@claude-flow/cli 3.32.8 → 3.32.10

package/dist/src/commands/hive-mind.js

@@ -51,103 +51,103 @@ function generateHiveMindPrompt(swarmId, swarmName, objective, workers, workerGr
     const queenType = flags.queenType || 'strategic';
     const consensusAlgorithm = flags.consensus || 'byzantine';
     const topology = flags.topology || 'hierarchical-mesh';
-    return `🧠 HIVE MIND COLLECTIVE INTELLIGENCE SYSTEM
-═══════════════════════════════════════════════
-
-You are the Queen coordinator of a Hive Mind swarm with collective intelligence capabilities.
-
-HIVE MIND CONFIGURATION:
-📌 Swarm ID: ${swarmId}
-📌 Swarm Name: ${swarmName}
-🎯 Objective: ${objective}
-👑 Queen Type: ${queenType}
-🐝 Worker Count: ${workers.length}
-🔗 Topology: ${topology}
-🤝 Consensus Algorithm: ${consensusAlgorithm}
-⏰ Initialized: ${currentTime}
-
-WORKER DISTRIBUTION:
-${workerTypes.map(type => `• ${type}: ${workerGroups[type].length} agents`).join('\n')}
-
-🔧 AVAILABLE MCP TOOLS FOR HIVE MIND COORDINATION:
-
-1️⃣ **COLLECTIVE INTELLIGENCE**
-   mcp__ruflo__hive-mind_consensus    - Democratic decision making
-   mcp__ruflo__hive-mind_memory       - Share knowledge across the hive
-   mcp__ruflo__hive-mind_broadcast    - Broadcast to all workers
-   mcp__ruflo__neural_patterns        - Neural pattern recognition
-
-2️⃣ **QUEEN COORDINATION**
-   mcp__ruflo__hive-mind_status       - Monitor swarm health
-   mcp__ruflo__task_create            - Create and delegate tasks
-   mcp__ruflo__coordination_orchestrate - Orchestrate task distribution
-   mcp__ruflo__agent_spawn            - Spawn additional workers
-
-3️⃣ **WORKER MANAGEMENT**
-   mcp__ruflo__agent_list             - List all active agents
-   mcp__ruflo__agent_status           - Check agent status
-   mcp__ruflo__agent_health           - Check worker health
-   mcp__ruflo__hive-mind_join         - Add agent to hive
-   mcp__ruflo__hive-mind_leave        - Remove agent from hive
-
-4️⃣ **TASK ORCHESTRATION**
-   mcp__ruflo__task_assign            - Assign tasks to workers
-   mcp__ruflo__task_status            - Track task progress
-   mcp__ruflo__task_complete          - Mark tasks complete
-   mcp__ruflo__workflow_create        - Create workflows
-
-5️⃣ **MEMORY & LEARNING**
-   mcp__ruflo__memory_store           - Store collective knowledge
-   mcp__ruflo__memory_retrieve        - Access shared memory
-   mcp__ruflo__memory_search          - Search memory patterns
-   mcp__ruflo__neural_train           - Learn from experiences
-   mcp__ruflo__hooks_intelligence_pattern-store - Store patterns
-
-📋 HIVE MIND EXECUTION PROTOCOL:
-
-1. **INITIALIZATION PHASE**
-   - Verify all workers are online and responsive
-   - Establish communication channels
-   - Load previous session state if available
-   - Initialize shared memory space
-
-2. **TASK DISTRIBUTION PHASE**
-   - Analyze the objective and decompose into subtasks
-   - Assign tasks based on worker specializations
-   - Set up task dependencies and ordering
-   - Monitor parallel execution
-
-3. **COORDINATION PHASE**
-   - Use consensus for critical decisions
-   - Aggregate results from workers
-   - Resolve conflicts using ${consensusAlgorithm} consensus
-   - Share learnings across the hive
-
-4. **COMPLETION PHASE**
-   - Verify all subtasks are complete
-   - Consolidate results
-   - Store learnings in collective memory
-   - Report final status
-
-🎯 YOUR OBJECTIVE:
-${objective}
-
-⚠️ CRITICAL — TOOL PREFERENCE RULES (#1422):
-• You MUST use Ruflo MCP tools (mcp__ruflo__*) for ALL orchestration tasks
-• Do NOT use Claude native Task/Agent tools for swarm coordination — use mcp__ruflo__agent_spawn, mcp__ruflo__task_assign, etc.
