claude-flow 3.63.4 → 3.63.5

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1793043879777,
+  "adoptedAt": 1793126252524,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",

package/.claude-plugin/marketplace.json

@@ -57,10 +57,10 @@
         "source": "git-subdir",
         "url": "https://github.com/proffesor-for-testing/agentic-qe.git",
         "path": "plugins/agentic-qe-fleet",
-        "ref": "v3.15.13",
-        "sha": "e976a8e451b331fff86fc249f2ba40f19644c9fc"
+        "ref": "v3.15.15",
+        "sha": "1d0cc76632e8663ca2dffeaf3e000ef7baf3d481"
       },
-      "description": "Agentic QE (external: maintained in proffesor-for-testing/agentic-qe, pinned to v3.15.13): a quality-engineering fleet with 11 QE agents, 9 skills, 9 commands, the agentic-qe MCP server pinned to the plugin version, and the aqe-mod guard that refuses destructive operations on AQE learning data"
+      "description": "Agentic QE (external: maintained in proffesor-for-testing/agentic-qe, pinned to v3.15.15): a quality-engineering fleet with 11 QE agents, 9 skills, 9 commands, the agentic-qe MCP server pinned to the plugin version, and the aqe-mod guard that refuses destructive operations on AQE learning data"
     },
     {
       "name": "ruflo-docs",

package/README.md

@@ -244,7 +244,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
 | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
 | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
-| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.13/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
+| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.15/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
 
 #### Security & Compliance
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.63.4",
+  "version": "3.63.5",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/mcp",
@@ -72,7 +72,7 @@
     "@claude-flow/cli-core": "3.7.5",
     "@claude-flow/codex": "3.0.5",
     "@claude-flow/mcp": "3.1.4",
-    "@claude-flow/neural": "3.0.0",
+    "@claude-flow/neural": "3.0.1",
     "@claude-flow/plugin-agent-federation": "1.0.3",
     "@claude-flow/security": "3.0.5",
     "@claude-flow/shared": "3.0.6",

package/v3/@claude-flow/cli/dist/src/commands/hooks.js

@@ -2489,7 +2489,7 @@ const workerStatusCommand = {
                 });
                 if (result.summary) {
                     output.writeln();
-                    output.writeln(`Total: ${result.summary.total} | Running: ${output.highlight(String(result.summary.running))} | Completed: ${output.success(String(result.summary.completed))} | Failed: ${output.error(String(result.summary.failed))}`);
+                    output.writeln(`Total: ${result.summary.total} | Pending: ${String(result.summary.pending ?? 0)} | Running: ${output.highlight(String(result.summary.running))} | Completed: ${output.success(String(result.summary.completed))} | Failed: ${output.error(String(result.summary.failed))}`);
                 }
             }
             else {

package/v3/@claude-flow/cli/dist/src/commands/status.js

@@ -152,7 +152,7 @@ async function getSystemStatus() {
                 backend: 'none',
                 performance: { searchTime: 0, cacheHitRate: 0 }
             },
-            tasks: { total: 0, pending: 0, running: 0, completed: 0, failed: 0 },
+            tasks: { total: 0, pending: 0, running: 0, completed: 0, failed: 0, cancelled: 0 },
             performance: {
                 cpuUsage: 0,
                 memoryUsage: 0,
@@ -217,6 +217,7 @@ function displayStatus(status) {
             { status: 'Running', count: status.tasks.running },
             { status: 'Completed', count: status.tasks.completed },
             { status: 'Failed', count: status.tasks.failed },
+            { status: 'Cancelled', count: status.tasks.cancelled },
             { status: output.bold('Total'), count: status.tasks.total }
         ]
     });

