@claude-flow/cli 3.32.35 → 3.32.37

package/dist/src/commands/doctor.js

@@ -120,8 +120,8 @@ async function checkConfigFile() {
 }
 // Check daemon status
 /**
- * #2448 — Detect the runaway `npx @claude-flow/cli@latest` statusLine / hook
- * commands left over in `.claude/settings.json` from pre-#2337 installs.
+ * #2448 / #2677 — Detect runaway `npx @claude-flow/cli@latest` commands
+ * left over in `.claude/settings.json` from pre-#2337 installs.
  *
  * These fire on every Claude Code event (statusLine refires every few hundred
  * ms, hooks fire per tool-use), each spawning a cold Node process + npm
@@ -138,7 +138,9 @@ async function checkStaleSettingsNpx() {
     // Same regex pattern the executor migration uses — kept in sync. Flag-list
     // repetition bounded at 10 (CodeQL js/redos — unbounded `*` here is
     // exponential-backtracking-prone on a crafted settings.json).
-    const BROKEN_RE = /npx\s+(?:--?\S+\s+){0,10}@?claude-flow\/cli@latest\s+hooks\s+(?:statusline|\S+)/;
+    // Every subcommand incurs the same cold npm process/registry cost. The
+    // previous `hooks` literal missed `memory`, `daemon`, `swarm`, etc.
+    const BROKEN_RE = /npx\s+(?:--?\S+\s+){0,10}@?claude-flow\/cli@latest\s+\S+/;
     // Look in both project-local and home-dir settings.
     const candidates = [
         join(process.cwd(), '.claude', 'settings.json'),
@@ -263,18 +265,21 @@ async function checkMemoryDatabase() {
 // The existing `checkMemoryDatabase` above asserts existence + statability
 // only, so it CANNOT distinguish a healthy DB from a 99.97%-empty or
 // SQLite-malformed one. Stuinfla reported both cases live (81-store fleet).
-// The three checks below layer functional assertions on top, ordered so
+// The checks below layer functional assertions on top, ordered so
 // the earliest chain-break is always the first red the user sees:
 //   1. Integrity          — can sql.js open it AND does PRAGMA integrity_check pass?
 //   2. Content            — do most memory_entries rows carry non-empty content?
 //   3. Embedding coverage — do most rows have a vector? (unembedded rows are
 //                           both unrecallable AND undistillable per ADR-174)
+//   6. Reflexion coverage — can episodes participate in retrieveRelevant's
+//                           required episode_embeddings INNER JOIN?
+//      Feedback critiques — do execution-tier episodes carry a real lesson?
 // Ordering matters: content ratio is meaningless on a DB that can't open;
 // embedding coverage is meaningless on rows with no content. First red wins.
 //
-// Recall probe (stuinfla check 4) requires actual write+search+delete round
-// trips through the CLI's own memory pipeline — deferred to a follow-up PR
-// to keep this one purely additive and safe.
+// Recall probe (stuinfla check 4) still requires an isolated write+search+
+// delete round trip through the CLI's own memory pipeline. It remains separate
+// because doctor otherwise stays read-only.
 //
 // Design rules (also from stuinfla's report):
 //   - "A check that cannot fail protects nothing" — every check has a
@@ -731,6 +736,102 @@ async function checkMemoryEmbeddingCoverage() {
         catch { /* best-effort */ }
     }
 }
+// #2677 check 6 — ReflexionMemory.retrieveRelevant() INNER JOINs episodes to
+// episode_embeddings. A populated episodes table with an empty/missing partner
+// table is therefore not degraded recall; it is structurally zero recall.
+async function checkMemoryReflexionCoverage() {
+    const dbPath = await resolveMemoryDbPath();
+    if (!dbPath)
+        return { name: 'Memory Reflexion Coverage', status: 'warn', message: 'no memory.db found' };
+    const db = await tryOpenSqlJs(dbPath);
+    if (!db)
+        return { name: 'Memory Reflexion Coverage', status: 'warn', message: 'DB unreadable (see Memory Integrity)' };
+    try {
+        const tables = new Set(db.exec("SELECT name FROM sqlite_master WHERE type='table' AND name IN ('episodes','episode_embeddings')")[0]?.values?.map((v) => String(v[0])) ?? []);
+        if (!tables.has('episodes')) {
+            return { name: 'Memory Reflexion Coverage', status: 'warn', message: 'episodes table absent — AgentDB Reflexion schema not initialized' };
+        }
+        const episodes = Number(db.exec('SELECT count(*) FROM episodes')[0]?.values?.[0]?.[0] ?? 0);
+        if (episodes === 0) {
+            return { name: 'Memory Reflexion Coverage', status: 'warn', message: `${dbPath} — 0 episodes (Reflexion has not been exercised)` };
+        }
+        if (!tables.has('episode_embeddings')) {
+            return {
+                name: 'Memory Reflexion Coverage',
+                status: 'fail',
+                message: `${dbPath} — episode embeddings 0/${episodes} (0.00%); retrieveRelevant() cannot return rows`,
