claude-flow 3.5.77 → 3.5.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.5.77",
+  "version": "3.5.78",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/security.js

@@ -5,6 +5,7 @@
  * Created with ❤️ by ruv.io
  */
 import { output } from '../output.js';
+import { execSync } from 'node:child_process';
 // Scan subcommand
 const scanCommand = {
     name: 'scan',
@@ -337,7 +338,6 @@ const threatsCommand = {
         // Check for .env files committed to git
         const checkEnvInGit = () => {
             try {
-                const { execSync } = require('child_process');
                 const tracked = execSync('git ls-files --cached', { cwd: rootDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
                 const envFiles = tracked.split('\n').filter((f) => /(?:^|\/)\.env(?:\.|$)/.test(f));
                 for (const envFile of envFiles) {

package/v3/@claude-flow/cli/dist/src/mcp-server.js

@@ -17,6 +17,8 @@
  * @version 3.0.0
  */
 import { EventEmitter } from 'events';
+import { execFileSync } from 'child_process';
+import { request as httpRequestFn } from 'http';
 import { randomUUID } from 'crypto';
 import * as path from 'path';
 import * as fs from 'fs';
@@ -572,13 +574,11 @@ export class MCPServerManager extends EventEmitter {
         // Verify it's actually a node process (guards against PID reuse)
         // DA-CRIT-3: Use execFileSync to prevent command injection via PID values
         try {
-            const { execFileSync } = require('child_process');
             const safePid = String(Math.floor(Math.abs(pid)));
             let cmdline = '';
             try {
                 // Try /proc on Linux
-                const { readFileSync } = require('fs');
-                cmdline = readFileSync(`/proc/${safePid}/cmdline`, 'utf8');
+                cmdline = fs.readFileSync(`/proc/${safePid}/cmdline`, 'utf8');
             }
             catch {
                 // Fall back to ps on macOS/other
@@ -608,8 +608,7 @@ export class MCPServerManager extends EventEmitter {
     async httpRequest(url, method, timeout) {
         return new Promise((resolve, reject) => {
             const urlObj = new URL(url);
-            const http = require('http');
-            const req = http.request({
+            const req = httpRequestFn({
                 hostname: urlObj.hostname,
                 port: urlObj.port,
                 path: urlObj.pathname,

package/v3/@claude-flow/cli/dist/src/mcp-tools/performance-tools.js

@@ -13,7 +13,7 @@
  */
 import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import * as os from 'node:os';
 // Storage paths
@@ -183,7 +183,6 @@ export const performanceTools = [
                 readFileSync(probeFile);
                 diskLatencyMs = Math.round((performance.now() - t0) * 100) / 100;
                 try {
-                    const { unlinkSync } = require('node:fs');
                     unlinkSync(probeFile);
                 }
                 catch { /* best-effort */ }
@@ -421,7 +420,6 @@ export const performanceTools = [
                 .sort((a, b) => b.percentOfTotal - a.percentOfTotal);
             // Cleanup probe file
             try {
-                const { unlinkSync } = require('node:fs');
                 unlinkSync(join(getPerfDir(), '.profile-probe'));
             }
             catch { /* ok */ }
@@ -472,7 +470,6 @@ export const performanceTools = [
                 readFileSync(probe);
                 diskLatencyBefore = Math.round((performance.now() - t0) * 100) / 100;
                 try {
-                    const { unlinkSync } = require('node:fs');
                     unlinkSync(probe);
                 }
                 catch { /* ok */ }
@@ -517,10 +514,9 @@ export const performanceTools = [
             if (aggressive) {
                 try {
                     const dir = getPerfDir();
-                    const { readdirSync, unlinkSync: ul } = require('node:fs');
                     const probes = readdirSync(dir).filter((f) => f.startsWith('.'));
                     probes.forEach((f) => { try {
-                        ul(join(dir, f));
+                        unlinkSync(join(dir, f));
                     }
                     catch { /* ok */ } });
                     if (probes.length > 0)

package/v3/@claude-flow/cli/dist/src/ruvector/coverage-router.js

@@ -6,6 +6,9 @@
  * - TTL-based caching of coverage data
  * - Singleton router instance
  */
+import * as pathMod from 'node:path';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 // ============================================================================
 // Caching for Performance
 // ============================================================================
@@ -378,7 +381,8 @@ export async function coverageGaps(options = {}) {
  * Returns null if path is invalid or attempts traversal
  */
 function validateProjectPath(inputPath) {
-    const { resolve, normalize, isAbsolute } = require('path');
+    // eslint-disable-next-line @typescript-eslint/no-var-requires -- sync function, top-level import at file head
+    const { resolve, normalize, isAbsolute } = pathMod;
     // Default to cwd if not provided
     const basePath = inputPath || process.cwd();
     // Normalize and resolve the path
@@ -417,9 +421,7 @@ async function loadProjectCoverage(projectRoot, skipCache) {
             return cached.report;
         }
     }
-    const { existsSync } = require('fs');
-    const { readFile } = require('fs/promises');
-    const { join, normalize } = require('path');
+    const { join, normalize } = pathMod;
     // Try common coverage locations (all relative to validated root)
     const coverageLocations = [
         ['coverage', 'coverage-final.json'],

package/v3/@claude-flow/cli/dist/src/ruvector/diff-classifier.js

@@ -1,6 +1,8 @@
 /**
  * Diff Classifier for Change Analysis
  */
+import { execFileSync, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 const DEFAULT_CONFIG = {
     maxDiffSize: 10000,
     classifyByImpact: true,
@@ -344,7 +346,7 @@ export function getGitDiffNumstat(ref = 'HEAD') {
     if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
         return cached.files;
     }
-    const { execFileSync } = require('child_process');
+    // execFileSync imported at top level
     try {
         // SECURITY: Use execFileSync with args array instead of shell string
         // This prevents command injection via the ref parameter
@@ -417,8 +419,7 @@ export async function getGitDiffNumstatAsync(ref = 'HEAD') {
     if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
         return cached.files;
     }
-    const { execFile } = require('child_process');
-    const { promisify } = require('util');
+    // execFile + promisify imported at top level
     const execFileAsync = promisify(execFile);
     try {
         // SECURITY: Use execFile with args array instead of shell string

package/v3/@claude-flow/cli/dist/src/update/checker.js

@@ -3,6 +3,7 @@
  * Queries npm registry and compares versions
  */
 import * as semver from 'semver';
+import { createRequire } from 'node:module';
 import { shouldCheckForUpdates, recordCheck, getCachedVersions } from './rate-limiter.js';
 const DEFAULT_CONFIG = {
     enabled: true,
@@ -88,10 +89,10 @@ export function getInstalledVersion(packageName) {
         ];
         for (const modulePath of possiblePaths) {
             try {
-                // Use dynamic import with require for package.json
-                const resolved = require.resolve(modulePath, { paths: [process.cwd()] });
-                // eslint-disable-next-line @typescript-eslint/no-var-requires
-                const pkg = require(resolved);
+                // Use createRequire for ESM-compatible package.json loading
+                const esmRequire = createRequire(import.meta.url);
+                const resolved = esmRequire.resolve(modulePath, { paths: [process.cwd()] });
+                const pkg = esmRequire(resolved);
                 return pkg.version;
             }
             catch {

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.5.77",
+  "version": "3.5.78",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",