claude-flow 3.32.2 → 3.32.9

package/.claude/helpers/statusline.cjs

@@ -26,11 +26,11 @@ const { execSync } = require('child_process');
 const os = require('os');
 
 // Configuration
-const CONFIG = {
-  maxAgents: 15,
-  // Header identity defaults to project/repository name. Set `author` to
-  // retain the previous `git config user.name` display (#2682).
-  identityMode: (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase(),
+const CONFIG = {
+  maxAgents: 15,
+  // Header identity defaults to project/repository name. Set `author` to
+  // retain the previous `git config user.name` display (#2682).
+  identityMode: (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase(),
   // Session-cost display. Claude Code's cost.total_cost_usd is a client-side
   // estimate that "may differ from your actual bill" and reads as misleading on
   // subscription plans, where token usage is not billed per dollar. These let
@@ -213,9 +213,9 @@ function getStatuslineData() {
   // 60s TTL (#2337 — don't re-spawn the CLI on every rapid re-render) AND the
   // tighter promo-rotation clock (this fix — don't let a still-fresh 60s
   // cache silently freeze the promo/insight row across multiple 20s slots).
-  if (cache.fresh && cache.promoFresh) {
-    return applyLocalOverlays(overlayMemoPromo(cache.data));
-  }
+  if (cache.fresh && cache.promoFresh) {
+    return applyLocalOverlays(overlayMemoPromo(cache.data));
+  }
 
   // #2337: prefer an already-installed CLI bin via direct `node` invocation —
   // no npx, no registry round-trip, no @latest re-resolve per render. Try
@@ -422,7 +422,7 @@ function buildLocalFallback() {
   return applyLocalOverlays({
     user: { name: 'user', gitBranch: '', modelName: 'Claude Code' },
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
-    security: { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 },
+    security: { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
     system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
     lastUpdated: new Date().toISOString(),
@@ -479,16 +479,16 @@ function readJSON(filePath) {
 
 // ─── Git info (pure-Node / single exec — needed for branch display) ──────────
 
-function getGitInfo() {
-  const result = {
-    name: path.basename(CWD) || 'project', gitBranch: '', modified: 0, untracked: 0,
-    staged: 0, ahead: 0, behind: 0,
-  };
-
-  const script = [
-    'git rev-parse --show-toplevel 2>/dev/null || pwd',
-    'echo "---SEP---"',
-    'git config user.name 2>/dev/null || echo user',
+function getGitInfo() {
+  const result = {
+    name: path.basename(CWD) || 'project', gitBranch: '', modified: 0, untracked: 0,
+    staged: 0, ahead: 0, behind: 0,
+  };
+
+  const script = [
+    'git rev-parse --show-toplevel 2>/dev/null || pwd',
+    'echo "---SEP---"',
+    'git config user.name 2>/dev/null || echo user',
     'echo "---SEP---"',
     'git branch --show-current 2>/dev/null',
     'echo "---SEP---"',
@@ -501,14 +501,14 @@ function getGitInfo() {
   if (!raw) return result;
 
   const parts = raw.split('---SEP---').map(function(s) { return s.trim(); });
-  if (parts.length >= 5) {
-    const projectName = path.basename(parts[0] || CWD) || path.basename(CWD) || 'project';
-    const authorName = parts[1] || 'user';
-    result.name = CONFIG.identityMode === 'author' ? authorName : projectName;
-    result.gitBranch = parts[2] || '';
-
-    if (parts[3]) {
-      for (const line of parts[3].split('\n')) {
+  if (parts.length >= 5) {
+    const projectName = path.basename(parts[0] || CWD) || path.basename(CWD) || 'project';
+    const authorName = parts[1] || 'user';
+    result.name = CONFIG.identityMode === 'author' ? authorName : projectName;
+    result.gitBranch = parts[2] || '';
+
+    if (parts[3]) {
+      for (const line of parts[3].split('\n')) {
         if (!line || line.length < 2) continue;
         const x = line[0], y = line[1];
         if (x === '?' && y === '?') { result.untracked++; continue; }
@@ -517,7 +517,7 @@ function getGitInfo() {
       }
     }
 
