claude-flow 3.58.0 → 3.58.1

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1792476754804,
+  "adoptedAt": 1792482576260,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.58.0",
+  "version": "3.58.1",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/mcp",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-20T06:14:05.915Z",
-  "gitSha": "d529a38a",
+  "generatedAt": "2026-10-20T07:55:51.186Z",
+  "gitSha": "f5f2e40c",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -5,7 +5,7 @@ import { feedbackPatternsSchema, validateFeedbackPatterns } from '../memory/feed
  */
 import { mkdirSync, writeFileSync, existsSync, readFileSync, statSync, unlinkSync, readdirSync } from 'fs';
 import * as nodeFs from 'fs';
-import { dirname, join, resolve } from 'path';
+import { dirname, join, resolve, sep } from 'path';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier, validateText, validatePath } from './validate-input.js';
 import { commandRecordingDisabled, redactCommandForStorage } from '../services/command-recording.js';
@@ -5136,7 +5136,17 @@ export const hooksCodemod = {
                 if (!v.valid)
                     return v.error;
                 const abs = resolve(cwd, v.sanitized);
-                if (!abs.startsWith(cwd))
+                // Anchor containment at a path-separator boundary — an unanchored
+                // `abs.startsWith(cwd)` string-prefix check would let an absolute
+                // path like `${cwd}-staging/x.ts` pass as "inside" `cwd`. Matches
+                // the pattern already used correctly elsewhere in this codebase
+                // (@claude-flow/security's `isWithinPrefix`, hooks/workers, plugins/security).
+                // KNOWN LIMITATION (disclosed 2026-10-20, not fixed here): this
+                // compares the resolved-but-not-realpath'd path, so a symlink
+                // inside cwd pointing outside it still escapes containment
+                // (CWE-59, a distinct/broader gap than the CWE-22 prefix bug this
+                // anchors). Needs fs.realpathSync-based containment as a follow-up.
+                if (abs !== cwd && !abs.startsWith(cwd + sep))
                     return `path escapes project root: ${p}`;
                 out.add(abs);
                 return undefined;
@@ -5169,7 +5179,7 @@ export const hooksCodemod = {
                 }
                 for (const m of matches) {
                     const abs = resolve(cwd, m);
-                    if (abs.startsWith(cwd) && CODEMOD_EXTENSIONS.has(abs.slice(abs.lastIndexOf('.')).toLowerCase())) {
+                    if ((abs === cwd || abs.startsWith(cwd + sep)) && CODEMOD_EXTENSIONS.has(abs.slice(abs.lastIndexOf('.')).toLowerCase())) {
                         out.add(abs);
                     }
                 }

package/v3/@claude-flow/cli/dist/src/parser.js

@@ -184,8 +184,9 @@ export class CommandParser {
         let commandSlotAvailable = true;
         while (i < args.length) {
             const arg = args[i];
-            // Check for end of flags marker
-            if (arg === '--') {
+            // Check for end of flags marker. Only the first "--" changes parser
+            // state; a later literal "--" is an ordinary positional (#4310).
+            if (parsingFlags && arg === '--') {
                 parsingFlags = false;
                 i++;
                 continue;

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.58.0",
+  "version": "3.58.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",