@claude-flow/cli 3.38.20 → 3.38.22

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.38.18
+3.38.20

package/.claude/helpers/helpers.manifest.json

@@ -1,13 +1,13 @@
 {
   "manifest": {
-    "version": "3.38.20",
+    "version": "3.38.22",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
-      "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
+      "hook-handler.cjs": "209d9fafe10e17d1be0866727f6f9cf9ac66f9a0793f1c793a4f58319e8e4583",
       "intelligence.cjs": "30e42ed7ec4ca5a94ac54fdb1330d2d47ac5f3fdeeef207753574723a9e77b5c",
       "statusline.cjs": "4a48353b4f1566fa4379b00fd0321b6676a22b6cc91fbbd8380ac5183d619468"
     }
   },
-  "signature": "XrmLYCSWusInkReUHieYqHKPPC8/0TKovnPNWAdPvxDEhHezvy+BkkVyk7Y62HClcy7a4+PP2G4mJ1kaPLJ7Bw==",
+  "signature": "L/Ni7Qu9lqMl9mA0S+bEte8Y0kQP18vOxwaH2KP6yXFrI89YF5rLVmx2I8WI8GJyjOiEcctPnbwyA97QpLO0CA==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -587,9 +587,20 @@ const handlers = {
 
 // Hooks must ALWAYS exit 0 — Claude Code treats non-zero as "hook error"
 // and skips all subsequent hooks for the event.
-process.exitCode = 0;
-main().catch((e) => {
-  try { console.log(`[WARN] Hook handler error: ${e.message}`); } catch (_) {}
-}).finally(() => {
-  process.exit(0);
-});
+//
+// Only dispatch when run directly (node hook-handler.cjs <cmd>). When
+// require()'d by a test, expose the internals instead of reading stdin and
+// calling process.exit — the 2026-06-15 fix (cb1e93e8d) added this guard and
+// the exports for tests/hook-handler-runwithtimeout.test.cjs; the 2026-07-04
+// helper sync (a5f86ad0a) dropped both, so the test died with
+// "runWithTimeout is not a function" once the Test Suite job ran again.
+if (require.main === module) {
+  process.exitCode = 0;
+  main().catch((e) => {
+    try { console.log(`[WARN] Hook handler error: ${e.message}`); } catch (_) {}
+  }).finally(() => {
+    process.exit(0);
+  });
+}
+
+module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS };

package/catalog-manifest.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": 1,
-  "generation": 5,
-  "generatedAt": "2026-08-24T19:34:50.132Z",
-  "gitSha": "a0b39b9d",
+  "generation": 6,
+  "generatedAt": "2026-09-07T17:25:59.600Z",
+  "gitSha": "6acc6891",
   "catalog": {
-    "agents": 165,
+    "agents": 167,
     "tools": 397,
     "skills": 34
   },

package/dist/src/commands/memory.js

@@ -583,6 +583,10 @@ const searchCommand = {
                             score: e.score,
                             namespace: e.namespace,
                             provenanceType: e.provenanceType,
+                            // Dream Cycle 2026-09-03: thread the already-computed
+                            // embedding through so SmartRetrieval's MMR step can use
+                            // cosine similarity instead of a text-overlap proxy.
+                            embedding: e.embedding,
                         })),
                     };
                 };

