claude-flow 3.7.0-alpha.76 → 3.7.0-alpha.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.7.0-alpha.76",
+  "version": "3.7.0-alpha.78",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/init.js

@@ -145,7 +145,13 @@ const initAction = async (ctx) => {
     const full = ctx.flags.full;
     const skipClaude = ctx.flags['skip-claude'];
     const onlyClaude = ctx.flags['only-claude'];
-    const noGlobal = ctx.flags['no-global'];
+    // #2098A — the parser handles `--no-foo` by stripping the prefix and
+    // storing `flags.foo = false` (parser.ts:291-294), not by storing
+    // `flags['no-foo'] = true`. So `--no-global` lands as
+    // `ctx.flags.global === false`. The old read of `flags['no-global']`
+    // was always undefined and silently no-op'd — every user with the flag
+    // set still got `~/.claude/CLAUDE.md` modified. Read the real key.
+    const noGlobal = ctx.flags['no-global'] === true || ctx.flags['global'] === false;
     const allAgents = ctx.flags['all-agents'];
     const codexMode = ctx.flags.codex;
     const dualMode = ctx.flags.dual;

package/v3/@claude-flow/cli/dist/src/init/claudemd-generator.js

@@ -15,6 +15,7 @@ function behavioralRules() {
 - NEVER save working files or tests to root — use \`/src\`, \`/tests\`, \`/docs\`, \`/config\`, \`/scripts\`
 - ALWAYS read a file before editing it
 - NEVER commit secrets, credentials, or .env files
+- NEVER add a \`Co-Authored-By\` trailer to user commits unless this project's \`.claude/settings.json\` has \`attribution.commit\` set (#2078). The Claude Code Bash tool may suggest one in its default commit-message template — ignore it. \`Co-Authored-By\` is semantic authorship attribution under git/GitHub convention; the tool is the facilitator, not a co-author.
 - Keep files under 500 lines
 - Validate input at system boundaries`;
 }

