claude-flow 3.62.0 → 3.63.1

package/v3/@claude-flow/cli/dist/src/services/managed-learning.js

@@ -0,0 +1,197 @@
+/** Verified, advisory workflow learning. Caller labels never establish trust. */
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { accept } from './harness-benchmark.js';
+export const TASK_TYPES = ['code-review', 'migration', 'research', 'test-generation', 'implementation', 'other'];
+const trusted = new WeakSet();
+const HASH = /^[a-f0-9]{64}$/;
+const ID = /^[a-z][a-z0-9-]{0,39}$/;
+const MODEL = /^[a-z][a-z0-9./-]{0,79}$/;
+const object = (v) => {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        throw new Error('Expected an object');
+    return v;
+};
+function exact(v, keys) {
+    if (Object.keys(v).length !== keys.length || Object.keys(v).some(k => !keys.includes(k)))
+        throw new Error('Unknown or missing learning fields');
+}
+const integer = (v, min, max) => typeof v === 'number' && Number.isSafeInteger(v) && v >= min && v <= max;
+const unit = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= 1;
+export function canonical(v) {
+    if (Array.isArray(v))
+        return '[' + v.map(canonical).join(',') + ']';
+    if (v && typeof v === 'object')
+        return '{' + Object.keys(v).sort().map(k => JSON.stringify(k) + ':' + canonical(v[k])).join(',') + '}';
+    return JSON.stringify(v);
+}
+export const digest = (v) => createHash('sha256').update(canonical(v)).digest('hex');
+/** Closed metadata contract: no prompts, arbitrary commands, transcripts or caller trust labels. */
+export function observationOf(value) {
+    const v = object(value);
+    exact(v, ['v', 'attemptId', 'taskHash', 'sourceHash', 'artifactHash', 'policyHash', 'corpusHash', 'evaluatorHash', 'taskType', 'split', 'trial', 'strategy', 'budgetCents', 'costCents', 'durationMs', 'checks']);
+    if (v.v !== 1 || !TASK_TYPES.includes(v.taskType) || !['train', 'holdout'].includes(v.split) || !integer(v.trial, 0, 99))
+        throw new Error('Invalid learning cohort');
+    for (const key of ['attemptId', 'taskHash', 'sourceHash', 'artifactHash', 'policyHash', 'corpusHash', 'evaluatorHash'])
+        if (typeof v[key] !== 'string' || !HASH.test(v[key]))
+            throw new Error('Invalid evidence hash');
+    const strategy = object(v.strategy);
+    exact(strategy, ['id', 'model', 'workers', 'template']);
+    if (!ID.test(String(strategy.id)) || !ID.test(String(strategy.template)) || !MODEL.test(String(strategy.model)) || !integer(strategy.workers, 1, 64))
+        throw new Error('Invalid workflow strategy');
+    if (!integer(v.budgetCents, 1, 999_999_999) || (v.costCents !== null && !integer(v.costCents, 0, 999_999_999)) || (v.durationMs !== null && !integer(v.durationMs, 0, 86_400_000)))
+        throw new Error('Invalid measured cost or duration');
+    const checks = object(v.checks);
+    exact(checks, ['acceptance', 'safety', 'replay', 'adversarial', 'drift', 'driftThreshold', 'rollbackRate']);
+    if (['acceptance', 'safety', 'replay', 'adversarial'].some(k => typeof checks[k] !== 'boolean') || !unit(checks.drift) || !unit(checks.driftThreshold) || !unit(checks.rollbackRate))
+        throw new Error('Invalid verification measurements');
+    // Detach caller objects, including nested strategy/checks, before hashing or persistence.
+    return JSON.parse(JSON.stringify(v));
+}
+export function evidenceOf(value) {
+    const v = object(value);
+    if (Object.keys(v).some(k => !['observation', 'signature'].includes(k)))
+        throw new Error('Unknown evidence fields');
+    const observation = observationOf(v.observation);
+    // Canonical form only: the last base64 character of a 64-byte signature has 4 unused bits that the decoder ignores, so
+    // other spellings of the same bytes would verify yet digest differently and be stored as separate records.
