@claude-flow/cli 3.38.13 → 3.38.15

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.38.13
+3.38.15

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.38.13",
+    "version": "3.38.15",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
@@ -8,6 +8,6 @@
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "V8Wxea6WL3Y6pa8RgPLLR+P2AuCu0HPq9kJ3UCtyGi12Zgk1X4NICNYxhuwftErwnyS2+zpjZ/XqmF03hsR9Cg==",
+  "signature": "BPJ/dA1o5KjvB5Ic9PGq/9BHvQnXADaTmGXZW3UUCfDKDKmDFKMzQZowG3HF54zTek1SapxJb3irPiIWMPAFDA==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 5,
-  "generatedAt": "2026-08-21T14:18:22.552Z",
-  "gitSha": "0f3c4510",
+  "generatedAt": "2026-08-21T14:40:50.895Z",
+  "gitSha": "87bacd55",
   "catalog": {
     "agents": 165,
     "tools": 397,

package/dist/src/commands/hive-mind.js

@@ -8,10 +8,11 @@
 import { output } from '../output.js';
 import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
-import { spawn as childSpawn, execSync } from 'child_process';
+import { spawn as childSpawn } from 'child_process';
 import { mkdir, writeFile } from 'fs/promises';
 import { existsSync } from 'fs';
 import { join } from 'path';
+import { resolveClaudeLaunchCommand } from '../runtime/claude-command.js';
 // Hive topologies
 const TOPOLOGIES = [
     { value: 'hierarchical', label: 'Hierarchical', hint: 'Queen-led with worker agents' },
@@ -185,20 +186,18 @@ async function spawnClaudeCodeInstance(swarmId, swarmName, objective, workers, f
         await writeFile(promptFile, hiveMindPrompt, 'utf8');
         output.writeln();
         output.printSuccess(`Hive Mind prompt saved to: ${promptFile}`);
-        // Check if claude command exists
-        let claudeAvailable = false;
-        try {
-            execSync('which claude', { stdio: 'ignore' });
-            claudeAvailable = true;
-        }
-        catch {
+        // Resolve a directly spawnable command. On Windows, npm exposes shell
+        // shims that Node cannot launch with shell:false, so the resolver follows
+        // the shim to Claude Code's executable or JavaScript entry point.
+        const claudeLaunch = resolveClaudeLaunchCommand();
+        if (!claudeLaunch) {
             output.writeln();
             output.printWarning('Claude Code CLI not found in PATH');
             output.writeln(output.dim('Install it with: npm install -g @anthropic-ai/claude-code'));
             output.writeln(output.dim('Falling back to displaying instructions...'));
         }
         const dryRun = flags.dryRun || flags['dry-run'];
-        if (claudeAvailable && !dryRun) {
+        if (claudeLaunch && !dryRun) {
             // Build arguments - flags first, then prompt
             const claudeArgs = [];
             // #1748 Issue 2 — pass --mcp-config so the spawned worker actually has
@@ -273,7 +272,10 @@ async function spawnClaudeCodeInstance(swarmId, swarmName, objective, workers, f
             output.printInfo('Launching Claude Code...');
             output.writeln(output.dim('Press Ctrl+C to pause the session'));
             // Spawn claude with properly ordered arguments
-            const claudeProcess = childSpawn('claude', claudeArgs, {
+            const claudeProcess = childSpawn(claudeLaunch.command, [
+                ...claudeLaunch.argsPrefix,
+                ...claudeArgs,
+            ], {
                 stdio: 'inherit',
                 shell: false,
             });

