fix: address #3045 #3064 #3065 + new ruflo-deepseek-harness plugin (3.38.13) (#3078)

Bug fixes
- #3045 statusline.cjs: getGitInfo() runs the 5-command git chain per render;
  on large repos with concurrent Claude Code sessions this queued subprocesses
  faster than they finished (reporter observed hundreds of orphan children +
  load-avg in the hundreds). Added a per-cwd tmp file cache with 5s TTL —
  dirty status still feels live, pileup is bounded.

- #3064 hooks post-task: the narrow ad-hoc regex /^[a-zA-Z0-9_-]+$/ silently
  dropped every colon-namespaced plugin agent (ruflo-core:reviewer,
  feature-dev:code-explorer, ...) — i.e. every Claude Code plugin agent. The
  canonical validateIdentifier() upstream already allows ':' and '.', so the
  redundant regex is removed. Regression test locks in 4 agent-shape cases,
  proven to catch the bug: 2 pass / 2 fail on revert, 4 pass with fix.

- #3065 harness-gepa SKILL.md: unquoted colon in `description` broke YAML
  parsing in `npx skills add`. Quoted the description; rephrased the bare
  "(default:" to avoid the leading colon.

New plugin: ruflo-deepseek-harness
- plugins/ruflo-deepseek-harness/: sibling to ruflo-metaharness (ADR-150
  shape). Two skills: `deepseek-chat` (non-reasoning) and `deepseek-reason`
  (surfaces reasoning_content separately). Reads DEEPSEEK_API_KEY from env;
  degrades gracefully (exit 0 with `{status: 'degraded', reason, hint}`)
  when the key is missing or the API is unreachable. `--alert-on-error`
  flag opts into hard exit 1 for CI gates. Smoke-tested locally.

Release
- Bump @claude-flow/cli, claude-flow, ruflo: 3.38.12 → 3.38.13 (PATCH:
  bug fixes; the new plugin is scaffolding under plugins/ and not part of
  the npm-published CLI packages).

Not fixed
- #3051 memory_store tags: current source's memory_store handler passes
  tags straight through to storeEntry; a maintainer already verified live
  round-trip works on fa13ee4. Reporter has not yet supplied the
  ruflo/@claude-flow/cli version that hosted the affected MCP server,
  so the affected release path is unknown. Left as-is pending that reply.


Claude-Session: https://claude.ai/code/session_0118jMsYhwHD5dx2vStENsEB

Author: ruvnet

.claude/helpers/statusline.cjs

@@ -630,7 +630,47 @@ function readJSON(filePath) {
 
 // ─── Git info (pure-Node / single exec — needed for branch display) ──────────
 
+// #3045 — getGitInfo() shells out to a 5-command chain per render. Uncached,
+// it queues subprocesses faster than they finish on large repos with multiple
+// concurrent Claude Code sessions, producing the pileup reported in that
+// issue (hundreds of orphan git children, load-avg in the hundreds). Cache
+// the parsed result in a per-cwd tmp file with a short TTL — dirty/branch
+// status doesn't need per-render freshness, and 5s is short enough to feel
+// live.
+const GIT_INFO_CACHE_FILE = path.join(
+  os.tmpdir(),
+  'ruflo-statusline-gitinfo-' +
+    require('crypto').createHash('md5').update(CWD).digest('hex').slice(0, 8) +
+    '.json'
+);
+const GIT_INFO_TTL_MS = 5000;
+
+function readGitInfoCache() {
+  try {
+    if (fs.existsSync(GIT_INFO_CACHE_FILE)) {
+      const raw = JSON.parse(fs.readFileSync(GIT_INFO_CACHE_FILE, 'utf-8'));
+      if (raw && typeof raw._ts === 'number' && Date.now() - raw._ts < GIT_INFO_TTL_MS && raw.data) {
+        return raw.data;
+      }
+    }
+  } catch { /* ignore */ }
+  return null;
+}
+
+function writeGitInfoCache(data) {
+  try {
+    fs.writeFileSync(
+      GIT_INFO_CACHE_FILE,
+      JSON.stringify({ _ts: Date.now(), data }),
+      'utf-8'
+    );
+  } catch { /* ignore */ }
+}
+
 function getGitInfo() {
+  const cached = readGitInfoCache();
+  if (cached) return cached;
+
   const result = {
     name: path.basename(CWD) || 'project', gitBranch: '', modified: 0, untracked: 0,
     staged: 0, ahead: 0, behind: 0,
@@ -649,7 +689,12 @@ function getGitInfo() {
   ].join('; ');
 
   const raw = safeExec("sh -c '" + script + "'", 3000);
-  if (!raw) return result;
+  if (!raw) {
+    // Cache even the empty result — if git is slow/unavailable, we don't want
+    // to re-attempt on every render either.
+    writeGitInfoCache(result);
+    return result;
+  }
 
   const parts = raw.split('---SEP---').map(function(s) { return s.trim(); });
   if (parts.length >= 5) {
@@ -673,6 +718,7 @@ function getGitInfo() {
     result.behind = parseInt(ab[1]) || 0;
   }
 
