claude-flow 3.32.2 → 3.32.9

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js

@@ -35,6 +35,33 @@ function isRuvectorCoreResolvable() {
     }
     return _ruvectorCoreResolvable;
 }
+/**
+ * #2735 — before a whole-image sql.js read-modify-persist (export() +
+ * rename over the live database path), refuse if there is evidence of a
+ * live native (better-sqlite3) WAL connection: `-wal`/`-shm` sidecar files
+ * on disk. A native connection in WAL mode keeps its sidecars present for
+ * its entire lifetime (removed only on the last connection's clean close),
+ * so their presence is strong evidence of a live native holder — and their
+ * absence means the image is a clean, checkpointed, standalone file that
+ * sql.js can safely read-modify-write.
+ *
+ * This is a scoped-down version of the fuller "scan live process holders"
+ * design discussed in #2735: it does not close the narrow assess-then-write
+ * race (a native opener could still attach in the gap between this check
+ * and the write), but it directly closes the demonstrated corruption
+ * mechanism — a whole-image write proceeding while an ALREADY-OPEN native
+ * connection's sidecars are on disk — with no platform-specific process
+ * scanning. Fails closed (treats a stat error as "unsafe") because this is
+ * a safety gate, not a best-effort probe.
+ */
+function hasNativeWalSidecars(dbPath) {
+    try {
+        return fs.existsSync(`${dbPath}-wal`) || fs.existsSync(`${dbPath}-shm`);
+    }
+    catch {
+        return true;
+    }
+}
 /**
  * #1854: previously every site that needed the memory directory hardcoded
  * `getMemoryRoot()`, so the documented config entry
@@ -2304,6 +2331,22 @@ export async function storeEntry(options) {
         if (!fs.existsSync(dbPath)) {
             return { success: false, id: '', error: 'Database not initialized. Run: claude-flow memory init' };
         }
+        // #2735 — refuse an unsafe whole-image write while a native WAL
+        // connection appears to be attached (sidecars on disk). See
+        // hasNativeWalSidecars()'s doc comment for the corruption mechanism
+        // this closes and its known residual (the narrow assess-then-write
+        // race). This check gates ensureSchemaColumns()'s own whole-image
+        // write below too, not just this function's.
+        if (hasNativeWalSidecars(dbPath)) {
+            return {
+                success: false,
+                id: '',
+                error: 'memory database has an active native WAL connection ' +
+                    '(found -wal/-shm sidecar files) — refusing an unsafe sql.js ' +
+                    'whole-image write. Retry once the native writer completes, or ' +
+                    'restore the native better-sqlite3 bridge.',
+            };
+        }
         // Ensure schema has all required columns (migration for older DBs)
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
@@ -2672,6 +2715,20 @@ export async function getEntry(options) {
         if (!fs.existsSync(dbPath)) {
             return { success: false, found: false, error: 'Database not found' };
         }
+        // #2735 — see storeEntry's identical gate for the corruption mechanism
+        // this closes. Applies here too because the fallback's access_count
+        // bump is itself a whole-image write, not a lightweight read, even
+        // though this function's contract reads as a "get".
+        if (hasNativeWalSidecars(dbPath)) {
+            return {
+                success: false,
+                found: false,
+                error: 'memory database has an active native WAL connection ' +
+                    '(found -wal/-shm sidecar files) — refusing an unsafe sql.js ' +
+                    'whole-image read/write. Retry once the native writer completes, ' +
+                    'or restore the native better-sqlite3 bridge.',
+            };
+        }
         // Ensure schema has all required columns (migration for older DBs)
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;
@@ -2783,6 +2840,21 @@ export async function deleteEntry(options) {
                 error: 'Database not found'
             };
         }
+        // #2735 — see storeEntry's identical gate for the corruption mechanism
+        // this closes.