package/dist/src/commands/init.js

@@ -613,6 +613,18 @@ const initClaudeAction = async (ctx) => {
         }
         output.printBox(summary.join('\n'), 'Summary');
         output.writeln();
+        // Security: surface anything settings-risk-scanner.ts flagged in a
+        // pre-existing settings.json this init carried forward unexamined.
+        if (result.warnings && result.warnings.length > 0) {
+            output.printWarning('Settings review recommended:');
+            for (const warning of result.warnings.slice(0, 5)) {
+                output.printInfo(`  • ${warning}`);
+            }
+            if (result.warnings.length > 5) {
+                output.printInfo(`  ... and ${result.warnings.length - 5} more`);
+            }
+            output.writeln();
+        }
         // Show what was created
         if (options.components.claudeMd || options.components.settings || options.components.skills || options.components.commands || options.components.agents) {
             output.printBox([
@@ -1022,6 +1034,18 @@ const wizardCommand = {
                 return { success: false, exitCode: 1 };
             }
             spinner.succeed('Setup complete!');
+            // Security: surface anything settings-risk-scanner.ts flagged in a
+            // pre-existing settings.json this wizard run carried forward unexamined.
+            if (result.warnings && result.warnings.length > 0) {
+                output.writeln();
+                output.printWarning('Settings review recommended:');
+                for (const warning of result.warnings.slice(0, 5)) {
+                    output.printInfo(`  • ${warning}`);
+                }
+                if (result.warnings.length > 5) {
+                    output.printInfo(`  ... and ${result.warnings.length - 5} more`);
+                }
+            }
             // Initialize embeddings if enabled
             let embeddingsInitialized = false;
             if (enableEmbeddings) {
@@ -1170,6 +1194,15 @@ const skillsCommand = {
         const result = await executeInit(options);
         if (result.success) {
             spinner.succeed(`Installed ${result.summary.skillsCount} skills`);
+            if (result.warnings && result.warnings.length > 0) {
+                output.printWarning('Settings review recommended:');
+                for (const warning of result.warnings.slice(0, 5)) {
+                    output.printInfo(`  • ${warning}`);
+                }
+                if (result.warnings.length > 5) {
+                    output.printInfo(`  ... and ${result.warnings.length - 5} more`);
+                }
+            }
         }
         else {
             spinner.fail('Failed to install skills');
@@ -1232,6 +1265,15 @@ const hooksCommand = {
         const result = await executeInit(options);
         if (result.success) {
             spinner.succeed(`Created settings.json with ${result.summary.hooksEnabled} hooks enabled`);
+            if (result.warnings && result.warnings.length > 0) {
+                output.printWarning('Settings review recommended:');
+                for (const warning of result.warnings.slice(0, 5)) {
+                    output.printInfo(`  • ${warning}`);
+                }
+                if (result.warnings.length > 5) {
+                    output.printInfo(`  ... and ${result.warnings.length - 5} more`);
+                }
+            }
         }
         else {
             spinner.fail('Failed to create hooks configuration');
@@ -1342,6 +1384,18 @@ const upgradeCommand = {
                 output.printBox(result.settingsUpdated.map(s => `+ ${s}`).join('\n'), 'Settings Updated');
                 output.writeln();
             }
+            // Security: surface anything settings-risk-scanner.ts flagged in the
+            // pre-existing settings.json this upgrade carried forward unexamined.
+            if (result.warnings && result.warnings.length > 0) {
+                output.printWarning('Settings review recommended:');
+                for (const warning of result.warnings.slice(0, 5)) {
+                    output.printInfo(`  • ${warning}`);
+                }
+                if (result.warnings.length > 5) {
+                    output.printInfo(`  ... and ${result.warnings.length - 5} more`);
+                }
+                output.writeln();
+            }
             output.printSuccess('Your statusline helper has been updated to the latest version');
             output.printInfo('Existing metrics and learning data were preserved');
             // Show settings summary

package/dist/src/commands/mcp.js

@@ -8,7 +8,7 @@
 import { output } from '../output.js';
 import { confirm } from '../prompt.js';
 import { installParentDeathWatchdog } from '../runtime/parent-death-watchdog.js';
-import { getServerManager, getMCPServerStatus, } from '../mcp-server.js';
+import { getServerManager, getMCPServerStatus, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
 import { listMCPTools, callMCPTool, hasTool } from '../mcp-client.js';
 // MCP tools categories
 const TOOL_CATEGORIES = [
@@ -406,7 +406,8 @@ const toolsCommand = {
         // Use local tool registry
         let tools;
         // Get tools from local registry
-        const registeredTools = listMCPTools(category);
+        const selection = parseMcpToolSelection(process.env.CLAUDE_FLOW_MCP_TOOLS);
+        const registeredTools = filterAdvertisedMcpTools(listMCPTools(category), selection);
         if (registeredTools.length > 0) {
             tools = registeredTools.map(tool => ({
                 name: tool.name,
@@ -417,7 +418,7 @@ const toolsCommand = {
         }
         else {
             // Fallback to static tool list
-            tools = [
+            tools = filterAdvertisedMcpTools([
                 // Agent tools
                 { name: 'agent_spawn', category: 'agent', description: 'Spawn a new agent', enabled: true },
                 { name: 'agent_list', category: 'agent', description: 'List all agents', enabled: true },
@@ -449,7 +450,7 @@ const toolsCommand = {
                 { name: 'system_info', category: 'system', description: 'System information', enabled: true },
                 { name: 'system_health', category: 'system', description: 'Health status', enabled: true },
                 { name: 'system_metrics', category: 'system', description: 'Server metrics', enabled: true },
-            ].filter(t => !category || t.category === category);
+            ].filter(t => !category || t.category === category), selection);
         }
         if (ctx.flags.format === 'json') {
             output.printJson(tools);

