claude-flow 3.56.10 → 3.57.1

package/v3/@claude-flow/cli/dist/src/services/policy-runtime.js

@@ -3,20 +3,34 @@
 // callback server (an ESM `node:http` import that materialises http's lazy
 // undici getters), bcryptjs, keychain and credential helpers that the policy
 // runtime never uses.
-import { AgenticPolicyEngine, createLegacyCompatibleState, } from '@claude-flow/security/policy/index';
+import { AgenticPolicyEngine, POLICY_STATE_VERSION, createLegacyCompatibleState, } from '@claude-flow/security/policy/index';
 import { isMcpCallerAuthEnabled, decodeTokenEnvelope, publicKeyFromHex, verifyInvocationToken, } from '@claude-flow/security/mcp-caller-identity';
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
-import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readlinkSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, ftruncateSync, writeSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { hostname, userInfo } from 'node:os';
 import { syncPolicyProjection } from '../mods/policy-projection.js';
+import { ATOMIC_JSON_WRITER } from './policy-anchor-log.js';
+import { captureArchiveSnapshot, verifyFullPolicyLedger } from './policy-ledger-audit.js';
 import { assessAnchors, policyTrustRoot, recordAnchor } from './policy-ledger-anchor.js';
 const POLICY_DIR = join('.claude-flow', 'policy');
 const POLICY_FILE = 'state.json';
 const LOCK_FILE = 'state.lock';
-const LOCK_STALE_MS = 30_000;
+const RECEIPT_ARCHIVE_FILE = 'receipts.ledger.jsonl';
 const LOCK_WAIT_MS = 5_000;
+// #3164: without a bound, `state.receipts` grows forever and every
+// transaction's verify/clone/serialize cost is O(all receipts ever issued) —
+// eventually exceeding LOCK_WAIT_MS and timing out every MCP tool call.
+// Pruned receipts are archived to RECEIPT_ARCHIVE_FILE, never discarded.
+const DEFAULT_LEDGER_RETENTION = 2_000;
+function ledgerRetention() {
+    const raw = process.env.CLAUDE_FLOW_POLICY_LEDGER_RETENTION;
+    if (!raw)
+        return DEFAULT_LEDGER_RETENTION;
+    const parsed = Number(raw);
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : DEFAULT_LEDGER_RETENTION;
+}
 // A lock is ~170 bytes plus the hostname (at most 255 bytes).
 const LOCK_MAX_BYTES = 1_024;
 // Linux PID namespace of this process, e.g. `pid:[4026531836]`; undefined on
@@ -45,7 +59,7 @@ const BOOT_ID = (() => {
 function paths(projectRoot) {
     const root = resolve(projectRoot);
     const dir = join(root, POLICY_DIR);
-    return { dir, state: join(dir, POLICY_FILE), lock: join(dir, LOCK_FILE) };
+    return { dir, state: join(dir, POLICY_FILE), lock: join(dir, LOCK_FILE), archive: join(dir, RECEIPT_ARCHIVE_FILE) };
 }
 function sleep(ms) {
     return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
@@ -68,7 +82,7 @@ function isPidAlive(pid) {
 /**
  * Reads a lock only if it is a small regular file: never follows a symlink,
  * never blocks on a FIFO or device, never reads more than LOCK_MAX_BYTES.
- * Anything else returns undefined and the caller keeps the mtime rule.
+ * Anything else returns undefined; unknown owners are preserved.
  */
 function readLockFile(lockPath) {
     if (!lstatSync(lockPath).isFile())
@@ -94,8 +108,8 @@ function readLockFile(lockPath) {
  * boot and in this PID namespace: anywhere else (a bwrap --unshare-pid
  * sandbox, a container, another machine on a shared filesystem) a live owner
  * also answers ESRCH. Locks without that identity (older ruflo, a crash
- * between create and write, anything unparsable) return false and keep the
- * mtime rule.
+ * between create and write, anything unparsable) return false and require
+ * explicit operator inspection rather than age-only takeover.
  */
 function lockOwnerIsDead(lockPath) {
     try {
@@ -127,6 +141,36 @@ function lockOwnerIsDead(lockPath) {
         return false;
     }
 }
+/** Serialize dead-owner reclamation across processes. A normal acquirer can
+ * create state.lock after deletion, but the next reclaimer must re-probe that
+ * new owner under this guard. Guard orphans fail closed, requiring explicit
+ * operator recovery after validating their exact recorded owner and nonce.