+        if (hasNativeWalSidecars(dbPath)) {
+            return {
+                success: false,
+                deleted: false,
+                key,
+                namespace,
+                remainingEntries: 0,
+                error: 'memory database has an active native WAL connection ' +
+                    '(found -wal/-shm sidecar files) — refusing an unsafe sql.js ' +
+                    'whole-image write. Retry once the native writer completes, or ' +
+                    'restore the native better-sqlite3 bridge.',
+            };
+        }
         // Ensure schema has all required columns (migration for older DBs)
         await ensureSchemaColumns(dbPath);
         const initSqlJs = (await import('sql.js')).default;

package/v3/@claude-flow/cli/dist/src/proxy/install.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `ruflo proxy install`/`update` orchestration (ADR-307): download -> verify
+ * -> extract -> place -> record. The per-user bearer token
+ * (`~/.ruflo/proxy-token`) is NOT generated here — confirmed empirically
+ * (2026-07-16) that the meta-proxy binary itself creates it on first launch
+ * (`load_or_create_token()`), so this module's job ends at a verified binary
+ * on disk plus an install manifest doctor can check against.
+ *
+ * @module proxy/install
+ */
+export declare class ExtractionError extends Error {
+    constructor(message: string);
+}
+export interface InstallOptions {
+    version: string;
+    log?: (line: string) => void;
+}
+export interface InstallResult {
+    version: string;
+    binaryPath: string;
+    sha256: string;
+}
+/**
+ * Full install pipeline. Refuses (throws) on any verification failure —
+ * never writes a partially-verified binary into the live install path.
+ */
+export declare function installProxy(opts: InstallOptions): Promise<InstallResult>;
+export declare function uninstallProxy(): Promise<boolean>;
+//# sourceMappingURL=install.d.ts.map

package/v3/@claude-flow/cli/dist/src/proxy/install.js

@@ -0,0 +1,135 @@
+/**
+ * `ruflo proxy install`/`update` orchestration (ADR-307): download -> verify
+ * -> extract -> place -> record. The per-user bearer token
+ * (`~/.ruflo/proxy-token`) is NOT generated here — confirmed empirically
+ * (2026-07-16) that the meta-proxy binary itself creates it on first launch
+ * (`load_or_create_token()`), so this module's job ends at a verified binary
+ * on disk plus an install manifest doctor can check against.
+ *
+ * @module proxy/install
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { fetchReleaseAssets, detectTargetTriple, releaseArchiveExtension, releaseAssetFilename } from './release.js';
+import { verifyRelease, sha256Hex, PROXY_RELEASE_PUBKEY_PEM } from './verify.js';
+import { proxyBinaryPath, proxyInstallManifestPath } from './paths.js';
+export class ExtractionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ExtractionError';
+    }
+}
+function binaryNameInArchive() {
+    return process.platform === 'win32' ? 'meta-proxy.exe' : 'meta-proxy';
+}
+/**
+ * Extracts the archive via the OS's own tools — `tar` for `.tar.gz`
+ * (present on macOS/Linux/Windows 10+), PowerShell `Expand-Archive`
+ * specifically for `.zip` on Windows (not tar's bsdtar zip support — not
+ * reliable enough to lean on). Zero new archive-parsing dependency, matching
+ * this repo's existing taste for shelling out over adding a parser dep.
+ */
+async function extractArchive(archivePath, extractDir, ext) {
+    const { SafeExecutor } = await import('@claude-flow/security');
+    fs.mkdirSync(extractDir, { recursive: true });
+    if (ext === 'tar.gz') {
+        const exec = new SafeExecutor({ allowedCommands: ['tar'], timeout: 60_000 });
+        const result = await exec.execute('tar', ['xzf', archivePath, '-C', extractDir]);
+        if (result.exitCode !== 0) {
+            throw new ExtractionError(`tar extraction failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);
+        }
+        return;
+    }
+    // .zip — PowerShell Expand-Archive, single-quoted literal paths (doubling
+    // any embedded single quote per PowerShell string-literal escaping) passed
+    // as ONE argv element to -Command. shell:false means no OS shell ever
+    // tokenizes this string — only powershell.exe's own parser does.
+    const escape = (p) => p.replace(/'/g, "''");
+    const command = `Expand-Archive -LiteralPath '${escape(archivePath)}' -DestinationPath '${escape(extractDir)}' -Force`;
+    const exec = new SafeExecutor({ allowedCommands: ['powershell', 'powershell.exe'], timeout: 60_000 });
+    const result = await exec.execute('powershell', ['-NoProfile', '-NonInteractive', '-Command', command]);
+    if (result.exitCode !== 0) {
+        throw new ExtractionError(`Expand-Archive failed (exit ${result.exitCode}): ${result.stderr || result.stdout}`);
+    }
+}
+/**
+ * Full install pipeline. Refuses (throws) on any verification failure —
+ * never writes a partially-verified binary into the live install path.
