny / revoke event is written to
+ * `.swarm/permission-audit.jsonl` — one JSON object per line, no rewrites,
+ * no deletes. Persistence follows the same discipline as ruflo's other
+ * append-only ledgers (routing-outcomes, funnel-events) so downstream
+ * readers can tail without truncation risk.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { randomBytes } from 'node:crypto';
+/** Resolve `.swarm/permission-audit.jsonl` under the given (or cwd's) swarm dir. */
+export function auditLogPath(swarmDir) {
+    const dir = swarmDir ?? path.join(process.cwd(), '.swarm');
+    return path.join(dir, 'permission-audit.jsonl');
+}
+/** Resolve `.swarm/permissions.jsonl` — the current-grants manifest. */
+export function grantsPath(swarmDir) {
+    const dir = swarmDir ?? path.join(process.cwd(), '.swarm');
+    return path.join(dir, 'permissions.jsonl');
+}
+function ensureDirFor(filePath) {
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+}
+/** Append a single audit event. Never throws — failures are non-critical. */
+export function appendAuditEvent(event, swarmDir) {
+    const full = {
+        ...event,
+        timestamp: new Date().toISOString(),
+        eventId: `evt-${Date.now()}-${randomBytes(4).toString('hex')}`,
+    };
+    try {
+        const p = auditLogPath(swarmDir);
+        ensureDirFor(p);
+        fs.appendFileSync(p, JSON.stringify(full) + '\n', 'utf-8');
+    }
+    catch {
+        /* audit log unavailable — non-critical, don't crash the caller */
+    }
+}
+/** Read every audit event. Used by review tooling. */
+export function readAuditLog(swarmDir) {
+    const p = auditLogPath(swarmDir);
+    if (!fs.existsSync(p))
+        return [];
+    const raw = fs.readFileSync(p, 'utf-8');
+    return raw
+        .split('\n')
+        .filter((line) => line.length > 0)
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((e) => e !== null);
+}
+/** Write the current grants manifest (overwrites) — one line per role. */
+export function writeGrants(grants, swarmDir) {
+    const p = grantsPath(swarmDir);
+    ensureDirFor(p);
+    fs.writeFileSync(p, grants.map((g) => JSON.stringify(g)).join('\n') + '\n', 'utf-8');
+}
+/** Read the current grants manifest. */
+export function readGrants(swarmDir) {
+    const p = grantsPath(swarmDir);
+    if (!fs.existsSync(p))
+        return [];
+    const raw = fs.readFileSync(p, 'utf-8');
+    return raw
+        .split('\n')
+        .filter((line) => line.length > 0)
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((g) => g !== null);
+}
+//# sourceMappingURL=permission-audit.js.map

package/v3/@claude-flow/cli/dist/src/permission/permission-set.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Workspace-scoped permission model for swarm subagents (dream-cycle #2768,
+ * ClawArena finding: privilege granting is the #1 orchestration bottleneck,
+ * no LLM > 50% workspace-permission precision as team lead).
+ *
+ * SCOPE (honest): this is a METADATA + AUDIT layer, not a runtime sandbox.
+ * Claude Code's Task tool owns the actual subprocess sandbox; ruflo cannot
+ * enforce at the syscall boundary. What we CAN do:
+ *   1. Publish a per-role capability manifest that Task-tool prompts can
+ *      consult ("your workspace-scoped tools are X, Y, Z; you may not use W").
+ *   2. Record every grant/check/deny/revoke to an append-only audit trail
+ *      so the swarm has a reviewable permission history.
+ *
+ * That is enough to close the "permission-hygiene" half of the ClawArena
+ * finding — the "50% precision as team lead" number is about the LLM's
+ * decision QUALITY, which no runtime layer fixes.
