@claude-flow/cli 3.32.39 → 3.32.41

package/.claude/agents/v3/security-architect-aidefence.md

@@ -140,7 +140,7 @@ hooks:
     # ═══════════════════════════════════════════════════════════════
     echo "🔒 Running comprehensive security validation..."
 
-    npx claude-flow@v3alpha security scan --depth full --output-format json > /tmp/security-scan.json 2>/dev/null
+    npx claude-flow@v3alpha security scan --depth deep --output-format json > /tmp/security-scan.json 2>/dev/null
     VULNERABILITIES=$(jq -r '.vulnerabilities | length' /tmp/security-scan.json 2>/dev/null || echo "0")
     CRITICAL_COUNT=$(jq -r '.vulnerabilities | map(select(.severity == "critical")) | length' /tmp/security-scan.json 2>/dev/null || echo "0")
     HIGH_COUNT=$(jq -r '.vulnerabilities | map(select(.severity == "high")) | length' /tmp/security-scan.json 2>/dev/null || echo "0")

package/.claude/agents/v3/security-architect.md

@@ -58,7 +58,7 @@ hooks:
     echo "✅ Security architecture analysis complete"
 
     # 1. Run comprehensive security validation
-    npx claude-flow@v3alpha security scan --depth full --output-format json > /tmp/security-scan.json 2>/dev/null
+    npx claude-flow@v3alpha security scan --depth deep --output-format json > /tmp/security-scan.json 2>/dev/null
     VULNERABILITIES=$(jq -r '.vulnerabilities | length' /tmp/security-scan.json 2>/dev/null || echo "0")
     CRITICAL_COUNT=$(jq -r '.vulnerabilities | map(select(.severity == "critical")) | length' /tmp/security-scan.json 2>/dev/null || echo "0")
 
@@ -834,7 +834,7 @@ mcp__claude-flow__memory_usage({
 
 ```bash
 # Full security scan
-npx claude-flow@v3alpha security scan --depth full
+npx claude-flow@v3alpha security scan --depth deep
 
 # CVE-specific checks
 npx claude-flow@v3alpha security cve --check CVE-2024-001

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.32.39
+3.32.40

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.32.39",
+    "version": "3.32.41",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
@@ -8,6 +8,6 @@
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "v71S5vogcB+hBHI1nrB4pYHFC5kkRKJb/Qj+QdGdYqsxaKlK+2+9qo6ovpQaADjjseTJzrUAtHcJ7CbdEQt6CA==",
+  "signature": "E9neB/wxzCHAXPsX8ICLwt7X02M0joPEtF9kqHMH6qBp6y0C5OblOxerCq/AOE+8UrtsA/utlCpnmdQL6iHqDw==",
   "algorithm": "ed25519"
 }

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1785375525809,
+  "adoptedAt": 1785428938153,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 4,
-  "generatedAt": "2026-07-30T02:05:05.762Z",
-  "gitSha": "fabcc926",
+  "generatedAt": "2026-07-30T16:29:15.655Z",
+  "gitSha": "48d532b4",
   "catalog": {
     "agents": 164,
     "tools": 397,

package/dist/src/commands/hooks.js

@@ -1387,6 +1387,16 @@ const transferFromProjectCommand = {
                 minConfidence,
                 mergeStrategy: 'keep-highest-confidence',
             });
+            // #2859 — the handler reports success:false (no destination write
+            // happened) when the source has no matching patterns at all. Surface
+            // that honestly instead of claiming a transfer occurred.
