claude-flow 3.63.3 → 3.63.5

package/v3/@claude-flow/cli/dist/src/mods/claude-installs.js

@@ -7,8 +7,8 @@
  * (a 2.1.107 npm-global beside a current native one, say) silently decides.
  */
 import { execFileSync } from 'node:child_process';
-import { existsSync, realpathSync, statSync } from 'node:fs';
-import { delimiter, join } from 'node:path';
+import { closeSync, existsSync, fstatSync, openSync, readSync, realpathSync, statSync } from 'node:fs';
+import { delimiter, dirname, join, resolve } from 'node:path';
 export const MODS_DEFAULT_ON = '2.1.287';
 export const MODS_FIRST = '2.1.277';
 const parse = (v) => v.split('.').map((n) => Number(n));
@@ -52,6 +52,98 @@ export const defaultVersionOf = (path) => {
         return null;
     }
 };
+/** Known npm/cmd-shim Node launcher forms (legacy basedir and basedir_win).
+ * Match the whole template, not comments or arbitrary shell code. Unknown npm
+ * versions/formats simply keep the independent probe result. Never execute it.
+ */
+const npmCmdShim = (entry, modern) => [
+    '@ECHO off', 'GOTO start', ':find_dp0', 'SET dp0=%~dp0', 'EXIT /b', ':start',
+    'SETLOCAL', 'CALL :find_dp0', '', 'IF EXIST "%dp0%\\node.exe" (',
+    '  SET "_prog=%dp0%\\node.exe"', ') ELSE (', '  SET "_prog=node"',
+    ...(!modern ? ['  SET PATHEXT=%PATHEXT:;.JS;=;%'] : []), ')', '',
+    'endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & '
+        + (modern ? 'set PATHEXT=%PATHEXT:;.JS;=;% & ' : '')
+        + `"%_prog%"  "%dp0%\\${entry.replaceAll('/', '\\')}" %*`, '',
+].join('\r\n');
+const npmPosixShim = (entry, modern) => [
+    '#!/bin/sh', 'basedir=$(dirname "$(echo "$0" | sed -e \'s,\\\\,/,g\')")',
+    ...(modern ? ['basedir_win="$basedir"'] : []), '',
+    modern ? 'case `uname -a` in' : 'case `uname` in',
+    ...(modern ? [
+        '  *CYGWIN*|*MINGW*|*MSYS*)', '    if command -v cygpath > /dev/null 2>&1; then',
+        '      basedir_win=`cygpath -w "$basedir"`', '    fi', '  ;;', '  *WSL2*)',
+        '    if command -v wslpath > /dev/null 2>&1; then',
+        '      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"',
+        '      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then',
+        '        echo "Error: wslpath failed to convert path. WSL environment may be misconfigured." >&2',
+        '        exit 1', '      fi', '    fi', '  ;;',
+    ] : [
+        '    *CYGWIN*|*MINGW*|*MSYS*)', '        if command -v cygpath > /dev/null 2>&1; then',
+        '            basedir=`cygpath -w "$basedir"`', '        fi', '    ;;',
+    ]), 'esac', '',
+    ...(modern ? [
+        'PROG_EXE="$basedir/node.exe"', 'if ! [ -x "$PROG_EXE" ]; then',
+        '  PROG_EXE="$basedir/node"', '  if ! [ -x "$PROG_EXE" ]; then',
+        '    PROG_EXE=node', '    if ! [ -x "$PROG_EXE" ]; then', '      PROG_EXE=node.exe',
+        '    fi', '  fi', 'fi', '', `exec "$PROG_EXE"  "$basedir_win/${entry}" "$@"`,
+    ] : [
+        'if [ -x "$basedir/node" ]; then', `  exec "$basedir/node"  "$basedir/${entry}" "$@"`,
+        'else ', `  exec node  "$basedir/${entry}" "$@"`, 'fi',
+    ]), '',
+].join('\n');
+// A no-shebang/native bin uses npm's direct-exec forms, not a Node wrapper.
+const npmDirectCmdShim = (entry) => [
+    '@ECHO off', 'GOTO start', ':find_dp0', 'SET dp0=%~dp0', 'EXIT /b', ':start',
+    'SETLOCAL', 'CALL :find_dp0', `"%dp0%\\${entry.replaceAll('/', '\\')}"   %*`, '',
+].join('\r\n');
+const npmDirectPosixShim = (entry, modern) => {
+    const nodeShim = npmPosixShim(entry, modern);
