claude-flow 3.7.0-alpha.20 → 3.7.0-alpha.21

package/.claude/scheduled_tasks.lock

@@ -1 +1 @@
-{"sessionId":"e8acbe6b-1513-4c00-ac30-2b486317c5b1","pid":7565,"procStart":"Sat May  9 13:35:07 2026","acquiredAt":1778338395740}
+{"sessionId":"47380e10-1915-412b-80f1-c03ac7d0ea24","pid":59856,"acquiredAt":1778091867601}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.7.0-alpha.20",
+  "version": "3.7.0-alpha.21",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -38,6 +38,11 @@ function ensureMemoryDir() {
 const MAX_KEY_LENGTH = 1024;
 const MAX_VALUE_SIZE = 1024 * 1024; // 1MB
 const MAX_QUERY_LENGTH = 4096;
+// #1425 — single source of truth for the dangerous-character set rejected by
+// validateMemoryInput. Imported by sanitizeMemoryKey so write-side sanitization
+// and read-side rejection can never drift apart (the symmetry bug behind #1884).
+const DANGEROUS_KEY_CHARS = /[;&|`$(){}[\]<>!#\\\0]|\.\.[/\\]/g;
+const DANGEROUS_KEY_PATTERN = /[;&|`$(){}[\]<>!#\\\0]|\.\.[/\\]/;
 function validateMemoryInput(key, value, query, namespace) {
     if (key && key.length > MAX_KEY_LENGTH) {
         throw new Error(`Key exceeds maximum length of ${MAX_KEY_LENGTH} characters`);
@@ -49,14 +54,64 @@ function validateMemoryInput(key, value, query, namespace) {
         throw new Error(`Query exceeds maximum length of ${MAX_QUERY_LENGTH} characters`);
     }
     // Reject path traversal and shell metacharacters in keys/namespaces (#1425)
-    const dangerousPattern = /[;&|`$(){}[\]<>!#\\\0]|\.\.[/\\]/;
-    if (key && dangerousPattern.test(key)) {
+    if (key && DANGEROUS_KEY_PATTERN.test(key)) {
         throw new Error('Key contains disallowed characters');
     }
-    if (namespace && dangerousPattern.test(namespace)) {
+    if (namespace && DANGEROUS_KEY_PATTERN.test(namespace)) {
         throw new Error('Namespace contains disallowed characters');
     }
 }
+// #1884 — sanitize a key produced from arbitrary input (markdown headings,
+// frontmatter names, file names) so it survives validateMemoryInput on the
+// read/delete path. Replaces every dangerous char with `_`. Truncates to
+// MAX_KEY_LENGTH so the bound check in validateMemoryInput also passes.
+// Keep this in sync with DANGEROUS_KEY_PATTERN — they share DANGEROUS_KEY_CHARS.
+function sanitizeMemoryKey(key) {
+    const safe = key.replace(DANGEROUS_KEY_CHARS, '_');
+    return safe.length > MAX_KEY_LENGTH ? safe.slice(0, MAX_KEY_LENGTH) : safe;
+}
+// #1883 — resolve the Claude-Code project memory directory for the *current*
+// project. Claude Code hashes the project path differently per host OS, and
+// our previous logic only POSIX-slash-replaced cwd, which breaks for:
+//   - WSL bridges where cwd is `/mnt/<drive>/...` but Claude Code is on Windows
+//   - paths containing spaces (Claude Code replaces spaces with dashes)
+//   - any leading slash on POSIX (Claude Code strips it)
+// Strategy: try several candidate hashes and return the first one with a
+// memory dir that exists. An explicit `projectPathOverride` short-circuits
+// the heuristics for callers that know the canonical project path.
+function resolveProjectMemoryDir(claudeProjectsDir, projectPathOverride) {
+    const candidates = new Set();
+    const sources = [];
+    if (projectPathOverride && projectPathOverride.length > 0) {
+        sources.push(projectPathOverride);
+    }
+    else {
+        sources.push(process.cwd());
+    }
+    for (const source of sources) {
+        // Candidate 1: legacy POSIX hash — what shipped before #1883
+        candidates.add(source.replace(/\//g, '-'));
+        // Candidate 2: WSL `/mnt/<drive>/...` translated to Claude-Code Windows hash
+        // e.g. `/mnt/c/Users/x/Project Name` → `C--Users-x-Project-Name`
+        const wsl = source.match(/^\/mnt\/([a-z])(\/.*)?$/i);
+        if (wsl) {
+            const drive = wsl[1].toUpperCase();
+            const rest = (wsl[2] ?? '').replace(/\//g, '-').replace(/ /g, '-');
+            candidates.add(`${drive}-${rest}`);
+        }
+        // Candidate 3: POSIX hash with leading dash stripped (Claude Code on macOS/Linux)
+        const stripped = source.replace(/\//g, '-').replace(/^-+/, '');
+        candidates.add(stripped);
+        // Candidate 4: spaces replaced with dashes (Claude Code's space rule)
+        candidates.add(source.replace(/\//g, '-').replace(/ /g, '-'));
+    }
+    for (const projectHash of candidates) {
+        const memDir = join(claudeProjectsDir, projectHash, 'memory');
+        if (existsSync(memDir))
+            return { memDir, projectHash };
+    }
+    return null;
+}
 /**
  * Check if legacy JSON store exists in old .claude-flow/memory/ location
  */
@@ -613,13 +668,14 @@ export const memoryTools = [
     // ===== Claude Code Memory Bridge Tools =====
     {
         name: 'memory_import_claude',