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -4817,6 +4817,7 @@ export const hooksWorkerStatus = {
             workers,
             summary: {
                 total: workers.length,
+                pending: workers.filter(w => w.status === 'pending').length,
                 running: workers.filter(w => w.status === 'running').length,
                 completed: workers.filter(w => w.status === 'completed').length,
                 failed: workers.filter(w => w.status === 'failed').length,

package/v3/@claude-flow/cli/dist/src/mcp-tools/http-fetch-tools.d.ts

@@ -15,7 +15,7 @@
  *   - DEFAULT-REFUSES Authorization / Cookie / X-Auth-* (CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1 opt-in)
  *   - hard timeout 30s default, 60s ceiling
  *   - response truncated to 256KB default, 1MB ceiling
- *   - no redirects auto-followed beyond fetch's default; status reported as-is
+ *   - redirects followed manually, max 10, every hop re-validated by the same allowlist
  *
  * @module @claude-flow/cli/mcp-tools/http-fetch
  */

package/v3/@claude-flow/cli/dist/src/mcp-tools/http-fetch-tools.js

@@ -15,7 +15,7 @@
  *   - DEFAULT-REFUSES Authorization / Cookie / X-Auth-* (CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1 opt-in)
  *   - hard timeout 30s default, 60s ceiling
  *   - response truncated to 256KB default, 1MB ceiling
- *   - no redirects auto-followed beyond fetch's default; status reported as-is
+ *   - redirects followed manually, max 10, every hop re-validated by the same allowlist
  *
  * @module @claude-flow/cli/mcp-tools/http-fetch
  */
@@ -23,6 +23,8 @@ const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 60_000;
 const DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024; // 256 KB
 const MAX_RESPONSE_BYTES = 1024 * 1024; // 1 MB
+const MAX_REDIRECTS = 10;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 const DEFAULT_USER_AGENT = 'ruflo-http-fetch/1.0';
 const FORBIDDEN_HEADER_PREFIXES = ['x-auth-', 'x-api-key'];
 const FORBIDDEN_HEADERS_EXACT = ['authorization', 'cookie', 'set-cookie', 'proxy-authorization'];
@@ -230,13 +232,97 @@ export async function httpFetchExecute(input) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await fetch(parsed.toString(), {
-            method,
-            headers,
-            body: method === 'GET' || method === 'HEAD' ? undefined : body,
-            signal: controller.signal,
-            // Keep redirect default ('follow') — caller sees final status/url.
-        });
+        let currentUrl = parsed;
+        let currentMethod = method;
+        let currentBody = body;
+        let response;
+        let redirects = 0;
+        // Do not let fetch follow redirects on its own: only the initial URL was
+        // validated, so an automatic follow could reach loopback/RFC1918 or switch
+        // protocols after passing the allowlist. Every hop is validated with the
+        // same rules; sensitive headers are dropped when the origin changes.
+        while (true) {
+            response = await fetch(currentUrl.toString(), {
+                method: currentMethod,
+                headers,
+                body: currentMethod === 'GET' || currentMethod === 'HEAD' ? undefined : currentBody,
+                signal: controller.signal,
+                redirect: 'manual',
+            });
+            if (!REDIRECT_STATUSES.has(response.status))
+                break;
+            const location = response.headers.get('location');
+            if (!location)
+                break;
+            if (redirects++ >= MAX_REDIRECTS) {
+                try {
+                    await response.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return {
+                    success: false,
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: {},
+                    body: '',
+                    bodyTruncated: false,
+                    bytesRead: 0,
+                    durationMs: Date.now() - startedAt,
+                    url: currentUrl.toString(),
+                    method,
+                    error: `too many redirects (max ${MAX_REDIRECTS})`,
+                    errorCode: 'REDIRECT_LIMIT',
+                };
+            }
+            let nextUrl;
+            try {
+                nextUrl = validateUrl(new URL(location, currentUrl).toString());
+            }
+            catch (e) {
+                try {
+                    await response.body?.cancel();
+                }
+                catch { /* ignore */ }
+                const err = e;
+                return {
+                    success: false,
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: {},
+                    body: '',
+                    bodyTruncated: false,
+                    bytesRead: 0,
+                    durationMs: Date.now() - startedAt,
+                    url: currentUrl.toString(),
+                    method,
+                    error: `redirect blocked: ${err.message}`,
+                    errorCode: err.code ?? 'REDIRECT_BLOCKED',
+                };
+            }
+            // The redirect response body is not returned; release the connection
+            // before issuing the next request. A body-less 3xx is also fine.
+            try {
+                await response.body?.cancel();
+            }
+            catch { /* ignore */ }
+            if (nextUrl.origin !== currentUrl.origin) {
+                for (const key of Object.keys(headers)) {
+                    const lower = key.toLowerCase();
+                    if (lower === 'authorization' || lower === 'cookie' || lower === 'proxy-authorization') {
+                        delete headers[key];
+                    }
+                }
+            }
+            // Match fetch's redirect method rules: 303 becomes GET except for
+            // GET/HEAD, while 301/302 only rewrite POST to GET. 307/308 preserve
+            // both method and body.
+            if ((response.status === 303 && currentMethod !== 'GET' && currentMethod !== 'HEAD') ||
+                ((response.status === 301 || response.status === 302) && currentMethod === 'POST')) {
+                currentMethod = 'GET';
+                currentBody = undefined;
+            }
+            currentUrl = nextUrl;
+        }
         // Drain the body with byte budget. Use array-buffer first to bound size
         // deterministically before decoding to UTF-8.
         const reader = response.body?.getReader();
@@ -286,7 +372,7 @@ export async function httpFetchExecute(input) {
             bodyTruncated,
             bytesRead,
             durationMs: Date.now() - startedAt,
-            url: parsed.toString(),
+            url: currentUrl.toString(),
             method,
         };
     }