+    const preamble = nodeShim.slice(0, nodeShim.indexOf(modern ? 'PROG_EXE=' : 'if [ -x'));
+    return preamble + `exec "$basedir/${entry}"   "$@"\n`;
+};
+function npmShimTarget(path, cmd) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > 64 * 1024)
+            return null;
+        // Also cap the actual read if a file grows after stat.
+        const bytes = Buffer.alloc(64 * 1024 + 1);
+        let size = 0;
+        while (size < bytes.length) {
+            const n = readSync(fd, bytes, size, bytes.length - size, null);
+            if (!n)
+                break;
+            size += n;
+        }
+        if (size > 64 * 1024)
+            return null;
+        const text = bytes.subarray(0, size).toString('utf8').replace(/\r\n/g, '\n').trimEnd();
+        const targets = cmd
+            ? [...text.matchAll(/"%dp0%\\([^"\r\n]+)" +%\*$/gm)].map(m => m[1].replaceAll('\\', '/'))
+            : [...text.matchAll(/^\s*exec (?:[^\r\n]* )?"\$basedir(?:_win)?\/([^"\r\n]+)" +"\$@"$/gm)].map(m => m[1]);
+        const entry = targets[0];
+        if (!entry || targets.some(t => t !== entry) || !/^[a-zA-Z0-9@._ /-]+$/.test(entry) || entry.startsWith('/'))
+            return null;
+        const template = cmd ? npmCmdShim : npmPosixShim;
+        const normalize = (value) => value.replace(/\r\n/g, '\n').trimEnd();
+        const node = [false, true].some(modern => normalize(template(entry, modern)) === text);
+        const direct = cmd ? normalize(npmDirectCmdShim(entry)) === text
+            : [false, true].some(modern => normalize(npmDirectPosixShim(entry, modern)) === text);
+        if (!node && !direct)
+            return null;
+        const target = realpathSync(resolve(dirname(path), entry));
+        return statSync(target).isFile() ? { path: target, mode: node ? 'node' : 'direct' } : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
 /** Every `claude` on PATH, in PATH order (the first is what runs), plus ~/.local/bin. */
 export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
     const names = process.platform === 'win32' ? ['claude.exe', 'claude.cmd', 'claude'] : ['claude'];
@@ -59,6 +151,7 @@ export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
     const seen = new Set();
     const installs = [];
     for (const dir of dirs) {
+        let cmd;
         for (const name of names) {
             const path = join(dir, name);
             let real;
@@ -73,7 +166,19 @@ export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
             if (seen.has(real))
                 continue;
             seen.add(real);
-            installs.push({ path, version: versionOf(path) });
+            let version = versionOf(path);
+            if (process.platform === 'win32' && name === 'claude' && version === null && cmd?.version) {
+                const target = npmShimTarget(path, false);
+                const cmdTarget = npmShimTarget(cmd.path, true);
+                if (target && cmdTarget && target.path === cmdTarget.path && target.mode === cmdTarget.mode)
+                    version = cmd.version;
+            }
+            const install = { path, version };
+            installs.push(install);
+            // Only a .cmd actually probed in this directory can supply a version.
+            // A realpath-deduplicated alias in another directory proves nothing here.
+            if (name === 'claude.cmd')
+                cmd = install;
         }
     }
     return installs;