+ */
+export async function installProxy(opts) {
+    const log = opts.log ?? (() => { });
+    const triple = detectTargetTriple();
+    const archiveFilename = releaseAssetFilename(opts.version, triple);
+    const workDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ruflo-proxy-install-'));
+    try {
+        log(`Fetching meta-proxy ${opts.version} (${triple})...`);
+        const assets = await fetchReleaseAssets(opts.version, triple, workDir, log);
+        log('Verifying release signature and checksum...');
+        const { sha256 } = verifyRelease({
+            sumsBytes: assets.sumsBytes,
+            sigBase64: assets.sigBase64,
+            assetBytes: assets.archiveBytes,
+            assetFilename: assets.archiveFilename,
+        });
+        log(`Verified — sha256 ${sha256.slice(0, 16)}…`);
+        // fetchReleaseAssets's dev (gh) path already wrote the archive to workDir
+        // under archiveFilename; ensure it's there regardless of source so
+        // extraction always has a real file to operate on.
+        const archivePath = path.join(workDir, archiveFilename);
+        if (!fs.existsSync(archivePath)) {
+            fs.writeFileSync(archivePath, assets.archiveBytes);
+        }
+        const extractDir = path.join(workDir, 'extracted');
+        await extractArchive(archivePath, extractDir, releaseArchiveExtension(triple));
+        const extractedBinaryPath = path.join(extractDir, binaryNameInArchive());
+        if (!fs.existsSync(extractedBinaryPath)) {
+            throw new ExtractionError(`archive did not contain the expected binary at its root: ${binaryNameInArchive()}`);
+        }
+        // Defense in depth: confirm the extracted binary genuinely resolves
+        // inside extractDir (catches a symlink swap or similar), even though
+        // we only ever read one specific expected relative path, never an
+        // archive-listed one (so "zip slip" via arbitrary archive paths isn't
+        // reachable here in the first place).
+        const { PathValidator } = await import('@claude-flow/security');
+        const validator = new PathValidator({ allowedPrefixes: [extractDir] });
+        const validation = await validator.validate(extractedBinaryPath);
+        if (!validation.isValid) {
+            throw new ExtractionError(`extracted binary path failed validation: ${validation.errors.join('; ') || 'unknown'}`);
+        }
+        const finalPath = proxyBinaryPath();
+        fs.mkdirSync(path.dirname(finalPath), { recursive: true, mode: 0o700 });
+        const tmp = `${finalPath}.tmp`;
+        fs.copyFileSync(extractedBinaryPath, tmp);
+        fs.chmodSync(tmp, 0o755);
+        fs.renameSync(tmp, finalPath);
+        const liveSha = sha256Hex(fs.readFileSync(finalPath));
+        const manifest = {
+            version: opts.version,
+            sha256: liveSha,
+            verifiedAt: new Date().toISOString(),
+            pubkeyFingerprint: sha256Hex(Buffer.from(PROXY_RELEASE_PUBKEY_PEM)).slice(0, 16),
+        };
+        fs.mkdirSync(path.dirname(proxyInstallManifestPath()), { recursive: true });
+        fs.writeFileSync(proxyInstallManifestPath(), JSON.stringify(manifest, null, 2), { mode: 0o600 });
+        log(`meta-proxy ${opts.version} installed at ${finalPath}`);
+        return { version: opts.version, binaryPath: finalPath, sha256: liveSha };
+    }
+    finally {
+        fs.rmSync(workDir, { recursive: true, force: true });
+    }
+}
+export async function uninstallProxy() {
+    const binPath = proxyBinaryPath();
+    const existed = fs.existsSync(binPath);
+    if (existed)
+        fs.unlinkSync(binPath);
+    try {
+        fs.unlinkSync(proxyInstallManifestPath());
+    }
+    catch {
+        /* absent — fine */
+    }
+    return existed;
+}
+//# sourceMappingURL=install.js.map

package/v3/@claude-flow/cli/dist/src/proxy/lifecycle.d.ts

@@ -0,0 +1,61 @@
+/**
+ * meta-proxy process lifecycle (ADR-307) — start/stop/status/logs.
