@claude-flow/cli 3.32.8 → 3.32.10

package/dist/src/memory/rabitq-index.js

@@ -81,11 +81,11 @@ export async function buildRabitqIndex(options) {
             const SQL = await initSqlJs();
             const fileBuffer = fs.readFileSync(dbPath);
             const db = new SQL.Database(fileBuffer);
-            const result = db.exec(`
-        SELECT id, key, namespace, embedding
-        FROM memory_entries
-        WHERE status = 'active' AND embedding IS NOT NULL
-        LIMIT 50000
+            const result = db.exec(`
+        SELECT id, key, namespace, embedding
+        FROM memory_entries
+        WHERE status = 'active' AND embedding IS NOT NULL
+        LIMIT 50000
       `);
             if (result[0]?.values) {
                 for (const row of result[0].values) {

package/dist/src/parser.js

@@ -223,8 +223,12 @@ export class CommandParser {
             }
             i++;
         }
-        // Apply defaults
-        this.applyDefaults(result.flags);
+        // Apply defaults (globals + resolved command/subcommand — #2775 follow-up).
+        // Previously only globals were walked, so any subcommand-declared
+        // `default: true` silently dropped and reached the action handler as
+        // `undefined`. That trapped `memory store --upsert` and every other
+        // subcommand that leaned on a per-flag default.
+        this.applyDefaults(result.flags, resolvedCmd, resolvedSub);
         return result;
     }
     parseFlag(args, index, aliases, booleanFlags) {
@@ -450,15 +454,27 @@ export class CommandParser {
         }
         return flags;
     }
-    applyDefaults(flags) {
-        // Apply global option defaults
-        for (const opt of this.globalOptions) {
-            const key = this.normalizeKey(opt.name);
-            if (flags[key] === undefined && opt.default !== undefined) {
-                flags[key] = opt.default;
+    applyDefaults(flags, command, subcommand) {
+        // #2775: apply defaults from globals AND the resolved command/subcommand.
+        // Subcommand > command > global (later writes lose to earlier — because
+        // we only set when `undefined`, so the FIRST option definition that
+        // supplies a default wins; walk narrow-to-broad so subcommand options
+        // apply before broader ones do).
+        const layers = [];
+        if (subcommand?.options)
+            layers.push(subcommand.options);
+        if (command?.options)
+            layers.push(command.options);
+        layers.push(this.globalOptions);
+        for (const layer of layers) {
+            for (const opt of layer) {
+                const key = this.normalizeKey(opt.name);
+                if (flags[key] === undefined && opt.default !== undefined) {
+                    flags[key] = opt.default;
+                }
             }
         }
-        // Apply custom defaults
+        // Apply custom defaults (lowest precedence)
         if (this.options.defaults) {
             for (const [key, value] of Object.entries(this.options.defaults)) {
                 const normalizedKey = this.normalizeKey(key);

package/dist/src/proxy/verify.js

@@ -15,8 +15,8 @@ import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto
  * live 2026-07-16 by verifying a real `SHA256SUMS.sig` from the v0.1.0
  * release against it (crypto.verify -> true).
  */
-export const PROXY_RELEASE_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=
+export const PROXY_RELEASE_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=
 -----END PUBLIC KEY-----`;
 export class ReleaseVerificationError extends Error {
     constructor(message) {