+            if (!result.success || typeof result.transferred === 'number') {
+                spinner.fail(result.message ?? 'No patterns transferred');
+                if (ctx.flags.format === 'json') {
+                    output.printJson(result);
+                }
+                return { success: false, exitCode: 1, data: result };
+            }
             spinner.succeed(`Transferred ${result.transferred.total} patterns`);
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
@@ -1401,9 +1411,9 @@ const transferFromProjectCommand = {
                 ],
                 data: [
                     { category: 'Total Transferred', count: output.success(String(result.transferred.total)) },
-                    { category: 'Skipped (Low Confidence)', count: result.skipped.lowConfidence },
-                    { category: 'Skipped (Duplicates)', count: result.skipped.duplicates },
-                    { category: 'Skipped (Conflicts)', count: result.skipped.conflicts }
+                    { category: 'Skipped (Low Confidence)', count: result.skipped?.lowConfidence ?? 0 },
+                    { category: 'Skipped (Duplicates)', count: result.skipped?.duplicates ?? 0 },
+                    { category: 'Skipped (Conflicts)', count: result.skipped?.conflicts ?? 0 }
                 ]
             });
             if (Object.keys(result.transferred.byType).length > 0) {
@@ -1417,11 +1427,19 @@ const transferFromProjectCommand = {
                     data: Object.entries(result.transferred.byType).map(([type, count]) => ({ type, count }))
                 });
             }
-            output.writeln();
-            output.printList([
-                `Avg Confidence: ${(result.stats.avgConfidence * 100).toFixed(1)}%`,
-                `Avg Age: ${result.stats.avgAge}`
-            ]);
+            // #2865-style honesty: omit stats that have no real measured value
+            // rather than showing a fabricated number.
+            const statLines = [];
+            if (result.stats?.avgConfidence != null) {
+                statLines.push(`Avg Confidence: ${(result.stats.avgConfidence * 100).toFixed(1)}%`);
+            }
+            if (result.stats?.avgAgeDays != null) {
+                statLines.push(`Avg Age: ${result.stats.avgAgeDays.toFixed(1)} days`);
+            }
+            if (statLines.length > 0) {
+                output.writeln();
+                output.printList(statLines);
+            }
             return { success: true, data: result };
         }
         catch (error) {
@@ -2137,9 +2155,17 @@ const intelligenceCommand = {
                     moe: {
                         enabled: enableMoe,
                         status: String(mcpMoe?.status ?? (hasLocalData ? 'active' : 'idle')),
-                        expertsActive: Number(mcpMoe?.expertsActive ?? (hasLocalData ? 8 : 0)),
-                        routingAccuracy: Number(mcpMoe?.routingAccuracy ?? (hasLocalData ? 0.82 : 0)),
-                        loadBalance: Number(mcpMoe?.loadBalance ?? (hasLocalData ? 0.9 : 0)),
+                        // #2865 — these three previously fell back to hardcoded
+                        // hasLocalData ? <constant> : 0 whenever the MCP tool didn't
+                        // report a real value, so "Routing Accuracy: 82.0%" displayed
+                        // on every project with local neural data regardless of actual
+                        // routing quality (measured 49% on a real store). None of these
+                        // three has a cheap, honest local substitute the way
+                        // `hooks metrics`' routingAccuracy falls back to averageConfidence,
+                        // so they are null (unmeasured) rather than a fabricated number.
+                        expertsActive: mcpMoe?.expertsActive == null ? null : Number(mcpMoe.expertsActive),
+                        routingAccuracy: mcpMoe?.routingAccuracy == null ? null : Number(mcpMoe.routingAccuracy),
+                        loadBalance: mcpMoe?.loadBalance == null ? null : Number(mcpMoe.loadBalance),
                     },
                     hnsw: {
                         enabled: enableHnsw,
@@ -2235,9 +2261,11 @@ const intelligenceCommand = {
                     ],
                     data: [
                         { metric: 'Status', value: formatIntelligenceStatus(moe.status) },
-                        { metric: 'Active Experts', value: moe.expertsActive ?? 0 },
-                        { metric: 'Routing Accuracy', value: `${((moe.routingAccuracy ?? 0) * 100).toFixed(1)}%` },
-                        { metric: 'Load Balance', value: `${((moe.loadBalance ?? 0) * 100).toFixed(1)}%` }
+                        // #2865 — omit rather than show a fabricated 0/0.0% when the
+                        // MCP tool hasn't reported a real value for these.