+                fix: 'run `claude-flow memory distill run`; current distillation creates/backfills episode_embeddings',
+            };
+        }
+        const embedded = Number(db.exec('SELECT count(*) FROM episodes e JOIN episode_embeddings ee ON ee.episode_id=e.id')[0]?.values?.[0]?.[0] ?? 0);
+        const ratio = embedded / episodes;
+        const detail = `episode embeddings ${embedded}/${episodes} (${(ratio * 100).toFixed(2)}%)`;
+        if (ratio < 0.95) {
+            return {
+                name: 'Memory Reflexion Coverage',
+                status: 'fail',
+                message: `${dbPath} — ${detail} below 95% floor; retrieveRelevant() cannot see uncovered episodes`,
+                fix: 'run `claude-flow memory distill run` to populate retrievable episodes',
+            };
+        }
+        return { name: 'Memory Reflexion Coverage', status: 'pass', message: `${dbPath} — ${detail}` };
+    }
+    catch (e) {
+        return { name: 'Memory Reflexion Coverage', status: 'warn', message: `${dbPath} — probe threw: ${e.message || String(e)}` };
+    }
+    finally {
+        try {
+            db.close();
+        }
+        catch { /* best-effort */ }
+    }
+}
+// Execution-tier feedback should carry a lesson, not just reward/success bits.
+// Proxy episodes intentionally remain critique-free to avoid laundering a
+// structural summary into an observed failure explanation.
+async function checkMemoryCritiqueCoverage() {
+    const dbPath = await resolveMemoryDbPath();
+    if (!dbPath)
+        return { name: 'Memory Feedback Critiques', status: 'warn', message: 'no memory.db found' };
+    const db = await tryOpenSqlJs(dbPath);
+    if (!db)
+        return { name: 'Memory Feedback Critiques', status: 'warn', message: 'DB unreadable (see Memory Integrity)' };
+    try {
+        const hasEpisodes = (db.exec("SELECT count(*) FROM sqlite_master WHERE type='table' AND name='episodes'")[0]?.values?.[0]?.[0] ?? 0) > 0;
+        if (!hasEpisodes)
+            return { name: 'Memory Feedback Critiques', status: 'warn', message: 'episodes table absent' };
+        const row = db.exec(`
+      SELECT count(*),
+        sum(CASE WHEN length(trim(coalesce(critique,''))) > 0 THEN 1 ELSE 0 END)
+      FROM episodes WHERE session_id LIKE 'distill:feedback%'
+    `)[0]?.values?.[0] ?? [0, 0];
+        const feedback = Number(row[0] ?? 0);
+        const withCritique = Number(row[1] ?? 0);
+        if (feedback === 0) {
+            return { name: 'Memory Feedback Critiques', status: 'warn', message: `${dbPath} — 0 execution-feedback episodes to assess` };
+        }
+        const ratio = withCritique / feedback;
+        const detail = `feedback critiques ${withCritique}/${feedback} (${(ratio * 100).toFixed(2)}%)`;
+        if (ratio < 0.95) {
+            return {
+                name: 'Memory Feedback Critiques',
+                status: 'fail',
+                message: `${dbPath} — ${detail} below 95% floor`,
+                fix: 'run current `claude-flow memory distill run`; execution-tier episodes preserve observed critique/error text',
+            };
+        }
+        return { name: 'Memory Feedback Critiques', status: 'pass', message: `${dbPath} — ${detail}` };
+    }
+    catch (e) {
+        return { name: 'Memory Feedback Critiques', status: 'warn', message: `${dbPath} — probe threw: ${e.message || String(e)}` };
+    }
+    finally {
+        try {
+            db.close();
+        }
+        catch { /* best-effort */ }
+    }
+}
 // #2545: Check that the self-learning bridge can actually load @claude-flow/memory
 // the SAME way the SessionStart auto-memory hook does. On the documented `npx ruflo`
 // path the package lands in the npx cache — unreachable from the project — so the
@@ -1027,6 +1128,48 @@ async function checkMcpServers() {
         fix: 'claude mcp add ruflo -- npx -y ruflo@latest mcp start',
     };
 }
+// #2726 — tools/list is fixed prompt overhead on clients/backends that do not
+// defer MCP schemas. Measure the actual live registry and warn before a small
+// context window becomes unrecoverable even after compaction.
+async function checkMcpSchemaOverhead() {
+    try {
+        const [{ listMCPTools }, { assessMcpSchemaOverhead, filterAdvertisedMcpTools, parseMcpToolSelection, }] = await Promise.all([
+            import('../mcp-client.js'),
+            import('../mcp-server.js'),
+        ]);
+        // The `mcp start --tools` CLI flag takes precedence when the server is
+        // constructed. Doctor intentionally inspects the environment fallback so
+        // its estimate describes the configuration inherited by MCP clients.
+        const selection = parseMcpToolSelection(process.env.CLAUDE_FLOW_MCP_TOOLS);
