@claude-flow/cli 3.38.12 → 3.38.14

package/.claude/.proven-config-version

@@ -0,0 +1 @@
+sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.38.12
+3.38.14

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.38.12",
+    "version": "3.38.14",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
@@ -8,6 +8,6 @@
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "8JINtA8uubiBqNQbsz8OL2fcc4xmKGk6gKPGoa1ib7/21nYDaYWiWrZB/4xli8AGUdmQuMS9GT6ANbpPjqAcCw==",
+  "signature": "HkAB4ZAhg/nQ7kKEyKXmCGeH+fx5op+LMEUdrjLcrVuuIxN6j9fFadcPslwN+zeOCzff+RTrU3mOBfYKJO6lDg==",
   "algorithm": "ed25519"
 }

package/.claude/proven-config.json

@@ -0,0 +1,42 @@
+{
+  "adoptedAt": 1787321045267,
+  "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
+  "manifest": {
+    "schema": "ruflo.proven-config/v1",
+    "policy": {
+      "ref": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
+      "value": {
+        "alpha": 0.3,
+        "subjectWeight": 1,
+        "mmrLambda": 0.5,
+        "bodyWeight": 1.5,
+        "typePenaltyFactor": 0.5
+      }
+    },
+    "layer": "framework/node-cli",
+    "compatibility": {
+      "ruflo": ">=3.24.0"
+    },
+    "benchmark": {
+      "corpus": "ADR-081-labelled-v1",
+      "corpusHash": "sha256:2f700b5c363e20a3bd88ce2bc9b87bbbbaa61732c6177894c6ec37890f888982"
+    },
+    "receipt": {
+      "heldOutDelta": 0.07381404928570845,
+      "redblue": "PASS",
+      "drift": 0,
+      "canary": {
+        "rollbackRate": 0,
+        "latencyP95": 244.612458000076,
+        "costPerTask": 0
+      },
+      "receiptCoverage": 1
+    },
+    "platform": [
+      "linux",
+      "macOS",
+      "windows"
+    ]
+  },
+  "previous": ""
+}

package/catalog-manifest.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": 1,
-  "generation": 4,
-  "generatedAt": "2026-08-15T15:33:50.000Z",
-  "gitSha": "44b9dad1",
+  "generation": 5,
+  "generatedAt": "2026-08-21T14:30:26.881Z",
+  "gitSha": "703e7741",
   "catalog": {
-    "agents": 164,
+    "agents": 165,
     "tools": 397,
     "skills": 34
   },

package/dist/src/mcp-tools/hooks-tools.js

@@ -1412,7 +1412,12 @@ export const hooksPostTask = {
         const taskText = params.task || '';
         const outcomeKeywords = extractKeywords(taskText);
         let outcomePersisted = false;
-        if (taskText && agent && agent.length <= 100 && /^[a-zA-Z0-9_-]+$/.test(agent)) {
+        // #3064 — the previous ad-hoc regex `/^[a-zA-Z0-9_-]+$/` silently dropped
+        // colon-namespaced plugin agents (`ruflo-core:reviewer`, etc.) — i.e. every
+        // Claude Code plugin agent. Colons are already allowed by the canonical
+        // validateIdentifier() check on line 1456 above (IDENTIFIER_RE includes ':'
+        // and '.'), so no additional charset gating is needed here.
+        if (taskText && agent) {
             try {
                 const outcomes = loadRoutingOutcomes();
                 outcomes.push({

