@claude-flow/cli 3.32.40 → 3.33.0

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.32.40
+3.32.29

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.32.40",
+    "version": "3.33.0",
     "files": {
       "auto-memory-hook.mjs": "68be7e9a9eba7bf9c4e8a230db7bf61a243b965639f8504842799d6c6ca28762",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
@@ -8,6 +8,6 @@
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "LKhT8u+7Osi/g/JGxIupJ26jkWtAi7RRh/RLPp/DplCdVEKcP6iTgWRYkBJ1flZNsAJGDkDpGfPbSWzLz3JcAg==",
+  "signature": "J0E/yeJoSS9oIfHsfle9CjlnSLNeSO6dcXPkuhzDx/2lddDeddDXMDXF3XO0GnQbpZWTduBKx5+cN0ip89fJDw==",
   "algorithm": "ed25519"
 }

package/README.md

@@ -1,8 +1,6 @@
 <div align="center">
 
 [![Ruflo Banner](ruflo/assets/ruflo-small.jpeg)](https://cognitum.one/agentic-engineering)
-[![Agentics Foundation Banner](docs/assets/sv-summit.png)](https://agentics.org/siliconvalley/?UTM=GH-RuFlo-SV)
-
 
 <!-- Try Ruflo — the 4 badges first-time visitors actually act on -->
 [![Try the UI Beta — flo.ruv.io](https://img.shields.io/badge/_Try_the_UI_Beta-flo.ruv.io-6366f1?style=for-the-badge&logoColor=white&logo=svelte)](https://flo.ruv.io/)

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 4,
-  "generatedAt": "2026-07-30T13:30:58.553Z",
-  "gitSha": "76453115",
+  "generatedAt": "2026-07-30T19:39:04.992Z",
+  "gitSha": "6e6c7347",
   "catalog": {
     "agents": 164,
     "tools": 397,