+ *
+ * Adapts daemon.ts's proven pattern (PID file, O_EXCL lockfile for atomic
+ * check-then-start, signal-0 liveness, SIGTERM->1000ms->SIGKILL) to a
+ * native binary instead of a forked Node process. The binary itself takes
+ * no CLI flags — confirmed empirically (2026-07-16): `meta-proxy.exe` has
+ * no `--version`/`--help`, and any invocation just starts the server reading
+ * its own config file — so `spawn()` here passes zero arguments, always.
+ *
+ * Foreground `start` (the ADR-307 default) uses `stdio: 'inherit'` and
+ * blocks directly — simplest and safest, no log-file redirection needed.
+ * `start --service` needs REAL file-descriptor redirection
+ * (`stdio: ['ignore', fd, fd]`) + `detached: true` + `unref()` via
+ * `child_process.spawn()` directly — `SafeExecutor.executeStreaming()`
+ * buffers output in-process, which is wrong for a process meant to outlive
+ * the `ruflo` invocation that started it.
+ *
+ * @module proxy/lifecycle
+ */
+import * as fs from 'node:fs';
+export declare class ProxyNotInstalledError extends Error {
+    constructor();
+}
+export declare class ProxyAlreadyRunningError extends Error {
+    readonly pid: number;
+    constructor(pid: number);
+}
+export interface ProxyStatus {
+    installed: boolean;
+    running: boolean;
+    pid: number | null;
+    stalePidFile: boolean;
+}
+export declare function getProxyStatus(): ProxyStatus;
+/**
+ * Foreground start (ADR-307 default) — blocks the caller until the process
+ * exits or is interrupted. `stdio: 'inherit'` passes the proxy's own output
+ * straight through to the terminal; signals (Ctrl+C) propagate naturally to
+ * the child, no manual forwarding needed.
+ */
+export declare function startForeground(supervised?: boolean): Promise<never>;
+/**
+ * Background/`--service` start — detaches so the process outlives this
+ * `ruflo` invocation, redirecting stdout/stderr to a real log file (not
+ * buffered in-process). Returns once the child's PID is confirmed written,
+ * without waiting for the process to exit.
+ */
+export declare function startBackground(): Promise<{
+    pid: number;
+}>;
+export interface StopResult {
+    wasRunning: boolean;
+    pid: number | null;
+}
+/** SIGTERM -> 1000ms -> SIGKILL if still alive, mirroring daemon.ts's killBackgroundDaemon. */
+export declare function stopProxy(): Promise<StopResult>;
+export declare function readProxyLogTail(maxBytes?: number): string;
+/** Streams new log lines as they're appended, starting from the current end of file. */
+export declare function watchProxyLog(onLine: (line: string) => void): fs.FSWatcher;
+//# sourceMappingURL=lifecycle.d.ts.map

package/v3/@claude-flow/cli/dist/src/proxy/lifecycle.js

@@ -0,0 +1,249 @@
+/**
+ * meta-proxy process lifecycle (ADR-307) — start/stop/status/logs.
+ *
+ * Adapts daemon.ts's proven pattern (PID file, O_EXCL lockfile for atomic
+ * check-then-start, signal-0 liveness, SIGTERM->1000ms->SIGKILL) to a
+ * native binary instead of a forked Node process. The binary itself takes
+ * no CLI flags — confirmed empirically (2026-07-16): `meta-proxy.exe` has
+ * no `--version`/`--help`, and any invocation just starts the server reading
+ * its own config file — so `spawn()` here passes zero arguments, always.
+ *
+ * Foreground `start` (the ADR-307 default) uses `stdio: 'inherit'` and
+ * blocks directly — simplest and safest, no log-file redirection needed.
+ * `start --service` needs REAL file-descriptor redirection
+ * (`stdio: ['ignore', fd, fd]`) + `detached: true` + `unref()` via
+ * `child_process.spawn()` directly — `SafeExecutor.executeStreaming()`
+ * buffers output in-process, which is wrong for a process meant to outlive
+ * the `ruflo` invocation that started it.
