claude-flow 3.6.22 → 3.6.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.6.22",
+  "version": "3.6.24",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.js

@@ -210,15 +210,18 @@ async function getRegistry(dbPath) {
                             if (adbPkgJsonPath) {
                                 const adbDir = path.dirname(adbPkgJsonPath);
                                 const candidates = [
-                                    // AttestationLog needs a db handle — too risky to wire
-                                    // without a per-install audit, leave for follow-up ADR.
-                                    // MutationGuard needs a write-policy config; skipped
-                                    // here for the same reason.
-                                    // GuardedVectorBackend needs key material; skipped.
                                     // GNNService and RVFOptimizer can construct with no args
-                                    // in current agentdb — wire those.
+                                    // in current agentdb — safe to activate as-is.
                                     { name: 'gnnService', relPath: 'dist/src/services/GNNService.js', configurable: false },
                                     { name: 'rvfOptimizer', relPath: 'dist/src/optimizations/RVFOptimizer.js', configurable: false },
+                                    // ADR-095 G7 follow-up: MutationGuard constructs cleanly
+                                    // with no args and exposes WASM-backed proof generation.
+                                    // No external deps; safe-default activation.
+                                    { name: 'mutationGuard', relPath: 'dist/src/security/MutationGuard.js', configurable: false },
+                                    // AttestationLog needs a sqlite db handle — wired below
+                                    // separately because we have to construct a db too.
+                                    // GuardedVectorBackend needs key material — leave for
+                                    // follow-up ADR.
                                 ];
                                 for (const cand of candidates) {
                                     if (reg.get(cand.name))
@@ -244,6 +247,67 @@ async function getRegistry(dbPath) {
                                     }
                                     catch { /* skip controllers that fail to construct */ }
                                 }
+                                // AttestationLog activation — needs a better-sqlite3
+                                // database. We open a dedicated file at .swarm/attestation.db
+                                // (separate from the main memory.db so the audit trail
+                                // is isolated). Best-effort: if better-sqlite3 isn't
+                                // resolvable in this env, skip cleanly.
+                                let attestationInst = null;
+                                if (!reg.get('attestationLog')) {
+                                    try {
+                                        const attestationFile = path.join(adbDir, 'dist/src/security/AttestationLog.js');
+                                        if (fs.existsSync(attestationFile)) {
+                                            const Database = cjsRequire('better-sqlite3');
+                                            const swarmDir = path.resolve(process.cwd(), '.swarm');
+                                            if (!fs.existsSync(swarmDir))
+                                                fs.mkdirSync(swarmDir, { recursive: true });
+                                            const dbPath = path.join(swarmDir, 'attestation.db');
+                                            const db = new Database(dbPath);
+                                            const url = pathToFileURL(attestationFile).href;
+                                            const mod = await import(url);
+                                            const Ctor = mod.AttestationLog;
+                                            if (typeof Ctor === 'function') {
+                                                const inst = new Ctor({ db });
+                                                attestationInst = inst;
+                                                if (typeof reg.set === 'function')
+                                                    reg.set('attestationLog', inst);
+                                                else
+                                                    reg._controllers = { ...(reg._controllers || {}), attestationLog: inst };
+                                            }
+                                        }
+                                    }
+                                    catch { /* better-sqlite3 missing or schema init failed — skip silently */ }
+                                }
+                                // ADR-095 G7 follow-up: GuardedVectorBackend wraps the
+                                // existing vectorBackend with mutationGuard + attestationLog
+                                // for proof-gated state mutations (ADR-060). All three
+                                // dependencies are reachable here — vectorBackend is in
+                                // the baseline init, mutationGuard was just activated, and
+                                // attestationLog is constructed above. Skip if any piece
+                                // is missing rather than constructing with undefined.
+                                if (!reg.get('guardedVectorBackend')) {
+                                    try {
+                                        const gvbFile = path.join(adbDir, 'dist/src/backends/ruvector/GuardedVectorBackend.js');
+                                        if (fs.existsSync(gvbFile)) {
+                                            const inner = reg.get('vectorBackend');
+                                            const guard = reg.get('mutationGuard');
+                                            const log = attestationInst ?? reg.get('attestationLog');
+                                            if (inner && guard) {
+                                                const url = pathToFileURL(gvbFile).href;
+                                                const mod = await import(url);
+                                                const Ctor = mod.GuardedVectorBackend;
+                                                if (typeof Ctor === 'function') {
+                                                    const inst = new Ctor(inner, guard, log);
+                                                    if (typeof reg.set === 'function')
+                                                        reg.set('guardedVectorBackend', inst);
+                                                    else
+                                                        reg._controllers = { ...(reg._controllers || {}), guardedVectorBackend: inst };
+                                                }
+                                            }
+                                        }
+                                    }
+                                    catch { /* GuardedVectorBackend optional */ }
+                                }
                             }
                         }
                         catch { /* G7 wiring optional */ }
@@ -252,12 +316,7 @@ async function getRegistry(dbPath) {
                     // path doesn't tear down the rest of the post-init wiring.
                     await Promise.allSettled([intelligencePromise, agentdbPromise]);
                     // Remaining disabled controllers tracked in ADR-095 G7 for
-                    // per-controller activation ADRs (each needs config / key
-                    // material / db handle that we don't pass blindly):
-                    //   - mutationGuard (write protection — needs config schema)
-                    //   - attestationLog (needs sqlite db handle the registry
-                    //     does not currently expose to non-builtin controllers)
-                    //   - guardedVectorBackend (secured backend — needs key material)
+                    // per-controller activation ADRs:
                     //   - graphAdapter (graph DB adapter — needs graph DB connection)
                 }
                 catch {

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.6.22",
+  "version": "3.6.24",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",