package/dist/src/commands/hooks.js

@@ -1387,6 +1387,16 @@ const transferFromProjectCommand = {
                 minConfidence,
                 mergeStrategy: 'keep-highest-confidence',
             });
+            // #2859 — the handler reports success:false (no destination write
+            // happened) when the source has no matching patterns at all. Surface
+            // that honestly instead of claiming a transfer occurred.
+            if (!result.success || typeof result.transferred === 'number') {
+                spinner.fail(result.message ?? 'No patterns transferred');
+                if (ctx.flags.format === 'json') {
+                    output.printJson(result);
+                }
+                return { success: false, exitCode: 1, data: result };
+            }
             spinner.succeed(`Transferred ${result.transferred.total} patterns`);
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
@@ -1401,9 +1411,9 @@ const transferFromProjectCommand = {
                 ],
                 data: [
                     { category: 'Total Transferred', count: output.success(String(result.transferred.total)) },
-                    { category: 'Skipped (Low Confidence)', count: result.skipped.lowConfidence },
-                    { category: 'Skipped (Duplicates)', count: result.skipped.duplicates },
-                    { category: 'Skipped (Conflicts)', count: result.skipped.conflicts }
+                    { category: 'Skipped (Low Confidence)', count: result.skipped?.lowConfidence ?? 0 },
+                    { category: 'Skipped (Duplicates)', count: result.skipped?.duplicates ?? 0 },
+                    { category: 'Skipped (Conflicts)', count: result.skipped?.conflicts ?? 0 }
                 ]
             });
             if (Object.keys(result.transferred.byType).length > 0) {
@@ -1417,11 +1427,19 @@ const transferFromProjectCommand = {
                     data: Object.entries(result.transferred.byType).map(([type, count]) => ({ type, count }))
                 });
             }
-            output.writeln();
-            output.printList([
-                `Avg Confidence: ${(result.stats.avgConfidence * 100).toFixed(1)}%`,
-                `Avg Age: ${result.stats.avgAge}`
-            ]);
+            // #2865-style honesty: omit stats that have no real measured value
+            // rather than showing a fabricated number.
+            const statLines = [];
+            if (result.stats?.avgConfidence != null) {
+                statLines.push(`Avg Confidence: ${(result.stats.avgConfidence * 100).toFixed(1)}%`);
+            }
+            if (result.stats?.avgAgeDays != null) {
+                statLines.push(`Avg Age: ${result.stats.avgAgeDays.toFixed(1)} days`);
+            }
+            if (statLines.length > 0) {
+                output.writeln();
+                output.printList(statLines);
+            }
             return { success: true, data: result };
         }
         catch (error) {
@@ -2137,9 +2155,17 @@ const intelligenceCommand = {
                     moe: {
                         enabled: enableMoe,
                         status: String(mcpMoe?.status ?? (hasLocalData ? 'active' : 'idle')),
-                        expertsActive: Number(mcpMoe?.expertsActive ?? (hasLocalData ? 8 : 0)),
-                        routingAccuracy: Number(mcpMoe?.routingAccuracy ?? (hasLocalData ? 0.82 : 0)),
-                        loadBalance: Number(mcpMoe?.loadBalance ?? (hasLocalData ? 0.9 : 0)),
+                        // #2865 — these three previously fell back to hardcoded
+                        // hasLocalData ? <constant> : 0 whenever the MCP tool didn't
+                        // report a real value, so "Routing Accuracy: 82.0%" displayed
+                        // on every project with local neural data regardless of actual
+                        // routing quality (measured 49% on a real store). None of these
+                        // three has a cheap, honest local substitute the way
+                        // `hooks metrics`' routingAccuracy falls back to averageConfidence,
+                        // so they are null (unmeasured) rather than a fabricated number.
+                        expertsActive: mcpMoe?.expertsActive == null ? null : Number(mcpMoe.expertsActive),
+                        routingAccuracy: mcpMoe?.routingAccuracy == null ? null : Number(mcpMoe.routingAccuracy),
+                        loadBalance: mcpMoe?.loadBalance == null ? null : Number(mcpMoe.loadBalance),
                     },
                     hnsw: {
                         enabled: enableHnsw,
@@ -2235,9 +2261,11 @@ const intelligenceCommand = {
                     ],
                     data: [
                         { metric: 'Status', value: formatIntelligenceStatus(moe.status) },
-                        { metric: 'Active Experts', value: moe.expertsActive ?? 0 },
-                        { metric: 'Routing Accuracy', value: `${((moe.routingAccuracy ?? 0) * 100).toFixed(1)}%` },
-                        { metric: 'Load Balance', value: `${((moe.loadBalance ?? 0) * 100).toFixed(1)}%` }
+                        // #2865 — omit rather than show a fabricated 0/0.0% when the
+                        // MCP tool hasn't reported a real value for these.
+                        ...(moe.expertsActive == null ? [] : [{ metric: 'Active Experts', value: moe.expertsActive }]),
+                        ...(moe.routingAccuracy == null ? [] : [{ metric: 'Routing Accuracy', value: `${(moe.routingAccuracy * 100).toFixed(1)}%` }]),
+                        ...(moe.loadBalance == null ? [] : [{ metric: 'Load Balance', value: `${(moe.loadBalance * 100).toFixed(1)}%` }]),
                     ]
                 });
             }