+                        ...(moe.expertsActive == null ? [] : [{ metric: 'Active Experts', value: moe.expertsActive }]),
+                        ...(moe.routingAccuracy == null ? [] : [{ metric: 'Routing Accuracy', value: `${(moe.routingAccuracy * 100).toFixed(1)}%` }]),
+                        ...(moe.loadBalance == null ? [] : [{ metric: 'Load Balance', value: `${(moe.loadBalance * 100).toFixed(1)}%` }]),
                     ]
                 });
             }

package/dist/src/commands/security.js

@@ -6,15 +6,51 @@
  */
 import { output } from '../output.js';
 import { execSync } from 'node:child_process';
+import { existsSync, statSync } from 'node:fs';
+import { resolve as resolvePath } from 'node:path';
 import { createBuiltinAIDefence } from '../security/builtin-aidefence.js';
+// Accepted values for `security scan`'s enum flags — the single source of truth
+// for both validation and the traversal-depth maps below.
+const SCAN_DEPTHS = ['quick', 'standard', 'deep'];
+const SCAN_TYPES = ['code', 'deps', 'all'];
+// Real type predicates, not `as` casts. Array.includes() does not narrow a
+// string to a literal union on its own, so without these the depth-map lookups
+// below need an unchecked assertion — and an unchecked assertion would let a
+// future refactor index the maps with an invalid key, yielding `undefined`.
+// That matters: `undefined <= 0` is false and `undefined - 1` is NaN, so the
+// recursion guard in scanDir would never fire. An unsafe cast here would
+// silently disable the depth limiter — the exact class of failure this command
+// is being fixed for.
+const isScanDepth = (v) => SCAN_DEPTHS.includes(v);
+const isScanType = (v) => SCAN_TYPES.includes(v);
+// `full` was never a supported depth, but the CLI itself printed it — the
+// statusline insight, the announcement, the release-notes blurb, the CLAUDE.md
+// that `init` generates, and two shipped agent definitions all tell people to
+// run `security scan --depth full`. Pre-fix it silently fell through to the
+// SHALLOWEST traversal, which is the bug. Hard-rejecting it would break every
+// caller we ourselves told to use it, so it is normalised to the depth the word
+// promised, with a warning. Remove once those emitters have aged out.
+const DEPRECATED_SCAN_DEPTHS = { full: 'deep' };
+// `container` has been advertised in --type's help since this command was
+// written, but no phase below implements it. Accepting it would reproduce the
+// exact bug this validation exists to fix: a documented flag value that scans
+// nothing and still prints a clean bill of health. Rejected explicitly, with
+// its own message, until a container phase exists.
+const UNIMPLEMENTED_SCAN_TYPES = ['container'];
+// Directory-recursion limits per depth. Exhaustive records rather than chained
+// ternaries, so adding a depth is a compile error here instead of a silently
+// shallower scan. CODE_SCAN_DEPTH.quick is unreachable — phase 3 is gated on
+// depth !== 'quick' — but is present so the record stays total.
+const SECRET_SCAN_DEPTH = { quick: 3, standard: 5, deep: 10 };
+const CODE_SCAN_DEPTH = { quick: 0, standard: 5, deep: 10 };
 // Scan subcommand
 const scanCommand = {
     name: 'scan',
-    description: 'Run security scan on target (code, dependencies, containers)',
+    description: 'Run security scan on target (code, dependencies)',
     options: [
         { name: 'target', short: 't', type: 'string', description: 'Target path or URL to scan', default: '.' },
         { name: 'depth', short: 'd', type: 'string', description: 'Scan depth: quick, standard, deep', default: 'standard' },
-        { name: 'type', type: 'string', description: 'Scan type: code, deps, container, all', default: 'all' },
+        { name: 'type', type: 'string', description: 'Scan type: code, deps, all', default: 'all' },
         { name: 'output', short: 'o', type: 'string', description: 'Output format: text, json, sarif', default: 'text' },
         { name: 'fix', short: 'f', type: 'boolean', description: 'Auto-fix vulnerabilities where possible' },
     ],
@@ -24,9 +60,52 @@ const scanCommand = {
     ],
     action: async (ctx) => {
         const target = ctx.flags.target || '.';
-        const depth = ctx.flags.depth || 'standard';
+        const requestedDepth = ctx.flags.depth || 'standard';
         const scanType = ctx.flags.type || 'all';
         const fix = ctx.flags.fix;
+        // A security scanner must never silently degrade on an unrecognised enum
+        // value. An unknown --depth used to fall through to the shallowest
+        // traversal (so `--depth full` scanned *less* than the default), and an
+        // unknown --type skipped every phase while still reporting "No security
+        // issues found!" with exit 0 — a typo was indistinguishable from a clean
+        // result, and it silently disabled the critical/high exit-code gate.
