@claude-flow/cli 3.38.19 → 3.38.21

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.38.18
+3.38.21

package/.claude/helpers/helpers.manifest.json

@@ -1,13 +1,13 @@
 {
   "manifest": {
-    "version": "3.38.19",
+    "version": "3.38.21",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
       "intelligence.cjs": "30e42ed7ec4ca5a94ac54fdb1330d2d47ac5f3fdeeef207753574723a9e77b5c",
-      "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
+      "statusline.cjs": "4a48353b4f1566fa4379b00fd0321b6676a22b6cc91fbbd8380ac5183d619468"
     }
   },
-  "signature": "5S+Xkm6C/esSRRBwK6dMHJb3cZpmDex5iYgaXTzD9+gmb7SsbivX2rdU3LuNXh7aGl0aelQpyi/OHIGCHYkNBg==",
+  "signature": "wxXkWxgHyxCi4QwBfHeomKd+yB4yFN7BGjt34e4fo/Y8TuhUuRqSiw7y+WV2euDa734J/lEx9mP7xMwg4dw2Cw==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/statusline.cjs

@@ -556,6 +556,68 @@ function getLocalSecurity(cliSecurity) {
   return base;
 }
 
+// Cached pattern count. The store is routinely >10MB (14.5MB / 1277 patterns on
+// the machine this was diagnosed on, costing 53ms to read+parse), and the
+// statusline re-renders on every prompt, so the parse is keyed on the file's
+// mtime+size and reused until the store actually changes.
+const PATTERN_COUNT_CACHE = path.join(os.tmpdir(), 'ruflo-statusline-patterns-' + require('crypto').createHash('md5').update(CWD).digest('hex').slice(0, 8) + '.json');
+
+function countPatternsCached(file) {
+  let stat;
+  try { stat = fs.statSync(file); } catch { return 0; }
+  const key = stat.mtimeMs + ':' + stat.size;
+
+  try {
+    const memo = JSON.parse(fs.readFileSync(PATTERN_COUNT_CACHE, 'utf-8'));
+    if (memo && memo[file] && memo[file].key === key) return memo[file].count;
+  } catch { /* no memo yet, or unreadable — fall through and recount */ }
+
+  let count = 0;
+  try {
+    const raw = JSON.parse(fs.readFileSync(file, 'utf-8'));
+    if (Array.isArray(raw)) count = raw.length;
+    else if (raw && Array.isArray(raw.patterns)) count = raw.patterns.length;
+    else if (raw && typeof raw === 'object') count = Object.keys(raw).length;
+  } catch { return 0; }
+
+  try {
+    let memo = {};
+    try { memo = JSON.parse(fs.readFileSync(PATTERN_COUNT_CACHE, 'utf-8')) || {}; } catch { /* start fresh */ }
+    memo[file] = { key, count };
+    fs.writeFileSync(PATTERN_COUNT_CACHE, JSON.stringify(memo));
+  } catch { /* cache is an optimisation, never a requirement */ }
+
+  return count;
+}
+
+// `system` is nominally CLI-populated, but the pattern store is on disk, so a
+// dead CLI must not render as "no learning". Without this, every candidate in
+// resolveCliBinCandidates() failing (a source-only marketplace checkout, or an
+// npx fetch that dies in a workspace root) silently degraded the brain to a
+// hardcoded 0% while the overlaid segments beside it kept showing live data —
+// indistinguishable from a genuine zero. Same reasoning as getLocalAgentDB(),
+// which had to start reading locally after the statusline reported "Vectors 0"
+// on a database holding thousands.
+function getLocalIntelligence(current) {
+  const base = (current && typeof current === 'object') ? current : {};
+  if (typeof base.intelligencePct === 'number' && base.intelligencePct > 0) return base;
+
+  for (const file of [
+    path.join(CWD, '.claude-flow', 'neural', 'patterns.json'),
+    path.join(os.homedir(), '.claude-flow', 'neural', 'patterns.json'),
+  ]) {
+    const n = countPatternsCached(file);
+    if (n > 0) {
+      base.intelligencePct = Math.min(100, Math.floor(n / 10));
+      return base;
+    }
+  }
+
+  // No CLI value and no local store: unknown, which is not the same as zero.
+  base.intelligencePct = null;
+  return base;
+}
+
 // Overlay every locally-derived block onto the CLI data (mutates in place).
 function applyLocalOverlays(data) {
   data.adrs = getLocalADRCount();
@@ -566,6 +628,7 @@ function applyLocalOverlays(data) {
   // Security overlay: recompute freshness from disk on every render so cached
   // CLI JSON can never freeze the pill at PENDING. See getLocalSecurity() above.
   data.security = getLocalSecurity(data.security);
+  data.system = getLocalIntelligence(data.system);
   return data;
 }
 