package/dist/src/memory/memory-bridge.js

@@ -936,11 +936,22 @@ export async function bridgeStoreEntry(options) {
                 persistWarning = `sql.js fallback driver in use — this write may not be durably persisted to disk (${msg}). Install better-sqlite3's native binding to restore durable writes (see issue #2968: npm rebuild better-sqlite3, or reinstall with install scripts enabled).`;
             }
         }
-        // Phase 2: Write-through to TieredCache
+        // Phase 2: Invalidate cache so the next read fetches the fresh row.
+        //
+        // #3051 — this used to be a write-through with a partial payload
+        // (`{ id, key, namespace, content, embedding }` — missing `tags`,
+        // access_count, timestamps, metadata, provenance_type). Any read that
+        // hit the cache then returned `tags: cached.tags || []` = `[]` for the
+        // very entry that had just been written with real tags, so
+        // `memory_store({ tags })` → `memory_retrieve()` looked like it silently
+        // dropped tags. Invalidating instead of partial-cache-set forces the
+        // next `bridgeGetEntry` to load the authoritative row (which correctly
+        // parses tags/metadata from the JSON columns) and repopulate the cache
+        // from that full shape.
         const safeNs = String(namespace).replace(/:/g, '_');
         const safeKey = String(key).replace(/:/g, '_');
         const cacheKey = `entry:${safeNs}:${safeKey}`;
-        await cacheSet(registry, cacheKey, { id, key, namespace, content: value, embedding: embeddingJson });
+        await cacheInvalidate(registry, cacheKey);
         // Phase 4: AttestationLog write audit
         await logAttestation(registry, 'store', id, { key, namespace, hasEmbedding: !!embeddingJson });
         return {

package/dist/src/ruvector/lattice-wasm.d.ts

@@ -0,0 +1,14 @@
+/** Default package name (ruvnet WASM convention); override with RUFLO_LATTICE_WASM_PKG. */
+export declare const LATTICE_WASM_PKG: string;
+export type LatticeModel = 'minilm' | 'bge' | 'paraphrase-minilm' | 'qwen3-0.6b' | string;
+export declare const DEFAULT_LATTICE_MODEL: LatticeModel;
+/** Is the Lattice WASM embedder installed + initializable? Cached; never throws. */
+export declare function latticeAvailable(): Promise<boolean>;
+/** The models Lattice reports (empty until availability is probed). */
+export declare function latticeModels(): LatticeModel[];
+/**
+ * Embed `text` with `model` via Lattice WASM. Returns null on any failure so the
+ * caller can fall through to the next tier. Never throws.
+ */
+export declare function latticeEmbed(text: string, model?: LatticeModel): Promise<number[] | null>;
+//# sourceMappingURL=lattice-wasm.d.ts.map