+        const tools = filterAdvertisedMcpTools(listMCPTools(), selection);
+        // This is diagnostic metadata about the external client's context window,
+        // not Ruflo command configuration, so there is no corresponding CLI flag.
+        const rawWindow = process.env.CLAUDE_FLOW_CONTEXT_WINDOW_TOKENS;
+        const contextWindow = rawWindow ? Number.parseInt(rawWindow, 10) : undefined;
+        const assessment = assessMcpSchemaOverhead(tools, contextWindow);
+        const ratio = assessment.ratio === undefined
+            ? ''
+            : `, ${(assessment.ratio * 100).toFixed(1)}% of ${assessment.contextWindowTokens}-token window`;
+        const selectionLabel = selection === 'all' ? 'all tools' : `filtered: ${selection.join(',')}`;
+        const message = `${assessment.toolCount} advertised tools ≈ ${assessment.estimatedTokens} schema tokens (${selectionLabel}${ratio})`;
+        if (assessment.risk === 'high') {
+            return {
+                name: 'MCP Schema Overhead',
+                status: 'warn',
+                message,
+                fix: 'Set CLAUDE_FLOW_MCP_TOOLS to required categories/tool names (for example: memory,swarm,agent,hooks) and optionally CLAUDE_FLOW_CONTEXT_WINDOW_TOKENS to your backend limit.',
+            };
+        }
+        return { name: 'MCP Schema Overhead', status: 'pass', message };
+    }
+    catch (error) {
+        return {
+            name: 'MCP Schema Overhead',
+            status: 'warn',
+            message: `Unable to measure: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
 // Check disk space (async with proper env inheritance)
 async function checkDiskSpace() {
     try {
@@ -1843,7 +1986,7 @@ export const doctorCommand = {
         {
             name: 'component',
             short: 'c',
-            description: 'Check specific component (version, node, npm, config, daemon, memory, api, git, mcp, claude, disk, typescript, agentic-flow, encryption, federation, funnel, proxy, auth, metaharness)',
+            description: 'Check specific component (version, node, npm, config, daemon, memory, api, git, mcp, mcp-overhead, claude, disk, typescript, agentic-flow, encryption, federation, funnel, proxy, auth, metaharness)',
             type: 'string'
         },
         {
@@ -1958,13 +2101,14 @@ export const doctorCommand = {
             checkGit,
             checkGitRepo,
             checkConfigFile,
-            checkStaleSettingsNpx, // #2448 — runaway `npx @latest` in statusLine/hooks
+            checkStaleSettingsNpx, // #2448/#2677 — runaway `npx @latest` in settings
             checkDaemonStatus,
             checkMemoryDatabase,
             checkMemoryStructuralIntegrity, // #2737 — bounded, native quick_check on every default run
             checkLearningBridge, // #2545 — can the auto-memory hook actually load @claude-flow/memory?
             checkApiKeys,
             checkMcpServers,
+            checkMcpSchemaOverhead, // #2726 — fixed tools/list prompt cost
             checkAIDefence, // #1807
             checkDiskSpace,
             checkBuildTools,
@@ -1982,8 +2126,9 @@ export const doctorCommand = {
         // array — expanded at execution time. Stuinfla's report showed the
         // existence-only check reporting PASS on a 99.97%-empty and even a
         // SQLite-malformed DB; the array here layers integrity → content →
-        // embedding coverage over the existing existence probe, ordered so
-        // the earliest chain-break is always the first red the user sees.
+        // embedding coverage over the existing existence probe; check 6 then
+        // verifies that distilled episodes are actually Reflexion-retrievable and
+        // execution feedback carries a lesson.
         const componentMap = {
             'version': checkVersionFreshness,
             'freshness': checkVersionFreshness,
@@ -1998,12 +2143,15 @@ export const doctorCommand = {
                 checkMemoryIntegrity, // #2677 check 1: sql.js open + PRAGMA integrity_check
                 checkMemoryContent, // #2677 check 2: memory_entries content coverage
                 checkMemoryEmbeddingCoverage, // #2677 check 3: vector coverage on populated rows
+                checkMemoryReflexionCoverage, // #2677 check 6: episodes are retrievable
+                checkMemoryCritiqueCoverage, // #2677 check 6: feedback carries lessons
             ],
             'learning': checkLearningBridge, // #2545
             'learning-bridge': checkLearningBridge, // #2545
             'api': checkApiKeys,
             'git': checkGit,
             'mcp': checkMcpServers,
+            'mcp-overhead': checkMcpSchemaOverhead,
             'aidefence': checkAIDefence, // #1807
             'disk': checkDiskSpace,
             'typescript': checkBuildTools,