@@ -579,7 +642,7 @@ function buildLocalFallback() {
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
     security: { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
-    system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
+    system: { memoryMB: memMB, contextPct: 0, intelligencePct: null, subAgents: 0 },
     lastUpdated: new Date().toISOString(),
   });
 }
@@ -941,7 +1004,11 @@ function generateStatusline() {
   const activeAgents = swarm.activeAgents || 0;
   const maxAgents = swarm.maxAgents || CONFIG.maxAgents;
   const coordinationActive = swarm.coordinationActive || false;
-  const intelligencePct = system.intelligencePct || 0;
+  // null/undefined means "no source answered", which must not collapse to 0 --
+  // that is exactly the ambiguity this segment used to present.
+  const intelligencePct = (typeof system.intelligencePct === 'number')
+    ? system.intelligencePct
+    : null;
   const memoryMB = system.memoryMB || 0;
   const subAgents = system.subAgents || 0;
   const findings = Math.max(0, security.findings || 0);
@@ -997,14 +1064,14 @@ function generateStatusline() {
   // do next; diagnostic detail moves to `ruflo status --verbose`.
   const agentsColor = activeAgents > 0 ? c.brightGreen : c.dim;
   const hooksColor = hooksEnabled > 0 ? c.brightGreen : c.dim;
-  const intellColor = intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
+  const intellColor = intelligencePct === null ? c.dim : intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
   const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset + ' ' : c.dim + '○' + c.reset + ' ';
   const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && findings === 0;
   const opsParts = [];
   opsParts.push(c.cyan + 'Swarm ' + swarmInd + agentsColor + activeAgents + c.reset + '/' + c.brightWhite + maxAgents + c.reset);
   if (subAgents > 0) opsParts.push(c.brightPurple + '👥 ' + subAgents + c.reset);
   opsParts.push(c.cyan + 'Hooks ' + hooksColor + hooksEnabled + c.reset + '/' + c.brightWhite + hooksTotal + c.reset);
-  opsParts.push(intellColor + '🧠 ' + intelligencePct + '%' + c.reset);
+  opsParts.push(intellColor + '🧠 ' + (intelligencePct === null ? '—' : intelligencePct + '%') + c.reset);
   opsParts.push(c.brightCyan + '💾 ' + memoryMB + 'MB' + c.reset);
   // Health: one glyph when green, terse copy when there's something to act on.
   if (healthAllGreen) {

package/catalog-manifest.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": 1,
-  "generation": 5,
-  "generatedAt": "2026-08-22T16:29:46.759Z",
-  "gitSha": "127a6546",
+  "generation": 6,
+  "generatedAt": "2026-09-02T13:38:52.286Z",
+  "gitSha": "b3db0180",
   "catalog": {
-    "agents": 165,
+    "agents": 167,
     "tools": 397,
     "skills": 34
   },

