@claude-flow/cli 3.32.29 → 3.32.30

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.32.29",
+    "version": "3.32.30",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
       "hook-handler.cjs": "50ea92a72651bdc95634f7588d56a5870963168eef5226f66ed14af3b47c8d9a",
@@ -8,6 +8,6 @@
       "statusline.cjs": "d2a0eac56d1267d8dbed2d70b09feb592299469196ec4b215909f2b052144882"
     }
   },
-  "signature": "jF/krskPhEF+3m0rkY3my1qEuLZec5hzo3YoV7xUl8/7xZqlpTctkB9QlYACViu2GCK3AGkWS7BRf5xR6WK7Aw==",
+  "signature": "6wQg/DXPVzG1hEnZzI0RcEi/6wfUnXyFYZ09Ho7jVHz84sbuX1flCWZA3qq5c8BvUtZ9/oCs9GOpEnMykGk4CA==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 3,
-  "generatedAt": "2026-07-29T04:47:25.187Z",
-  "gitSha": "39bc5fd9",
+  "generatedAt": "2026-07-29T05:35:40.000Z",
+  "gitSha": "1385e21b",
   "catalog": {
     "agents": 164,
     "tools": 395,

package/dist/src/init/claudemd-generator.js

@@ -19,6 +19,49 @@ function behavioralRules() {
 - Keep files under 500 lines
 - Validate input at system boundaries`;
 }
+function policyGovernedWorkflow() {
+    return `## Ruflo Capability Brain & Implementation Loop
+
+Ruflo is the coordination ledger and policy decision point. Claude Code is the
+executor: after a Ruflo coordination call, continue implementing the task.
+
+When it is registered, call
+\`guidance_brain({ mode: "recommend", task: "..." })\` before complex Ruflo
+work. Use its live registry instead of guessing tool names. Treat
+\`registered\`, \`configured\`, \`reachable\`, \`healthy\`, and \`authorized\`
+as separate facts. If the brain is unavailable, continue with the compatible
+\`guidance_recommend\` tool, CLI discovery, and repository instructions.
+
+Follow the returned loop:
+
+1. Recall memory and ADR constraints.
+2. Inspect source, runtime, dependencies, policy, and health.
+3. Route to the smallest capable topology, agents, skills, and tools.
+4. Plan acceptance criteria, safety envelope, ownership, and validation.
+5. Execute in isolated scopes; the coding agent performs the work.
+6. Test focused, regression, and failure paths.
+7. Validate types, security, policy, compatibility, and artifacts.
+8. Benchmark a source-bound candidate against a source-bound baseline.
+9. Optimize measured bottlenecks without weakening safety.
+10. Bind claims and evidence to exact source/build receipts.
+11. Reconcile concurrent handoffs and disclose limitations.
+12. Publish only through a separately authorized release gate.
+
+### Concurrency and authority
+
+- Never allow two writers in one worktree; give each writing agent an isolated
+  worktree and explicit file ownership.
+- Read-only research may run concurrently and report findings to the owner.
+- Only the integration owner edits shared manifests and lockfiles or reconciles
+  overlapping changes.
+- A child may drop capabilities but cannot add tools, network, secrets, spend,
+  concurrency, namespaces, or delegation depth.
+- A lease or claim coordinates ownership; it does not authorize a side effect.
+- Darwin, Flywheel, MetaHarness, memory, and neural systems may propose or
+  evaluate candidates but cannot self-promote or expand their SafetyEnvelope.
+- Bind tests, benchmarks, policy decisions, and release evidence to an exact
+  commit or immutable dirty-worktree snapshot.`;
+}
 function agentComms() {
     return `## Agent Comms (SendMessage-First Coordination)
 
