@claude-flow/cli 3.32.38 → 3.32.40

package/.claude/.proven-config-version

@@ -0,0 +1 @@
+sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319

package/.claude/agents/v3/security-architect-aidefence.md

@@ -140,7 +140,7 @@ hooks:
     # ═══════════════════════════════════════════════════════════════
     echo "🔒 Running comprehensive security validation..."
 
-    npx claude-flow@v3alpha security scan --depth full --output-format json > /tmp/security-scan.json 2>/dev/null
+    npx claude-flow@v3alpha security scan --depth deep --output-format json > /tmp/security-scan.json 2>/dev/null
     VULNERABILITIES=$(jq -r '.vulnerabilities | length' /tmp/security-scan.json 2>/dev/null || echo "0")
     CRITICAL_COUNT=$(jq -r '.vulnerabilities | map(select(.severity == "critical")) | length' /tmp/security-scan.json 2>/dev/null || echo "0")
     HIGH_COUNT=$(jq -r '.vulnerabilities | map(select(.severity == "high")) | length' /tmp/security-scan.json 2>/dev/null || echo "0")

package/.claude/agents/v3/security-architect.md

@@ -58,7 +58,7 @@ hooks:
     echo "✅ Security architecture analysis complete"
 
     # 1. Run comprehensive security validation
-    npx claude-flow@v3alpha security scan --depth full --output-format json > /tmp/security-scan.json 2>/dev/null
+    npx claude-flow@v3alpha security scan --depth deep --output-format json > /tmp/security-scan.json 2>/dev/null
     VULNERABILITIES=$(jq -r '.vulnerabilities | length' /tmp/security-scan.json 2>/dev/null || echo "0")
     CRITICAL_COUNT=$(jq -r '.vulnerabilities | map(select(.severity == "critical")) | length' /tmp/security-scan.json 2>/dev/null || echo "0")
 