package/dist/src/init/executor.d.ts

@@ -22,13 +22,23 @@ export interface UpgradeResult {
     addedCommands?: string[];
     /** Added by --settings flag */
     settingsUpdated?: string[];
+    /**
+     * Advisory-only findings from settings-risk-scanner.ts: dangerous-looking
+     * hook commands or Bash allow-rules found in the *pre-existing*
+     * settings.json this upgrade carried forward unexamined. Never blocks
+     * the upgrade — surfaced so a user can review before trusting it.
+     */
+    warnings?: string[];
 }
 /**
  * Merge new settings into existing settings.json
  * Preserves user customizations while adding new features like Agent Teams
  * Uses platform-specific commands for Mac, Linux, and Windows
  */
-export declare function mergeSettingsForUpgrade(existing: Record<string, unknown>): Record<string, unknown>;
+export declare function mergeSettingsForUpgrade(existing: Record<string, unknown>): {
+    merged: Record<string, unknown>;
+    warnings: string[];
+};
 /**
  * Execute upgrade - updates helpers and creates missing metrics without losing data
  * This is safe for existing users who want the latest statusline fixes

package/dist/src/init/executor.js

@@ -18,6 +18,7 @@ import { generatePreCommitHook, generatePostCommitHook, generateSessionManager,
 import { getInstalledCliVersion, HELPERS_STAMP_FILE } from './helper-refresh.js';
 import { generateClaudeMd } from './claudemd-generator.js';
 import { recordMemoryPackagePath } from './memory-package-resolver.js';
+import { scanSettingsForRisk, formatRiskFindingsAsWarnings } from './settings-risk-scanner.js';
 /**
  * Skills to copy based on configuration
  */
@@ -277,6 +278,10 @@ export async function executeInit(options) {
  * Uses platform-specific commands for Mac, Linux, and Windows
  */
 export function mergeSettingsForUpgrade(existing) {
+    // Scan the pre-existing hooks/permissions BEFORE they get spread into
+    // `merged` below — this is the untrusted, disk-sourced content a
+    // malicious settings.json would use to smuggle a hook payload through.
+    const warnings = formatRiskFindingsAsWarnings(scanSettingsForRisk({ hooks: existing.hooks, permissions: existing.permissions }));
     const merged = { ...existing };
     const platform = detectPlatform();
     const isWindows = platform.os === 'windows';
@@ -459,7 +464,7 @@ export function mergeSettingsForUpgrade(existing) {
             agentScopes: existingMemory.agentScopes ?? { enabled: true },
         },
     };
-    return merged;
+    return { merged, warnings };
 }
 /**
  * Execute upgrade - updates helpers and creates missing metrics without losing data
@@ -643,7 +648,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
             if (fs.existsSync(settingsPath)) {
                 try {
                     const existingSettings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
-                    const mergedSettings = mergeSettingsForUpgrade(existingSettings);
+                    const { merged: mergedSettings, warnings: settingsRiskWarnings } = mergeSettingsForUpgrade(existingSettings);
                     fs.writeFileSync(settingsPath, JSON.stringify(mergedSettings, null, 2), 'utf-8');
                     result.updated.push('.claude/settings.json');
                     result.settingsUpdated = [
@@ -655,6 +660,9 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                         'claudeFlow.agentTeams',
                         'claudeFlow.memory (learningBridge, memoryGraph, agentScopes)',
                     ];
+                    if (settingsRiskWarnings.length > 0) {
+                        result.warnings = [...(result.warnings ?? []), ...settingsRiskWarnings];
+                    }
                 }
                 catch (settingsError) {
                     result.errors.push(`Settings merge failed: ${settingsError instanceof Error ? settingsError.message : String(settingsError)}`);
@@ -797,6 +805,13 @@ async function writeSettings(targetDir, options, result) {
         // Merge hooks/env/permissions into existing settings instead of skipping
         try {
             const existing = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+            // Scan the pre-existing hooks/permissions BEFORE any merge decision
+            // below — same untrusted, disk-sourced content mergeSettingsForUpgrade()
+            // scans; see settings-risk-scanner.ts for why.
+            const riskWarnings = formatRiskFindingsAsWarnings(scanSettingsForRisk({ hooks: existing.hooks, permissions: existing.permissions }));
+            if (riskWarnings.length > 0) {
+                result.warnings = [...(result.warnings ?? []), ...riskWarnings];
+            }
             let merged = false;
             // Merge hooks (the critical missing piece — #1484)
             if (generated.hooks && !existing.hooks) {