package/dist/src/commands/hooks.js

@@ -1218,8 +1218,20 @@ const metricsCommand = {
             const totalPatterns = safeNum(rawMetrics.patterns?.total ?? rawMetrics.summary?.patternsLearned);
             const successfulPatterns = safeNum(rawMetrics.patterns?.successful ?? Math.round(safeNum(rawMetrics.summary?.successRate) * totalPatterns));
             const failedPatterns = Math.max(0, safeNum(rawMetrics.patterns?.failed ?? totalPatterns - successfulPatterns));
+            const unknownPatterns = Math.max(0, safeNum(rawMetrics.patterns?.unknown));
+            const describedPatterns = Math.max(0, safeNum(rawMetrics.patterns?.described));
+            const descriptionCoverage = safeNum(rawMetrics.patterns?.descriptionCoverage ??
+                (totalPatterns > 0 ? describedPatterns / totalPatterns : 0));
             const avgConfidence = safeNum(rawMetrics.patterns?.avgConfidence ?? rawMetrics.summary?.avgQuality);
-            const routingAccuracy = safeNum(rawMetrics.agents?.routingAccuracy ?? rawMetrics.routing?.avgConfidence);
+            const routingAccuracy = rawMetrics.agents?.routingAccuracy == null
+                ? null
+                : safeNum(rawMetrics.agents.routingAccuracy);
+            const averageRoutingConfidence = safeNum(rawMetrics.agents?.averageConfidence ??
+                rawMetrics.routing?.avgConfidence ??
+                rawMetrics.patterns?.avgConfidence);
+            const routingOutcomeSuccessRate = rawMetrics.agents?.outcomeSuccessRate == null
+                ? null
+                : safeNum(rawMetrics.agents.outcomeSuccessRate);
             const totalRoutes = safeNum(rawMetrics.agents?.totalRoutes ?? rawMetrics.routing?.totalRoutes);
             const topAgent = rawMetrics.agents?.topAgent ?? rawMetrics.routing?.topAgents?.[0]?.agent ?? 'n/a';
             const totalCommands = safeNum(rawMetrics.commands?.totalExecuted ?? rawMetrics.commands?.totalCommands);
@@ -1227,8 +1239,22 @@ const metricsCommand = {
             const avgRiskScore = safeNum(rawMetrics.commands?.avgRiskScore ?? rawMetrics.commands?.avgExecutionTime);
             const result = {
                 ...rawMetrics,
-                patterns: { total: totalPatterns, successful: successfulPatterns, failed: failedPatterns, avgConfidence },
-                agents: { routingAccuracy, totalRoutes, topAgent },
+                patterns: {
+                    total: totalPatterns,
+                    successful: successfulPatterns,
+                    failed: failedPatterns,
+                    unknown: unknownPatterns,
+                    described: describedPatterns,
+                    descriptionCoverage,
+                    avgConfidence,
+                },
+                agents: {
+                    routingAccuracy,
+                    averageConfidence: averageRoutingConfidence,
+                    outcomeSuccessRate: routingOutcomeSuccessRate,
+                    totalRoutes,
+                    topAgent,
+                },
                 commands: { totalExecuted: totalCommands, successRate: commandSuccessRate, avgRiskScore },
             };
             if (ctx.flags.format === 'json') {
@@ -1246,6 +1272,8 @@ const metricsCommand = {
                     { metric: 'Total Patterns', value: totalPatterns },
                     { metric: 'Successful', value: output.success(String(successfulPatterns)) },
                     { metric: 'Failed', value: output.error(String(failedPatterns)) },
+                    ...(unknownPatterns > 0 ? [{ metric: 'Unclassified', value: String(unknownPatterns) }] : []),
+                    { metric: 'With Task Context', value: `${(descriptionCoverage * 100).toFixed(1)}%` },
                     { metric: 'Avg Confidence', value: `${(avgConfidence * 100).toFixed(1)}%` }
                 ]
             });
@@ -1258,7 +1286,14 @@ const metricsCommand = {
                     { key: 'value', header: 'Value', width: 20, align: 'right' }
                 ],
                 data: [
-                    { metric: 'Routing Accuracy', value: `${(routingAccuracy * 100).toFixed(1)}%` },
+                    {
+                        metric: routingAccuracy === null ? 'Avg Confidence' : 'Routing Accuracy',
+                        value: `${((routingAccuracy ?? averageRoutingConfidence) * 100).toFixed(1)}%`,
+                    },
+                    ...(routingOutcomeSuccessRate === null ? [] : [{
+                            metric: 'Outcome Success Rate',
+                            value: `${(routingOutcomeSuccessRate * 100).toFixed(1)}%`,
+                        }]),
                     { metric: 'Total Routes', value: totalRoutes },
                     { metric: 'Top Agent', value: output.highlight(topAgent) }
                 ]