package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js

@@ -60,14 +60,31 @@ export async function callAnthropicMessages(input) {
     const explicitProvider = (process.env.RUFLO_PROVIDER || '').toLowerCase();
     const ollamaKey = process.env.OLLAMA_API_KEY;
     const anthropicKey = process.env.ANTHROPIC_API_KEY;
-    const useOllama = explicitProvider === 'ollama' || (!anthropicKey && !!ollamaKey);
+    // #2042 — OpenRouter is an OpenAI-compat endpoint that fronts dozens of
+    // providers. Reporter (@ummcke00) had `providers.openrouter.apiKey` in
+    // their config.yaml but agent_execute hardcoded Anthropic. Detect via
+    // explicit RUFLO_PROVIDER=openrouter OR presence of OPENROUTER_API_KEY
+    // when no Anthropic key is available (same precedence as the Ollama
+    // branch above).
+    const openrouterKey = process.env.OPENROUTER_API_KEY;
+    const useOpenRouter = explicitProvider === 'openrouter' || (!anthropicKey && !!openrouterKey);
+    const useOllama = explicitProvider === 'ollama' || (!anthropicKey && !!ollamaKey && !openrouterKey);
+    if (useOpenRouter && openrouterKey) {
+        return callOpenAICompat({
+            ...input,
+            apiKey: openrouterKey,
+            baseUrl: process.env.OPENROUTER_BASE_URL || 'https://openrouter.ai/api',
+            providerLabel: 'openrouter',
+            defaultModel: process.env.OPENROUTER_DEFAULT_MODEL || 'anthropic/claude-3.5-sonnet',
+        });
+    }
     if (useOllama && ollamaKey) {
         return callOllamaCompat({ ...input, apiKey: ollamaKey });
     }
     if (!anthropicKey) {
         return {
             success: false,
-            error: 'No LLM provider configured. Set ANTHROPIC_API_KEY (Tier-3) or OLLAMA_API_KEY (Tier-2 Ollama Cloud — see issue #1725).',
+            error: 'No LLM provider configured. Set ANTHROPIC_API_KEY (Tier-3), OPENROUTER_API_KEY (#2042), or OLLAMA_API_KEY (Tier-2 — #1725).',
         };
     }
     const model = input.model || DEFAULT_ANTHROPIC_MODEL;
@@ -202,6 +219,88 @@ async function callOllamaCompat(input) {
         };
     }
 }
+/**
+ * Generic OpenAI-compat caller for OpenRouter and other OpenAI-shaped
+ * endpoints. #2042 — reporter (@ummcke00) configured OpenRouter via
+ * config.yaml but agent_execute hardcoded the Anthropic fetch. This is
+ * the same shape as `callOllamaCompat` but routes to a configurable
+ * baseUrl + sends an OpenRouter-friendly default model when none is
+ * specified. Logical model names (haiku/sonnet/opus) pass through —
+ * OpenRouter accepts vendor-prefixed names like `anthropic/claude-3.5-sonnet`.
+ */
+async function callOpenAICompat(input) {
+    const model = resolveOpenAICompatModel(input.model, input.defaultModel);
+    const startedAt = Date.now();
+    const base = input.baseUrl.replace(/\/+$/, '');
+    const url = `${base}/v1/chat/completions`;
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), input.timeoutMs || 60000);
+        const messages = [];
+        if (input.systemPrompt)
+            messages.push({ role: 'system', content: input.systemPrompt });
+        messages.push({ role: 'user', content: input.prompt });
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${input.apiKey}`,
+                'content-type': 'application/json',
+                // OpenRouter convention: identify the integrating app for analytics
+                // and rate-limit tiering. Harmless on other OpenAI-compat backends.
+                'HTTP-Referer': 'https://github.com/ruvnet/ruflo',
+                'X-Title': 'Ruflo',
+            },
+            body: JSON.stringify({
+                model,
+                max_tokens: input.maxTokens || 1024,
+                temperature: typeof input.temperature === 'number' ? input.temperature : 0.7,
+                messages,
+            }),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        if (!res.ok) {
+            const errText = await res.text().catch(() => '<unreadable error body>');
+            return { success: false, model, error: `${input.providerLabel} API error ${res.status}: ${errText.slice(0, 400)}` };
+        }
+        const data = await res.json();
+        const textOut = data.choices?.[0]?.message?.content ?? '';
+        const usage = data.usage ?? {};
+        return {
+            success: true,
+            model: data.model || model,
+            messageId: data.id,
+            stopReason: data.choices?.[0]?.finish_reason ?? 'end_turn',
+            output: textOut,
+            usage: {
+                inputTokens: usage.prompt_tokens ?? 0,
+                outputTokens: usage.completion_tokens ?? 0,
+                totalTokens: usage.total_tokens ?? 0,
+            },
+            durationMs: Date.now() - startedAt,
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            model,
+            error: err instanceof Error ? err.message : String(err),
+            durationMs: Date.now() - startedAt,
+        };
+    }
+}
+function resolveOpenAICompatModel(input, fallback) {
+    if (!input)
+        return fallback;
+    // Logical Claude names → OpenRouter Anthropic-vendored names
+    if (input === 'haiku')
+        return 'anthropic/claude-3.5-haiku';
+    if (input === 'sonnet' || input === 'inherit')
+        return 'anthropic/claude-3.5-sonnet';
+    if (input === 'opus')
+        return 'anthropic/claude-3-opus';
+    return input;
+}
 function resolveOllamaModel(input) {
     const DEFAULT = 'gpt-oss:120b-cloud';
     if (!input)
@@ -232,15 +331,6 @@ export function resolveAnthropicModel(input) {
     return input;
 }
 export async function executeAgentTask(input) {
-    const apiKey = process.env.ANTHROPIC_API_KEY;
-    if (!apiKey) {
-        return {
-            success: false,
-            agentId: input.agentId,
-            error: 'ANTHROPIC_API_KEY not set in environment',
-            remediation: 'Set the env var and re-run. The key is read at call time.',
-        };
-    }
     const store = loadAgentStore();
     const agent = store.agents[input.agentId];
     if (!agent)
@@ -256,73 +346,50 @@ export async function executeAgentTask(input) {
     agent.taskCount = (agent.taskCount || 0) + 1;
     saveAgentStore(store);
     const startedAt = Date.now();
-    try {
-        const controller = new AbortController();
-        const timeoutMs = input.timeoutMs || 60000;
-        const timer = setTimeout(() => controller.abort(), timeoutMs);
-        const res = await fetch('https://api.anthropic.com/v1/messages', {
-            method: 'POST',
-            headers: {
-                'x-api-key': apiKey,
-                'anthropic-version': '2023-06-01',
-                'content-type': 'application/json',
-            },
-            body: JSON.stringify({
-                model: anthropicModel,
-                max_tokens: input.maxTokens || 1024,
-                temperature: typeof input.temperature === 'number' ? input.temperature : 0.7,
-                system: systemPrompt,
-                messages: [{ role: 'user', content: input.prompt }],
-            }),
-            signal: controller.signal,
-        });
-        clearTimeout(timer);
-        if (!res.ok) {
-            const errText = await res.text().catch(() => '<unreadable error body>');
-            agent.status = 'idle';
-            saveAgentStore(store);
-            return {
-                success: false,
-                agentId: input.agentId,
-                model: anthropicModel,
-                error: `Anthropic API error ${res.status}: ${errText.slice(0, 400)}`,
-            };
-        }
-        const data = await res.json();
-        const textOut = data.content
-            .filter(c => c.type === 'text' && typeof c.text === 'string')
-            .map(c => c.text)
-            .join('');
-        const result = {
+    // #2042 — delegate to callAnthropicMessages so the v3 provider router
+    // (Anthropic / Ollama / OpenRouter) governs which backend is hit. The
+    // previous inline `fetch('https://api.anthropic.com/...')` bypassed
+    // the router entirely and forced an ANTHROPIC_API_KEY error for every
+    // non-Anthropic deployment. Reporter (@ummcke00) had OpenRouter
+    // configured but the bypass made the agent unreachable.
+    const result = await callAnthropicMessages({
+        model: anthropicModel,
+        prompt: input.prompt,
+        systemPrompt,
+        maxTokens: input.maxTokens,
+        temperature: input.temperature,
+        timeoutMs: input.timeoutMs,
+    });
+    agent.status = 'idle';
+    if (result.success) {
+        const out = {
             success: true,
             agentId: input.agentId,
-            messageId: data.id,
-            model: data.model,
-            stopReason: data.stop_reason,
-            output: textOut,
-            usage: {
-                inputTokens: data.usage.input_tokens,
-                outputTokens: data.usage.output_tokens,
-                totalTokens: data.usage.input_tokens + data.usage.output_tokens,
-            },
-            durationMs: Date.now() - startedAt,
+            messageId: result.messageId,
+            model: result.model,
+            stopReason: result.stopReason,
+            output: result.output,
+            usage: result.usage,
+            durationMs: result.durationMs ?? Date.now() - startedAt,
         };
-        agent.status = 'idle';
-        agent.lastResult = result;
-        saveAgentStore(store);
-        return result;
-    }
-    catch (err) {
-        agent.status = 'idle';
+        agent.lastResult = out;
         saveAgentStore(store);
-        const msg = err instanceof Error ? err.message : String(err);
-        return {
-            success: false,
-            agentId: input.agentId,
-            model: anthropicModel,
-            error: `agent_execute failed: ${msg}`,
-            durationMs: Date.now() - startedAt,
-        };
+        return out;
     }
+    saveAgentStore(store);
+    // No-provider-configured error → surface the same actionable message
+    // the router built, with a #2042-aware remediation pointer.
+    const noProvider = (result.error || '').includes('No LLM provider configured');
+    return {
+        success: false,
+        agentId: input.agentId,
+        model: anthropicModel,
+        error: result.error || 'agent_execute failed',
+        durationMs: result.durationMs ?? Date.now() - startedAt,
+        ...(noProvider && {
+            remediation: 'Set one of ANTHROPIC_API_KEY, OPENROUTER_API_KEY (+ optional OPENROUTER_BASE_URL), or OLLAMA_API_KEY. ' +
+                'Or set RUFLO_PROVIDER=openrouter|ollama to force a specific provider.',
+        }),
+    };
 }
 //# sourceMappingURL=agent-execute-core.js.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/agent-tools.js