package/dist/src/init/settings-risk-scanner.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Static, non-blocking risk scanner for pre-existing .claude/settings.json
+ * content that `ruflo init`/`ruflo init --upgrade` carry forward unexamined.
+ *
+ * `mergeSettingsForUpgrade()` and `writeSettings()` both read a target
+ * project's *existing* settings.json off disk and spread its `hooks` /
+ * `permissions.allow` entries into the merged output verbatim (see
+ * executor.ts:352-353 and :901-912) — the same trust shape as the publicly
+ * disclosed CVE-2025-59536 class (a settings.json hook payload achieving
+ * command execution with no review step). Ruflo's own hook dispatch is a
+ * closed set of internal handlers (hook-handler.cjs), so this isn't
+ * remotely exploitable through Ruflo itself — but a malicious fork, PR, or
+ * compromised dependency that plants a bad settings.json before a user
+ * runs `ruflo init`/`--upgrade` in that directory would have its payload
+ * silently preserved and reported as a normal "merged"/"updated" result,
+ * with zero visibility.
+ *
+ * This scanner is advisory-only: it never mutates its input and never
+ * blocks a merge/write. Callers decide what to do with the findings
+ * (surfaced as a CLI warning today).
+ *
+ * KNOWN LIMITATION (found by an independent adversarial review the same
+ * night this was written — see docs/dream-cycle/dream-gist-2026-08-16.md
+ * §5): this is a best-effort, static, blocklist-style heuristic, NOT a
+ * security boundary. It catches copy-pasted proof-of-concept payload
+ * shapes; it does not and cannot catch every obfuscation a motivated
+ * adversary could construct (string-built commands, uncommon interpreters,
+ * novel exfil channels, etc). Treat findings as "worth a second look,"
+ * never as a guarantee of safety.
+ */
+export interface SettingsRiskFinding {
+    location: string;
+    snippet: string;
+    reason: string;
+}
+/** Reasons a single hook `command` string looks risky (empty = clean). */
+export declare function scanCommandStringForRisk(command: string): string[];
+/** Reasons a single `permissions.allow` rule string looks risky (empty = clean). */
+export declare function scanAllowRuleForRisk(rule: string): string[];
+/**
+ * Scans a settings.json-shaped object's `hooks` and `permissions.allow`
+ * for content matching known-dangerous patterns.
+ */
+export declare function scanSettingsForRisk(settings: Record<string, unknown>): SettingsRiskFinding[];
+/** Formats findings as short, human-readable CLI warning lines. */
+export declare function formatRiskFindingsAsWarnings(findings: SettingsRiskFinding[]): string[];
+//# sourceMappingURL=settings-risk-scanner.d.ts.map