package/dist/src/commands/init.js

@@ -492,7 +492,7 @@ function isInitialized(cwd) {
     };
 }
 // Init subcommand (default)
-const initAction = async (ctx) => {
+const initClaudeAction = async (ctx) => {
     const force = ctx.flags.force;
     const minimal = ctx.flags.minimal;
     const full = ctx.flags.full;
@@ -507,13 +507,7 @@ const initAction = async (ctx) => {
     const noGlobal = ctx.flags['no-global'] === true || ctx.flags['global'] === false;
     const allAgents = ctx.flags['all-agents'];
     const cloudMcp = ctx.flags['cloud-mcp'];
-    const codexMode = ctx.flags.codex;
-    const dualMode = ctx.flags.dual;
     const cwd = ctx.cwd;
-    // If codex mode, use the Codex initializer
-    if (codexMode || dualMode) {
-        return initCodexAction(ctx, { codexMode, dualMode, force, minimal, full });
-    }
     // Check if already initialized
     const initialized = isInitialized(cwd);
     const hasExisting = initialized.claude || initialized.claudeFlow;
@@ -786,6 +780,56 @@ const initAction = async (ctx) => {
         return { success: false, exitCode: 1 };
     }
 };
+/**
+ * Route platform initialization. Dual mode deliberately runs both native
+ * initializers: Claude Code first, then Codex without its compatibility
+ * CLAUDE.md stub so the full native Claude scaffold remains authoritative.
+ */
+const initAction = async (ctx) => {
+    const force = ctx.flags.force;
+    const minimal = ctx.flags.minimal;
+    const full = ctx.flags.full;
+    const codexMode = ctx.flags.codex;
+    const dualMode = ctx.flags.dual;
+    if (codexMode && !dualMode) {
+        return initCodexAction(ctx, { codexMode, dualMode: false, force, minimal, full });
+    }
+    if (!dualMode) {
+        return initClaudeAction(ctx);
+    }
+    const claudeContext = {
+        ...ctx,
+        flags: {
+            ...ctx.flags,
+            codex: false,
+            dual: false,
+            // The explicit Codex pass below owns Codex setup.
+            'no-codex-detect': true,
+        },
+    };
+    const claudeResult = await initClaudeAction(claudeContext);
+    if (!claudeResult.success)
+        return claudeResult;
+    const codexResult = await initCodexAction(ctx, {
+        codexMode: true,
+        // Preserve the full CLAUDE.md and .claude/ scaffold just generated.
+        dualMode: false,
+        force,
+        minimal,
+        full,
+    });
+    if (!codexResult.success) {
+        return {
+            ...codexResult,
+            message: 'Claude Code initialized, but Codex initialization failed',
+            data: { claude: claudeResult.data, codex: codexResult.data },
+        };
+    }
+    return {
+        success: true,
+        data: { claude: claudeResult.data, codex: codexResult.data },
+    };
+};
 // Wizard subcommand for interactive setup
 const wizardCommand = {
     name: 'wizard',
@@ -1453,7 +1497,7 @@ export const initCommand = {
         { command: 'claude-flow init upgrade --settings', description: 'Update helpers and merge new settings (Agent Teams)' },
         { command: 'claude-flow init upgrade --verbose', description: 'Show detailed upgrade info' },
         { command: 'claude-flow init --codex', description: 'Initialize for OpenAI Codex (AGENTS.md)' },
-        { command: 'claude-flow init --codex --full', description: 'Codex init with all 137+ skills' },
+        { command: 'claude-flow init --codex --full', description: 'Codex init with all canonical packaged skills' },
         { command: 'claude-flow init --dual', description: 'Initialize for both Claude Code and Codex' },
         { command: 'claude-flow init --no-codex-detect', description: 'Skip auto-configuring OpenAI Codex even if it is installed' },
         { command: 'claude-flow init --no-skills-sh', description: 'Skip the post-init skills.sh registration' },

package/dist/src/commands/mcp.js

@@ -63,7 +63,7 @@ const startCommand = {
         },
         {
             name: 'tools',
-            description: 'Tools to enable (comma-separated or "all")',
+            description: 'Tools to advertise (comma-separated categories, prefixes, exact names, or "all")',
             type: 'string',
             default: 'all'
         },

package/dist/src/commands/memory-distill.js

@@ -182,6 +182,7 @@ const runCommand = {
             data: [
                 { metric: 'Processed', value: String(report.processed) },
                 { metric: 'Episodes', value: String(report.episodes) },
+                { metric: 'Episode Embeddings', value: String(report.episodeEmbeddings) },
                 { metric: 'Patterns', value: String(report.patterns) },
                 { metric: 'Pattern Embeddings', value: String(report.patternEmbeddings) },
                 { metric: 'Causal Edges', value: String(report.causalEdges) },