package/dist/src/commands/proxy-lifecycle.js

@@ -7,7 +7,8 @@
  */
 import { output } from '../output.js';
 import { hasConsent, recordConsent, revokeConsent } from '../funnel/index.js';
-import { installProxy, uninstallProxy } from '../proxy/install.js';
+import { uninstallProxy } from '../proxy/install.js';
+import { installAndActivateProxy } from '../proxy/activation.js';
 import { startForeground, startBackground, stopProxy, getProxyStatus, readProxyLogTail, watchProxyLog, ProxyNotInstalledError, ProxyAlreadyRunningError, } from '../proxy/lifecycle.js';
 import { proxyTokenPath } from '../proxy/paths.js';
 import { removeInjectedToken, startTokenRefreshPump } from '../proxy/token-bridge.js';
@@ -135,8 +136,8 @@ const installSub = {
         try {
             const spinner = output.createSpinner({ text: `Installing meta-proxy ${version}...`, spinner: 'dots' });
             spinner.start();
-            const result = await installProxy({ version, log: (line) => spinner.setText(line) });
-            spinner.succeed(`meta-proxy ${version} installed`);
+            const result = await installAndActivateProxy(version, (line) => spinner.setText(line));
+            spinner.succeed(`meta-proxy ${version} installed and verified effective`);
             output.writeln(`  binary: ${result.binaryPath}`);
             output.writeln(`  sha256: ${result.sha256}`);
             return { success: true, data: result };
@@ -172,8 +173,8 @@ const updateSub = {
         try {
             const spinner = output.createSpinner({ text: `Updating meta-proxy to ${version}...`, spinner: 'dots' });
             spinner.start();
-            const result = await installProxy({ version, log: (line) => spinner.setText(line) });
-            spinner.succeed(`meta-proxy updated to ${version}`);
+            const result = await installAndActivateProxy(version, (line) => spinner.setText(line));
+            spinner.succeed(`meta-proxy updated to ${version} and verified effective`);
             output.writeln(`  binary: ${result.binaryPath}`);
             return { success: true, data: result };
         }

package/dist/src/log-filters.d.ts

@@ -40,7 +40,7 @@ declare const STDERR_REDIRECT_PREFIXES: string[];
 declare const AGENTDB_MOCK_FALLBACK_DROP_PREFIXES: string[];
 declare const shouldRedirectToStderr: (msg: unknown) => boolean;
 declare const isAgentdbMockFallbackNoise: (msg: unknown) => boolean;
-declare const origWarn: (message?: any, ...optionalParams: any[]) => void;
-declare const origLog: (message?: any, ...optionalParams: any[]) => void;
-declare const origError: (message?: any, ...optionalParams: any[]) => void;
+declare const origWarn: (...data: any[]) => void;
+declare const origLog: (...data: any[]) => void;
+declare const origError: (...data: any[]) => void;
 //# sourceMappingURL=log-filters.d.ts.map