+    if (v.signature !== undefined && (typeof v.signature !== 'string' || !/^[A-Za-z0-9+/]{86}==$/.test(v.signature)
+        || Buffer.from(v.signature, 'base64').toString('base64') !== v.signature))
+        throw new Error('Invalid verifier signature');
+    return { observation, ...(v.signature ? { signature: v.signature } : {}) };
+}
+/** Public key is configured by the host, never accepted from an MCP argument or stored record. */
+export function isVerified(evidence, publicKey) {
+    if (!publicKey || !evidence.signature)
+        return false;
+    try {
+        const key = createPublicKey(publicKey);
+        return key.asymmetricKeyType === 'ed25519' && verify(null, Buffer.from(canonical(evidence.observation)), key, Buffer.from(evidence.signature, 'base64'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Revalidate every persisted record on each use; a JSON provenance label is not authority. */
+export function trustedEvidence(records, publicKey) {
+    const out = [];
+    const ids = new Map();
+    for (const raw of records) {
+        const e = evidenceOf(raw);
+        if (!isVerified(e, publicKey) || e.observation.costCents === null || e.observation.durationMs === null)
+            continue;
+        const hash = digest(e.observation);
+        const previous = ids.get(e.observation.attemptId);
+        if (previous && previous !== hash)
+            throw new Error('Conflicting learning attempt');
+        if (previous)
+            continue;
+        ids.set(e.observation.attemptId, hash);
+        {
+            Object.freeze(e.observation.strategy);
+            Object.freeze(e.observation.checks);
+            Object.freeze(e.observation);
+            Object.freeze(e);
+            trusted.add(e);
+            out.push(e);
+        }
+    }
+    return out;
+}
+export function manifestOf(value) {
+    const m = object(value);
+    exact(m, ['taskHashes', 'trials']);
+    if (!Array.isArray(m.taskHashes) || m.taskHashes.length < 2 || m.taskHashes.length > 100 || m.taskHashes.some(h => typeof h !== 'string' || !HASH.test(h)) || new Set(m.taskHashes).size !== m.taskHashes.length)
+        throw new Error('Manifest needs 2 to 100 unique task hashes');
+    if (!Array.isArray(m.trials) || m.trials.length < 3 || m.trials.length > 10 || m.trials.some(t => !integer(t, 0, 99)) || new Set(m.trials).size !== m.trials.length)
+        throw new Error('Manifest needs 3 to 10 unique trials');
+    return { taskHashes: [...m.taskHashes].sort(), trials: [...m.trials].sort((a, b) => a - b) };
+}
+export function scopeOf(value) {
+    const s = object(value);
+    exact(s, ['taskType', 'policyHash', 'evaluatorHash']);
+    if (!TASK_TYPES.includes(s.taskType) || !HASH.test(String(s.policyHash)) || !HASH.test(String(s.evaluatorHash)))
+        throw new Error('Invalid recommendation scope');
+    return { taskType: s.taskType, policyHash: s.policyHash, evaluatorHash: s.evaluatorHash };
+}
+const inScope = (o, s) => o.taskType === s.taskType && o.policyHash === s.policyHash && o.evaluatorHash === s.evaluatorHash;
+const success = (o) => o.checks.acceptance && o.checks.safety ? 1 : 0;
+const p95 = (values) => [...values].sort((a, b) => a - b)[Math.max(0, Math.ceil(values.length * .95) - 1)] ?? 0;
+/** Training evidence only; holdout records and unsigned observations cannot influence a pick. */
+export function recommend(records, scope, maxP95Ms = 86_400_000) {
+    if (records.some(e => !trusted.has(e)))
+        throw new Error('Host-verified evidence required');
+    if (!integer(maxP95Ms, 1, 86_400_000))
+        throw new Error('Invalid latency constraint');
+    const groups = new Map();
+    for (const e of records) {
+        if (e.observation.split !== 'train' || !inScope(e.observation, scope))
+            continue;
+        const key = canonical(e.observation.strategy);
+        groups.set(key, [...(groups.get(key) ?? []), e]);
+    }
+    const candidates = [...groups.values()].flatMap(rows => {
+        if (rows.length < 3 || new Set(rows.map(r => r.observation.taskHash)).size < 3)
+            return [];