@@ -834,7 +834,7 @@ mcp__claude-flow__memory_usage({
 
 ```bash
 # Full security scan
-npx claude-flow@v3alpha security scan --depth full
+npx claude-flow@v3alpha security scan --depth deep
 
 # CVE-specific checks
 npx claude-flow@v3alpha security cve --check CVE-2024-001

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.32.29
+3.32.40

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.32.38",
+    "version": "3.32.40",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
@@ -8,6 +8,6 @@
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "TIaAcMVhpk+ezMRAJCOA7NQlvIznNqICVsJOiEDnW0Xqpxg1Zr3/RM2VlHaMqN7kaOiDf8sdus0R7b+mwFjUAg==",
+  "signature": "LKhT8u+7Osi/g/JGxIupJ26jkWtAi7RRh/RLPp/DplCdVEKcP6iTgWRYkBJ1flZNsAJGDkDpGfPbSWzLz3JcAg==",
   "algorithm": "ed25519"
 }

package/.claude/proven-config.json

@@ -0,0 +1,42 @@
+{
+  "adoptedAt": 1785415360835,
+  "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
+  "manifest": {
+    "schema": "ruflo.proven-config/v1",
+    "policy": {
+      "ref": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
+      "value": {
+        "alpha": 0.3,
+        "subjectWeight": 1,
+        "mmrLambda": 0.5,
+        "bodyWeight": 1.5,
+        "typePenaltyFactor": 0.5
+      }
+    },
+    "layer": "framework/node-cli",
+    "compatibility": {
+      "ruflo": ">=3.24.0"
+    },
+    "benchmark": {
+      "corpus": "ADR-081-labelled-v1",
+      "corpusHash": "sha256:2f700b5c363e20a3bd88ce2bc9b87bbbbaa61732c6177894c6ec37890f888982"
+    },
+    "receipt": {
+      "heldOutDelta": 0.07381404928570845,
+      "redblue": "PASS",
+      "drift": 0,
+      "canary": {
+        "rollbackRate": 0,
+        "latencyP95": 244.612458000076,
+        "costPerTask": 0
+      },
+      "receiptCoverage": 1
+    },
+    "platform": [
+      "linux",
+      "macOS",
+      "windows"
+    ]
+  },
+  "previous": ""
+}

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 4,
-  "generatedAt": "2026-07-29T19:50:37.000Z",
-  "gitSha": "ad8d071d",
+  "generatedAt": "2026-07-30T13:30:58.553Z",
+  "gitSha": "76453115",
   "catalog": {
     "agents": 164,
     "tools": 397,

package/dist/src/commands/security.js

@@ -6,15 +6,51 @@
  */
 import { output } from '../output.js';
 import { execSync } from 'node:child_process';
+import { existsSync, statSync } from 'node:fs';
+import { resolve as resolvePath } from 'node:path';
 import { createBuiltinAIDefence } from '../security/builtin-aidefence.js';
+// Accepted values for `security scan`'s enum flags — the single source of truth
+// for both validation and the traversal-depth maps below.
+const SCAN_DEPTHS = ['quick', 'standard', 'deep'];
+const SCAN_TYPES = ['code', 'deps', 'all'];
+// Real type predicates, not `as` casts. Array.includes() does not narrow a
+// string to a literal union on its own, so without these the depth-map lookups
+// below need an unchecked assertion — and an unchecked assertion would let a
+// future refactor index the maps with an invalid key, yielding `undefined`.
+// That matters: `undefined <= 0` is false and `undefined - 1` is NaN, so the
+// recursion guard in scanDir would never fire. An unsafe cast here would
+// silently disable the depth limiter — the exact class of failure this command
+// is being fixed for.
+const isScanDepth = (v) => SCAN_DEPTHS.includes(v);
+const isScanType = (v) => SCAN_TYPES.includes(v);
+// `full` was never a supported depth, but the CLI itself printed it — the
+// statusline insight, the announcement, the release-notes blurb, the CLAUDE.md
+// that `init` generates, and two shipped agent definitions all tell people to
+// run `security scan --depth full`. Pre-fix it silently fell through to the
+// SHALLOWEST traversal, which is the bug. Hard-rejecting it would break every
+// caller we ourselves told to use it, so it is normalised to the depth the word
+// promised, with a warning. Remove once those emitters have aged out.
+const DEPRECATED_SCAN_DEPTHS = { full: 'deep' };
+// `container` has been advertised in --type's help since this command was
+// written, but no phase below implements it. Accepting it would reproduce the
+// exact bug this validation exists to fix: a documented flag value that scans
+// nothing and still prints a clean bill of health. Rejected explicitly, with
+// its own message, until a container phase exists.
+const UNIMPLEMENTED_SCAN_TYPES = ['container'];
+// Directory-recursion limits per depth. Exhaustive records rather than chained
+// ternaries, so adding a depth is a compile error here instead of a silently
+// shallower scan. CODE_SCAN_DEPTH.quick is unreachable — phase 3 is gated on
+// depth !== 'quick' — but is present so the record stays total.
+const SECRET_SCAN_DEPTH = { quick: 3, standard: 5, deep: 10 };
+const CODE_SCAN_DEPTH = { quick: 0, standard: 5, deep: 10 };
 // Scan subcommand
 const scanCommand = {
     name: 'scan',
-    description: 'Run security scan on target (code, dependencies, containers)',
+    description: 'Run security scan on target (code, dependencies)',
     options: [
         { name: 'target', short: 't', type: 'string', description: 'Target path or URL to scan', default: '.' },
         { name: 'depth', short: 'd', type: 'string', description: 'Scan depth: quick, standard, deep', default: 'standard' },
-        { name: 'type', type: 'string', description: 'Scan type: code, deps, container, all', default: 'all' },
+        { name: 'type', type: 'string', description: 'Scan type: code, deps, all', default: 'all' },
         { name: 'output', short: 'o', type: 'string', description: 'Output format: text, json, sarif', default: 'text' },
         { name: 'fix', short: 'f', type: 'boolean', description: 'Auto-fix vulnerabilities where possible' },
     ],
@@ -24,9 +60,52 @@ const scanCommand = {
     ],
     action: async (ctx) => {
         const target = ctx.flags.target || '.';
-        const depth = ctx.flags.depth || 'standard';
+        const requestedDepth = ctx.flags.depth || 'standard';
         const scanType = ctx.flags.type || 'all';
         const fix = ctx.flags.fix;
+        // A security scanner must never silently degrade on an unrecognised enum
+        // value. An unknown --depth used to fall through to the shallowest
+        // traversal (so `--depth full` scanned *less* than the default), and an
+        // unknown --type skipped every phase while still reporting "No security
+        // issues found!" with exit 0 — a typo was indistinguishable from a clean
