@claude-flow/cli 3.32.0 → 3.32.2

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.30.0
+3.32.2

package/.claude/helpers/helpers.manifest.json

@@ -1,13 +1,13 @@
 {
   "manifest": {
-    "version": "3.32.0",
+    "version": "3.32.2",
     "files": {
       "auto-memory-hook.mjs": "e3e1033b24704992ddef6b31c7fa9dd7fcd9e1af7935dd77ef73402b916b31e6",
       "hook-handler.cjs": "f87ec28684bfc5fd0a54c46bd2a53a3fb037defe71d0ea4b8a5cb88a2cd87a3f",
       "intelligence.cjs": "5a55d979cb7ba5c8c4f27f3b2e6d686fbb1045d180023b803da672a37e05b915",
-      "statusline.cjs": "7d7bdee732e1c75b863e409afb86ce0d712f4919245e990d806da6752015bffa"
+      "statusline.cjs": "f6fcaedad7b521248ba57c494eb1a0ce696679fa3f8709f81edf3fdecef369c2"
     }
   },
-  "signature": "vOWP/i+ctJpD8NNHq6RhgZnxi748YJMlSSkYILMrxytsw5bhQK3322MKyz1iwyvxzNo7Jov1hPuqeDU+vCu2CQ==",
+  "signature": "r7TaWKVLZ6gxssGRM31J6usZrRm1Y5TAZXNmOfeLn+7VzWMrH6pZZPGTfSv6WMW49j8Ko3aamDBtahasWybSAw==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/statusline.cjs

@@ -26,8 +26,11 @@ const { execSync } = require('child_process');
 const os = require('os');
 
 // Configuration
-const CONFIG = {
-  maxAgents: 15,
+const CONFIG = {
+  maxAgents: 15,
+  // Header identity defaults to project/repository name. Set `author` to
+  // retain the previous `git config user.name` display (#2682).
+  identityMode: (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase(),
   // Session-cost display. Claude Code's cost.total_cost_usd is a client-side
   // estimate that "may differ from your actual bill" and reads as misleading on
   // subscription plans, where token usage is not billed per dollar. These let
@@ -210,7 +213,9 @@ function getStatuslineData() {
   // 60s TTL (#2337 — don't re-spawn the CLI on every rapid re-render) AND the
   // tighter promo-rotation clock (this fix — don't let a still-fresh 60s
   // cache silently freeze the promo/insight row across multiple 20s slots).
-  if (cache.fresh && cache.promoFresh) return overlayMemoPromo(cache.data);
+  if (cache.fresh && cache.promoFresh) {
+    return applyLocalOverlays(overlayMemoPromo(cache.data));
+  }
 
   // #2337: prefer an already-installed CLI bin via direct `node` invocation —
   // no npx, no registry round-trip, no @latest re-resolve per render. Try
@@ -417,7 +422,7 @@ function buildLocalFallback() {
   return applyLocalOverlays({
     user: { name: 'user', gitBranch: '', modelName: 'Claude Code' },
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
-    security: { status: 'NONE', cvesFixed: 0, totalCves: 0 },
+    security: { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
     system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
     lastUpdated: new Date().toISOString(),
@@ -474,14 +479,16 @@ function readJSON(filePath) {
 
 // ─── Git info (pure-Node / single exec — needed for branch display) ──────────
 
-function getGitInfo() {
-  const result = {
-    name: 'user', gitBranch: '', modified: 0, untracked: 0,
-    staged: 0, ahead: 0, behind: 0,
-  };
-
-  const script = [
-    'git config user.name 2>/dev/null || echo user',
+function getGitInfo() {
+  const result = {
+    name: path.basename(CWD) || 'project', gitBranch: '', modified: 0, untracked: 0,
+    staged: 0, ahead: 0, behind: 0,
+  };
+
+  const script = [
+    'git rev-parse --show-toplevel 2>/dev/null || pwd',
+    'echo "---SEP---"',
+    'git config user.name 2>/dev/null || echo user',
     'echo "---SEP---"',
     'git branch --show-current 2>/dev/null',
     'echo "---SEP---"',
@@ -494,12 +501,14 @@ function getGitInfo() {
   if (!raw) return result;
 