package/dist/src/commands/proxy-lifecycle.js

@@ -7,7 +7,8 @@
  */
 import { output } from '../output.js';
 import { hasConsent, recordConsent, revokeConsent } from '../funnel/index.js';
-import { installProxy, uninstallProxy } from '../proxy/install.js';
+import { uninstallProxy } from '../proxy/install.js';
+import { installAndActivateProxy } from '../proxy/activation.js';
 import { startForeground, startBackground, stopProxy, getProxyStatus, readProxyLogTail, watchProxyLog, ProxyNotInstalledError, ProxyAlreadyRunningError, } from '../proxy/lifecycle.js';
 import { proxyTokenPath } from '../proxy/paths.js';
 import { removeInjectedToken, startTokenRefreshPump } from '../proxy/token-bridge.js';
@@ -135,8 +136,8 @@ const installSub = {
         try {
             const spinner = output.createSpinner({ text: `Installing meta-proxy ${version}...`, spinner: 'dots' });
             spinner.start();
-            const result = await installProxy({ version, log: (line) => spinner.setText(line) });
-            spinner.succeed(`meta-proxy ${version} installed`);
+            const result = await installAndActivateProxy(version, (line) => spinner.setText(line));
+            spinner.succeed(`meta-proxy ${version} installed and verified effective`);
             output.writeln(`  binary: ${result.binaryPath}`);
             output.writeln(`  sha256: ${result.sha256}`);
             return { success: true, data: result };
@@ -172,8 +173,8 @@ const updateSub = {
         try {
             const spinner = output.createSpinner({ text: `Updating meta-proxy to ${version}...`, spinner: 'dots' });
             spinner.start();
-            const result = await installProxy({ version, log: (line) => spinner.setText(line) });
-            spinner.succeed(`meta-proxy updated to ${version}`);
+            const result = await installAndActivateProxy(version, (line) => spinner.setText(line));
+            spinner.succeed(`meta-proxy updated to ${version} and verified effective`);
             output.writeln(`  binary: ${result.binaryPath}`);
             return { success: true, data: result };
         }

package/dist/src/mcp-tools/memory-tools.js

@@ -485,6 +485,10 @@ export const memoryTools = [
                                     score: e.score,
                                     namespace: e.namespace,
                                     provenanceType: e.provenanceType,
+                                    // Dream Cycle 2026-09-03: thread the already-computed
+                                    // embedding through so SmartRetrieval's MMR step can use
+                                    // cosine similarity instead of a text-overlap proxy.
+                                    embedding: e.embedding,
                                 })),
                             };
                         };

package/dist/src/memory/memory-initializer.d.ts

@@ -476,6 +476,11 @@ export declare function searchEntries(options: {
         score: number;
         namespace: string;
         provenanceType?: string;
+        /** Dream Cycle 2026-09-03: the query-time cosine score above already
+         *  consumes this vector — surfaced so SmartRetrieval's MMR step can
+         *  reuse it instead of falling back to a text-overlap proxy. Internal
+         *  plumbing only; CLI/MCP response mappers do not forward this field. */
+        embedding?: number[];
     }[];
     searchTime: number;
     error?: string;