package/dist/src/commands/swarm.js

@@ -50,6 +50,34 @@ function getSwarmStatus(swarmId) {
             // Ignore
         }
     }
+    // The canonical agent registry is the same source used by `agent list`.
+    // Prefer it over the swarm-level coordination boolean so idle agents are
+    // not reported as active (#2808). Hive agents are merged additively.
+    if (totalAgents === 0) {
+        try {
+            const canonicalPath = path.join(process.cwd(), '.claude-flow', 'agents', 'store.json');
+            const hivePath = path.join(process.cwd(), '.claude-flow', 'agents.json');
+            const merged = {};
+            for (const storePath of [hivePath, canonicalPath]) {
+                if (!fs.existsSync(storePath))
+                    continue;
+                const parsed = JSON.parse(fs.readFileSync(storePath, 'utf-8'));
+                if (parsed?.agents && typeof parsed.agents === 'object') {
+                    Object.assign(merged, parsed.agents);
+                }
+            }
+            const agents = Object.values(merged).filter(agent => agent.status !== 'terminated');
+            if (agents.length > 0) {
+                totalAgents = agents.length;
+                activeAgents = agents.filter(agent => agent.status === 'active' ||
+                    agent.status === 'running' ||
+                    agent.status === 'busy').length;
+            }
+        }
+        catch {
+            // Ignore — the count-only activity file remains the final fallback.
+        }
+    }
     // #2799 — `agent spawn` never writes `.swarm/agents/*.json`; it records
     // the count in `.claude-flow/metrics/swarm-activity.json` (via
     // updateSwarmActivityMetrics in commands/agent.ts). So when the agents

package/dist/src/init/executor.js

@@ -370,18 +370,19 @@ function mergeSettingsForUpgrade(existing) {
     // js/redos): a crafted settings.json command string with dozens of
     // dash-token repetitions can hang this check for minutes.
     const BROKEN_STATUSLINE_RE = /(?:npx\s+(?:--?\S+\s+){0,10})?@?claude-flow(?:\/cli)?(?:@\S+)?\s+hooks\s+statusline/;
+    const BROKEN_NPX_LATEST_RE = /npx\s+(?:--?\S+\s+){0,10}@?claude-flow\/cli@latest\s+\S+/;
     const existingStatusLine = existing.statusLine;
     if (existingStatusLine) {
         const existingCmd = typeof existingStatusLine.command === 'string' ? existingStatusLine.command : '';
-        const isBroken = BROKEN_STATUSLINE_RE.test(existingCmd);
+        const isBroken = BROKEN_STATUSLINE_RE.test(existingCmd) || BROKEN_NPX_LATEST_RE.test(existingCmd);
         merged.statusLine = {
             type: 'command',
             command: isBroken || !existingCmd ? NEW_STATUSLINE_CMD : existingCmd,
             // Remove invalid fields: refreshMs, enabled (not supported by Claude Code)
         };
     }
-    // #2448 — Detect and REGENERATE per-action hook commands that still use
-    // the runaway `npx @claude-flow/cli@latest hooks <sub>` form. These fire
+    // #2448 / #2677 — Detect and REGENERATE per-action hook commands that still
+    // use the runaway `npx @claude-flow/cli@latest hooks <sub>` form. These fire
     // on every PreToolUse/PostToolUse/UserPromptSubmit, each spawning ~130 MB