package/dist/src/memory/memory-initializer.js

@@ -1250,13 +1250,33 @@ export async function checkAndMigrateLegacy(options) {
  * (ReasoningBank, SkillLibrary, ExplainableRecall, etc.) are instantiated.
  *
  * Uses the memory-bridge's getControllerRegistry() which lazily creates
- * a singleton ControllerRegistry and initializes it with the given dbPath.
- * After this call, all enabled controllers are ready for immediate use.
+ * a singleton ControllerRegistry. Deliberately called with NO dbPath so the
+ * bridge resolves its own dedicated file via `getAgentDbPath()` — the same
+ * resolution every other bridge call (bridgeStoreEntry, bridgeGetEntry, ...)
+ * uses when it omits `dbPath`. After this call, all enabled controllers are
+ * ready for immediate use.
  *
- * Failures are isolated: if @claude-flow/memory or agentdb is not installed,
- * this returns an empty result without throwing.
+ * #3155: this used to be called with the sql.js-facing `memory.db` path
+ * (the one just written by the block above, via `resolveDbPath()`), which
+ * seeded the process-wide ControllerRegistry singleton with THAT file as
+ * AgentDB's native better-sqlite3 database — instead of the dedicated
+ * `agentdb-memory.db` sibling `getAgentDbPath()` exists specifically to
+ * provide (#2786, so native better-sqlite3 doesn't hit a possibly-encrypted
+ * `memory.db`). Because `initializeMemoryDatabase()` only reaches this call
+ * on a database's FIRST-EVER init (the `#1791.6` already-exists branch above
+ * returns early without activating anything), a bridge started against a
+ * brand-new `.swarm/` directory would activate the registry against
+ * `memory.db`, store/retrieve correctly for that process's lifetime, and
+ * then a SUBSEQUENT process — where `.swarm/memory.db` already exists so
+ * this init path is skipped — would have its first bridge call activate the
+ * registry against `agentdb-memory.db` instead (via the `dbPath ||
+ * getAgentDbPath()` fallback in memory-bridge.ts's `getRegistry()`), an
+ * empty file that never received the earlier writes. Restarting the bridge
+ * therefore silently lost read access to everything it had written, with no
+ * error anywhere. Passing no dbPath here makes both code paths agree on
+ * `agentdb-memory.db` every time, regardless of init history.
  */
-async function activateControllerRegistry(dbPath, verbose) {
+async function activateControllerRegistry(verbose) {
     const startTime = performance.now();
     const activated = [];
     const failed = [];
@@ -1265,7 +1285,7 @@ async function activateControllerRegistry(dbPath, verbose) {
         if (!bridge) {
             return { activated, failed, initTimeMs: performance.now() - startTime };
         }
-        const registry = await bridge.getControllerRegistry(dbPath);
+        const registry = await bridge.getControllerRegistry();
         if (!registry) {
             return { activated, failed, initTimeMs: performance.now() - startTime };
         }
@@ -1708,7 +1728,7 @@ export async function initializeMemoryDatabase(options) {
             fs.writeFileSync(schemaPath, MEMORY_SCHEMA_V3 + '\n' + getInitialMetadata(backend));
             // ADR-053: Activate ControllerRegistry so controllers (ReasoningBank,
             // SkillLibrary, ExplainableRecall, etc.) are instantiated during init
-            const controllerResult = await activateControllerRegistry(dbPath, verbose);
+            const controllerResult = await activateControllerRegistry(verbose);
             return {
                 success: true,
                 backend,
@@ -1768,7 +1788,7 @@ export async function initializeMemoryDatabase(options) {
             sqliteHeader[27] = 0x20; // leaf payload
             writeFileRestricted(dbPath, sqliteHeader, { encrypt: true });
             // ADR-053: Activate ControllerRegistry even on fallback path
-            const controllerResult = await activateControllerRegistry(dbPath, verbose);
+            const controllerResult = await activateControllerRegistry(verbose);
             return {
                 success: true,
                 backend,

package/dist/src/proxy/activation.d.ts

@@ -0,0 +1,14 @@
+import { type InstallResult } from './install.js';
+export interface EffectiveProxy {
+    version: string;
+    pid: number;
+    executable: string;
+}
+type Wait = (milliseconds: number) => Promise<void>;
+export declare function probeEffectiveProxy(fetcher?: typeof fetch, platform?: NodeJS.Platform): Promise<EffectiveProxy | null>;
+export declare function acquireProxyInstallLease(wait?: Wait): Promise<() => void>;
+export declare function installAndActivateProxy(version: string, log?: (line: string) => void): Promise<InstallResult & {
+    pid: number;
+}>;
+export {};
+//# sourceMappingURL=activation.d.ts.map

