claude-flow 3.63.6 → 3.63.7

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js

@@ -1580,14 +1580,21 @@ export class WorkerDaemon extends EventEmitter {
         const audit = {
             timestamp: new Date().toISOString(),
             mode: 'local',
+            // This fallback performs file-presence checks only. It must not report
+            // a clean secret scan or a low risk level it did not actually establish:
+            // the worker runs by default at critical priority, so a fabricated
+            // noHardcodedSecrets/riskLevel pair is a believable false negative.
+            scanned: false,
             checks: {
                 envFilesProtected: !existsSync(join(this.projectRoot, '.env.local')),
                 gitIgnoreExists: existsSync(join(this.projectRoot, '.gitignore')),
-                noHardcodedSecrets: true, // Would need actual scanning
+                noHardcodedSecrets: null,
             },
-            riskLevel: 'low',
-            recommendations: [],
-            note: 'Install Claude Code CLI for AI-powered security analysis',
+            riskLevel: 'unknown',
+            recommendations: [
+                'No secret scan or code analysis was performed by the local fallback; install Claude Code CLI for AI-powered security analysis.',
+            ],
+            note: 'Local fallback checks file presence only; it does not scan source contents.',
         };
         writeFileSync(auditFile, JSON.stringify(audit, null, 2));
         return audit;

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.63.6",
+  "version": "3.63.7",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",