@@ -61,8 +104,10 @@ SendMessage({ to: "researcher", summary: "Start", message: "[task context]" })
 - ALWAYS name agents — \`name: "role"\` makes them addressable
 - ALWAYS include comms instructions in prompts — who to message, what to send
 - Spawn ALL agents in ONE message with \`run_in_background: true\`
-- After spawning: STOP, tell user what's running, wait for results
-- NEVER poll status — agents message back or complete automatically`;
+- After spawning, continue independent local work; wait only when a dependency
+  genuinely blocks progress
+- Do not poll repeatedly — agents message back or complete automatically
+- Give every writing agent an isolated worktree and a non-overlapping file scope`;
 }
 function swarmConfig(options) {
     return `## Swarm & Routing
@@ -283,6 +328,7 @@ CLAUDE_FLOW_MEMORY_PATH=./data/memory
 const TEMPLATE_SECTIONS = {
     minimal: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => buildAndTest(),
@@ -291,6 +337,7 @@ const TEMPLATE_SECTIONS = {
     ],
     standard: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => memoryAndLearning(),
@@ -301,6 +348,7 @@ const TEMPLATE_SECTIONS = {
     ],
     full: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => memoryAndLearning(),
@@ -315,6 +363,7 @@ const TEMPLATE_SECTIONS = {
     ],
     security: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => securitySection(),
@@ -326,6 +375,7 @@ const TEMPLATE_SECTIONS = {
     ],
     performance: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         swarmConfig,
         (_opts) => performanceSection(),
@@ -338,6 +388,7 @@ const TEMPLATE_SECTIONS = {
     ],
     solo: [
         behavioralRules,
+        (_opts) => policyGovernedWorkflow(),
         (_opts) => agentComms(),
         (_opts) => memoryAndLearning(),
         (_opts) => buildAndTest(),