package/dist/src/memory/memory-initializer.js

@@ -1250,13 +1250,33 @@ export async function checkAndMigrateLegacy(options) {
  * (ReasoningBank, SkillLibrary, ExplainableRecall, etc.) are instantiated.
  *
  * Uses the memory-bridge's getControllerRegistry() which lazily creates
- * a singleton ControllerRegistry and initializes it with the given dbPath.
- * After this call, all enabled controllers are ready for immediate use.
+ * a singleton ControllerRegistry. Deliberately called with NO dbPath so the
+ * bridge resolves its own dedicated file via `getAgentDbPath()` — the same
+ * resolution every other bridge call (bridgeStoreEntry, bridgeGetEntry, ...)
+ * uses when it omits `dbPath`. After this call, all enabled controllers are
+ * ready for immediate use.
  *
- * Failures are isolated: if @claude-flow/memory or agentdb is not installed,
- * this returns an empty result without throwing.
+ * #3155: this used to be called with the sql.js-facing `memory.db` path
+ * (the one just written by the block above, via `resolveDbPath()`), which
+ * seeded the process-wide ControllerRegistry singleton with THAT file as
+ * AgentDB's native better-sqlite3 database — instead of the dedicated
+ * `agentdb-memory.db` sibling `getAgentDbPath()` exists specifically to
+ * provide (#2786, so native better-sqlite3 doesn't hit a possibly-encrypted
+ * `memory.db`). Because `initializeMemoryDatabase()` only reaches this call
+ * on a database's FIRST-EVER init (the `#1791.6` already-exists branch above
+ * returns early without activating anything), a bridge started against a
+ * brand-new `.swarm/` directory would activate the registry against
+ * `memory.db`, store/retrieve correctly for that process's lifetime, and
+ * then a SUBSEQUENT process — where `.swarm/memory.db` already exists so
+ * this init path is skipped — would have its first bridge call activate the
+ * registry against `agentdb-memory.db` instead (via the `dbPath ||
+ * getAgentDbPath()` fallback in memory-bridge.ts's `getRegistry()`), an
+ * empty file that never received the earlier writes. Restarting the bridge
+ * therefore silently lost read access to everything it had written, with no
+ * error anywhere. Passing no dbPath here makes both code paths agree on
+ * `agentdb-memory.db` every time, regardless of init history.
  */
-async function activateControllerRegistry(dbPath, verbose) {
+async function activateControllerRegistry(verbose) {
     const startTime = performance.now();
     const activated = [];
     const failed = [];
@@ -1265,7 +1285,7 @@ async function activateControllerRegistry(dbPath, verbose) {
         if (!bridge) {
             return { activated, failed, initTimeMs: performance.now() - startTime };
         }
-        const registry = await bridge.getControllerRegistry(dbPath);
+        const registry = await bridge.getControllerRegistry();
         if (!registry) {
             return { activated, failed, initTimeMs: performance.now() - startTime };
         }
@@ -1708,7 +1728,7 @@ export async function initializeMemoryDatabase(options) {
             fs.writeFileSync(schemaPath, MEMORY_SCHEMA_V3 + '\n' + getInitialMetadata(backend));
             // ADR-053: Activate ControllerRegistry so controllers (ReasoningBank,
             // SkillLibrary, ExplainableRecall, etc.) are instantiated during init
-            const controllerResult = await activateControllerRegistry(dbPath, verbose);
+            const controllerResult = await activateControllerRegistry(verbose);
             return {
                 success: true,
                 backend,
@@ -1768,7 +1788,7 @@ export async function initializeMemoryDatabase(options) {
             sqliteHeader[27] = 0x20; // leaf payload
             writeFileRestricted(dbPath, sqliteHeader, { encrypt: true });
             // ADR-053: Activate ControllerRegistry even on fallback path
-            const controllerResult = await activateControllerRegistry(dbPath, verbose);
+            const controllerResult = await activateControllerRegistry(verbose);
             return {
                 success: true,
                 backend,
@@ -2673,10 +2693,11 @@ export async function searchEntries(options) {
                             continue;
                         }
                         let score = 0;
+                        let parsedEmbedding;
                         if (embeddingJson) {
                             try {
-                                const embedding = JSON.parse(embeddingJson);
-                                score = cosineSim(queryEmbedding, embedding);
+                                parsedEmbedding = JSON.parse(embeddingJson);
+                                score = cosineSim(queryEmbedding, parsedEmbedding);
                             }
                             catch { /* skip */ }
                         }
@@ -2688,6 +2709,7 @@ export async function searchEntries(options) {
                                 score,
                                 namespace: candidate.namespace,
                                 provenanceType: provenanceTypeVal || 'unknown',
+                                embedding: parsedEmbedding,
                             });
                         }
                     }
@@ -2789,13 +2811,15 @@ export async function searchEntries(options) {
             for (const row of entries[0].values) {
                 const [id, key, ns, content, embeddingJson, provenanceTypeVal] = row;
                 let score = 0;
+                let parsedEmbedding;
                 if (embeddingJson) {
                     try {
-                        const embedding = JSON.parse(embeddingJson);
-                        score = cosineSim(queryEmbedding, embedding);
+                        parsedEmbedding = JSON.parse(embeddingJson);
+                        score = cosineSim(queryEmbedding, parsedEmbedding);
                     }
                     catch {
                         // Invalid embedding, use keyword score
+                        parsedEmbedding = undefined;
                     }
                 }
                 // Fallback to keyword matching
@@ -2815,6 +2839,7 @@ export async function searchEntries(options) {
                         score,
                         namespace: ns || 'default',
                         provenanceType: provenanceTypeVal || 'unknown',
+                        embedding: parsedEmbedding,
                     });
                 }
             }

