@claude-flow/cli 3.32.35 → 3.32.36

package/dist/src/commands/doctor.js

@@ -120,8 +120,8 @@ async function checkConfigFile() {
 }
 // Check daemon status
 /**
- * #2448 — Detect the runaway `npx @claude-flow/cli@latest` statusLine / hook
- * commands left over in `.claude/settings.json` from pre-#2337 installs.
+ * #2448 / #2677 — Detect runaway `npx @claude-flow/cli@latest` commands
+ * left over in `.claude/settings.json` from pre-#2337 installs.
  *
  * These fire on every Claude Code event (statusLine refires every few hundred
  * ms, hooks fire per tool-use), each spawning a cold Node process + npm
@@ -138,7 +138,9 @@ async function checkStaleSettingsNpx() {
     // Same regex pattern the executor migration uses — kept in sync. Flag-list
     // repetition bounded at 10 (CodeQL js/redos — unbounded `*` here is
     // exponential-backtracking-prone on a crafted settings.json).
-    const BROKEN_RE = /npx\s+(?:--?\S+\s+){0,10}@?claude-flow\/cli@latest\s+hooks\s+(?:statusline|\S+)/;
+    // Every subcommand incurs the same cold npm process/registry cost. The
+    // previous `hooks` literal missed `memory`, `daemon`, `swarm`, etc.
+    const BROKEN_RE = /npx\s+(?:--?\S+\s+){0,10}@?claude-flow\/cli@latest\s+\S+/;
     // Look in both project-local and home-dir settings.
     const candidates = [
         join(process.cwd(), '.claude', 'settings.json'),
@@ -263,18 +265,21 @@ async function checkMemoryDatabase() {
 // The existing `checkMemoryDatabase` above asserts existence + statability
 // only, so it CANNOT distinguish a healthy DB from a 99.97%-empty or
 // SQLite-malformed one. Stuinfla reported both cases live (81-store fleet).
-// The three checks below layer functional assertions on top, ordered so
+// The checks below layer functional assertions on top, ordered so
 // the earliest chain-break is always the first red the user sees:
 //   1. Integrity          — can sql.js open it AND does PRAGMA integrity_check pass?
 //   2. Content            — do most memory_entries rows carry non-empty content?
 //   3. Embedding coverage — do most rows have a vector? (unembedded rows are
 //                           both unrecallable AND undistillable per ADR-174)
+//   6. Reflexion coverage — can episodes participate in retrieveRelevant's
+//                           required episode_embeddings INNER JOIN?
+//      Feedback critiques — do execution-tier episodes carry a real lesson?
 // Ordering matters: content ratio is meaningless on a DB that can't open;
 // embedding coverage is meaningless on rows with no content. First red wins.
 //
-// Recall probe (stuinfla check 4) requires actual write+search+delete round
-// trips through the CLI's own memory pipeline — deferred to a follow-up PR
-// to keep this one purely additive and safe.
+// Recall probe (stuinfla check 4) still requires an isolated write+search+
+// delete round trip through the CLI's own memory pipeline. It remains separate
+// because doctor otherwise stays read-only.
 //
 // Design rules (also from stuinfla's report):
 //   - "A check that cannot fail protects nothing" — every check has a
@@ -731,6 +736,102 @@ async function checkMemoryEmbeddingCoverage() {
         catch { /* best-effort */ }
     }
 }
+// #2677 check 6 — ReflexionMemory.retrieveRelevant() INNER JOINs episodes to
+// episode_embeddings. A populated episodes table with an empty/missing partner
+// table is therefore not degraded recall; it is structurally zero recall.
+async function checkMemoryReflexionCoverage() {
+    const dbPath = await resolveMemoryDbPath();
+    if (!dbPath)
+        return { name: 'Memory Reflexion Coverage', status: 'warn', message: 'no memory.db found' };
+    const db = await tryOpenSqlJs(dbPath);
+    if (!db)
+        return { name: 'Memory Reflexion Coverage', status: 'warn', message: 'DB unreadable (see Memory Integrity)' };
+    try {
+        const tables = new Set(db.exec("SELECT name FROM sqlite_master WHERE type='table' AND name IN ('episodes','episode_embeddings')")[0]?.values?.map((v) => String(v[0])) ?? []);
+        if (!tables.has('episodes')) {
+            return { name: 'Memory Reflexion Coverage', status: 'warn', message: 'episodes table absent — AgentDB Reflexion schema not initialized' };
+        }
+        const episodes = Number(db.exec('SELECT count(*) FROM episodes')[0]?.values?.[0]?.[0] ?? 0);
+        if (episodes === 0) {
+            return { name: 'Memory Reflexion Coverage', status: 'warn', message: `${dbPath} — 0 episodes (Reflexion has not been exercised)` };
+        }
+        if (!tables.has('episode_embeddings')) {
+            return {
+                name: 'Memory Reflexion Coverage',
+                status: 'fail',
+                message: `${dbPath} — episode embeddings 0/${episodes} (0.00%); retrieveRelevant() cannot return rows`,