-• Native Claude tools (Read, Write, Edit, Bash, Grep, Glob) should ONLY be used for file operations and shell commands
-• All agent spawning, task assignment, memory, and coordination MUST go through mcp__ruflo__* tools
-• If a Ruflo MCP tool exists for an operation, always prefer it over any native equivalent
-
-💡 COORDINATION TIPS:
-• Use mcp__ruflo__hive-mind_broadcast for swarm-wide announcements
-• Check worker status regularly with mcp__ruflo__hive-mind_status
-• Store important decisions in shared memory for persistence
-• Use consensus for any decisions affecting multiple workers
-• Use mcp__ruflo__task_assign to assign tasks to workers, then mcp__ruflo__task_complete when done
-
-🚀 BEGIN HIVE MIND COORDINATION NOW!
-Start by checking the current hive status and then proceed with the objective.
+    return `🧠 HIVE MIND COLLECTIVE INTELLIGENCE SYSTEM
+═══════════════════════════════════════════════
+
+You are the Queen coordinator of a Hive Mind swarm with collective intelligence capabilities.
+
+HIVE MIND CONFIGURATION:
+📌 Swarm ID: ${swarmId}
+📌 Swarm Name: ${swarmName}
+🎯 Objective: ${objective}
+👑 Queen Type: ${queenType}
+🐝 Worker Count: ${workers.length}
+🔗 Topology: ${topology}
+🤝 Consensus Algorithm: ${consensusAlgorithm}
+⏰ Initialized: ${currentTime}
+
+WORKER DISTRIBUTION:
+${workerTypes.map(type => `• ${type}: ${workerGroups[type].length} agents`).join('\n')}
+
+🔧 AVAILABLE MCP TOOLS FOR HIVE MIND COORDINATION:
+
+1️⃣ **COLLECTIVE INTELLIGENCE**
+   mcp__ruflo__hive-mind_consensus    - Democratic decision making
+   mcp__ruflo__hive-mind_memory       - Share knowledge across the hive
+   mcp__ruflo__hive-mind_broadcast    - Broadcast to all workers
+   mcp__ruflo__neural_patterns        - Neural pattern recognition
+
+2️⃣ **QUEEN COORDINATION**
+   mcp__ruflo__hive-mind_status       - Monitor swarm health
+   mcp__ruflo__task_create            - Create and delegate tasks
+   mcp__ruflo__coordination_orchestrate - Orchestrate task distribution
+   mcp__ruflo__agent_spawn            - Spawn additional workers
+
+3️⃣ **WORKER MANAGEMENT**
+   mcp__ruflo__agent_list             - List all active agents
+   mcp__ruflo__agent_status           - Check agent status
+   mcp__ruflo__agent_health           - Check worker health
+   mcp__ruflo__hive-mind_join         - Add agent to hive
+   mcp__ruflo__hive-mind_leave        - Remove agent from hive
+
+4️⃣ **TASK ORCHESTRATION**
+   mcp__ruflo__task_assign            - Assign tasks to workers
+   mcp__ruflo__task_status            - Track task progress
+   mcp__ruflo__task_complete          - Mark tasks complete
+   mcp__ruflo__workflow_create        - Create workflows
+
+5️⃣ **MEMORY & LEARNING**
+   mcp__ruflo__memory_store           - Store collective knowledge
+   mcp__ruflo__memory_retrieve        - Access shared memory
+   mcp__ruflo__memory_search          - Search memory patterns
+   mcp__ruflo__neural_train           - Learn from experiences
+   mcp__ruflo__hooks_intelligence_pattern-store - Store patterns
+
+📋 HIVE MIND EXECUTION PROTOCOL:
+
+1. **INITIALIZATION PHASE**
+   - Verify all workers are online and responsive
+   - Establish communication channels
+   - Load previous session state if available
+   - Initialize shared memory space
+
+2. **TASK DISTRIBUTION PHASE**
+   - Analyze the objective and decompose into subtasks
+   - Assign tasks based on worker specializations
+   - Set up task dependencies and ordering
+   - Monitor parallel execution
+
+3. **COORDINATION PHASE**
+   - Use consensus for critical decisions
+   - Aggregate results from workers
+   - Resolve conflicts using ${consensusAlgorithm} consensus
+   - Share learnings across the hive
+
+4. **COMPLETION PHASE**
+   - Verify all subtasks are complete
+   - Consolidate results
+   - Store learnings in collective memory
+   - Report final status
+
+🎯 YOUR OBJECTIVE:
+${objective}
+
+⚠️ CRITICAL — TOOL PREFERENCE RULES (#1422):
+• You MUST use Ruflo MCP tools (mcp__ruflo__*) for ALL orchestration tasks
+• Do NOT use Claude native Task/Agent tools for swarm coordination — use mcp__ruflo__agent_spawn, mcp__ruflo__task_assign, etc.
