claude-flow 3.59.17 → 3.60.1

package/v3/@claude-flow/cli/dist/src/rure/find-feature.d.ts

@@ -0,0 +1,26 @@
+/**
+ * ruRE Phase 1 — bounded lexical/structural feature search (ADR-0002).
+ *
+ * Deterministic, auditable: scores files by term overlap between the query
+ * and each file's identifiers/strings/comments, plus raw substring hits.
+ * Not semantic/LLM-based matching, by design — Phase 1 stays explainable.
+ */
+import { type Evidence } from './ts-walk.js';
+export interface FeatureMatch {
+    file: string;
+    lineRange: {
+        start: number;
+        end: number;
+    };
+    snippet: string;
+    score: number;
+}
+export interface FindFeatureResult {
+    matches: FeatureMatch[];
+    filesScanned: number;
+    truncated: boolean;
+    skippedFiles: number;
+}
+export declare function findFeature(root: string, query: string, maxMatches?: number): Promise<FindFeatureResult>;
+export type { Evidence };
+//# sourceMappingURL=find-feature.d.ts.map

package/v3/@claude-flow/cli/dist/src/rure/find-feature.js

@@ -0,0 +1,69 @@
+/**
+ * ruRE Phase 1 — bounded lexical/structural feature search (ADR-0002).
+ *
+ * Deterministic, auditable: scores files by term overlap between the query
+ * and each file's identifiers/strings/comments, plus raw substring hits.
+ * Not semantic/LLM-based matching, by design — Phase 1 stays explainable.
+ */
+import { walkAnalyzableFiles } from './walk-files.js';
+import { analyzeModuleSource } from './ts-walk.js';
+function tokenize(text) {
+    return text
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((t) => t.length > 1);
+}
+function scoreLine(lineLower, queryTerms) {
+    let score = 0;
+    for (const term of queryTerms) {
+        if (lineLower.includes(term))
+            score += 1;
+    }
+    return score;
+}
+export async function findFeature(root, query, maxMatches = 10) {
+    const queryTerms = Array.from(new Set(tokenize(query)));
+    const { files, truncated } = walkAnalyzableFiles(root);
+    const candidates = [];
+    let skippedFiles = 0;
+    for (const f of files) {
+        const lines = f.text.split('\n');
+        // Use the parser for structural signal (imports/exports/electron
+        // boundaries contribute to relevance) without executing anything.
+        let structuralBoost = 0;
+        try {
+            const analysis = await analyzeModuleSource(f.path, f.text);
+            const names = [
+                ...analysis.imports.flatMap((i) => [i.source, ...i.names]),
+                ...analysis.exports.map((e) => e.name),
+            ].join(' ').toLowerCase();
+            structuralBoost = scoreLine(names, queryTerms) * 0.5;
+        }
+        catch {
+            skippedFiles += 1; // unparseable: lexical score alone still applies
+        }
+        let bestLine = -1;
+        let bestScore = 0;
+        for (let i = 0; i < lines.length; i++) {
+            const s = scoreLine(lines[i].toLowerCase(), queryTerms);
+            if (s > bestScore) {
+                bestScore = s;
+                bestLine = i;
+            }
+        }
+        const total = bestScore + structuralBoost;
+        if (total > 0 && bestLine >= 0) {
+            const start = Math.max(0, bestLine - 2);
+            const end = Math.min(lines.length - 1, bestLine + 2);
+            candidates.push({
+                file: f.path,
+                lineRange: { start: start + 1, end: end + 1 },
+                snippet: lines.slice(start, end + 1).join('\n'),
+                score: total,
+            });
+        }
+    }
+    candidates.sort((a, b) => b.score - a.score);
+    return { matches: candidates.slice(0, maxMatches), filesScanned: files.length, truncated, skippedFiles };
+}
+//# sourceMappingURL=find-feature.js.map