package/v3/@claude-flow/cli/dist/src/mcp-tools/system-tools.js

@@ -633,6 +633,7 @@ export const systemTools = [
                 running: tasks.filter(t => t.status === 'in_progress').length,
                 completed: tasks.filter(t => t.status === 'completed').length,
                 failed: tasks.filter(t => t.status === 'failed').length,
+                cancelled: tasks.filter(t => t.status === 'cancelled').length,
             };
         },
     },

package/v3/@claude-flow/cli/dist/src/mcp-tools/task-tools.js

@@ -208,7 +208,9 @@ export const taskTools = [
             // Apply filters
             if (input.status) {
                 // Support comma-separated status values. 'all' (sent by `status tasks`) means no status filter.
-                const statuses = input.status.split(',').map(s => s.trim());
+                // Each value goes through statusOf, the reader task_update uses, so "done", "canceled",
+                // "running" or "Completed" match the stored status rather than matching nothing.
+                const statuses = input.status.split(',').map(s => s.trim()).map(s => statusOf(s) ?? s);
                 if (!statuses.includes('all')) {
                     tasks = tasks.filter(t => statuses.includes(t.status));
                 }

package/v3/@claude-flow/cli/dist/src/mcp-tools/workflow-tools.js

@@ -20,7 +20,9 @@ function parseCondition(when) {
     if (expression === 'true' || expression === 'false') {
         return { constant: expression === 'true' };
     }
-    const match = expression.match(/^([a-zA-Z_]\w*)\s*===?\s*(?:'([^']*)'|"([^"]*)"|(-?\d+(?:\.\d+)?)|(true|false))$/);
+    // Variable names follow the `{{…}}` interpolation syntax, so a condition can
+    // read a task step's output, stored as `<stepId>.output` (`step-1.output`).
+    const match = expression.match(/^([a-zA-Z_][\w.-]*)\s*===?\s*(?:'([^']*)'|"([^"]*)"|(-?\d+(?:\.\d+)?)|(true|false))$/);
     if (!match) {
         return new Error('condition config.when must compare a variable to a quoted string, number, or boolean using == or ===');
     }