   const parts = raw.split('---SEP---').map(function(s) { return s.trim(); });
-  if (parts.length >= 4) {
-    result.name = parts[0] || 'user';
-    result.gitBranch = parts[1] || '';
-
-    if (parts[2]) {
-      for (const line of parts[2].split('\n')) {
+  if (parts.length >= 5) {
+    const projectName = path.basename(parts[0] || CWD) || path.basename(CWD) || 'project';
+    const authorName = parts[1] || 'user';
+    result.name = CONFIG.identityMode === 'author' ? authorName : projectName;
+    result.gitBranch = parts[2] || '';
+
+    if (parts[3]) {
+      for (const line of parts[3].split('\n')) {
         if (!line || line.length < 2) continue;
         const x = line[0], y = line[1];
         if (x === '?' && y === '?') { result.untracked++; continue; }
@@ -508,7 +517,7 @@ function getGitInfo() {
       }
     }
 
-    const ab = (parts[3] || '0 0').split(/\s+/);
+    const ab = (parts[4] || '0 0').split(/\s+/);
     result.ahead = parseInt(ab[0]) || 0;
     result.behind = parseInt(ab[1]) || 0;
   }
@@ -722,8 +731,7 @@ function generateStatusline() {
   const intelligencePct = system.intelligencePct || 0;
   const memoryMB = system.memoryMB || 0;
   const subAgents = system.subAgents || 0;
-  const cvesFixed = security.cvesFixed || 0;
-  const totalCves = security.totalCves || 0;
+  const findings = Math.max(0, security.findings || 0);
   const secStatus = security.status || 'NONE';
   const adrCount = adrs.count || 0;
   const adrImpl = adrs.implemented || 0;
@@ -778,8 +786,7 @@ function generateStatusline() {
   const hooksColor = hooksEnabled > 0 ? c.brightGreen : c.dim;
   const intellColor = intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
   const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset + ' ' : c.dim + '○' + c.reset + ' ';
-  const cvesClean = totalCves === 0 || cvesFixed === totalCves;
-  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && cvesClean;
+  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && findings === 0;
   const opsParts = [];
   opsParts.push(c.cyan + 'Swarm ' + swarmInd + agentsColor + activeAgents + c.reset + '/' + c.brightWhite + maxAgents + c.reset);
   if (subAgents > 0) opsParts.push(c.brightPurple + '👥 ' + subAgents + c.reset);
@@ -790,14 +797,14 @@ function generateStatusline() {
   if (healthAllGreen) {
     opsParts.push(c.brightGreen + '🛡 ✓' + c.reset);
   } else {
-    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
-    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
-    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
-    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
-    if (totalCves > 0 && cvesFixed < totalCves) {
-      const unfixed = totalCves - cvesFixed;
-      opsParts.push(c.brightRed + '⚠ ' + unfixed + ' CVE' + (unfixed === 1 ? '' : 's') + c.reset);
-    }
+    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
+    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
+    else if (secStatus === 'ISSUES') opsParts.push(c.brightRed + '🛡 findings' + c.reset);
+    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
+    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
+    if (findings > 0) {
+      opsParts.push(c.brightRed + '⚠ ' + findings + ' finding' + (findings === 1 ? '' : 's') + c.reset);
+    }
   }
   lines.push(opsParts.join('  ' + c.dim + '·' + c.reset + '  '));
 