+        // Fail closed instead, before anything is printed or scanned.
+        const aliasedDepth = DEPRECATED_SCAN_DEPTHS[requestedDepth];
+        if (aliasedDepth) {
+            output.printWarning(`--depth '${requestedDepth}' is deprecated and has been treated as '${aliasedDepth}'. ` +
+                `Use one of: ${SCAN_DEPTHS.join(', ')}.`);
+        }
+        const candidateDepth = aliasedDepth ?? requestedDepth;
+        if (!isScanDepth(candidateDepth)) {
+            output.printError(`Invalid --depth '${requestedDepth}'. Expected one of: ${SCAN_DEPTHS.join(', ')}.`);
+            return { success: false, exitCode: 1 };
+        }
+        const depth = candidateDepth;
+        // Case-insensitive so `--type Container` gets the accurate "not implemented"
+        // message rather than being reported as a misspelling.
+        if (UNIMPLEMENTED_SCAN_TYPES.includes(scanType.toLowerCase())) {
+            output.printError(`--type '${scanType}' is not implemented yet. Expected one of: ${SCAN_TYPES.join(', ')}.`);
+            return { success: false, exitCode: 1 };
+        }
+        if (!isScanType(scanType)) {
+            output.printError(`Invalid --type '${scanType}'. Expected one of: ${SCAN_TYPES.join(', ')}.`);
+            return { success: false, exitCode: 1 };
+        }
+        // --target names WHAT gets scanned, and was never validated. A path that
+        // does not exist (or is a file, not a directory) made every phase read
+        // nothing, and the swallowed dir-read catches turned that into zero
+        // findings, the clean banner, exit 0 — and a PERSISTED clean report that
+        // getSecurityStatus then reports as CLEAN. Same fail-open class as the enum
+        // flags, and the likelier typo of the two, so it fails closed too.
+        const resolvedTarget = resolvePath(target);
+        if (!existsSync(resolvedTarget)) {
+            output.printError(`Target does not exist: ${resolvedTarget}`);
+            return { success: false, exitCode: 1 };
+        }
+        if (!statSync(resolvedTarget).isDirectory()) {
+            output.printError(`Target is not a directory: ${resolvedTarget}`);
+            return { success: false, exitCode: 1 };
+        }
         output.writeln();
         output.writeln(output.bold('Security Scan'));
         output.writeln(output.dim('─'.repeat(50)));
@@ -98,7 +177,9 @@ const scanCommand = {
                     { pattern: /password\s*[:=]\s*['"][^'"]{8,}['"]/gi, type: 'Hardcoded Password' },
                 ];
                 const scanDir = (dir, depthLimit) => {
-                    if (depthLimit <= 0)
+                    // Positive-test rather than `<= 0`: undefined and NaN both fail this,
+                    // so a bad budget stops the recursion instead of disabling the limiter.
+                    if (!(depthLimit > 0))
                         return;
                     try {
                         const entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -134,7 +215,7 @@ const scanCommand = {
                     }
                     catch { /* dir read error */ }
                 };
-                const scanDepth = depth === 'deep' ? 10 : depth === 'standard' ? 5 : 3;
+                const scanDepth = SECRET_SCAN_DEPTH[depth];
                 scanDir(path.resolve(target), scanDepth);
             }
             // Phase 3: Check for common security issues in code
@@ -148,7 +229,9 @@ const scanCommand = {
                     { pattern: /\$\{.*\}.*sql|sql.*\$\{/gi, type: 'SQL Injection', severity: 'high', desc: 'Possible SQL injection' },
                 ];
                 const scanCodeDir = (dir, depthLimit) => {
-                    if (depthLimit <= 0)
+                    // Positive-test rather than `<= 0`: undefined and NaN both fail this,
+                    // so a bad budget stops the recursion instead of disabling the limiter.
