claude-flow 3.59.17 → 3.60.1

package/v3/@claude-flow/cli/dist/src/mcp-tools/neural-tools.js

@@ -899,7 +899,7 @@ export const neuralTools = [
             properties: {
                 modelId: { type: 'string', description: 'Model ID to compress' },
                 method: { type: 'string', enum: ['quantize', 'prune', 'distill'], description: 'Compression method' },
-                targetSize: { type: 'number', description: 'Target size reduction (0-1)' },
+                targetSize: { type: 'number', description: 'Not used: quantize (#4195) and prune (#4423) are unavailable, and distill merges by similarity' },
             },
         },
         handler: async (input) => {
@@ -910,7 +910,6 @@ export const neuralTools = [
             }
             const store = loadNeuralStore();
             const method = input.method || 'quantize';
-            const targetReduction = input.targetSize || 0.5;
             const patterns = Object.values(store.patterns);
             if (patterns.length === 0) {
                 return { success: false, error: 'No patterns to compress. Train patterns first with neural_train.' };
@@ -936,23 +935,18 @@ export const neuralTools = [
             // Resolve provider only for operations that actually use embeddings.
             await ensureEmbeddings();
             if (method === 'prune') {
-                // Prune patterns with low usage count below threshold (targetReduction as min usage)
-                const threshold = targetReduction;
-                const toRemove = [];
-                for (const [id, pattern] of Object.entries(store.patterns)) {
-                    if ((pattern.usageCount || 0) < threshold)
-                        toRemove.push(id);
-                }
-                for (const id of toRemove)
-                    delete store.patterns[id];
-                saveNeuralStore(store);
+                // #4423: prune deleted patterns with usageCount below targetSize, but
+                // nothing in the neural store records usage (patterns are written with
+                // 0 and only max-merged), so any targetSize > 0, including the old 0.5
+                // default, deleted and persisted every pattern. Refuse until usage is
+                // tracked, the same way quantize refuses (#4195). The store is untouched.
                 return {
-                    success: true, _real: true, method,
-                    embeddingProvider: embeddingServiceName,
-                    threshold,
-                    patternsRemoved: toRemove.length,
+                    success: false,
+                    error: 'Pruning is unavailable: neural patterns do not record usage, so there is no signal to choose which to remove.',
+                    method,
+                    patternsRemoved: 0,
                     patternsBefore: beforeCount,
-                    patternsAfter: Object.keys(store.patterns).length,
+                    patternsAfter: beforeCount,
                 };
             }
             if (method === 'distill') {

package/v3/@claude-flow/cli/dist/src/mcp-tools/rure-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * ruRE Phase 1 MCP Tools — JS/Electron static analysis.
+ *
+ * See plugins/ruflo-rure/docs/adrs/0001-scope-and-dual-use-policy.md and
+ * 0002-phase1-architecture.md. These tools parse local files; they never
+ * execute analyzed code, and all extracted text is routed through the
+ * AIDefence gate before being returned to the caller.
+ */
+import type { MCPTool } from './types.js';
+export declare const rureTools: MCPTool[];
+//# sourceMappingURL=rure-tools.d.ts.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/rure-tools.js

