claude-flow 3.56.2 → 3.56.4

package/.claude/helpers/auto-memory-hook.mjs

@@ -17,11 +17,16 @@ import { fileURLToPath } from 'url';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+// Executable modules resolve only from the helper's own install root. A
+// home-level helper can serve an untrusted project, so CLAUDE_PROJECT_DIR must
+// never decide which JavaScript gets imported.
+const MODULE_ROOT = join(__dirname, '../..');
 // Home-level helpers can serve a different project. Keep the memory writer on
 // the same project root as intelligence.cjs, which reads CLAUDE_PROJECT_DIR.
+// PROJECT_ROOT is for data only.
 const PROJECT_ROOT = process.env.CLAUDE_PROJECT_DIR
   ? resolve(process.env.CLAUDE_PROJECT_DIR)
-  : join(__dirname, '../..');
+  : MODULE_ROOT;
 const DATA_DIR = join(PROJECT_ROOT, '.claude-flow', 'data');
 const STORE_PATH = join(DATA_DIR, 'auto-memory-store.json');
 
@@ -41,7 +46,7 @@ const dim = (msg) => console.log(`  ${DIM}${msg}${RESET}`);
 // told exactly how to fix it (on both stdout, so it shows in the Claude Code hook
 // transcript, and stderr, per the issue's requested channel).
 function warnMemoryUnavailable() {
-  const line1 = `[AutoMemory] @claude-flow/memory not resolvable from ${PROJECT_ROOT} — self-learning imports are DISABLED.`;
+  const line1 = `[AutoMemory] @claude-flow/memory not resolvable from ${MODULE_ROOT} — self-learning imports are DISABLED.`;
   const line2 = '             Fix: npm i -D @claude-flow/memory   (or re-run: npx ruflo@latest init, then npx ruflo@latest doctor --fix)';
   console.log(`${YELLOW}${line1}${RESET}`);
   console.log(`${YELLOW}${line2}${RESET}`);
@@ -175,7 +180,7 @@ async function loadMemoryPackage() {
   // project — so init resolves it from the CLI's own context and records the
   // absolute path here. This is the only strategy that works on that install.
   try {
-    const sidecar = join(PROJECT_ROOT, '.claude-flow', 'memory-package.json');
+    const sidecar = join(MODULE_ROOT, '.claude-flow', 'memory-package.json');
     if (existsSync(sidecar)) {
       const rec = JSON.parse(readFileSync(sidecar, 'utf-8'));
       if (rec?.distPath && existsSync(rec.distPath)) {
@@ -185,7 +190,7 @@ async function loadMemoryPackage() {
   } catch { /* fall through */ }
 
   // Strategy 1: Local dev (built dist)
-  const localDist = join(PROJECT_ROOT, 'v3/@claude-flow/memory/dist/index.js');
+  const localDist = join(MODULE_ROOT, 'v3/@claude-flow/memory/dist/index.js');
   if (existsSync(localDist)) {
     try {
       return await import(`file://${localDist}`);
@@ -196,7 +201,7 @@ async function loadMemoryPackage() {
   // when installed as a transitive dependency via npx ruflo / npx claude-flow)
   try {
     const { createRequire } = await import('module');
-    const require = createRequire(join(PROJECT_ROOT, 'package.json'));
+    const require = createRequire(join(MODULE_ROOT, 'package.json'));
     return require('@claude-flow/memory');
   } catch { /* fall through */ }
 
@@ -205,8 +210,8 @@ async function loadMemoryPackage() {
     return await import('@claude-flow/memory');
   } catch { /* fall through */ }
 
-  // Strategy 4: Walk up from PROJECT_ROOT looking for @claude-flow/memory in any node_modules
-  let searchDir = PROJECT_ROOT;
+  // Strategy 4: Walk up from MODULE_ROOT looking for @claude-flow/memory in any node_modules
+  let searchDir = MODULE_ROOT;
   const { parse } = await import('path');
   while (searchDir !== parse(searchDir).root) {
     const candidate = join(searchDir, 'node_modules', '@claude-flow', 'memory', 'dist', 'index.js');
@@ -378,7 +383,7 @@ async function doStatus() {
   const memPkg = await loadMemoryPackage();
   const config = readConfig();
 
-  const sidecar = join(PROJECT_ROOT, '.claude-flow', 'memory-package.json');
+  const sidecar = join(MODULE_ROOT, '.claude-flow', 'memory-package.json');
   const hasSidecar = existsSync(sidecar);
 
   console.log('\n=== Auto Memory Bridge Status ===\n');

package/.claude/helpers/hook-handler.cjs

@@ -18,6 +18,10 @@ const fs = require('fs');
 const os = require('os');
 
 const helpersDir = __dirname;
+// The helper's own install root: the project for a project-local helper,
+// $HOME for a home-level one. CLI resolution starts here, never at the opened
+// project, so a home-level helper does not run code the project supplies.
+const helperRoot = path.resolve(helpersDir, '..', '..');
 
