claude-flow 3.32.2 → 3.32.8

package/.claude/helpers/statusline.cjs

@@ -26,11 +26,11 @@ const { execSync } = require('child_process');
 const os = require('os');
 
 // Configuration
-const CONFIG = {
-  maxAgents: 15,
-  // Header identity defaults to project/repository name. Set `author` to
-  // retain the previous `git config user.name` display (#2682).
-  identityMode: (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase(),
+const CONFIG = {
+  maxAgents: 15,
+  // Header identity defaults to project/repository name. Set `author` to
+  // retain the previous `git config user.name` display (#2682).
+  identityMode: (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase(),
   // Session-cost display. Claude Code's cost.total_cost_usd is a client-side
   // estimate that "may differ from your actual bill" and reads as misleading on
   // subscription plans, where token usage is not billed per dollar. These let
@@ -213,9 +213,9 @@ function getStatuslineData() {
   // 60s TTL (#2337 — don't re-spawn the CLI on every rapid re-render) AND the
   // tighter promo-rotation clock (this fix — don't let a still-fresh 60s
   // cache silently freeze the promo/insight row across multiple 20s slots).
-  if (cache.fresh && cache.promoFresh) {
-    return applyLocalOverlays(overlayMemoPromo(cache.data));
-  }
+  if (cache.fresh && cache.promoFresh) {
+    return applyLocalOverlays(overlayMemoPromo(cache.data));
+  }
 
   // #2337: prefer an already-installed CLI bin via direct `node` invocation —
   // no npx, no registry round-trip, no @latest re-resolve per render. Try
@@ -422,7 +422,7 @@ function buildLocalFallback() {
   return applyLocalOverlays({
     user: { name: 'user', gitBranch: '', modelName: 'Claude Code' },
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
-    security: { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 },
+    security: { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
     system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
     lastUpdated: new Date().toISOString(),
@@ -479,16 +479,16 @@ function readJSON(filePath) {
 
 // ─── Git info (pure-Node / single exec — needed for branch display) ──────────
 
-function getGitInfo() {
-  const result = {
-    name: path.basename(CWD) || 'project', gitBranch: '', modified: 0, untracked: 0,
-    staged: 0, ahead: 0, behind: 0,
-  };
-
-  const script = [
-    'git rev-parse --show-toplevel 2>/dev/null || pwd',
-    'echo "---SEP---"',
-    'git config user.name 2>/dev/null || echo user',
+function getGitInfo() {
+  const result = {
+    name: path.basename(CWD) || 'project', gitBranch: '', modified: 0, untracked: 0,
+    staged: 0, ahead: 0, behind: 0,
+  };
+
+  const script = [
+    'git rev-parse --show-toplevel 2>/dev/null || pwd',
+    'echo "---SEP---"',
+    'git config user.name 2>/dev/null || echo user',
     'echo "---SEP---"',
     'git branch --show-current 2>/dev/null',
     'echo "---SEP---"',
@@ -501,14 +501,14 @@ function getGitInfo() {
   if (!raw) return result;
 
   const parts = raw.split('---SEP---').map(function(s) { return s.trim(); });
-  if (parts.length >= 5) {
-    const projectName = path.basename(parts[0] || CWD) || path.basename(CWD) || 'project';
-    const authorName = parts[1] || 'user';
-    result.name = CONFIG.identityMode === 'author' ? authorName : projectName;
-    result.gitBranch = parts[2] || '';
-
-    if (parts[3]) {
-      for (const line of parts[3].split('\n')) {
+  if (parts.length >= 5) {
+    const projectName = path.basename(parts[0] || CWD) || path.basename(CWD) || 'project';
+    const authorName = parts[1] || 'user';
+    result.name = CONFIG.identityMode === 'author' ? authorName : projectName;
+    result.gitBranch = parts[2] || '';
+
+    if (parts[3]) {
+      for (const line of parts[3].split('\n')) {
         if (!line || line.length < 2) continue;
         const x = line[0], y = line[1];
         if (x === '?' && y === '?') { result.untracked++; continue; }
@@ -517,7 +517,7 @@ function getGitInfo() {
       }
     }
 