+                fix: 'run `claude-flow memory distill run`; current distillation creates/backfills episode_embeddings',
+            };
+        }
+        const embedded = Number(db.exec('SELECT count(*) FROM episodes e JOIN episode_embeddings ee ON ee.episode_id=e.id')[0]?.values?.[0]?.[0] ?? 0);
+        const ratio = embedded / episodes;
+        const detail = `episode embeddings ${embedded}/${episodes} (${(ratio * 100).toFixed(2)}%)`;
+        if (ratio < 0.95) {
+            return {
+                name: 'Memory Reflexion Coverage',
+                status: 'fail',
+                message: `${dbPath} — ${detail} below 95% floor; retrieveRelevant() cannot see uncovered episodes`,
+                fix: 'run `claude-flow memory distill run` to populate retrievable episodes',
+            };
+        }
+        return { name: 'Memory Reflexion Coverage', status: 'pass', message: `${dbPath} — ${detail}` };
+    }
+    catch (e) {
+        return { name: 'Memory Reflexion Coverage', status: 'warn', message: `${dbPath} — probe threw: ${e.message || String(e)}` };
+    }
+    finally {
+        try {
+            db.close();
+        }
+        catch { /* best-effort */ }
+    }
+}
+// Execution-tier feedback should carry a lesson, not just reward/success bits.
+// Proxy episodes intentionally remain critique-free to avoid laundering a
+// structural summary into an observed failure explanation.
+async function checkMemoryCritiqueCoverage() {
+    const dbPath = await resolveMemoryDbPath();
+    if (!dbPath)
+        return { name: 'Memory Feedback Critiques', status: 'warn', message: 'no memory.db found' };
+    const db = await tryOpenSqlJs(dbPath);
+    if (!db)
+        return { name: 'Memory Feedback Critiques', status: 'warn', message: 'DB unreadable (see Memory Integrity)' };
+    try {
+        const hasEpisodes = (db.exec("SELECT count(*) FROM sqlite_master WHERE type='table' AND name='episodes'")[0]?.values?.[0]?.[0] ?? 0) > 0;
+        if (!hasEpisodes)
+            return { name: 'Memory Feedback Critiques', status: 'warn', message: 'episodes table absent' };
+        const row = db.exec(`
+      SELECT count(*),
+        sum(CASE WHEN length(trim(coalesce(critique,''))) > 0 THEN 1 ELSE 0 END)
+      FROM episodes WHERE session_id LIKE 'distill:feedback%'
+    `)[0]?.values?.[0] ?? [0, 0];
+        const feedback = Number(row[0] ?? 0);
+        const withCritique = Number(row[1] ?? 0);
+        if (feedback === 0) {
+            return { name: 'Memory Feedback Critiques', status: 'warn', message: `${dbPath} — 0 execution-feedback episodes to assess` };
+        }
+        const ratio = withCritique / feedback;
+        const detail = `feedback critiques ${withCritique}/${feedback} (${(ratio * 100).toFixed(2)}%)`;
+        if (ratio < 0.95) {
+            return {
+                name: 'Memory Feedback Critiques',
+                status: 'fail',
+                message: `${dbPath} — ${detail} below 95% floor`,
+                fix: 'run current `claude-flow memory distill run`; execution-tier episodes preserve observed critique/error text',
+            };
+        }
+        return { name: 'Memory Feedback Critiques', status: 'pass', message: `${dbPath} — ${detail}` };
+    }
+    catch (e) {
+        return { name: 'Memory Feedback Critiques', status: 'warn', message: `${dbPath} — probe threw: ${e.message || String(e)}` };
+    }
+    finally {
+        try {
+            db.close();
+        }
+        catch { /* best-effort */ }
+    }
+}
 // #2545: Check that the self-learning bridge can actually load @claude-flow/memory
 // the SAME way the SessionStart auto-memory hook does. On the documented `npx ruflo`
 // path the package lands in the npx cache — unreachable from the project — so the
@@ -1027,6 +1128,48 @@ async function checkMcpServers() {
         fix: 'claude mcp add ruflo -- npx -y ruflo@latest mcp start',
     };
 }
+// #2726 — tools/list is fixed prompt overhead on clients/backends that do not
+// defer MCP schemas. Measure the actual live registry and warn before a small
+// context window becomes unrecoverable even after compaction.
+async function checkMcpSchemaOverhead() {
+    try {
+        const [{ listMCPTools }, { assessMcpSchemaOverhead, filterAdvertisedMcpTools, parseMcpToolSelection, }] = await Promise.all([
+            import('../mcp-client.js'),
+            import('../mcp-server.js'),
+        ]);
+        // The `mcp start --tools` CLI flag takes precedence when the server is
+        // constructed. Doctor intentionally inspects the environment fallback so
+        // its estimate describes the configuration inherited by MCP clients.
+        const selection = parseMcpToolSelection(process.env.CLAUDE_FLOW_MCP_TOOLS);