package/v3/@claude-flow/cli/dist/src/mods/claude-installs.js

@@ -7,8 +7,8 @@
  * (a 2.1.107 npm-global beside a current native one, say) silently decides.
  */
 import { execFileSync } from 'node:child_process';
-import { existsSync, realpathSync, statSync } from 'node:fs';
-import { delimiter, join } from 'node:path';
+import { closeSync, existsSync, fstatSync, openSync, readSync, realpathSync, statSync } from 'node:fs';
+import { delimiter, dirname, join, resolve } from 'node:path';
 export const MODS_DEFAULT_ON = '2.1.287';
 export const MODS_FIRST = '2.1.277';
 const parse = (v) => v.split('.').map((n) => Number(n));
@@ -52,6 +52,98 @@ export const defaultVersionOf = (path) => {
         return null;
     }
 };
+/** Known npm/cmd-shim Node launcher forms (legacy basedir and basedir_win).
+ * Match the whole template, not comments or arbitrary shell code. Unknown npm
+ * versions/formats simply keep the independent probe result. Never execute it.
+ */
+const npmCmdShim = (entry, modern) => [
+    '@ECHO off', 'GOTO start', ':find_dp0', 'SET dp0=%~dp0', 'EXIT /b', ':start',
+    'SETLOCAL', 'CALL :find_dp0', '', 'IF EXIST "%dp0%\\node.exe" (',
+    '  SET "_prog=%dp0%\\node.exe"', ') ELSE (', '  SET "_prog=node"',
+    ...(!modern ? ['  SET PATHEXT=%PATHEXT:;.JS;=;%'] : []), ')', '',
+    'endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & '
+        + (modern ? 'set PATHEXT=%PATHEXT:;.JS;=;% & ' : '')
+        + `"%_prog%"  "%dp0%\\${entry.replaceAll('/', '\\')}" %*`, '',
+].join('\r\n');
+const npmPosixShim = (entry, modern) => [
+    '#!/bin/sh', 'basedir=$(dirname "$(echo "$0" | sed -e \'s,\\\\,/,g\')")',
+    ...(modern ? ['basedir_win="$basedir"'] : []), '',
+    modern ? 'case `uname -a` in' : 'case `uname` in',
+    ...(modern ? [
+        '  *CYGWIN*|*MINGW*|*MSYS*)', '    if command -v cygpath > /dev/null 2>&1; then',
+        '      basedir_win=`cygpath -w "$basedir"`', '    fi', '  ;;', '  *WSL2*)',
+        '    if command -v wslpath > /dev/null 2>&1; then',
+        '      basedir_win="$(wslpath -w "$basedir" 2> /dev/null)"',
+        '      if [ $? -ne 0 ] || [ -z "$basedir_win" ]; then',
+        '        echo "Error: wslpath failed to convert path. WSL environment may be misconfigured." >&2',
+        '        exit 1', '      fi', '    fi', '  ;;',
+    ] : [
+        '    *CYGWIN*|*MINGW*|*MSYS*)', '        if command -v cygpath > /dev/null 2>&1; then',
+        '            basedir=`cygpath -w "$basedir"`', '        fi', '    ;;',
+    ]), 'esac', '',
+    ...(modern ? [
+        'PROG_EXE="$basedir/node.exe"', 'if ! [ -x "$PROG_EXE" ]; then',
+        '  PROG_EXE="$basedir/node"', '  if ! [ -x "$PROG_EXE" ]; then',
+        '    PROG_EXE=node', '    if ! [ -x "$PROG_EXE" ]; then', '      PROG_EXE=node.exe',
+        '    fi', '  fi', 'fi', '', `exec "$PROG_EXE"  "$basedir_win/${entry}" "$@"`,
+    ] : [
+        'if [ -x "$basedir/node" ]; then', `  exec "$basedir/node"  "$basedir/${entry}" "$@"`,
+        'else ', `  exec node  "$basedir/${entry}" "$@"`, 'fi',
+    ]), '',
+].join('\n');
+// A no-shebang/native bin uses npm's direct-exec forms, not a Node wrapper.
+const npmDirectCmdShim = (entry) => [
+    '@ECHO off', 'GOTO start', ':find_dp0', 'SET dp0=%~dp0', 'EXIT /b', ':start',
+    'SETLOCAL', 'CALL :find_dp0', `"%dp0%\\${entry.replaceAll('/', '\\')}"   %*`, '',
+].join('\r\n');
+const npmDirectPosixShim = (entry, modern) => {
+    const nodeShim = npmPosixShim(entry, modern);
+    const preamble = nodeShim.slice(0, nodeShim.indexOf(modern ? 'PROG_EXE=' : 'if [ -x'));
+    return preamble + `exec "$basedir/${entry}"   "$@"\n`;
+};
+function npmShimTarget(path, cmd) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > 64 * 1024)