package/dist/src/proxy/activation.js

@@ -0,0 +1,210 @@
+/** Transactional activation of the daemon that actually owns the proxy port. */
+import { spawn, spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+import { installProxy } from './install.js';
+import { isLoopbackBind, proxyBinaryPath, proxyConfigPath, proxyInstallLockPath, proxyInstallManifestPath, proxyLogFilePath, proxyPidFilePath, } from './paths.js';
+const waitNormally = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+function processExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function effectiveEndpoint() {
+    let bind = '127.0.0.1:11435';
+    try {
+        const match = fs.readFileSync(proxyConfigPath(), 'utf8').match(/^bind\s*=\s*"([^"]+)"\s*$/m);
+        if (match?.[1])
+            bind = match[1];
+    }
+    catch { /* documented default */ }
+    if (!isLoopbackBind(bind))
+        throw new Error(`Refusing to probe non-loopback Meta-Proxy bind "${bind}".`);
+    return `http://${bind}`;
+}
+function executableFor(pid, platform) {
+    try {
+        if (platform === 'linux') {
+            const result = spawnSync('readlink', ['-f', `/proc/${pid}/exe`], { encoding: 'utf8', timeout: 2_000 });
+            return result.status === 0 ? result.stdout.trim() || null : null;
+        }
+        if (platform === 'win32') {
+            const command = `$p = Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}'; if ($null -ne $p) { [Console]::Out.Write($p.ExecutablePath) }`;
+            const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', command], { encoding: 'utf8', timeout: 2_000, windowsHide: true });
+            return result.status === 0 ? result.stdout.trim() || null : null;
+        }
+        const result = spawnSync('ps', ['-p', String(pid), '-o', 'comm='], { encoding: 'utf8', timeout: 2_000 });
+        return result.status === 0 ? result.stdout.trim() || null : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isSupportedOwner(executable, platform) {
+    const name = platform === 'win32' ? 'meta-proxy.exe' : 'meta-proxy';
+    const normalize = (value) => platform === 'win32' ? path.resolve(value).toLowerCase() : path.resolve(value);
+    const allowed = [
+        proxyBinaryPath(),
+        path.join(homedir(), '.metaharness', 'meta-proxy', 'bin', name),
+        path.join(homedir(), '.metaharness', 'bin', name),
+        path.join(homedir(), '.cargo', 'bin', name),
+    ].map(normalize);
+    return allowed.includes(normalize(executable));
+}
+export async function probeEffectiveProxy(fetcher = globalThis.fetch, platform = process.platform) {
+    const endpoint = effectiveEndpoint();
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 1_000);
+        let response;
+        try {
+            response = await fetcher(`${endpoint}/version`, { signal: controller.signal });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!response.ok)
+            return null;
+        const body = await response.json();
+        if (typeof body.version !== 'string' || !/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(body.version))
+            return null;
+        if (!Number.isSafeInteger(body.pid) || Number(body.pid) <= 0)
+            return null;
+        const executable = executableFor(Number(body.pid), platform);
+        return executable ? { version: body.version, pid: Number(body.pid), executable } : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function acquireProxyInstallLease(wait = waitNormally) {
+    const lock = proxyInstallLockPath();
+    fs.mkdirSync(path.dirname(lock), { recursive: true, mode: 0o700 });
+    for (let attempt = 0; attempt < 200; attempt++) {
+        try {
+            fs.mkdirSync(lock, { mode: 0o700 });
+            fs.writeFileSync(path.join(lock, 'owner'), `${process.pid}\n`, { mode: 0o600 });
+            return () => fs.rmSync(lock, { recursive: true, force: true });
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const age = Date.now() - fs.statSync(lock).mtimeMs;
+                const owner = Number.parseInt(fs.readFileSync(path.join(lock, 'owner'), 'utf8').trim(), 10);
+                if (age > 120_000 && (!Number.isSafeInteger(owner) || owner <= 0 || !processExists(owner))) {
+                    fs.rmSync(lock, { recursive: true, force: true });
+                    continue;
+                }
+            }
+            catch { /* another installer may still be writing its owner */ }