package/dist/src/mcp-tools/hooks-tools.js

@@ -987,14 +987,20 @@ export const hooksRoute = {
         let agents;
         let confidence;
         let matchedPattern = '';
+        // Both static and learned patterns are gated on the same similarity
+        // score. Learned patterns additionally require support/reliability as a
+        // quality guard, but do NOT need a higher score bar — a learned pattern
+        // that outscores every static candidate must not lose to one anyway
+        // (#2864: a 25pp higher threshold made a top-scoring learned-researcher
+        // match at 0.57 lose to a static match at 0.52, discarding the learned
+        // store's output on the majority of routes).
         const eligibleSemantic = semanticResult.find((match) => {
             if (match.score <= 0.4)
                 return false;
             const learned = match.intent.startsWith('learned-') || match.metadata.source === 'learned';
             if (!learned)
                 return true;
-            return match.score >= 0.65
-                && Number(match.metadata.support ?? 0) >= 2
+            return Number(match.metadata.support ?? 0) >= 2
                 && Number(match.metadata.reliability ?? 0) >= 0.75;
         });
         if (eligibleSemantic) {
@@ -1866,16 +1872,23 @@ export const hooksTransfer = {
         catch {
             // Fall back to empty store
         }
-        const sourceEntries = Object.values(sourceStore.entries);
-        // Count patterns by type from source
-        const byType = {
-            'file-patterns': sourceEntries.filter(e => e.key.includes('file') || e.metadata?.type === 'file-pattern').length,
-            'task-routing': sourceEntries.filter(e => e.key.includes('routing') || e.metadata?.type === 'routing').length,
-            'command-risk': sourceEntries.filter(e => e.key.includes('command') || e.metadata?.type === 'command-risk').length,
-            'agent-success': sourceEntries.filter(e => e.key.includes('agent') || e.metadata?.type === 'agent-success').length,
+        const classifyType = (key, metadata) => {
+            if (key.includes('file') || metadata?.type === 'file-pattern')
+                return 'file-patterns';
+            if (key.includes('routing') || metadata?.type === 'routing')
+                return 'task-routing';
+            if (key.includes('command') || metadata?.type === 'command-risk')
+                return 'command-risk';
+            if (key.includes('agent') || metadata?.type === 'agent-success')
+                return 'agent-success';
+            return null;
         };
+        const candidates = Object.entries(sourceStore.entries)
+            .map(([key, entry]) => ({ key, entry, type: classifyType(key, entry.metadata) }))
+            .filter((c) => c.type !== null)
+            .filter(c => !filter || c.type.includes(filter));
         // If source has no patterns, report honestly instead of substituting demo data
-        if (Object.values(byType).every(v => v === 0)) {
+        if (candidates.length === 0) {
             return {
                 success: false,
                 message: 'No patterns found in source project',
@@ -1883,28 +1896,76 @@ export const hooksTransfer = {
                 transferred: 0,
             };
         }
-        if (filter) {
-            Object.keys(byType).forEach(key => {
-                if (!key.includes(filter))
-                    delete byType[key];
-            });
+        // #2859 — this used to count source patterns, then invent skip counts
+        // as fixed percentages of that count and a fixed avgConfidence/avgAge,
+        // without ever reading or writing the destination store. An operator
+        // could believe state moved between projects when nothing changed.
+        // Perform a real merge: skip entries below the confidence threshold,
+        // skip exact duplicates, skip real conflicts (destination already has
+        // a different value for that key — never silently overwritten), and
+        // actually write whatever remains into this project's own memory store.
+        const destStore = loadMemoryStore();
+        const byType = {};
+        let lowConfidence = 0;
+        let duplicates = 0;
+        let conflicts = 0;
+        let transferredCount = 0;
+        let confidenceSum = 0;
+        let confidenceCount = 0;
+        let ageSumMs = 0;
+        let ageCount = 0;
+        const now = Date.now();
+        for (const { key, entry, type } of candidates) {
+            const confidenceRaw = entry.metadata?.confidence ?? entry.metadata?.reliability;
+            const confidence = typeof confidenceRaw === 'number' ? confidenceRaw : undefined;
+            if (confidence !== undefined && confidence < minConfidence) {
+                lowConfidence++;
+                continue;
+            }
+            const existing = destStore.entries[key];
+            if (existing) {
+                const same = JSON.stringify(existing.value) === JSON.stringify(entry.value);
+                if (same) {
+                    duplicates++;
+                    continue;
+                }
+                conflicts++;
+                continue;
+            }
+            destStore.entries[key] = entry;
+            transferredCount++;
+            byType[type] = (byType[type] ?? 0) + 1;
+            if (confidence !== undefined) {
+                confidenceSum += confidence;
+                confidenceCount++;
+            }
+            const storedAtMs = Date.parse(entry.storedAt ?? '');
+            if (!Number.isNaN(storedAtMs)) {
+                ageSumMs += now - storedAtMs;
+                ageCount++;
+            }
+        }
+        if (transferredCount > 0) {
+            const memDir = resolve(MEMORY_DIR);
+            if (!existsSync(memDir))
+                mkdirSync(memDir, { recursive: true });
+            writeFileSync(getMemoryPath(), JSON.stringify(destStore, null, 2), 'utf-8');
         }
-        const total = Object.values(byType).reduce((a, b) => a + b, 0);
         return {
             success: true,
             sourcePath,
             transferred: {
-                total,
+                total: transferredCount,
                 byType,
             },
             skipped: {
-                lowConfidence: Math.floor(total * 0.15),
-                duplicates: Math.floor(total * 0.08),
-                conflicts: Math.floor(total * 0.03),
+                lowConfidence,
+                duplicates,
+                conflicts,
             },
             stats: {
-                avgConfidence: 0.82 + (minConfidence > 0.8 ? 0.1 : 0),
-                avgAge: '3 days',
+                avgConfidence: confidenceCount > 0 ? Number((confidenceSum / confidenceCount).toFixed(3)) : null,
+                avgAgeDays: ageCount > 0 ? Number((ageSumMs / ageCount / 86_400_000).toFixed(1)) : null,
             },
             dataSource: 'source-project',
         };