-    const ab = (parts[4] || '0 0').split(/\s+/);
+    const ab = (parts[4] || '0 0').split(/\s+/);
     result.ahead = parseInt(ab[0]) || 0;
     result.behind = parseInt(ab[1]) || 0;
   }
@@ -633,12 +633,55 @@ function compareVersions(a, b) {
   return 0;
 }
 
+// #2742: when CWD is a linked git worktree, it has no node_modules of its
+// own (worktrees don't get their own `npm install`), so every CWD-relative
+// probe in getPkgVersion() misses and the version silently falls back to
+// the baked-in default — even though the main repo's install a few
+// directories away is perfectly resolvable. A linked worktree's `.git` is
+// a plain FILE (not a directory) containing `gitdir: <main>/.git/worktrees/
+// <name>`; walk up from CWD to find it, parse the pointer, and strip the
+// trailing `.git/worktrees/<name>` segment to recover the main repo root.
+// Pure fs — no `git rev-parse` spawn (statusline renders are latency-
+// sensitive; this doc comment's neighbors are explicit about avoiding
+// spawns in the render path).
+function resolveWorktreeMainRoot() {
+  try {
+    let dir = CWD;
+    for (;;) {
+      const dotGit = path.join(dir, '.git');
+      if (fs.existsSync(dotGit)) {
+        if (fs.statSync(dotGit).isFile()) {
+          const contents = fs.readFileSync(dotGit, 'utf-8');
+          const m = contents.match(/^gitdir:\s*(.+)$/m);
+          const wtGitDir = m && m[1].trim();
+          if (wtGitDir) {
+            // Git writes this pointer with forward slashes even on Windows
+            // (a git-for-windows convention for its own internal files) —
+            // path.sep (backslash on win32) never matches, so normalize
+            // before searching rather than building an OS-specific marker.
+            const normalized = wtGitDir.replace(/\\/g, '/');
+            const marker = '/.git/worktrees/';
+            const idx = normalized.lastIndexOf(marker);
+            if (idx > 0) return normalized.slice(0, idx);
+          }
+        }
+        return null; // a real (non-worktree) .git dir — nothing to resolve
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) return null; // reached filesystem root
+      dir = parent;
+    }
+  } catch {
+    return null;
+  }
+}
+
 function getPkgVersion() {
   // Baked in at generation time from the real running CLI's own resolved
   // version (see generateStatuslineScript()'s doc comment) — correct even
   // when this renders via a pure npx invocation with no local install for
   // the candidate scan below to find.
-  let ver = "3.28.0";
+  let ver = "3.32.8";
   try {
     const home = os.homedir();
     const pkgPaths = [
@@ -647,6 +690,17 @@ function getPkgVersion() {
       path.join(CWD, 'node_modules', 'ruflo', 'package.json'),
       path.join(CWD, 'v3', '@claude-flow', 'cli', 'package.json'),
     ];
+    // #2742: CWD is a linked git worktree with no node_modules of its own —
+    // probe the main repo's install too, so a worktree session shows the
+    // same version a main-repo session would.
+    const worktreeMainRoot = resolveWorktreeMainRoot();
+    if (worktreeMainRoot) {
+      pkgPaths.push(
+        path.join(worktreeMainRoot, 'node_modules', '@claude-flow', 'cli', 'package.json'),
+        path.join(worktreeMainRoot, 'node_modules', 'ruflo', 'package.json'),
+        path.join(worktreeMainRoot, 'v3', '@claude-flow', 'cli', 'package.json'),
+      );
+    }
     // #2221: global installs (npm i -g ruflo) live outside CWD/node_modules, so the
     // probes above all miss and the version falls back to the hard-coded default.
     // Derive the global node_modules dir from the running node binary (no npm spawn —
@@ -731,7 +785,7 @@ function generateStatusline() {
   const intelligencePct = system.intelligencePct || 0;
   const memoryMB = system.memoryMB || 0;
   const subAgents = system.subAgents || 0;
-  const findings = Math.max(0, security.findings || 0);
+  const findings = Math.max(0, security.findings || 0);
   const secStatus = security.status || 'NONE';
   const adrCount = adrs.count || 0;
   const adrImpl = adrs.implemented || 0;
@@ -786,7 +840,7 @@ function generateStatusline() {
   const hooksColor = hooksEnabled > 0 ? c.brightGreen : c.dim;
   const intellColor = intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
   const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset + ' ' : c.dim + '○' + c.reset + ' ';
-  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && findings === 0;
+  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && findings === 0;
   const opsParts = [];
   opsParts.push(c.cyan + 'Swarm ' + swarmInd + agentsColor + activeAgents + c.reset + '/' + c.brightWhite + maxAgents + c.reset);
   if (subAgents > 0) opsParts.push(c.brightPurple + '👥 ' + subAgents + c.reset);
@@ -797,14 +851,14 @@ function generateStatusline() {
   if (healthAllGreen) {
     opsParts.push(c.brightGreen + '🛡 ✓' + c.reset);
   } else {
-    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
-    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
-    else if (secStatus === 'ISSUES') opsParts.push(c.brightRed + '🛡 findings' + c.reset);
-    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
-    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
-    if (findings > 0) {
-      opsParts.push(c.brightRed + '⚠ ' + findings + ' finding' + (findings === 1 ? '' : 's') + c.reset);
-    }
+    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
+    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
+    else if (secStatus === 'ISSUES') opsParts.push(c.brightRed + '🛡 findings' + c.reset);
+    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
+    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
+    if (findings > 0) {
+      opsParts.push(c.brightRed + '⚠ ' + findings + ' finding' + (findings === 1 ? '' : 's') + c.reset);
+    }
   }
   lines.push(opsParts.join('  ' + c.dim + '·' + c.reset + '  '));
 