+ * Unknown/foreign owners are never stolen merely because their mtime aged. */
+function reclaimDeadLock(lockPath) {
+    const guard = `${lockPath}.reclaim`;
+    let fd;
+    try {
+        fd = openSync(guard, 'wx', 0o600);
+    }
+    catch {
+        return;
+    }
+    const ownership = JSON.stringify({ pid: process.pid, nonce: randomUUID(), host: hostname(), platform: process.platform, pidns: PID_NAMESPACE, boot: BOOT_ID });
+    try {
+        writeFileSync(fd, ownership);
+        if (lockOwnerIsDead(lockPath))
+            unlinkSync(lockPath);
+    }
+    catch { /* lock changed, unknown identity, or an inaccessible path */ }
+    finally {
+        closeSync(fd);
+        try {
+            if (readLockFile(guard) === ownership)
+                unlinkSync(guard);
+        }
+        catch { /* preserve an unknown guard */ }
+    }
+}
 /**
  * Exported for ADR-406 mission storage, which takes the same per-file lock
  * (pid, pid namespace and boot id identify a dead owner) rather than a copy.
@@ -136,33 +180,37 @@ export async function acquireLock(lockPath) {
     while (Date.now() - started < LOCK_WAIT_MS) {
         try {
             const fd = openSync(lockPath, 'wx', 0o600);
-            writeFileSync(fd, JSON.stringify({
+            const ownership = JSON.stringify({
                 pid: process.pid,
                 acquiredAt: Date.now(),
                 host: hostname(),
                 platform: process.platform,
                 pidns: PID_NAMESPACE,
                 boot: BOOT_ID,
-            }));
-            closeSync(fd);
+                nonce: randomUUID(),
+            });
+            try {
+                writeFileSync(fd, ownership);
+            }
+            finally {
+                closeSync(fd);
+            }
             return () => {
                 try {
-                    unlinkSync(lockPath);
+                    if (readLockFile(lockPath) === ownership)
+                        unlinkSync(lockPath);
                 }
                 catch { /* already released */ }
             };
         }
         catch {
-            try {
-                if (lockOwnerIsDead(lockPath)
-                    || Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS)
-                    unlinkSync(lockPath);
-            }
-            catch { /* another process changed the lock */ }
+            reclaimDeadLock(lockPath);
             await sleep(10);
         }
     }
-    throw new Error('policy-state-lock-timeout');
+    throw new Error(lockOwnerIsDead(lockPath)
+        ? 'policy-state-lock-timeout: dead owner; inspect exact owner of state.lock.reclaim before explicit recovery'
+        : 'policy-state-lock-timeout');
 }
 // #3398: Windows rename over a file another process holds open fails with
 // EPERM/EBUSY/EACCES. Retry (~1.3s total, inside LOCK_WAIT_MS), never leave the
@@ -170,17 +218,129 @@ export async function acquireLock(lockPath) {
 // and consumed approval uses, so dropping it would let an approval be reused.
 const RENAME_RETRY_DELAYS_MS = [25, 50, 100, 150, 250, 300, 400];
 const TRANSIENT_RENAME_CODES = new Set(['EPERM', 'EBUSY', 'EACCES']);
+function mkdirDurably(dir) {
+    if (existsSync(dir))
+        return;
+    const parent = dirname(dir);
+    if (parent !== dir)
+        mkdirDurably(parent);
+    try {
+        mkdirSync(dir, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    syncDirectory(parent);
+}
+function syncDirectory(dir) {
+    // Windows does not expose directory fsync through Node. File sync and
+    // atomic rename still apply there; POSIX failures must reach the caller.
+    if (process.platform === 'win32')
+        return;
+    const fd = openSync(dir, fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY ?? 0));
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Recover only an incomplete, unacknowledged final append. All inspection,
+ * truncation, append and sync use the same nofollow regular-file descriptor. */
+function appendArchiveDurably(file, receipts, verifier) {
+    const fd = openSync(file, fsConstants.O_RDWR | fsConstants.O_CREAT
+        | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0), 0o600);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error('policy-ledger-archive-not-regular');
+        const limit = 64 * 1024;
+        const start = Math.max(0, stat.size - limit);
+        const buffer = Buffer.alloc(stat.size - start);
+        if (readSync(fd, buffer, 0, buffer.length, start) !== buffer.length)
+            throw new Error('policy-ledger-archive-short-read');
+        let end = stat.size;
+        const lastNewline = buffer.lastIndexOf(10);
+        if (buffer.length && buffer[buffer.length - 1] !== 10) {
+            if (lastNewline < 0 && start > 0)
+                throw new Error('policy-ledger-archive-tail-too-large');
+            const fragmentBytes = buffer.subarray(lastNewline + 1);
+            const fragment = fragmentBytes.toString('utf8');
+            try {
+                JSON.parse(fragment);
+                throw new Error('policy-ledger-archive-unterminated-record');
+            }
+            catch (error) {
+                if (!(error instanceof SyntaxError))
+                    throw error;
+            }
+            // A parse failure alone grants no repair authority: the bytes must
+            // be an exact prefix of a receipt still available in the verified hot
+            // state and being retried by this prune.
