claude-flow 3.47.1 → 3.49.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (84) hide show
  1. package/.claude/.proven-config-version +1 -0
  2. package/.claude/helpers/auto-memory-hook.mjs +6 -2
  3. package/.claude/helpers/hook-handler.cjs +7 -4
  4. package/.claude/helpers/learning-service.mjs +4 -2
  5. package/.claude/helpers/memory.cjs +1 -1
  6. package/.claude/helpers/metrics-db.mjs +4 -2
  7. package/.claude/helpers/router.cjs +1 -1
  8. package/.claude/helpers/session.cjs +1 -1
  9. package/.claude/proven-config.json +42 -0
  10. package/.claude-plugin/marketplace.json +16 -1
  11. package/README.md +1 -53
  12. package/README.zh-CN.md +1 -53
  13. package/node_modules/@claude-flow/codex/package.json +1 -1
  14. package/node_modules/@claude-flow/mcp/dist/tool-registry.d.ts.map +1 -1
  15. package/node_modules/@claude-flow/mcp/dist/tool-registry.js +11 -3
  16. package/node_modules/@claude-flow/mcp/dist/tool-registry.js.map +1 -1
  17. package/node_modules/@claude-flow/mcp/package.json +6 -3
  18. package/node_modules/@claude-flow/plugin-agent-federation/package.json +3 -3
  19. package/node_modules/@claude-flow/security/dist/policy/engine.d.ts +2 -6
  20. package/node_modules/@claude-flow/security/dist/policy/engine.d.ts.map +1 -1
  21. package/node_modules/@claude-flow/security/dist/policy/engine.js +35 -1
  22. package/node_modules/@claude-flow/security/dist/policy/engine.js.map +1 -1
  23. package/node_modules/@claude-flow/security/dist/policy/types.d.ts +18 -0
  24. package/node_modules/@claude-flow/security/dist/policy/types.d.ts.map +1 -1
  25. package/node_modules/@claude-flow/security/package.json +2 -3
  26. package/package.json +7 -7
  27. package/v3/@claude-flow/cli/README.md +1 -53
  28. package/v3/@claude-flow/cli/bin/cli.js +4 -1
  29. package/v3/@claude-flow/cli/catalog-manifest.json +4 -4
  30. package/v3/@claude-flow/cli/dist/src/commands/analyze.js +2 -2
  31. package/v3/@claude-flow/cli/dist/src/commands/config.js +5 -7
  32. package/v3/@claude-flow/cli/dist/src/commands/doctor.d.ts +19 -1
  33. package/v3/@claude-flow/cli/dist/src/commands/doctor.js +69 -8
  34. package/v3/@claude-flow/cli/dist/src/commands/hooks.js +22 -9
  35. package/v3/@claude-flow/cli/dist/src/commands/memory.js +119 -34
  36. package/v3/@claude-flow/cli/dist/src/commands/metaharness.js +1 -0
  37. package/v3/@claude-flow/cli/dist/src/commands/plugins.js +44 -7
  38. package/v3/@claude-flow/cli/dist/src/commands/policy.js +5 -2
  39. package/v3/@claude-flow/cli/dist/src/commands/security.js +113 -55
  40. package/v3/@claude-flow/cli/dist/src/commands/session.js +132 -25
  41. package/v3/@claude-flow/cli/dist/src/commands/swarm.js +11 -11
  42. package/v3/@claude-flow/cli/dist/src/commands/task.js +5 -4
  43. package/v3/@claude-flow/cli/dist/src/index.js +10 -1
  44. package/v3/@claude-flow/cli/dist/src/init/executor.js +11 -5
  45. package/v3/@claude-flow/cli/dist/src/init/helper-companions.d.ts +3 -0
  46. package/v3/@claude-flow/cli/dist/src/init/helper-companions.js +34 -0
  47. package/v3/@claude-flow/cli/dist/src/init/helper-integrity.d.ts +21 -0
  48. package/v3/@claude-flow/cli/dist/src/init/helper-integrity.js +62 -0
  49. package/v3/@claude-flow/cli/dist/src/init/helper-refresh.d.ts +18 -11
  50. package/v3/@claude-flow/cli/dist/src/init/helper-refresh.js +56 -13
  51. package/v3/@claude-flow/cli/dist/src/init/helpers-generator.js +14 -12
  52. package/v3/@claude-flow/cli/dist/src/mcp-server.js +10 -3