package/.claude-plugin/hooks/hooks.json

@@ -1,7 +1,9 @@
 {
   "_note": "#1921 — hook commands invoke scripts/ruflo-hook.sh (resilient shim): prefers a locally-installed `ruflo`/`claude-flow` binary, falls back to `npx --prefer-offline`, and always exits 0 so a CLI/install failure (e.g. arborist `Invalid Version` on npm 10.8.x) never surfaces an error in Claude Code or blocks a turn. The trailing `|| true` guards the case where $CLAUDE_PLUGIN_ROOT is unset (older Claude Code) — the hook then no-ops silently. DO NOT revert to a bare `npx <pkg>@alpha hooks …` per fire.",
   "_platform": "posix",
-  "_platform_note": "#2132 — This hooks.json uses /bin/bash, POSIX pipelines (jq, xargs, tr), and .sh scripts. It is intentionally POSIX-only (Mac/Linux). On Windows, ruflo init writes a .claude/settings.json that overrides these entries with node-based equivalents via plugins/ruflo-core/scripts/ruflo-hook.cjs. The audit exempts files with _platform:posix from the cross-platform check.",
+  "_platform_note": "#2132 — This hooks.json uses /bin/bash, POSIX pipelines (jq, xargs, tr), and .sh scripts. It is intentionally POSIX-only (Mac/Linux) today and known-broken on native Windows (#2721 shape). The previous claim here that `ruflo init` overrides these entries with node-based equivalents on Windows was never actually implemented and is incorrect — Claude Code merges plugin-declared hooks additively with any init-generated settings.json, it does not replace them. This package (separate from plugins/ruflo-core, which got the #2721 fix) still needs its own Windows-compatible rewrite; see _legacy_unaudited_shim below.",
+  "_legacy_unaudited_shim": true,
+  "_legacy_unaudited_shim_note": "#2721 fixed plugins/ruflo-core and plugins/ruflo-cost-tracker (marketplace-listed in .claude-plugin/marketplace.json) by rewiring hooks.json to a `node -e` bootstrap around scripts/ruflo-hook.cjs. This older, separately-published \"claude-flow\" plugin package (not in the ruflo marketplace list) has its own, larger jq/xargs-based hook set and its own scripts/ruflo-hook.cjs that hooks.json never references — same underlying bug shape, NOT fixed as part of #2721. Needs its own audited pass before this flag can be removed.",
   "hooks": {
     "PreToolUse": [
       {