+ *
+ * @module proxy/lifecycle
+ */
+import { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import { proxyBinaryPath, proxyPidFilePath, proxyLockFilePath, proxyLogFilePath } from './paths.js';
+export class ProxyNotInstalledError extends Error {
+    constructor() {
+        super('meta-proxy is not installed. Run: ruflo proxy install');
+        this.name = 'ProxyNotInstalledError';
+    }
+}
+export class ProxyAlreadyRunningError extends Error {
+    pid;
+    constructor(pid) {
+        super(`meta-proxy is already running (pid ${pid}). Stop it first with: ruflo proxy stop`);
+        this.pid = pid;
+        this.name = 'ProxyAlreadyRunningError';
+    }
+}
+function requireBinary() {
+    const bin = proxyBinaryPath();
+    if (!fs.existsSync(bin))
+        throw new ProxyNotInstalledError();
+    return bin;
+}
+/** Signal-0 liveness probe — cross-platform in Node, throws if the process is dead. */
+function isProcessRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function getProxyStatus() {
+    const installed = fs.existsSync(proxyBinaryPath());
+    const pidPath = proxyPidFilePath();
+    if (!fs.existsSync(pidPath)) {
+        return { installed, running: false, pid: null, stalePidFile: false };
+    }
+    const raw = fs.readFileSync(pidPath, 'utf-8').trim();
+    const pid = parseInt(raw, 10);
+    if (!Number.isFinite(pid)) {
+        return { installed, running: false, pid: null, stalePidFile: true };
+    }
+    const running = isProcessRunning(pid);
+    return { installed, running, pid: running ? pid : null, stalePidFile: !running };
+}
+function writePidFile(pid) {
+    fs.writeFileSync(proxyPidFilePath(), String(pid), 'utf-8');
+}
+function clearStalePidFile() {
+    try {
+        fs.unlinkSync(proxyPidFilePath());
+    }
+    catch {
+        // already absent
+    }
+}
+/**
+ * Atomic check-then-start via an O_EXCL lockfile — the same fix daemon.ts
+ * applies for the identical race (#2407/#2484: without this, N concurrent
+ * `start` calls all see "not running" and all spawn their own process).
+ * Returns the lock fd to release once the PID file has been written (or on
+ * any early-return/throw), never before.
+ */
+function acquireStartLock() {
+    const lockFile = proxyLockFilePath();
+    try {
+        return fs.openSync(lockFile, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
+    }
+    catch (e) {
+        if (e.code === 'EEXIST')
+            return null; // another start is mid-spawn
+        throw e;
+    }
+}
+function releaseStartLock(fd) {
+    if (fd === null)
+        return;
+    try {
+        fs.closeSync(fd);
+    }
+    catch {
+        /* ignore */
+    }
+    try {
+        fs.unlinkSync(proxyLockFilePath());
+    }
+    catch {
+        /* ignore */
+    }
+}
+/**
+ * Foreground start (ADR-307 default) — blocks the caller until the process
+ * exits or is interrupted. `stdio: 'inherit'` passes the proxy's own output
+ * straight through to the terminal; signals (Ctrl+C) propagate naturally to
+ * the child, no manual forwarding needed.
+ */
+export async function startForeground(supervised = false) {
+    const bin = requireBinary();
+    const status = getProxyStatus();
+    // In service mode startBackground has already written this supervisor's
+    // PID. Treating it as a competing proxy makes the supervisor immediately
+    // exit before it can spawn meta-proxy.
+    if (!supervised && status.running && status.pid)
+        throw new ProxyAlreadyRunningError(status.pid);
+    if (status.stalePidFile)
+        clearStalePidFile();
+    const child = spawn(bin, [], { stdio: 'inherit', windowsHide: false });
+    if (!supervised && child.pid)
+        writePidFile(child.pid);
+    const cleanup = () => clearStalePidFile();
+    process.on('exit', cleanup);
+    if (supervised) {
+        const forwardSignal = (signal) => {
+            if (!child.killed)
+                child.kill(signal);
+        };
+        process.once('SIGTERM', () => forwardSignal('SIGTERM'));
+        process.once('SIGINT', () => forwardSignal('SIGINT'));
+    }
+    await new Promise((resolve) => {
+        child.on('exit', () => {
+            cleanup();
+            resolve();
+        });
+    });
+    process.exit(0);
+}
+/**
+ * Background/`--service` start — detaches so the process outlives this
+ * `ruflo` invocation, redirecting stdout/stderr to a real log file (not
+ * buffered in-process). Returns once the child's PID is confirmed written,
+ * without waiting for the process to exit.
+ */
+export async function startBackground() {
+    requireBinary();
+    const status = getProxyStatus();
+    if (status.running && status.pid)
+        throw new ProxyAlreadyRunningError(status.pid);
+    const lockFd = acquireStartLock();
+    try {
+        // Re-check under the lock — the dedup above raced a concurrent starter.
