claude-flow 3.63.4 → 3.63.6

package/.claude-plugin/marketplace.json

@@ -57,10 +57,10 @@
         "source": "git-subdir",
         "url": "https://github.com/proffesor-for-testing/agentic-qe.git",
         "path": "plugins/agentic-qe-fleet",
-        "ref": "v3.15.13",
-        "sha": "e976a8e451b331fff86fc249f2ba40f19644c9fc"
+        "ref": "v3.15.15",
+        "sha": "1d0cc76632e8663ca2dffeaf3e000ef7baf3d481"
       },
-      "description": "Agentic QE (external: maintained in proffesor-for-testing/agentic-qe, pinned to v3.15.13): a quality-engineering fleet with 11 QE agents, 9 skills, 9 commands, the agentic-qe MCP server pinned to the plugin version, and the aqe-mod guard that refuses destructive operations on AQE learning data"
+      "description": "Agentic QE (external: maintained in proffesor-for-testing/agentic-qe, pinned to v3.15.15): a quality-engineering fleet with 11 QE agents, 9 skills, 9 commands, the agentic-qe MCP server pinned to the plugin version, and the aqe-mod guard that refuses destructive operations on AQE learning data"
     },
     {
       "name": "ruflo-docs",

package/README.md

@@ -244,7 +244,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
 | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
 | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
-| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.13/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
+| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.15/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
 
 #### Security & Compliance
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.63.4",
+  "version": "3.63.6",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/mcp",
@@ -72,7 +72,7 @@
     "@claude-flow/cli-core": "3.7.5",
     "@claude-flow/codex": "3.0.5",
     "@claude-flow/mcp": "3.1.4",
-    "@claude-flow/neural": "3.0.0",
+    "@claude-flow/neural": "3.0.1",
     "@claude-flow/plugin-agent-federation": "1.0.3",
     "@claude-flow/security": "3.0.5",
     "@claude-flow/shared": "3.0.6",

package/v3/@claude-flow/cli/dist/src/commands/hooks.js

@@ -2489,7 +2489,7 @@ const workerStatusCommand = {
                 });
                 if (result.summary) {
                     output.writeln();
-                    output.writeln(`Total: ${result.summary.total} | Running: ${output.highlight(String(result.summary.running))} | Completed: ${output.success(String(result.summary.completed))} | Failed: ${output.error(String(result.summary.failed))}`);
+                    output.writeln(`Total: ${result.summary.total} | Pending: ${String(result.summary.pending ?? 0)} | Running: ${output.highlight(String(result.summary.running))} | Completed: ${output.success(String(result.summary.completed))} | Failed: ${output.error(String(result.summary.failed))}`);
                 }
             }
             else {

package/v3/@claude-flow/cli/dist/src/commands/status.js

@@ -152,7 +152,7 @@ async function getSystemStatus() {
                 backend: 'none',
                 performance: { searchTime: 0, cacheHitRate: 0 }
             },
-            tasks: { total: 0, pending: 0, running: 0, completed: 0, failed: 0 },
+            tasks: { total: 0, pending: 0, running: 0, completed: 0, failed: 0, cancelled: 0 },
             performance: {
                 cpuUsage: 0,
                 memoryUsage: 0,
@@ -217,6 +217,7 @@ function displayStatus(status) {
             { status: 'Running', count: status.tasks.running },
             { status: 'Completed', count: status.tasks.completed },
             { status: 'Failed', count: status.tasks.failed },
+            { status: 'Cancelled', count: status.tasks.cancelled },
             { status: output.bold('Total'), count: status.tasks.total }
         ]
     });

package/v3/@claude-flow/cli/dist/src/mcp-tools/claims-tools.js

@@ -812,14 +812,18 @@ export const claimsTools = [
             const overloaded = loads.filter(l => l.claims.length > maxClaims * targetUtilization * 1.5);
             const underloaded = loads.filter(l => l.claims.length < maxClaims * targetUtilization * 0.5);
             const suggestions = [];
+            // Claim counts including moves suggested so far, so one target is not
+            // handed more claims than maxClaims allows.
+            const plannedCount = new Map(loads.map(l => [l.agentId, l.claims.length]));
             for (const over of overloaded) {
                 // Find low-progress claims to redistribute
                 const movable = over.claims
                     .filter(c => c.progress < 25 && c.status === 'active')
                     .slice(0, over.claims.length - Math.ceil(maxClaims * targetUtilization));
                 for (const claim of movable) {
-                    const target = underloaded.find(u => u.agentType === over.agentType && u.claims.length < maxClaims);
+                    const target = underloaded.find(u => u.agentType === over.agentType && plannedCount.get(u.agentId) < maxClaims);
                     if (target) {
+                        plannedCount.set(target.agentId, plannedCount.get(target.agentId) + 1);
                         suggestions.push({
                             issueId: claim.issueId,
                             from: `agent:${over.agentId}:${over.agentType}`,