package/node_modules/@claude-flow/security/dist/index.d.ts

@@ -21,6 +21,7 @@ export { InputValidator, sanitizeString, sanitizeHtml, sanitizePath, SafeStringS
 export { TokenGenerator, TokenGeneratorError, createTokenGenerator, getDefaultGenerator, quickGenerate, type TokenConfig, type Token, type SignedToken, type VerificationCode, } from './token-generator.js';
 export { ToolOutputGuardrail, createToolOutputGuardrail, isToolOutputSafe, type GuardrailConfig, type GuardrailResult, type GuardrailAction, type InjectionFinding, type InjectionSeverity, type InjectionCategory, } from './tool-output-guardrail.js';
 export { AgentAuthorizationPropagator, AuthorizationPropagationError, makeLegacyPermissiveScope, type AuthScope, type SendMessageEnvelope, type ToolCallDecision, } from './authorization/propagator.js';
+export { generateCallerIdentityKey, loadCallerIdentityKey, issueInvocationToken, verifyInvocationToken, isMcpCallerAuthEnabled, type CallerIdentityKey, type InvocationToken, type TokenVerificationResult, } from './mcp-caller-identity.js';
 export * from './policy/index.js';
 export { CLIENT_ID as OAUTH_CLIENT_ID, SCOPE as OAUTH_SCOPE, OOB_REDIRECT_URI, OAuthError, authorizeUrl, exchangeCode, refreshToken, exchangeManualCode, type TokenResponse as OAuthTokenResponse, } from './oauth/client.js';
 export { generate as generatePkce, challengeFromVerifier, type PkceRequest } from './oauth/pkce.js';

package/node_modules/@claude-flow/security/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC;AAMvC,cAAc,mBAAmB,CAAC;AAMlC,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,KAAK,IAAI,WAAW,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,IAAI,kBAAkB,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ,EAER,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,eAAe,EACf,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,EACrB,UAAU,EAEV,oBAAoB,EACpB,oBAAoB,EAEpB,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC;AAMvC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAMlC,cAAc,mBAAmB,CAAC;AAMlC,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,KAAK,IAAI,WAAW,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,IAAI,kBAAkB,GACzC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,cAAc,CAAC;IAC/B,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAiBjF;AAMD;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAoBnF;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,kBAAkB,CAAC"}