+ */
+import type { PathValidator } from '@claude-flow/security';
+/** A single agent role's capability envelope. */
+export interface PermissionSet {
+    /** Symbolic role name — matches ruflo agent-type names (coder, tester, reviewer, …). */
+    role: string;
+    /** Tools this role MAY use. Empty array = deny-all-tools. */
+    allowedTools: string[];
+    /** Tools this role MUST NOT use (evaluated after allow — deny wins). */
+    deniedTools: string[];
+    /** Glob patterns this role MAY read/write, relative to swarm cwd. */
+    allowedPaths: string[];
+    /** Glob patterns this role MUST NOT touch (deny wins). */
+    deniedPaths: string[];
+    /** Exact-host allowlist for outbound network. Empty = deny-all-network. */
+    allowedNetworkHosts: string[];
+    /** Human-readable note explaining the intent of this envelope. */
+    notes?: string;
+}
+/** Built-in presets, ordered narrow → wide. Each preset ships per-role sets. */
+export declare const PRESETS: Record<'strict' | 'standard' | 'permissive', PermissionSet[]>;
+export type PresetName = keyof typeof PRESETS;
+/**
+ * Resolve a preset name to its per-role sets. Throws on unknown preset —
+ * fail loud so a typo doesn't silently degrade to permissive.
+ */
+export declare function resolvePreset(name: string): PermissionSet[];
+/**
+ * Sanity-check a permission set: role name shape, no null entries.
+ * Path validation is deferred to the enforcement side (PathValidator)
+ * so this module has no @claude-flow/security runtime dep beyond a
+ * type-only import.
+ */
+export declare function validatePermissionSet(set: PermissionSet, _validator?: PathValidator): string[];
+//# sourceMappingURL=permission-set.d.ts.map

package/v3/@claude-flow/cli/dist/src/permission/permission-set.js

@@ -0,0 +1,141 @@
+/**
+ * Workspace-scoped permission model for swarm subagents (dream-cycle #2768,
+ * ClawArena finding: privilege granting is the #1 orchestration bottleneck,
+ * no LLM > 50% workspace-permission precision as team lead).
+ *
+ * SCOPE (honest): this is a METADATA + AUDIT layer, not a runtime sandbox.
+ * Claude Code's Task tool owns the actual subprocess sandbox; ruflo cannot
+ * enforce at the syscall boundary. What we CAN do:
+ *   1. Publish a per-role capability manifest that Task-tool prompts can
+ *      consult ("your workspace-scoped tools are X, Y, Z; you may not use W").
+ *   2. Record every grant/check/deny/revoke to an append-only audit trail
+ *      so the swarm has a reviewable permission history.
+ *
+ * That is enough to close the "permission-hygiene" half of the ClawArena
+ * finding — the "50% precision as team lead" number is about the LLM's
+ * decision QUALITY, which no runtime layer fixes.
+ */
+/** Built-in presets, ordered narrow → wide. Each preset ships per-role sets. */
+export const PRESETS = {
+    /**
+     * strict — read-only file access, no network, no bash. Suitable for
+     * research / review / planning agents. Denies every destructive surface.
+     */
+    strict: [
+        {
+            role: 'researcher',
+            allowedTools: ['Read', 'Grep', 'Glob'],
+            deniedTools: ['Bash', 'Edit', 'Write', 'NotebookEdit'],
+            allowedPaths: ['**/*'],
+            deniedPaths: ['**/.env', '**/.env.*', '**/secrets/**', '**/*.key', '**/*.pem'],
+            allowedNetworkHosts: [],
+            notes: 'Read-only research role; no filesystem writes, no network, no shell.',
+        },
+        {
+            role: 'reviewer',
+            allowedTools: ['Read', 'Grep', 'Glob'],
+            deniedTools: ['Bash', 'Edit', 'Write', 'NotebookEdit'],
+            allowedPaths: ['**/*'],
+            deniedPaths: ['**/.env', '**/.env.*', '**/secrets/**', '**/*.key', '**/*.pem'],
+            allowedNetworkHosts: [],
+            notes: 'Read-only code review; findings emitted via return message, not filesystem writes.',
+        },
+        {
+            role: 'planner',
+            allowedTools: ['Read', 'Grep', 'Glob'],
+            deniedTools: ['Bash', 'Edit', 'Write', 'NotebookEdit'],
+            allowedPaths: ['**/*'],
+            deniedPaths: ['**/.env', '**/.env.*', '**/secrets/**', '**/*.key', '**/*.pem'],
+            allowedNetworkHosts: [],
+            notes: 'Read-only planning; produces plan text, no side effects.',
+        },
+    ],
+    /**
+     * standard — the default. Read + edit under cwd, no bash, allowlisted
+     * network hosts for common dev workflows (github, npm registry, docs).