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -4817,6 +4817,7 @@ export const hooksWorkerStatus = {
             workers,
             summary: {
                 total: workers.length,
+                pending: workers.filter(w => w.status === 'pending').length,
                 running: workers.filter(w => w.status === 'running').length,
                 completed: workers.filter(w => w.status === 'completed').length,
                 failed: workers.filter(w => w.status === 'failed').length,

package/v3/@claude-flow/cli/dist/src/mcp-tools/http-fetch-tools.d.ts

@@ -15,7 +15,7 @@
  *   - DEFAULT-REFUSES Authorization / Cookie / X-Auth-* (CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1 opt-in)
  *   - hard timeout 30s default, 60s ceiling
  *   - response truncated to 256KB default, 1MB ceiling
- *   - no redirects auto-followed beyond fetch's default; status reported as-is
+ *   - redirects followed manually, max 10, every hop re-validated by the same allowlist
  *
  * @module @claude-flow/cli/mcp-tools/http-fetch
  */

package/v3/@claude-flow/cli/dist/src/mcp-tools/http-fetch-tools.js

@@ -15,7 +15,7 @@
  *   - DEFAULT-REFUSES Authorization / Cookie / X-Auth-* (CLAUDE_FLOW_HTTP_FETCH_ALLOW_AUTH=1 opt-in)
  *   - hard timeout 30s default, 60s ceiling
  *   - response truncated to 256KB default, 1MB ceiling
- *   - no redirects auto-followed beyond fetch's default; status reported as-is
+ *   - redirects followed manually, max 10, every hop re-validated by the same allowlist
  *
  * @module @claude-flow/cli/mcp-tools/http-fetch
  */
@@ -23,6 +23,8 @@ const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 60_000;
 const DEFAULT_MAX_RESPONSE_BYTES = 256 * 1024; // 256 KB
 const MAX_RESPONSE_BYTES = 1024 * 1024; // 1 MB
+const MAX_REDIRECTS = 10;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 const DEFAULT_USER_AGENT = 'ruflo-http-fetch/1.0';
 const FORBIDDEN_HEADER_PREFIXES = ['x-auth-', 'x-api-key'];
 const FORBIDDEN_HEADERS_EXACT = ['authorization', 'cookie', 'set-cookie', 'proxy-authorization'];
@@ -230,13 +232,97 @@ export async function httpFetchExecute(input) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await fetch(parsed.toString(), {
-            method,
-            headers,
-            body: method === 'GET' || method === 'HEAD' ? undefined : body,
-            signal: controller.signal,
-            // Keep redirect default ('follow') — caller sees final status/url.
-        });
+        let currentUrl = parsed;
+        let currentMethod = method;
+        let currentBody = body;
+        let response;
+        let redirects = 0;
+        // Do not let fetch follow redirects on its own: only the initial URL was
+        // validated, so an automatic follow could reach loopback/RFC1918 or switch
+        // protocols after passing the allowlist. Every hop is validated with the
+        // same rules; sensitive headers are dropped when the origin changes.
+        while (true) {
+            response = await fetch(currentUrl.toString(), {
+                method: currentMethod,
+                headers,
+                body: currentMethod === 'GET' || currentMethod === 'HEAD' ? undefined : currentBody,
+                signal: controller.signal,
+                redirect: 'manual',
+            });
+            if (!REDIRECT_STATUSES.has(response.status))
+                break;
+            const location = response.headers.get('location');
+            if (!location)
+                break;
+            if (redirects++ >= MAX_REDIRECTS) {
+                try {
+                    await response.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return {
+                    success: false,
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: {},
+                    body: '',
+                    bodyTruncated: false,
+                    bytesRead: 0,
+                    durationMs: Date.now() - startedAt,
+                    url: currentUrl.toString(),
+                    method,
+                    error: `too many redirects (max ${MAX_REDIRECTS})`,
+                    errorCode: 'REDIRECT_LIMIT',
+                };
+            }
+            let nextUrl;
+            try {
+                nextUrl = validateUrl(new URL(location, currentUrl).toString());
+            }
+            catch (e) {
+                try {
+                    await response.body?.cancel();
+                }
+                catch { /* ignore */ }
+                const err = e;
+                return {
+                    success: false,
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: {},
+                    body: '',
+                    bodyTruncated: false,
+                    bytesRead: 0,
+                    durationMs: Date.now() - startedAt,
+                    url: currentUrl.toString(),
+                    method,
+                    error: `redirect blocked: ${err.message}`,
+                    errorCode: err.code ?? 'REDIRECT_BLOCKED',
+                };
+            }
+            // The redirect response body is not returned; release the connection
+            // before issuing the next request. A body-less 3xx is also fine.
+            try {
+                await response.body?.cancel();
+            }
+            catch { /* ignore */ }
+            if (nextUrl.origin !== currentUrl.origin) {
+                for (const key of Object.keys(headers)) {
+                    const lower = key.toLowerCase();
+                    if (lower === 'authorization' || lower === 'cookie' || lower === 'proxy-authorization') {
+                        delete headers[key];
+                    }
+                }
+            }
+            // Match fetch's redirect method rules: 303 becomes GET except for
+            // GET/HEAD, while 301/302 only rewrite POST to GET. 307/308 preserve
+            // both method and body.
+            if ((response.status === 303 && currentMethod !== 'GET' && currentMethod !== 'HEAD') ||
+                ((response.status === 301 || response.status === 302) && currentMethod === 'POST')) {
+                currentMethod = 'GET';
+                currentBody = undefined;
+            }
+            currentUrl = nextUrl;
+        }
         // Drain the body with byte budget. Use array-buffer first to bound size
         // deterministically before decoding to UTF-8.
         const reader = response.body?.getReader();
@@ -286,7 +372,7 @@ export async function httpFetchExecute(input) {
             bodyTruncated,
             bytesRead,
             durationMs: Date.now() - startedAt,
-            url: parsed.toString(),
+            url: currentUrl.toString(),
             method,
         };
     }

