claude-flow 3.5.77 → 3.5.79

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.5.77",
+  "version": "3.5.79",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/init.js

@@ -231,8 +231,12 @@ const initAction = async (ctx) => {
         }
         output.printBox(summary.join('\n'), 'Summary');
         output.writeln();
-        // Show what was created
-        if (options.components.claudeMd || options.components.settings || options.components.skills || options.components.commands || options.components.agents) {
+        // Show what was created (honest about skip-claude — #1597)
+        if (skipClaude) {
+            output.printBox('Skipped (--skip-claude): no files written under .claude/ or ~/.claude/', 'Claude Code Integration');
+            output.writeln();
+        }
+        else if (options.components.claudeMd || options.components.settings || options.components.skills || options.components.commands || options.components.agents) {
             output.printBox([
                 options.components.claudeMd ? `CLAUDE.md:   Swarm guidance & configuration` : '',
                 options.components.settings ? `Settings:    .claude/settings.json` : '',
@@ -909,7 +913,7 @@ export const initCommand = {
         },
         {
             name: 'skip-claude',
-            description: 'Skip .claude/ directory creation (runtime only)',
+            description: 'Skip all .claude/ writes including global ~/.claude/CLAUDE.md (runtime only)',
             type: 'boolean',
             default: false,
         },

package/v3/@claude-flow/cli/dist/src/commands/security.js

@@ -5,6 +5,7 @@
  * Created with ❤️ by ruv.io
  */
 import { output } from '../output.js';
+import { execSync } from 'node:child_process';
 // Scan subcommand
 const scanCommand = {
     name: 'scan',
@@ -337,7 +338,6 @@ const threatsCommand = {
         // Check for .env files committed to git
         const checkEnvInGit = () => {
             try {
-                const { execSync } = require('child_process');
                 const tracked = execSync('git ls-files --cached', { cwd: rootDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
                 const envFiles = tracked.split('\n').filter((f) => /(?:^|\/)\.env(?:\.|$)/.test(f));
                 for (const envFile of envFiles) {

package/v3/@claude-flow/cli/dist/src/init/executor.js

@@ -1663,6 +1663,11 @@ async function writeClaudeMd(targetDir, options, result) {
         result.created.files.push('CLAUDE.md');
     }
     // Also write/append global ~/.claude/CLAUDE.md so ruflo tools are used automatically (#1497)
+    // Guarded to never overwrite user content and to respect opt-out env var (#1597).
+    // Opt out entirely with CLAUDE_FLOW_SKIP_GLOBAL_CLAUDE_MD=1.
+    if (process.env.CLAUDE_FLOW_SKIP_GLOBAL_CLAUDE_MD === '1') {
+        return;
+    }
     const homeDir = process.env.HOME || process.env.USERPROFILE || '';
     if (homeDir) {
         const globalClaudeDir = path.join(homeDir, '.claude');
@@ -1682,8 +1687,13 @@ async function writeClaudeMd(targetDir, options, result) {
             if (fs.existsSync(globalClaudeMd)) {
                 const existing = fs.readFileSync(globalClaudeMd, 'utf-8');
                 if (!existing.includes('Ruflo Integration')) {
+                    // Always back up existing user content before any modification (#1597).
+                    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+                    const backupPath = `${globalClaudeMd}.backup-${timestamp}`;
+                    fs.copyFileSync(globalClaudeMd, backupPath);
                     fs.appendFileSync(globalClaudeMd, rufloBlock);
                     result.created.files.push('~/.claude/CLAUDE.md (appended ruflo block)');
+                    result.created.files.push(`~/.claude/CLAUDE.md.backup-${timestamp} (backup of pre-existing content)`);
                 }
             }
             else {

package/v3/@claude-flow/cli/dist/src/mcp-server.js

@@ -17,6 +17,8 @@
  * @version 3.0.0
  */
 import { EventEmitter } from 'events';
+import { execFileSync } from 'child_process';
+import { request as httpRequestFn } from 'http';
 import { randomUUID } from 'crypto';
 import * as path from 'path';
 import * as fs from 'fs';
@@ -572,13 +574,11 @@ export class MCPServerManager extends EventEmitter {
         // Verify it's actually a node process (guards against PID reuse)
         // DA-CRIT-3: Use execFileSync to prevent command injection via PID values
         try {
-            const { execFileSync } = require('child_process');
             const safePid = String(Math.floor(Math.abs(pid)));
             let cmdline = '';
             try {
                 // Try /proc on Linux
-                const { readFileSync } = require('fs');
-                cmdline = readFileSync(`/proc/${safePid}/cmdline`, 'utf8');
+                cmdline = fs.readFileSync(`/proc/${safePid}/cmdline`, 'utf8');
             }
             catch {
                 // Fall back to ps on macOS/other
@@ -608,8 +608,7 @@ export class MCPServerManager extends EventEmitter {
     async httpRequest(url, method, timeout) {
         return new Promise((resolve, reject) => {
             const urlObj = new URL(url);
-            const http = require('http');
-            const req = http.request({
+            const req = httpRequestFn({
                 hostname: urlObj.hostname,
                 port: urlObj.port,
                 path: urlObj.pathname,