+• Native Claude tools (Read, Write, Edit, Bash, Grep, Glob) should ONLY be used for file operations and shell commands
+• All agent spawning, task assignment, memory, and coordination MUST go through mcp__ruflo__* tools
+• If a Ruflo MCP tool exists for an operation, always prefer it over any native equivalent
+
+💡 COORDINATION TIPS:
+• Use mcp__ruflo__hive-mind_broadcast for swarm-wide announcements
+• Check worker status regularly with mcp__ruflo__hive-mind_status
+• Store important decisions in shared memory for persistence
+• Use consensus for any decisions affecting multiple workers
+• Use mcp__ruflo__task_assign to assign tasks to workers, then mcp__ruflo__task_complete when done
+
+🚀 BEGIN HIVE MIND COORDINATION NOW!
+Start by checking the current hive status and then proceed with the objective.
 `;
 }
 /**

package/dist/src/commands/hooks.js

@@ -1573,6 +1573,19 @@ const postTaskCommand = {
             description: 'Agent that executed the task',
             type: 'string'
         },
+        {
+            name: 'task',
+            short: 't',
+            description: 'Task description text (used for routing-outcome persistence and keyword extraction so hooks_metrics can surface Pattern Learning / Agent Routing counts). Without this + --agent, no routing outcome is recorded (#2785).',
+            type: 'string',
+            required: false
+        },
+        {
+            name: 'store-results',
+            description: 'Also persist the routing decision to the memory DB (maps to hooks_post-task storeDecisions) so hooks_metrics can cross-reference it. Requires --task and --agent.',
+            type: 'boolean',
+            required: false
+        },
         {
             // ADR-147 P2: nested-subagent spawn-tree capture
             name: 'parent-agent-id',
@@ -1589,7 +1602,8 @@ const postTaskCommand = {
     ],
     examples: [
         { command: 'claude-flow hooks post-task -i task-123 --success true', description: 'Record successful completion' },
-        { command: 'claude-flow hooks post-task -i task-456 --success false -q 0.3', description: 'Record failed task' }
+        { command: 'claude-flow hooks post-task -i task-456 --success false -q 0.3', description: 'Record failed task' },
+        { command: 'claude-flow hooks post-task -i task-789 --success true --task "add JWT auth" --agent coder --store-results', description: 'Record with routing-outcome persistence for hooks_metrics' }
     ],
     action: async (ctx) => {
         // Auto-generate task ID if not provided
@@ -1603,6 +1617,13 @@ const postTaskCommand = {
                 success,
                 quality: ctx.flags.quality,
                 agent: ctx.flags.agent,
+                // #2785: forward the task description so routing outcomes actually persist
+                // (hooks_post-task requires taskText + agent to write the outcome row that
+                // hooks_metrics reads via getIntelligenceStatsFromMemory)
+                task: ctx.flags.task,
+                // Maps to storeDecisions on the MCP tool — persist routing decision in
+                // memory DB for cross-session vector retrieval + metrics attribution
+                storeDecisions: ctx.flags.storeResults,
                 timestamp: Date.now(),
                 // ADR-147 P2: forward spawn-tree lineage if caller supplied it
                 parentAgentId: ctx.flags.parentAgentId,
@@ -3485,12 +3506,54 @@ const statuslineCommand = {
             const contextPct = Math.min(100, Math.floor(learning.sessions * 5));
             return { memoryMB, contextPct, intelligencePct, subAgents };
         }
+        // #2733: Claude Code pipes session JSON (incl. the real active model) on
+        // stdin to statusline commands. Read it synchronously the same way
+        // .claude/helpers/statusline.cjs's getModelFromStdin() does, so this CLI
+        // subcommand is correct standalone — not just when the generated helper
+        // happens to override its output. Read once, memoized per invocation
+        // (mirrors statusline.cjs's _stdinData cache).