  53. package/v3/@claude-flow/cli/dist/src/mcp-tools/agentdb-tools.js +29 -62
  54. package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.d.ts +16 -7
  55. package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js +226 -51
  56. package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.d.ts +7 -0
  57. package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js +131 -40
  58. package/v3/@claude-flow/cli/dist/src/mcp-tools/policy-enforcer.d.ts +8 -1
  59. package/v3/@claude-flow/cli/dist/src/mcp-tools/policy-enforcer.js +80 -8
  60. package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.d.ts +15 -0
  61. package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.js +270 -58
  62. package/v3/@claude-flow/cli/dist/src/memory/feedback-patterns.d.ts +13 -0
  63. package/v3/@claude-flow/cli/dist/src/memory/feedback-patterns.js +14 -0
  64. package/v3/@claude-flow/cli/dist/src/memory/live-memory-row.d.ts +3 -0
  65. package/v3/@claude-flow/cli/dist/src/memory/live-memory-row.js +5 -0
  66. package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.d.ts +11 -20
  67. package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.js +348 -134
  68. package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.d.ts +9 -1
  69. package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js +47 -34
  70. package/v3/@claude-flow/cli/dist/src/plugins/manager.d.ts +37 -10
  71. package/v3/@claude-flow/cli/dist/src/plugins/manager.js +106 -20
  72. package/v3/@claude-flow/cli/dist/src/plugins/trust-policy.d.ts +61 -0
  73. package/v3/@claude-flow/cli/dist/src/plugins/trust-policy.js +84 -0
  74. package/v3/@claude-flow/cli/dist/src/ruvector/graph-analyzer.js +4 -1
  75. package/v3/@claude-flow/cli/dist/src/services/config-file-manager.js +30 -8
  76. package/v3/@claude-flow/cli/dist/src/services/memory-backup.d.ts +1 -1
  77. package/v3/@claude-flow/cli/dist/src/services/memory-backup.js +67 -27
  78. package/v3/@claude-flow/cli/dist/src/services/policy-runtime.d.ts +6 -0
  79. package/v3/@claude-flow/cli/dist/src/services/policy-runtime.js +27 -2
  80. package/v3/@claude-flow/cli/dist/src/services/worker-daemon.d.ts +2 -2
  81. package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js +23 -14
  82. package/v3/@claude-flow/cli/package.json +9 -9
  83. package/v3/@claude-flow/guidance/package.json +5 -6
  84. package/v3/@claude-flow/shared/package.json +6 -3
@@ -1,15 +1,4 @@
1
- /**
2
- * AgentDB MCP Tools — Phase 6 of ADR-053
3
- *
4
- * Exposes AgentDB v3 controller operations as MCP tools.
5
- * Provides direct access to ReasoningBank, CausalGraph, SkillLibrary,
6
- * AttestationLog, and bridge health through the MCP protocol.
7
- *
8
- * Security: All handlers validate input types, enforce length bounds,
9
- * and sanitize error messages before returning to MCP callers.
10
- *
11
- * @module v3/cli/mcp-tools/agentdb-tools
12
- */
1
+ import { feedbackPatternsSchema, validateFeedbackPatterns } from '../memory/feedback-patterns.js';
13
2
  import { validateIdentifier, validateText } from './validate-input.js';
14
3
  // ===== Shared validation helpers =====
15
4
  const MAX_STRING_LENGTH = 100_000; // 100KB max for any string input
@@ -66,12 +55,6 @@ async function getBridge() {
66
55
  // Lazy-cached modules used by graph-query / graph-pathfinder dispatch.
67
56
  // Caching the resolved namespace avoids per-call dynamic-import overhead
68
57
  // in the ADR-130 hot path (smoke harness measures elapsedMs of every call).