-    const ab = (parts[4] || '0 0').split(/\s+/);
+    const ab = (parts[4] || '0 0').split(/\s+/);
     result.ahead = parseInt(ab[0]) || 0;
     result.behind = parseInt(ab[1]) || 0;
   }
@@ -731,7 +731,7 @@ function generateStatusline() {
   const intelligencePct = system.intelligencePct || 0;
   const memoryMB = system.memoryMB || 0;
   const subAgents = system.subAgents || 0;
-  const findings = Math.max(0, security.findings || 0);
+  const findings = Math.max(0, security.findings || 0);
   const secStatus = security.status || 'NONE';
   const adrCount = adrs.count || 0;
   const adrImpl = adrs.implemented || 0;
@@ -786,7 +786,7 @@ function generateStatusline() {
   const hooksColor = hooksEnabled > 0 ? c.brightGreen : c.dim;
   const intellColor = intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
   const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset + ' ' : c.dim + '○' + c.reset + ' ';
-  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && findings === 0;
+  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && findings === 0;
   const opsParts = [];
   opsParts.push(c.cyan + 'Swarm ' + swarmInd + agentsColor + activeAgents + c.reset + '/' + c.brightWhite + maxAgents + c.reset);
   if (subAgents > 0) opsParts.push(c.brightPurple + '👥 ' + subAgents + c.reset);
@@ -797,14 +797,14 @@ function generateStatusline() {
   if (healthAllGreen) {
     opsParts.push(c.brightGreen + '🛡 ✓' + c.reset);
   } else {
-    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
-    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
-    else if (secStatus === 'ISSUES') opsParts.push(c.brightRed + '🛡 findings' + c.reset);
-    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
-    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
-    if (findings > 0) {
-      opsParts.push(c.brightRed + '⚠ ' + findings + ' finding' + (findings === 1 ? '' : 's') + c.reset);
-    }
+    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
+    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
+    else if (secStatus === 'ISSUES') opsParts.push(c.brightRed + '🛡 findings' + c.reset);
+    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
+    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
+    if (findings > 0) {
+      opsParts.push(c.brightRed + '⚠ ' + findings + ' finding' + (findings === 1 ? '' : 's') + c.reset);
+    }
   }
   lines.push(opsParts.join('  ' + c.dim + '·' + c.reset + '  '));
 

package/.claude-plugin/scripts/ruflo-hook.cjs

@@ -14,7 +14,7 @@
  * Behaviour mirrors ruflo-hook.sh:
  *   1. Reads hook JSON payload from stdin.
  *   2. Prefers a locally installed `ruflo` or `claude-flow` binary.
- *   3. Falls back to `npx --prefer-offline ruflo@latest`.
+ *   3. Falls back to `npx --prefer-offline ruflo@latest`.
  *   4. Always exits 0 — hook subcommands are best-effort telemetry.
  *   5. Swallows all stderr — nothing should surface to Claude Code.
  *
@@ -157,7 +157,7 @@ function main() {
   // a spurious failure even though the shim itself works correctly.
   // The bash version doesn't hit this because it backgrounded the work.
   if (process.env.RUFLO_HOOK_SKIP_NPX !== '1') {
-    invokeHook('npx', ['--prefer-offline', '--yes', 'ruflo@latest'], hookArgs, stdinData);
+    invokeHook('npx', ['--prefer-offline', '--yes', 'ruflo@latest'], hookArgs, stdinData);
   }
 
   done();

package/.claude-plugin/scripts/ruflo-hook.sh

@@ -24,29 +24,29 @@
 # so redirecting it is a pure cleanup with no functional cost.
 exec 1>/dev/null 2>/dev/null
 
-# Bound every hook process. A partially initialized native embedding pool can
-# otherwise keep a logically completed Stop hook alive indefinitely (#2691).
-run() {
-  "$@" &
-  child=$!
-  (
-    sleep 15
-    kill -TERM "$child" 2>/dev/null || true
-    sleep 1
-    kill -KILL "$child" 2>/dev/null || true
-  ) &
-  watchdog=$!
-  wait "$child" 2>/dev/null || true
-  kill "$watchdog" 2>/dev/null || true
-  wait "$watchdog" 2>/dev/null || true
-}
+# Bound every hook process. A partially initialized native embedding pool can
+# otherwise keep a logically completed Stop hook alive indefinitely (#2691).
+run() {
+  "$@" &
+  child=$!
+  (
+    sleep 15
+    kill -TERM "$child" 2>/dev/null || true
+    sleep 1
+    kill -KILL "$child" 2>/dev/null || true
+  ) &
+  watchdog=$!
+  wait "$child" 2>/dev/null || true
+  kill "$watchdog" 2>/dev/null || true
+  wait "$watchdog" 2>/dev/null || true
+}
 
 if command -v ruflo >/dev/null 2>&1; then
   run ruflo hooks "$@"
 elif command -v claude-flow >/dev/null 2>&1; then
   run claude-flow hooks "$@"
 else
-  run npx --prefer-offline --yes ruflo@latest hooks "$@"
+  run npx --prefer-offline --yes ruflo@latest hooks "$@"
 fi
 