+            if (!fragmentBytes.length || !receipts.some(receipt => {
+                const expected = Buffer.from(JSON.stringify(receipt));
+                return fragmentBytes.length < expected.length && expected.subarray(0, fragmentBytes.length).equals(fragmentBytes);
+            })) {
+                throw new Error('policy-ledger-archive-unrecoverable-tail');
+            }
+            end = start + lastNewline + 1;
+        }
+        const complete = buffer.subarray(0, end - start).toString('utf8');
+        const usable = start === 0 ? complete : complete.slice(complete.indexOf('\n') + 1);
+        for (const line of usable.split('\n')) {
+            if (!line.trim())
+                continue;
+            let record;
+            try {
+                record = JSON.parse(line);
+            }
+            catch {
+                throw new Error('policy-ledger-archive-parse-error');
+            }
+            if (verifier.verifyReceipt(record))
+                throw new Error('policy-ledger-archive-conflict');
+        }
+        if (end < stat.size) {
+            ftruncateSync(fd, end);
+            fsyncSync(fd);
+        }
+        const bytes = Buffer.from(`${receipts.map(receipt => JSON.stringify(receipt)).join('\n')}\n`);
+        let written = 0;
+        while (written < bytes.length) {
+            const count = writeSync(fd, bytes, written, bytes.length - written, end + written);
+            if (!count)
+                throw new Error('policy-ledger-archive-short-write');
+            written += count;
+        }
+        fsyncSync(fd);
+        syncDirectory(dirname(file));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 async function writeJsonAtomic(file, value) {
-    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    mkdirDurably(dirname(file));
     const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
     let renamed = false;
     try {
-        writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        const fd = openSync(temporary, 'wx', 0o600);
+        try {
+            if (value && typeof value[ATOMIC_JSON_WRITER] === 'function')
+                value[ATOMIC_JSON_WRITER](fd);
+            else
+                writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
         for (let attempt = 0;; attempt++) {
             try {
                 renameSync(temporary, file);
                 renamed = true;
-                return;
+                break;
             }
             catch (error) {
                 const code = error?.code ?? '';
@@ -189,6 +349,9 @@ async function writeJsonAtomic(file, value) {
                 await sleep(RENAME_RETRY_DELAYS_MS[attempt]);
             }
         }
+        // A post-rename sync failure is a publication failure, not a rename
+        // failure. Never retry with a temporary file already consumed by rename.
+        syncDirectory(dirname(file));
     }
     finally {
         if (!renamed) {
@@ -210,8 +373,16 @@ function trustKey(projectRoot, create) {
     if (!existsSync(key)) {
         if (!create)
             return undefined;
-        mkdirSync(dirname(key), { recursive: true, mode: 0o700 });
-        writeFileSync(key, randomBytes(32), { mode: 0o600, flag: 'wx' });
+        mkdirDurably(dirname(key));
+        const fd = openSync(key, 'wx', 0o600);
+        try {
+            writeFileSync(fd, randomBytes(32));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        syncDirectory(dirname(key));
     }
     const material = readFileSync(key);
     if (material.length !== 32)
@@ -238,11 +409,11 @@ function verifyStateAnchor(projectRoot, state) {
         throw new Error('policy-state-authentication-failed');
     }
 }
-async function writePolicyState(projectRoot, statePath, state, anchorEvent = 'append', by) {
+async function writePolicyState(projectRoot, statePath, state, anchorEvent = 'append', by, assessedTip) {
     await writePolicyStateFiles(projectRoot, statePath, state);
     // #3602: the second anchor is written after the state, so a crash leaves the
     // state AHEAD of the log (caught up on the next write), never behind it.