     // of cold Node + npm registry resolution; the storm is what kernel-paniced
     // the reporter's machine in #2448.
@@ -409,15 +410,20 @@ function mergeSettingsForUpgrade(existing) {
             for (const group of groups) {
                 if (!Array.isArray(group.hooks))
                     continue;
-                for (const h of group.hooks) {
+                group.hooks = group.hooks.filter((h) => {
                     if (typeof h?.command !== 'string')
-                        continue;
+                        return true;
                     const m = BROKEN_HOOK_RE.exec(h.command);
-                    if (!m)
-                        continue;
-                    // Subcommand captured (e.g. "pre-bash", "post-edit", "route") — keep it.
-                    h.command = localHookCmd(m[1]);
-                }
+                    if (m) {
+                        // Subcommand captured (e.g. "pre-bash", "post-edit", "route") — keep it.
+                        h.command = localHookCmd(m[1]);
+                        return true;
+                    }
+                    // Sibling CLI invocations (memory/daemon/swarm/...) have no
+                    // hook-handler equivalent. Drop the stale extra; the merge above
+                    // has already installed current local-helper hooks for this event.
+                    return !BROKEN_NPX_LATEST_RE.test(h.command);
+                });
             }
         }
     }
@@ -1373,6 +1379,7 @@ async function writeStatusline(targetDir, options, result) {
  * Write runtime configuration (.claude-flow/)
  */
 async function writeRuntimeConfig(targetDir, options, result) {
+    updateRootGitignore(targetDir, result);
     const configPath = path.join(targetDir, '.claude-flow', 'config.yaml');
     if (fs.existsSync(configPath) && !options.force) {
         result.skipped.push('.claude-flow/config.yaml');
@@ -1441,6 +1448,34 @@ neural/
     // Write CAPABILITIES.md with full system overview
     await writeCapabilitiesDoc(targetDir, options, result);
 }
+/**
+ * Protect project-local secrets and runtime state for Claude-only installs.
+ * Append missing entries without replacing the project's existing rules.
+ */
+function updateRootGitignore(targetDir, result) {
+    const gitignorePath = path.join(targetDir, '.gitignore');
+    const entries = [
+        '# Ruflo local secrets and runtime data',
+        '.env',
+        '.env.local',
+        '.env.*.local',
+        '.claude-flow/data/',
+        '.claude-flow/logs/',
+        '.claude-flow/sessions/',
+    ];
+    const existing = fs.existsSync(gitignorePath)
+        ? fs.readFileSync(gitignorePath, 'utf8')
+        : '';
+    const existingLines = new Set(existing.split(/\r?\n/));
+    const missing = entries.filter((entry) => !existingLines.has(entry));
+    if (missing.length === 0)
+        return;
+    const separator = existing.length === 0
+        ? ''
+        : existing.endsWith('\n') ? '\n' : '\n\n';
+    fs.writeFileSync(gitignorePath, `${existing}${separator}${missing.join('\n')}\n`, 'utf8');
+    result.created.files.push('.gitignore (updated)');
+}
 /**
  * Write initial metrics files for statusline
  * Creates baseline data so statusline shows meaningful state instead of all zeros