 // Resolve an installed @claude-flow/cli (or ruflo) bin — mirrors
 // statusline-generator.ts's resolveCliBin() candidate list. Used only to
@@ -38,12 +42,11 @@ const helpersDir = __dirname;
 function resolveCliBinForHook() {
   try {
     const home = os.homedir();
-    const cwd = process.cwd();
     const candidates = [
       path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'bin', 'cli.js'),
-      path.join(cwd, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
-      path.join(cwd, 'node_modules', 'ruflo', 'bin', 'cli.js'),
-      path.join(cwd, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(helperRoot, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(helperRoot, 'node_modules', 'ruflo', 'bin', 'cli.js'),
+      path.join(helperRoot, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
       // helpersDir is .claude/helpers/ inside the package itself when this
       // file is running from a real @claude-flow/cli install (not a project
       // that merely copied the helper) — its bin/ is two levels up.
@@ -77,14 +80,19 @@ function resolveCliBinForHook() {
 // render path, where local-first exists purely for per-render latency.
 // `--prefer-offline` avoids a registry round trip for the tarball when
 // already cached while still resolving the current `@latest` version.
+//
+// `--prefix helperRoot` makes npx resolve @claude-flow/cli from the helper's
+// install root instead of the cwd (the opened project); the spawned CLI still
+// runs with the project as its cwd.
+function cliSpawnArgs(cliBin, args, platform = process.platform) {
+  if (cliBin) return [process.execPath, [cliBin, ...args]];
+  return [platform === 'win32' ? 'npx.cmd' : 'npx', ['--prefer-offline', '--prefix', helperRoot, '@claude-flow/cli', ...args]];
+}
+
 function spawnDetachedHookRefresh(subcommand) {
   try {
     const { spawn } = require('child_process');
-    const cliBin = resolveCliBinForHook();
-    const cmd = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-    const spawnArgs = cliBin
-      ? [process.execPath, [cliBin, 'hooks', subcommand, '--quiet']]
-      : [cmd, ['--prefer-offline', '@claude-flow/cli', 'hooks', subcommand, '--quiet']];
+    const spawnArgs = cliSpawnArgs(resolveCliBinForHook(), ['hooks', subcommand, '--quiet']);
     const child = spawn(spawnArgs[0], spawnArgs[1], {
       detached: true,
       stdio: 'ignore',
@@ -151,10 +159,7 @@ function firstRunAutoEnableIfEligible() {
     const cliBin = resolveCliBinForHook();
     const runDetached = (args) => {
       try {
-        const spawnArgs = cliBin
-          ? [process.execPath, [cliBin, ...args]]
-          : [process.platform === 'win32' ? 'npx.cmd' : 'npx',
-             ['--prefer-offline', '@claude-flow/cli', ...args]];
+        const spawnArgs = cliSpawnArgs(cliBin, args);
         const child = spawn(spawnArgs[0], spawnArgs[1], {
           detached: true, stdio: 'ignore', env: process.env, windowsHide: true,
         });
@@ -772,4 +777,4 @@ if (require.main === module) {
 // Which sibling helpers loaded (all CommonJS, shipped as .cjs — #3555).
 const loadedHelpers = { router: !!router, session: !!session, memory: !!memory, intelligence: !!intelligence };
 
-module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS };
+module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS, resolveCliBinForHook, cliSpawnArgs, helperRoot };

package/.claude/helpers/learning-service.mjs

@@ -26,9 +26,12 @@ import Database from 'better-sqlite3';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+// Executable modules resolve only from the helper's own install root; a
+// home-level helper can serve an untrusted project. PROJECT_ROOT is data only.
+const MODULE_ROOT = join(__dirname, '../..');
 const PROJECT_ROOT = process.env.CLAUDE_PROJECT_DIR
   ? resolve(process.env.CLAUDE_PROJECT_DIR)
-  : join(__dirname, '../..');
+  : MODULE_ROOT;
 const DATA_DIR = join(PROJECT_ROOT, '.claude-flow/learning');
 const DB_PATH = join(DATA_DIR, 'patterns.db');
 const METRICS_PATH = join(DATA_DIR, 'learning-metrics.json');
@@ -463,7 +466,7 @@ class EmbeddingService {
 
     try {
       // Dynamically import agentic-flow OptimizedEmbedder
-      const agenticFlowPath = join(PROJECT_ROOT, 'node_modules/agentic-flow/dist/embeddings/optimized-embedder.js');
+      const agenticFlowPath = join(MODULE_ROOT, 'node_modules/agentic-flow/dist/embeddings/optimized-embedder.js');
 
       if (existsSync(agenticFlowPath)) {
         const { getOptimizedEmbedder } = await import(agenticFlowPath);

package/.claude/helpers/session.cjs

@@ -6,6 +6,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const os = require('os');
 
 const platform = os.platform();
@@ -30,6 +31,49 @@ function getDataDir() {
 const SESSION_DIR = getDataDir();
 const SESSION_FILE = path.join(SESSION_DIR, 'current.json');
 