package/v3/@claude-flow/cli/dist/src/rure/ts-walk.d.ts

@@ -0,0 +1,47 @@
+/**
+ * ruRE Phase 1 — static analysis via the TypeScript compiler API (ADR-0002).
+ *
+ * Parses JS/MJS/CJS/TS/TSX source into an AST and inspects it. This module
+ * only reads and inspects; it never calls eval, vm, child_process, or a
+ * dynamic require on analyzed content (ADR-0001 "parses, never executes").
+ *
+ * The `typescript` package is loaded lazily (not as a top-level import):
+ * mcp-tools/rure-tools.ts is registered into every CLI invocation's tool
+ * set via mcp-client.ts, so a static `import ts from 'typescript'` here
+ * would load the full compiler into memory on every `ruflo` command, not
+ * just the ones that use ruRE. Same reasoning as aidefence-gate.ts's lazy
+ * load, and the same failure shape as the #2561 cold-start regression.
+ */
+export interface Evidence {
+    file: string;
+    /** 1-indexed, inclusive. */
+    lineStart: number;
+    lineEnd: number;
+}
+export interface ImportRecord {
+    source: string;
+    names: string[];
+    evidence: Evidence;
+}
+export interface ExportRecord {
+    name: string;
+    evidence: Evidence;
+}
+export interface ElectronBoundaryHit {
+    kind: 'require-electron' | 'ipcMain' | 'ipcRenderer' | 'contextBridge' | 'nodeIntegration-flag';
+    detail: string;
+    evidence: Evidence;
+}
+export interface ModuleAnalysis {
+    file: string;
+    imports: ImportRecord[];
+    exports: ExportRecord[];
+    electronBoundaries: ElectronBoundaryHit[];
+    /** Raw text snippets this module's analysis quoted, for the AIDefence gate to scan. */
+    rawSnippets: string[];
+}
+/** No `typescript` dependency — pure extension check, safe to call eagerly. */
+export declare function isAnalyzableFile(path: string): boolean;
+/** Parses one file's source text into a structural analysis. Never executes it. */
+export declare function analyzeModuleSource(file: string, sourceText: string): Promise<ModuleAnalysis>;
+//# sourceMappingURL=ts-walk.d.ts.map

