claude-flow 3.7.0-alpha.13 → 3.7.0-alpha.15

package/.claude/settings.local.json

@@ -1 +1,10 @@
-{}
+{
+  "permissions": {
+    "allow": [
+      "Bash(mkdir -p /tmp/ruflo-smoke)",
+      "Bash(rm -rf /tmp/ruflo-smoke/*)",
+      "Read(//tmp/**)",
+      "Bash(npm pack *)"
+    ]
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.7.0-alpha.13",
+  "version": "3.7.0-alpha.15",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/hooks.js

@@ -3302,7 +3302,13 @@ const statuslineCommand = {
         },
         {
             name: 'compact',
-            description: 'Compact single-line output',
+            description: 'Compact single-line output (auto-enabled when terminal width < 100 cols)',
+            type: 'boolean',
+            default: false
+        },
+        {
+            name: 'full',
+            description: 'Force the full multi-line output even on narrow terminals',
             type: 'boolean',
             default: false
         },
@@ -3531,8 +3537,16 @@ const statuslineCommand = {
             output.printJson(statusData);
             return { success: true, data: statusData };
         }
-        // Compact output
-        if (ctx.flags.compact) {
+        // #1153: auto-collapse to compact on narrow terminals so the full
+        // 6+ line statusline doesn't dominate the screen. Honors:
+        //   - explicit --compact → compact
+        //   - explicit --full    → full (overrides auto-detection)
+        //   - else                → compact when terminal < 100 cols (full multi-line
+        //                            output expects ~100 cols of horizontal space)
+        const COMPACT_WIDTH_THRESHOLD = 100;
+        const terminalCols = process.stdout.columns ?? 80;
+        const autoCompact = !ctx.flags.full && terminalCols < COMPACT_WIDTH_THRESHOLD;
+        if (ctx.flags.compact || autoCompact) {
             const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} CVE:${security.cvesFixed}/${security.totalCves} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${system.contextPct}% Int:${system.intelligencePct}%`;
             output.writeln(line);
             return { success: true, data: statusData };

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.d.ts

@@ -8,6 +8,9 @@
  *
  * @module v3/cli/memory-initializer
  */
+export declare function getMemoryRoot(): string;
+/** For tests + the `memory configure` flow that mutates the config at runtime. */
+export declare function _resetMemoryRootCache(): void;
 /**
  * Enhanced schema with pattern confidence, temporal decay, versioning
  * Vector embeddings enabled for semantic search