@@ -0,0 +1,359 @@
+/**
+ * ruRE Phase 1 MCP Tools — JS/Electron static analysis.
+ *
+ * See plugins/ruflo-rure/docs/adrs/0001-scope-and-dual-use-policy.md and
+ * 0002-phase1-architecture.md. These tools parse local files; they never
+ * execute analyzed code, and all extracted text is routed through the
+ * AIDefence gate before being returned to the caller.
+ */
+import { openSync, fstatSync, readFileSync, closeSync } from 'node:fs';
+import { validatePath, validateText } from './validate-input.js';
+import { extractAsarWithCaps, DEFAULT_ASAR_LIMITS } from '../rure/extract-asar.js';
+import { analyzeJsApp } from '../rure/analyze-js-app.js';
+import { findFeature } from '../rure/find-feature.js';
+import { gateWithAIDefence } from '../rure/aidefence-gate.js';
+import { parseBinary, extractStrings, MAX_BINARY_BYTES } from '../rure/binary-parse.js';
+import { parseDotNet } from '../rure/dotnet-parse.js';
+import { analyzeEvm, parseHex, MAX_EVM_BYTES } from '../rure/evm-parse.js';
+function fail(error) {
+    return { content: [{ type: 'text', text: JSON.stringify({ success: false, error }) }], isError: true };
+}
+function ok(data) {
+    return { content: [{ type: 'text', text: JSON.stringify({ success: true, ...data }) }] };
+}
+/**
+ * Screens untrusted extracted text through AIDefence. Every attacker-derived string in a
+ * tool result goes through here (paths, names, literals), results are cached per call, and
+ * `screened` reports honestly whether the scanner actually ran on everything.
+ */
+class Screener {
+    redacted = 0;
+    unscreened = 0;
+    cache = new Map();
+    async one(item) {
+        let g = this.cache.get(item);
+        if (!g) {
+            g = await gateWithAIDefence(item);
+            this.cache.set(item, g);
+            if (g.flagged)
+                this.redacted += 1;
+            if (!g.gated && item)
+                this.unscreened += 1;
+        }
+        return g.text;
+    }
+    async screen(items) {
+        const out = [];
+        for (const item of items)
+            out.push(await this.one(item));
+        return out;
+    }
+    get screened() {
+        return this.unscreened === 0;
+    }
+}
+async function screenEvidence(sc, e) {
+    return { ...e, file: await sc.one(e.file) };
+}
+/** Returns a module analysis with every attacker-derived string screened and clipped; raw snippets are dropped. */
+async function screenModule(sc, mod) {
+    const imports = [];
+    for (const i of mod.imports) {
+        imports.push({ source: await sc.one(i.source), names: await sc.screen(i.names), evidence: await screenEvidence(sc, i.evidence) });
+    }
+    const exports = [];
+    for (const e of mod.exports)
+        exports.push({ name: await sc.one(e.name), evidence: await screenEvidence(sc, e.evidence) });
+    const electronBoundaries = [];
+    for (const b of mod.electronBoundaries) {
+        electronBoundaries.push({ kind: b.kind, detail: await sc.one(b.detail), evidence: await screenEvidence(sc, b.evidence) });
+    }
+    return { file: await sc.one(mod.file), imports, exports, electronBoundaries };
+}
+/** Opens once and checks the size on the same descriptor, so a file swapped after a stat cannot bypass the cap. */
+function readCapped(path, cap) {
+    const fd = openSync(path, 'r');
+    try {
+        const st = fstatSync(fd);
+        if (!st.isFile())
+            return { ok: false, error: 'path is not a regular file' };
+        if (st.size > cap)
+            return { ok: false, error: `file exceeds the ${cap}-byte analysis cap` };
+        return { ok: true, bytes: readFileSync(fd) };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export const rureTools = [
+    {
+        name: 'rure_extract_asar',
+        description: 'Unpack an Electron .asar archive to a scratch directory, under resource caps (max total declared size, max file count) checked from the archive header before any bytes are written. Refuses to partially extract: returns truncated:true with nothing written if the archive exceeds the caps. Use when you need to analyze the JS inside a packaged Electron app and rure_analyze_js_app rejects the .asar path directly.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'electron', 'asar', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to the .asar file' },
+            },
+            required: ['path'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            try {
+                const result = await extractAsarWithCaps(v.sanitized, DEFAULT_ASAR_LIMITS);
+                if (result.truncated) {
+                    return ok({ truncated: true, reason: result.reason, fileCount: result.fileCount, totalBytes: result.totalBytes });
+                }
+                return ok({
+                    truncated: false,
+                    unpackedPath: result.unpackedPath,
+                    fileCount: result.fileCount,
+                    totalBytes: result.totalBytes,
+                });
+            }
+            catch (err) {
+                return fail(`asar extraction failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_analyze_js_app',
+        description: 'Statically analyze a directory of JavaScript/TypeScript/Electron source: module list, import/export graph, and Electron process-boundary detection (ipcMain/ipcRenderer/contextBridge, require("electron"), nodeIntegration flags). Every finding carries evidence (file + line range), AIDefence-screened before return. Use when you need a structural map of unfamiliar JS/Electron source rather than reading files one at a time — native Read is fine for a single already-identified file, but wrong for discovering the import graph or Electron boundaries across a whole app. Does not accept a .asar path directly — run rure_extract_asar first and pass its unpackedPath.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'electron', 'javascript', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to a directory of extracted JS/Electron source' },
+            },