package/dist/src/proxy/activation.d.ts

@@ -0,0 +1,14 @@
+import { type InstallResult } from './install.js';
+export interface EffectiveProxy {
+    version: string;
+    pid: number;
+    executable: string;
+}
+type Wait = (milliseconds: number) => Promise<void>;
+export declare function probeEffectiveProxy(fetcher?: typeof fetch, platform?: NodeJS.Platform): Promise<EffectiveProxy | null>;
+export declare function acquireProxyInstallLease(wait?: Wait): Promise<() => void>;
+export declare function installAndActivateProxy(version: string, log?: (line: string) => void): Promise<InstallResult & {
+    pid: number;
+}>;
+export {};
+//# sourceMappingURL=activation.d.ts.map

package/dist/src/proxy/activation.js

@@ -0,0 +1,210 @@
+/** Transactional activation of the daemon that actually owns the proxy port. */
+import { spawn, spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+import { installProxy } from './install.js';
+import { isLoopbackBind, proxyBinaryPath, proxyConfigPath, proxyInstallLockPath, proxyInstallManifestPath, proxyLogFilePath, proxyPidFilePath, } from './paths.js';
+const waitNormally = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+function processExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function effectiveEndpoint() {
+    let bind = '127.0.0.1:11435';
+    try {
+        const match = fs.readFileSync(proxyConfigPath(), 'utf8').match(/^bind\s*=\s*"([^"]+)"\s*$/m);
+        if (match?.[1])
+            bind = match[1];
+    }
+    catch { /* documented default */ }
+    if (!isLoopbackBind(bind))
+        throw new Error(`Refusing to probe non-loopback Meta-Proxy bind "${bind}".`);
+    return `http://${bind}`;
+}
+function executableFor(pid, platform) {
+    try {
+        if (platform === 'linux') {
+            const result = spawnSync('readlink', ['-f', `/proc/${pid}/exe`], { encoding: 'utf8', timeout: 2_000 });
+            return result.status === 0 ? result.stdout.trim() || null : null;
+        }
+        if (platform === 'win32') {
+            const command = `$p = Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}'; if ($null -ne $p) { [Console]::Out.Write($p.ExecutablePath) }`;
+            const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', command], { encoding: 'utf8', timeout: 2_000, windowsHide: true });
+            return result.status === 0 ? result.stdout.trim() || null : null;
+        }
+        const result = spawnSync('ps', ['-p', String(pid), '-o', 'comm='], { encoding: 'utf8', timeout: 2_000 });
+        return result.status === 0 ? result.stdout.trim() || null : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isSupportedOwner(executable, platform) {
+    const name = platform === 'win32' ? 'meta-proxy.exe' : 'meta-proxy';
+    const normalize = (value) => platform === 'win32' ? path.resolve(value).toLowerCase() : path.resolve(value);
+    const allowed = [
+        proxyBinaryPath(),
+        path.join(homedir(), '.metaharness', 'meta-proxy', 'bin', name),
+        path.join(homedir(), '.metaharness', 'bin', name),
+        path.join(homedir(), '.cargo', 'bin', name),
+    ].map(normalize);
+    return allowed.includes(normalize(executable));
+}
+export async function probeEffectiveProxy(fetcher = globalThis.fetch, platform = process.platform) {
+    const endpoint = effectiveEndpoint();
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 1_000);
+        let response;
+        try {
+            response = await fetcher(`${endpoint}/version`, { signal: controller.signal });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!response.ok)
+            return null;
+        const body = await response.json();
+        if (typeof body.version !== 'string' || !/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(body.version))
+            return null;
+        if (!Number.isSafeInteger(body.pid) || Number(body.pid) <= 0)
+            return null;
+        const executable = executableFor(Number(body.pid), platform);
+        return executable ? { version: body.version, pid: Number(body.pid), executable } : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function acquireProxyInstallLease(wait = waitNormally) {
+    const lock = proxyInstallLockPath();
+    fs.mkdirSync(path.dirname(lock), { recursive: true, mode: 0o700 });
+    for (let attempt = 0; attempt < 200; attempt++) {
+        try {
+            fs.mkdirSync(lock, { mode: 0o700 });
+            fs.writeFileSync(path.join(lock, 'owner'), `${process.pid}\n`, { mode: 0o600 });
+            return () => fs.rmSync(lock, { recursive: true, force: true });
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const age = Date.now() - fs.statSync(lock).mtimeMs;
+                const owner = Number.parseInt(fs.readFileSync(path.join(lock, 'owner'), 'utf8').trim(), 10);