package/.claude/helpers/statusline.js

@@ -167,39 +167,27 @@ function getV3Progress() {
 
 // Get security status based on actual scans
 function getSecurityStatus() {
-  // Check for security scan results in memory
+  // ponytail: read the NEWEST scan in .claude/security-scans/ and surface its
+  // real findings count. Previously hardcoded totalCves=3 and counted scan
+  // *files* as "CVEs fixed", fabricating "⚠ 3 CVEs" for every project.
   const scanResultsPath = path.join(process.cwd(), '.claude', 'security-scans');
-  let cvesFixed = 0;
-  const totalCves = 3;
-
-  if (fs.existsSync(scanResultsPath)) {
-    try {
-      const scans = fs.readdirSync(scanResultsPath).filter(f => f.endsWith('.json'));
-      // Each successful scan file = 1 CVE addressed
-      cvesFixed = Math.min(totalCves, scans.length);
-    } catch (e) {
-      // Ignore
-    }
-  }
-
-  // Also check .swarm/security for audit results
-  const auditPath = path.join(process.cwd(), '.swarm', 'security');
-  if (fs.existsSync(auditPath)) {
-    try {
-      const audits = fs.readdirSync(auditPath).filter(f => f.includes('audit'));
-      cvesFixed = Math.min(totalCves, Math.max(cvesFixed, audits.length));
-    } catch (e) {
-      // Ignore
+  if (!fs.existsSync(scanResultsPath)) return { status: 'PENDING', findings: 0, cvesFixed: 0, totalCves: 0 };
+  try {
+    const files = fs.readdirSync(scanResultsPath).filter(f => f.endsWith('.json'));
+    if (files.length === 0) return { status: 'PENDING', findings: 0, cvesFixed: 0, totalCves: 0 };
+    let newest = files[0];
+    let newestMtime = -1;
+    for (const f of files) {
+      const st = fs.statSync(path.join(scanResultsPath, f));
+      if (st.mtimeMs > newestMtime) { newestMtime = st.mtimeMs; newest = f; }
     }
+    const scan = JSON.parse(fs.readFileSync(path.join(scanResultsPath, newest), 'utf-8'));
+    const findings = Math.max(0, scan.summary?.total ?? scan.totalFindings ?? scan.findings?.length ?? 0);
+    const status = findings > 0 ? 'ISSUES' : 'CLEAN';
+    return { status, findings, scannedAt: scan.timestamp, cvesFixed: 0, totalCves: 0 };
+  } catch (e) {
+    return { status: 'PENDING', findings: 0, cvesFixed: 0, totalCves: 0 };
   }
-
-  const status = cvesFixed >= totalCves ? 'CLEAN' : cvesFixed > 0 ? 'IN_PROGRESS' : 'PENDING';
-
-  return {
-    status,
-    cvesFixed,
-    totalCves,
-  };
 }
 
 // Get swarm status
@@ -306,7 +294,7 @@ function generateStatusline() {
   lines.push(
     `${c.brightYellow}🤖 Swarm${c.reset}  ${swarmIndicator} [${agentsColor}${String(swarm.activeAgents).padStart(2)}${c.reset}/${c.brightWhite}${swarm.maxAgents}${c.reset}]  ` +
     `${c.brightPurple}👥 ${system.subAgents}${c.reset}    ` +
-    `${securityIcon} ${securityColor}CVE ${security.cvesFixed}${c.reset}/${c.brightWhite}${security.totalCves}${c.reset}    ` +
+    `${securityIcon} ${securityColor}Findings ${security.findings || 0}${c.reset}    ` +
     `${c.brightCyan}💾 ${system.memoryMB}MB${c.reset}    ` +
     `${c.brightGreen}📂 ${String(system.contextPct).padStart(3)}%${c.reset}    ` +
     `${c.dim}🧠 ${String(system.intelligencePct).padStart(3)}%${c.reset}`

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-15T22:06:33.335Z",
-  "gitSha": "a0c1ac4b",
+  "generatedAt": "2026-07-17T04:00:15.717Z",
+  "gitSha": "61047df4",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/dist/src/commands/hooks.js

