fix(claims): anchor MCP claims store to project cwd

[original4422]

Summary

Fixes #3178.

Claims persistence resolves its file and directory from the MCP process cwd, so a server launched in a subdirectory ignores CLAUDE_FLOW_CWD. Sessions configured with the same effective project root can consequently miss each other's claims.

Anchor both paths with the existing getProjectCwd() helper, matching the other file-backed tools. This preserves the helper's current fallback rules and keeps distinct effective project roots separate; it does not introduce cross-worktree root discovery or change claims ownership/expiry semantics (#3180).

Validation

On macOS / Apple Silicon, Node 20.20.2 and Vitest 4.1.0, from v3/@claude-flow/cli:

npm test -- --pool=forks --maxWorkers=1 __tests__/claims-project-cwd-3178.test.ts __tests__/mcp-tools-deep.test.ts

• 114 tests passed on the submitted commit. The seven new tests call the actual source handlers with a real temporary filesystem and real cwd changes: nested-cwd persistence, duplicate/release checks, handoff/status, steal/load, fallback, and root isolation.
• With the production file restored to main, four new tests fail and the other 110 tests pass. The existing Vite invalid-file-URL warning appears on both versions.
• Focused strict TypeScript check of the changed source and test, plus git diff --check: passed.

Used a toolchain-only local install and the declared @claude-flow/cli-core@3.7.0-alpha.5 dependency. Full monorepo build/test and Windows/Linux CI were not run locally.

[harryohh]

Thx

[harryohh]

Thx

[original4422]

Hi @ruvnet, could you please take a look when convenient and let me know whether this is ready to merge or needs any changes? Thanks!

[ruvnet]

Exact-head evidence review (3d87d5e).

The patch is narrowly aligned with #3178: both claim reads and writes now resolve through getProjectCwd(), and the new real-filesystem cases cover same-root sharing, distinct-root isolation, ownership, release, handoff/status, steal/load, fallback, and duplicate behavior.

Acceptance is still blocked. All six observed exact-head workflows ended action_required (CI, V3 CI, Verification, CVE Audit, Cross-Agent, and CodeQL), and the repository's documented clean-install blocker prevents independent broad replay. The 114 focused-test claim therefore cannot substitute for exact-head installation, full regression, Windows/Linux path, concurrency, and atomic-write evidence.

INCONCLUSIVE