claude-flow 3.32.37 → 3.32.39

package/.claude/.proven-config-version

@@ -0,0 +1 @@
+sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319

package/.claude/proven-config.json

@@ -0,0 +1,42 @@
+{
+  "adoptedAt": 1785375407244,
+  "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
+  "manifest": {
+    "schema": "ruflo.proven-config/v1",
+    "policy": {
+      "ref": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
+      "value": {
+        "alpha": 0.3,
+        "subjectWeight": 1,
+        "mmrLambda": 0.5,
+        "bodyWeight": 1.5,
+        "typePenaltyFactor": 0.5
+      }
+    },
+    "layer": "framework/node-cli",
+    "compatibility": {
+      "ruflo": ">=3.24.0"
+    },
+    "benchmark": {
+      "corpus": "ADR-081-labelled-v1",
+      "corpusHash": "sha256:2f700b5c363e20a3bd88ce2bc9b87bbbbaa61732c6177894c6ec37890f888982"
+    },
+    "receipt": {
+      "heldOutDelta": 0.07381404928570845,
+      "redblue": "PASS",
+      "drift": 0,
+      "canary": {
+        "rollbackRate": 0,
+        "latencyP95": 244.612458000076,
+        "costPerTask": 0
+      },
+      "receiptCoverage": 1
+    },
+    "platform": [
+      "linux",
+      "macOS",
+      "windows"
+    ]
+  },
+  "previous": ""
+}

package/.claude-plugin/hooks/hooks.json

@@ -1,9 +1,7 @@
 {
-  "_note": "#1921 — hook commands invoke scripts/ruflo-hook.sh (resilient shim): prefers a locally-installed `ruflo`/`claude-flow` binary, falls back to `npx --prefer-offline`, and always exits 0 so a CLI/install failure (e.g. arborist `Invalid Version` on npm 10.8.x) never surfaces an error in Claude Code or blocks a turn. The trailing `|| true` guards the case where $CLAUDE_PLUGIN_ROOT is unset (older Claude Code) — the hook then no-ops silently. DO NOT revert to a bare `npx <pkg>@alpha hooks …` per fire.",
+  "description": "Hook commands invoke scripts/ruflo-hook.sh (resilient shim): prefers a locally-installed `ruflo`/`claude-flow` binary, falls back to `npx --prefer-offline`, and always exits 0 so a CLI/install failure never surfaces an error in Claude Code or blocks a turn. The trailing `|| true` guards the case where $CLAUDE_PLUGIN_ROOT is unset (older Claude Code) — the hook then no-ops silently. This manifest is intentionally POSIX-only (Mac/Linux): it uses /bin/bash, POSIX pipelines (jq, xargs, tr), and .sh scripts, and is known-broken on native Windows. It is a separately-published legacy \"claude-flow\" plugin package (not in the ruflo marketplace list) with its own jq/xargs-based hook set and its own scripts/ruflo-hook.cjs that this file never references — still needs its own Windows-compatible, Node-based rewrite.",
   "_platform": "posix",
-  "_platform_note": "#2132 — This hooks.json uses /bin/bash, POSIX pipelines (jq, xargs, tr), and .sh scripts. It is intentionally POSIX-only (Mac/Linux) today and known-broken on native Windows (#2721 shape). The previous claim here that `ruflo init` overrides these entries with node-based equivalents on Windows was never actually implemented and is incorrect — Claude Code merges plugin-declared hooks additively with any init-generated settings.json, it does not replace them. This package (separate from plugins/ruflo-core, which got the #2721 fix) still needs its own Windows-compatible rewrite; see _legacy_unaudited_shim below.",
   "_legacy_unaudited_shim": true,
-  "_legacy_unaudited_shim_note": "#2721 fixed plugins/ruflo-core and plugins/ruflo-cost-tracker (marketplace-listed in .claude-plugin/marketplace.json) by rewiring hooks.json to a `node -e` bootstrap around scripts/ruflo-hook.cjs. This older, separately-published \"claude-flow\" plugin package (not in the ruflo marketplace list) has its own, larger jq/xargs-based hook set and its own scripts/ruflo-hook.cjs that hooks.json never references — same underlying bug shape, NOT fixed as part of #2721. Needs its own audited pass before this flag can be removed.",
   "hooks": {
     "PreToolUse": [
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.32.37",
+  "version": "3.32.39",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/plugin-agent-federation",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 4,
-  "generatedAt": "2026-07-29T19:40:17.000Z",
-  "gitSha": "401e02d5",
+  "generatedAt": "2026-07-30T02:05:05.762Z",
+  "gitSha": "fabcc926",
   "catalog": {
     "agents": 164,
     "tools": 397,