package/dist/src/init/settings-risk-scanner.js

@@ -0,0 +1,161 @@
+/**
+ * Static, non-blocking risk scanner for pre-existing .claude/settings.json
+ * content that `ruflo init`/`ruflo init --upgrade` carry forward unexamined.
+ *
+ * `mergeSettingsForUpgrade()` and `writeSettings()` both read a target
+ * project's *existing* settings.json off disk and spread its `hooks` /
+ * `permissions.allow` entries into the merged output verbatim (see
+ * executor.ts:352-353 and :901-912) — the same trust shape as the publicly
+ * disclosed CVE-2025-59536 class (a settings.json hook payload achieving
+ * command execution with no review step). Ruflo's own hook dispatch is a
+ * closed set of internal handlers (hook-handler.cjs), so this isn't
+ * remotely exploitable through Ruflo itself — but a malicious fork, PR, or
+ * compromised dependency that plants a bad settings.json before a user
+ * runs `ruflo init`/`--upgrade` in that directory would have its payload
+ * silently preserved and reported as a normal "merged"/"updated" result,
+ * with zero visibility.
+ *
+ * This scanner is advisory-only: it never mutates its input and never
+ * blocks a merge/write. Callers decide what to do with the findings
+ * (surfaced as a CLI warning today).
+ *
+ * KNOWN LIMITATION (found by an independent adversarial review the same
+ * night this was written — see docs/dream-cycle/dream-gist-2026-08-16.md
+ * §5): this is a best-effort, static, blocklist-style heuristic, NOT a
+ * security boundary. It catches copy-pasted proof-of-concept payload
+ * shapes; it does not and cannot catch every obfuscation a motivated
+ * adversary could construct (string-built commands, uncommon interpreters,
+ * novel exfil channels, etc). Treat findings as "worth a second look,"
+ * never as a guarantee of safety.
+ */
+const DANGEROUS_COMMAND_WORDS = [
+    'rm', 'rmdir', 'del', 'format', 'mkfs', 'dd', 'chmod', 'chown',
+    'kill', 'killall', 'pkill', 'reboot', 'shutdown', 'poweroff', 'halt',
+    'sudo', 'eval',
+];
+// Words that make a *hook command string* look risky when combined with a
+// downloader (curl/wget) or a decode step (base64) anywhere in the same
+// string — deliberately co-occurrence-based, not strict adjacency/piping,
+// since `curl … -o f && sh f` and `curl … | tee x | bash` both reach the
+// same outcome as the textbook `curl … | bash` and a strict pipe-adjacency
+// regex misses both (found by adversarial review).
+const SHELL_EXEC_WORDS = ['bash', 'sh', 'zsh', 'python', 'python3', 'perl', 'ruby', 'eval'];
+const DOWNLOADER_WORDS = ['curl', 'wget'];
+const STANDALONE_RISK_PATTERNS = [
+    /\bInvoke-Expression\b/i,
+    /\biex\s*\(/i,
+    /powershell(\.exe)?\s+.*-e(nc(odedcommand)?)?\s+\S/i,
+    /\/dev\/tcp\//i,
+    /\bnc\s+-e\b/i,
+    /base64\s+(-d|--decode)\b/i,
+];
+// Words a Bash allow-rule should never blanket-preapprove without a
+// specific argument scope, even though they aren't "dangerous" on their
+// own the way `rm`/`chmod` are — pre-approving them removes the human
+// review step for exactly the commands download-and-execute attacks use.
+const RISKY_PREAPPROVE_WORDS = [...DANGEROUS_COMMAND_WORDS, ...SHELL_EXEC_WORDS, ...DOWNLOADER_WORDS];
+function wordBoundaryMatches(text, word) {
+    return new RegExp(`\\b${word}\\b`, 'i').test(text);
+}
+/** Reasons a single hook `command` string looks risky (empty = clean). */
+export function scanCommandStringForRisk(command) {
+    const reasons = [];
+    for (const pattern of STANDALONE_RISK_PATTERNS) {
+        if (pattern.test(command)) {
+            reasons.push('matches a known-dangerous execution pattern (encoded/remote command execution)');
+            break;
+        }
+    }
+    const hasDownloader = DOWNLOADER_WORDS.some((w) => wordBoundaryMatches(command, w));