package/v3/@claude-flow/cli/dist/src/rure/ts-walk.js

@@ -0,0 +1,158 @@
+/**
+ * ruRE Phase 1 — static analysis via the TypeScript compiler API (ADR-0002).
+ *
+ * Parses JS/MJS/CJS/TS/TSX source into an AST and inspects it. This module
+ * only reads and inspects; it never calls eval, vm, child_process, or a
+ * dynamic require on analyzed content (ADR-0001 "parses, never executes").
+ *
+ * The `typescript` package is loaded lazily (not as a top-level import):
+ * mcp-tools/rure-tools.ts is registered into every CLI invocation's tool
+ * set via mcp-client.ts, so a static `import ts from 'typescript'` here
+ * would load the full compiler into memory on every `ruflo` command, not
+ * just the ones that use ruRE. Same reasoning as aidefence-gate.ts's lazy
+ * load, and the same failure shape as the #2561 cold-start regression.
+ */
+let tsModulePromise = null;
+function loadTs() {
+    tsModulePromise ??= import('typescript');
+    return tsModulePromise;
+}
+const ANALYZABLE_EXT = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx']);
+/** No `typescript` dependency — pure extension check, safe to call eagerly. */
+export function isAnalyzableFile(path) {
+    const dot = path.lastIndexOf('.');
+    if (dot < 0)
+        return false;
+    return ANALYZABLE_EXT.has(path.slice(dot));
+}
+function scriptKindFor(ts, path) {
+    if (path.endsWith('.tsx'))
+        return ts.ScriptKind.TSX;
+    if (path.endsWith('.jsx'))
+        return ts.ScriptKind.JSX;
+    if (path.endsWith('.ts'))
+        return ts.ScriptKind.TS;
+    return ts.ScriptKind.JS;
+}
+function evidenceFor(sf, node, file) {
+    const start = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+    const end = sf.getLineAndCharacterOfPosition(node.getEnd()).line + 1;
+    return { file, lineStart: start, lineEnd: end };
+}
+function textOf(node) {
+    return node.getText();
+}
+/** Parses one file's source text into a structural analysis. Never executes it. */
+export async function analyzeModuleSource(file, sourceText) {
+    const ts = await loadTs();
+    const sf = ts.createSourceFile(file, sourceText, ts.ScriptTarget.Latest, true, scriptKindFor(ts, file));
+    const imports = [];
+    const exports = [];
+    const electronBoundaries = [];
+    const rawSnippets = [];
+    const pushSnippet = (n) => {
+        const t = textOf(n);
+        if (t)
+            rawSnippets.push(t);
+    };
+    function visit(node) {
+        // ESM: import ... from "x"
+        if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+            const source = node.moduleSpecifier.text;
+            const names = [];
+            const bindings = node.importClause?.namedBindings;
+            if (node.importClause?.name)
+                names.push(node.importClause.name.text);
+            if (bindings && ts.isNamedImports(bindings)) {
+                for (const el of bindings.elements)
+                    names.push(el.name.text);
+            }
+            else if (bindings && ts.isNamespaceImport(bindings)) {
+                names.push(`* as ${bindings.name.text}`);
+            }
+            imports.push({ source, names, evidence: evidenceFor(sf, node, file) });
+            pushSnippet(node);
+            if (source === 'electron') {
+                electronBoundaries.push({
+                    kind: 'require-electron',
+                    detail: `import from "electron": ${names.join(', ') || '(side-effect only)'}`,
+                    evidence: evidenceFor(sf, node, file),
+                });
+            }
+        }
+        // ESM: export ... (named, default, declarations)
+        if (ts.isExportDeclaration(node)) {
+            const clause = node.exportClause;
+            if (clause && ts.isNamedExports(clause)) {
+                for (const el of clause.elements) {
+                    exports.push({ name: el.name.text, evidence: evidenceFor(sf, node, file) });
+                }
+            }
+            pushSnippet(node);
+        }
+        if (ts.isExportAssignment(node)) {
+            exports.push({ name: 'default', evidence: evidenceFor(sf, node, file) });
+            pushSnippet(node);
+        }
+        if ((ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node) || ts.isVariableStatement(node)) &&
+            hasExportModifier(ts, node)) {
+            const name = exportedNameOf(ts, node);
+            if (name)
+                exports.push({ name, evidence: evidenceFor(sf, node, file) });
+        }
+        // CJS: require("x") / require("electron")
+        if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'require') {
+            const arg = node.arguments[0];
+            if (arg && ts.isStringLiteral(arg)) {
+                const source = arg.text;
+                imports.push({ source, names: [], evidence: evidenceFor(sf, node, file) });
+                pushSnippet(node);
+                if (source === 'electron') {
+                    electronBoundaries.push({
+                        kind: 'require-electron',
+                        detail: `require("electron")`,
+                        evidence: evidenceFor(sf, node, file),
+                    });
+                }
+            }
+        }
+        // Electron process-boundary signals: ipcMain / ipcRenderer / contextBridge usage,
+        // and the nodeIntegration webPreferences flag (renderer-trust indicator).
+        if (ts.isPropertyAccessExpression(node) || ts.isIdentifier(node)) {
+            const text = ts.isIdentifier(node) ? node.text : node.name.text;
+            if (text === 'ipcMain' || text === 'ipcRenderer' || text === 'contextBridge') {
+                electronBoundaries.push({
+                    kind: text,
+                    detail: textOf(node).slice(0, 160),
+                    evidence: evidenceFor(sf, node, file),
+                });
+                pushSnippet(node);
+            }
+        }
+        if (ts.isPropertyAssignment(node) &&
+            ts.isIdentifier(node.name) &&
+            node.name.text === 'nodeIntegration') {
+            electronBoundaries.push({
+                kind: 'nodeIntegration-flag',
+                detail: textOf(node).slice(0, 160),
+                evidence: evidenceFor(sf, node, file),
+            });
+            pushSnippet(node);
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return { file, imports, exports, electronBoundaries, rawSnippets };
+}
+function hasExportModifier(ts, node) {
+    const mods = ts.canHaveModifiers(node) ? ts.getModifiers(node) : undefined;
+    return !!mods?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+}
+function exportedNameOf(ts, node) {
+    if (ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node)) {
+        return node.name?.text ?? null;
+    }
+    const first = node.declarationList.declarations[0];
+    return first && ts.isIdentifier(first.name) ? first.name.text : null;
+}
+//# sourceMappingURL=ts-walk.js.map