+        const totalCost = rows.reduce((n, r) => n + (r.observation.costCents ?? 0), 0);
+        const latency = p95(rows.map(r => r.observation.durationMs));
+        if (totalCost <= 0 || latency > maxP95Ms || rows.some(r => !r.observation.checks.safety))
+            return [];
+        const successes = rows.reduce((n, r) => n + success(r.observation), 0);
+        if (successes === 0)
+            return [];
+        return [{ strategy: rows[0].observation.strategy, samples: rows.length, successes, successRate: successes / rows.length, successesPerDollar: successes * 100 / totalCost, p95Ms: latency, evidenceIds: rows.map(r => digest(r.observation)).sort() }];
+    }).sort((a, b) => b.successesPerDollar - a.successesPerDollar || a.p95Ms - b.p95Ms || canonical(a.strategy).localeCompare(canonical(b.strategy)));
+    return { advisory: true, selected: candidates[0] ?? null, candidates, abstained: candidates.length === 0, reason: candidates.length ? 'Ranked by measured training successes per dollar within exact policy/evaluator scope' : 'Insufficient trusted training evidence within scope and latency constraint', defaultsChanged: false };
+}
+/** Complete paired heldout data, equal admitted budgets, source identity and existing MetaHarness conjunction. */
+export function evaluate(records, scope, manifest, baselineId, candidateId) {
+    if (records.some(e => !trusted.has(e)))
+        throw new Error('Host-verified evidence required');
+    if (!ID.test(baselineId) || !ID.test(candidateId) || baselineId === candidateId)
+        throw new Error('Distinct strategy IDs required');
+    const corpusHash = digest(manifest);
+    const relevant = records.filter(e => inScope(e.observation, scope) && [baselineId, candidateId].includes(e.observation.strategy.id));
+    const trainingTasks = new Set(records.filter(e => inScope(e.observation, scope) && e.observation.split === 'train').map(e => e.observation.taskHash));
+    if (manifest.taskHashes.some(h => trainingTasks.has(h)))
+        throw new Error('Training and heldout tasks overlap');
+    const rows = relevant.filter(e => e.observation.split === 'holdout' && e.observation.corpusHash === corpusHash);
+    for (const id of [baselineId, candidateId])
+        if (new Set(rows.filter(r => r.observation.strategy.id === id).map(r => canonical(r.observation.strategy))).size !== 1)
+            throw new Error('Missing or inconsistent strategy configuration');
+    const paired = [];
+    for (const taskHash of manifest.taskHashes)
+        for (const trial of manifest.trials) {
+            const pick = (id) => rows.filter(e => e.observation.taskHash === taskHash && e.observation.trial === trial && e.observation.strategy.id === id);
+            const base = pick(baselineId), candidate = pick(candidateId);
+            if (base.length !== 1 || candidate.length !== 1)
+                throw new Error('Missing or duplicate paired heldout result');
+            const b = base[0].observation, c = candidate[0].observation;
+            if (b.sourceHash !== c.sourceHash || b.budgetCents !== c.budgetCents)
+                throw new Error('Source identity or admitted budgets differ');
+            paired.push([b, c]);
+        }
+    const base = paired.map(p => p[0]), candidate = paired.map(p => p[1]);
+    const efficiency = (rows) => {
+        const cost = rows.reduce((n, r) => n + r.costCents, 0);
+        if (cost <= 0)
+            throw new Error('Positive measured cost required');
+        return rows.reduce((n, r) => n + success(r), 0) * 100 / cost;
+    };
+    const baselineEfficiency = efficiency(base), candidateEfficiency = efficiency(candidate);
+    if (baselineEfficiency <= 0)
+        throw new Error('Nonzero baseline success required for relative improvement');
+    const delta = candidateEfficiency / baselineEfficiency - 1;
+    const total = baselineEfficiency + candidateEfficiency;
+    const all = [...base, ...candidate];
+    const gate = accept({
+        heldOutScore: candidateEfficiency / total, baselineHeldOutScore: baselineEfficiency / total,
+        redblue: all.every(o => o.checks.adversarial) ? 'PASS' : 'FAIL',