package/dist/src/runtime/headless.js

@@ -62,34 +62,34 @@ function parseArgs() {
  * Show help message
  */
 function showHelp() {
-    console.log(`
-Headless Runtime for RuFlo V3
-
-Usage:
-  headless --worker <type>    Run a specific worker
-  headless --daemon           Start background daemon
-  headless --benchmark        Run performance benchmarks
-  headless --status           Show system status
-
-Workers: ${HEADLESS_WORKER_TYPES.join(', ')}
-
-Options:
-  -w, --worker <type>   Worker type to run
-  -d, --daemon          Run as daemon
-  -b, --benchmark       Run benchmarks
-  -s, --status          Show status
-  -t, --timeout <ms>    Execution timeout (default: 60000)
-  -v, --verbose         Verbose output
-  -h, --help            Show help
-
-Environment:
-  CLAUDE_FLOW_HEADLESS=true   Enable headless mode
-  CLAUDE_CODE_HEADLESS=true   Enable Claude Code headless
-
-Examples:
-  headless --worker audit --timeout 120000
-  headless --daemon
-  headless --benchmark
+    console.log(`
+Headless Runtime for RuFlo V3
+
+Usage:
+  headless --worker <type>    Run a specific worker
+  headless --daemon           Start background daemon
+  headless --benchmark        Run performance benchmarks
+  headless --status           Show system status
+
+Workers: ${HEADLESS_WORKER_TYPES.join(', ')}
+
+Options:
+  -w, --worker <type>   Worker type to run
+  -d, --daemon          Run as daemon
+  -b, --benchmark       Run benchmarks
+  -s, --status          Show status
+  -t, --timeout <ms>    Execution timeout (default: 60000)
+  -v, --verbose         Verbose output
+  -h, --help            Show help
+
+Environment:
+  CLAUDE_FLOW_HEADLESS=true   Enable headless mode
+  CLAUDE_CODE_HEADLESS=true   Enable Claude Code headless
+
+Examples:
+  headless --worker audit --timeout 120000
+  headless --daemon
+  headless --benchmark
 `);
 }
 /**

package/dist/src/services/distill-tuning.js

@@ -278,9 +278,9 @@ function buildQuerySet(db, opts) {
         return [];
     const placeholders = namespaces.map(() => '?').join(',');
     const hiFinite = Number.isFinite(hiRowid);
-    const sql = `SELECT rowid, id, namespace, content, embedding FROM memory_entries
-    WHERE rowid > ? ${hiFinite ? 'AND rowid <= ?' : ''} AND embedding IS NOT NULL
-      AND COALESCE(namespace,'default') IN (${placeholders})
+    const sql = `SELECT rowid, id, namespace, content, embedding FROM memory_entries
+    WHERE rowid > ? ${hiFinite ? 'AND rowid <= ?' : ''} AND embedding IS NOT NULL
+      AND COALESCE(namespace,'default') IN (${placeholders})
     ORDER BY rowid`;
     const args = hiFinite ? [loRowid, hiRowid, ...namespaces] : [loRowid, ...namespaces];
     const rows = db.prepare(sql).all(...args);
@@ -398,7 +398,7 @@ function resetDistillationState(db) {
     }
 }
 function applyCorroboratedPromotion(db) {
-    db.prepare(`UPDATE reasoning_patterns SET metadata = json_set(metadata, '$.promoted', 1)
+    db.prepare(`UPDATE reasoning_patterns SET metadata = json_set(metadata, '$.promoted', 1)
      WHERE json_extract(metadata, '$.provenance') = 'proxy:structural' AND uses >= ?`).run(CORROBORATION_MIN_USES);
 }
 // ── Scoring (MRR@K / recall@K, shared by candidate + baseline paths) ────
@@ -437,9 +437,9 @@ function isTopicallyCorrect(q, p) {
 // ── pattern_embeddings BLOB → number[] ───────────────────────────────────
 function loadPromotedPatternIndex(db) {
     const rows = db
-        .prepare(`SELECT rp.id AS id, rp.tags AS tags, rp.metadata AS metadata, pe.embedding AS embedding
-       FROM reasoning_patterns rp
-       JOIN pattern_embeddings pe ON pe.pattern_id = rp.id
+        .prepare(`SELECT rp.id AS id, rp.tags AS tags, rp.metadata AS metadata, pe.embedding AS embedding
+       FROM reasoning_patterns rp
+       JOIN pattern_embeddings pe ON pe.pattern_id = rp.id
        WHERE json_extract(rp.metadata, '$.promoted') = 1`)
         .all();
     return rows.map((r) => {