@@ -174,6 +174,10 @@ export const agentTools = [
             properties: {
                 agentType: { type: 'string', description: 'Type of agent to spawn' },
                 agentId: { type: 'string', description: 'Optional custom agent ID' },
+                // #2085 — accept swarmId so spawned agents register in the
+                // swarm.agents array that swarm_status reports. Omit to register
+                // with the most-recently-created swarm.
+                swarmId: { type: 'string', description: 'Optional swarm to register the agent with (defaults to most-recent swarm)' },
                 config: { type: 'object', description: 'Agent configuration' },
                 domain: { type: 'string', description: 'Agent domain' },
                 model: {
@@ -217,6 +221,33 @@ export const agentTools = [
             };
             store.agents[agentId] = agent;
             saveAgentStore(store);
+            // #2085 — also push to the swarm store's agents array so that
+            // swarm_status reports the new agent. Without this, agent_spawn
+            // and swarm_status read/write separate stores and agents added
+            // post-init never show up in swarm_status.agents — confirmed for
+            // all topologies (hierarchical, mesh, etc.).
+            try {
+                const { loadSwarmStore: _loadSwarmStore, saveSwarmStore: _saveSwarmStore } = await import('./swarm-tools.js');
+                const swarmStore = _loadSwarmStore();
+                let targetSwarmId = input.swarmId || '';
+                if (!targetSwarmId) {
+                    // Default to the most-recently-created swarm.
+                    const all = Object.values(swarmStore.swarms);
+                    const latest = all.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime())[0];
+                    targetSwarmId = latest?.swarmId || '';
+                }
+                if (targetSwarmId && swarmStore.swarms[targetSwarmId]) {
+                    const swarm = swarmStore.swarms[targetSwarmId];
+                    if (!Array.isArray(swarm.agents))
+                        swarm.agents = [];
+                    // Idempotent — don't duplicate if agent_spawn is retried.
+                    if (!swarm.agents.includes(agentId)) {
+                        swarm.agents.push(agentId);
+                        _saveSwarmStore(swarmStore);
+                    }
+                }
+            }
+            catch { /* swarm store unavailable — agent still registered globally */ }
             // Record agent in graph database (ADR-087, best-effort)
             try {
                 const { addNode } = await import('../ruvector/graph-backend.js');