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js

@@ -11,6 +11,61 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { readFileMaybeEncrypted, writeFileRestricted } from '../fs-secure.js';
+/**
+ * #1854: previously every site that needed the memory directory hardcoded
+ * `getMemoryRoot()`, so the documented config entry
+ * points (`memory.persistPath` config field, `memory configure --path`,
+ * `CLAUDE_FLOW_MEMORY_PATH` env var) all silently no-op'd. This helper
+ * is the single source of truth — every `.swarm/memory.db` resolution in
+ * this file flows through it.
+ *
+ * Precedence (highest → lowest):
+ *   1. CLAUDE_FLOW_MEMORY_PATH env var
+ *   2. memory.persistPath / memory.path in claude-flow.config.json (cwd or
+ *      the directory the CLI was invoked from)
+ *   3. Default: cwd/.swarm
+ *
+ * Cached per-process so repeated lookups are cheap; reset only by spawning
+ * a fresh process (which is how config changes already propagate).
+ */
+let _memoryRootCache;
+export function getMemoryRoot() {
+    if (_memoryRootCache !== undefined)
+        return _memoryRootCache;
+    // 1. Env var
+    const envPath = process.env.CLAUDE_FLOW_MEMORY_PATH;
+    if (envPath && envPath.trim().length > 0) {
+        _memoryRootCache = path.resolve(envPath);
+        return _memoryRootCache;
+    }
+    // 2. Config file (claude-flow.config.json)
+    const configCandidates = [
+        path.resolve(process.cwd(), 'claude-flow.config.json'),
+        path.resolve(process.cwd(), '.claude-flow', 'config.json'),
+    ];
+    for (const configPath of configCandidates) {
+        if (!fs.existsSync(configPath))
+            continue;
+        try {
+            const raw = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+            const fromConfig = raw?.memory?.persistPath ?? raw?.memory?.path;
+            if (typeof fromConfig === 'string' && fromConfig.trim().length > 0) {
+                _memoryRootCache = path.resolve(fromConfig);
+                return _memoryRootCache;
+            }
+        }
+        catch {
+            /* malformed config — fall through to default */
+        }
+    }
+    // 3. Default
+    _memoryRootCache = path.resolve(process.cwd(), '.swarm');
+    return _memoryRootCache;
+}
+/** For tests + the `memory configure` flow that mutates the config at runtime. */
+export function _resetMemoryRootCache() {
+    _memoryRootCache = undefined;
+}
 // ADR-053: Lazy import of AgentDB v3 bridge
 let _bridge;
 async function getBridge() {
@@ -358,7 +413,7 @@ export async function getHNSWIndex(options) {
         }
         const { VectorDb } = ruvectorCore;
         // Persistent storage paths — resolve to absolute to survive CWD changes
-        const swarmDir = path.resolve(process.cwd(), '.swarm');
+        const swarmDir = getMemoryRoot();
         if (!fs.existsSync(swarmDir)) {
             fs.mkdirSync(swarmDir, { recursive: true });
         }
@@ -459,7 +514,7 @@ function saveHNSWMetadata() {
     if (!hnswIndex?.entries)
         return;
     try {
-        const swarmDir = path.join(process.cwd(), '.swarm');
+        const swarmDir = getMemoryRoot();
         const metadataPath = path.join(swarmDir, 'hnsw.metadata.json');
         const metadata = Array.from(hnswIndex.entries.entries());
         fs.writeFileSync(metadataPath, JSON.stringify(metadata));
@@ -974,7 +1029,7 @@ async function activateControllerRegistry(dbPath, verbose) {
  */
 export async function initializeMemoryDatabase(options) {
     const { backend = 'hybrid', dbPath: customPath, force = false, verbose = false, migrate = true } = options;
-    const swarmDir = path.join(process.cwd(), '.swarm');
+    const swarmDir = getMemoryRoot();
     const dbPath = customPath || path.join(swarmDir, 'memory.db');
     const dbDir = path.dirname(dbPath);
     try {
@@ -1162,7 +1217,7 @@ export async function initializeMemoryDatabase(options) {
  * Check if memory database is properly initialized
  */
 export async function checkMemoryInitialization(dbPath) {
-    const swarmDir = path.join(process.cwd(), '.swarm');
+    const swarmDir = getMemoryRoot();
     const path_ = dbPath || path.join(swarmDir, 'memory.db');
     if (!fs.existsSync(path_)) {
         return { initialized: false };
@@ -1211,7 +1266,7 @@ export async function checkMemoryInitialization(dbPath) {
  * Reduces confidence of patterns that haven't been used recently
  */
 export async function applyTemporalDecay(dbPath) {
-    const swarmDir = path.join(process.cwd(), '.swarm');
+    const swarmDir = getMemoryRoot();
     const path_ = dbPath || path.join(swarmDir, 'memory.db');
     try {
         const initSqlJs = (await import('sql.js')).default;
@@ -1737,7 +1792,7 @@ export async function storeEntry(options) {
     }
     // Fallback: raw sql.js
     const { key, value, namespace = 'default', generateEmbeddingFlag = true, tags = [], ttl, dbPath: customPath, upsert = false } = options;
-    const swarmDir = path.resolve(process.cwd(), '.swarm');
+    const swarmDir = getMemoryRoot();
     const dbPath = customPath ? path.resolve(customPath) : path.join(swarmDir, 'memory.db');
     try {
         if (!fs.existsSync(dbPath)) {
@@ -1830,7 +1885,7 @@ export async function searchEntries(options) {
     // Fallback: raw sql.js
     const { query, namespace, limit = 10, threshold = 0.3, dbPath: customPath } = options;
     const effectiveNamespace = namespace || 'all';
-    const swarmDir = path.resolve(process.cwd(), '.swarm');
+    const swarmDir = getMemoryRoot();
     const dbPath = customPath ? path.resolve(customPath) : path.join(swarmDir, 'memory.db');
     const startTime = Date.now();
     try {
@@ -2001,7 +2056,7 @@ export async function listEntries(options) {
     }
     // Fallback: raw sql.js
     const { namespace, limit = 20, offset = 0, dbPath: customPath } = options;
-    const swarmDir = path.join(process.cwd(), '.swarm');
+    const swarmDir = getMemoryRoot();
     const dbPath = customPath || path.join(swarmDir, 'memory.db');
     try {
         if (!fs.existsSync(dbPath)) {
@@ -2086,7 +2141,7 @@ export async function getEntry(options) {
     }
     // Fallback: raw sql.js
     const { key, namespace = 'default', dbPath: customPath } = options;
-    const swarmDir = path.join(process.cwd(), '.swarm');
+    const swarmDir = getMemoryRoot();
     const dbPath = customPath || path.join(swarmDir, 'memory.db');
     try {
         if (!fs.existsSync(dbPath)) {
@@ -2190,7 +2245,7 @@ export async function deleteEntry(options) {
     }
     // Fallback: raw sql.js
     const { key, namespace = 'default', dbPath: customPath } = options;
-    const swarmDir = path.join(process.cwd(), '.swarm');
+    const swarmDir = getMemoryRoot();
     const dbPath = customPath || path.join(swarmDir, 'memory.db');
     try {
         if (!fs.existsSync(dbPath)) {