package/dist/src/ruvector/lattice-wasm.js

@@ -0,0 +1,144 @@
+/**
+ * Lattice WASM embedder adapter — the primary embedding tier (ADR: embedding
+ * substrate upgrade). Replaces hash placeholders with real semantic embeddings
+ * and adds multiple models (miniLM, bge, multi-paraphrase-miniLM, GPU qwen3-0.6B).
+ *
+ * Built on the proven `@ruvector/ruvllm-wasm` optional-dependency convention:
+ *   - dynamically imported (never a hard dependency),
+ *   - WASM initialized from bundled bytes,
+ *   - fully FAIL-CLOSED: if the package is absent, the WASM fails to init, or the
+ *     embed API differs, `latticeAvailable()` returns false and callers fall
+ *     through to the existing ruvector-ONNX → hash tiers with ZERO regression.
+ *
+ * The package specifier is configurable (`RUFLO_LATTICE_WASM_PKG`) so the exact
+ * published name can be set without a code change; the API is probed tolerantly.
+ * Opt-in for the GPU model: qwen3 is only selected when explicitly requested.
+ */
+import { createRequire } from 'module';
+import { readFileSync } from 'fs';
+const require_ = createRequire(import.meta.url);
+/** Default package name (ruvnet WASM convention); override with RUFLO_LATTICE_WASM_PKG. */
+export const LATTICE_WASM_PKG = process.env.RUFLO_LATTICE_WASM_PKG || '@ruvector/lattice-wasm';
+export const DEFAULT_LATTICE_MODEL = process.env.RUFLO_EMBED_MODEL || 'minilm';
+/* eslint-disable @typescript-eslint/no-explicit-any */
+let _mod = null;
+let _ready = false;
+let _probed = false;
+let _available = false;
+let _models = [];
+async function loadModule() {
+    if (_mod)
+        return _mod;
+    const spec = LATTICE_WASM_PKG;
+    _mod = await import(spec).catch(() => null); // optional — absent ⇒ null ⇒ unavailable
+    return _mod;
+}
+async function ensureInit() {
+    if (_ready)
+        return true;
+    const mod = await loadModule();
+    if (!mod)
+        return false;
+    try {
+        // ruvnet WASM convention: initSync({ module: <wasm bytes> }); tolerate variants.
+        if (!_ready && typeof mod.initSync === 'function') {
+            let wasmBytes;
+            for (const cand of ['lattice_wasm_bg.wasm', 'lattice_bg.wasm', 'index_bg.wasm']) {
+                try {
+                    wasmBytes = readFileSync(require_.resolve(`${LATTICE_WASM_PKG}/${cand}`));
+                    break;
+                }
+                catch { /* try next */ }
+            }
+            mod.initSync(wasmBytes ? { module: wasmBytes } : undefined);
+        }
+        else if (typeof mod.default === 'function') {
+            await mod.default(); // some wasm-bindgen builds export an async default init
+        }
+        _ready = true;
+        return true;
+    }
+    catch {
+        return false; // init failed ⇒ fail closed
+    }
+}
+/** Extract a plain number[] from whatever shape the module's embed returns. */
+function toVec(r) {
+    const v = (r && typeof r === 'object' && 'embedding' in r) ? r.embedding : r;
+    if (!v)
+        return null;
+    if (Array.isArray(v))
+        return v;
+    if (v.length !== undefined)
+        return Array.from(v);
+    return null;
+}
+/** Is the Lattice WASM embedder installed + initializable? Cached; never throws. */
+export async function latticeAvailable() {
+    if (_probed)
+        return _available;
+    _probed = true;
+    try {
+        if (!(await ensureInit())) {
+            _available = false;
+            return false;
+        }
+        const mod = _mod;
+        // discover models (tolerant): listModels() / models / MODELS
+        try {
+            const list = typeof mod.listModels === 'function' ? mod.listModels() : (mod.models ?? mod.MODELS);
+            if (Array.isArray(list) && list.length)
+                _models = list;
+        }
+        catch { /* leave default */ }
+        if (!_models.length)
+            _models = [DEFAULT_LATTICE_MODEL];
+        // verify an actual embed succeeds (the ADR-086 "loads but runtime-fails" trap).
+        const probe = await latticeEmbedRaw('probe', DEFAULT_LATTICE_MODEL);
+        _available = !!probe && probe.length > 0;
+        return _available;
+    }
+    catch {
+        _available = false;
+        return false;
+    }
+}
+/** The models Lattice reports (empty until availability is probed). */
+export function latticeModels() { return [..._models]; }
+async function latticeEmbedRaw(text, model) {
+    const mod = _mod;
+    if (!mod)
+        return null;
+    // tolerant API probing across plausible wasm-bindgen surfaces.
+    const attempts = [
+        () => typeof mod.embed === 'function' ? mod.embed(text, model) : undefined,
+        () => typeof mod.embed === 'function' ? mod.embed(text) : undefined,
+        () => typeof mod.embedText === 'function' ? mod.embedText(text, model) : undefined,
+        () => typeof mod.Embedder === 'function' ? new mod.Embedder(model).embed(text) : undefined,
+    ];
+    for (const a of attempts) {
+        try {
+            const r = await a();
+            const v = toVec(r);
+            if (v)
+                return v;
+        }
+        catch { /* try next surface */ }
+    }
+    return null;
+}
+/**
+ * Embed `text` with `model` via Lattice WASM. Returns null on any failure so the
+ * caller can fall through to the next tier. Never throws.
+ */
+export async function latticeEmbed(text, model = DEFAULT_LATTICE_MODEL) {
+    try {
+        if (!(await latticeAvailable()))
+            return null;
+        return await latticeEmbedRaw(text, model);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=lattice-wasm.js.map