package/v3/@claude-flow/cli/dist/src/services/daemon-autostart.d.ts

@@ -1,5 +1,14 @@
 /** True if a live daemon already holds the project's pidfile. */
 export declare function isDaemonAlive(projectRoot: string): boolean;
+/**
+ * Return true only when the directory contains a durable Ruflo project marker.
+ *
+ * A bare `.claude/` is owned by Claude Code, and a bare `.claude-flow/` is not
+ * sufficient either: startup-time policy/champion migration can create it
+ * before this function runs. Treating that mutation as authorization caused a
+ * read-only command in any Claude project to spawn a detached daemon (#2852).
+ */
+export declare function isRufloProject(projectRoot: string): boolean;
 export interface EnsureResult {
     started: boolean;
     reason?: string;

package/v3/@claude-flow/cli/dist/src/services/daemon-autostart.js

@@ -68,6 +68,43 @@ function autostartDisabled(projectRoot) {
         return true;
     return autostartDisabledByProjectConfig(projectRoot);
 }
+/**
+ * Return true only when the directory contains a durable Ruflo project marker.
+ *
+ * A bare `.claude/` is owned by Claude Code, and a bare `.claude-flow/` is not
+ * sufficient either: startup-time policy/champion migration can create it
+ * before this function runs. Treating that mutation as authorization caused a
+ * read-only command in any Claude project to spawn a detached daemon (#2852).
+ */
+export function isRufloProject(projectRoot) {
+    const root = path.resolve(projectRoot);
+    const directMarkers = [
+        path.join(root, '.claude-flow', 'config.yaml'),
+        path.join(root, '.claude-flow', 'config.yml'),
+        path.join(root, '.claude-flow', 'config.json'),
+        path.join(root, 'claude-flow.config.json'),
+        path.join(root, '.swarm', 'memory.db'),
+    ];
+    if (directMarkers.some((marker) => fs.existsSync(marker)))
+        return true;
+    try {
+        const settings = JSON.parse(fs.readFileSync(path.join(root, '.claude', 'settings.json'), 'utf-8'));
+        if (settings && typeof settings === 'object' && 'claudeFlow' in settings) {
+            return true;
+        }
+    }
+    catch { /* absent/malformed/non-Ruflo settings */ }
+    try {
+        const mcp = JSON.parse(fs.readFileSync(path.join(root, '.mcp.json'), 'utf-8'));
+        const servers = mcp?.mcpServers;
+        if (servers && typeof servers === 'object'
+            && ('ruflo' in servers || 'claude-flow' in servers)) {
+            return true;
+        }
+    }
+    catch { /* absent/malformed/non-Ruflo MCP config */ }
+    return false;
+}
 const defaultSpawn = (projectRoot) => {
     const cliBin = process.argv[1]; // the running bin/cli.js
     const child = spawn(process.execPath, [cliBin, 'daemon', 'start', '--quiet'], {
@@ -86,10 +123,7 @@ export function ensureDaemonRunning(projectRoot, opts = {}) {
     try {
         if (autostartDisabled(projectRoot))
             return { started: false, reason: 'disabled (RUFLO_DAEMON_AUTOSTART=0 or project config)' };
-        // `.claude/` belongs to Claude Code and is present in many repositories
-        // that have never initialized Ruflo. Only Ruflo's own state directory is
-        // an authorization signal for spawning a detached background process.
-        if (!fs.existsSync(path.join(projectRoot, '.claude-flow'))) {
+        if (!isRufloProject(projectRoot)) {
             return { started: false, reason: 'not a ruflo project' };
         }
         const alive = (opts.isAlive ?? isDaemonAlive)(projectRoot);

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.37",
+  "version": "3.32.39",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",