package/v3/@claude-flow/cli/dist/src/rure/walk-files.d.ts

@@ -0,0 +1,21 @@
+/**
+ * ruRE Phase 1 — bounded directory walk shared by the analyze and
+ * find-feature tools. Caps file count and per-file read size so a
+ * maliciously or accidentally huge target can't exhaust memory.
+ */
+export interface WalkLimits {
+    maxFiles: number;
+    maxFileBytes: number;
+    /** Total bytes of file text held across the whole walk. */
+    maxTotalBytes: number;
+}
+export declare const DEFAULT_WALK_LIMITS: WalkLimits;
+export interface WalkedFile {
+    path: string;
+    text: string;
+}
+export declare function walkAnalyzableFiles(root: string, limits?: WalkLimits): {
+    files: WalkedFile[];
+    truncated: boolean;
+};
+//# sourceMappingURL=walk-files.d.ts.map

package/v3/@claude-flow/cli/dist/src/rure/walk-files.js

@@ -0,0 +1,71 @@
+/**
+ * ruRE Phase 1 — bounded directory walk shared by the analyze and
+ * find-feature tools. Caps file count and per-file read size so a
+ * maliciously or accidentally huge target can't exhaust memory.
+ */
+import { readdirSync, lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isAnalyzableFile } from './ts-walk.js';
+export const DEFAULT_WALK_LIMITS = {
+    maxFiles: 20_000,
+    maxFileBytes: 8 * 1024 * 1024, // 8 MiB per file
+    maxTotalBytes: 128 * 1024 * 1024, // 128 MiB across the walk
+};
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.turbo', '.cache']);
+export function walkAnalyzableFiles(root, limits = DEFAULT_WALK_LIMITS) {
+    const files = [];
+    let truncated = false;
+    let totalBytes = 0;
+    function visit(dir) {
+        if (truncated || files.length >= limits.maxFiles) {
+            truncated = truncated || files.length >= limits.maxFiles;
+            return;
+        }
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (truncated)
+                return;
+            if (files.length >= limits.maxFiles) {
+                truncated = true;
+                return;
+            }
+            if (SKIP_DIRS.has(entry))
+                continue;
+            const full = join(dir, entry);
+            let st;
+            try {
+                st = lstatSync(full); // lstat: symlinks are never followed (loops, fan-out, escapes)
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory()) {
+                visit(full);
+            }
+            else if (st.isFile() && isAnalyzableFile(full)) {
+                if (st.size > limits.maxFileBytes)
+                    continue; // skip oversized files, don't abort the walk
+                if (totalBytes + st.size > limits.maxTotalBytes) {
+                    truncated = true;
+                    return;
+                }
+                totalBytes += st.size;
+                try {
+                    files.push({ path: full, text: readFileSync(full, 'utf8') });
+                }
+                catch {
+                    /* unreadable file, skip */
+                }
+            }
+        }
+    }
+    visit(root);
+    return { files, truncated };
+}
+//# sourceMappingURL=walk-files.js.map

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js

@@ -1159,6 +1159,14 @@ export class WorkerDaemon extends EventEmitter {
         const state = this.workers.get(workerConfig.type);
         const internalConfig = workerConfig;
         const staggerOffset = internalConfig.offsetMs || 0;
+        // #4410: only one timer may own a worker type. A redundant enable used to
+        // schedule a second timeout while this.timers kept only the newer handle,
+        // so the original leaked and could fire again after stop().
+        const previousTimer = this.timers.get(workerConfig.type);
+        if (previousTimer) {
+            clearTimeout(previousTimer);
+            this.timers.delete(workerConfig.type);
+        }
         // Calculate initial delay with stagger offset
         let initialDelay = staggerOffset;
         if (state.lastRun) {
@@ -1171,8 +1179,9 @@ export class WorkerDaemon extends EventEmitter {
                 return;
             // Use concurrency-controlled execution (P0 fix)
             await this.executeWorkerWithConcurrencyControl(workerConfig);
-            // Reschedule
-            if (this.running) {
+            // Reschedule only while the daemon is running and this worker is still
+            // enabled. Disabling during an in-flight run must not resurrect it.
+            if (this.running && workerConfig.enabled) {
                 const timer = setTimeout(runAndReschedule, workerConfig.intervalMs);
                 this.timers.set(workerConfig.type, timer);
                 state.nextRun = new Date(Date.now() + workerConfig.intervalMs);
@@ -1914,7 +1923,11 @@ export class WorkerDaemon extends EventEmitter {
         if (workerConfig) {
             workerConfig.enabled = enabled;
             if (enabled && this.running) {
-                this.scheduleWorker(workerConfig);
+                // A live timer or an in-flight run will schedule the next iteration
+                // itself; scheduling here would create a second chain (#4410).
+                if (!this.timers.has(type) && !this.runningWorkers.has(type)) {
+                    this.scheduleWorker(workerConfig);
+                }
             }
             else if (!enabled) {
                 const timer = this.timers.get(type);
@@ -1922,6 +1935,7 @@ export class WorkerDaemon extends EventEmitter {
                     clearTimeout(timer);
                     this.timers.delete(type);
                 }
+                this.pendingWorkers = this.pendingWorkers.filter(workerType => workerType !== type);
             }
             this.saveState();
         }