+        const tools = filterAdvertisedMcpTools(listMCPTools(), selection);
+        // This is diagnostic metadata about the external client's context window,
+        // not Ruflo command configuration, so there is no corresponding CLI flag.
+        const rawWindow = process.env.CLAUDE_FLOW_CONTEXT_WINDOW_TOKENS;
+        const contextWindow = rawWindow ? Number.parseInt(rawWindow, 10) : undefined;
+        const assessment = assessMcpSchemaOverhead(tools, contextWindow);
+        const ratio = assessment.ratio === undefined
+            ? ''
+            : `, ${(assessment.ratio * 100).toFixed(1)}% of ${assessment.contextWindowTokens}-token window`;
+        const selectionLabel = selection === 'all' ? 'all tools' : `filtered: ${selection.join(',')}`;
+        const message = `${assessment.toolCount} advertised tools ≈ ${assessment.estimatedTokens} schema tokens (${selectionLabel}${ratio})`;
+        if (assessment.risk === 'high') {
+            return {
+                name: 'MCP Schema Overhead',
+                status: 'warn',
+                message,
+                fix: 'Set CLAUDE_FLOW_MCP_TOOLS to required categories/tool names (for example: memory,swarm,agent,hooks) and optionally CLAUDE_FLOW_CONTEXT_WINDOW_TOKENS to your backend limit.',
+            };
+        }
+        return { name: 'MCP Schema Overhead', status: 'pass', message };
+    }
+    catch (error) {
+        return {
+            name: 'MCP Schema Overhead',
+            status: 'warn',
+            message: `Unable to measure: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
 // Check disk space (async with proper env inheritance)
 async function checkDiskSpace() {
     try {
@@ -1843,7 +1986,7 @@ export const doctorCommand = {
         {
             name: 'component',
             short: 'c',
-            description: 'Check specific component (version, node, npm, config, daemon, memory, api, git, mcp, claude, disk, typescript, agentic-flow, encryption, federation, funnel, proxy, auth, metaharness)',
+            description: 'Check specific component (version, node, npm, config, daemon, memory, api, git, mcp, mcp-overhead, claude, disk, typescript, agentic-flow, encryption, federation, funnel, proxy, auth, metaharness)',
             type: 'string'
         },
         {
@@ -1958,13 +2101,14 @@ export const doctorCommand = {
             checkGit,
             checkGitRepo,
             checkConfigFile,
-            checkStaleSettingsNpx, // #2448 — runaway `npx @latest` in statusLine/hooks
+            checkStaleSettingsNpx, // #2448/#2677 — runaway `npx @latest` in settings
             checkDaemonStatus,
             checkMemoryDatabase,
             checkMemoryStructuralIntegrity, // #2737 — bounded, native quick_check on every default run
             checkLearningBridge, // #2545 — can the auto-memory hook actually load @claude-flow/memory?
             checkApiKeys,
             checkMcpServers,
+            checkMcpSchemaOverhead, // #2726 — fixed tools/list prompt cost
             checkAIDefence, // #1807
             checkDiskSpace,
             checkBuildTools,
@@ -1982,8 +2126,9 @@ export const doctorCommand = {
         // array — expanded at execution time. Stuinfla's report showed the
         // existence-only check reporting PASS on a 99.97%-empty and even a
         // SQLite-malformed DB; the array here layers integrity → content →
-        // embedding coverage over the existing existence probe, ordered so
-        // the earliest chain-break is always the first red the user sees.
+        // embedding coverage over the existing existence probe; check 6 then
+        // verifies that distilled episodes are actually Reflexion-retrievable and
+        // execution feedback carries a lesson.
         const componentMap = {
             'version': checkVersionFreshness,
             'freshness': checkVersionFreshness,
@@ -1998,12 +2143,15 @@ export const doctorCommand = {
                 checkMemoryIntegrity, // #2677 check 1: sql.js open + PRAGMA integrity_check
                 checkMemoryContent, // #2677 check 2: memory_entries content coverage
                 checkMemoryEmbeddingCoverage, // #2677 check 3: vector coverage on populated rows
+                checkMemoryReflexionCoverage, // #2677 check 6: episodes are retrievable
+                checkMemoryCritiqueCoverage, // #2677 check 6: feedback carries lessons
             ],
             'learning': checkLearningBridge, // #2545
             'learning-bridge': checkLearningBridge, // #2545
             'api': checkApiKeys,
             'git': checkGit,
             'mcp': checkMcpServers,
+            'mcp-overhead': checkMcpSchemaOverhead,
             'aidefence': checkAIDefence, // #1807
             'disk': checkDiskSpace,
             'typescript': checkBuildTools,