+            return null;
+        // Also cap the actual read if a file grows after stat.
+        const bytes = Buffer.alloc(64 * 1024 + 1);
+        let size = 0;
+        while (size < bytes.length) {
+            const n = readSync(fd, bytes, size, bytes.length - size, null);
+            if (!n)
+                break;
+            size += n;
+        }
+        if (size > 64 * 1024)
+            return null;
+        const text = bytes.subarray(0, size).toString('utf8').replace(/\r\n/g, '\n').trimEnd();
+        const targets = cmd
+            ? [...text.matchAll(/"%dp0%\\([^"\r\n]+)" +%\*$/gm)].map(m => m[1].replaceAll('\\', '/'))
+            : [...text.matchAll(/^\s*exec (?:[^\r\n]* )?"\$basedir(?:_win)?\/([^"\r\n]+)" +"\$@"$/gm)].map(m => m[1]);
+        const entry = targets[0];
+        if (!entry || targets.some(t => t !== entry) || !/^[a-zA-Z0-9@._ /-]+$/.test(entry) || entry.startsWith('/'))
+            return null;
+        const template = cmd ? npmCmdShim : npmPosixShim;
+        const normalize = (value) => value.replace(/\r\n/g, '\n').trimEnd();
+        const node = [false, true].some(modern => normalize(template(entry, modern)) === text);
+        const direct = cmd ? normalize(npmDirectCmdShim(entry)) === text
+            : [false, true].some(modern => normalize(npmDirectPosixShim(entry, modern)) === text);
+        if (!node && !direct)
+            return null;
+        const target = realpathSync(resolve(dirname(path), entry));
+        return statSync(target).isFile() ? { path: target, mode: node ? 'node' : 'direct' } : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
 /** Every `claude` on PATH, in PATH order (the first is what runs), plus ~/.local/bin. */
 export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
     const names = process.platform === 'win32' ? ['claude.exe', 'claude.cmd', 'claude'] : ['claude'];
@@ -59,6 +151,7 @@ export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
     const seen = new Set();
     const installs = [];
     for (const dir of dirs) {
+        let cmd;
         for (const name of names) {
             const path = join(dir, name);
             let real;
@@ -73,7 +166,19 @@ export function findClaudeInstalls(env, home, versionOf = defaultVersionOf) {
             if (seen.has(real))
                 continue;
             seen.add(real);
-            installs.push({ path, version: versionOf(path) });
+            let version = versionOf(path);
+            if (process.platform === 'win32' && name === 'claude' && version === null && cmd?.version) {
+                const target = npmShimTarget(path, false);
+                const cmdTarget = npmShimTarget(cmd.path, true);
+                if (target && cmdTarget && target.path === cmdTarget.path && target.mode === cmdTarget.mode)
+                    version = cmd.version;
+            }
+            const install = { path, version };
+            installs.push(install);
+            // Only a .cmd actually probed in this directory can supply a version.
+            // A realpath-deduplicated alias in another directory proves nothing here.
+            if (name === 'claude.cmd')
+                cmd = install;
         }
     }
     return installs;

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.63.4",
+  "version": "3.63.5",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -103,7 +103,7 @@
     "@claude-flow/cli-core": "3.7.5",
     "@claude-flow/codex": "3.0.5",
     "@claude-flow/mcp": "3.1.4",
-    "@claude-flow/neural": "3.0.0",
+    "@claude-flow/neural": "3.0.1",
     "@claude-flow/plugin-agent-federation": "1.0.3",
     "@claude-flow/security": "3.0.5",
     "@claude-flow/shared": "3.0.6",