package/node_modules/@claude-flow/security/dist/index.js

@@ -43,6 +43,11 @@ export { ToolOutputGuardrail, createToolOutputGuardrail, isToolOutputSafe, } fro
 // Action-layer: SendMessage envelope + per-action scope check + MCP server
 // identity probe. Wraps the comms layer in P2; wraps the dispatcher in P3.
 export { AgentAuthorizationPropagator, AuthorizationPropagationError, makeLegacyPermissiveScope, } from './authorization/propagator.js';
+// MCP Caller-Identity Binding (ADR-377 Phase 3 — ruvnet/ruflo#2516, #2873)
+// Per-invocation Ed25519-signed capability tokens. Off by default
+// (CLAUDE_FLOW_MCP_CALLER_AUTH) pending a follow-on ADR for key
+// distribution; see mcp-caller-identity.ts's file header for scope notes.
+export { generateCallerIdentityKey, loadCallerIdentityKey, issueInvocationToken, verifyInvocationToken, isMcpCallerAuthEnabled, } from './mcp-caller-identity.js';
 // Agentic Policy Engine (ADR-324)
 // Deterministic policy evaluation, monotonic capability envelopes, approvals,
 // budgets, and tamper-evident decision receipts. Legacy mode preserves the

package/node_modules/@claude-flow/security/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,GAOjB,MAAM,4BAA4B,CAAC;AAEpC,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,GAI1B,MAAM,+BAA+B,CAAC;AAEvC,kCAAkC;AAClC,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,cAAc,mBAAmB,CAAC;AAElC,2CAA2C;AAC3C,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,KAAK,IAAI,WAAW,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,qBAAqB,EAAoB,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAuB,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,gCAAgC;AAChC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAE/B,6DAA6D;AAC7D,0EAA0E;AAC1E,0DAA0D;AAC1D,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,GAQX,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,sEAAsE;AACtE,6DAA6D;AAC7D,sEAAsE;AACtE,uEAAuE;AACvE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SAClE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+BAA+B;AAC/B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,sBAAsB,CAAC;AAE9B,oCAAoC;AACpC,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,2BAA2B,CAAC;AAEnC,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,GAIvB,MAAM,oBAAoB,CAAC;AAE5B,+BAA+B;AAC/B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,8BAA8B,GAG/B,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY;AACZ,eAAe;AACf,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,UAAU,EACV,cAAc,EACd,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,QAAQ;AACR,eAAe;AACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB;AAClB,uBAAuB;AACvB,eAAe,EACf,gBAAgB,EAChB,eAAe;AACf,yBAAyB;AACzB,qBAAqB,EACrB,UAAU;AACV,iBAAiB;AACjB,oBAAoB,EACpB,oBAAoB;AACpB,YAAY;AACZ,QAAQ,EACR,MAAM,EACN,CAAC,GACF,MAAM,sBAAsB,CAAC;AAE9B,mBAAmB;AACnB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GAKd,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,GAOjB,MAAM,4BAA4B,CAAC;AAEpC,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,yBAAyB,GAI1B,MAAM,+BAA+B,CAAC;AAEvC,2EAA2E;AAC3E,kEAAkE;AAClE,gEAAgE;AAChE,0EAA0E;AAC1E,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GAIvB,MAAM,0BAA0B,CAAC;AAElC,kCAAkC;AAClC,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,cAAc,mBAAmB,CAAC;AAElC,2CAA2C;AAC3C,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,KAAK,IAAI,WAAW,EACpB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,qBAAqB,EAAoB,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAuB,MAAM,4BAA4B,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,gCAAgC;AAChC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAE/B,6DAA6D;AAC7D,0EAA0E;AAC1E,0DAA0D;AAC1D,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,GAQX,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,sEAAsE;AACtE,6DAA6D;AAC7D,sEAAsE;AACtE,uEAAuE;AACvE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,EACP,SAAS,EACT,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwCtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA4B;IAC/D,OAAO;QACL,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,MAAM,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;SAClC,CAAC;QACF,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;QAC9C,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC;SAClE,CAAC;QACF,aAAa,EAAE,IAAI,aAAa,CAAC;YAC/B,eAAe,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,cAAc,EAAE,IAAI,cAAc,CAAC;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqC;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,iBAAiB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,gCAAgC,iBAAiB,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC"}