package/dist/src/commands/hooks.js

@@ -1218,8 +1218,20 @@ const metricsCommand = {
             const totalPatterns = safeNum(rawMetrics.patterns?.total ?? rawMetrics.summary?.patternsLearned);
             const successfulPatterns = safeNum(rawMetrics.patterns?.successful ?? Math.round(safeNum(rawMetrics.summary?.successRate) * totalPatterns));
             const failedPatterns = Math.max(0, safeNum(rawMetrics.patterns?.failed ?? totalPatterns - successfulPatterns));
+            const unknownPatterns = Math.max(0, safeNum(rawMetrics.patterns?.unknown));
+            const describedPatterns = Math.max(0, safeNum(rawMetrics.patterns?.described));
+            const descriptionCoverage = safeNum(rawMetrics.patterns?.descriptionCoverage ??
+                (totalPatterns > 0 ? describedPatterns / totalPatterns : 0));
             const avgConfidence = safeNum(rawMetrics.patterns?.avgConfidence ?? rawMetrics.summary?.avgQuality);
-            const routingAccuracy = safeNum(rawMetrics.agents?.routingAccuracy ?? rawMetrics.routing?.avgConfidence);
+            const routingAccuracy = rawMetrics.agents?.routingAccuracy == null
+                ? null
+                : safeNum(rawMetrics.agents.routingAccuracy);
+            const averageRoutingConfidence = safeNum(rawMetrics.agents?.averageConfidence ??
+                rawMetrics.routing?.avgConfidence ??
+                rawMetrics.patterns?.avgConfidence);
+            const routingOutcomeSuccessRate = rawMetrics.agents?.outcomeSuccessRate == null
+                ? null
+                : safeNum(rawMetrics.agents.outcomeSuccessRate);
             const totalRoutes = safeNum(rawMetrics.agents?.totalRoutes ?? rawMetrics.routing?.totalRoutes);
             const topAgent = rawMetrics.agents?.topAgent ?? rawMetrics.routing?.topAgents?.[0]?.agent ?? 'n/a';
             const totalCommands = safeNum(rawMetrics.commands?.totalExecuted ?? rawMetrics.commands?.totalCommands);
@@ -1227,8 +1239,22 @@ const metricsCommand = {
             const avgRiskScore = safeNum(rawMetrics.commands?.avgRiskScore ?? rawMetrics.commands?.avgExecutionTime);
             const result = {
                 ...rawMetrics,
-                patterns: { total: totalPatterns, successful: successfulPatterns, failed: failedPatterns, avgConfidence },
-                agents: { routingAccuracy, totalRoutes, topAgent },
+                patterns: {
+                    total: totalPatterns,
+                    successful: successfulPatterns,
+                    failed: failedPatterns,
+                    unknown: unknownPatterns,
+                    described: describedPatterns,
+                    descriptionCoverage,
+                    avgConfidence,
+                },
+                agents: {
+                    routingAccuracy,
+                    averageConfidence: averageRoutingConfidence,
+                    outcomeSuccessRate: routingOutcomeSuccessRate,
+                    totalRoutes,
+                    topAgent,
+                },
                 commands: { totalExecuted: totalCommands, successRate: commandSuccessRate, avgRiskScore },
             };
             if (ctx.flags.format === 'json') {
@@ -1246,6 +1272,8 @@ const metricsCommand = {
                     { metric: 'Total Patterns', value: totalPatterns },
                     { metric: 'Successful', value: output.success(String(successfulPatterns)) },
                     { metric: 'Failed', value: output.error(String(failedPatterns)) },
+                    ...(unknownPatterns > 0 ? [{ metric: 'Unclassified', value: String(unknownPatterns) }] : []),
+                    { metric: 'With Task Context', value: `${(descriptionCoverage * 100).toFixed(1)}%` },
                     { metric: 'Avg Confidence', value: `${(avgConfidence * 100).toFixed(1)}%` }
                 ]
             });
@@ -1258,7 +1286,14 @@ const metricsCommand = {
                     { key: 'value', header: 'Value', width: 20, align: 'right' }
                 ],
                 data: [
-                    { metric: 'Routing Accuracy', value: `${(routingAccuracy * 100).toFixed(1)}%` },
+                    {
+                        metric: routingAccuracy === null ? 'Avg Confidence' : 'Routing Accuracy',
+                        value: `${((routingAccuracy ?? averageRoutingConfidence) * 100).toFixed(1)}%`,
+                    },
+                    ...(routingOutcomeSuccessRate === null ? [] : [{
+                            metric: 'Outcome Success Rate',
+                            value: `${(routingOutcomeSuccessRate * 100).toFixed(1)}%`,
+                        }]),
                     { metric: 'Total Routes', value: totalRoutes },
                     { metric: 'Top Agent', value: output.highlight(topAgent) }
                 ]