+        drift: Math.max(...candidate.map(o => o.checks.drift)), driftThreshold: Math.min(...candidate.map(o => o.checks.driftThreshold)),
+        replayDeterministic: all.every(o => o.checks.replay), receiptCoverage: 1,
+        canaryRollbackRate: Math.max(...candidate.map(o => o.checks.rollbackRate)), baselineRollbackRate: Math.max(...base.map(o => o.checks.rollbackRate)),
+    });
+    const noRegression = paired.every(([b, c]) => success(c) >= success(b)) && all.every(o => o.checks.safety);
+    const baselineP95Ms = p95(base.map(o => o.durationMs)), candidateP95Ms = p95(candidate.map(o => o.durationMs));
+    return { advisory: true, eligible: gate.accept && delta >= .10 - Number.EPSILON && noRegression && candidateP95Ms <= baselineP95Ms, baselineP95Ms, candidateP95Ms, delta, baselineEfficiency, candidateEfficiency, pairedResults: paired.length, corpusHash, noRegression, metaharness: gate, defaultsChanged: false, evidenceIds: rows.map(r => digest(r.observation)).sort() };
+}
+//# sourceMappingURL=managed-learning.js.map

package/v3/@claude-flow/cli/dist/src/services/managed-memory-client.d.ts

@@ -0,0 +1,72 @@
+/** Native memory runs behind a bounded child boundary, never in the MCP process. */
+import { type ChildProcess } from 'node:child_process';
+export declare const MANAGED_MEMORY_NAMESPACE = "managed-workflow-evidence";
+export declare const MANAGED_MEMORY_LIMITS: {
+    readonly workers: 1;
+    readonly requestBytes: 80000;
+    readonly resultBytes: 200000;
+    readonly rows: 20;
+    readonly rowBytes: 8192;
+    readonly timeoutMs: 15000;
+    readonly idleMs: 5000;
+};
+export type MemoryRequest = {
+    operation: 'index';
+    id: string;
+    value: string;
+    taskType: string;
+} | {
+    operation: 'recall';
+    taskType: string;
+    allowedIds: string[];
+};
+export type MemoryRow = {
+    key: string;
+    namespace: typeof MANAGED_MEMORY_NAMESPACE;
+    score: number;
+    content: string;
+};
+export type MemoryResult = {
+    operation: 'index';
+    durable: true;
+    hasEmbedding: boolean;
+} | {
+    operation: 'recall';
+    available: boolean;
+    rows: MemoryRow[];
+};
+/** The optional fork callback is an in-process host test seam, not a serialized tool argument. */
+export declare class ManagedMemoryClient {
+    private readonly slots;
+    private readonly timeoutMs;
+    private readonly idleMs;
+    private readonly forkWorker;
+    constructor(options?: {
+        timeoutMs?: number;
+        idleMs?: number;
+        forkWorker?: (root: string) => ChildProcess;
+    });
+    run(root: string, raw: unknown, authorize?: () => boolean): Promise<MemoryResult>;
+    stats(): {
+        workers: number;
+        busy: number;
+    };
+    close(): void;
+    private remove;
+}
+export declare const managedMemoryClient: ManagedMemoryClient;
+export declare function nativeMemoryIndex(root: string, input: Omit<Extract<MemoryRequest, {
+    operation: 'index';
+}>, 'operation'>, authorize?: () => boolean): Promise<{
+    operation: "index";
+    durable: true;
+    hasEmbedding: boolean;
+}>;
+export declare function nativeMemoryRecall(root: string, input: Omit<Extract<MemoryRequest, {
+    operation: 'recall';
+}>, 'operation'>, authorize?: () => boolean): Promise<{
+    operation: "recall";
+    available: boolean;
+    rows: MemoryRow[];
+}>;
+//# sourceMappingURL=managed-memory-client.d.ts.map

package/v3/@claude-flow/cli/dist/src/services/managed-memory-client.js

@@ -0,0 +1,236 @@
+/** Native memory runs behind a bounded child boundary, never in the MCP process. */
+import { fork } from 'node:child_process';
+import { existsSync, realpathSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+export const MANAGED_MEMORY_NAMESPACE = 'managed-workflow-evidence';
+export const MANAGED_MEMORY_LIMITS = { workers: 1, requestBytes: 80_000, resultBytes: 200_000, rows: 20, rowBytes: 8192, timeoutMs: 15_000, idleMs: 5000 };
+const HASH = /^[a-f0-9]{64}$/;
+const TYPES = ['code-review', 'migration', 'research', 'test-generation', 'implementation', 'other'];
+function requestOf(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid managed memory request');