-        description: 'Import Claude Code auto-memory files into AgentDB with ONNX vector embeddings. Reads ~/.claude/projects/*/memory/*.md files, parses YAML frontmatter, splits into sections, and stores with 384-dim embeddings for semantic search. Use allProjects=true to import from ALL Claude projects.',
+        description: 'Import Claude Code auto-memory files into AgentDB with ONNX vector embeddings. Reads ~/.claude/projects/*/memory/*.md files, parses YAML frontmatter, splits into sections, and stores with 384-dim embeddings for semantic search. Use allProjects=true to import from ALL Claude projects. Pass projectPath to override cwd-based detection (#1883 — required when Ruflo runs in WSL but Claude Code is on Windows).',
         category: 'memory',
         inputSchema: {
             type: 'object',
             properties: {
                 allProjects: { type: 'boolean', description: 'Import from all Claude projects (default: current project only)' },
                 namespace: { type: 'string', description: 'Target namespace (default: "claude-memories")' },
+                projectPath: { type: 'string', description: '#1883 — explicit project path to hash, used when cwd does not match Claude Code\'s view (e.g. WSL bridge to Windows host). Pass the canonical project root as Claude Code sees it.' },
             },
         },
         handler: async (input) => {
@@ -632,6 +688,7 @@ export const memoryTools = [
                     return { success: false, imported: 0, error: vNs.error };
             }
             const allProjects = input.allProjects;
+            const projectPathOverride = input.projectPath;
             const claudeProjectsDir = join(homedir(), '.claude', 'projects');
             // Find memory files
             const memoryFiles = [];
@@ -654,14 +711,13 @@ export const memoryTools = [
                 }
             }
             else {
-                // Current project only — find by CWD hash
-                const cwd = process.cwd();
-                const projectHash = cwd.replace(/\//g, '-');
-                const memDir = join(claudeProjectsDir, projectHash, 'memory');
-                if (existsSync(memDir)) {
+                // #1883 — current project: try multiple candidate hashes (POSIX, WSL-translated,
+                // leading-dash-stripped, space-replaced). Caller can pass projectPath to override.
+                const resolved = resolveProjectMemoryDir(claudeProjectsDir, projectPathOverride);
+                if (resolved) {
                     try {
-                        for (const file of readdirSync(memDir).filter((f) => f.endsWith('.md'))) {
-                            memoryFiles.push({ path: join(memDir, file), project: projectHash, file });
+                        for (const file of readdirSync(resolved.memDir).filter((f) => f.endsWith('.md'))) {
+                            memoryFiles.push({ path: join(resolved.memDir, file), project: resolved.projectHash, file });
                         }
                     }
                     catch { /* scan error */ }
@@ -707,7 +763,10 @@ export const memoryTools = [
                     // Split into sections for granular search
                     const sections = body.split(/^(?=## )/m).filter(s => s.trim().length > 20);
                     if (sections.length === 0 && body.length > 10) {
-                        await storeEntry({ key: `claude:${memFile.project}:${name}`, value: body.slice(0, 4096), namespace: ns, generateEmbeddingFlag: true });
+                        // #1884 — sanitize key so memory_delete can later remove it. Without
+                        // this, dangerous chars from frontmatter `name` strand the key.
+                        const key = sanitizeMemoryKey(`claude:${memFile.project}:${name}`);
+                        await storeEntry({ key, value: body.slice(0, 4096), namespace: ns, generateEmbeddingFlag: true });
                         imported++;
                     }
                     else {
@@ -717,7 +776,10 @@ export const memoryTools = [
                             const sectionBody = section.replace(/^##\s+.+\n/, '').trim();
                             if (sectionBody.length < 10)
                                 continue;
-                            await storeEntry({ key: `claude:${memFile.project}:${name}:${sectionTitle.slice(0, 50)}`, value: sectionBody.slice(0, 4096), namespace: ns, generateEmbeddingFlag: true });
+                            // #1884 — sanitize so any dangerous chars in the heading don't
+                            // produce keys memory_delete will reject.
+                            const key = sanitizeMemoryKey(`claude:${memFile.project}:${name}:${sectionTitle.slice(0, 50)}`);
+                            await storeEntry({ key, value: sectionBody.slice(0, 4096), namespace: ns, generateEmbeddingFlag: true });
                             imported++;
                         }
                     }

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.7.0-alpha.20",
+  "version": "3.7.0-alpha.21",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",