claude-flow 3.5.78 → 3.5.79

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.5.78",
+  "version": "3.5.79",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/init.js

@@ -231,8 +231,12 @@ const initAction = async (ctx) => {
         }
         output.printBox(summary.join('\n'), 'Summary');
         output.writeln();
-        // Show what was created
-        if (options.components.claudeMd || options.components.settings || options.components.skills || options.components.commands || options.components.agents) {
+        // Show what was created (honest about skip-claude — #1597)
+        if (skipClaude) {
+            output.printBox('Skipped (--skip-claude): no files written under .claude/ or ~/.claude/', 'Claude Code Integration');
+            output.writeln();
+        }
+        else if (options.components.claudeMd || options.components.settings || options.components.skills || options.components.commands || options.components.agents) {
             output.printBox([
                 options.components.claudeMd ? `CLAUDE.md:   Swarm guidance & configuration` : '',
                 options.components.settings ? `Settings:    .claude/settings.json` : '',
@@ -909,7 +913,7 @@ export const initCommand = {
         },
         {
             name: 'skip-claude',
-            description: 'Skip .claude/ directory creation (runtime only)',
+            description: 'Skip all .claude/ writes including global ~/.claude/CLAUDE.md (runtime only)',
             type: 'boolean',
             default: false,
         },

package/v3/@claude-flow/cli/dist/src/init/executor.js

@@ -1663,6 +1663,11 @@ async function writeClaudeMd(targetDir, options, result) {
         result.created.files.push('CLAUDE.md');
     }
     // Also write/append global ~/.claude/CLAUDE.md so ruflo tools are used automatically (#1497)
+    // Guarded to never overwrite user content and to respect opt-out env var (#1597).
+    // Opt out entirely with CLAUDE_FLOW_SKIP_GLOBAL_CLAUDE_MD=1.
+    if (process.env.CLAUDE_FLOW_SKIP_GLOBAL_CLAUDE_MD === '1') {
+        return;
+    }
     const homeDir = process.env.HOME || process.env.USERPROFILE || '';
     if (homeDir) {
         const globalClaudeDir = path.join(homeDir, '.claude');
@@ -1682,8 +1687,13 @@ async function writeClaudeMd(targetDir, options, result) {
             if (fs.existsSync(globalClaudeMd)) {
                 const existing = fs.readFileSync(globalClaudeMd, 'utf-8');
                 if (!existing.includes('Ruflo Integration')) {
+                    // Always back up existing user content before any modification (#1597).
+                    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+                    const backupPath = `${globalClaudeMd}.backup-${timestamp}`;
+                    fs.copyFileSync(globalClaudeMd, backupPath);
                     fs.appendFileSync(globalClaudeMd, rufloBlock);
                     result.created.files.push('~/.claude/CLAUDE.md (appended ruflo block)');
+                    result.created.files.push(`~/.claude/CLAUDE.md.backup-${timestamp} (backup of pre-existing content)`);
                 }
             }
             else {

package/v3/@claude-flow/cli/dist/src/mcp-tools/types.d.ts

@@ -18,11 +18,28 @@ export interface MCPToolResult {
     isError?: boolean;
 }
 /**
- * Returns the effective project working directory.
- * Prefers CLAUDE_FLOW_CWD (set by the install script for global/MCP installs
- * where process.cwd() may resolve to '/') over the real process.cwd().
+ * Returns the effective project working directory for storage path resolution.
+ *
+ * Resolution order (#1577):
+ *   1. CLAUDE_FLOW_PROJECT_DIR — explicit ruflo project override
+ *   2. CLAUDE_FLOW_CWD — legacy ruflo override set by install script
+ *   3. CLAUDE_PROJECT_DIR — Claude Code's native project dir env var
+ *   4. INIT_CWD — npm's original invocation dir
+ *   5. process.cwd() — if it is not a system directory
+ *   6. os.homedir() — safe fallback
+ *
+ * System directories (e.g. C:\Windows\System32 on Windows, where MCP servers
+ * spawned by AI agents commonly inherit cwd) are rejected at every step.
+ *
+ * Only use this for storage path resolution. When the actual runtime working
+ * directory matters (e.g. child process cwd, user-facing status), call
+ * process.cwd() directly.
  */
 export declare function getProjectCwd(): string;
+/**
+ * Reset cached value. Intended for tests only.
+ */
+export declare function __resetProjectCwdCache(): void;
 export interface MCPTool {
     name: string;
     description: string;