package/v3/@claude-flow/cli/dist/src/update/checker.d.ts

@@ -23,6 +23,7 @@ export interface UpdateConfig {
     exclude: string[];
 }
 declare const DEFAULT_CONFIG: UpdateConfig;
+export declare function getUpdateType(current: string, latest: string): 'major' | 'minor' | 'patch' | 'none';
 export declare function getInstalledVersion(packageName: string): string | null;
 export declare function checkForUpdates(config?: UpdateConfig): Promise<{
     results: UpdateCheckResult[];

package/v3/@claude-flow/cli/dist/src/update/checker.js

@@ -45,11 +45,13 @@ async function fetchPackageInfo(packageName) {
         return null;
     }
 }
-function getUpdateType(current, latest) {
+export function getUpdateType(current, latest) {
     if (!semver.valid(current) || !semver.valid(latest)) {
         return 'none';
     }
-    if (semver.eq(current, latest)) {
+    // An update is a strictly newer version. Comparing the parts one by one called 3.60.0 (running) against 3.59.17 (latest) a
+    // 'patch' update, since 17 > 0, and the startup check then auto-installed the older version: a downgrade.
+    if (!semver.gt(latest, current)) {
         return 'none';
     }
     if (semver.major(latest) > semver.major(current)) {

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.59.17",
+  "version": "3.60.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -96,13 +96,13 @@
   },
   "devDependencies": {
     "tsx": "^4.19.0",
-    "typescript": "^5.3.0",
     "vitest": "^4.1.0"
   },
   "dependencies": {
+    "@electron/asar": "^4.3.1",
     "@claude-flow/cli-core": "3.7.5",
     "@claude-flow/codex": "3.0.5",
-    "@claude-flow/mcp": "3.1.1",
+    "@claude-flow/mcp": "3.1.2",
     "@claude-flow/neural": "3.0.0",
     "@claude-flow/plugin-agent-federation": "1.0.1",
     "@claude-flow/security": "3.0.5",
@@ -123,6 +123,7 @@
     "inquirer": "^9.2.0",
     "semver": "7.7.3",
     "sql.js": "^1.13.0",
+    "typescript": "^5.3.0",
     "ws": "^8.21.0",
     "yaml": "^2.8.0",
     "zod": "^3.22.0",

package/.claude/.proven-config-version

@@ -1 +0,0 @@
-sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319

package/.claude/proven-config.json

@@ -1,42 +0,0 @@
-{
-  "adoptedAt": 1792673042956,
-  "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
-  "manifest": {
-    "schema": "ruflo.proven-config/v1",
-    "policy": {
-      "ref": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
-      "value": {
-        "alpha": 0.3,
-        "subjectWeight": 1,
-        "mmrLambda": 0.5,
-        "bodyWeight": 1.5,
-        "typePenaltyFactor": 0.5
-      }
-    },
-    "layer": "framework/node-cli",
-    "compatibility": {
-      "ruflo": ">=3.24.0"
-    },
-    "benchmark": {
-      "corpus": "ADR-081-labelled-v1",
-      "corpusHash": "sha256:2f700b5c363e20a3bd88ce2bc9b87bbbbaa61732c6177894c6ec37890f888982"
-    },
-    "receipt": {
-      "heldOutDelta": 0.07381404928570845,
-      "redblue": "PASS",
-      "drift": 0,
-      "canary": {
-        "rollbackRate": 0,
-        "latencyP95": 244.612458000076,
-        "costPerTask": 0
-      },
-      "receiptCoverage": 1
-    },
-    "platform": [
-      "linux",
-      "macOS",
-      "windows"
-    ]
-  },
-  "previous": ""
-}