+     * Suitable for implementation agents doing bounded file changes.
+     */
+    standard: [
+        {
+            role: 'coder',
+            allowedTools: ['Read', 'Grep', 'Glob', 'Edit', 'Write', 'NotebookEdit'],
+            deniedTools: ['Bash'],
+            allowedPaths: ['src/**', 'tests/**', '__tests__/**', 'lib/**', 'plugins/**', 'v3/**', 'docs/**', 'CHANGELOG.md', 'package.json'],
+            deniedPaths: ['**/.env', '**/.env.*', '**/secrets/**', '**/*.key', '**/*.pem', '**/.git/**', '**/node_modules/**'],
+            allowedNetworkHosts: ['api.github.com', 'registry.npmjs.org', 'docs.rs', 'crates.io'],
+            notes: 'Bounded code writer; edits under source directories, no shell, allowlist network.',
+        },
+        {
+            role: 'tester',
+            allowedTools: ['Read', 'Grep', 'Glob', 'Edit', 'Write'],
+            deniedTools: ['Bash', 'NotebookEdit'],
+            allowedPaths: ['tests/**', '__tests__/**', '**/*.test.*', '**/*.spec.*'],
+            deniedPaths: ['**/.env', '**/.env.*', '**/secrets/**', '**/*.key', '**/*.pem'],
+            allowedNetworkHosts: [],
+            notes: 'Tests-only writer; scope pinned to test directories and .test/.spec files.',
+        },
+        {
+            role: 'reviewer',
+            allowedTools: ['Read', 'Grep', 'Glob'],
+            deniedTools: ['Bash', 'Edit', 'Write', 'NotebookEdit'],
+            allowedPaths: ['**/*'],
+            deniedPaths: ['**/.env', '**/.env.*', '**/secrets/**', '**/*.key', '**/*.pem'],
+            allowedNetworkHosts: [],
+            notes: 'Read-only reviewer; identical to strict-reviewer.',
+        },
+    ],
+    /**
+     * permissive — the pre-#2768 baseline. Full toolset, no path fencing.
+     * Kept for compatibility so users can opt back in explicitly. NOT a
+     * good default — the entire point of this feature is that the LLM's
+     * unaided permission decisions land under 50% precision.
+     */
+    permissive: [
+        {
+            role: '*',
+            allowedTools: ['*'],
+            deniedTools: [],
+            allowedPaths: ['**/*'],
+            deniedPaths: [],
+            allowedNetworkHosts: ['*'],
+            notes: 'No restriction. Kept for opt-in compatibility; see #2768 for why this is not the default.',
+        },
+    ],
+};
+/**
+ * Resolve a preset name to its per-role sets. Throws on unknown preset —
+ * fail loud so a typo doesn't silently degrade to permissive.
+ */
+export function resolvePreset(name) {
+    if (!(name in PRESETS)) {
+        const valid = Object.keys(PRESETS).join(', ');
+        throw new Error(`Unknown permissions preset: ${name}. Valid presets: ${valid}`);
+    }
+    return PRESETS[name];
+}
+/**
+ * Sanity-check a permission set: role name shape, no null entries.
+ * Path validation is deferred to the enforcement side (PathValidator)
+ * so this module has no @claude-flow/security runtime dep beyond a
+ * type-only import.
+ */
+export function validatePermissionSet(set, _validator) {
+    const errors = [];
+    if (!set.role || typeof set.role !== 'string')
+        errors.push('role must be a non-empty string');
+    const arrays = [
+        ['allowedTools', set.allowedTools],
+        ['deniedTools', set.deniedTools],
+        ['allowedPaths', set.allowedPaths],
+        ['deniedPaths', set.deniedPaths],
+        ['allowedNetworkHosts', set.allowedNetworkHosts],
+    ];
+    for (const [key, val] of arrays) {
+        if (!Array.isArray(val))
+            errors.push(`${String(key)} must be an array`);
+        else if (val.some((v) => typeof v !== 'string'))
+            errors.push(`${String(key)} must contain only strings`);
+    }
+    return errors;
+}
+//# sourceMappingURL=permission-set.js.map

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.10",
+  "version": "3.32.12",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",