package/v3/@claude-flow/cli/dist/src/mcp-tools/swarm-tools.d.ts

@@ -5,5 +5,33 @@
  * Replaces previous stub implementations with real state tracking.
  */
 import { type MCPTool } from './types.js';
+interface SwarmState {
+    swarmId: string;
+    topology: string;
+    maxAgents: number;
+    status: 'initializing' | 'running' | 'paused' | 'shutting_down' | 'terminated';
+    agents: string[];
+    tasks: string[];
+    config: Record<string, unknown>;
+    createdAt: string;
+    updatedAt: string;
+    /**
+     * #1799 — process that initialized this swarm. Used by reconciliation
+     * on `loadSwarmStore()` to detect orphan entries whose host process has
+     * already exited (common on Windows where backgrounded daemons don't
+     * always survive shell exit). Optional for backward compat with
+     * pre-#1799 stores.
+     */
+    pid?: number;
+    /** Reason set when status was forced to 'terminated' by reconciliation. */
+    terminationReason?: string;
+}
+interface SwarmStore {
+    swarms: Record<string, SwarmState>;
+    version: string;
+}
+export declare function loadSwarmStore(): SwarmStore;
+export declare function saveSwarmStore(store: SwarmStore): void;
 export declare const swarmTools: MCPTool[];
+export {};
 //# sourceMappingURL=swarm-tools.d.ts.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/swarm-tools.js