package/v3/@claude-flow/cli/dist/src/mcp-tools/performance-tools.js

@@ -13,7 +13,7 @@
  */
 import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import * as os from 'node:os';
 // Storage paths
@@ -183,7 +183,6 @@ export const performanceTools = [
                 readFileSync(probeFile);
                 diskLatencyMs = Math.round((performance.now() - t0) * 100) / 100;
                 try {
-                    const { unlinkSync } = require('node:fs');
                     unlinkSync(probeFile);
                 }
                 catch { /* best-effort */ }
@@ -421,7 +420,6 @@ export const performanceTools = [
                 .sort((a, b) => b.percentOfTotal - a.percentOfTotal);
             // Cleanup probe file
             try {
-                const { unlinkSync } = require('node:fs');
                 unlinkSync(join(getPerfDir(), '.profile-probe'));
             }
             catch { /* ok */ }
@@ -472,7 +470,6 @@ export const performanceTools = [
                 readFileSync(probe);
                 diskLatencyBefore = Math.round((performance.now() - t0) * 100) / 100;
                 try {
-                    const { unlinkSync } = require('node:fs');
                     unlinkSync(probe);
                 }
                 catch { /* ok */ }
@@ -517,10 +514,9 @@ export const performanceTools = [
             if (aggressive) {
                 try {
                     const dir = getPerfDir();
-                    const { readdirSync, unlinkSync: ul } = require('node:fs');
                     const probes = readdirSync(dir).filter((f) => f.startsWith('.'));
                     probes.forEach((f) => { try {
-                        ul(join(dir, f));
+                        unlinkSync(join(dir, f));
                     }
                     catch { /* ok */ } });
                     if (probes.length > 0)

package/v3/@claude-flow/cli/dist/src/mcp-tools/types.d.ts

@@ -18,11 +18,28 @@ export interface MCPToolResult {
     isError?: boolean;
 }
 /**
- * Returns the effective project working directory.
- * Prefers CLAUDE_FLOW_CWD (set by the install script for global/MCP installs
- * where process.cwd() may resolve to '/') over the real process.cwd().
+ * Returns the effective project working directory for storage path resolution.
+ *
+ * Resolution order (#1577):
+ *   1. CLAUDE_FLOW_PROJECT_DIR — explicit ruflo project override
+ *   2. CLAUDE_FLOW_CWD — legacy ruflo override set by install script
+ *   3. CLAUDE_PROJECT_DIR — Claude Code's native project dir env var
+ *   4. INIT_CWD — npm's original invocation dir
+ *   5. process.cwd() — if it is not a system directory
+ *   6. os.homedir() — safe fallback
+ *
+ * System directories (e.g. C:\Windows\System32 on Windows, where MCP servers
+ * spawned by AI agents commonly inherit cwd) are rejected at every step.
+ *
+ * Only use this for storage path resolution. When the actual runtime working
+ * directory matters (e.g. child process cwd, user-facing status), call
+ * process.cwd() directly.
  */
 export declare function getProjectCwd(): string;
+/**
+ * Reset cached value. Intended for tests only.
+ */
+export declare function __resetProjectCwdCache(): void;
 export interface MCPTool {
     name: string;
     description: string;

package/v3/@claude-flow/cli/dist/src/mcp-tools/types.js

@@ -3,12 +3,73 @@
  *
  * Local type definitions to avoid external imports outside package boundary.
  */
+import { homedir } from 'node:os';
+// System directories that must not be used for project storage (#1577).
+// On Windows, MCP servers spawned by AI agents often inherit System32 as cwd
+// — writing there fails with EPERM.
+const SYSTEM_DIR_PREFIXES = [
+    'c:\\windows',
+    'c:/windows',
+    '/windows/system32',
+];
+function isSystemDir(dir) {
+    if (!dir)
+        return true;
+    const lower = dir.toLowerCase().replace(/\\/g, '/');
+    return SYSTEM_DIR_PREFIXES.some((p) => lower.startsWith(p.replace(/\\/g, '/')));
+}
+let _cachedProjectCwd;
 /**
- * Returns the effective project working directory.
- * Prefers CLAUDE_FLOW_CWD (set by the install script for global/MCP installs
- * where process.cwd() may resolve to '/') over the real process.cwd().
+ * Returns the effective project working directory for storage path resolution.
+ *
+ * Resolution order (#1577):
+ *   1. CLAUDE_FLOW_PROJECT_DIR — explicit ruflo project override
+ *   2. CLAUDE_FLOW_CWD — legacy ruflo override set by install script
+ *   3. CLAUDE_PROJECT_DIR — Claude Code's native project dir env var
+ *   4. INIT_CWD — npm's original invocation dir
+ *   5. process.cwd() — if it is not a system directory
+ *   6. os.homedir() — safe fallback
+ *
+ * System directories (e.g. C:\Windows\System32 on Windows, where MCP servers
+ * spawned by AI agents commonly inherit cwd) are rejected at every step.
+ *
+ * Only use this for storage path resolution. When the actual runtime working
+ * directory matters (e.g. child process cwd, user-facing status), call
+ * process.cwd() directly.
  */
 export function getProjectCwd() {
-    return process.env.CLAUDE_FLOW_CWD || process.cwd();
+    if (_cachedProjectCwd !== undefined)
+        return _cachedProjectCwd;
+    const envKeys = [
+        'CLAUDE_FLOW_PROJECT_DIR',
+        'CLAUDE_FLOW_CWD',
+        'CLAUDE_PROJECT_DIR',
+        'INIT_CWD',
+    ];
+    for (const key of envKeys) {
+        const val = process.env[key];
+        if (val && !isSystemDir(val)) {
+            _cachedProjectCwd = val;
+            return _cachedProjectCwd;
+        }
+    }
+    try {
+        const cwd = process.cwd();
+        if (!isSystemDir(cwd)) {
+            _cachedProjectCwd = cwd;
+            return _cachedProjectCwd;
+        }
+    }
+    catch {
+        // process.cwd() can throw ENOENT if the cwd was deleted — fall through.
+    }
+    _cachedProjectCwd = homedir();
+    return _cachedProjectCwd;
+}
+/**
+ * Reset cached value. Intended for tests only.
+ */
+export function __resetProjectCwdCache() {
+    _cachedProjectCwd = undefined;
 }
 //# sourceMappingURL=types.js.map