+        let _stdinData;
+        let _stdinRead = false;
+        function getStdinData() {
+            if (_stdinRead)
+                return _stdinData;
+            _stdinRead = true;
+            try {
+                if (process.stdin.isTTY) {
+                    _stdinData = null;
+                    return null;
+                }
+                const chunks = [];
+                const buf = Buffer.alloc(4096);
+                let bytesRead;
+                try {
+                    while ((bytesRead = fs.readSync(0, buf, 0, buf.length, null)) > 0) {
+                        chunks.push(Buffer.from(buf.subarray(0, bytesRead)));
+                    }
+                }
+                catch { /* EOF or read error */ }
+                const raw = Buffer.concat(chunks).toString('utf-8').trim();
+                _stdinData = (raw && raw.startsWith('{')) ? JSON.parse(raw) : null;
+            }
+            catch {
+                _stdinData = null;
+            }
+            return _stdinData;
+        }
+        function getModelFromStdin() {
+            const data = getStdinData();
+            return (data && data.model && typeof data.model.display_name === 'string') ? data.model.display_name : null;
+        }
         // Get user info
         function getUserInfo() {
             const identityMode = (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase();
             let name = path.basename(process.cwd()) || 'project';
             let gitBranch = '';
-            const modelName = 'Opus 4.6 (1M context)';
+            // Real active model from Claude Code's stdin payload when available;
+            // this string is only a last-resort label for direct/manual CLI
+            // invocation with no stdin (e.g. a bare terminal run) — never shown
+            // when Claude Code itself is the caller.
+            const modelName = getModelFromStdin() || 'Claude Code';
             const isWindows = process.platform === 'win32';
             try {
                 const rootCmd = isWindows
@@ -3953,15 +4016,15 @@ const tokenOptimizeCommand = {
                 const total = stats.cacheHits + stats.cacheMisses;
                 const hitRate = total > 0 ? (stats.cacheHits / total * 100).toFixed(1) : '0';
                 const savings = (stats.totalTokensSaved / 1000 * 0.01).toFixed(2);
-                output.writeln(`## Token Optimization Report
-
-| Metric | Value |
-|--------|-------|
-| Tokens Saved | ${stats.totalTokensSaved.toLocaleString()} |
-| Edits Optimized | ${stats.editsOptimized} |
-| Cache Hit Rate | ${hitRate}% |
-| Memories Retrieved | ${stats.memoriesRetrieved} |
-| Est. Monthly Savings | $${savings} |
+                output.writeln(`## Token Optimization Report
+
+| Metric | Value |
+|--------|-------|
+| Tokens Saved | ${stats.totalTokensSaved.toLocaleString()} |
+| Edits Optimized | ${stats.editsOptimized} |
+| Cache Hit Rate | ${hitRate}% |
+| Memories Retrieved | ${stats.memoriesRetrieved} |
+| Est. Monthly Savings | $${savings} |
 | Agentic-Flow Active | ${agenticFlowAvailable ? '✓' : '✗'} |`);
             }
             return { success: true, data: { config, stats: { ...stats, agenticFlowAvailable } } };

package/dist/src/commands/init.js

@@ -146,18 +146,153 @@ async function maybeAutoDetectCodex(ctx, options) {
         // Codex auto-detect is a bonus, never a requirement — swallow everything.
