claude-flow 3.63.5 → 3.63.7

package/v3/@claude-flow/cli/dist/src/mcp-tools/coordination-tools.js

@@ -225,8 +225,8 @@ export const coordinationTools = [
         inputSchema: {
             type: 'object',
             properties: {
-                action: { type: 'string', enum: ['status', 'trigger', 'resolve'], description: 'Action to perform' },
-                force: { type: 'boolean', description: 'Force synchronization' },
+                action: { type: 'string', enum: ['status', 'trigger', 'resolve'], description: 'Action to perform. `trigger` is unavailable: nodes are local records with no sync backend, so it is refused (#4557)' },
+                force: { type: 'boolean', description: 'Unused: `trigger` is refused regardless (#4557)' },
                 conflictResolution: { type: 'string', enum: ['latest', 'merge', 'manual'], description: 'Conflict resolution strategy' },
             },
         },
@@ -243,18 +243,16 @@ export const coordinationTools = [
                 };
             }
             if (action === 'trigger') {
-                store.sync.syncCount++;
-                store.sync.lastSync = new Date().toISOString();
-                store.sync.pendingChanges = 0;
-                // Simulate sync
-                await new Promise(resolve => setTimeout(resolve, 50));
-                saveCoordStore(store);
+                // #4557: this waited on a simulated 50ms "sync", bumped syncCount/lastSync
+                // and reported every node synchronized, but no state moves between
+                // nodes. Refuse without touching the stored sync record, as
+                // neural_compress quantize/prune do (#4195, #4423).
                 return {
-                    success: true,
-                    action: 'synchronized',
+                    success: false,
+                    action: 'trigger',
+                    error: 'Synchronization is unavailable: coordination nodes are local records with no sync backend, so nothing would be transferred.',
                     syncCount: store.sync.syncCount,
-                    syncedAt: store.sync.lastSync,
-                    nodesSync: Object.keys(store.nodes).length,
+                    lastSync: store.sync.lastSync,
                 };
             }
             if (action === 'resolve') {

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -2212,7 +2212,14 @@ export const hooksBuildAgents = {
         },
     },
     handler: async (params) => {
-        const outputDir = resolve(params.outputDir || './agents');
+        // #4558: outputDir was never validated and resolved against the process
+        // cwd, so a default call from another directory overwrote files there.
+        if (params.outputDir !== undefined) {
+            const v = validatePath(params.outputDir, 'outputDir');
+            if (!v.valid)
+                return { success: false, error: v.error };
+        }
+        const outputDir = resolve(getProjectCwd(), params.outputDir || './agents');
         const focus = params.focus || 'all';
         const format = params.format || 'yaml';
         const persist = params.persist !== false; // Default to true
@@ -2255,9 +2262,11 @@ export const hooksBuildAgents = {
             agents: filteredAgents,
             stats: {
                 configsGenerated: filteredAgents.length,
-                patternsApplied: filteredAgents.length * 3,
+                // #4558: was agents * 3; no pretrain data is read, the configs are templates.
+                patternsApplied: 0,
                 optimizationsIncluded: filteredAgents.reduce((acc, a) => acc + a.optimizations.length, 0),
             },
+            _note: 'Configs are built-in templates; pretrain data is not read.',
         };
     },
 };

package/v3/@claude-flow/cli/dist/src/mcp-tools/performance-tools.js

@@ -612,6 +612,14 @@ export const performanceTools = [
             };
             const cpuStats = calcStats(cpuHistory, cpuPercent);
             const memStats = calcStats(memHistory, memUsedMB);
+            // #4554: latency/throughput used to be fixed literals (45ms, 1250 ops/s).
+            // Report the samples performance_report records (ADR-093 F8), or say none exist.
+            const sampled = (values, unit) => {
+                const real = values.filter(n => Number.isFinite(n));
+                return real.length === 0
+                    ? { available: false, unit, samples: 0, _real: false, _note: 'No samples recorded yet: run performance_report to record one.' }
+                    : { ...calcStats(real, real[real.length - 1]), unit, samples: real.length, _real: true };
+            };
             const allMetrics = {
                 cpu: {
                     ...cpuStats,
@@ -630,30 +638,12 @@ export const performanceTools = [
                     unit: 'MB',
                     _real: true,
                 },
-                latency: {
-                    current: 45,
-                    avg: 52,
-                    min: 15,
-                    max: 250,
-                    p50: 48,
-                    p95: 150,
-                    p99: 220,
-                    unit: 'ms',
-                },
-                throughput: {
-                    current: 1250,
-                    avg: 1100,
-                    min: 500,
-                    max: 2000,
-                    p50: 1050,
-                    p95: 1800,
-                    p99: 1950,
-                    unit: 'ops/s',
-                },
+                latency: sampled(history.map(m => m.latency?.avg), 'ms'),
+                throughput: sampled(history.map(m => m.throughput?.operations), 'ops/s'),
             };
             if (metric === 'all') {
                 return {
-                    _real: true,
+                    _real: Object.values(allMetrics).every(m => m._real),
                     metrics: allMetrics,
                     aggregation,
                     historySize: history.length,
@@ -662,9 +652,9 @@ export const performanceTools = [
             }
             const selectedMetric = allMetrics[metric];
             return {
-                _real: ['cpu', 'memory'].includes(metric),
+                _real: selectedMetric._real,
                 metric,
-                value: selectedMetric[aggregation],
+                value: selectedMetric[aggregation] ?? null,
                 unit: selectedMetric.unit,
                 details: selectedMetric,
                 timestamp: new Date().toISOString(),