+                if (age > 120_000 && (!Number.isSafeInteger(owner) || owner <= 0 || !processExists(owner))) {
+                    fs.rmSync(lock, { recursive: true, force: true });
+                    continue;
+                }
+            }
+            catch { /* another installer may still be writing its owner */ }
+            await wait(50);
+        }
+    }
+    throw new Error('Another Ruflo/MetaHarness installer still owns the Meta-Proxy install lease.');
+}
+async function stopEffective(wait) {
+    const owner = await probeEffectiveProxy();
+    if (!owner)
+        return null;
+    if (!isSupportedOwner(owner.executable, process.platform)) {
+        throw new Error(`Meta-Proxy port owner pid ${owner.pid} is not a recognized Ruflo/MetaHarness binary; refusing to signal it.`);
+    }
+    process.kill(owner.pid, 'SIGTERM');
+    for (let attempt = 0; attempt < 40; attempt++) {
+        await wait(50);
+        const current = await probeEffectiveProxy();
+        if (!current || current.pid !== owner.pid)
+            return owner;
+    }
+    throw new Error(`Stale Meta-Proxy pid ${owner.pid} did not stop.`);
+}
+function launch(binary) {
+    fs.mkdirSync(path.dirname(proxyLogFilePath()), { recursive: true, mode: 0o700 });
+    const log = fs.openSync(proxyLogFilePath(), 'a', 0o600);
+    try {
+        const child = spawn(binary, [], { detached: true, stdio: ['ignore', log, log], windowsHide: true });
+        if (!child.pid)
+            throw new Error('Meta-Proxy did not return a process id.');
+        child.unref();
+        fs.writeFileSync(proxyPidFilePath(), `${child.pid}\n`, { mode: 0o600 });
+        return child.pid;
+    }
+    finally {
+        fs.closeSync(log);
+    }
+}
+async function launchAndVerify(binary, version, wait) {
+    const pid = launch(binary);
+    for (let attempt = 0; attempt < 100; attempt++) {
+        await wait(50);
+        const current = await probeEffectiveProxy();
+        if (current?.pid === pid && current.version === version && path.resolve(current.executable) === path.resolve(binary))
+            return current;
+        if (current && current.pid !== pid) {
+            try {
+                process.kill(pid, 'SIGTERM');
+            }
+            catch { /* already exited */ }
+            throw new Error(`Competing Meta-Proxy pid ${current.pid} won the port with version ${current.version}.`);
+        }
+    }
+    try {
+        process.kill(pid, 'SIGTERM');
+    }
+    catch { /* already exited */ }
+    throw new Error(`Meta-Proxy v${version} did not become the effective daemon.`);
+}
+export async function installAndActivateProxy(version, log) {
+    const wait = waitNormally;
+    const binary = proxyBinaryPath();
+    const manifest = proxyInstallManifestPath();
+    const binaryBackup = `${binary}.rollback`;
+    const manifestBackup = `${manifest}.rollback`;
+    let release = null;
+    let prior = null;
+    try {
+        release = await acquireProxyInstallLease(wait);
+        prior = await stopEffective(wait);
+        fs.rmSync(binaryBackup, { force: true });
+        fs.rmSync(manifestBackup, { force: true });
+        if (fs.existsSync(binary))
+            fs.copyFileSync(binary, binaryBackup);
+        if (fs.existsSync(manifest))
+            fs.copyFileSync(manifest, manifestBackup);
+        const installed = await installProxy({ version, log });
+        const effective = await launchAndVerify(installed.binaryPath, installed.version, wait);
+        return { ...installed, pid: effective.pid };
+    }
+    catch (error) {
+        const failure = error instanceof Error ? error.message : String(error);
+        if (fs.existsSync(binaryBackup)) {
+            try {
+                await stopEffective(wait);
+                fs.rmSync(binary, { force: true });
+                fs.renameSync(binaryBackup, binary);
+                fs.rmSync(manifest, { force: true });
+                if (fs.existsSync(manifestBackup))
+                    fs.renameSync(manifestBackup, manifest);
+                if (prior)
+                    await launchAndVerify(prior.executable === binary ? binary : prior.executable, prior.version, wait);
+            }
+            catch (rollbackError) {
+                throw new Error(`${failure} Rollback failed: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+            }
+            throw new Error(`${failure} Previous Meta-Proxy ${prior ? 'was restored and verified' : 'binary was restored; it was not running before the upgrade'}.`);
+        }
+        throw error;
+    }
+    finally {
+        fs.rmSync(binaryBackup, { force: true });
+        fs.rmSync(manifestBackup, { force: true });
+        release?.();
+    }
+}
+//# sourceMappingURL=activation.js.map