+// Archive names are generated by start(); anything else in current.json is
+// untrusted project content and must never pick a path.
+const SESSION_ID = /^session-\d+$/;
+
+// current.json lives in the opened project. A symlink there must never be read
+// or written through, so only a regular file counts as an active session.
+function hasSessionFile() {
+  try { return fs.lstatSync(SESSION_FILE).isFile(); } catch { return false; }
+}
+
+function archiveId(id) {
+  return SESSION_ID.test(String(id)) ? String(id) : `session-${Date.now()}`;
+}
+
+// The project session directory must resolve inside the project (no
+// symlinked escape). The per-user fallback directory is not project-owned.
+function assertSessionDirContained() {
+  if (SESSION_DIR !== path.join(process.cwd(), '.claude-flow', 'sessions')) return;
+  const root = fs.realpathSync(process.cwd());
+  // Resolve the deepest part of the path that exists (lstat: a symlink counts),
+  // so a symlinked .claude-flow is refused before anything is created under it.
+  let dir = SESSION_DIR;
+  for (;;) {
+    try { fs.lstatSync(dir); break; } catch { /* not created yet */ }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const rel = path.relative(root, fs.realpathSync(dir));
+  if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+    throw new Error('Session directory resolves outside the project');
+  }
+}
+
+// Exclusive temp file + rename: never writes through a planted symlink, and
+// rename() replaces a symlinked target instead of following it.
+function atomicWrite(file, data) {
+  assertSessionDirContained();
+  const tmp = `${file}.tmp.${process.pid}.${crypto.randomBytes(6).toString('hex')}`;
+  fs.writeFileSync(tmp, data, { flag: 'wx' });
+  fs.renameSync(tmp, file);
+}
+
 function ensureDir(dir) {
   if (!fs.existsSync(dir)) {
     fs.mkdirSync(dir, { recursive: true });
@@ -38,6 +82,7 @@ function ensureDir(dir) {
 
 const commands = {
   start: () => {
+    assertSessionDirContained();
     ensureDir(SESSION_DIR);
     const sessionId = `session-${Date.now()}`;
     const session = {
@@ -48,25 +93,25 @@ const commands = {
       context: {},
       metrics: { edits: 0, commands: 0, tasks: 0, errors: 0 }
     };
-    fs.writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2));
+    atomicWrite(SESSION_FILE, JSON.stringify(session, null, 2));
     console.log(`Session started: ${sessionId}`);
     return session;
   },
 
   restore: () => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       console.log('No session to restore');
       return null;
     }
     const session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf-8'));
     session.restoredAt = new Date().toISOString();
-    fs.writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2));
+    atomicWrite(SESSION_FILE, JSON.stringify(session, null, 2));
     console.log(`Session restored: ${session.id}`);
     return session;
   },
 
   end: () => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       console.log('No active session');
       return null;
     }
@@ -74,17 +119,18 @@ const commands = {
     session.endedAt = new Date().toISOString();
     session.duration = Date.now() - new Date(session.startedAt).getTime();
 
-    const archivePath = path.join(SESSION_DIR, `${session.id}.json`);
-    fs.writeFileSync(archivePath, JSON.stringify(session, null, 2));
+    // Archive under a validated name; a crafted id cannot pick the path.
+    const id = archiveId(session.id);
+    atomicWrite(path.join(SESSION_DIR, `${id}.json`), JSON.stringify(session, null, 2));
     fs.unlinkSync(SESSION_FILE);
 
-    console.log(`Session ended: ${session.id}`);
+    console.log(`Session ended: ${id}`);
     console.log(`Duration: ${Math.round(session.duration / 1000 / 60)} minutes`);
     return session;
   },
 
   status: () => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       console.log('No active session');
       return null;
     }
@@ -98,13 +144,13 @@ const commands = {
   },
 
   metric: (name) => {
-    if (!fs.existsSync(SESSION_FILE)) {
+    if (!hasSessionFile()) {
       return null;
     }
     const session = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf-8'));
     if (session.metrics[name] !== undefined) {
       session.metrics[name]++;
-      fs.writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2));
+      atomicWrite(SESSION_FILE, JSON.stringify(session, null, 2));
     }
     return session;
   }