package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.js

@@ -54,6 +54,21 @@ function ensureSessionDir() {
         mkdirRestricted(dir);
     }
 }
+/**
+ * The session hook (`session.js` from init/helpers-generator.ts) writes its
+ * records into this same directory: `current.json` and `session-<n>.json`
+ * archives shaped `{ id, startedAt, ... }` rather than session_save's
+ * `{ sessionId, name, savedAt, stats }`. Read the id and time from either shape
+ * (ADR-093 F6), falling back to the file's own id.
+ */
+function sessionIdentity(session, fileId) {
+    const raw = session;
+    const pick = (...values) => values.find((v) => typeof v === 'string' && v !== '');
+    return {
+        sessionId: pick(raw.sessionId, raw.id) ?? fileId,
+        savedAt: pick(raw.savedAt, raw.startedAt) ?? '',
+    };
+}
 function loadSession(sessionId) {
     try {
         const path = getSessionPath(sessionId);
@@ -583,12 +598,13 @@ export const sessionTools = [
             if (session) {
                 const path = getSessionPath(sessionId);
                 const stat = statSync(path);
+                const identity = sessionIdentity(session, sessionId);
                 return {
-                    sessionId: session.sessionId,
-                    name: session.name,
+                    sessionId: identity.sessionId,
+                    name: session.name ?? identity.sessionId,
                     description: session.description,
-                    savedAt: session.savedAt,
-                    stats: session.stats,
+                    savedAt: identity.savedAt,
+                    stats: session.stats ?? null,
                     fileSize: stat.size,
                     path,
                     hasData: {
@@ -631,12 +647,13 @@ export const sessionTools = [
             const session = loadSession(sessionId);
             if (!session)
                 return { sessionId, status: 'unknown', startedAt: '', error: 'Session file unreadable' };
+            const identity = sessionIdentity(session, sessionId);
             return {
-                sessionId: session.sessionId,
-                name: session.name,
+                sessionId: identity.sessionId,
+                name: session.name ?? identity.sessionId,
                 status: 'active',
-                startedAt: session.savedAt,
-                stats: session.stats,
+                startedAt: identity.savedAt,
+                stats: session.stats ?? null,
             };
         },
     },

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js

@@ -1580,14 +1580,21 @@ export class WorkerDaemon extends EventEmitter {
         const audit = {
             timestamp: new Date().toISOString(),
             mode: 'local',
+            // This fallback performs file-presence checks only. It must not report
+            // a clean secret scan or a low risk level it did not actually establish:
+            // the worker runs by default at critical priority, so a fabricated
+            // noHardcodedSecrets/riskLevel pair is a believable false negative.
+            scanned: false,
             checks: {
                 envFilesProtected: !existsSync(join(this.projectRoot, '.env.local')),
                 gitIgnoreExists: existsSync(join(this.projectRoot, '.gitignore')),
-                noHardcodedSecrets: true, // Would need actual scanning
+                noHardcodedSecrets: null,
             },
-            riskLevel: 'low',
-            recommendations: [],
-            note: 'Install Claude Code CLI for AI-powered security analysis',
+            riskLevel: 'unknown',
+            recommendations: [
+                'No secret scan or code analysis was performed by the local fallback; install Claude Code CLI for AI-powered security analysis.',
+            ],
+            note: 'Local fallback checks file presence only; it does not scan source contents.',
         };
         writeFileSync(auditFile, JSON.stringify(audit, null, 2));
         return audit;

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.63.5",
+  "version": "3.63.7",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -131,6 +131,7 @@
   },
   "optionalDependencies": {
     "@agntcy/slim-bindings": "2.1.1",
+    "@claude-flow/aidefence": "3.0.2",
     "@claude-flow/memory": "3.0.9",
     "@metaharness/darwin": "~0.12.0",
     "@metaharness/flywheel": "~0.1.10",