@claude-flow/cli 3.38.3 → 3.38.5

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.38.3",
+    "version": "3.38.5",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
       "hook-handler.cjs": "dae295fb9ae2626b89899c19a20cc911541af82b52d2eeb9b214d618b96e9a86",
@@ -8,6 +8,6 @@
       "statusline.cjs": "0457fe53f8cd2c56458ff178392536a5868efd1a573665fa43bc01d2d95ca677"
     }
   },
-  "signature": "+LCCU+BDg+NJQxxOVYmhpNNzgWAi4NXNYtdiNueujCaLjkoKboJs5MKThbWd7PHp7D9b+RjgqO9VMvCUWA41CQ==",
+  "signature": "aNZkK2xmrSn4xS5GEZ42BMV56uqQorOY8jt/3cxHbCUt1D2Vi8Ewz31d4vrm8pDUR1wTtkUKj148o8saoUaxAg==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 4,
-  "generatedAt": "2026-08-12T18:13:50.566Z",
-  "gitSha": "1e2178f2",
+  "generatedAt": "2026-08-12T19:44:54.526Z",
+  "gitSha": "7715eb5e",
   "catalog": {
     "agents": 164,
     "tools": 397,

package/dist/src/commands/init.js

@@ -496,8 +496,16 @@ const initClaudeAction = async (ctx) => {
     const force = ctx.flags.force;
     const minimal = ctx.flags.minimal;
     const full = ctx.flags.full;
-    const skipClaude = ctx.flags['skip-claude'];
-    const onlyClaude = ctx.flags['only-claude'];
+    // #2952 — every long-flag write path in the parser goes through
+    // normalizeKey() (parser.ts:399-402), which converts kebab-case to
+    // camelCase before storing. `--skip-claude`/`--only-claude`/
+    // `--all-agents`/`--cloud-mcp` land as `flags.skipClaude`/`flags.onlyClaude`/
+    // `flags.allAgents`/`flags.cloudMcp` — there is no code path that ever
+    // stores the literal kebab-case key. Reading `ctx.flags['skip-claude']`
+    // etc. was always undefined, so all four flags were silent no-ops. Same
+    // bug class as #2098A below, just never applied to these siblings.
+    const skipClaude = ctx.flags.skipClaude;
+    const onlyClaude = ctx.flags.onlyClaude;
     // #2098A — the parser handles `--no-foo` by stripping the prefix and
     // storing `flags.foo = false` (parser.ts:291-294), not by storing
     // `flags['no-foo'] = true`. So `--no-global` lands as
@@ -505,8 +513,8 @@ const initClaudeAction = async (ctx) => {
     // was always undefined and silently no-op'd — every user with the flag
     // set still got `~/.claude/CLAUDE.md` modified. Read the real key.
     const noGlobal = ctx.flags['no-global'] === true || ctx.flags['global'] === false;
-    const allAgents = ctx.flags['all-agents'];
-    const cloudMcp = ctx.flags['cloud-mcp'];
+    const allAgents = ctx.flags.allAgents;
+    const cloudMcp = ctx.flags.cloudMcp;
     const cwd = ctx.cwd;
     // Check if already initialized
     const initialized = isInitialized(cwd);

package/dist/src/commands/security.js

@@ -170,7 +170,14 @@ const scanCommand = {
             if (scanType === 'all' || scanType === 'code') {
                 spinner.setText('Scanning for hardcoded secrets...');
                 const secretPatterns = [
-                    { pattern: /['"](?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{20,}['"]/g, type: 'API Key (Stripe/OpenAI)' },
+                    // #2931: was `['"](?:sk-|...)...{20,}['"]` — the 20-char floor
+                    // missed shorter-but-real keys like `sk-1234567890abcdef` (16
+                    // chars), and the quote-adjacency anchor required a quote
+                    // literally next to the prefix, missing the extremely common
+                    // `Authorization: "Bearer sk_live_..."` shape where the quote
+                    // sits next to "Bearer", not the key. Lookaround boundaries
+                    // match the prefix wherever it appears as a standalone token.
+                    { pattern: /(?<![a-zA-Z0-9_])(?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{10,}(?![a-zA-Z0-9_])/g, type: 'API Key (Stripe/OpenAI)' },
                     { pattern: /['"]AKIA[A-Z0-9]{16}['"]/g, type: 'AWS Access Key' },
                     { pattern: /['"]ghp_[a-zA-Z0-9]{36}['"]/g, type: 'GitHub Token' },
                     { pattern: /['"]xox[baprs]-[a-zA-Z0-9-]+['"]/g, type: 'Slack Token' },
@@ -789,7 +796,7 @@ const secretsCommand = {
             { pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, type: 'JWT Token', risk: 'High', action: 'Remove from source' },
             { pattern: /-----BEGIN (?:RSA|EC|DSA|OPENSSH) PRIVATE KEY-----/g, type: 'Private Key', risk: 'Critical', action: 'Remove and regenerate' },
             { pattern: /(?:mongodb|postgres|mysql|redis):\/\/[^\s'"]+/g, type: 'Connection String', risk: 'High', action: 'Use env variable' },
-            { pattern: /['"](?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{20,}['"]/g, type: 'API Key (Stripe/OpenAI)', risk: 'Critical', action: 'Rotate immediately' },
+            { pattern: /(?<![a-zA-Z0-9_])(?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{10,}(?![a-zA-Z0-9_])/g, type: 'API Key (Stripe/OpenAI)', risk: 'Critical', action: 'Rotate immediately' },
             { pattern: /['"]xox[baprs]-[a-zA-Z0-9-]+['"]/g, type: 'Slack Token', risk: 'High', action: 'Revoke and rotate' },
             { pattern: /[a-zA-Z0-9_-]*(?:api[_-]?key|secret[_-]?key|auth[_-]?token|access[_-]?token|private[_-]?key)\s*[:=]\s*['"][^'"]{8,}['"]/gi, type: 'Generic Secret/API Key', risk: 'High', action: 'Use env variable' },
             { pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi, type: 'Hardcoded Password', risk: 'High', action: 'Use secrets manager' },