package/dist/src/commands/mcp.js

@@ -63,7 +63,7 @@ const startCommand = {
         },
         {
             name: 'tools',
-            description: 'Tools to enable (comma-separated or "all")',
+            description: 'Tools to advertise (comma-separated categories, prefixes, exact names, or "all")',
             type: 'string',
             default: 'all'
         },

package/dist/src/commands/memory-distill.js

@@ -182,6 +182,7 @@ const runCommand = {
             data: [
                 { metric: 'Processed', value: String(report.processed) },
                 { metric: 'Episodes', value: String(report.episodes) },
+                { metric: 'Episode Embeddings', value: String(report.episodeEmbeddings) },
                 { metric: 'Patterns', value: String(report.patterns) },
                 { metric: 'Pattern Embeddings', value: String(report.patternEmbeddings) },
                 { metric: 'Causal Edges', value: String(report.causalEdges) },

package/dist/src/commands/swarm.js

@@ -50,6 +50,34 @@ function getSwarmStatus(swarmId) {
             // Ignore
         }
     }
+    // The canonical agent registry is the same source used by `agent list`.
+    // Prefer it over the swarm-level coordination boolean so idle agents are
+    // not reported as active (#2808). Hive agents are merged additively.
+    if (totalAgents === 0) {
+        try {
+            const canonicalPath = path.join(process.cwd(), '.claude-flow', 'agents', 'store.json');
+            const hivePath = path.join(process.cwd(), '.claude-flow', 'agents.json');
+            const merged = {};
+            for (const storePath of [hivePath, canonicalPath]) {
+                if (!fs.existsSync(storePath))
+                    continue;
+                const parsed = JSON.parse(fs.readFileSync(storePath, 'utf-8'));
+                if (parsed?.agents && typeof parsed.agents === 'object') {
+                    Object.assign(merged, parsed.agents);
+                }
+            }
+            const agents = Object.values(merged).filter(agent => agent.status !== 'terminated');
+            if (agents.length > 0) {
+                totalAgents = agents.length;
+                activeAgents = agents.filter(agent => agent.status === 'active' ||
+                    agent.status === 'running' ||
+                    agent.status === 'busy').length;
+            }
+        }
+        catch {
+            // Ignore — the count-only activity file remains the final fallback.
+        }
+    }
     // #2799 — `agent spawn` never writes `.swarm/agents/*.json`; it records
     // the count in `.claude-flow/metrics/swarm-activity.json` (via
     // updateSwarmActivityMetrics in commands/agent.ts). So when the agents