+    const hasShellExec = SHELL_EXEC_WORDS.some((w) => wordBoundaryMatches(command, w));
+    if (hasDownloader && hasShellExec) {
+        reasons.push('combines a downloader (curl/wget) with a shell/interpreter invocation in the same command');
+    }
+    for (const word of DANGEROUS_COMMAND_WORDS) {
+        if (wordBoundaryMatches(command, word)) {
+            reasons.push(`invokes dangerous command "${word}"`);
+        }
+    }
+    return reasons;
+}
+/** Reasons a single `permissions.allow` rule string looks risky (empty = clean). */
+export function scanAllowRuleForRisk(rule) {
+    const trimmed = rule.trim();
+    const reasons = [];
+    if (/^Bash\(\s*\*\s*(:\s*\*\s*)?\)$/i.test(trimmed)) {
+        reasons.push('grants unrestricted Bash execution (wildcard allow rule)');
+    }
+    for (const word of RISKY_PREAPPROVE_WORDS) {
+        if (new RegExp(`^Bash\\(\\s*${word}\\s*(:| |\\))`, 'i').test(trimmed)) {
+            reasons.push(`pre-allows "${word}" with no per-call confirmation`);
+        }
+    }
+    return reasons;
+}
+/**
+ * Strips ANSI/control characters from untrusted text before it's ever
+ * embedded in a CLI warning string. Without this, a malicious hook command
+ * could use escape sequences to spoof or corrupt the terminal output of
+ * the very warning meant to flag it (found during this candidate's own
+ * security review — not part of the CVE-2025-59536 class itself, but the
+ * same "untrusted settings.json content reaches the user's terminal"
+ * shape, so it gets the same treatment here rather than being left open).
+ */
+function sanitizeForDisplay(text) {
+    // eslint-disable-next-line no-control-regex
+    return text.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
+}
+function buildSnippet(text) {
+    const clean = sanitizeForDisplay(text);
+    return clean.length > 120 ? `${clean.slice(0, 120)}…` : clean;
+}
+/**
+ * Scans a settings.json-shaped object's `hooks` and `permissions.allow`
+ * for content matching known-dangerous patterns.
+ */
+export function scanSettingsForRisk(settings) {
+    const findings = [];
+    const hooks = settings.hooks;
+    if (hooks && typeof hooks === 'object') {
+        for (const [eventName, groups] of Object.entries(hooks)) {
+            if (!Array.isArray(groups))
+                continue;
+            groups.forEach((group, groupIdx) => {
+                const hookList = group?.hooks;
+                if (!Array.isArray(hookList))
+                    return;
+                hookList.forEach((h, hookIdx) => {
+                    if (typeof h?.command !== 'string')
+                        return;
+                    for (const reason of scanCommandStringForRisk(h.command)) {
+                        findings.push({
+                            location: `hooks.${eventName}[${groupIdx}].hooks[${hookIdx}]`,
+                            snippet: buildSnippet(h.command),
+                            reason,
+                        });
+                    }
+                });
+            });
+        }
+    }
+    const allow = settings.permissions?.allow;
+    if (Array.isArray(allow)) {
+        allow.forEach((rule, idx) => {
+            if (typeof rule !== 'string')
+                return;
+            for (const reason of scanAllowRuleForRisk(rule)) {
+                findings.push({
+                    location: `permissions.allow[${idx}]`,
+                    snippet: buildSnippet(rule),
+                    reason,
+                });
+            }
+        });
+    }
+    return findings;
+}
+/** Formats findings as short, human-readable CLI warning lines. */
+export function formatRiskFindingsAsWarnings(findings) {
+    return findings.map((f) => `${f.location}: ${f.reason} — "${f.snippet}"`);
+}
+//# sourceMappingURL=settings-risk-scanner.js.map