-    await recordAnchor(projectRoot, state, writeJsonAtomic, anchorEvent, by);
+    await recordAnchor(projectRoot, state, writeJsonAtomic, anchorEvent, by, writeJsonAtomic, assessedTip);
     // ADR-404: the ruflo mod reads Claude Code tool rules from a small
     // projection, never from state.json. Written only after the state and its
     // anchor are safely down; a failure here never fails the state write. A
@@ -316,7 +487,7 @@ export function loadPolicyState(projectRoot = process.cwd()) {
         return createLegacyCompatibleState(detectLegacyCapabilities(projectRoot));
     }
     const parsed = JSON.parse(readFileSync(target.state, 'utf8'));
-    if (parsed.version !== 1 || !Array.isArray(parsed.rules) || !Array.isArray(parsed.receipts)) {
+    if ((parsed.version !== 1 && parsed.version !== POLICY_STATE_VERSION) || !Array.isArray(parsed.rules) || !Array.isArray(parsed.receipts)) {
         throw new Error(`unsupported-policy-state-version:${String(parsed.version)}`);
     }
     verifyStateAnchor(projectRoot, parsed);
@@ -337,7 +508,7 @@ export async function autoMigratePolicyStateIfNeeded(projectRoot = process.cwd()
     if (!existsSync(join(resolve(projectRoot), '.claude-flow'))
         && !existsSync(join(resolve(projectRoot), '.swarm')))
         return { migrated: false };
-    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    mkdirDurably(target.dir);
     const release = await acquireLock(target.lock);
     try {
         if (!existsSync(target.state)) {
@@ -357,7 +528,7 @@ export async function autoMigratePolicyStateIfNeeded(projectRoot = process.cwd()
 }
 export async function withPolicyTransaction(projectRoot, operation, options = {}) {
     const target = paths(projectRoot);
-    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    mkdirDurably(target.dir);
     const release = await acquireLock(target.lock);
     try {
         const loaded = loadPolicyState(projectRoot);
@@ -376,10 +547,30 @@ export async function withPolicyTransaction(projectRoot, operation, options = {}
                 : gate.result.error ?? 'policy-ledger-verification-failed');
         }
         const result = await operation(engine);
-        if (!engine.verifyLedger().valid)
+        const verified = engine.verifyLedger();
+        if (!verified.valid)
             throw new Error('policy-ledger-verification-failed');
+        // Only archive the prefix already committed in loaded state. Archiving
+        // newly generated receipts before their first state publication would
+        // leave conflicting same-sequence records when a failed operation is
+        // retried with a different timestamp/request. Retention=0 and large
+        // batches therefore retain this transaction's new receipts until a
+        // subsequent transaction can archive their exact committed bytes.
+        const newlyAppended = verified.length - ((loaded.retainedFrom ?? 0) + loaded.receipts.length);
+        const pruned = engine.pruneReceipts(Math.max(ledgerRetention(), newlyAppended));
+        // #3164: archive BEFORE writing the shrunk state. If the process crashes
+        // between the two writes, the archive append already landed but
+        // `retainedFrom` on disk still reflects the pre-prune length, so the next
+        // prune recomputes and re-appends the SAME receipts — a harmless,
+        // detectable duplicate (same sequence, identical content), deduped by
+        // `verifyPolicyLedger({ full: true })`. The reverse order (state first)
+        // would instead risk a permanent gap if the process died in between,
+        // which is strictly worse for an audit ledger — never reorder this.
+        if (pruned.length > 0) {
+            appendArchiveDurably(target.archive, pruned, engine);
+        }
         const nextState = engine.exportState();
-        await writePolicyState(projectRoot, target.state, nextState, gate.event);
+        await writePolicyState(projectRoot, target.state, nextState, gate.event, undefined, gate.anchorTip);
         return result;
     }
     finally {
@@ -439,7 +630,9 @@ export async function revokePolicyApproval(id, projectRoot = process.cwd()) {
  */
 function reconcileLedger(projectRoot, engine, options) {
     const state = engine.exportState();
-    const length = state.receipts.length;
+    // #3164: the historical length includes anything pruned out of the hot
+    // array — `length` here must keep meaning "total receipts ever issued".