+    const r = value;
+    const keys = r.operation === 'index' ? ['operation', 'id', 'value', 'taskType'] : ['operation', 'taskType', 'allowedIds'];
+    if (!['index', 'recall'].includes(String(r.operation)) || Object.keys(r).length !== keys.length || Object.keys(r).some(k => !keys.includes(k)) || !TYPES.includes(String(r.taskType)))
+        throw new Error('Invalid managed memory request');
+    if (r.operation === 'index' && (typeof r.id !== 'string' || !HASH.test(r.id) || typeof r.value !== 'string' || Buffer.byteLength(r.value) > MANAGED_MEMORY_LIMITS.rowBytes))
+        throw new Error('Invalid managed index request');
+    if (r.operation === 'recall' && (!Array.isArray(r.allowedIds) || r.allowedIds.length > 500 || r.allowedIds.some(id => typeof id !== 'string' || !HASH.test(id))))
+        throw new Error('Invalid managed recall request');
+    if (Buffer.byteLength(JSON.stringify(r)) > MANAGED_MEMORY_LIMITS.requestBytes)
+        throw new Error('Managed memory request limit exceeded');
+    return JSON.parse(JSON.stringify(r));
+}
+function resultOf(value, operation, requestId) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Buffer.byteLength(JSON.stringify(value)) > MANAGED_MEMORY_LIMITS.resultBytes)
+        throw new Error('Invalid managed memory worker response');
+    const r = value;
+    if (r.v !== 1 || r.ok !== true || r.operation !== operation || r.requestId !== requestId)
+        throw new Error('Managed native memory worker did not complete');
+    if (operation === 'index') {
+        if (Object.keys(r).some(k => !['v', 'ok', 'requestId', 'operation', 'durable', 'hasEmbedding'].includes(k)) || r.durable !== true || typeof r.hasEmbedding !== 'boolean')
+            throw new Error('Unconfirmed managed memory persistence');
+        return { operation, durable: true, hasEmbedding: r.hasEmbedding };
+    }
+    if (Object.keys(r).some(k => !['v', 'ok', 'requestId', 'operation', 'available', 'rows'].includes(k)) || typeof r.available !== 'boolean' || !Array.isArray(r.rows) || r.rows.length > MANAGED_MEMORY_LIMITS.rows)
+        throw new Error('Invalid managed recall response');
+    for (const raw of r.rows) {
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+            throw new Error('Invalid managed recall row');
+        const row = raw;
+        if (Object.keys(row).length !== 4 || Object.keys(row).some(k => !['key', 'namespace', 'score', 'content'].includes(k)) || typeof row.key !== 'string' || !HASH.test(row.key) || row.namespace !== MANAGED_MEMORY_NAMESPACE || typeof row.score !== 'number' || !Number.isFinite(row.score) || row.score < -1 || row.score > 1 || typeof row.content !== 'string' || Buffer.byteLength(row.content) > MANAGED_MEMORY_LIMITS.rowBytes)
+            throw new Error('Invalid managed recall row');
+    }
+    return { operation, available: r.available, rows: r.rows };
+}
+function sourceLoader() {
+    try {
+        return createRequire(import.meta.url).resolve('tsx');
+    }
+    catch { /* npx tsx can live outside project node_modules */ }
+    for (let i = 0; i < process.execArgv.length; i++) {
+        const arg = process.execArgv[i];
+        const path = arg === '--import' ? process.execArgv[i + 1] : arg.startsWith('--import=') ? arg.slice(9) : undefined;
+        if (!path)
+            continue;
+        const file = path.startsWith('file:') ? fileURLToPath(path) : path;
+        if (/[/\\]node_modules[/\\]tsx[/\\]dist[/\\](?:loader\.mjs|esm[/\\]index\.mjs)$/.test(file) && existsSync(file))
+            return file;
+    }
+    throw new Error('Source managed memory worker requires tsx');
+}
+function launch(root) {
+    const js = new URL('./managed-memory-worker.js', import.meta.url), ts = new URL('./managed-memory-worker.ts', import.meta.url);
+    const compiled = existsSync(fileURLToPath(js));
+    const entry = compiled ? js : ts;
+    if (!existsSync(fileURLToPath(entry)))
+        throw new Error('Managed memory worker is not installed');
+    // Production uses emitted JS. Source development uses the project's declared
+    // tsx dependency so internal .js imports resolve to TypeScript sources.