+            required: ['path'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            try {
+                const analysis = await analyzeJsApp(v.sanitized);
+                const sc = new Screener();
+                const modules = [];
+                for (const m of analysis.modules)
+                    modules.push(await screenModule(sc, m));
+                return ok({
+                    filesScanned: analysis.filesScanned,
+                    truncated: analysis.truncated,
+                    skippedFiles: analysis.skippedFiles,
+                    isElectron: analysis.isElectron,
+                    modules,
+                    redactedSnippetCount: sc.redacted,
+                    screened: sc.screened,
+                });
+            }
+            catch (err) {
+                return fail(`analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_find_feature',
+        description: 'Locate where a described feature likely lives in an already-extracted JS/Electron app, using deterministic lexical and structural scoring (not semantic/LLM matching, so results stay explainable). Returns ranked matches with file, line range, a short snippet, and a score, every snippet AIDefence-screened before return. Use when the target app is too large to read file-by-file and you need evidence of where a feature lives before explaining or reimplementing it — grep is fine for an exact known string, but wrong when you only have a plain-language description of the behavior.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'search', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to a directory of extracted JS/Electron source' },
+                query: { type: 'string', description: 'Plain-language description of the feature to locate' },
+            },
+            required: ['path', 'query'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            const q = validateText(input.query, 'query', 2000);
+            if (!q.valid)
+                return fail(q.error);
+            try {
+                const result = await findFeature(v.sanitized, q.sanitized);
+                const sc = new Screener();
+                const gated = [];
+                for (const m of result.matches) {
+                    const before = sc.redacted;
+                    const snippet = await sc.one(m.snippet);
+                    gated.push({ ...m, file: await sc.one(m.file), snippet, redacted: sc.redacted > before });
+                }
+                return ok({
+                    matches: gated,
+                    filesScanned: result.filesScanned,
+                    truncated: result.truncated,
+                    skippedFiles: result.skippedFiles,
+                    screened: sc.screened,
+                });
+            }
+            catch (err) {
+                return fail(`feature search failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_analyze_binary',
+        description: 'Statically inspect a native ELF, PE, or Mach-O file (ADR-0003): format, architecture, entry point, section layout, linked libraries, and imported/exported symbols, plus optional printable strings. Pure byte parsing under hard caps (128 MiB file, bounded tables); the file is never loaded or executed, and every name and string is AIDefence-screened before return. Use when you need an inventory of what a native binary links against and exposes before deciding where to look next — not for disassembly or decompilation, which this does not do. Malformed headers yield warnings, not errors.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'binary', 'elf', 'pe', 'macho', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to a native binary (ELF, PE, or Mach-O)' },
+                includeStrings: { type: 'boolean', description: 'Also return up to 200 printable strings (default false)' },
+            },
+            required: ['path'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            try {
+                const r = readCapped(v.sanitized, MAX_BINARY_BYTES);
+                if (!r.ok)
+                    return fail(r.error);
+                const buf = r.bytes;
+                const info = parseBinary(buf);
+                const sc = new Screener();
+                const libraries = await sc.screen(info.libraries);
+                const imports = await sc.screen(info.imports);
+                const exports = await sc.screen(info.exports);
+                const sectionNames = await sc.screen(info.sections.map((x) => x.name));
+                const sections = info.sections.map((x, i) => ({ ...x, name: sectionNames[i] }));
+                let strings;
+                let stringsTruncated = false;
+                const warnings = [...info.warnings];
+                if (input.includeStrings === true) {
+                    if (info.format === 'unknown') {
+                        warnings.push('strings not extracted: file is not a recognized binary format');
+                    }
+                    else {
+                        const ex = extractStrings(buf);
+                        stringsTruncated = ex.truncated;
+                        const gated = await sc.screen(ex.strings.map((x) => x.value));
+                        strings = ex.strings.map((x, i) => ({ value: gated[i], offset: x.offset }));
+                    }
+                }
+                return ok({ ...info, warnings, sections, libraries, imports, exports, ...(strings ? { strings, stringsTruncated } : {}), redactedCount: sc.redacted, screened: sc.screened });
+            }
+            catch (err) {
+                return fail(`binary analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_analyze_dotnet',