@@ -3487,18 +3487,26 @@ const statuslineCommand = {
         }
         // Get user info
         function getUserInfo() {
-            let name = 'user';
+            const identityMode = (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase();
+            let name = path.basename(process.cwd()) || 'project';
             let gitBranch = '';
             const modelName = 'Opus 4.6 (1M context)';
             const isWindows = process.platform === 'win32';
             try {
-                const nameCmd = isWindows
-                    ? 'git config user.name 2>NUL || echo user'
-                    : 'git config user.name 2>/dev/null || echo "user"';
+                const rootCmd = isWindows
+                    ? 'git rev-parse --show-toplevel 2>NUL'
+                    : 'git rev-parse --show-toplevel 2>/dev/null';
                 const branchCmd = isWindows
                     ? 'git branch --show-current 2>NUL || echo.'
                     : 'git branch --show-current 2>/dev/null || echo ""';
-                name = execSync(nameCmd, { encoding: 'utf-8' }).trim();
+                const root = execSync(rootCmd, { encoding: 'utf-8' }).trim();
+                name = path.basename(root) || name;
+                if (identityMode === 'author') {
+                    const authorCmd = isWindows
+                        ? 'git config user.name 2>NUL || echo user'
+                        : 'git config user.name 2>/dev/null || echo "user"';
+                    name = execSync(authorCmd, { encoding: 'utf-8' }).trim() || 'user';
+                }
                 gitBranch = execSync(branchCmd, { encoding: 'utf-8' }).trim();
                 if (gitBranch === '.')
                     gitBranch = '';
@@ -3555,7 +3563,10 @@ const statuslineCommand = {
         const terminalCols = process.stdout.columns ?? 80;
         const autoCompact = !ctx.flags.full && terminalCols < COMPACT_WIDTH_THRESHOLD;
         if (ctx.flags.compact || autoCompact) {
-            const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} CVE:${security.cvesFixed}/${security.totalCves} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${system.contextPct}% Int:${system.intelligencePct}%`;
+            const securityCompact = security.findings > 0
+                ? `Findings:${security.findings}`
+                : `Security:${security.status}`;
+            const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} ${securityCompact} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${system.contextPct}% Int:${system.intelligencePct}%`;
             output.writeln(line);
             return { success: true, data: statusData };
         }
@@ -3729,13 +3740,13 @@ const statuslineCommand = {
             perfIndicator;
         const swarmIndicator = swarm.coordinationActive ? `${c.brightGreen}◉${c.reset}` : `${c.dim}○${c.reset}`;
         const agentsColor = swarm.activeAgents > 0 ? c.brightGreen : c.red;
-        const securityIcon = security.status === 'CLEAN' ? '🟢' : security.status === 'IN_PROGRESS' ? '🟡' : '🔴';
-        const securityColor = security.status === 'CLEAN' ? c.brightGreen : security.status === 'IN_PROGRESS' ? c.brightYellow : c.brightRed;
+        const securityIcon = security.status === 'CLEAN' ? '🟢' : security.status === 'PENDING' ? '🟡' : '🔴';
+        const securityColor = security.status === 'CLEAN' ? c.brightGreen : security.status === 'PENDING' ? c.brightYellow : c.brightRed;
         const hooksColor = hooksStats.enabled > 0 ? c.brightGreen : c.dim;
         const line2 = `${c.brightYellow}🤖 Swarm${c.reset}  ${swarmIndicator} [${agentsColor}${String(swarm.activeAgents).padStart(2)}${c.reset}/${c.brightWhite}${swarm.maxAgents}${c.reset}]  ` +
             `${c.brightPurple}👥 ${system.subAgents}${c.reset}    ` +
             `${c.brightBlue}🪝 ${hooksColor}${hooksStats.enabled}${c.reset}/${c.brightWhite}${hooksStats.total}${c.reset}    ` +
-            `${securityIcon} ${securityColor}CVE ${security.cvesFixed}${c.reset}/${c.brightWhite}${security.totalCves}${c.reset}    ` +
+            `${securityIcon} ${securityColor}${security.findings > 0 ? `Findings ${security.findings}` : `Security ${security.status}`}${c.reset}    ` +
             `${c.brightCyan}💾 ${system.memoryMB}MB${c.reset}    ` +
             `${c.brightPurple}🧠 ${String(system.intelligencePct).padStart(3)}%${c.reset}`;
         const dddColor = progress.dddProgress >= 50 ? c.brightGreen : progress.dddProgress > 0 ? c.yellow : c.red;

package/dist/src/commands/init.d.ts

@@ -3,6 +3,11 @@
  * Comprehensive initialization for Claude Flow with Claude Code integration
  */
 import type { Command } from '../types.js';
+export declare function runCodexInitializerCli(cwd: string, options: {
+    template: string;
+    force: boolean;
+    dual: boolean;
+}): boolean;
 export declare const initCommand: Command;
 export default initCommand;
 //# sourceMappingURL=init.d.ts.map