+                    if (!(depthLimit > 0))
                         return;
                     try {
                         const entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -187,7 +270,7 @@ const scanCommand = {
                     }
                     catch { /* dir read error */ }
                 };
-                const scanDepth = depth === 'deep' ? 10 : 5;
+                const scanDepth = CODE_SCAN_DEPTH[depth];
                 scanCodeDir(path.resolve(target), scanDepth);
             }
             spinner.succeed('Scan complete');
@@ -1222,7 +1305,7 @@ export const securityCommand = {
         output.writeln();
         output.writeln('Subcommands:');
         output.printList([
-            'scan              - Run security scans on code, deps, containers',
+            'scan              - Run security scans on code, deps',
             'cve               - Check and manage CVE vulnerabilities',
             'threats           - Threat modeling (STRIDE, DREAD, PASTA)',
             'audit             - Security audit logging and compliance',

package/dist/src/funnel/insights.js

@@ -51,7 +51,7 @@ function securityInsight(ctx) {
         };
     }
     if (s.status === 'PENDING') {
-        return { id: 'insight-scan-pending', text: '🛡 Security scan pending — Run ruflo security scan --depth full', priority: 70 };
+        return { id: 'insight-scan-pending', text: '🛡 Security scan pending — Run ruflo security scan --depth deep', priority: 70 };
     }
     return null;
 }

package/dist/src/funnel/messages.js

@@ -158,7 +158,7 @@ export const MESSAGES = [
         schemaVersion: 1,
         id: 'local.edu.security-scan',
         class: 'educational',
-        text: '🔒 ruflo security scan --depth full — audits dependencies and config',
+        text: '🔒 ruflo security scan --depth deep — audits dependencies and config',
         url: 'https://cognitum.one/docs/security',
     },
     {

package/dist/src/init/claudemd-generator.js

@@ -247,7 +247,7 @@ function securitySection() {
 - Always use parameterized queries (prevent injection)
 
 \`\`\`bash
-npx @claude-flow/cli@latest security scan --depth full
+npx @claude-flow/cli@latest security scan --depth deep
 npx @claude-flow/cli@latest security audit --report
 \`\`\`
 

package/dist/src/mcp-tools/hooks-tools.js

@@ -987,14 +987,20 @@ export const hooksRoute = {
         let agents;
         let confidence;
         let matchedPattern = '';
+        // Both static and learned patterns are gated on the same similarity
+        // score. Learned patterns additionally require support/reliability as a
+        // quality guard, but do NOT need a higher score bar — a learned pattern
+        // that outscores every static candidate must not lose to one anyway
+        // (#2864: a 25pp higher threshold made a top-scoring learned-researcher
+        // match at 0.57 lose to a static match at 0.52, discarding the learned
+        // store's output on the majority of routes).
         const eligibleSemantic = semanticResult.find((match) => {
             if (match.score <= 0.4)
                 return false;
             const learned = match.intent.startsWith('learned-') || match.metadata.source === 'learned';
             if (!learned)
                 return true;
-            return match.score >= 0.65
-                && Number(match.metadata.support ?? 0) >= 2
+            return Number(match.metadata.support ?? 0) >= 2
                 && Number(match.metadata.reliability ?? 0) >= 0.75;
         });
         if (eligibleSemantic) {
@@ -1866,16 +1872,23 @@ export const hooksTransfer = {
         catch {
             // Fall back to empty store
         }
-        const sourceEntries = Object.values(sourceStore.entries);
-        // Count patterns by type from source
-        const byType = {
-            'file-patterns': sourceEntries.filter(e => e.key.includes('file') || e.metadata?.type === 'file-pattern').length,
-            'task-routing': sourceEntries.filter(e => e.key.includes('routing') || e.metadata?.type === 'routing').length,
-            'command-risk': sourceEntries.filter(e => e.key.includes('command') || e.metadata?.type === 'command-risk').length,
-            'agent-success': sourceEntries.filter(e => e.key.includes('agent') || e.metadata?.type === 'agent-success').length,
+        const classifyType = (key, metadata) => {
+            if (key.includes('file') || metadata?.type === 'file-pattern')
+                return 'file-patterns';
+            if (key.includes('routing') || metadata?.type === 'routing')
+                return 'task-routing';
+            if (key.includes('command') || metadata?.type === 'command-risk')
+                return 'command-risk';
+            if (key.includes('agent') || metadata?.type === 'agent-success')
+                return 'agent-success';
+            return null;
         };
+        const candidates = Object.entries(sourceStore.entries)
+            .map(([key, entry]) => ({ key, entry, type: classifyType(key, entry.metadata) }))
+            .filter((c) => c.type !== null)
+            .filter(c => !filter || c.type.includes(filter));
         // If source has no patterns, report honestly instead of substituting demo data
-        if (Object.values(byType).every(v => v === 0)) {
+        if (candidates.length === 0) {
             return {
                 success: false,
                 message: 'No patterns found in source project',
@@ -1883,28 +1896,76 @@ export const hooksTransfer = {
                 transferred: 0,
             };
         }
-        if (filter) {
-            Object.keys(byType).forEach(key => {
-                if (!key.includes(filter))
-                    delete byType[key];
-            });
+        // #2859 — this used to count source patterns, then invent skip counts
+        // as fixed percentages of that count and a fixed avgConfidence/avgAge,
+        // without ever reading or writing the destination store. An operator
+        // could believe state moved between projects when nothing changed.