package/dist/src/services/flywheel-receipt.d.ts

@@ -123,6 +123,16 @@ export interface CreateReceiptInput {
     publicKeyPem?: string;
     bootstrapIterations?: number;
 }
+/** Names present on `value` that the contract does not define, as `unknown field: <path>`. */
+export declare function collectUnknownFields(value: unknown, allowed: readonly string[], path: string): string[];
+/**
+ * ADR-322C: unknown fields fail verification for a given schema version.
+ * Enforced here rather than delegated to out-of-band schema validation, because
+ * a signature is valid over whatever the producer canonicalized — including
+ * fields the contract never defined — so a permissive verifier lets a producer
+ * attach arbitrary signed data that still verifies cleanly.
+ */
+export declare function collectUnknownReceiptFields(receipt: FlywheelEvaluationReceipt): string[];
 /**
  * RFC-8785-compatible for the JSON domain accepted above: ECMAScript primitive
  * serialization plus recursively sorted UTF-16 property names.

package/dist/src/services/flywheel-receipt.js

@@ -11,6 +11,72 @@ import { checkPairedOutcomesConsistency } from './flywheel-sequential-evidence.j
 export const RECEIPT_SCHEMA = 'ruflo.flywheel-receipt/v1';
 export const RECEIPT_DOMAIN = 'ruflo/flywheel-receipt/v1';
 export const GENESIS_LEDGER_HEAD = `sha256:${'0'.repeat(64)}`;
+/**
+ * Closed field sets for ADR-322C strict verification. Three objects stay open by
+ * contract: `candidatePolicy` is owned by `policySchemaVersion`, `gates` is a
+ * caller-named term map, and `evidence.verification` / `evidence.canary` carry
+ * evidence-specific payloads.
+ */
+const RECEIPT_FIELDS = {
+    root: ['payload', 'signature'],
+    payload: [
+        'schemaVersion', 'receiptId', 'lineageId', 'candidateId', 'evaluationRunId',
+        'baselineRef', 'expectedLedgerHead', 'candidatePolicy', 'gateVersion',
+        'policySchemaVersion', 'safetyEnvelopeRef', 'anchorRef', 'requestedProposer',
+        'effectiveProposer', 'proposerSubstitution', 'corpusVersion', 'corpusHash',
+        'baselineScore', 'candidateScore', 'heldOutDeltas', 'pairedOutcomes',
+        'statistics', 'gates', 'resourceEvidence', 'evidence', 'termVerification',
+        'decision', 'issuedAt', 'expiresAt',
+    ],
+    signature: ['algorithm', 'domain', 'publicKeyPem', 'signatureBase64'],
+    statistics: [
+        'ruleVersion', 'relativeLift', 'pairedBootstrapProbability',
+        'pairedBootstrapDeltaCILow95', 'frozenAnchorRegression', 'iterations',
+        'seedHex', 'significant', 'accepted',
+    ],
+    resourceEvidence: [
+        'p95LatencyMicros', 'costMicrosPerTask', 'tokensPerTask', 'failureRate',
+        'evaluationCostMicros', 'energyMicrojoules', 'currency',
+    ],
+    evidence: ['corpusRoles', 'verification', 'canary'],
+    corpusRoles: ['selectionTaskIds', 'promotionHoldoutTaskIds', 'guardTaskIds'],
+    pairedOutcome: ['taskId', 'baselineScore', 'candidateScore'],
+    termVerification: ['term', 'verification', 'evidenceRef', 'attestor'],
+};
+/** Names present on `value` that the contract does not define, as `unknown field: <path>`. */
+export function collectUnknownFields(value, allowed, path) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return [];
+    return Object.keys(value)
+        .filter((key) => !allowed.includes(key))
+        .map((key) => `unknown field: ${path}.${key}`);
+}
+/**
+ * ADR-322C: unknown fields fail verification for a given schema version.
+ * Enforced here rather than delegated to out-of-band schema validation, because
+ * a signature is valid over whatever the producer canonicalized — including
+ * fields the contract never defined — so a permissive verifier lets a producer
+ * attach arbitrary signed data that still verifies cleanly.
+ */
+export function collectUnknownReceiptFields(receipt) {
+    const errors = collectUnknownFields(receipt, RECEIPT_FIELDS.root, 'receipt');
+    const payload = receipt.payload;