@@ -78,7 +78,9 @@ function reconcileOrphanSwarms(store) {
     }
     return reconciled;
 }
-function loadSwarmStore() {
+// #2085 — exported so `agent-tools.ts agent_spawn` can push into
+// `swarm.agents` (the field `swarm_status` reads).
+export function loadSwarmStore() {
     let store = { swarms: {}, version: '3.0.0' };
     try {
         const path = getSwarmStatePath();
@@ -99,7 +101,7 @@ function loadSwarmStore() {
     }
     return store;
 }
-function saveSwarmStore(store) {
+export function saveSwarmStore(store) {
     ensureSwarmDir();
     writeFileSync(getSwarmStatePath(), JSON.stringify(store, null, 2), 'utf-8');
 }

package/v3/@claude-flow/cli/dist/src/services/headless-worker-executor.js

@@ -859,11 +859,19 @@ Analyze the above codebase context and provide your response following the forma
             // writes the prompt and closes stdin atomically — the EOF still
             // unblocks `claude --print` (the original concern in #1395) but no
             // shell tokenization touches the prompt.
+            // #2098B / #2093 — `claude --print` can spawn grandchildren (MCP
+            // server stdio bridges, plugin tools). When the head times out a
+            // plain `child.kill()` only signals the head; grandchildren get
+            // reparented to init and survive — the symptom @maxstefanakis1114
+            // diagnosed as a 5-second redispatch + subprocess-table growth.
+            // `detached: true` puts the child in its own process group so we
+            // can signal the whole tree with `process.kill(-pid, sig)`.
             const child = spawn('claude', ['--print'], {
                 cwd: this.projectRoot,
                 env,
                 stdio: ['pipe', 'pipe', 'pipe'],
                 windowsHide: true, // Prevent phantom console windows on Windows
+                detached: process.platform !== 'win32',
             });
             try {
                 child.stdin?.end(prompt);
@@ -872,14 +880,29 @@ Analyze the above codebase context and provide your response following the forma
                 // stdin already closed (e.g. spawn failed) — `error` handler below
                 // will surface the real cause.
             }
+            // Kill the whole process group on POSIX, fall back to the child on
+            // Windows (where setsid-style detach isn't available the same way).
+            const killTree = (signal) => {
+                if (process.platform !== 'win32' && typeof child.pid === 'number') {
+                    try {
+                        process.kill(-child.pid, signal);
+                        return;
+                    }
+                    catch { /* fall through */ }
+                }
+                try {
+                    child.kill(signal);
+                }
+                catch { /* already dead */ }
+            };
             // Setup timeout
             const timeoutHandle = setTimeout(() => {
                 if (this.processPool.has(options.executionId)) {
-                    child.kill('SIGTERM');
+                    killTree('SIGTERM');
                     // Give it a moment to terminate gracefully
                     setTimeout(() => {
                         if (!child.killed) {
-                            child.kill('SIGKILL');
+                            killTree('SIGKILL');
                         }
                     }, 5000);
                 }
@@ -947,7 +970,7 @@ Analyze the above codebase context and provide your response following the forma
                 if (!this.processPool.has(options.executionId))
                     return;
                 resolved = true;
-                child.kill('SIGTERM');
+                killTree('SIGTERM');
                 cleanup();
                 resolve({
                     success: false,

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.7.0-alpha.76",
+  "version": "3.7.0-alpha.78",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",