package/dist/src/init/types.d.ts

@@ -327,5 +327,12 @@ export interface InitResult {
         agentsCount: number;
         hooksEnabled: number;
     };
+    /**
+     * Advisory-only findings from settings-risk-scanner.ts: dangerous-looking
+     * hook commands or Bash allow-rules found in a *pre-existing*
+     * settings.json this init carried forward unexamined. Never blocks
+     * init — surfaced so a user can review before trusting it.
+     */
+    warnings?: string[];
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/src/mcp-tools/hooks-tools.js

@@ -392,7 +392,7 @@ const activeTrajectories = new Map();
 const MEMORY_DIR = '.claude-flow/memory';
 const MEMORY_FILE = 'store.json';
 function getMemoryPath() {
-    return resolve(join(MEMORY_DIR, MEMORY_FILE));
+    return resolve(join(getProjectCwd(), MEMORY_DIR, MEMORY_FILE));
 }
 function loadMemoryStore() {
     try {
@@ -407,6 +407,80 @@ function loadMemoryStore() {
     }
     return { entries: {}, version: '3.0.0' };
 }
+function isLearnedPatternEntry(entry) {
+    return entry.key.includes('pattern') ||
+        entry.metadata?.type === 'pattern' ||
+        entry.key.startsWith('learned-') ||
+        entry.namespace === 'patterns' ||
+        entry.metadata?.type === 'routing-decision';
+}
+function timestampInRange(value, start, end) {
+    if (typeof value !== 'string' && typeof value !== 'number')
+        return false;
+    const timestamp = typeof value === 'number' ? value : Date.parse(value);
+    return Number.isFinite(timestamp) && timestamp >= start && timestamp <= end;
+}
+function nonNegativeInteger(value) {
+    return typeof value === 'number' && Number.isFinite(value)
+        ? Math.max(0, Math.floor(value))
+        : 0;
+}
+function loadActiveSessionState() {
+    try {
+        const sessionPath = join(getProjectCwd(), '.claude-flow', 'sessions', 'current.json');
+        if (!existsSync(sessionPath))
+            return null;
+        const session = JSON.parse(readFileSync(sessionPath, 'utf-8'));
+        if (typeof session.id !== 'string' || session.id.trim().length === 0)
+            return null;
+        if (typeof session.startedAt !== 'string' || !Number.isFinite(Date.parse(session.startedAt)))
+            return null;
+        return session;
+    }
+    catch {
+        return null;
+    }
+}
+function loadSessionActivity(session, endedAt) {
+    const startedAt = Date.parse(session.startedAt);
+    let tasksCompleted = 0;
+    try {
+        const taskPath = join(getProjectCwd(), '.claude-flow', 'tasks', 'store.json');
+        if (existsSync(taskPath)) {
+            const store = JSON.parse(readFileSync(taskPath, 'utf-8'));
+            for (const task of Object.values(store.tasks ?? {})) {
+                if (task.status === 'completed' && timestampInRange(task.completedAt, startedAt, endedAt)) {
+                    tasksCompleted++;
+                }
+            }
+        }
+    }
+    catch {
+        // Missing or malformed task state contributes no completed tasks.
+    }
+    const patternsLearned = Object.values(loadMemoryStore().entries)
+        .filter(entry => isLearnedPatternEntry(entry) && timestampInRange(entry.storedAt, startedAt, endedAt))
+        .length;
+    return {
+        tasksCompleted,
+        patternsLearned,
+        editsRecorded: nonNegativeInteger(session.metrics?.edits),
+        commandsRecorded: nonNegativeInteger(session.metrics?.commands),
+        errorsRecorded: nonNegativeInteger(session.metrics?.errors),
+    };
+}
+function buildSessionSummary(activity, duration) {
+    const durationMinutes = Math.max(0, Math.round(duration / 60000));
+    const count = (value, singular, plural = `${singular}s`) => `${value} ${value === 1 ? singular : plural}`;
+    return [
+        `${count(activity.tasksCompleted, 'task')} completed`,
+        `${count(activity.patternsLearned, 'pattern')} learned`,
+        `${count(activity.editsRecorded, 'edit')} recorded`,
+        `${count(activity.commandsRecorded, 'command')} recorded`,
+        `${count(activity.errorsRecorded, 'error')} recorded`,
+        `duration ${count(durationMinutes, 'minute')}`,
+    ].join('; ');
+}
 /**
  * Get real intelligence statistics from memory store
  */
@@ -428,11 +502,7 @@ function getIntelligenceStatsFromMemory() {
     // patterns the metric is meant to count, so include them: any entry
     // whose namespace is `patterns`, plus the original shapes for
     // forward-compatibility with a future explicit `pattern` writer.
-    const patternEntries = entries.filter(e => e.key.includes('pattern') ||
-        e.metadata?.type === 'pattern' ||
-        e.key.startsWith('learned-') ||
-        e.namespace === 'patterns' ||
-        e.metadata?.type === 'routing-decision');
+    const patternEntries = entries.filter(isLearnedPatternEntry);
     // Categorize patterns
     const categories = {};
     patternEntries.forEach(e => {
@@ -2144,7 +2214,15 @@ export const hooksSessionEnd = {
     handler: async (params) => {
         const saveState = params.saveState !== false;
         const shouldStopDaemon = params.stopDaemon !== false;
-        const sessionId = `session-${Date.now() - 3600000}`; // Default session (1 hour ago)
+        const session = loadActiveSessionState();
+        if (!session) {
+            throw new Error('No active session state found at .claude-flow/sessions/current.json');
+        }
+        const sessionId = session.id;
+        const endedAt = Date.now();
+        const duration = Math.max(0, endedAt - Date.parse(session.startedAt));
+        const activity = loadSessionActivity(session, endedAt);
+        const summary = buildSessionSummary(activity, duration);
         // Stop daemon if enabled
         let daemonStopped = false;
         if (shouldStopDaemon) {
@@ -2157,12 +2235,10 @@ export const hooksSessionEnd = {
                 // Daemon may not be running
             }
         }
-        // Read actual counts from stores
+        // Read aggregate store data for the remaining compatibility metrics.
         const store = loadMemoryStore();
         const allEntries = Object.values(store.entries);
-        const taskCount = allEntries.filter(e => e.key.includes('task')).length;
         const agentCount = allEntries.filter(e => e.key.includes('agent')).length;
-        const patternCount = allEntries.filter(e => e.key.includes('pattern')).length;
         const trajectoryCount = activeTrajectories.size;
         // Check for pending-insights.jsonl
         let insightCount = 0;
@@ -2183,9 +2259,9 @@ export const hooksSessionEnd = {
             bridge = await import('../memory/memory-bridge.js');
             const result = await bridge.bridgeSessionEnd({
                 sessionId,
-                summary: saveState ? 'Session ended with state saved' : 'Session ended',
-                tasksCompleted: taskCount,
-                patternsLearned: patternCount,
+                summary,
+                tasksCompleted: activity.tasksCompleted,
+                patternsLearned: activity.patternsLearned,
             });
             if (result) {
                 sessionPersistence = {
@@ -2210,19 +2286,19 @@ export const hooksSessionEnd = {
         }
         return {
             sessionId,
-            duration: 3600000, // 1 hour in ms
+            duration,
             statePath: saveState ? `.claude/sessions/${sessionId}.json` : undefined,
             daemon: { stopped: daemonStopped },
             sessionPersistence: sessionPersistence || { controller: 'none', persisted: false },
             summary: {
-                tasksExecuted: taskCount,
-                filesModified: 0,
+                tasksExecuted: activity.tasksCompleted,
+                filesModified: activity.editsRecorded,
                 agentsSpawned: agentCount,
                 pendingInsights: insightCount,
                 memoryEntries: allEntries.length,
             },
             learningUpdates: {
-                patternsLearned: patternCount,
+                patternsLearned: activity.patternsLearned,
                 trajectoriesRecorded: trajectoryCount,
             },
         };