+    if (!payload || typeof payload !== 'object')
+        return errors;
+    const evidence = payload.evidence;
+    errors.push(...collectUnknownFields(payload, RECEIPT_FIELDS.payload, 'payload'), ...collectUnknownFields(receipt.signature, RECEIPT_FIELDS.signature, 'signature'), ...collectUnknownFields(payload.statistics, RECEIPT_FIELDS.statistics, 'payload.statistics'), ...collectUnknownFields(payload.resourceEvidence, RECEIPT_FIELDS.resourceEvidence, 'payload.resourceEvidence'), ...collectUnknownFields(evidence, RECEIPT_FIELDS.evidence, 'payload.evidence'), ...collectUnknownFields(evidence?.corpusRoles, RECEIPT_FIELDS.corpusRoles, 'payload.evidence.corpusRoles'));
+    if (Array.isArray(payload.pairedOutcomes)) {
+        payload.pairedOutcomes.forEach((outcome, i) => {
+            errors.push(...collectUnknownFields(outcome, RECEIPT_FIELDS.pairedOutcome, `payload.pairedOutcomes[${i}]`));
+        });
+    }
+    if (Array.isArray(payload.termVerification)) {
+        payload.termVerification.forEach((term, i) => {
+            errors.push(...collectUnknownFields(term, RECEIPT_FIELDS.termVerification, `payload.termVerification[${i}]`));
+        });
+    }
+    return errors;
+}
 function assertJsonValue(value, path = '$') {
     if (value === null || typeof value === 'string' || typeof value === 'boolean')
         return;
@@ -184,11 +250,19 @@ export function createFlywheelReceipt(input) {
     const evaluationRunId = input.evaluationRunId ?? uuidV7(now);
     const lineageId = input.lineageId ?? uuidV7(now);
     const candidateId = policyCandidateId(input.candidatePolicy);
+    // Verifiers recompute the statistics from the payload's scale-12 decimal
+    // strings — the only values they ever have. The encoded values are therefore
+    // the statistical inputs of record: compute the decision from them, not from
+    // full-precision intermediates, or any input that does not terminate within
+    // twelve decimals produces an honest receipt that fails its own verification.
+    const encodedBaselineScore = decimal(input.baselineScore);
+    const encodedCandidateScore = decimal(input.candidateScore);
+    const encodedHeldOutDeltas = input.heldOutDeltas.map((v) => decimal(v));
     const statistics = computePromotionStatistics({
-        baselineScore: input.baselineScore,
-        candidateScore: input.candidateScore,
-        heldOutDeltas: input.heldOutDeltas,
-        frozenAnchorRegression: input.frozenAnchorRegression,
+        baselineScore: Number(encodedBaselineScore),
+        candidateScore: Number(encodedCandidateScore),
+        heldOutDeltas: encodedHeldOutDeltas.map(Number),
+        frozenAnchorRegression: Number(decimal(input.frozenAnchorRegression)),
         corpusHash: input.corpusHash,
         candidateId,
         baselineRef: input.baselineRef,
@@ -213,9 +287,9 @@ export function createFlywheelReceipt(input) {
         ...(input.proposerSubstitution ? { proposerSubstitution: input.proposerSubstitution } : {}),
         corpusVersion: input.corpusVersion,
         corpusHash: input.corpusHash,
-        baselineScore: decimal(input.baselineScore),
-        candidateScore: decimal(input.candidateScore),
-        heldOutDeltas: input.heldOutDeltas.map((v) => decimal(v)),
+        baselineScore: encodedBaselineScore,
+        candidateScore: encodedCandidateScore,
+        heldOutDeltas: encodedHeldOutDeltas,
         ...(input.pairedOutcomes
             ? {
                 pairedOutcomes: input.pairedOutcomes.map((o) => ({
@@ -272,6 +346,7 @@ export function verifyFlywheelReceipt(receipt, trustedPublicKeys) {
     try {
         if (receipt.payload.schemaVersion !== RECEIPT_SCHEMA)
             errors.push('unsupported receipt schema');
+        errors.push(...collectUnknownReceiptFields(receipt));
         const { receiptId: _receiptId, ...base } = receipt.payload;
         const expectedId = sha256Ref(canonicalizeJcs(receiptIdentityPayload(base)));
         if (expectedId !== receipt.payload.receiptId)

