Files
Mr. Makandruflo 2015071b98 fix(plugins): run the installed ruflo CLI before npx @claude-flow/cli@latest in cost-tracker, adr and metaharness (#3558)
A plugin installed from the Claude Code marketplace is copied on its own to
~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/, with no CLI next
to it. ruflo-cost-tracker and ruflo-adr always spawned
`npx -y @claude-flow/cli@latest` for their memory/hooks calls, and #3366's
resolveRufloCli() in ruflo-metaharness only looks for the CLI that ships the
plugin or a repo checkout, so all three fell back to npx @latest there. For
cost-tracker that is every turn (its Stop hook): a registry round trip per
call, and a different CLI than the one the user installed, including a
release published minutes earlier. Each such run also refreshes
~/.claude/helpers ahead of the installed CLI.

All three plugins now resolve the CLI in the same order:
1. CLI_CORE=1: unchanged (npx @claude-flow/cli-core@alpha, ADR-100); adr
   still ignores it (#2781).
2. The CLI that ships the plugin, or a repo checkout, with #3366's guards
   (package.json named @claude-flow/cli + bin/cli.js + dist/src/index.js).
3. New: `ruflo`, then `claude-flow`, on PATH. fs-only probe (X_OK + isFile),
   shell: false; relative and empty PATH entries are skipped; on win32 an npm
   `.cmd` shim is mapped to its package's bin entry and run with node, and
   anything unmappable is skipped, never run through cmd.exe.
4. The unchanged npx @latest fallback.

- ruflo-cost-tracker: new scripts/_ruflo-cli.mjs; spawnNpxSync() in _npx.mjs
  sends `@claude-flow/cli@latest` to the resolved CLI (signature unchanged,
  no call-site edits).
- ruflo-adr: new scripts/lib/ruflo-cli.mjs; import.mjs, reindex.mjs and
  verify.mjs use it (verify too, so reader and writers share a store, #2781).
- ruflo-metaharness: step 3 added to resolveRufloCli() in _invoke.mjs.
- Test seams RUFLO_PLUGIN_SKIP_LOCAL_CLI=1 / RUFLO_PLUGIN_SKIP_PATH_CLI=1
  (same style as RUFLO_METAHARNESS_SKIP_LOCAL). The existing npx-stub tests
  (import-root-exit-3097, verify-read-safety-3147, test-no-tool-time-npx)
  set them; without that they fail on any machine with ruflo on PATH.
- New regression tests for each plugin, run in a marketplace-style plugin
  cache with fake ruflo/claude-flow/npx on PATH: fail on 49da6ecc4
  (cost-tracker 5/12, adr 2/6, metaharness 5/8), pass with the fix (14/14,
  6/6, 8/8). Wired into v3-ci.yml and metaharness-ci.yml.

Co-Authored-By: ruflo <ruv@ruv.net>
2026-10-05 09:57:49 -07:00
..