package/.claude-plugin/scripts/ruflo-hook.cjs

@@ -14,7 +14,7 @@
  * Behaviour mirrors ruflo-hook.sh:
  *   1. Reads hook JSON payload from stdin.
  *   2. Prefers a locally installed `ruflo` or `claude-flow` binary.
- *   3. Falls back to `npx --prefer-offline ruflo@latest`.
+ *   3. Falls back to `npx --prefer-offline ruflo@latest`.
  *   4. Always exits 0 — hook subcommands are best-effort telemetry.
  *   5. Swallows all stderr — nothing should surface to Claude Code.
  *
@@ -157,7 +157,7 @@ function main() {
   // a spurious failure even though the shim itself works correctly.
   // The bash version doesn't hit this because it backgrounded the work.
   if (process.env.RUFLO_HOOK_SKIP_NPX !== '1') {
-    invokeHook('npx', ['--prefer-offline', '--yes', 'ruflo@latest'], hookArgs, stdinData);
+    invokeHook('npx', ['--prefer-offline', '--yes', 'ruflo@latest'], hookArgs, stdinData);
   }
 
   done();

package/.claude-plugin/scripts/ruflo-hook.sh

@@ -24,29 +24,29 @@
 # so redirecting it is a pure cleanup with no functional cost.
 exec 1>/dev/null 2>/dev/null
 
-# Bound every hook process. A partially initialized native embedding pool can
-# otherwise keep a logically completed Stop hook alive indefinitely (#2691).
-run() {
-  "$@" &
-  child=$!
-  (
-    sleep 15
-    kill -TERM "$child" 2>/dev/null || true
-    sleep 1
-    kill -KILL "$child" 2>/dev/null || true
-  ) &
-  watchdog=$!
-  wait "$child" 2>/dev/null || true
-  kill "$watchdog" 2>/dev/null || true
-  wait "$watchdog" 2>/dev/null || true
-}
+# Bound every hook process. A partially initialized native embedding pool can
+# otherwise keep a logically completed Stop hook alive indefinitely (#2691).
+run() {
+  "$@" &
+  child=$!
+  (
+    sleep 15
+    kill -TERM "$child" 2>/dev/null || true
+    sleep 1
+    kill -KILL "$child" 2>/dev/null || true
+  ) &
+  watchdog=$!
+  wait "$child" 2>/dev/null || true
+  kill "$watchdog" 2>/dev/null || true
+  wait "$watchdog" 2>/dev/null || true
+}
 
 if command -v ruflo >/dev/null 2>&1; then
   run ruflo hooks "$@"
 elif command -v claude-flow >/dev/null 2>&1; then
   run claude-flow hooks "$@"
 else
-  run npx --prefer-offline --yes ruflo@latest hooks "$@"
+  run npx --prefer-offline --yes ruflo@latest hooks "$@"
 fi
 
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.32.2",
+  "version": "3.32.9",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",
@@ -78,11 +78,12 @@
     "@ruvector/router-linux-x64-gnu": "^0.1.30",
     "@ruvector/sona": "^0.1.5",
     "agentdb": "^3.0.0-alpha.17",
-    "agentic-flow": "^2.0.14"
+    "agentic-flow": "^2.0.14",
+    "better-sqlite3": "12.9.0"
   },
   "overrides": {
     "ruvector": "^0.2.27",
-    "better-sqlite3": ">=12.8.0",
+    "better-sqlite3": "12.9.0",
     "js-yaml": ">=4.3.0",
     "hono": ">=4.12.25",
     "@ruvector/rvf-wasm": "0.1.5",
@@ -131,6 +132,11 @@
     "typescript": "^5.0.0",
     "vitest": "^3.2.6"
   },
+  "pnpm": {
+    "overrides": {
+      "better-sqlite3": "12.9.0"
+    }
+  },
   "engines": {
     "node": ">=20.0.0"
   },

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-17T04:00:15.717Z",
-  "gitSha": "61047df4",
+  "generatedAt": "2026-07-20T23:20:52.239Z",
+  "gitSha": "745dfbe3",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/v3/@claude-flow/cli/dist/src/auth/client.d.ts