package/dist/src/services/headless-worker-executor.js

@@ -78,18 +78,18 @@ export const HEADLESS_WORKER_CONFIGS = {
         description: 'AI-powered security analysis',
         enabled: true,
         headless: {
-            promptTemplate: `Analyze this codebase for security vulnerabilities:
-- Check for hardcoded secrets (API keys, passwords)
-- Identify SQL injection risks
-- Find XSS vulnerabilities
-- Check for insecure dependencies
-- Identify authentication/authorization issues
-
-Provide a JSON report with:
-{
-  "vulnerabilities": [{ "severity": "high|medium|low", "file": "...", "line": N, "description": "..." }],
-  "riskScore": 0-100,
-  "recommendations": ["..."]
+            promptTemplate: `Analyze this codebase for security vulnerabilities:
+- Check for hardcoded secrets (API keys, passwords)
+- Identify SQL injection risks
+- Find XSS vulnerabilities
+- Check for insecure dependencies
+- Identify authentication/authorization issues
+
+Provide a JSON report with:
+{
+  "vulnerabilities": [{ "severity": "high|medium|low", "file": "...", "line": N, "description": "..." }],
+  "riskScore": 0-100,
+  "recommendations": ["..."]
 }`,
             sandbox: 'strict',
             model: 'haiku',
@@ -106,13 +106,13 @@ Provide a JSON report with:
         description: 'AI optimization suggestions',
         enabled: true,
         headless: {
-            promptTemplate: `Analyze this codebase for performance optimizations:
-- Identify N+1 query patterns
-- Find unnecessary re-renders in React
-- Suggest caching opportunities
-- Identify memory leaks
-- Find redundant computations
-
+            promptTemplate: `Analyze this codebase for performance optimizations:
+- Identify N+1 query patterns
+- Find unnecessary re-renders in React
+- Suggest caching opportunities
+- Identify memory leaks
+- Find redundant computations
+
 Provide actionable suggestions with code examples.`,
             sandbox: 'permissive',
             model: 'sonnet',
@@ -129,13 +129,13 @@ Provide actionable suggestions with code examples.`,
         description: 'AI test gap analysis',
         enabled: true,
         headless: {
-            promptTemplate: `Analyze test coverage and identify gaps:
-- Find untested functions and classes
-- Identify edge cases not covered
-- Suggest new test scenarios
-- Check for missing error handling tests
-- Identify integration test gaps
-
+            promptTemplate: `Analyze test coverage and identify gaps:
+- Find untested functions and classes
+- Identify edge cases not covered
+- Suggest new test scenarios
+- Check for missing error handling tests
+- Identify integration test gaps
+
 For each gap, provide a test skeleton.`,
             sandbox: 'permissive',
             model: 'sonnet',
@@ -152,13 +152,13 @@ For each gap, provide a test skeleton.`,
         description: 'AI documentation generation',
         enabled: false,
         headless: {
-            promptTemplate: `Generate documentation for undocumented code:
-- Add JSDoc comments to functions
-- Create README sections for modules
-- Document API endpoints
-- Add inline comments for complex logic
-- Generate usage examples
-
+            promptTemplate: `Generate documentation for undocumented code:
+- Add JSDoc comments to functions
+- Create README sections for modules
+- Document API endpoints
+- Add inline comments for complex logic
+- Generate usage examples
+
 Focus on public APIs and exported functions.`,
             sandbox: 'permissive',
             model: 'haiku',
@@ -175,19 +175,19 @@ Focus on public APIs and exported functions.`,
         description: 'Deep knowledge acquisition',
         enabled: false,
         headless: {
-            promptTemplate: `Deeply analyze this codebase to learn:
-- Architectural patterns used
-- Coding conventions
-- Domain-specific terminology
-- Common patterns and idioms
-- Team preferences
-
-Provide insights as JSON:
-{
-  "architecture": { "patterns": [...], "style": "..." },
-  "conventions": { "naming": "...", "formatting": "..." },
-  "domains": ["..."],
-  "insights": ["..."]
+            promptTemplate: `Deeply analyze this codebase to learn:
+- Architectural patterns used
+- Coding conventions
+- Domain-specific terminology
+- Common patterns and idioms
+- Team preferences
+
+Provide insights as JSON:
+{
+  "architecture": { "patterns": [...], "style": "..." },
+  "conventions": { "naming": "...", "formatting": "..." },
+  "domains": ["..."],
+  "insights": ["..."]
 }`,
             sandbox: 'strict',
             model: 'opus',
@@ -204,13 +204,13 @@ Provide insights as JSON:
         description: 'AI refactoring suggestions',
         enabled: false,
         headless: {
-            promptTemplate: `Suggest refactoring opportunities:
-- Identify code duplication
-- Suggest better abstractions
-- Find opportunities for design patterns
-- Identify overly complex functions
-- Suggest module reorganization
-
+            promptTemplate: `Suggest refactoring opportunities:
+- Identify code duplication
+- Suggest better abstractions
+- Find opportunities for design patterns
+- Identify overly complex functions
+- Suggest module reorganization
+
 Provide before/after code examples.`,
             sandbox: 'permissive',
             model: 'sonnet',
@@ -227,13 +227,13 @@ Provide before/after code examples.`,
         description: 'Deep code analysis',
         enabled: false,
         headless: {
-            promptTemplate: `Perform deep analysis of this codebase:
-- Understand data flow
-- Map dependencies
-- Identify architectural issues
-- Find potential bugs
-- Analyze error handling
-
+            promptTemplate: `Perform deep analysis of this codebase:
+- Understand data flow
+- Map dependencies
+- Identify architectural issues
+- Find potential bugs
+- Analyze error handling
+
 Provide comprehensive report.`,
             sandbox: 'strict',
             model: 'opus',
@@ -250,18 +250,18 @@ Provide comprehensive report.`,
         description: 'Predictive preloading',
         enabled: false,
         headless: {
-            promptTemplate: `Based on recent activity, predict what the developer needs:
-- Files likely to be edited next
-- Tests that should be run
-- Documentation to reference
-- Dependencies to check
-
-Provide preload suggestions as JSON:
-{
-  "filesToPreload": ["..."],
-  "testsToRun": ["..."],
-  "docsToReference": ["..."],
-  "confidence": 0.0-1.0
+            promptTemplate: `Based on recent activity, predict what the developer needs:
+- Files likely to be edited next
+- Tests that should be run
+- Documentation to reference
+- Dependencies to check
+
+Provide preload suggestions as JSON:
+{
+  "filesToPreload": ["..."],
+  "testsToRun": ["..."],
+  "docsToReference": ["..."],
+  "confidence": 0.0-1.0
 }`,
             sandbox: 'strict',
             model: 'haiku',
@@ -980,20 +980,20 @@ export class HeadlessWorkerExecutor extends EventEmitter {
      */
     buildPrompt(template, context) {
         if (!context) {
-            return `${template}
-
-## Instructions
-
+            return `${template}
+
+## Instructions
+
 Analyze the codebase and provide your response following the format specified in the task.`;
         }
-        return `${template}
-
-## Codebase Context
-
-${context}
-
-## Instructions
-
+        return `${template}
+
+## Codebase Context
+
+${context}
+
+## Instructions
+
 Analyze the above codebase context and provide your response following the format specified in the task.`;
     }
     /**