package/dist/src/proxy/install.js

@@ -143,6 +143,9 @@ export async function installProxy(opts) {
         const tmp = `${finalPath}.tmp`;
         fs.copyFileSync(extractedBinaryPath, tmp);
         fs.chmodSync(tmp, 0o755);
+        // The activation transaction has already stopped and backed up the old
+        // daemon. Windows rename does not replace an existing executable.
+        fs.rmSync(finalPath, { force: true });
         fs.renameSync(tmp, finalPath);
         const liveSha = sha256Hex(fs.readFileSync(finalPath));
         const manifest = {

package/dist/src/proxy/paths.d.ts

@@ -10,6 +10,8 @@ export declare function proxyPidFilePath(): string;
 export declare function proxyLockFilePath(): string;
 export declare function proxyLogFilePath(): string;
 export declare function proxyInstallManifestPath(): string;
+/** Shared by Ruflo and MetaHarness so two IDE windows cannot race an upgrade. */
+export declare function proxyInstallLockPath(): string;
 export declare function proxyConfigPath(): string;
 export declare function proxyTokenPath(): string;
 export declare function proxyInjectedTokenPath(): string;

package/dist/src/proxy/paths.js

@@ -23,6 +23,10 @@ export function proxyLogFilePath() {
 export function proxyInstallManifestPath() {
     return join(funnelStateDir(), 'proxy', 'install-manifest.json');
 }
+/** Shared by Ruflo and MetaHarness so two IDE windows cannot race an upgrade. */
+export function proxyInstallLockPath() {
+    return join(funnelStateDir(), 'meta-proxy-install.lock');
+}
 export function proxyConfigPath() {
     return join(funnelStateDir(), 'proxy-config.toml');
 }