@@ -0,0 +1,89 @@
+/**
+ * `ruflo auth login` flow orchestration (ADR-306) — composes
+ * `@claude-flow/security`'s ported OAuth primitives (loopback PKCE, OOB
+ * manual-paste, refresh) the same way meta-proxy's `oauth/login.rs`
+ * orchestrates its own Rust primitives. See security-bridge.ts for why the
+ * package is loaded lazily, and oauth/client.ts (in @claude-flow/security)
+ * for why this targets the live `auth.cognitum.one` surface rather than
+ * ADR-308's unconfirmed `/v1/auth/*` spec.
+ *
+ * @module auth/client
+ */
+import { type OAuthTokenResponse } from './security-bridge.js';
+/** Refresh before there is less than one minute left on the access token. */
+export declare const ACCESS_TOKEN_REFRESH_WINDOW_MS = 60000;
+export interface LoginResult {
+    tokens: OAuthTokenResponse;
+    method: 'pkce' | 'device' | 'token-stdin';
+}
+/**
+ * Best-effort headlessness signal — a false negative just means the browser
+ * flow is attempted and a real browser opens fine anyway; a false positive
+ * means the user falls back to the manual OOB flow, which always works
+ * regardless. Mirrors meta-proxy's `login.rs::is_probably_headless()`.
+ */
+export declare function isProbablyHeadless(): boolean;
+/**
+ * Validates the OAuth callback params against the request that started the
+ * flow — the CSRF-critical step, extracted so it's independently testable.
+ * Order matters: an explicit `error` (user denied) and a missing code are
+ * reported as their own reasons; a missing or mismatched `state` is always
+ * a state-mismatch, even when a code is present.
+ */
+export declare function validateCallback(error: string | null, code: string | null, returnedState: string | null, expectedState: string): {
+    ok: true;
+    code: string;
+} | {
+    ok: false;
+    reason: 'denied' | 'state-mismatch';
+    detail?: string;
+};
+export declare class LoginCancelledError extends Error {
+    constructor();
+}
+export declare class LoginDeniedError extends Error {
+    constructor(detail: string);
+}
+export declare class StateMismatchError extends Error {
+    constructor();
+}
+export declare class NotLoggedInError extends Error {
+    constructor(profile: string);
+}
+export declare class SessionOnlyExpiredError extends Error {
+    constructor(profile: string);
+}
+export declare class ScopeConsentMismatchError extends Error {
+    constructor(profile: string, scopes: string[]);
+}
+/** Browser-based loopback PKCE login — the ADR-306 default for an interactive desktop. */
+export declare function browserLogin(print: (line: string) => void): Promise<LoginResult>;
+/** Headless fallback: prints the authorize URL with the OOB redirect, prompts for the pasted code. */
+export declare function manualLogin(print: (line: string) => void, input?: NodeJS.ReadableStream): Promise<LoginResult>;
+/**
+ * `--token-stdin`: reads one JSON object from stdin,
+ * `{access_token, refresh_token?, expires_in, scope}`. Wire format is not
+ * specified by ADR-306 — defined here as typed JSON rather than a bare
+ * token string, so scope/expiry are explicit rather than inferred.
+ */
+export declare function tokenStdinLogin(input?: NodeJS.ReadableStream): Promise<LoginResult>;
+/**
+ * Refreshes an access token. Classifies failure into network-unreachable
+ * vs. a reachable-but-erroring server so callers can print an honest
+ * message instead of collapsing both into "offline" (ADR-308 failure
+ * policy: local ruflo functionality is never affected by auth being
+ * unavailable, but the diagnostic should say WHY it's unavailable).
+ */
+export declare function refreshAccessToken(refreshTokenValue: string): Promise<OAuthTokenResponse>;
+/**
+ * Returns an access token suitable for an authenticated call.
+ *
+ * Fast path: a process-memory token with more than one minute remaining.
+ * Slow path: load the profile's refresh token from the OS keychain, perform
+ * one refresh, persist a rotated refresh token BEFORE exposing the new access
+ * token, then update metadata and the process cache. Refresh is deliberately
+ * demand-driven: offline-safe commands such as plain `auth status` never call
+ * this function and therefore never create background traffic or retry loops.
+ */
+export declare function getValidAccessToken(profileName?: string): Promise<string>;
+//# sourceMappingURL=client.d.ts.map