package/dist/src/memory/memory-bridge.js

@@ -936,11 +936,22 @@ export async function bridgeStoreEntry(options) {
                 persistWarning = `sql.js fallback driver in use — this write may not be durably persisted to disk (${msg}). Install better-sqlite3's native binding to restore durable writes (see issue #2968: npm rebuild better-sqlite3, or reinstall with install scripts enabled).`;
             }
         }
-        // Phase 2: Write-through to TieredCache
+        // Phase 2: Invalidate cache so the next read fetches the fresh row.
+        //
+        // #3051 — this used to be a write-through with a partial payload
+        // (`{ id, key, namespace, content, embedding }` — missing `tags`,
+        // access_count, timestamps, metadata, provenance_type). Any read that
+        // hit the cache then returned `tags: cached.tags || []` = `[]` for the
+        // very entry that had just been written with real tags, so
+        // `memory_store({ tags })` → `memory_retrieve()` looked like it silently
+        // dropped tags. Invalidating instead of partial-cache-set forces the
+        // next `bridgeGetEntry` to load the authoritative row (which correctly
+        // parses tags/metadata from the JSON columns) and repopulate the cache
+        // from that full shape.
         const safeNs = String(namespace).replace(/:/g, '_');
         const safeKey = String(key).replace(/:/g, '_');
         const cacheKey = `entry:${safeNs}:${safeKey}`;
-        await cacheSet(registry, cacheKey, { id, key, namespace, content: value, embedding: embeddingJson });
+        await cacheInvalidate(registry, cacheKey);
         // Phase 4: AttestationLog write audit
         await logAttestation(registry, 'store', id, { key, namespace, hasEmbedding: !!embeddingJson });
         return {

package/dist/src/runtime/claude-command.d.ts

@@ -0,0 +1,21 @@
+export interface ClaudeLaunchCommand {
+    command: string;
+    argsPrefix: string[];
+}
+interface ClaudeCommandResolverOptions {
+    platform?: NodeJS.Platform;
+    nodeExecutable?: string;
+    lookup?: (command: string, args: string[]) => string;
+    fileExists?: (path: string) => boolean;
+}
+/**
+ * Resolve Claude Code to a target that Node can spawn without a shell.
+ *
+ * Windows npm shims (`claude.cmd` and `claude.ps1`) are shell scripts and
+ * cannot be passed directly to spawn with `shell: false`. Resolve the native
+ * executable used by current Claude Code releases, or the JavaScript entry
+ * used by older releases, while keeping user-provided prompts out of a shell.
+ */
+export declare function resolveClaudeLaunchCommand(options?: ClaudeCommandResolverOptions): ClaudeLaunchCommand | null;
+export {};
+//# sourceMappingURL=claude-command.d.ts.map

package/dist/src/runtime/claude-command.js

@@ -0,0 +1,49 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { posix, win32 } from 'node:path';
+/**
+ * Resolve Claude Code to a target that Node can spawn without a shell.
+ *
+ * Windows npm shims (`claude.cmd` and `claude.ps1`) are shell scripts and
+ * cannot be passed directly to spawn with `shell: false`. Resolve the native
+ * executable used by current Claude Code releases, or the JavaScript entry
+ * used by older releases, while keeping user-provided prompts out of a shell.
+ */
+export function resolveClaudeLaunchCommand(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const path = platform === 'win32' ? win32 : posix;
+    const nodeExecutable = options.nodeExecutable ?? process.execPath;
+    const lookup = options.lookup ?? ((command, args) => execFileSync(command, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }));
+    const fileExists = options.fileExists ?? existsSync;
+    let matches;
+    try {
+        const output = platform === 'win32'
+            ? lookup('where.exe', ['claude'])
+            : lookup('which', ['claude']);
+        matches = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    }
+    catch {
+        return null;
+    }
+    if (platform !== 'win32') {
+        const command = matches.find(fileExists);
+        return command ? { command, argsPrefix: [] } : null;
+    }
+    const executable = matches.find((candidate) => path.extname(candidate).toLowerCase() === '.exe' && fileExists(candidate));
+    if (executable)
+        return { command: executable, argsPrefix: [] };
+    for (const shim of matches) {
+        const npmBin = path.dirname(shim);
+        const packageRoot = path.join(npmBin, 'node_modules', '@anthropic-ai', 'claude-code');
+        const nativeExecutable = path.join(packageRoot, 'bin', 'claude.exe');
+        if (fileExists(nativeExecutable)) {
+            return { command: nativeExecutable, argsPrefix: [] };
+        }
+        const javascriptEntry = path.join(packageRoot, 'cli.js');
+        if (fileExists(javascriptEntry)) {
+            return { command: nodeExecutable, argsPrefix: [javascriptEntry] };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=claude-command.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.38.13",
+  "version": "3.38.15",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",