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.32.2",
+  "version": "3.32.8",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-17T04:00:15.717Z",
-  "gitSha": "61047df4",
+  "generatedAt": "2026-07-18T22:28:26.547Z",
+  "gitSha": "fb2f92bb",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/v3/@claude-flow/cli/dist/src/auth/client.d.ts

@@ -0,0 +1,89 @@
+/**
+ * `ruflo auth login` flow orchestration (ADR-306) — composes
+ * `@claude-flow/security`'s ported OAuth primitives (loopback PKCE, OOB
+ * manual-paste, refresh) the same way meta-proxy's `oauth/login.rs`
+ * orchestrates its own Rust primitives. See security-bridge.ts for why the
+ * package is loaded lazily, and oauth/client.ts (in @claude-flow/security)
+ * for why this targets the live `auth.cognitum.one` surface rather than
+ * ADR-308's unconfirmed `/v1/auth/*` spec.
+ *
+ * @module auth/client
+ */
+import { type OAuthTokenResponse } from './security-bridge.js';
+/** Refresh before there is less than one minute left on the access token. */
+export declare const ACCESS_TOKEN_REFRESH_WINDOW_MS = 60000;
+export interface LoginResult {
+    tokens: OAuthTokenResponse;
+    method: 'pkce' | 'device' | 'token-stdin';
+}
+/**
+ * Best-effort headlessness signal — a false negative just means the browser
+ * flow is attempted and a real browser opens fine anyway; a false positive
+ * means the user falls back to the manual OOB flow, which always works
+ * regardless. Mirrors meta-proxy's `login.rs::is_probably_headless()`.
+ */
+export declare function isProbablyHeadless(): boolean;
+/**
+ * Validates the OAuth callback params against the request that started the
+ * flow — the CSRF-critical step, extracted so it's independently testable.
+ * Order matters: an explicit `error` (user denied) and a missing code are
+ * reported as their own reasons; a missing or mismatched `state` is always
+ * a state-mismatch, even when a code is present.
+ */
+export declare function validateCallback(error: string | null, code: string | null, returnedState: string | null, expectedState: string): {
+    ok: true;
+    code: string;
+} | {
+    ok: false;
+    reason: 'denied' | 'state-mismatch';
+    detail?: string;
+};
+export declare class LoginCancelledError extends Error {
+    constructor();
+}
+export declare class LoginDeniedError extends Error {
+    constructor(detail: string);
+}
+export declare class StateMismatchError extends Error {
+    constructor();
+}
+export declare class NotLoggedInError extends Error {
+    constructor(profile: string);
+}
+export declare class SessionOnlyExpiredError extends Error {
+    constructor(profile: string);
+}
+export declare class ScopeConsentMismatchError extends Error {
+    constructor(profile: string, scopes: string[]);
+}
+/** Browser-based loopback PKCE login — the ADR-306 default for an interactive desktop. */
+export declare function browserLogin(print: (line: string) => void): Promise<LoginResult>;
+/** Headless fallback: prints the authorize URL with the OOB redirect, prompts for the pasted code. */
+export declare function manualLogin(print: (line: string) => void, input?: NodeJS.ReadableStream): Promise<LoginResult>;
+/**
+ * `--token-stdin`: reads one JSON object from stdin,
+ * `{access_token, refresh_token?, expires_in, scope}`. Wire format is not
+ * specified by ADR-306 — defined here as typed JSON rather than a bare
+ * token string, so scope/expiry are explicit rather than inferred.
+ */
+export declare function tokenStdinLogin(input?: NodeJS.ReadableStream): Promise<LoginResult>;
+/**
+ * Refreshes an access token. Classifies failure into network-unreachable
+ * vs. a reachable-but-erroring server so callers can print an honest
+ * message instead of collapsing both into "offline" (ADR-308 failure
+ * policy: local ruflo functionality is never affected by auth being
+ * unavailable, but the diagnostic should say WHY it's unavailable).
+ */
+export declare function refreshAccessToken(refreshTokenValue: string): Promise<OAuthTokenResponse>;
+/**
+ * Returns an access token suitable for an authenticated call.
+ *
+ * Fast path: a process-memory token with more than one minute remaining.
+ * Slow path: load the profile's refresh token from the OS keychain, perform
+ * one refresh, persist a rotated refresh token BEFORE exposing the new access
+ * token, then update metadata and the process cache. Refresh is deliberately
+ * demand-driven: offline-safe commands such as plain `auth status` never call
+ * this function and therefore never create background traffic or retry loops.
+ */
+export declare function getValidAccessToken(profileName?: string): Promise<string>;
+//# sourceMappingURL=client.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/client.js