package/dist/src/init/helpers-generator.js

@@ -775,11 +775,22 @@ export function generateIntelligenceStub() {
         "const path = require('path');",
         "const os = require('os');",
         '',
-        "const DATA_DIR = path.join(process.cwd(), '.claude-flow', 'data');",
+        'function resolveProjectRoot(startDir) {',
+        '  if (process.env.CLAUDE_PROJECT_DIR) return path.resolve(process.env.CLAUDE_PROJECT_DIR);',
+        '  var dir = path.resolve(startDir || process.cwd());',
+        '  while (true) {',
+        '    if (fs.existsSync(path.join(dir, ".git")) || fs.existsSync(path.join(dir, ".claude-flow"))) return dir;',
+        '    var parent = path.dirname(dir);',
+        '    if (parent === dir) return path.resolve(startDir || process.cwd());',
+        '    dir = parent;',
+        '  }',
+        '}',
+        "const PROJECT_ROOT = resolveProjectRoot(process.cwd());",
+        "const DATA_DIR = path.join(PROJECT_ROOT, '.claude-flow', 'data');",
         "const STORE_PATH = path.join(DATA_DIR, 'auto-memory-store.json');",
         "const RANKED_PATH = path.join(DATA_DIR, 'ranked-context.json');",
         "const PENDING_PATH = path.join(DATA_DIR, 'pending-insights.jsonl');",
-        "const SESSION_DIR = path.join(process.cwd(), '.claude-flow', 'sessions');",
+        "const SESSION_DIR = path.join(PROJECT_ROOT, '.claude-flow', 'sessions');",
         "const SESSION_FILE = path.join(SESSION_DIR, 'current.json');",
         '',
         'function ensureDir(dir) {',
@@ -823,8 +834,8 @@ export function generateIntelligenceStub() {
         '  var entries = [];',
         '  var candidates = [',
         '    path.join(os.homedir(), ".claude", "projects"),',
-        '    path.join(process.cwd(), ".claude-flow", "memory"),',
-        '    path.join(process.cwd(), ".claude", "memory"),',
+        '    path.join(PROJECT_ROOT, ".claude-flow", "memory"),',
+        '    path.join(PROJECT_ROOT, ".claude", "memory"),',
         '  ];',
         '  for (var i = 0; i < candidates.length; i++) {',
         '    try {',