+        const rechecked = getProxyStatus();
+        if (rechecked.running && rechecked.pid)
+            throw new ProxyAlreadyRunningError(rechecked.pid);
+        if (rechecked.stalePidFile)
+            clearStalePidFile();
+        const logFd = fs.openSync(proxyLogFilePath(), 'a');
+        const cliEntry = process.argv[1];
+        if (!cliEntry)
+            throw new Error('cannot locate the ruflo CLI entrypoint for supervised service mode');
+        const child = spawn(process.execPath, [cliEntry, 'proxy', 'supervise'], {
+            stdio: ['ignore', logFd, logFd],
+            detached: true,
+            windowsHide: true,
+        });
+        fs.closeSync(logFd); // the child holds its own duplicated fd; safe to close ours
+        if (!child.pid)
+            throw new Error('ruflo proxy supervisor failed to spawn — no PID returned');
+        writePidFile(child.pid);
+        child.unref();
+        return { pid: child.pid };
+    }
+    finally {
+        releaseStartLock(lockFd);
+    }
+}
+/** SIGTERM -> 1000ms -> SIGKILL if still alive, mirroring daemon.ts's killBackgroundDaemon. */
+export async function stopProxy() {
+    const status = getProxyStatus();
+    if (!status.running || !status.pid) {
+        if (status.stalePidFile)
+            clearStalePidFile();
+        return { wasRunning: false, pid: null };
+    }
+    const pid = status.pid;
+    process.kill(pid, 'SIGTERM');
+    await new Promise((r) => setTimeout(r, 1000));
+    if (isProcessRunning(pid)) {
+        process.kill(pid, 'SIGKILL');
+    }
+    clearStalePidFile();
+    return { wasRunning: true, pid };
+}
+const TAIL_BYTES = 64 * 1024; // bounded read — a long-running proxy's log grows over weeks
+export function readProxyLogTail(maxBytes = TAIL_BYTES) {
+    const logPath = proxyLogFilePath();
+    if (!fs.existsSync(logPath))
+        return '';
+    const { size } = fs.statSync(logPath);
+    const start = Math.max(0, size - maxBytes);
+    const fd = fs.openSync(logPath, 'r');
+    try {
+        const buf = Buffer.alloc(size - start);
+        fs.readSync(fd, buf, 0, buf.length, start);
+        return buf.toString('utf-8');
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/** Streams new log lines as they're appended, starting from the current end of file. */
+export function watchProxyLog(onLine) {
+    const logPath = proxyLogFilePath();
+    if (!fs.existsSync(logPath)) {
+        throw new Error('no log file yet — meta-proxy has never been started in --service mode');
+    }
+    let offset = fs.statSync(logPath).size;
+    return fs.watch(logPath, () => {
+        const { size } = fs.statSync(logPath);
+        if (size <= offset)
+            return;
+        const fd = fs.openSync(logPath, 'r');
+        try {
+            const buf = Buffer.alloc(size - offset);
+            fs.readSync(fd, buf, 0, buf.length, offset);
+            offset = size;
+            for (const line of buf.toString('utf-8').split('\n')) {
+                if (line.length > 0)
+                    onLine(line);
+            }
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    });
+}
+//# sourceMappingURL=lifecycle.js.map

package/v3/@claude-flow/cli/dist/src/proxy/paths.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Filesystem layout for the managed meta-proxy binary (ADR-307), all under
+ * the same `~/.ruflo` state dir every other funnel/proxy/auth file uses
+ * (src/funnel/state.ts's `funnelStateDir()` — respects RUFLO_STATE_DIR for
+ * tests). Centralized here so doctor.ts, install.ts, and lifecycle.ts share
+ * one definition instead of three copies drifting apart.
+ */
+export declare function proxyBinaryPath(): string;
+export declare function proxyPidFilePath(): string;
+export declare function proxyLockFilePath(): string;
+export declare function proxyLogFilePath(): string;
+export declare function proxyInstallManifestPath(): string;
+export declare function proxyConfigPath(): string;
+export declare function proxyTokenPath(): string;
+export declare function proxyInjectedTokenPath(): string;
+export interface InstallManifest {
+    version: string;
+    sha256: string;
+    verifiedAt: string;
+    pubkeyFingerprint: string;
+}
+/**
+ * True if `bind` (a `host:port` string from proxy-config.toml) targets a
+ * loopback address — decides whether the non-loopback exposure warning
+ * fires (ADR-307). Recognizes the whole IPv4 127.0.0.0/8 block, IPv6 `::1`,
+ * IPv4-mapped IPv6 loopback, and the `localhost` hostname.