69
- let graphBackendMod = null;
70
- async function getGraphBackend() {
71
- if (!graphBackendMod)
72
- graphBackendMod = await import('../ruvector/graph-backend.js');
73
- return graphBackendMod;
74
- }
75
58
  let graphEdgeWriterMod = null;
76
59
  async function getGraphEdgeWriter() {
77
60
  if (!graphEdgeWriterMod)
@@ -396,6 +379,7 @@ export const agentdbFeedback = {
396
379
  type: 'object',
397
380
  properties: {
398
381
  taskId: { type: 'string', description: 'Task identifier' },
382
+ patterns: feedbackPatternsSchema,
399
383
  success: { type: 'boolean', description: 'Whether task succeeded' },
400
384
  quality: { type: 'number', description: 'Quality score (0-1)' },
401
385
  agent: { type: 'string', description: 'Agent that performed the task' },
@@ -415,9 +399,11 @@ export const agentdbFeedback = {
415
399
  const taskId = validateString(params.taskId, 'taskId', 500);
416
400
  if (!taskId)
417
401
  return { success: false, error: 'taskId is required (non-empty string, max 500 chars)' };
402
+ const patterns = validateFeedbackPatterns(params.patterns);
418
403
  const bridge = await getBridge();
419
404
  const result = await bridge.bridgeRecordFeedback({
420
405
  taskId,
406
+ patterns,
421
407
  success: params.success === true,
422
408
  quality: validateScore(params.quality, 0.85),
423
409
  agent: validateString(params.agent, 'agent', 200) ?? undefined,
@@ -802,21 +788,18 @@ export const agentdbHierarchicalRecall = {
802
788
  // ===== agentdb_consolidate — Run memory consolidation =====
803
789
  export const agentdbConsolidate = {
804
790
  name: 'agentdb_consolidate',
805
- description: 'Run memory consolidation to promote entries across tiers and compress old data Use when generic memory_* tools are wrong because you need AgentDB-specific controllers (HNSW vector search, hierarchical tiers, causal-graph links, pattern store/recall, RaBitQ quantization). For simple key-value persistence, memory_store/memory_retrieve are simpler. For unrelated file work, native Read/Write are fine.',
791
+ description: 'Request memory consolidation. Use when checking whether AgentDB can consolidate retained memories; native file edits cannot perform controller consolidation. Currently returns unsupported when the installed controller is a no-op stub; no entries are promoted or compressed in that case.',
806
792
  inputSchema: {
807
793
  type: 'object',
808
- properties: {
809
- minAge: { type: 'number', description: 'Minimum age in hours since store (optional)' },
810
- maxEntries: { type: 'number', description: 'Maximum entries to consolidate (optional)' },
811
- },
794
+ properties: {},
812
795
  },
813
796
  handler: async (params) => {
814
797
  try {
798
+ if (Object.keys(params).length > 0) {
799
+ return { success: false, status: 'unsupported', error: 'agentdb_consolidate does not support options' };
800
+ }
815
801
  const bridge = await getBridge();
816
- const result = await bridge.bridgeConsolidate({
817
- minAge: typeof params.minAge === 'number' ? Math.max(0, params.minAge) : undefined,
818
- maxEntries: validatePositiveInt(params.maxEntries, 1000, 10_000),
819
- });
802
+ const result = await bridge.bridgeConsolidate({});
820
803
  return result ?? { success: false, error: 'AgentDB bridge not available. Use memory_store/memory_search instead.' };
821
804
  }
822
805
  catch (error) {
@@ -1060,7 +1043,7 @@ export const agentdbCausalNodeDelete = {
1060
1043
  };
1061
1044
  export const agentdbGraphQuery = {
1062
1045
  name: 'agentdb_graph-query',
1063