@@ -0,0 +1,242 @@
+/**
+ * `ruflo auth login` flow orchestration (ADR-306) — composes
+ * `@claude-flow/security`'s ported OAuth primitives (loopback PKCE, OOB
+ * manual-paste, refresh) the same way meta-proxy's `oauth/login.rs`
+ * orchestrates its own Rust primitives. See security-bridge.ts for why the
+ * package is loaded lazily, and oauth/client.ts (in @claude-flow/security)
+ * for why this targets the live `auth.cognitum.one` surface rather than
+ * ADR-308's unconfirmed `/v1/auth/*` spec.
+ *
+ * @module auth/client
+ */
+import * as readline from 'node:readline/promises';
+import { existsSync } from 'node:fs';
+import { loadSecurityOAuth } from './security-bridge.js';
+import { KEYCHAIN_SERVICE } from './constants.js';
+import { getProfile, setProfile } from './state.js';
+import { getSessionToken, setSessionToken } from './session.js';
+import { hasConsent } from '../funnel/index.js';
+import { domainForScope } from './scopes.js';
+/** Refresh before there is less than one minute left on the access token. */
+export const ACCESS_TOKEN_REFRESH_WINDOW_MS = 60_000;
+/**
+ * Best-effort headlessness signal — a false negative just means the browser
+ * flow is attempted and a real browser opens fine anyway; a false positive
+ * means the user falls back to the manual OOB flow, which always works
+ * regardless. Mirrors meta-proxy's `login.rs::is_probably_headless()`.
+ */
+export function isProbablyHeadless() {
+    return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.CONTAINER || existsDockerEnv());
+}
+function existsDockerEnv() {
+    try {
+        return existsSync('/.dockerenv');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validates the OAuth callback params against the request that started the
+ * flow — the CSRF-critical step, extracted so it's independently testable.
+ * Order matters: an explicit `error` (user denied) and a missing code are
+ * reported as their own reasons; a missing or mismatched `state` is always
+ * a state-mismatch, even when a code is present.
+ */
+export function validateCallback(error, code, returnedState, expectedState) {
+    if (error)
+        return { ok: false, reason: 'denied', detail: error };
+    if (!code)
+        return { ok: false, reason: 'denied', detail: 'no authorization code received' };
+    if (!returnedState || returnedState !== expectedState)
+        return { ok: false, reason: 'state-mismatch' };
+    return { ok: true, code };
+}
+export class LoginCancelledError extends Error {
+    constructor() {
+        super('login cancelled: no code was entered');
+        this.name = 'LoginCancelledError';
+    }
+}
+export class LoginDeniedError extends Error {
+    constructor(detail) {
+        super(`authorization was denied or failed: ${detail}`);
+        this.name = 'LoginDeniedError';
+    }
+}
+export class StateMismatchError extends Error {
+    constructor() {
+        super('state mismatch — the OAuth callback did not match the request this CLI sent');
+        this.name = 'StateMismatchError';
+    }
+}
+export class NotLoggedInError extends Error {
+    constructor(profile) {
+        super(`not logged in for profile "${profile}" — run: ruflo auth login --profile ${profile}`);
+        this.name = 'NotLoggedInError';
+    }
+}
+export class SessionOnlyExpiredError extends Error {
+    constructor(profile) {
+        super(`profile "${profile}" has no persisted refresh token and its in-memory access token is ` +
+            `absent or expiring — run: ruflo auth login --profile ${profile}`);
+        this.name = 'SessionOnlyExpiredError';
+    }
+}
+export class ScopeConsentMismatchError extends Error {
+    constructor(profile, scopes) {