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.d.ts

@@ -428,7 +428,9 @@ export declare class WorkerDaemon extends EventEmitter {
     /**
      * Manually trigger a worker
      */
-    triggerWorker(type: WorkerType): Promise<WorkerResult>;
+    triggerWorker(type: WorkerType, opts?: {
+        manualTrigger?: boolean;
+    }): Promise<WorkerResult>;
     /**
      * Enable/disable a worker
      */

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js

@@ -952,7 +952,7 @@ export class WorkerDaemon extends EventEmitter {
             }
             try {
                 this.log('info', `Dequeued ${trigger}${workerId ? ` (id=${workerId})` : ''} from MCP dispatch queue`);
-                await this.triggerWorker(trigger);
+                await this.triggerWorker(trigger, { manualTrigger: false });
             }
             catch (err) {
                 this.log('warn', `Queued worker ${trigger} failed: ${err.message}`);
@@ -1926,7 +1926,7 @@ export class WorkerDaemon extends EventEmitter {
     /**
      * Manually trigger a worker
      */
-    async triggerWorker(type) {
+    async triggerWorker(type, opts = {}) {
         const workerConfig = this.config.workers.find(w => w.type === type);
         if (!workerConfig) {
             throw new Error(`Unknown worker type: ${type}`);
@@ -1941,7 +1941,9 @@ export class WorkerDaemon extends EventEmitter {
         // #2661 root-fix — an explicit manual trigger bypasses the repository-
         // supervisor gate (still budget/dedup-gated) — see runWorkerLogic()'s
         // doc comment.
-        return this.executeWorker(workerConfig, { manualTrigger: true });
+        // Only an operator's own `daemon trigger` is manual. A file in daemon-queue/ can come from a
+        // cloned repo, so queue runs pass `manualTrigger: false` and stay behind the supervisor gate.
+        return this.executeWorker(workerConfig, { manualTrigger: opts.manualTrigger ?? true });
     }
     /**
      * Enable/disable a worker

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.63.3",
+  "version": "3.63.5",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -102,11 +102,11 @@
     "@electron/asar": "^4.3.1",
     "@claude-flow/cli-core": "3.7.5",
     "@claude-flow/codex": "3.0.5",
-    "@claude-flow/mcp": "3.1.3",
-    "@claude-flow/neural": "3.0.0",
-    "@claude-flow/plugin-agent-federation": "1.0.2",
+    "@claude-flow/mcp": "3.1.4",
+    "@claude-flow/neural": "3.0.1",
+    "@claude-flow/plugin-agent-federation": "1.0.3",
     "@claude-flow/security": "3.0.5",
-    "@claude-flow/shared": "3.0.5",
+    "@claude-flow/shared": "3.0.6",
     "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",

package/v3/@claude-flow/shared/dist/mcp/transport/guard.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Checks for transports that carry no bearer token. A browser always sends an
+ * `Origin` header and cannot be stopped by CORS on a WebSocket upgrade, and a
+ * rebinding page reaches 127.0.0.1 under its own hostname, so an open loopback
+ * server must look at both. Non-browser clients send no `Origin`.
+ */
+import type { IncomingMessage } from 'node:http';
+export declare function isLoopbackName(host: string): boolean;
+/** Whether the `Host` header names this server (a loopback name or the bound host). */
+export declare function hostHeaderAllowed(header: string | undefined, boundHost: string): boolean;
+/** Whether a request's `Origin` may talk to an unauthenticated server: none at all, or one listed by name (`*` does not count). */
+export declare function originAllowed(origin: string | undefined, allowed: readonly string[] | undefined): boolean;
+/** Why an unauthenticated request must be refused, or `undefined` when it may proceed. */
+export declare function refuseOpenRequest(req: Pick<IncomingMessage, 'headers'>, boundHost: string, allowedOrigins: readonly string[] | undefined): string | undefined;
+/** Refuse to listen beyond loopback with no token unless the operator said so. */
+export declare function assertSafeBind(host: string, authenticated: boolean, allowUnauthenticated: boolean | undefined): void;
+//# sourceMappingURL=guard.d.ts.map