+            await wait(50);
+        }
+    }
+    throw new Error('Another Ruflo/MetaHarness installer still owns the Meta-Proxy install lease.');
+}
+async function stopEffective(wait) {
+    const owner = await probeEffectiveProxy();
+    if (!owner)
+        return null;
+    if (!isSupportedOwner(owner.executable, process.platform)) {
+        throw new Error(`Meta-Proxy port owner pid ${owner.pid} is not a recognized Ruflo/MetaHarness binary; refusing to signal it.`);
+    }
+    process.kill(owner.pid, 'SIGTERM');
+    for (let attempt = 0; attempt < 40; attempt++) {
+        await wait(50);
+        const current = await probeEffectiveProxy();
+        if (!current || current.pid !== owner.pid)
+            return owner;
+    }
+    throw new Error(`Stale Meta-Proxy pid ${owner.pid} did not stop.`);
+}
+function launch(binary) {
+    fs.mkdirSync(path.dirname(proxyLogFilePath()), { recursive: true, mode: 0o700 });
+    const log = fs.openSync(proxyLogFilePath(), 'a', 0o600);
+    try {
+        const child = spawn(binary, [], { detached: true, stdio: ['ignore', log, log], windowsHide: true });
+        if (!child.pid)
+            throw new Error('Meta-Proxy did not return a process id.');
+        child.unref();
+        fs.writeFileSync(proxyPidFilePath(), `${child.pid}\n`, { mode: 0o600 });
+        return child.pid;
+    }
+    finally {
+        fs.closeSync(log);
+    }
+}
+async function launchAndVerify(binary, version, wait) {
+    const pid = launch(binary);
+    for (let attempt = 0; attempt < 100; attempt++) {
+        await wait(50);
+        const current = await probeEffectiveProxy();
+        if (current?.pid === pid && current.version === version && path.resolve(current.executable) === path.resolve(binary))
+            return current;
+        if (current && current.pid !== pid) {
+            try {
+                process.kill(pid, 'SIGTERM');
+            }
+            catch { /* already exited */ }
+            throw new Error(`Competing Meta-Proxy pid ${current.pid} won the port with version ${current.version}.`);
+        }
+    }
+    try {
+        process.kill(pid, 'SIGTERM');
+    }
+    catch { /* already exited */ }
+    throw new Error(`Meta-Proxy v${version} did not become the effective daemon.`);
+}
+export async function installAndActivateProxy(version, log) {
+    const wait = waitNormally;
+    const binary = proxyBinaryPath();
+    const manifest = proxyInstallManifestPath();
+    const binaryBackup = `${binary}.rollback`;
+    const manifestBackup = `${manifest}.rollback`;
+    let release = null;
+    let prior = null;
+    try {
+        release = await acquireProxyInstallLease(wait);
+        prior = await stopEffective(wait);
+        fs.rmSync(binaryBackup, { force: true });
+        fs.rmSync(manifestBackup, { force: true });
+        if (fs.existsSync(binary))
+            fs.copyFileSync(binary, binaryBackup);
+        if (fs.existsSync(manifest))
+            fs.copyFileSync(manifest, manifestBackup);
+        const installed = await installProxy({ version, log });
+        const effective = await launchAndVerify(installed.binaryPath, installed.version, wait);
+        return { ...installed, pid: effective.pid };
+    }
+    catch (error) {
+        const failure = error instanceof Error ? error.message : String(error);
+        if (fs.existsSync(binaryBackup)) {
+            try {
+                await stopEffective(wait);
+                fs.rmSync(binary, { force: true });
+                fs.renameSync(binaryBackup, binary);
+                fs.rmSync(manifest, { force: true });
+                if (fs.existsSync(manifestBackup))
+                    fs.renameSync(manifestBackup, manifest);
+                if (prior)
+                    await launchAndVerify(prior.executable === binary ? binary : prior.executable, prior.version, wait);
+            }
+            catch (rollbackError) {
+                throw new Error(`${failure} Rollback failed: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+            }
+            throw new Error(`${failure} Previous Meta-Proxy ${prior ? 'was restored and verified' : 'binary was restored; it was not running before the upgrade'}.`);
+        }
+        throw error;
+    }
+    finally {
+        fs.rmSync(binaryBackup, { force: true });
+        fs.rmSync(manifestBackup, { force: true });
+        release?.();
+    }
+}
+//# sourceMappingURL=activation.js.map