+ *
+ * A plain `bind.startsWith('127.0.0.1')` check (the obvious first draft)
+ * misclassifies `[::1]:port` as non-loopback — a real bug meta-proxy's own
+ * Rust `is_loopback_bind` fixed for the identical reason; this mirrors that
+ * fix rather than repeating the mistake on the TypeScript side.
+ */
+export declare function isLoopbackBind(bind: string): boolean;
+//# sourceMappingURL=paths.d.ts.map

package/v3/@claude-flow/cli/dist/src/proxy/paths.js

@@ -0,0 +1,70 @@
+/**
+ * Filesystem layout for the managed meta-proxy binary (ADR-307), all under
+ * the same `~/.ruflo` state dir every other funnel/proxy/auth file uses
+ * (src/funnel/state.ts's `funnelStateDir()` — respects RUFLO_STATE_DIR for
+ * tests). Centralized here so doctor.ts, install.ts, and lifecycle.ts share
+ * one definition instead of three copies drifting apart.
+ */
+import { join } from 'node:path';
+import { funnelStateDir } from '../funnel/index.js';
+const BINARY_NAME = process.platform === 'win32' ? 'meta-proxy.exe' : 'meta-proxy';
+export function proxyBinaryPath() {
+    return join(funnelStateDir(), 'bin', BINARY_NAME);
+}
+export function proxyPidFilePath() {
+    return join(funnelStateDir(), 'proxy.pid');
+}
+export function proxyLockFilePath() {
+    return join(funnelStateDir(), 'proxy.lock');
+}
+export function proxyLogFilePath() {
+    return join(funnelStateDir(), 'proxy.log');
+}
+export function proxyInstallManifestPath() {
+    return join(funnelStateDir(), 'proxy', 'install-manifest.json');
+}
+export function proxyConfigPath() {
+    return join(funnelStateDir(), 'proxy-config.toml');
+}
+export function proxyTokenPath() {
+    return join(funnelStateDir(), 'proxy-token');
+}
+export function proxyInjectedTokenPath() {
+    return join(funnelStateDir(), 'proxy-injected-token.json');
+}
+/**
+ * True if `bind` (a `host:port` string from proxy-config.toml) targets a
+ * loopback address — decides whether the non-loopback exposure warning
+ * fires (ADR-307). Recognizes the whole IPv4 127.0.0.0/8 block, IPv6 `::1`,
+ * IPv4-mapped IPv6 loopback, and the `localhost` hostname.
+ *
+ * A plain `bind.startsWith('127.0.0.1')` check (the obvious first draft)
+ * misclassifies `[::1]:port` as non-loopback — a real bug meta-proxy's own
+ * Rust `is_loopback_bind` fixed for the identical reason; this mirrors that
+ * fix rather than repeating the mistake on the TypeScript side.
+ */
+export function isLoopbackBind(bind) {
+    const hostPart = (host) => {
+        const stripped = host.replace(/^\[/, '').replace(/\]$/, '');
+        if (stripped.toLowerCase() === 'localhost')
+            return true;
+        if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(stripped))
+            return true; // 127.0.0.0/8
+        if (stripped === '::1')
+            return true;
+        if (/^::ffff:127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/i.test(stripped))
+            return true; // IPv4-mapped loopback
+        return false;
+    };
+    // IPv6 bracketed form: [::1]:11435
+    const bracketed = bind.match(/^\[([^\]]+)\]:\d+$/);
+    if (bracketed)
+        return hostPart(bracketed[1]);
+    // host:port (IPv4 or hostname) — split on the LAST colon so a bare IPv6
+    // address without brackets (ambiguous, shouldn't occur in practice) isn't
+    // misparsed as host:port.
+    const lastColon = bind.lastIndexOf(':');
+    const host = lastColon === -1 ? bind : bind.slice(0, lastColon);
+    return hostPart(host);
+}
+//# sourceMappingURL=paths.js.map