package/dist/src/services/memory-distillation.js

@@ -116,10 +116,10 @@ export async function runDistillation(options) {
             return { ...report, corrupt: true, skipped: 'memory DB reports corruption — run recoverMemoryDatabase first' };
         }
         // M0: incremental cursor table (per namespace, by monotonic rowid).
-        db.exec(`CREATE TABLE IF NOT EXISTS distill_state (
-      namespace TEXT PRIMARY KEY,
-      last_rowid INTEGER NOT NULL DEFAULT 0,
-      last_run_at INTEGER
+        db.exec(`CREATE TABLE IF NOT EXISTS distill_state (
+      namespace TEXT PRIMARY KEY,
+      last_rowid INTEGER NOT NULL DEFAULT 0,
+      last_run_at INTEGER
     )`);
         // Which namespaces to process.
         const nsAll = db.prepare("SELECT DISTINCT COALESCE(namespace,'default') AS ns FROM memory_entries WHERE embedding IS NOT NULL").all().map(r => r.ns);

package/dist/src/services/worker-daemon.js

@@ -11,9 +11,10 @@
  * - testgaps: Test coverage analysis (20 min interval)
  */
 import { EventEmitter } from 'events';
-import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, unlinkSync, renameSync } from 'fs';
+import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, unlinkSync } from 'fs';
 import { cpus } from 'os';
 import { join } from 'path';
+import { writeFileAtomic } from '../fs-secure.js';
 import { HeadlessWorkerExecutor, isHeadlessWorker, } from './headless-worker-executor.js';
 // ADR-174 M3: the consolidate worker below drives the real DISTILL/CONSOLIDATE
 // pass instead of writing a hardcoded { patternsConsolidated: 0 } stub. The
@@ -1806,9 +1807,11 @@ export class WorkerDaemon extends EventEmitter {
             savedAt: new Date().toISOString(),
         };
         try {
-            const tmpFile = this.config.stateFile + '.tmp';
-            writeFileSync(tmpFile, JSON.stringify(state, null, 2));
-            renameSync(tmpFile, this.config.stateFile);
+            // ruvnet/ruflo#2782: use writeFileAtomic — its temp file is uniquified with
+            // pid + timestamp + random suffix, so two concurrent in-process saveState()
+            // calls can no longer collide on a shared `.tmp` basename and race one
+            // another's renameSync into ENOENT. Related to but distinct from #1637.
+            writeFileAtomic(this.config.stateFile, Buffer.from(JSON.stringify(state, null, 2)));
         }
         catch (error) {
             this.log('error', `Failed to save state: ${error}`);

package/dist/src/transfer/deploy-seraphine.js

@@ -71,29 +71,29 @@ function parseArgs() {
  * Print help message
  */
 function printHelp() {
-    console.log(`
-Seraphine Genesis Deployer
-==========================
-
-Deploy the foundational Claude Flow pattern model.
-
-Usage:
-  npx ts-node deploy-seraphine.ts [options]
-
-Options:
-  --output, -o <path>     Output file path
-  --to-ipfs, --ipfs       Upload to IPFS
-  --anonymize, -a <level> Anonymization level (minimal|standard|strict|paranoid)
-  --gateway, -g <url>     IPFS gateway URL
-  --no-pin                Don't pin to pinning service
-  --no-validate           Skip validation
-  --verbose, -v           Verbose output
-  --help, -h              Show this help
-
-Examples:
-  npx ts-node deploy-seraphine.ts --output ./seraphine-genesis.cfp.json
-  npx ts-node deploy-seraphine.ts --to-ipfs --anonymize strict
-  npx ts-node deploy-seraphine.ts --to-ipfs --gateway https://dweb.link
+    console.log(`
+Seraphine Genesis Deployer
+==========================
+
+Deploy the foundational Claude Flow pattern model.
+
+Usage:
+  npx ts-node deploy-seraphine.ts [options]
+
+Options:
+  --output, -o <path>     Output file path
+  --to-ipfs, --ipfs       Upload to IPFS
+  --anonymize, -a <level> Anonymization level (minimal|standard|strict|paranoid)
+  --gateway, -g <url>     IPFS gateway URL
+  --no-pin                Don't pin to pinning service
+  --no-validate           Skip validation
+  --verbose, -v           Verbose output
+  --help, -h              Show this help
+
+Examples:
+  npx ts-node deploy-seraphine.ts --output ./seraphine-genesis.cfp.json
+  npx ts-node deploy-seraphine.ts --to-ipfs --anonymize strict
+  npx ts-node deploy-seraphine.ts --to-ipfs --gateway https://dweb.link
 `);
 }
 /**