+        description: 'Inspect a managed .NET assembly (.dll/.exe) from its ECMA-335 metadata (ADR-0004): runtime version, assembly identity, assembly references, type names, method count, P/Invoke native imports (module + function), user-string literals, and entry-point token. Reads metadata only under hard caps; the assembly is never loaded or run, and every name and string is AIDefence-screened before return. Use when you need the dependency and native-call surface of a .NET binary before deciding where to dig deeper — not for IL disassembly or decompilation, which this does not do. A native (non-managed) PE returns isManaged:false.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'dotnet', 'assembly', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Absolute path to a .NET assembly (.dll or .exe)' },
+            },
+            required: ['path'],
+        },
+        handler: async (input) => {
+            const v = validatePath(input.path, 'path');
+            if (!v.valid)
+                return fail(v.error);
+            try {
+                const r = readCapped(v.sanitized, MAX_BINARY_BYTES);
+                if (!r.ok)
+                    return fail(r.error);
+                const info = parseDotNet(r.bytes);
+                const sc = new Screener();
+                const assembly = info.assembly ? { ...info.assembly, name: await sc.one(info.assembly.name) } : null;
+                const refNames = await sc.screen(info.assemblyRefs.map((x) => x.name));
+                const types = await sc.screen(info.types);
+                const pmods = await sc.screen(info.pinvokes.map((x) => x.module));
+                const pfuncs = await sc.screen(info.pinvokes.map((x) => x.function));
+                const userStrings = await sc.screen(info.userStrings);
+                const runtimeVersion = info.runtimeVersion === null ? null : await sc.one(info.runtimeVersion);
+                return ok({
+                    ...info,
+                    runtimeVersion,
+                    assembly,
+                    assemblyRefs: info.assemblyRefs.map((x, i) => ({ ...x, name: refNames[i] })),
+                    types,
+                    pinvokes: info.pinvokes.map((_, i) => ({ module: pmods[i], function: pfuncs[i] })),
+                    userStrings,
+                    redactedCount: sc.redacted,
+                    screened: sc.screened,
+                });
+            }
+            catch (err) {
+                return fail(`dotnet analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+    {
+        name: 'rure_analyze_evm',
+        description: 'Statically inventory EVM contract bytecode (ADR-0005): instruction and JUMPDEST counts, function selectors recognized from the dispatcher (with names for a small well-known table only), counts and offsets of hazardous opcodes (SELFDESTRUCT, DELEGATECALL, CALLCODE, CREATE/CREATE2, ORIGIN, CALL, STATICCALL), embedded addresses, event topics, EIP-1167 minimal-proxy detection, compiler metadata, and embedded strings such as revert reasons (AIDefence-screened). Pass bytecode inline as hex, or a path to a file of hex text or raw bytes. Aligned disassembly only: there is no EVM interpreter, no RPC, and no network. Use when you need the exposed surface and risky capabilities of a contract before deeper review; a hazardous opcode is an inventory fact, not a vulnerability finding, and dispatcher detection can miss unusual layouts.',
+        category: 'rure',
+        tags: ['reverse-engineering', 'evm', 'smart-contract', 'static-analysis'],
+        inputSchema: {
+            type: 'object',
+            properties: {
+                bytecode: { type: 'string', description: 'Contract bytecode as hex (0x prefix optional). Provide this or path, not both.' },
+                path: { type: 'string', description: 'Absolute path to a file containing hex text or raw bytecode' },
+                includeDisassembly: { type: 'boolean', description: 'Also return the first 500 instructions (default false)' },
+            },
+        },
+        handler: async (input) => {
+            const hasInline = typeof input.bytecode === 'string' && input.bytecode.length > 0;
+            const hasPath = typeof input.path === 'string' && input.path.length > 0;
+            if (hasInline === hasPath)
+                return fail('provide exactly one of bytecode or path');
+            try {
+                let bytes;
+                if (hasInline) {
+                    const text = input.bytecode;
+                    if (text.length > MAX_EVM_BYTES * 2 + 2)
+                        return fail(`bytecode exceeds the ${MAX_EVM_BYTES}-byte cap`);
+                    const parsed = parseHex(text);
+                    if (!parsed.ok)
+                        return fail(parsed.error);
+                    bytes = parsed.bytes;
+                }
+                else {
+                    const v = validatePath(input.path, 'path');
+                    if (!v.valid)
+                        return fail(v.error);
+                    const r = readCapped(v.sanitized, MAX_EVM_BYTES * 2 + 64);
+                    if (!r.ok)
+                        return fail(r.error);
+                    const raw = r.bytes;
+                    const asText = raw.toString('latin1').trim();
+                    if (/^(0x)?[0-9a-fA-F\s]+$/.test(asText)) {
+                        const parsed = parseHex(asText.replace(/\s/g, ''));
+                        if (!parsed.ok)
+                            return fail(parsed.error);
+                        bytes = parsed.bytes;
+                    }
+                    else if (raw.length <= MAX_EVM_BYTES) {
+                        bytes = raw;
+                    }
+                    else {
+                        return fail(`file exceeds the ${MAX_EVM_BYTES}-byte bytecode cap`);
+                    }
+                }
+                const info = analyzeEvm(bytes, input.includeDisassembly === true);
+                const sc = new Screener();
+                const strings = await sc.screen(info.strings);
+                return ok({ ...info, strings, redactedCount: sc.redacted, screened: sc.screened });
+            }
+            catch (err) {
+                return fail(`evm analysis failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        },
+    },
+];
+//# sourceMappingURL=rure-tools.js.map