- description: 'Unified graph traversal across the knowledge graph (ADR-130). Native graph-node k-hop cannot filter by relation and returns an explicit unsupported error for that request; the SQL fallback can filter by relation. Inspect appliedDepth/truncated because SQL is bounded at 3 hops. Semantic and PageRank modes use their own backends. Use when you need structured graph traversal beyond flat memory search.',
1046
+ description: 'Unified graph traversal across the knowledge graph (ADR-130). K-hop queries read committed graph_edges relationships through SQL; a separately populated native graph is not evidence of retained-history coverage. Inspect appliedDepth/truncated because SQL is bounded at 3 hops. maxNodesVisited bounds returned rows, not traversal work or elapsed time. Semantic and PageRank modes use their own backends. Use when you need relationship traversal beyond flat memory search.',
1064
1047
  inputSchema: {
1065
1048
  type: 'object',
1066
1049
  properties: {
@@ -1101,53 +1084,38 @@ export const agentdbGraphQuery = {
1101
1084
  }
1102
1085
  const budgetRaw = (params.complexityBudget ?? {});
1103
1086
  const budget = {
1104
- maxNodesVisited: budgetRaw.maxNodesVisited ?? 10_000,
1105
- maxDepth: budgetRaw.maxDepth ?? 5,
1087
+ maxNodesVisited: validatePositiveInt(budgetRaw.maxNodesVisited, 10_000, 10_000),
1088
+ maxDepth: validatePositiveInt(budgetRaw.maxDepth, 5, 5),
1106
1089
  maxMillis: budgetRaw.maxMillis ?? 50,
1107
1090
  maxMemoryMB: budgetRaw.maxMemoryMB ?? 32,
1108
1091
  };
1109
- const depth = Math.min(validatePositiveInt(params.depth, 2, budget.maxDepth), budget.maxDepth);
1092
+ const requestedDepth = validatePositiveInt(params.depth, 2, 5);
1093
+ const depth = Math.min(requestedDepth, budget.maxDepth);
1110
1094
  const topK = validatePositiveInt(params.topK, 10, MAX_TOP_K);
1111
1095
  const relation = validateString(params.relation, 'relation', 200) ?? undefined;
1112
1096
  // ── k-hop mode ──────────────────────────────────────────────────────────
1113
1097
  if (mode === 'k-hop') {
1114
- // graph-node's kHopNeighbors API has no relation parameter. Its graph
1115
- // and the SQL graph are separate stores, and SQL writes can be async;
1116
- // switching stores here could report a false negative. Refuse the
1117
- // unsupported native query instead of silently widening it.
1118
- try {
1119
- const graphBackend = await getGraphBackend();
1120
- if (await graphBackend.isGraphBackendAvailable()) {
1121
- if (relation) {
1122
- return { success: false, error: 'Native graph-node k-hop does not support relation filtering', unsupported: 'relation', mode, nodeId, relation, backend: 'graph-node' };
1123
- }
1124
- const neighbors = await graphBackend.getNeighbors(nodeId, depth);
1125
- return {
1126
- success: true, mode, nodeId, depth, appliedDepth: depth,
1127
- results: neighbors.map(id => ({ nodeId: id })),
1128
- count: neighbors.length,
1129
- backend: 'graph-node',
1130
- elapsedMs: Date.now() - t0,
1131
- };
1132
- }
1133
- }
1134
- catch { /* fall through to SQL */ }
1135
- // SQL CTE fallback is bounded at depth 3. Report that bound so callers
1136
- // cannot mistake an incomplete depth-5 cycle check for a complete one.
1098
+ // #3315: graph-node and retained SQL are populated independently.
1099
+ // Native availability does not establish historical coverage. Query
1100
+ // the committed relationship source, and fail if it cannot be read.
1137
1101
  try {
1138
1102
  const { getBridgeDb } = await getGraphEdgeWriter();
1139
1103
  const db = await getBridgeDb();
1140
1104
  if (db) {
1141
1105
  const appliedDepth = Math.min(depth, 3);
1142
- const cteSql = buildKHopCTE(nodeId, appliedDepth, relation, budget.maxNodesVisited);
1106
+ const cteSql = buildKHopCTE(nodeId, appliedDepth, relation, budget.maxNodesVisited + 1);
1143
1107
  // graph-edge-writer returns a better-sqlite3 Database after #2431.