package/dist/src/commands/init.js

@@ -6,6 +6,7 @@ import { output } from '../output.js';
 import { confirm, select, multiSelect, input } from '../prompt.js';
 import * as fs from 'fs';
 import * as path from 'path';
+import { spawnSync } from 'node:child_process';
 import { executeInit, executeUpgrade, executeUpgradeWithMissing, DEFAULT_INIT_OPTIONS, MINIMAL_INIT_OPTIONS, FULL_INIT_OPTIONS, } from '../init/index.js';
 import { ENROLLMENT_SCREEN, recordEnrollmentOutcome, shouldOfferEnrollment, } from '../funnel/enrollment.js';
 import { commandExists } from '../services/harness-hosts.js';
@@ -82,6 +83,27 @@ async function resolveCodexInitializer(cwd) {
     }
     return undefined;
 }
+// Keep Codex out of the CLI dependency graph so cold `npx ruflo --version`
+// remains fast (#2561). An explicit `init --codex` may fetch the small,
+// stable adapter on demand when it is not already installed by an umbrella
+// package, the current project, or the global npm prefix.
+export function runCodexInitializerCli(cwd, options) {
+    const npxArgs = [
+        '-y',
+        '@claude-flow/codex@latest',
+        'init',
+        '--template',
+        options.template,
+        ...(options.force ? ['--force'] : []),
+        ...(options.dual ? ['--dual'] : []),
+    ];
+    const result = process.platform === 'win32'
+        ? spawnSync(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', ['npx', ...npxArgs].join(' ')], { cwd, stdio: 'inherit', windowsHide: true })
+        : spawnSync('npx', npxArgs, { cwd, stdio: 'inherit' });
+    if (result.error)
+        throw result.error;
+    return result.status === 0;
+}
 // #2666-adjacent — quietly wire up Codex too when a plain `ruflo init` (no
 // --codex/--dual) runs on a machine that also has the OpenAI Codex CLI on
 // PATH: registers its MCP server and installs skills alongside the Claude
@@ -194,7 +216,14 @@ async function initCodexAction(ctx, options) {
     try {
         const CodexInitializer = await resolveCodexInitializer(ctx.cwd);
         if (!CodexInitializer) {
-            throw new Error('Cannot find module @claude-flow/codex');
+            spinner.stop();
+            output.printInfo('Fetching the stable Codex adapter for this initialization...');
+            const success = runCodexInitializerCli(ctx.cwd, { template, force, dual: dualMode });
+            if (!success) {
+                output.printError('Codex initialization failed while running @claude-flow/codex@latest.');
+                return { success: false, exitCode: 1 };
+            }
+            return { success: true, data: { adapter: '@claude-flow/codex@latest' } };
         }
         const initializer = new CodexInitializer();
         const result = await initializer.initialize({

package/dist/src/commands/security.js

@@ -6,6 +6,7 @@
  */
 import { output } from '../output.js';
 import { execSync } from 'node:child_process';
+import { createBuiltinAIDefence } from '../security/builtin-aidefence.js';
 // Scan subcommand
 const scanCommand = {
     name: 'scan',
@@ -861,16 +862,17 @@ const defendCommand = {
         output.writeln(output.bold('🛡️ AIDefence - AI Manipulation Defense System'));
         output.writeln(output.dim('─'.repeat(55)));
         // Dynamic import of aidefence (allows package to be optional)
-        let createAIDefence;
+        let defender;
         try {
             const aidefence = await import('@claude-flow/aidefence');
-            createAIDefence = aidefence.createAIDefence;
+            defender = aidefence.createAIDefence({ enableLearning });
         }
         catch {
-            output.error('AIDefence package not installed. Run: npm install @claude-flow/aidefence');
-            return { success: false, message: 'AIDefence not available' };
+            // Keep cold npx startup lean (#2561): the full learning engine remains
+            // user-installable, while the CLI always ships a deterministic scanner.
+            defender = createBuiltinAIDefence();
+            output.writeln(output.dim('Using built-in defense engine (install @claude-flow/aidefence for adaptive learning)'));
         }
-        const defender = createAIDefence({ enableLearning });
         // Show stats mode
         if (showStats) {
             const stats = await defender.getStats();
@@ -893,8 +895,8 @@ const defendCommand = {
                 output.writeln(output.dim(`Reading file: ${filePath}`));
             }
             catch (err) {
-                output.error(`Failed to read file: ${filePath}`);
-                return { success: false, message: 'File not found' };
+                output.printError(`Failed to read file: ${filePath}`);
+                return { success: false, exitCode: 2, message: 'File not found' };
             }
         }
         if (!textToScan) {
@@ -914,8 +916,9 @@ const defendCommand = {
         spinner.start();
         // Perform scan
         const startTime = performance.now();
-        const result = quickMode
-            ? { ...defender.quickScan(textToScan), threats: [], piiFound: false, detectionTimeMs: 0, inputHash: '', safe: !defender.quickScan(textToScan).threat }
+        const quickResult = quickMode ? defender.quickScan(textToScan) : undefined;
+        const result = quickResult
+            ? { ...quickResult, threats: [], piiFound: false, detectionTimeMs: 0, inputHash: '', safe: !quickResult.threat }
             : await defender.detect(textToScan);
         const scanTime = performance.now() - startTime;
         spinner.stop();
@@ -927,7 +930,8 @@ const defendCommand = {
                 piiFound: result.piiFound,
                 detectionTimeMs: scanTime,
             }, null, 2));
-            return { success: true };
+            const safe = result.safe && !result.piiFound;
+            return { success: safe, exitCode: safe ? 0 : 1 };
         }
         // Text output
         output.writeln();
@@ -969,7 +973,8 @@ const defendCommand = {
             }
         }
         output.writeln(output.dim(`Detection time: ${scanTime.toFixed(3)}ms`));
-        return { success: result.safe };
+        const safe = result.safe && !result.piiFound;
+        return { success: safe, exitCode: safe ? 0 : 1 };
     },
 };
 // Main security command