package/dist/src/services/flywheel-transaction.js

@@ -9,7 +9,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { applyChampionParams } from '../config/harness-feedback-applier.js';
-import { GENESIS_LEDGER_HEAD, canonicalizeJcs, sha256Ref, uuidV7, verifyFlywheelReceipt, } from './flywheel-receipt.js';
+import { GENESIS_LEDGER_HEAD, canonicalizeJcs, collectUnknownFields, sha256Ref, uuidV7, verifyFlywheelReceipt, } from './flywheel-receipt.js';
 import { DEFAULT_ALPHA_TOTAL, DEFAULT_LAMBDA, minInformativePairsToClear, sequentialEvidenceVerdict, } from './flywheel-sequential-evidence.js';
 const STATE_VERSION = 1;
 const STATE_DIR = ['.claude-flow', 'flywheel-v1'];
@@ -18,6 +18,11 @@ const LOCK_FILE = 'transaction-state.lock';
 const RECEIPTS_DIR = 'receipts';
 const LOCK_TIMEOUT_MS = 10_000;
 const LOCK_STALE_MS = 60_000;
+const COMMIT_FIELDS = [
+    'commitId', 'transactionId', 'receiptId', 'lineageId', 'sequence',
+    'previousLedgerHead', 'baselineRef', 'candidateId', 'servingEpoch',
+    'proposer', 'proposerSubstitution', 'promotedAt',
+];
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 function stateDir(root) {
     return path.join(root, ...STATE_DIR);
@@ -481,6 +486,10 @@ export function verifyFlywheelLedger(root) {
     for (let i = 0; i < state.commits.length; i++) {
         const commit = state.commits[i];
         const { commitId, ...core } = commit;
+        // Same ADR-322C strictness as the receipt path: a commit hashes consistently
+        // over whatever fields it carries, so an undefined field would otherwise
+        // chain cleanly (ruflo#3068).
+        errors.push(...collectUnknownFields(commit, COMMIT_FIELDS, `commits[${i}]`));
         if (commit.sequence !== i + 1)
             errors.push(`sequence mismatch at ${i + 1}`);
         if (commit.previousLedgerHead !== head)

package/node_modules/@claude-flow/security/dist/input-validator.d.ts

@@ -159,14 +159,14 @@ export declare const SpawnAgentSchema: z.ZodObject<{
     timeout: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
+    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
-    id?: string | undefined;
 }, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
+    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
-    id?: string | undefined;
 }>;
 /**
  * Task input schema
@@ -181,13 +181,13 @@ export declare const TaskInputSchema: z.ZodObject<{
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "critical" | "high" | "medium" | "low" | undefined;
+    priority?: "low" | "medium" | "high" | "critical" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }, {
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "critical" | "high" | "medium" | "low" | undefined;
+    priority?: "low" | "medium" | "high" | "critical" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }>;
 /**
@@ -234,16 +234,16 @@ export declare const ExecutorConfigSchema: z.ZodObject<{
     cwd: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
     allowSudo: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    allowedCommands: string[];
     timeout: number;
+    allowedCommands: string[];
     maxBuffer: number;
     allowSudo: boolean;
     blockedPatterns?: string[] | undefined;
     cwd?: string | undefined;
 }, {
     allowedCommands: string[];
-    blockedPatterns?: string[] | undefined;
     timeout?: number | undefined;
+    blockedPatterns?: string[] | undefined;
     maxBuffer?: number | undefined;
     cwd?: string | undefined;
     allowSudo?: boolean | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.38.12",
+  "version": "3.38.14",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",