Commit Graph

2 Commits

Author SHA1 Message Date
Reuven 1884ed1010 fix(3.7.0-alpha.12): batch resolve issue-fix loop #1839-#1847
Closes #1839, #1840, #1841, #1842, #1843, #1844, #1845, #1846, #1847.

#1839 — bin/cli.js, bin/mcp-server.js, config-adapter.ts: rename
  serverInfo.name 'claude-flow' → 'ruflo' so MCP wire identity matches the
  package name. Live probe of `ruflo mcp start` now returns
  `serverInfo.name="ruflo"` (verified post-build).

#1840 — init/executor.ts: detectExistingRufloMCP() now also walks
  parsed.projects[*].mcpServers.ruflo with normalized path matching
  (lowercase + forward-slash) so `claude mcp add ruflo` registrations
  stored project-scoped in ~/.claude.json are detected and init skips
  writing a duplicate .mcp.json.

#1841 — init/mcp-generator.ts: generated .mcp.json now keys
  `mcpServers.ruflo` instead of legacy `mcpServers['claude-flow']`. The
  printed `claude mcp add` instructions match. Prevents the
  duplicate-tool-prefix problem when init runs over an existing ruflo
  registration.

#1842 — commands/doctor.ts: checkMcpServers() now traverses
  ~/.claude.json.projects[*].mcpServers in addition to top-level
  mcpServers, so doctor stops warning "No MCP config found" when a
  working project-scoped ruflo registration exists.

#1843 — mcp-tools/system-tools.ts: exclude `unknown` from health
  denominator (was dragging the score down even when actionable checks
  were green) and surface as `advisory` count. Add YAML config and
  sql.js/HNSW/.swarm/ruvector memory paths to detection. Local probe:
  4 healthy / 5 actionable = 80% (was 4/8 = 50%) with 3 advisory.

#1844 — services/worker-daemon.ts: WorkerDaemon now reads
  .claude-flow/config.yaml (and .yml) when config.json is absent, with
  lazy `yaml` import so missing dep falls back to a clear warning.
  Adds yaml@^2.8.0 to runtime deps. Logs the chosen source.

#1845 — services/worker-daemon.ts + mcp-tools/hooks-tools.ts: durable
  queue boundary between MCP dispatch and daemon. mcp__hooks_worker-
  dispatch now writes .claude-flow/daemon-queue/<id>.json (the
  process-local Map was invisible to the daemon). The daemon polls this
  directory every 5s, executes triggerWorker(), and moves processed
  entries to .processed/. Adds `mcp-only` status for queue-write
  failures so we never claim `queued` without proof on disk.

#1846 — mcp-tools/memory-tools.ts + commands/memory.ts: feature-detect
  smartSearch on the resolved @claude-flow/memory build. When absent
  (older published memory packages predate the export), fall through to
  plain semantic search with an explicit warning + `smartFallback`
  field on the response, instead of throwing
  `smartSearch is not a function`.

#1847 — mcp-tools/hooks-tools.ts: hooks_pretrain now emits an explicit
  note when a non-empty corpus produces zero patterns, naming the
  supported extraction extensions (.ts/.js/.py/.go/.rs/.java) and
  clarifying that pretrain is a separate axis from live trajectories
  and statusline state. Local probe on a Markdown vault returns the
  new note correctly.

src/index.ts: pre-existing TS strict-null error in showCommandHelp()
  that was preventing `npm run build` (introduced by #1791.4 / 93b97548e)
  fixed by extracting a non-null `current: Command` local instead of
  reassigning the optional `command`. Unblocks publish + restores the
  integration-docker `npm run build succeeds` test.

Verification:
- 1963 tests pass / 0 fail (was 1962 / 1 due to the index.ts TS error)
- Live MCP probe: serverInfo.name="ruflo" ✅
- Live mcp-generator: emits mcpServers.ruflo ✅
- Live system_health: 80% (4/5 healthy, 3 advisory) ✅
- Live hooks_pretrain on Markdown vault: emits explicit note ✅

Published @claude-flow/cli@3.7.0-alpha.12, claude-flow@3.7.0-alpha.12,
ruflo@3.7.0-alpha.12 with all dist-tags (alpha, latest, v3alpha for
cli/claude-flow; alpha, latest for ruflo).

Co-Authored-By: RuFlo <ruv@ruv.net>
2026-05-08 09:36:58 -04:00
rUv 1e105c799b fix: v3.5.8-v3.5.14 ADR-061 security fixes, cross-platform hooks, Windows parity
ADR-061 Deep Audit Fixes (12 P0/P1/D issues):
- S-1: Replace execSync with execFileSync to prevent command injection (GCS)
- S-2: Add MAX_BUFFER constant (10MB) to prevent unbounded stdout capture
- S-3: Add validatePackageName() to sanitize plugin names
- S-4: Add IPFS CID format validation before fetch
- S-5: Add buffer size limits to execSync calls
- D-1: Fix CFP magic-number check (use subarray, not slice)
- D-2: Fix unsupported format error (throw instead of silent fallback)
- D-3: Fix MCP partial-JSON accumulator (per-session buffering)
- D-4: Fix duplicate provider registration guard
- D-5: Fix memory namespace parameter passthrough
- D-6: Fix process command error handler (use err.message)
- D-7: Fix GCS credential loading (resolve path, validate fields)

ADR-062 Cross-Platform Hook Commands:
- Replace node -e "..." one-liners with node script subcommand invocation
- Add cmd /c prefix on Windows to bypass PowerShell stdin issues
- Fix stdin reading with 500ms timeout (prevents Windows hanging)
- Guarantee process.exitCode = 0 in all hook scripts
- StatusLine uses plain node (no cmd /c) for proper stdin forwarding
- Fix invalid SubagentEnd → SubagentStop hook event name
- Restore valid SubagentStart hook event

Tests: 1600 passed, 46 skipped across 23 test files

Co-Authored-By: claude-flow <ruv@ruv.net>
2026-03-06 00:25:28 +00:00