+    const length = (state.retainedFrom ?? 0) + state.receipts.length;
     const primary = typeof state.ledgerLength === 'number';
     const base = engine.verifyLedger();
     const fail = (error) => ({ result: { valid: false, length, error }, persist: false });
@@ -454,7 +647,7 @@ function reconcileLedger(projectRoot, engine, options) {
                 ? { result: { ...base, secondaryAnchor: 'established-explicitly' }, persist: true, event: 'establish-anchor' }
                 : { result: { ...base, secondaryAnchor: 'recorded-from-state' }, persist: true, event: 'migrated-from-state' };
         }
-        return { result: base, persist: assessed.kind === 'ok' && assessed.behind, event: 'append' };
+        return { result: base, persist: assessed.kind === 'ok' && assessed.behind, event: 'append', anchorTip: assessed.kind === 'ok' ? assessed.last : undefined };
     }
     // No primary anchor.
     if (length === 0)
@@ -463,7 +656,7 @@ function reconcileLedger(projectRoot, engine, options) {
         // The second anchor is authentic and agrees with the chain: the deleted
         // primary can be restored from it. Truncation was already rejected above.
         engine.verifyLedger({ establishAnchor: true });
-        return { result: { valid: true, length, secondaryAnchor: 'restored-primary' }, persist: true, event: 'append' };
+        return { result: { valid: true, length, secondaryAnchor: 'restored-primary' }, persist: true, event: 'append', anchorTip: assessed.last };
     }
     if (options.establishAnchor) {
         const established = engine.verifyLedger({ establishAnchor: true });
@@ -483,23 +676,51 @@ function reconcileLedger(projectRoot, engine, options) {
  */
 export async function verifyPolicyLedger(projectRoot = process.cwd(), options = {}) {
     const target = paths(projectRoot);
-    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    mkdirDurably(target.dir);
+    const engineOptions = {
+        signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
+        keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
+    };
+    let outcomeResult;
+    let snapshotState;
+    let archiveSnapshot;
+    // Capture the verified hot state and a checked regular archive descriptor
+    // plus immutable byte boundary under the writer lock. Historical read,
+    // authentication, deduplication and replay all happen after release, using
+    // bounded chunks and private disposable disk scratch instead of O(history)
+    // strings, receipt arrays or maps. The descriptor pins path replacements.
     const release = await acquireLock(target.lock);
     try {
-        const engine = AgenticPolicyEngine.fromState(loadPolicyState(projectRoot), {
-            signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
-            keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
-        });
+        const engine = AgenticPolicyEngine.fromState(loadPolicyState(projectRoot), engineOptions);
         const outcome = reconcileLedger(projectRoot, engine, options);
         if (outcome.persist) {
             const by = outcome.event === 'establish-anchor' ? userInfo().username : undefined;
-            await writePolicyState(projectRoot, target.state, engine.exportState(), outcome.event, by);
+            await writePolicyState(projectRoot, target.state, engine.exportState(), outcome.event, by, outcome.anchorTip);
+        }
+        outcomeResult = outcome.result;
+        snapshotState = engine.exportState();
+        if (options.full && outcomeResult.valid) {
+            try {
+                archiveSnapshot = captureArchiveSnapshot(target.archive);
+            }
+            catch (error) {
+                outcomeResult = { valid: false, length: outcomeResult.length, error: error.message };
+            }
         }
-        return outcome.result;
     }
     finally {
         release();
     }
+    if (!options.full || !outcomeResult.valid)
+        return outcomeResult;
+    try {
+        const full = await verifyFullPolicyLedger(archiveSnapshot, snapshotState, engineOptions);
+        return { ...full, secondaryAnchor: outcomeResult.secondaryAnchor };
+    }
+    finally {
+        if (archiveSnapshot !== undefined)
+            closeSync(archiveSnapshot.fd);
+    }
 }
 /**
  * Resolve the caller identity for `authorizeMcpTool`.

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.56.10",
+  "version": "3.57.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -98,7 +98,7 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@claude-flow/cli-core": "3.7.3",
+    "@claude-flow/cli-core": "3.7.4",
     "@claude-flow/codex": "3.0.5",
     "@claude-flow/mcp": "3.1.1",
     "@claude-flow/neural": "3.0.0",
@@ -130,7 +130,7 @@
   "optionalDependencies": {
     "@agntcy/slim-bindings": "2.0.0-alpha.5",
     "@claude-flow/memory": "3.0.5",
-    "@metaharness/darwin": "~0.10.2",
+    "@metaharness/darwin": "~0.12.0",
     "@metaharness/flywheel": "~0.1.10",
     "@metaharness/radio": "~0.1.0",
     "@metaharness/turn-credit": "~0.1.0",