+        // result, and it silently disabled the critical/high exit-code gate.
+        // Fail closed instead, before anything is printed or scanned.
+        const aliasedDepth = DEPRECATED_SCAN_DEPTHS[requestedDepth];
+        if (aliasedDepth) {
+            output.printWarning(`--depth '${requestedDepth}' is deprecated and has been treated as '${aliasedDepth}'. ` +
+                `Use one of: ${SCAN_DEPTHS.join(', ')}.`);
+        }
+        const candidateDepth = aliasedDepth ?? requestedDepth;
+        if (!isScanDepth(candidateDepth)) {
+            output.printError(`Invalid --depth '${requestedDepth}'. Expected one of: ${SCAN_DEPTHS.join(', ')}.`);
+            return { success: false, exitCode: 1 };
+        }
+        const depth = candidateDepth;
+        // Case-insensitive so `--type Container` gets the accurate "not implemented"
+        // message rather than being reported as a misspelling.
+        if (UNIMPLEMENTED_SCAN_TYPES.includes(scanType.toLowerCase())) {
+            output.printError(`--type '${scanType}' is not implemented yet. Expected one of: ${SCAN_TYPES.join(', ')}.`);
+            return { success: false, exitCode: 1 };
+        }
+        if (!isScanType(scanType)) {
+            output.printError(`Invalid --type '${scanType}'. Expected one of: ${SCAN_TYPES.join(', ')}.`);
+            return { success: false, exitCode: 1 };
+        }
+        // --target names WHAT gets scanned, and was never validated. A path that
+        // does not exist (or is a file, not a directory) made every phase read
+        // nothing, and the swallowed dir-read catches turned that into zero
+        // findings, the clean banner, exit 0 — and a PERSISTED clean report that
+        // getSecurityStatus then reports as CLEAN. Same fail-open class as the enum
+        // flags, and the likelier typo of the two, so it fails closed too.
+        const resolvedTarget = resolvePath(target);
+        if (!existsSync(resolvedTarget)) {
+            output.printError(`Target does not exist: ${resolvedTarget}`);
+            return { success: false, exitCode: 1 };
+        }
+        if (!statSync(resolvedTarget).isDirectory()) {
+            output.printError(`Target is not a directory: ${resolvedTarget}`);
+            return { success: false, exitCode: 1 };
+        }
         output.writeln();
         output.writeln(output.bold('Security Scan'));
         output.writeln(output.dim('─'.repeat(50)));
@@ -98,7 +177,9 @@ const scanCommand = {
                     { pattern: /password\s*[:=]\s*['"][^'"]{8,}['"]/gi, type: 'Hardcoded Password' },
                 ];
                 const scanDir = (dir, depthLimit) => {
-                    if (depthLimit <= 0)
+                    // Positive-test rather than `<= 0`: undefined and NaN both fail this,
+                    // so a bad budget stops the recursion instead of disabling the limiter.
+                    if (!(depthLimit > 0))
                         return;
                     try {
                         const entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -134,7 +215,7 @@ const scanCommand = {
                     }
                     catch { /* dir read error */ }
                 };
-                const scanDepth = depth === 'deep' ? 10 : depth === 'standard' ? 5 : 3;
+                const scanDepth = SECRET_SCAN_DEPTH[depth];
                 scanDir(path.resolve(target), scanDepth);
             }
             // Phase 3: Check for common security issues in code
@@ -148,7 +229,9 @@ const scanCommand = {
                     { pattern: /\$\{.*\}.*sql|sql.*\$\{/gi, type: 'SQL Injection', severity: 'high', desc: 'Possible SQL injection' },
                 ];
                 const scanCodeDir = (dir, depthLimit) => {
-                    if (depthLimit <= 0)
+                    // Positive-test rather than `<= 0`: undefined and NaN both fail this,
+                    // so a bad budget stops the recursion instead of disabling the limiter.
+                    if (!(depthLimit > 0))
                         return;
                     try {
                         const entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -187,7 +270,7 @@ const scanCommand = {
                     }
                     catch { /* dir read error */ }
                 };
-                const scanDepth = depth === 'deep' ? 10 : 5;
+                const scanDepth = CODE_SCAN_DEPTH[depth];
                 scanCodeDir(path.resolve(target), scanDepth);
             }
             spinner.succeed('Scan complete');
@@ -1222,7 +1305,7 @@ export const securityCommand = {
         output.writeln();
         output.writeln('Subcommands:');
         output.printList([
-            'scan              - Run security scans on code, deps, containers',
+            'scan              - Run security scans on code, deps',
             'cve               - Check and manage CVE vulnerabilities',
             'threats           - Threat modeling (STRIDE, DREAD, PASTA)',
             'audit             - Security audit logging and compliance',

package/dist/src/funnel/insights.js

@@ -51,7 +51,7 @@ function securityInsight(ctx) {
         };
     }
     if (s.status === 'PENDING') {
-        return { id: 'insight-scan-pending', text: '🛡 Security scan pending — Run ruflo security scan --depth full', priority: 70 };
+        return { id: 'insight-scan-pending', text: '🛡 Security scan pending — Run ruflo security scan --depth deep', priority: 70 };
     }
     return null;
 }

package/dist/src/funnel/messages.js

@@ -158,7 +158,7 @@ export const MESSAGES = [
         schemaVersion: 1,
         id: 'local.edu.security-scan',
         class: 'educational',
-        text: '🔒 ruflo security scan --depth full — audits dependencies and config',
+        text: '🔒 ruflo security scan --depth deep — audits dependencies and config',
         url: 'https://cognitum.one/docs/security',
     },
     {

package/dist/src/init/claudemd-generator.js

@@ -247,7 +247,7 @@ function securitySection() {
 - Always use parameterized queries (prevent injection)
 
 \`\`\`bash
-npx @claude-flow/cli@latest security scan --depth full
+npx @claude-flow/cli@latest security scan --depth deep
 npx @claude-flow/cli@latest security audit --report
 \`\`\`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.38",
+  "version": "3.32.40",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",