package/dist/src/ruvector/enhanced-model-router.js

@@ -376,17 +376,28 @@ export class EnhancedModelRouter {
         }
         // Step 6: Determine tier based on complexity
         const { haiku, sonnet } = this.config.complexityThresholds;
-        // ADR-149 — forward the per-model fields from baseResult onto every
-        // tier-2/3 return. This keeps the cost-optimal pick alive end-to-end:
-        // if the neural backend picked Ling for a cheap task, the enhanced
-        // router surfaces `modelId: 'inclusionai/ling-2.6-flash'` alongside
-        // `model: 'haiku'` so downstream consumers can dispatch via OpenRouter.
-        const neuralFields = {
-            ...(baseResult.modelId ? { modelId: baseResult.modelId } : {}),
-            ...(baseResult.routedBy ? { routedBy: baseResult.routedBy } : {}),
-            ...(baseResult.provider ? { provider: baseResult.provider } : {}),
-            ...(baseResult.openrouterModel ? { openrouterModel: baseResult.openrouterModel } : {}),
-        };
+        // ADR-149 — forward the per-model fields from baseResult onto the
+        // tier-2/3 return, but ONLY when the tier being returned here still
+        // matches the tier baseResult.model was chosen for. `finalComplexity`
+        // (AST-adjusted / tier3-keyword-boosted, Step 5-6 above) can escalate
+        // the returned tier past what the base bandit router saw when it picked
+        // `modelId` — forwarding it unconditionally would attach a cheaper
+        // tier's concrete model (e.g. `inclusionai/ling-2.6-flash`, chosen for
+        // 'haiku') to an escalated 'opus' decision. `agent-execute-core.ts`
+        // treats a present `modelId` as an override that skips tier-based
+        // dispatch entirely, so a stale, wrong-tier `modelId` silently defeats
+        // the escalation this function just computed. Dropping the mismatched
+        // fields (rather than trying to re-resolve modelId for the new tier)
+        // keeps this fix small and fail-safe: an escalated decision falls back
+        // to the plain `model` field, never to a cheaper model's identity.
+        const neuralFieldsFor = (model) => baseResult.model === model
+            ? {
+                ...(baseResult.modelId ? { modelId: baseResult.modelId } : {}),
+                ...(baseResult.routedBy ? { routedBy: baseResult.routedBy } : {}),
+                ...(baseResult.provider ? { provider: baseResult.provider } : {}),
+                ...(baseResult.openrouterModel ? { openrouterModel: baseResult.openrouterModel } : {}),
+            }
+            : {};
         if (finalComplexity < haiku) {
             return {
                 tier: 2,
@@ -398,7 +409,7 @@ export class EnhancedModelRouter {
                 canSkipLLM: false,
                 estimatedLatencyMs: 500,
                 estimatedCost: 0.0002,
-                ...neuralFields,
+                ...neuralFieldsFor('haiku'),
             };
         }
         if (finalComplexity < sonnet) {
@@ -412,7 +423,7 @@ export class EnhancedModelRouter {
                 canSkipLLM: false,
                 estimatedLatencyMs: 2000,
                 estimatedCost: 0.003,
-                ...neuralFields,
+                ...neuralFieldsFor('sonnet'),
             };
         }
         return {
@@ -425,7 +436,7 @@ export class EnhancedModelRouter {
             canSkipLLM: false,
             estimatedLatencyMs: 5000,
             estimatedCost: 0.015,
-            ...neuralFields,
+            ...neuralFieldsFor('opus'),
         };
     }
     /**

package/node_modules/@claude-flow/security/dist/input-validator.d.ts

@@ -159,14 +159,14 @@ export declare const SpawnAgentSchema: z.ZodObject<{
     timeout: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
+    id?: string | undefined;
 }, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
+    id?: string | undefined;
 }>;
 /**
  * Task input schema
@@ -181,13 +181,13 @@ export declare const TaskInputSchema: z.ZodObject<{
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "low" | "medium" | "high" | "critical" | undefined;
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }, {
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "low" | "medium" | "high" | "critical" | undefined;
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }>;
 /**
@@ -234,16 +234,16 @@ export declare const ExecutorConfigSchema: z.ZodObject<{
     cwd: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
     allowSudo: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    timeout: number;
     allowedCommands: string[];
+    timeout: number;
     maxBuffer: number;
     allowSudo: boolean;
     blockedPatterns?: string[] | undefined;
     cwd?: string | undefined;
 }, {
     allowedCommands: string[];
-    timeout?: number | undefined;
     blockedPatterns?: string[] | undefined;
+    timeout?: number | undefined;
     maxBuffer?: number | undefined;
     cwd?: string | undefined;
     allowSudo?: boolean | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.38.20",
+  "version": "3.38.22",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",