package/dist/src/init/executor.js

@@ -370,18 +370,19 @@ function mergeSettingsForUpgrade(existing) {
     // js/redos): a crafted settings.json command string with dozens of
     // dash-token repetitions can hang this check for minutes.
     const BROKEN_STATUSLINE_RE = /(?:npx\s+(?:--?\S+\s+){0,10})?@?claude-flow(?:\/cli)?(?:@\S+)?\s+hooks\s+statusline/;
+    const BROKEN_NPX_LATEST_RE = /npx\s+(?:--?\S+\s+){0,10}@?claude-flow\/cli@latest\s+\S+/;
     const existingStatusLine = existing.statusLine;
     if (existingStatusLine) {
         const existingCmd = typeof existingStatusLine.command === 'string' ? existingStatusLine.command : '';
-        const isBroken = BROKEN_STATUSLINE_RE.test(existingCmd);
+        const isBroken = BROKEN_STATUSLINE_RE.test(existingCmd) || BROKEN_NPX_LATEST_RE.test(existingCmd);
         merged.statusLine = {
             type: 'command',
             command: isBroken || !existingCmd ? NEW_STATUSLINE_CMD : existingCmd,
             // Remove invalid fields: refreshMs, enabled (not supported by Claude Code)
         };
     }
-    // #2448 — Detect and REGENERATE per-action hook commands that still use
-    // the runaway `npx @claude-flow/cli@latest hooks <sub>` form. These fire
+    // #2448 / #2677 — Detect and REGENERATE per-action hook commands that still
+    // use the runaway `npx @claude-flow/cli@latest hooks <sub>` form. These fire
     // on every PreToolUse/PostToolUse/UserPromptSubmit, each spawning ~130 MB
     // of cold Node + npm registry resolution; the storm is what kernel-paniced
     // the reporter's machine in #2448.
@@ -409,15 +410,20 @@ function mergeSettingsForUpgrade(existing) {
             for (const group of groups) {
                 if (!Array.isArray(group.hooks))
                     continue;
-                for (const h of group.hooks) {
+                group.hooks = group.hooks.filter((h) => {
                     if (typeof h?.command !== 'string')
-                        continue;
+                        return true;
                     const m = BROKEN_HOOK_RE.exec(h.command);
-                    if (!m)
-                        continue;
-                    // Subcommand captured (e.g. "pre-bash", "post-edit", "route") — keep it.
-                    h.command = localHookCmd(m[1]);
-                }
+                    if (m) {
+                        // Subcommand captured (e.g. "pre-bash", "post-edit", "route") — keep it.
+                        h.command = localHookCmd(m[1]);
+                        return true;
+                    }
+                    // Sibling CLI invocations (memory/daemon/swarm/...) have no
+                    // hook-handler equivalent. Drop the stale extra; the merge above
+                    // has already installed current local-helper hooks for this event.
+                    return !BROKEN_NPX_LATEST_RE.test(h.command);
+                });
             }
         }
     }

package/dist/src/init/helpers-generator.js

@@ -775,11 +775,22 @@ export function generateIntelligenceStub() {
         "const path = require('path');",
         "const os = require('os');",
         '',
-        "const DATA_DIR = path.join(process.cwd(), '.claude-flow', 'data');",
+        'function resolveProjectRoot(startDir) {',
+        '  if (process.env.CLAUDE_PROJECT_DIR) return path.resolve(process.env.CLAUDE_PROJECT_DIR);',
+        '  var dir = path.resolve(startDir || process.cwd());',
+        '  while (true) {',
+        '    if (fs.existsSync(path.join(dir, ".git")) || fs.existsSync(path.join(dir, ".claude-flow"))) return dir;',
+        '    var parent = path.dirname(dir);',
+        '    if (parent === dir) return path.resolve(startDir || process.cwd());',
+        '    dir = parent;',
+        '  }',
+        '}',
+        "const PROJECT_ROOT = resolveProjectRoot(process.cwd());",
+        "const DATA_DIR = path.join(PROJECT_ROOT, '.claude-flow', 'data');",
         "const STORE_PATH = path.join(DATA_DIR, 'auto-memory-store.json');",
         "const RANKED_PATH = path.join(DATA_DIR, 'ranked-context.json');",
         "const PENDING_PATH = path.join(DATA_DIR, 'pending-insights.jsonl');",
-        "const SESSION_DIR = path.join(process.cwd(), '.claude-flow', 'sessions');",
+        "const SESSION_DIR = path.join(PROJECT_ROOT, '.claude-flow', 'sessions');",
         "const SESSION_FILE = path.join(SESSION_DIR, 'current.json');",
         '',
         'function ensureDir(dir) {',
@@ -823,8 +834,8 @@ export function generateIntelligenceStub() {
         '  var entries = [];',
         '  var candidates = [',
         '    path.join(os.homedir(), ".claude", "projects"),',
-        '    path.join(process.cwd(), ".claude-flow", "memory"),',
-        '    path.join(process.cwd(), ".claude", "memory"),',
+        '    path.join(PROJECT_ROOT, ".claude-flow", "memory"),',
+        '    path.join(PROJECT_ROOT, ".claude", "memory"),',
         '  ];',
         '  for (var i = 0; i < candidates.length; i++) {',
         '    try {',