+    const args = compiled ? [] : ['--import', sourceLoader()];
+    const env = {};
+    for (const key of ['PATH', 'HOME', 'USERPROFILE', 'SystemRoot', 'SYSTEMROOT', 'WINDIR', 'TMPDIR', 'TMP', 'TEMP', 'LANG', 'LC_ALL', 'CLAUDE_FLOW_DISABLE_BRIDGE', 'CLAUDE_FLOW_ENABLE_NATIVE_BRIDGE_ON_WINDOWS'])
+        if (process.env[key] !== undefined)
+            env[key] = process.env[key];
+    // No provider credentials or startup hooks are inherited. Existing local
+    // models may be used; indexing never initiates a model download.
+    env.CLAUDE_FLOW_CWD = root;
+    env.HF_HUB_OFFLINE = '1';
+    env.TRANSFORMERS_OFFLINE = '1';
+    return fork(entry, [], { cwd: root, env, execArgv: args, stdio: ['ignore', 'ignore', 'ignore', 'ipc'], serialization: 'json' });
+}
+/** The optional fork callback is an in-process host test seam, not a serialized tool argument. */
+export class ManagedMemoryClient {
+    slots = new Map();
+    timeoutMs;
+    idleMs;
+    forkWorker;
+    constructor(options = {}) {
+        this.timeoutMs = options.timeoutMs ?? MANAGED_MEMORY_LIMITS.timeoutMs;
+        this.idleMs = options.idleMs ?? MANAGED_MEMORY_LIMITS.idleMs;
+        this.forkWorker = options.forkWorker ?? launch;
+        if (!Number.isFinite(this.timeoutMs) || this.timeoutMs < 20 || this.timeoutMs > 60_000 || !Number.isFinite(this.idleMs) || this.idleMs < 20 || this.idleMs > 30_000)
+            throw new Error('Invalid managed memory worker limits');
+    }
+    run(root, raw, authorize = () => true) {
+        let input, cwd;
+        try {
+            input = requestOf(raw);
+            cwd = realpathSync(root);
+            if (!statSync(cwd).isDirectory())
+                throw new Error('Invalid learning project root');
+        }
+        catch {
+            return Promise.reject(new Error('Invalid managed memory operation or project root'));
+        }
+        try {
+            if (!authorize())
+                return Promise.reject(new Error('Managed memory policy denied'));
+        }
+        catch {
+            return Promise.reject(new Error('Managed memory policy denied'));
+        }
+        let slot = this.slots.get(cwd);
+        if (slot?.busy)
+            return Promise.reject(new Error('Managed memory worker is busy; retry later'));
+        if (!slot) {
+            if (this.slots.size >= MANAGED_MEMORY_LIMITS.workers) {
+                const idle = [...this.slots.values()].filter(s => !s.busy).sort((a, b) => a.lastUsed - b.lastUsed)[0];
+                if (!idle)
+                    return Promise.reject(new Error('Managed memory worker limit reached; retry later'));
+                this.remove(idle);
+            }
+            try {
+                slot = { child: this.forkWorker(cwd), root: cwd, busy: false, lastUsed: Date.now() };
+                this.slots.set(cwd, slot);
+                const owned = slot;
+                slot.child.once('error', () => { owned.fail?.(); this.remove(owned); });
+                slot.child.once('exit', () => { owned.fail?.(); this.remove(owned); });
+            }
+            catch {
+                return Promise.reject(new Error('Managed native memory worker unavailable'));
+            }
+        }
+        const owned = slot;
+        const requestId = randomUUID();
+        if (owned.timer)
+            clearTimeout(owned.timer);
+        owned.busy = true;
+        return new Promise((resolve, reject) => {
+            let settled = false, policyDenied = false, ready = false, writeGranted = false;
+            const complete = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeout);
+                owned.child.off('message', onMessage);
+                owned.fail = undefined;
+                owned.busy = false;
+                owned.lastUsed = Date.now();
+                if (result) {
+                    owned.timer = setTimeout(() => this.remove(owned), this.idleMs);
+                    owned.timer.unref();
+                    owned.child.unref();
+                    owned.child.channel?.unref();
+                    resolve(result);
+                }
+                else {
+                    this.remove(owned);
+                    reject(new Error(policyDenied ? (writeGranted ? 'Managed memory policy changed; admitted write may have completed' : 'Managed memory policy denied before dispatch') : 'Managed native memory operation failed or timed out; parent remains available'));
+                }
+            };
+            const onMessage = (value) => {
+                try {
+                    if (!authorize()) {
+                        policyDenied = true;
+                        complete();