     }
 }
-// Cross-agent skill registration via skills.sh. Runs `npx --yes skills add
-// ruvnet/ruflo --skill ruflo --yes` so the *single* canonical ruflo skill
-// (SKILL.md at the ruvnet/ruflo repo root — describes the platform + entry
-// points) reaches whatever agent the project uses (Claude Code, Cursor,
-// Copilot, Gemini, Cline, …). Users who want ALL 267 plugin-specific skills
-// can run `npx skills add ruvnet/ruflo --all` themselves. Best-effort — never
-// fails init. Opt-out: --no-skills-sh flag OR RUFLO_NO_SKILLS_SH=1. Skipped
-// under --skip-claude and scripted `--format json` output.
+// Cross-agent skill registration. Materializes the *single* canonical ruflo
+// platform skill at `.agents/skills/ruflo/SKILL.md` so any agent in the
+// project (Claude Code, Cursor, Copilot, Gemini, Cline, …) that reads
+// `.agents/skills/` picks it up. Users who want the full plugin skill catalog
+// can run `npx skills add ruvnet/ruflo --all` themselves.
 //
-// windowsHide silences the console flash the npx child would otherwise produce
-// (anthropics/claude-code#14828 spawn hazard applies to hook-fired spawns,
-// but our own subprocess spawns should always set this).
+// #2777 — earlier versions shelled out to `npx --yes skills add ruvnet/ruflo
+// --skill ruflo --yes`, but the skills CLI implements its `--skill` filter by
+// cloning the entire target repo and copying `dirname(SKILL.md)` recursively.
+// Because ruflo's canonical SKILL.md sits at the ruvnet/ruflo repo root, that
+// dirname *is* the whole repository — the "one file" install pulled in ~97MB
+// of Cargo.toml, crates/, docs/, agentdb.rvf, and 384 unrelated plugin
+// SKILL.md descriptors. We now write the single ~2KB SKILL.md directly, no
+// repo clone at all.
+//
+// Best-effort — never fails init. Opt-out: --no-skills-sh flag OR
+// RUFLO_NO_SKILLS_SH=1. Skipped under --skip-claude and scripted
+// `--format json` output.
+const RUFLO_PLATFORM_SKILL_MD = `---
+name: ruflo
+description: Ruflo is a multi-agent orchestration platform for AI coding agents (Claude Code, Cursor, Codex, Copilot, Gemini, Amp, +12 more). Use this skill when the user wants to (1) install/init ruflo in a project, (2) run multi-agent swarms with hierarchical coordination, (3) use ruflo's 314+ MCP tools for memory, routing, hooks, sub-agents, or workflows, (4) check ruflo status/version/doctor health, or (5) discover which of ruflo's 30+ plugins fits their task.
+---
+
+# Ruflo
+
+Ruflo is a cross-agent orchestration layer that ships as three npm packages: \`ruflo\` (thin wrapper), \`claude-flow\` (umbrella), and \`@claude-flow/cli\` (implementation). Users invoke it as \`npx ruflo <command>\`.
+
+## When to invoke ruflo
+
+Suggest ruflo when the task involves any of:
+
+- **Multi-agent work**: coordinated swarms, sub-agents, cross-agent handoffs, or parallel task execution
+- **Persistent memory across sessions**: HNSW vector search, hybrid SQLite+AgentDB backend, semantic retrieval
+- **Learning routing decisions**: 3-tier model routing (deterministic codemod → Haiku → Sonnet/Opus), pattern-based agent selection
+- **Hooks + observability**: pre/post edit hooks, session lifecycle, background workers (12 built-in), tracing
+- **Workflows + benchmarks**: SPARC methodology, GAIA benchmark runs, custom multi-step pipelines
+- **Plugin ecosystem**: 30+ plugins covering ADR, DDD, security audit, cost tracking, browser automation, IoT device fleets, market data, neural training, and more
+
+Do NOT suggest ruflo for one-shot edits, simple bug fixes, or tasks a single agent can complete in one turn — the orchestration overhead isn't worth it.