package/dist/src/init/statusline-generator.js

@@ -53,6 +53,16 @@ function getInstalledCliVersionLocal() {
         return '0.0.0';
     }
 }
+function compareVersionsLocal(a, b) {
+    const pa = a.split(/[.-]/).map(part => Number.parseInt(part, 10) || 0);
+    const pb = b.split(/[.-]/).map(part => Number.parseInt(part, 10) || 0);
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+        const delta = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (delta !== 0)
+            return delta;
+    }
+    return 0;
+}
 /**
  * Generate optimized statusline script
  * Output format:
@@ -91,10 +101,12 @@ export function generateStatuslineScript(options) {
     // getInstalledCliVersionLocal() above — reuse the pattern for the
     // same reason it exists there.
     let helperContent = null;
+    let helperPackageRoot = '';
     try {
         const esmRequire = createRequire(import.meta.url);
         const pkgJsonPath = esmRequire.resolve('@claude-flow/cli/package.json');
-        const helperPath = path.join(path.dirname(pkgJsonPath), '.claude', 'helpers', 'statusline.cjs');
+        helperPackageRoot = path.dirname(pkgJsonPath);
+        const helperPath = path.join(helperPackageRoot, '.claude', 'helpers', 'statusline.cjs');
         helperContent = fs.readFileSync(helperPath, 'utf-8');
     }
     catch {
@@ -105,6 +117,7 @@ export function generateStatuslineScript(options) {
                 if (pkg && pkg.name === '@claude-flow/cli') {
                     const candidate = path.join(dir, '.claude', 'helpers', 'statusline.cjs');
                     if (fs.existsSync(candidate)) {
+                        helperPackageRoot = dir;
                         helperContent = fs.readFileSync(candidate, 'utf-8');
                         break;
                     }
@@ -128,15 +141,15 @@ export function generateStatuslineScript(options) {
     // whatever the helper hard-codes) ships. Add a paired test in
     // statusline-cost-display.test.ts before changing either token.
     helperContent = helperContent.replace(/maxAgents: \d+,/, `maxAgents: ${maxAgents},`);
+    helperContent = helperContent.replace(/const BAKED_INSTALL_ROOT = "[^"]*";/, `const BAKED_INSTALL_ROOT = ${JSON.stringify(helperPackageRoot)};`);
     // Only overwrite the helper's baked version if OURS resolves higher.
     // Otherwise the substitution could DOWNGRADE (test environments where
     // esmRequire.resolve happens to hit an older node_modules install would
-    // clobber a fresh committed helper). Naive lexicographic compare — works
-    // for canonical semver strings with same-width digit parts, which is
-    // reliable at this stage of the version space.
+    // clobber a fresh committed helper). Compare numeric components:
+    // lexicographic comparison freezes 3.32.24 below 3.32.8 (#2811).
     const helperVerMatch = helperContent.match(/let ver = "([^"]+)";/);
     const helperVer = helperVerMatch ? helperVerMatch[1] : '';
-    if (!helperVer || bakedVersion > helperVer) {
+    if (!helperVer || compareVersionsLocal(bakedVersion, helperVer) > 0) {
         helperContent = helperContent.replace(/let ver = "[^"]+";/, `let ver = ${JSON.stringify(bakedVersion)};`);
     }
     return helperContent;