package/node_modules/@claude-flow/security/dist/mcp-caller-identity.d.ts

@@ -0,0 +1,90 @@
+/**
+ * McpCallerIdentity — ADR-377 Phase 3 (ruvnet/ruflo#2516, #2873).
+ *
+ * Per-invocation, Ed25519-signed capability tokens binding an MCP tool call
+ * to a specific caller. Closes the gap identified in arXiv:2603.07473
+ * (Caller Identity Confusion in MCP): authorization state today persists
+ * across callers with no re-verification, and `AgentAuthorizationPropagator`
+ * (ADR-144)'s `checkToolCall` validates a *scope* but not that the caller
+ * presenting it is who they claim to be for *this* call.
+ *
+ * Signing implementation follows the same pattern already used in this repo
+ * for Ed25519 signing (`@claude-flow/browser`'s `witness-signer.ts`): native
+ * `node:crypto`, zero new dependencies, sign+verify both supported (unlike
+ * `@claude-flow/security`'s own `plugins/integrity-verifier.ts`, which uses
+ * `@noble/ed25519` for verify-only). Reimplemented here rather than imported
+ * from `@claude-flow/browser` because a security-primitives module
+ * depending on the browser package would be a backwards layering
+ * dependency; the pattern is ~15 lines and not worth a cross-package import
+ * for that.
+ *
+ * Scope and honest limitations (per the ADR's own text)
+ * --------------------------------------------------------
+ * This module implements token issuance/verification only. It does NOT
+ * wire itself into any MCP tool dispatcher — this repo currently has at
+ * least two distinct `ToolRegistry` implementations
+ * (`v3/mcp/tool-registry.ts`, `v3/@claude-flow/mcp/src/tool-registry.ts`)
+ * plus a third under `@claude-flow/shared`, and it was not safe to guess
+ * which one is authoritative without risking silently wiring the wrong
+ * dispatch path. `AgentAuthorizationPropagator.checkToolCall` (ADR-144) is
+ * the natural composition point — call `verifyInvocationToken` first and
+ * only proceed to `checkToolCall` if it passes — but that composition is
+ * left to the caller rather than baked into `checkToolCall` itself, to
+ * avoid changing ADR-144's already-shipped, already-tested behavior.
+ *
+ * Key distribution (how callers obtain a private key to sign with in the
+ * first place) is explicitly out of scope — the ADR calls for "a follow-on
+ * ADR for key distribution" before this ships enabled by default, which is
+ * why `CLAUDE_FLOW_MCP_CALLER_AUTH` defaults to disabled.
+ */
+import type { KeyObject } from 'node:crypto';
+export interface CallerIdentityKey {
+    privateKey: KeyObject;
+    publicKey: KeyObject;
+    publicKeyHex: string;
+}
+export interface InvocationToken {
+    /** Agent/principal id of the caller this token was issued to. */
+    callerId: string;
+    /** Tool this token authorizes — a token issued for one tool cannot be
+     * replayed against another. */
+    toolName: string;
+    /** Unix ms the token was issued. */
+    issuedAt: number;
+    /** Unix ms after which the token is no longer valid. */
+    expiresAt: number;
+    /** Random per-token value; prevents replay of an otherwise-identical
+     * token issued in the same millisecond. */
+    nonce: string;
+    /** Hex-encoded Ed25519 signature over the canonicalized fields above. */
+    signature: string;
+}
+export interface TokenVerificationResult {
+    valid: boolean;
+    reason?: 'expired' | 'bad-signature' | 'tool-mismatch';
+}
+/** Generate a fresh Ed25519 keypair. */
+export declare function generateCallerIdentityKey(): CallerIdentityKey;
+/** Load a caller-identity key from a PEM-encoded private key string. */
+export declare function loadCallerIdentityKey(privateKeyPem: string): CallerIdentityKey;
+/**
+ * Issue a fresh, signed `InvocationToken` for `callerId` to call `toolName`.
+ * Callers must present a *new* token per invocation — tokens are
+ * single-tool-bound and short-lived (`ttlMs`, default 30s) by design; there
+ * is no renewal API on purpose.
+ */
+export declare function issueInvocationToken(callerId: string, toolName: string, key: CallerIdentityKey, opts?: {
+    ttlMs?: number;
+    now?: number;
+}): InvocationToken;
+/**
+ * Verify an `InvocationToken` against the issuing caller's public key and
+ * (if provided) the tool the caller is about to invoke. Never throws.
+ */
+export declare function verifyInvocationToken(token: InvocationToken, publicKey: KeyObject, opts?: {
+    toolName?: string;
+    now?: number;
+}): TokenVerificationResult;
+/** Off by default — see the file header re: key distribution being out of scope pending a follow-on ADR. Only the literal `'true'` enables enforcement. */
+export declare function isMcpCallerAuthEnabled(): boolean;
+//# sourceMappingURL=mcp-caller-identity.d.ts.map