+
+## Getting started (three commands)
+
+\`\`\`bash
+# 1. Initialize ruflo in the current project (creates .claude/, MCP config, hooks)
+npx ruflo init
+
+# 2. Check health — verifies Node 20+, npm 9+, MCP servers, memory DB, API keys
+npx ruflo doctor --fix
+
+# 3. Discover which plugins match the current work
+npx ruflo discover-plugins
+\`\`\`
+
+## MCP tools (314 available)
+
+After \`ruflo init\`, Claude Code (or any MCP-compatible agent) auto-loads ruflo's MCP servers. Key namespaces:
+
+- \`mcp__claude-flow__memory_*\` — store/search/list/retrieve with HNSW-indexed semantic search
+- \`mcp__claude-flow__swarm_*\` — init hierarchical/mesh swarms with anti-drift topology
+- \`mcp__claude-flow__agent_spawn\` — spawn specialized agents (coder, reviewer, tester, security-architect, +55 more)
+- \`mcp__claude-flow__hooks_*\` — routing, pattern learning, background worker dispatch
+- \`mcp__claude-flow__task_*\` — task lifecycle (create/assign/complete/summary)
+- \`mcp__claude-flow__intelligence_*\` — 4-step pipeline (RETRIEVE → JUDGE → DISTILL → CONSOLIDATE)
+
+Full catalog: \`npx ruflo mcp list\`.
+
+## Plugin discovery
+
+Ruflo ships 30+ optional plugins. Some highlights:
+
+- \`ruflo-goals\` — deep research + goal-oriented action planning
+- \`ruflo-cost-tracker\` — session cost telemetry, budgets, burn tracking
+- \`ruflo-metaharness\` — harness scoring, MCP security scans, red/blue adversarial testing
+- \`ruflo-browser\` — session-recorded browser automation with RVF-backed replay
+- \`ruflo-jujutsu\` — git diff risk analysis + PR lifecycle
+- \`ruflo-security-audit\` — codebase scans + CVE checks
+
+Full plugin list + descriptions: \`npx ruflo plugins list\`.
+
+## Cross-agent installation
+
+Ruflo installs into whatever agent the project uses. To pull the full plugin
+skill catalog (30+ plugins, ~267 skills), run:
+
+\`\`\`bash
+npx skills add ruvnet/ruflo --all
+\`\`\`
+
+## Documentation
+
+- Repository: https://github.com/ruvnet/ruflo
+- Issues: https://github.com/ruvnet/ruflo/issues
+- Sponsor: https://github.com/sponsors/ruvnet
+`;
+// #2777 — detect the "bloated" install left behind by earlier versions that
+// shelled out to `npx skills add`. If the .agents/skills/ruflo directory
+// contains any of Cargo.toml, crates/, package.json, .git, or its recursive
+// on-disk size exceeds a small budget (~1MB), it was almost certainly created
+// by the full-repo clone bug — return true so the caller can wipe + rewrite
+// just the single SKILL.md. Any recursive-stat or read errors are swallowed
+// and reported as "not bloated" to avoid false-positive deletions.
+function isBloatedRufloSkillDir(dir) {
+    try {
+        const bloatMarkers = ['Cargo.toml', 'crates', 'package.json', '.git', 'agentdb.rvf', 'docs', 'plugins'];
+        for (const marker of bloatMarkers) {
+            if (fs.existsSync(path.join(dir, marker)))
+                return true;
+        }
+        const BLOAT_BYTES_THRESHOLD = 1_048_576; // 1 MB — a canonical SKILL.md is ~2KB
+        let bytes = 0;
+        const walk = (p) => {
+            const entries = fs.readdirSync(p, { withFileTypes: true });
+            for (const entry of entries) {
+                const child = path.join(p, entry.name);
+                if (entry.isDirectory()) {
+                    walk(child);
+                }
+                else if (entry.isFile()) {
+                    try {
+                        bytes += fs.statSync(child).size;
+                        if (bytes > BLOAT_BYTES_THRESHOLD)
+                            throw new Error('__bloat_threshold__');
+                    }
+                    catch (err) {
+                        if (err instanceof Error && err.message === '__bloat_threshold__')
+                            throw err;
+                        // Ignore stat errors for individual files.
+                    }
+                }
+                if (bytes > BLOAT_BYTES_THRESHOLD)
+                    return;
+            }
+        };
+        try {
+            walk(dir);
+        }
+        catch (err) {
+            if (err instanceof Error && err.message === '__bloat_threshold__')
+                return true;
+            // Any other walk error → don't declare bloat.