package/dist/src/funnel/insights.d.ts

@@ -30,6 +30,7 @@ export interface LocalInsight {
 export interface LocalInsightContext {
     security?: {
         status: string;
+        findings?: number;
         cvesFixed: number;
         totalCves: number;
     };

package/dist/src/funnel/insights.js

@@ -42,11 +42,11 @@ function securityInsight(ctx) {
     const s = ctx.security;
     if (!s)
         return null;
-    const pending = s.totalCves - s.cvesFixed;
-    if (pending > 0) {
+    const findings = Math.max(0, s.findings ?? 0);
+    if (s.status === 'ISSUES' || findings > 0) {
         return {
-            id: 'insight-cves-pending',
-            text: `⚠ ${pending} CVE${pending === 1 ? '' : 's'} pending — Run ruflo security scan --depth full`,
+            id: 'insight-security-findings',
+            text: `⚠ ${findings} security finding${findings === 1 ? '' : 's'} — Review the latest ruflo security scan`,
             priority: 90,
         };
     }

package/dist/src/funnel/local-signals.d.ts

@@ -1,6 +1,11 @@
 export interface SecurityStatus {
-    status: 'CLEAN' | 'IN_PROGRESS' | 'PENDING';
+    status: 'CLEAN' | 'ISSUES' | 'PENDING';
+    /** Generic code-pattern findings from `ruflo security scan` (not CVEs). */
+    findings: number;
+    scannedAt?: string;
+    /** @deprecated Retained as a zero-valued compatibility field. */
     cvesFixed: number;
+    /** @deprecated Retained as a zero-valued compatibility field. */
     totalCves: number;
 }
 export declare function getSecurityStatus(cwd?: string): SecurityStatus;