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.d.ts

@@ -54,6 +54,15 @@ export declare function siblingAgentDbPath(dbPath: string): string | null;
 export declare function ensureBridgeSchema(db: {
     exec: (sql: string) => unknown;
 }): boolean;
+/** @internal Exported for the multi-store rescue regression test. */
+export declare function rescueAgentdbEmbedder(agentdb: {
+    embedder?: {
+        pipeline?: unknown;
+        embed?: (t: string) => Promise<Float32Array>;
+        embedBatch?: (ts: string[]) => Promise<Float32Array[]>;
+        __ruvectorRescued?: boolean;
+    };
+}): Promise<void>;
 /**
  * Store an entry via AgentDB v3.
  * Phase 2-5: Routes through MutationGuard → TieredCache → DB → AttestationLog.
@@ -102,6 +111,14 @@ export declare function bridgeStoreEntry(options: {
  * Phase 2: BM25 hybrid scoring replaces naive String.includes() keyword fallback.
  * Combines cosine similarity (semantic) with BM25 (lexical) via reciprocal rank fusion.
  */
+/**
+ * #4397: how many of the newest rows the pre-rank SELECT hands to scoring.
+ * #2982 added ORDER BY updated_at DESC but kept LIMIT 1000, so rows outside
+ * the newest 1000 became unfindable (the sql.js path and 3.38.3 used 10000).
+ * Override with CLAUDE_FLOW_SEARCH_WINDOW (clamped to 100..100000).
+ */
+export declare const DEFAULT_BRIDGE_SEARCH_WINDOW = 10000;
+export declare function resolveBridgeSearchWindow(env?: NodeJS.ProcessEnv): number;
 export declare function bridgeSearchEntries(options: {
     query: string;
     namespace?: string;