package/node_modules/@claude-flow/security/dist/mcp-caller-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-caller-identity.d.ts","sourceRoot":"","sources":["../src/mcp-caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB;mCAC+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB;+CAC2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;CACxD;AAeD,wCAAwC;AACxC,wBAAgB,yBAAyB,IAAI,iBAAiB,CAG7D;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CAI9E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,eAAe,CAWjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,uBAAuB,CAgBzB;AAQD,2JAA2J;AAC3J,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD"}

package/node_modules/@claude-flow/security/dist/mcp-caller-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-caller-identity.js","sourceRoot":"","sources":["../src/mcp-caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA+BhH,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,iGAAiG;AACjG,SAAS,cAAc,CAAC,CAAsF;IAC5G,OAAO,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED,gFAAgF;AAChF,SAAS,mBAAmB,CAAC,SAAoB;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,yBAAyB;IACvC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,QAAgB,EAChB,GAAsB,EACtB,OAAyC,EAAE;IAE3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG;QACf,QAAQ;QACR,QAAQ;QACR,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;QAC/C,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5G,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsB,EACtB,SAAoB,EACpB,OAA4C,EAAE;IAE9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAEnC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAChJ,MAAM,CACP,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,2JAA2J;AAC3J,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC;AACjD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.40",
+  "version": "3.33.0",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/.claude/.proven-config-version

@@ -1 +0,0 @@
-sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319

package/.claude/proven-config.json

@@ -1,42 +0,0 @@
-{
-  "adoptedAt": 1785415360835,
-  "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
-  "manifest": {
-    "schema": "ruflo.proven-config/v1",
-    "policy": {
-      "ref": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
-      "value": {
-        "alpha": 0.3,
-        "subjectWeight": 1,
-        "mmrLambda": 0.5,
-        "bodyWeight": 1.5,
-        "typePenaltyFactor": 0.5
-      }
-    },
-    "layer": "framework/node-cli",
-    "compatibility": {
-      "ruflo": ">=3.24.0"
-    },
-    "benchmark": {
-      "corpus": "ADR-081-labelled-v1",
-      "corpusHash": "sha256:2f700b5c363e20a3bd88ce2bc9b87bbbbaa61732c6177894c6ec37890f888982"
-    },
-    "receipt": {
-      "heldOutDelta": 0.07381404928570845,
-      "redblue": "PASS",
-      "drift": 0,
-      "canary": {
-        "rollbackRate": 0,
-        "latencyP95": 244.612458000076,
-        "costPerTask": 0
-      },
-      "receiptCoverage": 1
-    },
-    "platform": [
-      "linux",
-      "macOS",
-      "windows"
-    ]
-  },
-  "previous": ""
-}