package/dist/src/funnel/local-signals.js

@@ -11,30 +11,39 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 export function getSecurityStatus(cwd = process.cwd()) {
+    const empty = {
+        status: 'PENDING', findings: 0, cvesFixed: 0, totalCves: 0,
+    };
     const scanResultsPath = path.join(cwd, '.claude', 'security-scans');
-    let cvesFixed = 0;
-    const totalCves = 3;
-    if (fs.existsSync(scanResultsPath)) {
-        try {
-            const scans = fs.readdirSync(scanResultsPath).filter((f) => f.endsWith('.json'));
-            cvesFixed = Math.min(totalCves, scans.length);
-        }
-        catch {
-            // Ignore
+    if (!fs.existsSync(scanResultsPath))
+        return empty;
+    try {
+        const files = fs.readdirSync(scanResultsPath).filter((f) => f.endsWith('.json'));
+        if (files.length === 0)
+            return empty;
+        let newest = files[0];
+        let newestMtime = -1;
+        for (const f of files) {
+            const st = fs.statSync(path.join(scanResultsPath, f));
+            if (st.mtimeMs > newestMtime) {
+                newestMtime = st.mtimeMs;
+                newest = f;
+            }
         }
+        const scan = JSON.parse(fs.readFileSync(path.join(scanResultsPath, newest), 'utf-8'));
+        const rawFindings = scan.summary?.total ?? scan.totalFindings ?? scan.findings?.length ?? 0;
+        const findings = Math.max(0, Number.isFinite(rawFindings) ? rawFindings : 0);
+        return {
+            status: findings > 0 ? 'ISSUES' : 'CLEAN',
+            findings,
+            scannedAt: typeof scan.timestamp === 'string' ? scan.timestamp : undefined,
+            cvesFixed: 0,
+            totalCves: 0,
+        };
     }
-    const auditPath = path.join(cwd, '.swarm', 'security');
-    if (fs.existsSync(auditPath)) {
-        try {
-            const audits = fs.readdirSync(auditPath).filter((f) => f.includes('audit'));
-            cvesFixed = Math.min(totalCves, Math.max(cvesFixed, audits.length));
-        }
-        catch {
-            // Ignore
-        }
+    catch {
+        return empty;
     }
-    const status = cvesFixed >= totalCves ? 'CLEAN' : cvesFixed > 0 ? 'IN_PROGRESS' : 'PENDING';
-    return { status, cvesFixed, totalCves };
 }
 export function getSwarmStatus() {
     let activeAgents = 0;

package/dist/src/init/executor.js

@@ -619,7 +619,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 initialized: new Date().toISOString(),
                 status: 'PENDING',
                 cvesFixed: 0,
-                totalCves: 3,
+                totalCves: 0,
                 lastScan: null,
                 _note: 'Run: npx @claude-flow/cli@latest security scan'
             };
@@ -1541,7 +1541,7 @@ async function writeInitialMetrics(targetDir, options, result) {
             initialized: new Date().toISOString(),
             status: 'PENDING',
             cvesFixed: 0,
-            totalCves: 3,
+            totalCves: 0,
             lastScan: null,
             _note: 'Run: npx @claude-flow/cli@latest security scan'
         };

package/dist/src/mcp-tools/hooks-tools.js

@@ -2010,8 +2010,9 @@ export const hooksSessionEnd = {
         }
         // Phase 5: Wire ReflexionMemory session end + NightlyLearner consolidation via bridge
         let sessionPersistence = null;
+        let bridge = null;
         try {
-            const bridge = await import('../memory/memory-bridge.js');
+            bridge = await import('../memory/memory-bridge.js');
             const result = await bridge.bridgeSessionEnd({
                 sessionId,
                 summary: saveState ? 'Session ended with state saved' : 'Session ended',
@@ -2028,6 +2029,17 @@ export const hooksSessionEnd = {
         catch {
             // Bridge not available
         }
+        finally {
+            // Release AgentDB/ONNX resources after one-shot session persistence.
+            // A partially initialized native pool can otherwise keep Node alive
+            // after the command has completed all logical work (#2691).
+            try {
+                await bridge?.shutdownBridge();
+            }
+            catch {
+                // Cleanup is best-effort and must not fail session-end.
+            }
+        }
         return {
             sessionId,
             duration: 3600000, // 1 hour in ms

package/dist/src/security/builtin-aidefence.d.ts

@@ -0,0 +1,34 @@
+export interface BuiltinThreat {
+    type: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    description: string;
+    confidence: number;
+}
+export interface DefenceResult {
+    safe: boolean;
+    threats: BuiltinThreat[];
+    piiFound: boolean;
+    detectionTimeMs: number;
+    inputHash: string;
+}
+export interface DefenceEngine {
+    detect(input: string): Promise<DefenceResult>;
+    quickScan(input: string): {
+        threat: boolean;
+        confidence: number;
+        type?: string;
+    };
+    getStats(): Promise<{
+        detectionCount: number;
+        avgDetectionTimeMs: number;
+        learnedPatterns: number;
+        mitigationStrategies: number;
+        avgMitigationEffectiveness: number;
+    }>;
+    getBestMitigation(type: string): Promise<{
+        strategy: string;
+        effectiveness: number;
+    } | null>;
+}
+export declare function createBuiltinAIDefence(): DefenceEngine;
+//# sourceMappingURL=builtin-aidefence.d.ts.map