+  writeGitInfoCache(result);
   return result;
 }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.38.12",
+  "version": "3.38.13",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/plugin-agent-federation",

plugins/ruflo-deepseek-harness/agents/deepseek-architect.md

@@ -0,0 +1,62 @@
+---
+name: deepseek-architect
+description: DeepSeek harness architect for ruflo. Surfaces DeepSeek's chat and reasoning models via skills; enforces the ADR-150 removability contract (this plugin as optional augmentation, never a required runtime dep); routes between deepseek-chat and deepseek-reasoner based on task shape
+model: haiku
+---
+
+You are the deepseek-architect for ruflo. Your job is to expose the
+DeepSeek API (`deepseek-chat`, `deepseek-reasoner`) through ruflo's UX
+while keeping ruflo independently operational at all times.
+
+## ADR-150 invariants (load-bearing)
+
+1. **Removable** — deleting `plugins/ruflo-deepseek-harness/` must not
+   break any other ruflo functionality.
+2. **No hard dependency** — nothing in this plugin gets added to ruflo's
+   `dependencies` in `package.json`. Scripts use `fetch` (Node 18+) and
+   Node built-ins only.
+3. **Graceful degradation** — every script exits 0 with a
+   `{ status: 'degraded'|'error', reason, hint? }` JSON envelope when
+   `DEEPSEEK_API_KEY` is unset or the API is unreachable. The
+   `emitAndExit(...)` helper in `scripts/_deepseek.mjs` is the reference
+   implementation. Pass `--alert-on-error` to opt into hard failure for
+   CI gates.
+4. **No secret in logs** — the API key is only read from
+   `process.env.DEEPSEEK_API_KEY` and sent as a Bearer header. It is
+   never printed to stdout/stderr.
+
+If a PR breaks any of these four rules, it is a breaking change and
+needs its own ADR.
+
+## Skills
+
+| Skill | Role | Invoke when |
+|-------|------|-------------|
+| `deepseek-chat` | Non-reasoning single-turn completion via `deepseek-chat` | Summarization, extraction, quick classification, cheap Q&A |
+| `deepseek-reason` | Reasoning-mode completion via `deepseek-reasoner` (surfaces the CoT) | Proofs, plans, root-cause analysis, audits that need explicit reasoning |
+
+## Routing heuristic
+
+- Default to `deepseek-chat` for anything a smaller model can plausibly
+  do in one turn.
+- Escalate to `deepseek-reason` when the task calls for multi-step
+  reasoning AND the caller either wants to see the chain-of-thought or
+  is willing to pay the higher token cost for the quality lift.
+- If the caller wants the CoT displayed, use `deepseek-reason
+  --show-reasoning` in table mode; for programmatic consumption, use
+  JSON mode which always includes `reasoning` and a `reasoningTokens`
+  breakdown.
+
+## Extending the plugin
+
+Add a new skill by:
+
+1. Creating `skills/<skill-name>/SKILL.md` with YAML frontmatter (name,
+   description in **quotes** — see #3065 for why unquoted colons break
+   `npx skills add`).
+2. Adding a matching `scripts/<name>.mjs` that imports
+   `deepseekChat` / `parseArgs` / `emitAndExit` from `_deepseek.mjs` so
+   it inherits the graceful-degradation contract for free.
+3. Documenting the new subcommand in
+   `commands/ruflo-deepseek-harness.md` so the top-level command
+   dispatcher lists it.