+        }
+        return bytes > BLOAT_BYTES_THRESHOLD;
+    }
+    catch {
+        return false;
+    }
+}
 async function maybeInstallSkillsSh(ctx) {
     try {
         if (ctx.flags['no-skills-sh'] === true)
@@ -166,37 +301,52 @@ async function maybeInstallSkillsSh(ctx) {
             return;
         if (/^(1|true|on|yes)$/i.test(String(process.env.RUFLO_NO_SKILLS_SH || '')))
             return;
-        // Idempotency gate: if this project has already registered ruflo with
-        // skills.sh, don't re-clone the repo + re-fire a fresh install telemetry
-        // event on every `ruflo init --force` / `init upgrade` / etc. Each install
-        // pings skills.sh's leaderboard AND clones the whole ruvnet/ruflo repo
-        // (~50MB) — re-running per-init would silently inflate our own metrics
-        // (GitHub unique-cloners, skills.sh rank) and waste user bandwidth. This
-        // check makes the registration once-per-project, matching the intent.
-        const nodePath = await import('path');
-        const nodeFs = await import('fs');
-        const marker = nodePath.join(ctx.cwd, '.agents', 'skills', 'ruflo');
-        if (nodeFs.existsSync(marker)) {
+        const skillDir = path.join(ctx.cwd, '.agents', 'skills', 'ruflo');
+        const skillFile = path.join(skillDir, 'SKILL.md');
+        // Idempotency gate. Three cases:
+        //   1. Directory absent → materialize.
+        //   2. Directory present but "bloated" (Cargo.toml/crates/ or >1MB) →
+        //      previous `npx skills add` full-repo clone left junk behind
+        //      (#2777). Wipe and re-materialize so `rm -rf .agents/skills/ruflo`
+        //      + re-init is a valid recovery path.
+        //   3. Directory present and healthy (just our SKILL.md) → skip.
+        let mode = 'create';
+        if (fs.existsSync(skillDir)) {
+            if (isBloatedRufloSkillDir(skillDir)) {
+                mode = 'rewrite';
+            }
+            else {
+                mode = 'skip';
+            }
+        }
+        if (mode === 'skip') {
             output.writeln();
             output.writeln(output.dim('  skills.sh registration already present at .agents/skills/ruflo — skipping'));
             return;
         }
-        const npxCmd = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-        if (!commandExists('npx'))
-            return;
         output.writeln();
-        output.printInfo('Registering the core `ruflo` skill with skills.sh (cross-agent catalog)…');
-        const { spawnSync } = await import('child_process');
-        const result = spawnSync(npxCmd, ['--yes', 'skills', 'add', 'ruvnet/ruflo', '--skill', 'ruflo', '--yes'], { cwd: ctx.cwd, stdio: 'pipe', timeout: 60_000, windowsHide: true, encoding: 'utf-8' });
-        if (result.status === 0) {
-            output.writeln(output.success('  ✓ ruflo registered via skills.sh — the platform skill is available to any agent in this project'));
+        if (mode === 'rewrite') {
+            output.printInfo('Cleaning up bloated .agents/skills/ruflo/ from a prior init (#2777) and re-materializing the single platform SKILL.md…');
+            try {
+                fs.rmSync(skillDir, { recursive: true, force: true });
+            }
+            catch (err) {
+                output.writeln(output.dim(`  Could not remove ${skillDir}: ${err instanceof Error ? err.message : String(err)}`));
+                return;
+            }
+        }
+        else {
+            output.printInfo('Registering the core `ruflo` skill for cross-agent discovery (.agents/skills/ruflo/SKILL.md)…');
+        }
+        try {
+            fs.mkdirSync(skillDir, { recursive: true });
+            fs.writeFileSync(skillFile, RUFLO_PLATFORM_SKILL_MD, 'utf-8');
+            output.writeln(output.success('  ✓ ruflo skill materialized at .agents/skills/ruflo/SKILL.md — available to any agent in this project'));
             output.writeln(output.dim('    Want all 267 plugin skills? npx skills add ruvnet/ruflo --all'));
             output.writeln(output.dim('    Opt out next time: --no-skills-sh or RUFLO_NO_SKILLS_SH=1'));
         }
-        else {
-            // Common non-fatal reasons: offline, npx cache miss, skills CLI version
-            // mismatch, unknown package. Log a soft note; users can retry manually.