package/v3/@claude-flow/cli/dist/src/services/headless-worker-executor.js

@@ -831,13 +831,33 @@ Analyze the above codebase context and provide your response following the forma
             // Set model
             // Resolve model: user env override > config override > default alias
             env.ANTHROPIC_MODEL = process.env.ANTHROPIC_MODEL || MODEL_IDS[options.model];
-            // Spawn claude CLI process
-            const child = spawn('claude', ['--print', prompt], {
+            // Spawn claude CLI process. #1852: previously the prompt was passed
+            // as a positional CLI arg. On Windows `claude` resolves to
+            // `claude.cmd`, which Node refuses to exec directly (CVE-2024-27980
+            // mitigation) — it routes through `cmd.exe /d /s /c`, which then
+            // re-tokenizes the entire command line including the prompt.
+            // Source-code prompts contain `>` `<` `&` `|` (arrow functions,
+            // comparisons, redirections) — cmd.exe parses those as redirects
+            // and creates zero-byte files in cwd named after the next token
+            // (`controller.abort()`, `{const`, `0`, `HTTP`, etc.).
+            //
+            // Fix: pipe the prompt via stdin instead. `child.stdin.end(prompt)`
+            // writes the prompt and closes stdin atomically — the EOF still
+            // unblocks `claude --print` (the original concern in #1395) but no
+            // shell tokenization touches the prompt.
+            const child = spawn('claude', ['--print'], {
                 cwd: this.projectRoot,
                 env,
-                stdio: ['ignore', 'pipe', 'pipe'], // 'ignore' closes stdin at spawn — fixes #1395 where claude --print blocks on EOF
+                stdio: ['pipe', 'pipe', 'pipe'],
                 windowsHide: true, // Prevent phantom console windows on Windows
             });
+            try {
+                child.stdin?.end(prompt);
+            }
+            catch {
+                // stdin already closed (e.g. spawn failed) — `error` handler below
+                // will surface the real cause.
+            }
             // Setup timeout
             const timeoutHandle = setTimeout(() => {
                 if (this.processPool.has(options.executionId)) {

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.d.ts

@@ -128,6 +128,15 @@ export declare class WorkerDaemon extends EventEmitter {
     /**
      * Check if another daemon instance is already running.
      * Returns the existing PID if alive, or null if no daemon is running.
+     *
+     * #1853: ignore self-PID matches. The detached-spawn path in
+     * `commands/daemon.ts` writes the child's PID into the file as a
+     * fallback after a 500ms wait. If the child reaches `start()` slower
+     * than the parent's 500ms wait (observed on Node 25 / macOS 26), the
+     * child reads its own PID back from the file and concludes "another
+     * daemon is already running" — so it exits before scheduling workers
+     * and `daemon status` reports STOPPED forever. A daemon process is
+     * never "another instance" of itself; treat self-match as absence.
      */
     private checkExistingDaemon;
     /**

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js

@@ -370,6 +370,15 @@ export class WorkerDaemon extends EventEmitter {
     /**
      * Check if another daemon instance is already running.
      * Returns the existing PID if alive, or null if no daemon is running.
+     *
+     * #1853: ignore self-PID matches. The detached-spawn path in
+     * `commands/daemon.ts` writes the child's PID into the file as a
+     * fallback after a 500ms wait. If the child reaches `start()` slower
+     * than the parent's 500ms wait (observed on Node 25 / macOS 26), the
+     * child reads its own PID back from the file and concludes "another
+     * daemon is already running" — so it exits before scheduling workers
+     * and `daemon status` reports STOPPED forever. A daemon process is
+     * never "another instance" of itself; treat self-match as absence.
      */
     checkExistingDaemon() {
         if (!existsSync(this.pidFile))
@@ -378,6 +387,10 @@ export class WorkerDaemon extends EventEmitter {
             const pid = parseInt(readFileSync(this.pidFile, 'utf-8').trim(), 10);
             if (isNaN(pid))
                 return null;
+            // #1853: a PID file containing our own PID is not "another daemon".
+            // Treat as absent so the start() path proceeds normally.
+            if (pid === process.pid)
+                return null;
             // Check if process is alive (signal 0 = existence check)
             process.kill(pid, 0);
             return pid; // Process is alive

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.7.0-alpha.13",
+  "version": "3.7.0-alpha.15",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",