package/dist/src/mcp-tools/capability-brain.js

@@ -125,8 +125,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'guidance',
         name: 'Capability Guidance',
-        description: 'Live capability inventory, task routing, workflow guidance, and system discovery.',
         prefixes: ['guidance_'],
+        description: 'Live capability inventory, task routing, workflow guidance, and system discovery.',
         taskSignals: ['guidance', 'discover', 'capability', 'what can ruflo do'],
         commands: ['guidance compile', 'guidance retrieve', 'guidance gates', 'guidance optimize'],
         skills: [],
@@ -140,8 +140,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'identity-auth',
         name: 'Cognitum Identity & OAuth',
-        description: 'Profile-aware PKCE/OOB authentication, credential status, consent-bound scopes, refresh, and local logout.',
         prefixes: ['auth_', 'oauth_'],
+        description: 'Profile-aware PKCE/OOB authentication, credential status, consent-bound scopes, refresh, and local logout.',
         taskSignals: ['auth', 'oauth', 'login', 'logout', 'credential', 'profile', 'scope', 'consent'],
         commands: ['auth login', 'auth login --no-browser', 'auth status', 'auth status --check', 'auth logout'],
         skills: ['security-audit'],
@@ -163,8 +163,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'policy-authorization',
         name: 'Policy Authorization',
-        description: 'Policy-decision evaluation and status for exact subject/action/resource requests.',
         prefixes: ['policy_'],
+        description: 'Policy-decision evaluation and status for exact subject/action/resource requests.',
         taskSignals: ['policy', 'authorization', 'permission', 'capability', 'access control'],
         commands: ['policy evaluate', 'policy status', 'guidance gates'],
         skills: ['claims', 'security-audit', 'v3-security-overhaul'],
@@ -181,8 +181,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'work-claims',
         name: 'Exclusive Work Claims',
-        description: 'Repository/task ownership claims, handoffs, contention, stealing, and rebalance.',
         prefixes: ['claims_'],
+        description: 'Repository/task ownership claims, handoffs, contention, stealing, and rebalance.',
         taskSignals: ['work claim', 'claim task', 'handoff', 'ownership', 'concurrent work', 'rebalance'],
         commands: ['claims claim', 'claims handoff', 'claims status'],
         skills: ['claims'],
@@ -198,8 +198,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'content-safety',
         name: 'AIDefence Content Safety',
-        description: 'Prompt/content safety, PII detection, learning, and security evidence.',
         prefixes: ['aidefence_', 'security_'],
+        description: 'Prompt/content safety, PII detection, learning, and security evidence.',
         taskSignals: ['security', 'content safety', 'pii', 'prompt injection', 'threat', 'audit'],
         commands: ['security scan'],
         skills: ['security-audit', 'v3-security-overhaul'],
@@ -215,8 +215,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'metaharness-flywheel',
         name: 'MetaHarness, Darwin & Flywheel',
-        description: 'Candidate scoring, static analysis, threat modeling, genome exploration, and controlled improvement loops.',
         prefixes: ['metaharness_', 'autopilot_'],
+        description: 'Candidate scoring, static analysis, threat modeling, genome exploration, and controlled improvement loops.',
         taskSignals: ['metaharness', 'darwin', 'flywheel', 'genome', 'optimize', 'autopilot'],
         commands: ['metaharness score', 'metaharness genome', 'autopilot run'],
         skills: ['metaharness-brain', 'performance-analysis'],
@@ -233,8 +233,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'memory-knowledge',
         name: 'Memory, AgentDB & Embeddings',
-        description: 'Persistent memory, semantic/vector retrieval, namespaces, embeddings, and AgentDB controllers.',
         prefixes: ['memory_', 'agentdb_', 'embeddings_'],
+        description: 'Persistent memory, semantic/vector retrieval, namespaces, embeddings, and AgentDB controllers.',
         taskSignals: ['memory', 'agentdb', 'vector', 'embedding', 'semantic', 'recall'],
         commands: ['memory search', 'memory store', 'memory retrieve'],
         skills: ['memory-management', 'agentdb-advanced', 'agentdb-vector-search'],
@@ -250,8 +250,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'memory-branching',
         name: 'Copy-on-Write & Speculative Memory',
-        description: 'Low-cost memory branching, checkpoint, rollback, comparison, and validated promotion.',
         prefixes: ['agenticow_'],
+        description: 'Low-cost memory branching, checkpoint, rollback, comparison, and validated promotion.',
         taskSignals: ['branch memory', 'checkpoint', 'rollback', 'speculative'],
         commands: [],
         skills: ['agentdb-learning'],
@@ -267,8 +267,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'agents-runtimes',
         name: 'Agent Lifecycle & Runtimes',
-        description: 'Local agents, managed cloud agents, WASM sandboxes, and inference runtimes.',
         prefixes: ['agent_', 'managed_agent_', 'wasm_agent_', 'wasm_gallery_', 'ruvllm_'],
+        description: 'Local agents, managed cloud agents, WASM sandboxes, and inference runtimes.',
         taskSignals: ['agent', 'worker', 'wasm', 'sandbox', 'inference', 'managed agent'],
         commands: ['agent spawn', 'agent status', 'agent stop'],
         skills: ['agent-coder', 'agent-tester', 'agent-reviewer'],
@@ -284,8 +284,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'swarm-coordination',
         name: 'Swarm & Coordination',
-        description: 'Topology-aware multi-agent coordination, task ownership, and collective scheduling.',
         prefixes: ['swarm_', 'coordination_', 'daa_'],
+        description: 'Topology-aware multi-agent coordination, task ownership, and collective scheduling.',
         taskSignals: ['swarm', 'concurrent', 'parallel', 'coordinate', 'multi-agent'],
         commands: ['swarm init', 'swarm status', 'swarm coordinate'],
         skills: ['swarm-orchestration', 'swarm-advanced'],
@@ -299,8 +299,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'consensus-federation',
         name: 'Hive Mind & Consensus',
-        description: 'Hive, quorum, voting, gossip, and distributed agreement primitives.',
         prefixes: ['hive_', 'hive-mind_', 'consensus_', 'quorum_'],
