claude-flow 3.6.18 → 3.6.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.6.18",
+  "version": "3.6.20",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/index.d.ts

@@ -4,6 +4,7 @@
  *
  * Created with ❤️ by ruv.io
  */
+import './log-filters.js';
 export declare const VERSION: string;
 export interface CLIOptions {
     name?: string;

package/v3/@claude-flow/cli/dist/src/index.js

@@ -4,33 +4,13 @@
  *
  * Created with ❤️ by ruv.io
  */
-// MUST run before any agentic-flow / agentdb imports — this file is
-// imported by every entry point (bin/cli.js, ruflo/bin/ruflo.js via
-// dist/src/index.js, and tests). Patching the console here ensures the
-// suppression applies regardless of how the CLI was invoked. Previously
-// the suppression lived only in bin/cli.js, so the ruflo wrapper (which
-// imports dist/src/index.js directly) leaked the cosmetic warning.
-//
-// Tight match: requires BOTH "[AgentDB Patch]" AND "Controller index not
-// found" so other [AgentDB Patch] messages (real issues) still flow.
-{
-    const _isCosmeticAgentdbPatchNoise = (msg) => {
-        const s = String(msg ?? '');
-        return s.includes('[AgentDB Patch]') && s.includes('Controller index not found');
-    };
-    const _origWarn = console.warn.bind(console);
-    const _origLog = console.log.bind(console);
-    console.warn = (...args) => {
-        if (_isCosmeticAgentdbPatchNoise(args[0]))
-            return;
-        _origWarn(...args);
-    };
-    console.log = (...args) => {
-        if (_isCosmeticAgentdbPatchNoise(args[0]))
-            return;
-        _origLog(...args);
-    };
-}
+// MUST be the first import — installs console filter for the cosmetic
+// "[AgentDB Patch] Controller index not found" warning before any
+// agentic-flow / agentdb code can load. ES module imports are evaluated
+// in source order, so this file runs its side effects before any other
+// import in this module's import graph (including transitive imports of
+// agentic-flow via commands/index.js).
+import './log-filters.js';
 import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';

package/v3/@claude-flow/cli/dist/src/log-filters.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Console filter for the cosmetic "[AgentDB Patch] Controller index not found"
+ * warning emitted by agentic-flow's runtime patch (it expects agentdb v1.x
+ * layout but we use v3). This file MUST be imported as the first side-effect
+ * import in any entry point so the patch is in place before agentic-flow
+ * (and anything that transitively imports it) loads.
+ *
+ * The previous attempt put the suppression as a top-level code block inside
+ * src/index.ts, but ES module imports are evaluated before the file's own
+ * top-level code, so transitive imports of agentic-flow were still
+ * triggering the warning before the suppression took effect. A dedicated
+ * side-effect module imported FIRST avoids that.
+ *
+ * Tight match: requires BOTH "[AgentDB Patch]" AND "Controller index not
+ * found". Other [AgentDB Patch] messages (real issues) flow through.
+ * Audit log audit_1776483149979 flagged the previous broad filter as too
+ * aggressive — this one is tight enough to be safe.
+ */
+declare const isCosmeticAgentdbPatchNoise: (msg: unknown) => boolean;
+declare const origWarn: (message?: any, ...optionalParams: any[]) => void;
+declare const origLog: (message?: any, ...optionalParams: any[]) => void;
+//# sourceMappingURL=log-filters.d.ts.map

package/v3/@claude-flow/cli/dist/src/log-filters.js

@@ -0,0 +1,36 @@
+"use strict";
+/**
+ * Console filter for the cosmetic "[AgentDB Patch] Controller index not found"
+ * warning emitted by agentic-flow's runtime patch (it expects agentdb v1.x
+ * layout but we use v3). This file MUST be imported as the first side-effect
+ * import in any entry point so the patch is in place before agentic-flow
+ * (and anything that transitively imports it) loads.
+ *
+ * The previous attempt put the suppression as a top-level code block inside
+ * src/index.ts, but ES module imports are evaluated before the file's own
+ * top-level code, so transitive imports of agentic-flow were still
+ * triggering the warning before the suppression took effect. A dedicated
+ * side-effect module imported FIRST avoids that.
+ *
+ * Tight match: requires BOTH "[AgentDB Patch]" AND "Controller index not
+ * found". Other [AgentDB Patch] messages (real issues) flow through.
+ * Audit log audit_1776483149979 flagged the previous broad filter as too
+ * aggressive — this one is tight enough to be safe.
+ */
+const isCosmeticAgentdbPatchNoise = (msg) => {
+    const s = String(msg ?? '');
+    return s.includes('[AgentDB Patch]') && s.includes('Controller index not found');
+};
+const origWarn = console.warn.bind(console);
+const origLog = console.log.bind(console);
+console.warn = (...args) => {
+    if (isCosmeticAgentdbPatchNoise(args[0]))
+        return;
+    origWarn(...args);
+};
+console.log = (...args) => {
+    if (isCosmeticAgentdbPatchNoise(args[0]))
+        return;
+    origLog(...args);
+};
+//# sourceMappingURL=log-filters.js.map

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js

@@ -1274,15 +1274,40 @@ export async function loadEmbeddingModel(options) {
         }
     }
     try {
-        // Try to import @xenova/transformers for ONNX embeddings
-        const transformers = await import('@xenova/transformers').catch(() => null);
-        if (transformers) {
+        // ADR-094: prefer @huggingface/transformers (clears protobufjs <7.5.5
+        // critical RCE chain), fall back to legacy @xenova/transformers.
+        // Inlined here rather than depending on @claude-flow/embeddings to
+        // avoid a circular optional-dep at install time; the logic mirrors
+        // @claude-flow/embeddings/src/transformers-loader.ts.
+        let transformersSource = null;
+        let pipelineFn = null;
+        {
+            const tryLoad = async (specifier) => {
+                try {
+                    return (await import(specifier));
+                }
+                catch {
+                    return null;
+                }
+            };
+            const hf = await tryLoad('@huggingface/transformers');
+            if (hf && typeof hf.pipeline === 'function') {
+                pipelineFn = hf.pipeline;
+                transformersSource = '@huggingface/transformers';
+            }
+            else {
+                const xen = await tryLoad('@xenova/transformers');
+                if (xen && typeof xen.pipeline === 'function') {
+                    pipelineFn = xen.pipeline;
+                    transformersSource = '@xenova/transformers';
+                }
+            }
+        }
+        if (pipelineFn && transformersSource) {
             if (verbose) {
-                console.log('Loading ONNX embedding model (all-MiniLM-L6-v2)...');
+                console.log(`Loading ONNX embedding model via ${transformersSource} (all-MiniLM-L6-v2)...`);
             }
-            // Use small, fast model for local embeddings
-            const { pipeline } = transformers;
-            const embedder = await pipeline('feature-extraction', 'Xenova/all-MiniLM-L6-v2');
+            const embedder = await pipelineFn('feature-extraction', 'Xenova/all-MiniLM-L6-v2');
             embeddingModelState = {
                 loaded: true,
                 model: embedder,

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.6.18",
+  "version": "3.6.20",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",