+        // Perform a real merge: skip entries below the confidence threshold,
+        // skip exact duplicates, skip real conflicts (destination already has
+        // a different value for that key — never silently overwritten), and
+        // actually write whatever remains into this project's own memory store.
+        const destStore = loadMemoryStore();
+        const byType = {};
+        let lowConfidence = 0;
+        let duplicates = 0;
+        let conflicts = 0;
+        let transferredCount = 0;
+        let confidenceSum = 0;
+        let confidenceCount = 0;
+        let ageSumMs = 0;
+        let ageCount = 0;
+        const now = Date.now();
+        for (const { key, entry, type } of candidates) {
+            const confidenceRaw = entry.metadata?.confidence ?? entry.metadata?.reliability;
+            const confidence = typeof confidenceRaw === 'number' ? confidenceRaw : undefined;
+            if (confidence !== undefined && confidence < minConfidence) {
+                lowConfidence++;
+                continue;
+            }
+            const existing = destStore.entries[key];
+            if (existing) {
+                const same = JSON.stringify(existing.value) === JSON.stringify(entry.value);
+                if (same) {
+                    duplicates++;
+                    continue;
+                }
+                conflicts++;
+                continue;
+            }
+            destStore.entries[key] = entry;
+            transferredCount++;
+            byType[type] = (byType[type] ?? 0) + 1;
+            if (confidence !== undefined) {
+                confidenceSum += confidence;
+                confidenceCount++;
+            }
+            const storedAtMs = Date.parse(entry.storedAt ?? '');
+            if (!Number.isNaN(storedAtMs)) {
+                ageSumMs += now - storedAtMs;
+                ageCount++;
+            }
+        }
+        if (transferredCount > 0) {
+            const memDir = resolve(MEMORY_DIR);
+            if (!existsSync(memDir))
+                mkdirSync(memDir, { recursive: true });
+            writeFileSync(getMemoryPath(), JSON.stringify(destStore, null, 2), 'utf-8');
         }
-        const total = Object.values(byType).reduce((a, b) => a + b, 0);
         return {
             success: true,
             sourcePath,
             transferred: {
-                total,
+                total: transferredCount,
                 byType,
             },
             skipped: {
-                lowConfidence: Math.floor(total * 0.15),
-                duplicates: Math.floor(total * 0.08),
-                conflicts: Math.floor(total * 0.03),
+                lowConfidence,
+                duplicates,
+                conflicts,
             },
             stats: {
-                avgConfidence: 0.82 + (minConfidence > 0.8 ? 0.1 : 0),
-                avgAge: '3 days',
+                avgConfidence: confidenceCount > 0 ? Number((confidenceSum / confidenceCount).toFixed(3)) : null,
+                avgAgeDays: ageCount > 0 ? Number((ageSumMs / ageCount / 86_400_000).toFixed(1)) : null,
             },
             dataSource: 'source-project',
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.39",
+  "version": "3.32.41",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",