package/v3/@claude-flow/cli/dist/src/mcp-tools/types.js

@@ -3,12 +3,73 @@
  *
  * Local type definitions to avoid external imports outside package boundary.
  */
+import { homedir } from 'node:os';
+// System directories that must not be used for project storage (#1577).
+// On Windows, MCP servers spawned by AI agents often inherit System32 as cwd
+// — writing there fails with EPERM.
+const SYSTEM_DIR_PREFIXES = [
+    'c:\\windows',
+    'c:/windows',
+    '/windows/system32',
+];
+function isSystemDir(dir) {
+    if (!dir)
+        return true;
+    const lower = dir.toLowerCase().replace(/\\/g, '/');
+    return SYSTEM_DIR_PREFIXES.some((p) => lower.startsWith(p.replace(/\\/g, '/')));
+}
+let _cachedProjectCwd;
 /**
- * Returns the effective project working directory.
- * Prefers CLAUDE_FLOW_CWD (set by the install script for global/MCP installs
- * where process.cwd() may resolve to '/') over the real process.cwd().
+ * Returns the effective project working directory for storage path resolution.
+ *
+ * Resolution order (#1577):
+ *   1. CLAUDE_FLOW_PROJECT_DIR — explicit ruflo project override
+ *   2. CLAUDE_FLOW_CWD — legacy ruflo override set by install script
+ *   3. CLAUDE_PROJECT_DIR — Claude Code's native project dir env var
+ *   4. INIT_CWD — npm's original invocation dir
+ *   5. process.cwd() — if it is not a system directory
+ *   6. os.homedir() — safe fallback
+ *
+ * System directories (e.g. C:\Windows\System32 on Windows, where MCP servers
+ * spawned by AI agents commonly inherit cwd) are rejected at every step.
+ *
+ * Only use this for storage path resolution. When the actual runtime working
+ * directory matters (e.g. child process cwd, user-facing status), call
+ * process.cwd() directly.
  */
 export function getProjectCwd() {
-    return process.env.CLAUDE_FLOW_CWD || process.cwd();
+    if (_cachedProjectCwd !== undefined)
+        return _cachedProjectCwd;
+    const envKeys = [
+        'CLAUDE_FLOW_PROJECT_DIR',
+        'CLAUDE_FLOW_CWD',
+        'CLAUDE_PROJECT_DIR',
+        'INIT_CWD',
+    ];
+    for (const key of envKeys) {
+        const val = process.env[key];
+        if (val && !isSystemDir(val)) {
+            _cachedProjectCwd = val;
+            return _cachedProjectCwd;
+        }
+    }
+    try {
+        const cwd = process.cwd();
+        if (!isSystemDir(cwd)) {
+            _cachedProjectCwd = cwd;
+            return _cachedProjectCwd;
+        }
+    }
+    catch {
+        // process.cwd() can throw ENOENT if the cwd was deleted — fall through.
+    }
+    _cachedProjectCwd = homedir();
+    return _cachedProjectCwd;
+}
+/**
+ * Reset cached value. Intended for tests only.
+ */
+export function __resetProjectCwdCache() {
+    _cachedProjectCwd = undefined;
 }
 //# sourceMappingURL=types.js.map

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.5.78",
+  "version": "3.5.79",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -115,8 +115,7 @@
     "@ruvector/rvagent-wasm": "^0.1.0",
     "@ruvector/diskann": "^0.1.0",
     "@ruvector/sona": "^0.1.5",
-    "agentdb": "^3.0.0-alpha.11",
-    "agentic-flow": "^3.0.0-alpha.1"
+    "agentdb": "^3.0.0-alpha.11"
   },
   "publishConfig": {
     "access": "public",