+        super(`profile "${profile}" has scope(s) without matching local consent: ${scopes.join(', ')} — ` +
+            'authenticated capability denied');
+        this.name = 'ScopeConsentMismatchError';
+    }
+}
+/** Browser-based loopback PKCE login — the ADR-306 default for an interactive desktop. */
+export async function browserLogin(print) {
+    const sec = await loadSecurityOAuth();
+    const server = await sec.CallbackServer.bind();
+    const pkce = sec.generatePkce();
+    const url = sec.authorizeUrl(server.redirectUri, pkce.state, pkce.codeChallenge);
+    print('Opening your browser to sign in to Cognitum...');
+    print(`If it doesn't open automatically, visit:\n\n  ${url}\n`);
+    await sec.openBrowser(url).catch(() => { }); // best-effort — the URL above is always the fallback
+    print('Waiting for you to finish signing in...');
+    const result = await server.awaitCallback();
+    const validated = validateCallback(result.error, result.code, result.state, pkce.state);
+    if (!validated.ok) {
+        if (validated.reason === 'state-mismatch')
+            throw new StateMismatchError();
+        throw new LoginDeniedError(validated.detail ?? 'unknown');
+    }
+    const tokens = await sec.exchangeCode(validated.code, pkce.codeVerifier, server.redirectUri);
+    return { tokens, method: 'pkce' };
+}
+/** Headless fallback: prints the authorize URL with the OOB redirect, prompts for the pasted code. */
+export async function manualLogin(print, input = process.stdin) {
+    const sec = await loadSecurityOAuth();
+    print('Browser-based callback unavailable (SSH/container detected, or --no-browser).\n');
+    const pkce = sec.generatePkce();
+    const url = sec.authorizeUrl(sec.OOB_REDIRECT_URI, pkce.state, pkce.codeChallenge);
+    print(`Open this URL in a browser and authorize:\n\n  ${url}\n`);
+    // `rl.question()` resolves on a newline-terminated 'line' event — if `input`
+    // ends without ever emitting one (e.g. stdin closed early, or piped input
+    // with no trailing newline), it hangs forever rather than treating EOF as
+    // a cancellation. Race it against the interface's own 'close' event so an
+    // early EOF resolves to "" (-> LoginCancelledError below) instead of hanging.
+    const rl = readline.createInterface({ input, terminal: false });
+    let code;
+    try {
+        const closed = new Promise((resolve) => rl.once('close', () => resolve('')));
+        code = (await Promise.race([rl.question('Paste the code shown after authorizing: '), closed])).trim();
+    }
+    finally {
+        rl.close();
+    }
+    if (!code)
+        throw new LoginCancelledError();
+    const tokens = await sec.exchangeManualCode(code, pkce.codeVerifier);
+    return { tokens, method: 'device' };
+}
+/**
+ * `--token-stdin`: reads one JSON object from stdin,
+ * `{access_token, refresh_token?, expires_in, scope}`. Wire format is not
+ * specified by ADR-306 — defined here as typed JSON rather than a bare
+ * token string, so scope/expiry are explicit rather than inferred.
+ */
+export async function tokenStdinLogin(input = process.stdin) {
+    const chunks = [];
+    for await (const chunk of input)
+        chunks.push(chunk);
+    const raw = Buffer.concat(chunks).toString('utf-8').trim();
+    if (!raw)
+        throw new Error('--token-stdin: no input received on stdin');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('--token-stdin expects a single JSON object: {"access_token","refresh_token"?,"expires_in","scope"}');
+    }
+    if (!parsed.access_token)
+        throw new Error('--token-stdin: JSON is missing required field "access_token"');
+    const tokens = {
+        access_token: parsed.access_token,
+        token_type: 'Bearer',