1144
1108
  // `db.exec(sql, params)` (sql.js style) is a runner with no result
1145
1109
  // on better-sqlite3 — use `prepare(sql).raw().all(...)` to get the
1146
1110
  // same array-of-arrays shape the downstream code expects.
1147
- const rows = db.prepare(cteSql).raw().all();
1111
+ const allRows = db.prepare(cteSql).raw().all();
1112
+ const resultLimitReached = allRows.length > budget.maxNodesVisited;
1113
+ const rows = allRows.slice(0, budget.maxNodesVisited);
1114
+ const depthLimited = appliedDepth < requestedDepth;
1148
1115
  return {
1149
- success: true, mode, nodeId, depth, appliedDepth,
1150
- ...(appliedDepth < depth ? { truncated: true } : {}),
1116
+ success: true, mode, nodeId, depth, requestedDepth, appliedDepth,
1117
+ depthLimited, resultLimitReached, truncated: depthLimited || resultLimitReached,
1118
+ resultLimit: budget.maxNodesVisited,
1151
1119
  results: rows.map((r) => ({ nodeId: r[0], depth: r[1] })),
1152
1120
  count: rows.length,
1153
1121
  backend: 'sql-cte',
@@ -1155,11 +1123,10 @@ export const agentdbGraphQuery = {
1155
1123
  };
1156
1124
  }
1157
1125
  }
1158
- catch { /* db unavailable */ }
1159
- if (relation) {
1160
- return { success: false, error: 'Relation-filtered k-hop query requires the SQL graph_edges backend', mode, nodeId, relation };
1126
+ catch (error) {
1127
+ return { success: false, error: `Retained SQL graph query failed: ${sanitizeError(error)}`, mode, nodeId };
1161
1128
  }
1162
- return { success: false, error: 'No graph backend available for k-hop query', mode, nodeId };
1129
+ return { success: false, error: 'Retained SQL graph_edges backend is unavailable for k-hop query', mode, nodeId };
1163
1130
  }
1164
1131
  // ── semantic mode ────────────────────────────────────────────────────────
1165
1132
  if (mode === 'semantic') {
@@ -1,7 +1,3 @@
1
- /**
2
- * Hooks MCP Tools
3
- * Provides intelligent hooks functionality via MCP protocol
4
- */
5
1
  import { type MCPTool } from './types.js';
6
2
  import { type RouterEmbedderKind } from '../ruvector/router-embedder.js';
7
3
  /**
@@ -16,11 +12,24 @@ import { type RouterEmbedderKind } from '../ruvector/router-embedder.js';
16
12
  export declare function scrubReasoningBlocks(text: string): string;
17
13
  /** Test hook: drop the cached semantic index so the next route rebuilds it. */
18
14
  export declare function resetSemanticRouterForTests(): void;
19
- /** Exported for tests. */
20
- export declare function suggestAgentsForTask(task: string): {
15
+ /**
16
+ * Confidence for a task nothing matched (#3567). It must rank below every real
17
+ * signal: keyword hits are >= 0.8, learned outcomes >= 0.7, and a semantic
18
+ * match is only eligible above 0.4. Matches the helper router's 0.3 fall-through.
19
+ */
20
+ export declare const NO_MATCH_CONFIDENCE = 0.3;
21
+ export interface TaskAgentSuggestion {
21
22
  agents: string[];
22
23
  confidence: number;
23
- };
24
+ /** false when no keyword or learned pattern matched; the agents are a default, not a decision. */
25
+ matched: boolean;
26
+ reason?: 'no-match-default';
27
+ note?: string;
28
+ }
29
+ /** True when the task has at least one letter or digit in any script. */
30
+ export declare function hasRoutableText(task: string): boolean;
31
+ /** Exported for tests. */
32
+ export declare function suggestAgentsForTask(task: string): TaskAgentSuggestion;
24
33
  export declare const hooksPreEdit: MCPTool;
25
34
  export declare const hooksPostEdit: MCPTool;
26
35
  export declare const hooksPreCommand: MCPTool;