package/v3/@claude-flow/cli/dist/src/mcp-tools/system-tools.js

@@ -633,6 +633,7 @@ export const systemTools = [
                 running: tasks.filter(t => t.status === 'in_progress').length,
                 completed: tasks.filter(t => t.status === 'completed').length,
                 failed: tasks.filter(t => t.status === 'failed').length,
+                cancelled: tasks.filter(t => t.status === 'cancelled').length,
             };
         },
     },

package/v3/@claude-flow/cli/dist/src/mcp-tools/task-tools.js

@@ -208,7 +208,9 @@ export const taskTools = [
             // Apply filters
             if (input.status) {
                 // Support comma-separated status values. 'all' (sent by `status tasks`) means no status filter.
-                const statuses = input.status.split(',').map(s => s.trim());
+                // Each value goes through statusOf, the reader task_update uses, so "done", "canceled",
+                // "running" or "Completed" match the stored status rather than matching nothing.
+                const statuses = input.status.split(',').map(s => s.trim()).map(s => statusOf(s) ?? s);
                 if (!statuses.includes('all')) {
                     tasks = tasks.filter(t => statuses.includes(t.status));
                 }

package/v3/@claude-flow/cli/dist/src/mcp-tools/workflow-tools.js

@@ -20,7 +20,9 @@ function parseCondition(when) {
     if (expression === 'true' || expression === 'false') {
         return { constant: expression === 'true' };
     }
-    const match = expression.match(/^([a-zA-Z_]\w*)\s*===?\s*(?:'([^']*)'|"([^"]*)"|(-?\d+(?:\.\d+)?)|(true|false))$/);
+    // Variable names follow the `{{…}}` interpolation syntax, so a condition can
+    // read a task step's output, stored as `<stepId>.output` (`step-1.output`).
+    const match = expression.match(/^([a-zA-Z_][\w.-]*)\s*===?\s*(?:'([^']*)'|"([^"]*)"|(-?\d+(?:\.\d+)?)|(true|false))$/);
     if (!match) {
         return new Error('condition config.when must compare a variable to a quoted string, number, or boolean using == or ===');
     }