+        description: 'Hive, quorum, voting, gossip, and distributed agreement primitives.',
         taskSignals: ['hive', 'consensus', 'quorum', 'byzantine', 'federation'],
         commands: ['hive-mind init', 'hive-mind status'],
         skills: ['hive-mind', 'hive-mind-advanced'],
@@ -314,8 +314,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'tasks-workflows-sessions',
         name: 'Tasks, Workflows, Sessions & Progress',
-        description: 'Task orchestration, reusable workflows, session state, progress, and handoff.',
         prefixes: ['task_', 'workflow_', 'session_', 'progress_'],
+        description: 'Task orchestration, reusable workflows, session state, progress, and handoff.',
         taskSignals: ['task', 'workflow', 'session', 'handoff', 'progress'],
         commands: ['task create', 'task status', 'workflow run'],
         skills: ['workflow-automation'],
@@ -329,8 +329,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'hooks-learning-routing',
         name: 'Hooks, Coverage & Learning Routing',
-        description: 'Lifecycle hooks, coverage-aware routing, background workers, and validated pattern capture.',
         prefixes: ['hooks_', 'coverage_'],
+        description: 'Lifecycle hooks, coverage-aware routing, background workers, and validated pattern capture.',
         taskSignals: ['hook', 'coverage', 'route', 'worker', 'learning'],
         commands: ['hooks pre-task', 'hooks post-task', 'hooks route', 'hooks coverage-gaps'],
         skills: ['hooks-automation'],
@@ -345,8 +345,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'analysis-quality',
         name: 'Analysis & Quality',
-        description: 'Code/project analysis, quality assessment, and change inspection.',
         prefixes: ['analyze_', 'analysis_'],
+        description: 'Code/project analysis, quality assessment, and change inspection.',
         taskSignals: ['analyze', 'review', 'quality', 'dependency'],
         commands: ['analyze code', 'analyze project'],
         skills: ['verification-quality'],
@@ -360,8 +360,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'test-generation',
         name: 'TDD Test Generation',
-        description: 'TDD repair and test-generation capability exported by Ruflo but intentionally reported as unregistered until the MCP registry enables it.',
         prefixes: ['testgen_'],
+        description: 'TDD repair and test-generation capability exported by Ruflo but intentionally reported as unregistered until the MCP registry enables it.',
         exactTools: ['testgen_tdd_repair'],
         taskSignals: ['generate tests', 'tdd repair', 'test generation'],
         commands: [],
@@ -379,8 +379,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'performance-neural',
         name: 'Performance & Neural Optimization',
-        description: 'Profiling, benchmarks, learned routing, pattern training, and optimization.',
         prefixes: ['performance_', 'neural_'],
+        description: 'Profiling, benchmarks, learned routing, pattern training, and optimization.',
         taskSignals: ['performance', 'benchmark', 'profile', 'latency', 'neural', 'train'],
         commands: ['performance benchmark', 'performance profile', 'neural train'],
         skills: ['performance-analysis', 'neural-training'],
@@ -396,8 +396,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'browser-web',
         name: 'Browser & Web Actions',
-        description: 'Browser sessions, page actions, intent routing, and guarded HTTP probes.',
         prefixes: ['browser_', 'http_fetch'],
+        description: 'Browser sessions, page actions, intent routing, and guarded HTTP probes.',
         taskSignals: ['browser', 'web page', 'navigate', 'click', 'http', 'fetch'],
         commands: ['browser open', 'browser act'],
         skills: [],
@@ -413,8 +413,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'github-delivery',
         name: 'GitHub & Delivery',
-        description: 'Issues, pull requests, workflows, releases, repository automation, and handoff.',
         prefixes: ['github_', 'pr_', 'release_'],
+        description: 'Issues, pull requests, workflows, releases, repository automation, and handoff.',
         taskSignals: ['github', 'issue', 'pull request', 'merge', 'release', 'publish'],
         commands: ['github pr', 'github release'],
         skills: ['github-automation', 'github-release-management'],
@@ -429,9 +429,9 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'business-collaboration',
         name: 'AgentBBS & Business Pods',
-        description: 'Federated business rooms, domain-affinity routing, and business-pod validation.',
         // Metadata classification only; execution remains behind the existing loadAgentbbs guard.
         prefixes: ['agentbbs_', 'business_pod_', 'federation_bbs_'],
+        description: 'Federated business rooms, domain-affinity routing, and business-pod validation.',
         taskSignals: ['business pod', 'bbs', 'room', 'domain affinity'],
         commands: [],
         skills: [],
@@ -447,8 +447,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'configuration-transfer',
         name: 'Configuration & Transfer',
-        description: 'Configuration state plus portable import, export, backup, and migration.',
         prefixes: ['config_', 'transfer_'],
+        description: 'Configuration state plus portable import, export, backup, and migration.',
         taskSignals: ['config', 'setup', 'import', 'export', 'backup', 'migrate'],
         commands: ['config show', 'memory export'],
         skills: [],
@@ -463,8 +463,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'system-terminal',
         name: 'System & Terminal Compatibility',
-        description: 'System diagnostics and legacy-compatible terminal execution surfaces.',
         prefixes: ['system_', 'terminal_', 'mcp_'],
+        description: 'System diagnostics and legacy-compatible terminal execution surfaces.',
         taskSignals: ['terminal', 'shell', 'doctor', 'system status'],
         commands: ['doctor', 'status'],
         skills: [],
@@ -479,8 +479,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'runtime-services',
         name: 'Other Registered Runtime Services',
-        description: 'Live MCP tools not yet assigned to a specialized domain; included so coverage is never silently incomplete.',
         prefixes: [],
+        description: 'Live MCP tools not yet assigned to a specialized domain; included so coverage is never silently incomplete.',
         taskSignals: [],
         commands: [],
         skills: [],