+        refresh_token: parsed.refresh_token,
+        expires_in: parsed.expires_in,
+    };
+    return { tokens, method: 'token-stdin' };
+}
+/**
+ * Refreshes an access token. Classifies failure into network-unreachable
+ * vs. a reachable-but-erroring server so callers can print an honest
+ * message instead of collapsing both into "offline" (ADR-308 failure
+ * policy: local ruflo functionality is never affected by auth being
+ * unavailable, but the diagnostic should say WHY it's unavailable).
+ */
+export async function refreshAccessToken(refreshTokenValue) {
+    const sec = await loadSecurityOAuth();
+    try {
+        return await sec.refreshToken(refreshTokenValue);
+    }
+    catch (e) {
+        if (e instanceof sec.OAuthError) {
+            if (e.code === 'network') {
+                throw new Error('Could not reach the Cognitum auth service. ruflo core functionality is unaffected — ' +
+                    'sign-in is not required for local use.');
+            }
+            throw new Error(`Cognitum auth service returned an unexpected response: ${e.message}`);
+        }
+        throw e;
+    }
+}
+/**
+ * Returns an access token suitable for an authenticated call.
+ *
+ * Fast path: a process-memory token with more than one minute remaining.
+ * Slow path: load the profile's refresh token from the OS keychain, perform
+ * one refresh, persist a rotated refresh token BEFORE exposing the new access
+ * token, then update metadata and the process cache. Refresh is deliberately
+ * demand-driven: offline-safe commands such as plain `auth status` never call
+ * this function and therefore never create background traffic or retry loops.
+ */
+export async function getValidAccessToken(profileName = 'default') {
+    const profile = getProfile(profileName);
+    if (!profile)
+        throw new NotLoggedInError(profileName);
+    const scopesWithoutConsent = profile.scopes.filter((scope) => {
+        const domain = domainForScope(scope);
+        return domain !== undefined && !hasConsent(domain);
+    });
+    if (scopesWithoutConsent.length > 0) {
+        throw new ScopeConsentMismatchError(profileName, scopesWithoutConsent);
+    }
+    const cached = getSessionToken(profileName, ACCESS_TOKEN_REFRESH_WINDOW_MS);
+    if (cached)
+        return cached;
+    if (!profile.keychainRef)
+        throw new SessionOnlyExpiredError(profileName);
+    const sec = await loadSecurityOAuth();
+    const keychain = await sec.createKeychainAdapter();
+    const refreshTokenValue = await keychain.getSecret(KEYCHAIN_SERVICE, profile.keychainRef);
+    if (!refreshTokenValue)
+        throw new SessionOnlyExpiredError(profileName);
+    const refreshed = await refreshAccessToken(refreshTokenValue);
+    if (!refreshed.access_token)
+        throw new Error('Cognitum refresh response did not contain an access token');
+    // Cognitum rotates refresh tokens with reuse detection. Commit the rotated
+    // credential first; if this write fails, do not publish/cache the access
+    // token and do not retry the already-spent old refresh token here.
+    if (refreshed.refresh_token) {
+        await keychain.setSecret(KEYCHAIN_SERVICE, profile.keychainRef, refreshed.refresh_token);
+    }
+    const expiresAtMs = Date.now() + Math.max(0, refreshed.expires_in ?? 0) * 1000;
+    setSessionToken(profileName, refreshed.access_token, expiresAtMs);
+    setProfile(profileName, {
+        ...profile,
+        accountId: refreshed.account_email ?? profile.accountId,
+        accessTokenExpiresAt: new Date(expiresAtMs).toISOString(),
+        linkedAt: new Date().toISOString(),
+    });
+    return refreshed.access_token;
+}
+//# sourceMappingURL=client.js.map