package/dist/src/proxy/install.js

@@ -143,6 +143,9 @@ export async function installProxy(opts) {
         const tmp = `${finalPath}.tmp`;
         fs.copyFileSync(extractedBinaryPath, tmp);
         fs.chmodSync(tmp, 0o755);
+        // The activation transaction has already stopped and backed up the old
+        // daemon. Windows rename does not replace an existing executable.
+        fs.rmSync(finalPath, { force: true });
         fs.renameSync(tmp, finalPath);
         const liveSha = sha256Hex(fs.readFileSync(finalPath));
         const manifest = {

package/dist/src/proxy/paths.d.ts

@@ -10,6 +10,8 @@ export declare function proxyPidFilePath(): string;
 export declare function proxyLockFilePath(): string;
 export declare function proxyLogFilePath(): string;
 export declare function proxyInstallManifestPath(): string;
+/** Shared by Ruflo and MetaHarness so two IDE windows cannot race an upgrade. */
+export declare function proxyInstallLockPath(): string;
 export declare function proxyConfigPath(): string;
 export declare function proxyTokenPath(): string;
 export declare function proxyInjectedTokenPath(): string;

package/dist/src/proxy/paths.js

@@ -23,6 +23,10 @@ export function proxyLogFilePath() {
 export function proxyInstallManifestPath() {
     return join(funnelStateDir(), 'proxy', 'install-manifest.json');
 }
+/** Shared by Ruflo and MetaHarness so two IDE windows cannot race an upgrade. */
+export function proxyInstallLockPath() {
+    return join(funnelStateDir(), 'meta-proxy-install.lock');
+}
 export function proxyConfigPath() {
     return join(funnelStateDir(), 'proxy-config.toml');
 }

package/node_modules/@claude-flow/security/dist/input-validator.d.ts

@@ -159,14 +159,14 @@ export declare const SpawnAgentSchema: z.ZodObject<{
     timeout: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
+    id?: string | undefined;
 }, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
+    id?: string | undefined;
 }>;
 /**
  * Task input schema
@@ -181,13 +181,13 @@ export declare const TaskInputSchema: z.ZodObject<{
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "low" | "medium" | "high" | "critical" | undefined;
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }, {
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "low" | "medium" | "high" | "critical" | undefined;
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }>;
 /**
@@ -234,16 +234,16 @@ export declare const ExecutorConfigSchema: z.ZodObject<{
     cwd: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
     allowSudo: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    timeout: number;
     allowedCommands: string[];
+    timeout: number;
     maxBuffer: number;
     allowSudo: boolean;
     blockedPatterns?: string[] | undefined;
     cwd?: string | undefined;
 }, {
     allowedCommands: string[];
-    timeout?: number | undefined;
     blockedPatterns?: string[] | undefined;
+    timeout?: number | undefined;
     maxBuffer?: number | undefined;
     cwd?: string | undefined;
     allowSudo?: boolean | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.38.19",
+  "version": "3.38.21",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/dist/src/ruvector/lattice-wasm.d.ts

@@ -1,14 +0,0 @@
-/** Default package name (ruvnet WASM convention); override with RUFLO_LATTICE_WASM_PKG. */
-export declare const LATTICE_WASM_PKG: string;
-export type LatticeModel = 'minilm' | 'bge' | 'paraphrase-minilm' | 'qwen3-0.6b' | string;
-export declare const DEFAULT_LATTICE_MODEL: LatticeModel;
-/** Is the Lattice WASM embedder installed + initializable? Cached; never throws. */
-export declare function latticeAvailable(): Promise<boolean>;
-/** The models Lattice reports (empty until availability is probed). */
-export declare function latticeModels(): LatticeModel[];
-/**
- * Embed `text` with `model` via Lattice WASM. Returns null on any failure so the
- * caller can fall through to the next tier. Never throws.
- */
-export declare function latticeEmbed(text: string, model?: LatticeModel): Promise<number[] | null>;
-//# sourceMappingURL=lattice-wasm.d.ts.map