package/dist/src/mcp-tools/github-tools.js

@@ -391,9 +391,16 @@ export const githubTools = [
             const store = loadGitHubStore();
             const action = input.action || 'list';
             const gh = hasGhCli();
+            // #2963 — owner/repo were validated but never passed to `gh`, so `gh`
+            // silently resolved the target repo from the cwd's git remote instead
+            // of the caller-specified one. `gh` accepts `--repo owner/repo` on
+            // every issue subcommand used here.
+            const owner = input.owner;
+            const repo = input.repo;
+            const repoArgs = owner && repo ? ['--repo', `${owner}/${repo}`] : [];
             if (action === 'list') {
                 if (gh) {
-                    const raw = run('gh issue list --state all --limit 20 --json number,title,state,labels,createdAt');
+                    const raw = runArgv('gh', ['issue', 'list', '--state', 'all', '--limit', '20', '--json', 'number,title,state,labels,createdAt', ...repoArgs]);
                     if (raw) {
                         try {
                             const issues = JSON.parse(raw);
@@ -413,7 +420,7 @@ export const githubTools = [
                 // outside [A-Za-z0-9 _\-./] and caps each label at 64 chars.
                 const labels = sanitizeLabels(input.labels) ?? [];
                 if (gh) {
-                    const argv = ['issue', 'create', '--title', title, '--body', body];
+                    const argv = ['issue', 'create', '--title', title, '--body', body, ...repoArgs];
                     if (labels.length > 0) {
                         argv.push('--label', labels.join(','));
                     }
@@ -442,7 +449,7 @@ export const githubTools = [
                             argv.push('--add-label', labels.join(','));
                     }
                     if (argv.length > 3) {
-                        const result = runArgv('gh', argv);
+                        const result = runArgv('gh', [...argv, ...repoArgs]);
                         if (result !== null)
                             return { success: true, _real: true, action: 'updated', issueNumber };
                     }
@@ -463,7 +470,7 @@ export const githubTools = [
             if (action === 'close') {
                 const issueNumber = toPositiveInt(input.issueNumber);
                 if (gh && issueNumber) {
-                    const result = runArgv('gh', ['issue', 'close', String(issueNumber)]);
+                    const result = runArgv('gh', ['issue', 'close', String(issueNumber), ...repoArgs]);
                     if (result !== null)
                         return { success: true, _real: true, action: 'closed', issueNumber, closedAt: new Date().toISOString() };
                 }

package/dist/src/mcp-tools/hooks-tools.js

@@ -1377,26 +1377,36 @@ export const hooksPostTask = {
         catch {
             // Intelligence module not available — non-fatal
         }
-        // ADR-130 Phase 3: fire-and-forget "reinforced-by" edge on task success
+        // ADR-130 Phase 3: "reinforced-by" edge on task success.
         // Writes: context node → task pattern node (relation: "reinforced-by")
+        //
+        // #2961 — this used to be fire-and-forget (no `await` on the IIFE). That
+        // was invisible from the long-running MCP server, where the process
+        // stays alive long enough for the detached write to finish in the
+        // background. But `hooks post-task` (CLI) is the exact same handler
+        // invoked from a one-shot process that calls `process.exit(0)`
+        // immediately after this action resolves (bin/cli.js, #1552) — the
+        // still-pending dynamic `import(...)` + `insertGraphEdge()` call was
+        // killed before its first tick, so the CLI form dropped this edge on
+        // every single success, not intermittently. Await it — this is a
+        // single fast DB write, not worth losing correctness on one call site
+        // to save latency on the other.
         if (success) {
-            (async () => {
-                try {
-                    const { insertGraphEdge } = await import('../memory/graph-edge-writer.js');
-                    const sessionCtxId = `task:${taskId}`;
-                    const patternId = `pattern:${taskId}`;
-                    await insertGraphEdge({
-                        sourceId: sessionCtxId,
-                        targetId: patternId,
-                        relation: 'reinforced-by',
-                        weight: quality,
-                        confidence: quality,
-                        lastReinforced: new Date().toISOString(),
-                        metadata: { success, agent, taskId },
-                    });
-                }
-                catch { /* non-fatal */ }
-            })().catch(() => { });
+            try {
+                const { insertGraphEdge } = await import('../memory/graph-edge-writer.js');
+                const sessionCtxId = `task:${taskId}`;
+                const patternId = `pattern:${taskId}`;
+                await insertGraphEdge({
+                    sourceId: sessionCtxId,
+                    targetId: patternId,
+                    relation: 'reinforced-by',
+                    weight: quality,
+                    confidence: quality,
+                    lastReinforced: new Date().toISOString(),
+                    metadata: { success, agent, taskId },
+                });
+            }
+            catch { /* non-fatal */ }
         }
         // Persist routing outcome for runtime learning (file-based, always reliable)
         const taskText = params.task || '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.38.3",
+  "version": "3.38.5",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",