package/v3/@claude-flow/shared/dist/mcp/transport/guard.js

@@ -0,0 +1,43 @@
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '::1', '0:0:0:0:0:0:0:1']);
+export function isLoopbackName(host) {
+    return LOOPBACK.has(host.trim().toLowerCase().replace(/^\[|\]$/g, ''));
+}
+/** The hostname of a `Host` header value: no port, no IPv6 brackets, lower case. */
+function hostnameOf(header) {
+    const value = header.trim().toLowerCase();
+    const bracket = value.match(/^\[([^\]]*)\](?::\d*)?$/);
+    if (bracket)
+        return bracket[1];
+    return value.replace(/:\d*$/, '');
+}
+/** Whether the `Host` header names this server (a loopback name or the bound host). */
+export function hostHeaderAllowed(header, boundHost) {
+    if (!header)
+        return false;
+    const name = hostnameOf(header);
+    return isLoopbackName(name) || name === boundHost.trim().toLowerCase().replace(/^\[|\]$/g, '');
+}
+/** Whether a request's `Origin` may talk to an unauthenticated server: none at all, or one listed by name (`*` does not count). */
+export function originAllowed(origin, allowed) {
+    if (origin === undefined || origin === '')
+        return true;
+    return (allowed ?? []).some((entry) => entry !== '*' && entry === origin);
+}
+/** Why an unauthenticated request must be refused, or `undefined` when it may proceed. */
+export function refuseOpenRequest(req, boundHost, allowedOrigins) {
+    // Rebinding only reaches a loopback bind; behind a proxy on another address the Host is the proxy's.
+    if (isLoopbackName(boundHost) && !hostHeaderAllowed(req.headers.host, boundHost))
+        return 'Host header does not name this server';
+    const origin = req.headers.origin;
+    if (!originAllowed(Array.isArray(origin) ? origin[0] : origin, allowedOrigins))
+        return 'cross-origin requests are refused without a token';
+    return undefined;
+}
+/** Refuse to listen beyond loopback with no token unless the operator said so. */
+export function assertSafeBind(host, authenticated, allowUnauthenticated) {
+    if (!isLoopbackName(host) && !authenticated && allowUnauthenticated !== true) {
+        throw new Error(`Refusing to listen on non-loopback host "${host}" without authentication: every registered tool would be reachable from the network. ` +
+            'Configure a token, bind to a loopback host, or set allowUnauthenticated to accept the risk.');
+    }
+}
+//# sourceMappingURL=guard.js.map

package/v3/@claude-flow/shared/dist/mcp/transport/http.d.ts

@@ -25,6 +25,8 @@ export interface HttpTransportConfig {
     corsEnabled?: boolean;
     corsOrigins?: string[];
     auth?: AuthConfig;
+    /** Accept a non-loopback bind with no token (the operator's own risk). */
+    allowUnauthenticated?: boolean;
     maxRequestSize?: string;
     requestTimeout?: number;
 }

package/v3/@claude-flow/shared/dist/mcp/transport/http.js

@@ -14,6 +14,7 @@
 import { EventEmitter } from 'events';
 import express from 'express';
 import { createServer } from 'http';
+import { assertSafeBind, refuseOpenRequest } from './guard.js';
 import { WebSocketServer, WebSocket } from 'ws';
 import cors from 'cors';
 import helmet from 'helmet';
@@ -56,12 +57,14 @@ export class HttpTransport extends EventEmitter {
             host: this.config.host,
             port: this.config.port,
         });
+        assertSafeBind(this.config.host, this.config.auth?.enabled === true, this.config.allowUnauthenticated);
         // Create HTTP server
         this.server = createServer(this.app);
-        // Create WebSocket server
+        // Create WebSocket server (CORS does not apply to upgrades, so a token-less server checks Host and Origin itself)
         this.wss = new WebSocketServer({
             server: this.server,
             path: '/ws',
+            verifyClient: (info) => this.config.auth?.enabled === true || refuseOpenRequest(info.req, this.config.host, this.config.corsOrigins) === undefined,
         });
         this.setupWebSocketHandlers();
         // Start server
@@ -159,6 +162,17 @@ export class HttpTransport extends EventEmitter {
      * Setup Express middleware
      */
     setupMiddleware() {
+        // A server with no token must not answer a web page or a rebound hostname.
+        if (this.config.auth?.enabled !== true) {
+            this.app.use((req, res, next) => {
+                const why = refuseOpenRequest(req, this.config.host, this.config.corsOrigins);
+                if (why === undefined) {
+                    next();
+                    return;
+                }
+                res.status(403).json({ jsonrpc: '2.0', id: null, error: { code: -32000, message: `Forbidden: ${why}` } });
+            });
+        }
         // Security headers
         this.app.use(helmet({
             contentSecurityPolicy: false, // Allow for flexibility