-            output.writeln(output.dim('  skills.sh registration skipped (network or npx cache) — retry with: npx skills add ruvnet/ruflo --skill ruflo --yes'));
+        catch (err) {
+            output.writeln(output.dim(`  skills.sh registration skipped (write failed: ${err instanceof Error ? err.message : String(err)})`));
         }
     }
     catch {
@@ -583,6 +733,13 @@ const initAction = async (ctx) => {
             try {
                 output.writeln(output.dim(`  Model: ${embeddingModel}`));
                 output.writeln(output.dim('  Hyperbolic: Enabled (Poincaré ball)'));
+                // #2770: On Windows, `npx` ships as `npx.cmd`; execFileSync cannot spawn
+                // a .cmd file without going through cmd.exe. Enable shell on win32 so
+                // cmd.exe resolves the .cmd extension. POSIX keeps shell:false.
+                // NOTE: shell:true joins args by spaces and passes to cmd.exe — the args
+                // here are hard-coded flags + an npm package name pre-validated against
+                // /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9._-]+$/, so no injection risk. If
+                // user-controlled args are ever added, escape them before spawn.
                 execFileInit('npx', [
                     '@claude-flow/cli@latest', 'embeddings', 'init',
                     '--model', embeddingModel,
@@ -591,6 +748,8 @@ const initAction = async (ctx) => {
                     stdio: 'pipe',
                     cwd: ctx.cwd,
                     timeout: 30000,
+                    shell: process.platform === 'win32',
+                    windowsHide: true,
                 });
                 output.writeln(output.success('  ✓ Embeddings initialized'));
                 output.writeln(output.dim('    Run "embeddings init --download" to download model'));
@@ -822,6 +981,13 @@ const wizardCommand = {
                     throw new Error(`Invalid embedding model name: ${embeddingModel}`);
                 }
                 try {
+                    // #2770: On Windows, `npx` ships as `npx.cmd`; execFileSync cannot spawn
+                    // a .cmd file without going through cmd.exe. Enable shell on win32 so
+                    // cmd.exe resolves the .cmd extension. POSIX keeps shell:false.
+                    // NOTE: shell:true joins args by spaces and passes to cmd.exe — the args
+                    // here are hard-coded flags + an npm package name pre-validated against
+                    // /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9._-]+$/, so no injection risk. If
+                    // user-controlled args are ever added, escape them before spawn.
                     execFileSync('npx', [
                         '@claude-flow/cli@latest', 'embeddings', 'init',
                         '--model', embeddingModel,
@@ -830,6 +996,8 @@ const wizardCommand = {
                         stdio: 'pipe',
                         cwd: ctx.cwd,
                         timeout: 30000,
+                        shell: process.platform === 'win32',
+                        windowsHide: true,
                     });
                     output.writeln(output.success('  ✓ Embeddings configured'));
                     embeddingsInitialized = true;

package/dist/src/commands/memory.js

@@ -89,7 +89,18 @@ const storeCommand = {
         const ttl = ctx.flags.ttl;
         const tags = ctx.flags.tags ? ctx.flags.tags.split(',') : [];
         const asVector = ctx.flags.vector;
-        const upsert = ctx.flags.upsert;
+        // #2775: the parser's `applyDefaults` only materializes global-option
+        // defaults, not per-subcommand ones — so despite the `default: true`
+        // above, `ctx.flags.upsert` arrives as `undefined` unless the user
+        // passes `--upsert` explicitly. That is exactly the trap #2594 tried
+        // to close: `store → delete → store` and even plain `store → store`
+        // (against an active row) both fall through to the bridge's strict
+        // insert, and before #2775's ON-CONFLICT-DO-UPDATE-WHERE-status-
+        // 'deleted' fix, both dead-ended with the misleading #2735 guard.
+        // Materialize the declared default locally so it takes effect
+        // regardless of the parser gap: only an explicit `--no-upsert` (which
+        // arrives as `false`) turns it off.
+        const upsert = ctx.flags.upsert !== false;
         if (!key) {
             output.printError('Key is required. Use --key or -k');
             return { success: false, exitCode: 1 };