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.js

@@ -896,13 +896,10 @@ function getDb(registry) {
     rescueAgentdbEmbedder(agentdb).catch(() => { });
     return { db, agentdb };
 }
-// One-shot guard so we only patch once per process — the embedder is shared
-// by ReflexionMemory/SkillLibrary/CausalRecall and they all see the same
-// object reference.
-let _embedderPatched = false;
-async function rescueAgentdbEmbedder(agentdb) {
-    if (_embedderPatched)
-        return;
+// The rescue is idempotent per embedder via __ruvectorRescued. A process-wide
+// flag would skip later dbPath registries and leave their embedder on mock (#4410).
+/** @internal Exported for the multi-store rescue regression test. */
+export async function rescueAgentdbEmbedder(agentdb) {
     const emb = agentdb?.embedder;
     if (!emb || emb.__ruvectorRescued)
         return;
@@ -953,7 +950,6 @@ async function rescueAgentdbEmbedder(agentdb) {
     emb.embed = newEmbed;
     emb.embedBatch = async (texts) => Promise.all(texts.map(t => newEmbed(t)));
     emb.__ruvectorRescued = true;
-    _embedderPatched = true;
 }
 /** AgentDB uses a null pipeline while its transformer failed and it serves mock vectors. */
 function isMockAgentdbEmbedder(embedder) {
@@ -1291,6 +1287,19 @@ export async function bridgeStoreEntry(options) {
  * Phase 2: BM25 hybrid scoring replaces naive String.includes() keyword fallback.
  * Combines cosine similarity (semantic) with BM25 (lexical) via reciprocal rank fusion.
  */
+/**
+ * #4397: how many of the newest rows the pre-rank SELECT hands to scoring.
+ * #2982 added ORDER BY updated_at DESC but kept LIMIT 1000, so rows outside
+ * the newest 1000 became unfindable (the sql.js path and 3.38.3 used 10000).
+ * Override with CLAUDE_FLOW_SEARCH_WINDOW (clamped to 100..100000).
+ */
+export const DEFAULT_BRIDGE_SEARCH_WINDOW = 10000;
+export function resolveBridgeSearchWindow(env = process.env) {
+    const n = Number.parseInt(env.CLAUDE_FLOW_SEARCH_WINDOW ?? "", 10);
+    if (!Number.isFinite(n))
+        return DEFAULT_BRIDGE_SEARCH_WINDOW;
+    return Math.min(100000, Math.max(100, n));
+}
 export async function bridgeSearchEntries(options) {
     if (!operationContext.getStore()?.active)
         return withBridgeOperation(() => bridgeSearchEntries(options));
@@ -1339,7 +1348,7 @@ export async function bridgeSearchEntries(options) {
         FROM memory_entries
         WHERE ${liveMemoryRowSql()} ${whereExtra}
         ORDER BY updated_at DESC
-        LIMIT 1000
+        LIMIT ${resolveBridgeSearchWindow()}
       `);
             rows = filterParams.length > 0 ? stmt.all(...filterParams) : stmt.all();
         }

package/v3/@claude-flow/cli/dist/src/mods/claude-installs.d.ts

@@ -15,6 +15,18 @@ export interface ClaudeInstall {
 export type VersionOf = (path: string) => string | null;
 /** a < b for dotted numeric versions. */
 export declare function versionLess(a: string, b: string): boolean;
+export interface VersionProbe {
+    command: string;
+    args: string[];
+    windowsVerbatimArguments?: boolean;
+}
+/**
+ * #4397: Node refuses to execFile a .cmd/.bat shim on Windows (EINVAL), so the
+ * npm-global `claude.cmd` read as "version unknown". Shims go through cmd.exe
+ * with the path quoted; a path holding cmd metacharacters is not probed at
+ * all (null) rather than risk interpreting it.
+ */
+export declare function versionProbe(path: string, platform?: NodeJS.Platform, comspec?: string): VersionProbe | null;
 /** `claude --version` of one binary, bounded; null when it cannot say. */
 export declare const defaultVersionOf: VersionOf;
 /** Every `claude` on PATH, in PATH order (the first is what runs), plus ~/.local/bin. */

package/v3/@claude-flow/cli/dist/src/mods/claude-installs.js

@@ -22,10 +22,30 @@ export function versionLess(a, b) {
     }
     return false;
 }
+/**
+ * #4397: Node refuses to execFile a .cmd/.bat shim on Windows (EINVAL), so the
+ * npm-global `claude.cmd` read as "version unknown". Shims go through cmd.exe
+ * with the path quoted; a path holding cmd metacharacters is not probed at
+ * all (null) rather than risk interpreting it.
+ */
+export function versionProbe(path, platform = process.platform, comspec = process.env.ComSpec || 'cmd.exe') {
+    if (platform === 'win32' && /\.(cmd|bat)$/i.test(path)) {
+        if (/["&|<>^%\r\n]/.test(path))
+            return null;
+        return { command: comspec, args: ['/d', '/s', '/c', `""${path}" --version"`], windowsVerbatimArguments: true };
+    }
+    return { command: path, args: ['--version'] };
+}
 /** `claude --version` of one binary, bounded; null when it cannot say. */
 export const defaultVersionOf = (path) => {
+    const probe = versionProbe(path);
+    if (!probe)
+        return null;
     try {
-        const out = execFileSync(path, ['--version'], { encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] });
+        const out = execFileSync(probe.command, probe.args, {
+            encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'],
+            ...(probe.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+        });
         return out.match(/\d+\.\d+\.\d+/)?.[0] ?? null;
     }
     catch {