plugins/ruflo-deepseek-harness/commands/ruflo-deepseek-harness.md

@@ -0,0 +1,39 @@
+---
+name: ruflo-deepseek-harness
+description: DeepSeek harness integration — chat and reasoning-mode completions via the OpenAI-compatible DeepSeek API, wrapped as ruflo skills with graceful degradation (ADR-150 pattern)
+---
+
+DeepSeek harness commands. All shell out to
+[`scripts/_deepseek.mjs`](../scripts/_deepseek.mjs) which hits DeepSeek's
+`https://api.deepseek.com/v1/chat/completions` endpoint using
+`DEEPSEEK_API_KEY` from the environment. The plugin never becomes a hard
+runtime dependency of ruflo — with the key unset or the API unreachable
+every script exits 0 with a `{ status: 'degraded', reason }` envelope,
+matching the ADR-150 removability contract used by the sibling
+`ruflo-metaharness` plugin.
+
+**`deepseek chat --prompt <text> [--system <text>] [--model deepseek-chat] [--temperature 0.7] [--max-tokens 1024] [--format table|json] [--alert-on-error]`** — one-shot completion against the non-reasoning `deepseek-chat` model.
+1. Run `node plugins/ruflo-deepseek-harness/scripts/chat.mjs --prompt "..."`
+2. Emits `{ status, model, content, finishReason, usage }` as JSON (default) or the bare content (`--format table`)
+3. `--alert-on-error` exits 1 on any degraded/error status — CI-friendly gate
+4. See [`skills/deepseek-chat/SKILL.md`](../skills/deepseek-chat/SKILL.md)
+
+**`deepseek reason --prompt <text> [--system <text>] [--model deepseek-reasoner] [--max-tokens 4096] [--show-reasoning] [--format table|json] [--alert-on-error]`** — reasoning-mode completion; separates `reasoning_content` (chain of thought) from `content` (final answer).
+1. Run `node plugins/ruflo-deepseek-harness/scripts/reason.mjs --prompt "..."`
+2. `temperature`/`top_p` are NOT forwarded — DeepSeek ignores them for reasoner models
+3. JSON output always includes `reasoning` + a `reasoningTokens` cost breakdown; table mode omits reasoning unless `--show-reasoning` is passed
+4. See [`skills/deepseek-reason/SKILL.md`](../skills/deepseek-reason/SKILL.md)
+
+## Environment
+
+- `DEEPSEEK_API_KEY` — required to actually call the API. Without it every
+  script exits 0 with `{ status: 'degraded', reason: 'DEEPSEEK_API_KEY is not set' }`.
+  Get a key at https://platform.deepseek.com.
+
+## ADR-150 invariants (same as ruflo-metaharness)
+
+1. **Removable** — `rm -rf plugins/ruflo-deepseek-harness/` must leave ruflo working.
+2. **No hard dependency** — nothing in ruflo's `dependencies`. This plugin's
+   scripts import only Node built-ins + `fetch` (Node 18+).
+3. **Graceful degradation** — every script exits 0 with a JSON envelope on
+   failure. Pass `--alert-on-error` to opt into hard failure for CI gates.