package/dist/src/mcp-server.d.ts

@@ -48,6 +48,31 @@ export interface MCPServerStatus {
         metrics?: Record<string, number>;
     };
 }
+export declare function parseMcpToolSelection(value: string | undefined): string[] | 'all';
+/**
+ * Apply the existing `--tools` contract to advertised schemas. A selector can
+ * be an exact tool name, a category, or a namespace prefix (`memory` matches
+ * `memory_store`). Execution remains registered internally; only the fixed
+ * per-request schema catalogue is reduced.
+ */
+export declare function filterAdvertisedMcpTools<T extends {
+    name: string;
+    category?: string;
+}>(tools: T[], selection: string[] | 'all'): T[];
+export interface McpSchemaOverhead {
+    toolCount: number;
+    bytes: number;
+    estimatedTokens: number;
+    contextWindowTokens?: number;
+    ratio?: number;
+    risk: 'normal' | 'high';
+}
+/** Conservative JSON-size estimate for the fixed tools/list catalogue. */
+export declare function assessMcpSchemaOverhead(tools: Array<{
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+}>, contextWindowTokens?: number): McpSchemaOverhead;
 /**
  * MCP Server Manager
  *

package/dist/src/mcp-server.js

@@ -42,6 +42,54 @@ const DEFAULT_OPTIONS = {
     daemonize: false,
     timeout: 30000,
 };
+export function parseMcpToolSelection(value) {
+    if (!value || value.trim().toLowerCase() === 'all')
+        return 'all';
+    const selectors = value.split(',').map((item) => item.trim()).filter(Boolean);
+    return selectors.length > 0 ? selectors : 'all';
+}
+/**
+ * Apply the existing `--tools` contract to advertised schemas. A selector can
+ * be an exact tool name, a category, or a namespace prefix (`memory` matches
+ * `memory_store`). Execution remains registered internally; only the fixed
+ * per-request schema catalogue is reduced.
+ */
+export function filterAdvertisedMcpTools(tools, selection) {
+    if (selection === 'all')
+        return tools;
+    const selectors = new Set(selection.map((item) => item.toLowerCase()));
+    return tools.filter((tool) => {
+        const name = tool.name.toLowerCase();
+        const category = tool.category?.toLowerCase();
+        return selectors.has(name)
+            || (category !== undefined && selectors.has(category))
+            || Array.from(selectors).some((selector) => name.startsWith(`${selector}_`));
+    });
+}
+/** Conservative JSON-size estimate for the fixed tools/list catalogue. */
+export function assessMcpSchemaOverhead(tools, contextWindowTokens) {
+    const catalogue = tools.map((tool) => ({
+        name: tool.name,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+    }));
+    const bytes = Buffer.byteLength(JSON.stringify(catalogue), 'utf8');
+    const estimatedTokens = Math.ceil(bytes / 4);
+    const validWindow = Number.isFinite(contextWindowTokens) && Number(contextWindowTokens) > 0
+        ? Number(contextWindowTokens)
+        : undefined;
+    const ratio = validWindow ? estimatedTokens / validWindow : undefined;
+    return {
+        toolCount: tools.length,
+        bytes,
+        estimatedTokens,
+        ...(validWindow === undefined ? {} : { contextWindowTokens: validWindow }),
+        ...(ratio === undefined ? {} : { ratio }),
+        risk: (ratio !== undefined ? ratio >= 0.2 : estimatedTokens >= 8_000)
+            ? 'high'
+            : 'normal',
+    };
+}
 /**
  * MCP Server Manager
  *
@@ -55,7 +103,14 @@ export class MCPServerManager extends EventEmitter {
     healthCheckInterval;
     constructor(options = {}) {
         super();
-        this.options = { ...DEFAULT_OPTIONS, ...options };
+        // `options.tools`, populated by the `mcp start --tools` CLI flag, is
+        // spread last below and therefore takes precedence over this env fallback.
+        const environmentTools = parseMcpToolSelection(process.env.CLAUDE_FLOW_MCP_TOOLS);
+        this.options = {
+            ...DEFAULT_OPTIONS,
+            ...(environmentTools === 'all' ? {} : { tools: environmentTools }),
+            ...options,
+        };
     }
     /**
      * Start the MCP server
@@ -420,7 +475,7 @@ export class MCPServerManager extends EventEmitter {
                         },
                     };
                 case 'tools/list':
-                    const tools = listMCPTools();
+                    const tools = filterAdvertisedMcpTools(listMCPTools(), this.options.tools);
                     return {
                         jsonrpc: '2.0',
                         id: message.id,