package/v3/@claude-flow/cli/dist/src/rure/aidefence-gate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AIDefence content gate for ruRE (ADR-0001 §dual-use policy).
+ *
+ * Every string literal, comment, and identifier ruRE extracts comes from a
+ * target the user may not control. Before any of it is returned to the
+ * caller (and therefore to the model that synthesizes an explanation), it is
+ * routed through this gate. Mirrors the lazy-load pattern used by
+ * browser-intent-tools.ts's private gateWithAIDefence — @claude-flow/aidefence
+ * is itself an optional dependency, so absence degrades to pass-through
+ * rather than blocking analysis.
+ */
+/** Longest attacker-derived string returned or scanned; anything longer is clipped first. */
+export declare const MAX_GATED_CHARS = 2048;
+export declare function clipText(text: string): string;
+export interface GatedText {
+    text: string;
+    flagged: boolean;
+    gated: boolean;
+}
+export declare function gateWithAIDefence(input: string): Promise<GatedText>;
+/** Gate every string in an array, preserving order and length. Sequential —
+ * gating is cheap, and this avoids firing the first-ever (memoized) module
+ * resolution attempt from several calls at once. */
+export declare function gateAll(texts: string[]): Promise<GatedText[]>;
+//# sourceMappingURL=aidefence-gate.d.ts.map

package/v3/@claude-flow/cli/dist/src/rure/aidefence-gate.js

@@ -0,0 +1,63 @@
+/**
+ * AIDefence content gate for ruRE (ADR-0001 §dual-use policy).
+ *
+ * Every string literal, comment, and identifier ruRE extracts comes from a
+ * target the user may not control. Before any of it is returned to the
+ * caller (and therefore to the model that synthesizes an explanation), it is
+ * routed through this gate. Mirrors the lazy-load pattern used by
+ * browser-intent-tools.ts's private gateWithAIDefence — @claude-flow/aidefence
+ * is itself an optional dependency, so absence degrades to pass-through
+ * rather than blocking analysis.
+ */
+/** Longest attacker-derived string returned or scanned; anything longer is clipped first. */
+export const MAX_GATED_CHARS = 2048;
+export function clipText(text) {
+    return text.length > MAX_GATED_CHARS ? `${text.slice(0, MAX_GATED_CHARS)}…[truncated ${text.length - MAX_GATED_CHARS} chars]` : text;
+}
+// Memoized: resolving a genuinely-absent optional module repeatedly on every
+// call is wasteful, and a single shared attempt avoids any ambiguity from
+// multiple concurrent dynamic-import resolutions of the same bare specifier
+// (gateAll calls this for every string in a batch).
+let aidefenceModulePromise = null;
+function loadAIDefenceModule() {
+    aidefenceModulePromise ??= import('@claude-flow/aidefence');
+    return aidefenceModulePromise;
+}
+let defenderPromise = null;
+function loadDefender() {
+    defenderPromise ??= loadAIDefenceModule().then((mod) => mod.createAIDefence({ enableLearning: false }));
+    return defenderPromise;
+}
+export async function gateWithAIDefence(input) {
+    if (!input)
+        return { text: input, flagged: false, gated: false };
+    const text = clipText(input);
+    try {
+        const defender = await loadDefender();
+        let flagged = false;
+        // A scan that throws is NOT a clean result: report gated:false so callers can disclose it.
+        const quick = defender.quickScan(text);
+        flagged = !!quick?.threat;
+        if (!flagged && defender.hasPII(text))
+            flagged = true;
+        if (flagged) {
+            return { text: '[content redacted by AIDefence — threat or PII detected]', flagged: true, gated: true };
+        }
+        return { text, flagged: false, gated: true };
+    }
+    catch {
+        // @claude-flow/aidefence is optional, or its scan failed: pass the clipped text through
+        // but say so (gated:false). Tool outputs surface this as screened:false.
+        return { text, flagged: false, gated: false };
+    }
+}
+/** Gate every string in an array, preserving order and length. Sequential —
+ * gating is cheap, and this avoids firing the first-ever (memoized) module
+ * resolution attempt from several calls at once. */
+export async function gateAll(texts) {
+    const results = [];
+    for (const t of texts)
+        results.push(await gateWithAIDefence(t));
+    return results;
+}
+//# sourceMappingURL=aidefence-gate.js.map