package/v3/@claude-flow/cli/dist/src/ruvector/coverage-router.js

@@ -6,6 +6,9 @@
  * - TTL-based caching of coverage data
  * - Singleton router instance
  */
+import * as pathMod from 'node:path';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 // ============================================================================
 // Caching for Performance
 // ============================================================================
@@ -378,7 +381,8 @@ export async function coverageGaps(options = {}) {
  * Returns null if path is invalid or attempts traversal
  */
 function validateProjectPath(inputPath) {
-    const { resolve, normalize, isAbsolute } = require('path');
+    // eslint-disable-next-line @typescript-eslint/no-var-requires -- sync function, top-level import at file head
+    const { resolve, normalize, isAbsolute } = pathMod;
     // Default to cwd if not provided
     const basePath = inputPath || process.cwd();
     // Normalize and resolve the path
@@ -417,9 +421,7 @@ async function loadProjectCoverage(projectRoot, skipCache) {
             return cached.report;
         }
     }
-    const { existsSync } = require('fs');
-    const { readFile } = require('fs/promises');
-    const { join, normalize } = require('path');
+    const { join, normalize } = pathMod;
     // Try common coverage locations (all relative to validated root)
     const coverageLocations = [
         ['coverage', 'coverage-final.json'],

package/v3/@claude-flow/cli/dist/src/ruvector/diff-classifier.js

@@ -1,6 +1,8 @@
 /**
  * Diff Classifier for Change Analysis
  */
+import { execFileSync, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 const DEFAULT_CONFIG = {
     maxDiffSize: 10000,
     classifyByImpact: true,
@@ -344,7 +346,7 @@ export function getGitDiffNumstat(ref = 'HEAD') {
     if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
         return cached.files;
     }
-    const { execFileSync } = require('child_process');
+    // execFileSync imported at top level
     try {
         // SECURITY: Use execFileSync with args array instead of shell string
         // This prevents command injection via the ref parameter
@@ -417,8 +419,7 @@ export async function getGitDiffNumstatAsync(ref = 'HEAD') {
     if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
         return cached.files;
     }
-    const { execFile } = require('child_process');
-    const { promisify } = require('util');
+    // execFile + promisify imported at top level
     const execFileAsync = promisify(execFile);
     try {
         // SECURITY: Use execFile with args array instead of shell string

package/v3/@claude-flow/cli/dist/src/update/checker.js

@@ -3,6 +3,7 @@
  * Queries npm registry and compares versions
  */
 import * as semver from 'semver';
+import { createRequire } from 'node:module';
 import { shouldCheckForUpdates, recordCheck, getCachedVersions } from './rate-limiter.js';
 const DEFAULT_CONFIG = {
     enabled: true,
@@ -88,10 +89,10 @@ export function getInstalledVersion(packageName) {
         ];
         for (const modulePath of possiblePaths) {
             try {
-                // Use dynamic import with require for package.json
-                const resolved = require.resolve(modulePath, { paths: [process.cwd()] });
-                // eslint-disable-next-line @typescript-eslint/no-var-requires
-                const pkg = require(resolved);
+                // Use createRequire for ESM-compatible package.json loading
+                const esmRequire = createRequire(import.meta.url);
+                const resolved = esmRequire.resolve(modulePath, { paths: [process.cwd()] });
+                const pkg = esmRequire(resolved);
                 return pkg.version;
             }
             catch {

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.5.77",
+  "version": "3.5.79",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -115,8 +115,7 @@
     "@ruvector/rvagent-wasm": "^0.1.0",
     "@ruvector/diskann": "^0.1.0",
     "@ruvector/sona": "^0.1.5",
-    "agentdb": "^3.0.0-alpha.11",
-    "agentic-flow": "^3.0.0-alpha.1"
+    "agentdb": "^3.0.0-alpha.11"
   },
   "publishConfig": {
     "access": "public",