plugins/ruflo-deepseek-harness/scripts/_deepseek.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+/**
+ * Shared helper for the ruflo-deepseek-harness plugin.
+ *
+ * Calls the DeepSeek OpenAI-compatible Chat Completions API
+ * (https://api.deepseek.com/v1/chat/completions). Reads the key from
+ * DEEPSEEK_API_KEY. Never crashes ruflo on boot — every failure emits a
+ * JSON object with { status: 'degraded', reason } and exits 0 by default;
+ * pass --alert-on-error to exit 1 on a hard failure (missing key, HTTP
+ * error, timeout).
+ *
+ * Modeled on plugins/ruflo-metaharness/scripts/_harness.mjs' graceful
+ * degradation shape (ADR-150), so this plugin never becomes a hard runtime
+ * dependency of ruflo — remove it and everything else keeps working.
+ */
+
+const API_URL = 'https://api.deepseek.com/v1/chat/completions';
+const DEFAULT_TIMEOUT_MS = 60_000;
+
+/**
+ * Parse a minimal --key value CLI. Booleans: --flag with no value.
+ */
+export function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (!tok.startsWith('--')) continue;
+    const key = tok.slice(2);
+    const next = argv[i + 1];
+    if (next && !next.startsWith('--')) {
+      out[key] = next;
+      i++;
+    } else {
+      out[key] = true;
+    }
+  }
+  return out;
+}
+
+/**
+ * Emit a degraded/OK JSON envelope and exit.
+ * status: 'ok' | 'degraded' | 'error'
+ */
+export function emitAndExit(payload, { alertOnError = false } = {}) {
+  process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
+  const isFailure = payload.status === 'degraded' || payload.status === 'error';
+  process.exit(isFailure && alertOnError ? 1 : 0);
+}
+
+/**
+ * Call DeepSeek's chat/completions endpoint.
+ *
+ * @param {object} opts
+ * @param {string} opts.model            e.g. "deepseek-chat", "deepseek-reasoner"
+ * @param {Array}  opts.messages         OpenAI-style messages
+ * @param {number} [opts.temperature]
+ * @param {number} [opts.maxTokens]
+ * @param {number} [opts.timeoutMs]
+ * @returns {Promise<{ok: true, data: object} | {ok: false, reason: string, hint?: string}>}
+ */
+export async function deepseekChat({ model, messages, temperature, maxTokens, timeoutMs }) {
+  const apiKey = process.env.DEEPSEEK_API_KEY;
+  if (!apiKey) {
+    return {
+      ok: false,
+      reason: 'DEEPSEEK_API_KEY is not set',
+      hint: 'Get a key at https://platform.deepseek.com and export DEEPSEEK_API_KEY=... in your shell.',
+    };
+  }
+
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), timeoutMs || DEFAULT_TIMEOUT_MS);
+
+  try {
+    const body = { model, messages };
+    if (typeof temperature === 'number') body.temperature = temperature;
+    if (typeof maxTokens === 'number') body.max_tokens = maxTokens;
+
+    const res = await fetch(API_URL, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        authorization: 'Bearer ' + apiKey,
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal,
+    });
+
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      return {
+        ok: false,
+        reason: 'HTTP ' + res.status + ' from DeepSeek',
+        hint: text.slice(0, 500),
+      };
+    }
+
+    const data = await res.json();
+    return { ok: true, data };
+  } catch (err) {
+    if (err && err.name === 'AbortError') {
+      return { ok: false, reason: 'DeepSeek call timed out after ' + (timeoutMs || DEFAULT_TIMEOUT_MS) + 'ms' };
+    }
+    return { ok: false, reason: err && err.message ? err.message : String(err) };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+/**
+ * Convenience: pull the first choice's message content (and reasoning_content
+ * when present, for deepseek-reasoner).
+ */
+export function extractCompletion(data) {
+  const choice = data && data.choices && data.choices[0];
+  if (!choice || !choice.message) return { content: '', reasoning: '' };
+  return {
+    content: choice.message.content || '',
+    reasoning: choice.message.reasoning_content || '',
+    finishReason: choice.finish_reason || null,
+  };
+}

plugins/ruflo-deepseek-harness/scripts/chat.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/**
+ * DeepSeek chat completion — non-reasoning model (`deepseek-chat`).
+ *
+ * Usage:
+ *   node plugins/ruflo-deepseek-harness/scripts/chat.mjs \
+ *     --prompt "Summarize the following in one sentence: ..." \
+ *     [--system "You are a concise assistant."] \
+ *     [--model deepseek-chat] \
+ *     [--temperature 0.7] \
+ *     [--max-tokens 1024] \
+ *     [--format table|json] \
+ *     [--alert-on-error]
+ */
+
+import { parseArgs, emitAndExit, deepseekChat, extractCompletion } from './_deepseek.mjs';
+
+const args = parseArgs(process.argv.slice(2));
+const alertOnError = args['alert-on-error'] === true;
+
+const prompt = args.prompt;
+if (!prompt || prompt === true) {
+  emitAndExit(
+    { status: 'error', reason: '--prompt is required (a string of at least 1 char)' },
+    { alertOnError: true } // hard-error even without the flag: this is a usage bug
+  );
+}
+
+const messages = [];
+if (args.system && args.system !== true) messages.push({ role: 'system', content: args.system });
+messages.push({ role: 'user', content: prompt });
+
+const model = (args.model && args.model !== true) ? args.model : 'deepseek-chat';
+const temperature = args.temperature !== undefined ? Number(args.temperature) : undefined;
+const maxTokens = args['max-tokens'] !== undefined ? Number(args['max-tokens']) : undefined;
+
+const result = await deepseekChat({ model, messages, temperature, maxTokens });
+
+if (!result.ok) {
+  emitAndExit(
+    { status: 'degraded', model, reason: result.reason, hint: result.hint || null },
+    { alertOnError }
+  );
+}
+
+const { content, finishReason } = extractCompletion(result.data);
+const usage = result.data.usage || {};
+
+const payload = {
+  status: 'ok',
+  model,
+  content,
+  finishReason,
+  usage: {
+    promptTokens: usage.prompt_tokens ?? null,
+    completionTokens: usage.completion_tokens ?? null,
+    totalTokens: usage.total_tokens ?? null,
+  },
+};
+
+if (args.format === 'table') {
+  process.stdout.write(content + '\n');
+  process.exit(0);
+}
+
+emitAndExit(payload);