+                        return;
+                    }
+                    const message = value;
+                    if (message?.phase !== undefined) {
+                        if (Object.keys(message).length !== 3 || message.v !== 1 || message.requestId !== requestId || !['ready', 'before-write'].includes(String(message.phase)))
+                            throw new Error('Invalid worker grant request');
+                        if (message.phase === 'ready') {
+                            if (ready)
+                                throw new Error('Repeated worker ready');
+                            ready = true;
+                        }
+                        else {
+                            if (!ready || writeGranted || input.operation !== 'index')
+                                throw new Error('Invalid worker write grant');
+                            writeGranted = true;
+                        }
+                        owned.child.send({ v: 1, requestId, grant: message.phase === 'ready' ? 'execute' : 'write' }, error => { if (error)
+                            complete(); });
+                        return;
+                    }
+                    if (!ready)
+                        throw new Error('Worker was not ready');
+                    complete(resultOf(value, input.operation, requestId));
+                }
+                catch {
+                    complete();
+                }
+            };
+            const timeout = setTimeout(() => complete(), this.timeoutMs);
+            owned.fail = () => complete();
+            owned.child.on('message', onMessage);
+            try {
+                if (!authorize()) {
+                    policyDenied = true;
+                    complete();
+                    return;
+                }
+                owned.child.send({ v: 1, requestId, ...input }, error => { if (error)
+                    complete(); });
+            }
+            catch {
+                policyDenied = true;
+                complete();
+            }
+        });
+    }
+    stats() { return { workers: this.slots.size, busy: [...this.slots.values()].filter(s => s.busy).length }; }
+    close() { for (const slot of [...this.slots.values()]) {
+        slot.fail?.();
+        this.remove(slot);
+    } }
+    remove(slot) {
+        if (slot.timer)
+            clearTimeout(slot.timer);
+        if (this.slots.get(slot.root) === slot)
+            this.slots.delete(slot.root);
+        if (!slot.child.killed)
+            slot.child.kill('SIGKILL');
+    }
+}
+export const managedMemoryClient = new ManagedMemoryClient();
+export async function nativeMemoryIndex(root, input, authorize) {
+    return await managedMemoryClient.run(root, { operation: 'index', ...input }, authorize);
+}
+export async function nativeMemoryRecall(root, input, authorize) {
+    return await managedMemoryClient.run(root, { operation: 'recall', ...input }, authorize);
+}
+//# sourceMappingURL=managed-memory-client.js.map

package/v3/@claude-flow/cli/dist/src/services/managed-memory-worker.d.ts

@@ -0,0 +1,56 @@
+type Row = {
+    key: string;
+    namespace: string;
+    content: string;
+    hasEmbedding?: boolean;
+};
+export type NativeMemoryAdapter = {
+    getEntry: (options: Record<string, unknown>) => Promise<{
+        success: boolean;
+        found: boolean;
+        entry?: Row;
+    } | null>;
+    storeEntry: (options: Record<string, unknown>) => Promise<{
+        success: boolean;
+        persistWarning?: unknown;
+        embedding?: {
+            dimensions?: number;
+        };
+        error?: unknown;
+    } | null>;
+    searchEntries: (options: Record<string, unknown>) => Promise<{
+        success: boolean;
+        results: Array<{
+            key: string;
+            namespace: string;
+            score: number;
+        }>;
+    } | null>;
+};
+/** Pure operation seam for host tests. Serialized callers cannot supply an adapter. */
+export declare function executeManagedMemory(raw: unknown, adapter: NativeMemoryAdapter, dbPath: string, beforeWrite?: () => Promise<void>): Promise<{
+    v: number;
+    requestId: string;
+    ok: boolean;
+    operation: string;
+    durable: boolean;
+    hasEmbedding: boolean;
+    available?: undefined;
+    rows?: undefined;
+} | {
+    v: number;
+    requestId: string;
+    ok: boolean;
+    operation: string;
+    available: boolean;
+    rows: {
+        key: string;
+        namespace: string;
+        score: number;
+        content: string;
+    }[];
+    durable?: undefined;
+    hasEmbedding?: undefined;
+}>;
+export {};
+//# sourceMappingURL=managed-memory-worker.d.ts.map