package/v3/@claude-flow/shared/dist/mcp/transport/websocket.d.ts

@@ -26,6 +26,10 @@ export interface WebSocketTransportConfig {
     heartbeatTimeout?: number;
     maxMessageSize?: number;
     auth?: AuthConfig;
+    /** Accept a non-loopback bind with no token. */
+    allowUnauthenticated?: boolean;
+    /** Browser origins allowed to connect, by exact name. */
+    allowedOrigins?: string[];
     enableBinaryMode?: boolean;
 }
 /**
@@ -107,6 +111,8 @@ export declare class WebSocketTransport extends EventEmitter implements ITranspo
     /**
      * Handle incoming message
      */
+    /** Token from `Authorization: Bearer` or `?token=`, compared in constant time. */
+    private upgradeHasValidToken;
     private handleMessage;
     /**
      * Parse incoming message

package/v3/@claude-flow/shared/dist/mcp/transport/websocket.js

@@ -14,6 +14,8 @@
 import { EventEmitter } from 'events';
 import { WebSocketServer, WebSocket } from 'ws';
 import { createServer } from 'http';
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { assertSafeBind, refuseOpenRequest } from './guard.js';
 /**
  * WebSocket Transport Implementation
  */
@@ -51,6 +53,7 @@ export class WebSocketTransport extends EventEmitter {
             port: this.config.port,
             path: this.config.path || '/ws',
         });
+        assertSafeBind(this.config.host, this.config.auth?.enabled === true, this.config.allowUnauthenticated);
         // Create HTTP server for WebSocket upgrade
         this.server = createServer((req, res) => {
             // Simple HTTP response for non-WebSocket requests
@@ -63,6 +66,9 @@ export class WebSocketTransport extends EventEmitter {
             path: this.config.path || '/ws',
             maxPayload: this.config.maxMessageSize || 10 * 1024 * 1024,
             perMessageDeflate: true, // Enable compression
+            verifyClient: (info) => this.config.auth?.enabled === true
+                ? this.upgradeHasValidToken(info.req)
+                : refuseOpenRequest(info.req, this.config.host, this.config.allowedOrigins) === undefined,
         });
         this.setupWebSocketHandlers();
         this.startHeartbeat();
@@ -225,7 +231,8 @@ export class WebSocketTransport extends EventEmitter {
                 lastActivity: new Date(),
                 messageCount: 0,
                 isAlive: true,
-                isAuthenticated: !this.config.auth?.enabled,
+                // With a token configured the upgrade itself was authenticated (verifyClient).
+                isAuthenticated: true,
             };
             this.clients.set(clientId, client);
             this.totalConnections++;
@@ -264,6 +271,22 @@ export class WebSocketTransport extends EventEmitter {
     /**
      * Handle incoming message
      */
+    /** Token from `Authorization: Bearer` or `?token=`, compared in constant time. */
+    upgradeHasValidToken(req) {
+        const header = req.headers.authorization;
+        const fromHeader = typeof header === 'string' ? header.match(/^Bearer\s+(.+)$/i)?.[1] : undefined;
+        const fromQuery = new URL(req.url ?? '', 'http://localhost').searchParams.get('token') ?? undefined;
+        const given = fromHeader ?? fromQuery;
+        if (!given)
+            return false;
+        const digest = (v) => createHash('sha256').update(v, 'utf8').digest();
+        let ok = false;
+        for (const valid of this.config.auth?.tokens ?? []) {
+            if (timingSafeEqual(digest(given), digest(valid)))
+                ok = true;
+        }
+        return ok;
+    }
     async handleMessage(client, data) {
         client.lastActivity = new Date();
         client.messageCount++;

package/v3/@claude-flow/shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/shared",
-  "version": "3.0.5",
+  "version": "3.0.6",
   "type": "module",
   "description": "Shared module - common types, events, utilities, core interfaces",
   "main": "dist/index.js",