package/dist/src/mcp-tools/guidance-tools.js

@@ -814,7 +814,7 @@ const guidanceQuickRef = {
 };
 const guidanceBrain = {
     name: 'guidance_brain',
-    description: 'Query Ruflo’s live capability brain. Covers every registered MCP tool, separates registration from configuration/reachability/health/authorization, recommends capabilities for a task, and returns the validated implementation loop.',
+    description: 'Use when choosing how to execute a task with Ruflo. Queries the live capability brain, covers every registered MCP tool, separates registration from configuration/reachability/health/authorization, recommends capabilities, and returns the validated implementation loop.',
     inputSchema: {
         type: 'object',
         properties: {

package/node_modules/@claude-flow/codex/.agents/skills/memory-management/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: memory-management
+description: >
+  AgentDB memory system with HNSW vector search.
+  Use when: need to store patterns, search for solutions, semantic lookup.
+  Skip when: no learning needed, ephemeral tasks.
+---
+
+# Memory Management Skill
+
+## Purpose
+AgentDB memory system with HNSW vector search.
+
+## When to Trigger
+- need to store patterns
+- search for solutions
+- semantic lookup
+
+## When to Skip
+- no learning needed
+- ephemeral tasks
+
+## Commands
+
+### Store Data
+Store a pattern in memory
+
+```bash
+npx @claude-flow/cli memory store --key "key" --value "value" --namespace patterns
+```
+
+### Search Data
+Semantic search in memory
+
+```bash
+npx @claude-flow/cli memory search --query "search terms" --limit 10
+```
+
+
+
+## Best Practices
+1. Check memory for existing patterns before starting
+2. Use hierarchical topology for coordination
+3. Store successful patterns after completion
+4. Document any new learnings

package/node_modules/@claude-flow/codex/.agents/skills/security-audit/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: security-audit
+description: >
+  Security scanning and vulnerability detection.
+  Use when: authentication, authorization, payment processing, user data.
+  Skip when: read-only operations, internal tooling.
+---
+
+# Security Audit Skill
+
+## Purpose
+Security scanning and vulnerability detection.
+
+## When to Trigger
+- authentication
+- authorization
+- payment processing
+- user data
+
+## When to Skip
+- read-only operations
+- internal tooling
+
+## Commands
+
+### Full Security Scan
+Run comprehensive security analysis
+
+```bash
+npx @claude-flow/cli security scan --depth full
+```
+
+### Input Validation Check
+Check for input validation issues
+
+```bash
+npx @claude-flow/cli security scan --check input-validation
+```
+
+
+
+## Best Practices
+1. Check memory for existing patterns before starting
+2. Use hierarchical topology for coordination
+3. Store successful patterns after completion
+4. Document any new learnings

package/node_modules/@claude-flow/codex/.agents/skills/sparc-methodology/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: sparc-methodology
+description: >
+  SPARC development workflow (Specification, Pseudocode, Architecture, Refinement, Completion).
+  Use when: new features, complex implementations, architectural changes.
+  Skip when: simple fixes, documentation, configuration.
+---
+
+# Sparc Methodology Skill
+
+## Purpose
+SPARC development workflow (Specification, Pseudocode, Architecture, Refinement, Completion).
+
+## When to Trigger
+- new features
+- complex implementations
+- architectural changes
+
+## When to Skip
+- simple fixes
+- documentation
+- configuration
+
+## Commands
+
+### Specification Phase
+Define requirements and acceptance criteria
+
+```bash
+npx @claude-flow/cli hooks route --task "specification: [requirements]"
+```
+
+### Architecture Phase
+Design system structure
+
+```bash
+npx @claude-flow/cli hooks route --task "architecture: [design]"
+```
+
+
+
+## Best Practices
+1. Check memory for existing patterns before starting
+2. Use hierarchical topology for coordination
+3. Store successful patterns after completion
+4. Document any new learnings

package/node_modules/@claude-flow/codex/.agents/skills/swarm-orchestration/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: swarm-orchestration
+description: >
+  Multi-agent swarm coordination for complex tasks.
+  Use when: 3+ files need changes, new features, refactoring.
+  Skip when: single file edits, simple fixes, documentation.
+---
+
+# Swarm Orchestration Skill
+
+## Purpose
+Multi-agent swarm coordination for complex tasks.
+
+## When to Trigger
+- 3+ files need changes
+- new features
+- refactoring
+
+## When to Skip
+- single file edits
+- simple fixes
+- documentation
+
+## Commands
+
+### Initialize Swarm
+Start a new swarm with hierarchical topology
+
+```bash
+npx @claude-flow/cli swarm init --topology hierarchical --max-agents 8
+```
+
+### Route Task
+Route a task to the appropriate agents
+
+```bash
+npx @claude-flow/cli hooks route --task "[task description]"
+```
+
+### Monitor Status
+Check the current swarm status
+
+```bash
+npx @claude-flow/cli swarm status
+```
+
+
+
+## Best Practices
+1. Check memory for existing patterns before starting
+2. Use hierarchical topology for coordination
+3. Store successful patterns after completion
+4. Document any new learnings