package/v3/@claude-flow/cli/dist/src/auth/constants.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Shared ADR-306 constants — split out so `commands/auth.ts` and
+ * `auth/client.ts` reference the same keychain service name rather than two
+ * independently-typed string literals that could silently drift apart.
+ */
+export declare const KEYCHAIN_SERVICE = "ruflo-cognitum-auth";
+//# sourceMappingURL=constants.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/constants.js

@@ -0,0 +1,7 @@
+/**
+ * Shared ADR-306 constants — split out so `commands/auth.ts` and
+ * `auth/client.ts` reference the same keychain service name rather than two
+ * independently-typed string literals that could silently drift apart.
+ */
+export const KEYCHAIN_SERVICE = 'ruflo-cognitum-auth';
+//# sourceMappingURL=constants.js.map

package/v3/@claude-flow/cli/dist/src/auth/scopes.d.ts

@@ -0,0 +1,14 @@
+/**
+ * ADR-306 scope <-> ADR-302 consent-domain mapping.
+ *
+ * The 5 ADR-306 scopes map 1:1 onto 5 `ConsentDomain` values that already
+ * exist in src/funnel/types.ts (pre-provisioned for exactly this purpose —
+ * see that file's own comments). No new consent machinery is needed; this
+ * module is just the lookup table ADR-306 describes but never names in code.
+ */
+import type { ConsentDomain } from '../funnel/index.js';
+export declare const SCOPE_TO_DOMAIN: Record<string, ConsentDomain>;
+export declare function domainForScope(scope: string): ConsentDomain | undefined;
+/** `login` always requests this scope only, on first run — ADR-306. */
+export declare const INITIAL_SCOPE = "account.create";
+//# sourceMappingURL=scopes.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/scopes.js

@@ -0,0 +1,21 @@
+/**
+ * ADR-306 scope <-> ADR-302 consent-domain mapping.
+ *
+ * The 5 ADR-306 scopes map 1:1 onto 5 `ConsentDomain` values that already
+ * exist in src/funnel/types.ts (pre-provisioned for exactly this purpose —
+ * see that file's own comments). No new consent machinery is needed; this
+ * module is just the lookup table ADR-306 describes but never names in code.
+ */
+export const SCOPE_TO_DOMAIN = {
+    'account.create': 'account',
+    'proxy.use': 'proxy-install',
+    'cloud.route': 'cloud-routing',
+    'telemetry.write': 'telemetry',
+    'hosted.memory.use': 'hosted-memory',
+};
+export function domainForScope(scope) {
+    return SCOPE_TO_DOMAIN[scope];
+}
+/** `login` always requests this scope only, on first run — ADR-306. */
+export const INITIAL_SCOPE = 'account.create';
+//# sourceMappingURL=scopes.js.map

package/v3/@claude-flow/cli/dist/src/auth/security-bridge.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Lazy loader for `@claude-flow/security`'s OAuth + keychain surface
+ * (ADR-306). `@claude-flow/security` is an `optionalDependency` of this
+ * package (see package.json) — `ruflo auth` is the one capability that
+ * genuinely cannot function without it, so this module's job is turning "the
+ * optional package failed to install" into one clear, actionable error
+ * instead of a raw `ERR_MODULE_NOT_FOUND` stack trace. Mirrors the
+ * lazy-`require`-in-try/catch idiom already used for this same package in
+ * src/mcp-client.ts's `applyContentBoundaryGuardrail`, but as an async
+ * dynamic `import()` (the security package is itself `"type": "module"`).
+ *
+ * Only `import type` is used for the package's real types below — type-only
+ * imports are fully erased at compile time and never touch the runtime
+ * module resolver, so this file type-checks whether or not the optional
+ * dependency happens to be installed in a given consumer's node_modules.
+ */
+import type { authorizeUrl as AuthorizeUrlFn, exchangeCode as ExchangeCodeFn, refreshToken as RefreshTokenFn, exchangeManualCode as ExchangeManualCodeFn, generatePkce as GeneratePkceFn, OAuthTokenResponse, PkceRequest, CallbackServer as CallbackServerClass, CallbackResult, openBrowser as OpenBrowserFn, createKeychainAdapter as CreateKeychainAdapterFn, KeychainAdapter, OAuthError as OAuthErrorClass } from '@claude-flow/security';
+export interface SecurityOAuthModule {
+    authorizeUrl: typeof AuthorizeUrlFn;
+    exchangeCode: typeof ExchangeCodeFn;
+    refreshToken: typeof RefreshTokenFn;
+    exchangeManualCode: typeof ExchangeManualCodeFn;
+    generatePkce: typeof GeneratePkceFn;
+    CallbackServer: typeof CallbackServerClass;
+    openBrowser: typeof OpenBrowserFn;
+    createKeychainAdapter: typeof CreateKeychainAdapterFn;
+    OAuthError: typeof OAuthErrorClass;
+    OOB_REDIRECT_URI: string;
+}
+export type { OAuthTokenResponse, PkceRequest, CallbackResult, KeychainAdapter };
+export declare class SecurityPackageMissingError extends Error {
+    constructor(cause: unknown);
+}
+/** Loads `@claude-flow/security`'s OAuth surface, throwing a clear error if it's absent. */
+export declare function loadSecurityOAuth(): Promise<SecurityOAuthModule>;
+//# sourceMappingURL=security-bridge.d.ts.map