@claude-flow/cli 3.41.0 → 3.41.2

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.41.0",
+    "version": "3.41.2",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
       "hook-handler.cjs": "209d9fafe10e17d1be0866727f6f9cf9ac66f9a0793f1c793a4f58319e8e4583",
@@ -8,6 +8,6 @@
       "statusline.cjs": "4a48353b4f1566fa4379b00fd0321b6676a22b6cc91fbbd8380ac5183d619468"
     }
   },
-  "signature": "lJIU7TlbDO4FdWAceZ1eddxBvAn8zCSnrN+SNhhSpbeDv4jFgUWHFkYj27+O1DGRRDoebonbSRLrzbcWP9hHCQ==",
+  "signature": "cmz1Yt39LkaWY+8JH1BOtqD27A3TYoFbpHnMGTpKZDzpuhgq1RQCF9P90z1yrnnStOSX0e01meDsHeRoGQgtAA==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 6,
-  "generatedAt": "2026-09-10T11:59:15.567Z",
-  "gitSha": "cb10bf61",
+  "generatedAt": "2026-09-10T19:46:29.600Z",
+  "gitSha": "df87b0db",
   "catalog": {
     "agents": 167,
     "tools": 418,

package/dist/src/commands/memory.js

@@ -7,6 +7,25 @@ import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
 import { distillCommand } from './memory-distill.js';
 import { backupCommand } from './memory-backup.js';
+import { countSiblingStoreRows } from '../memory/sibling-store.js';
+import { resolveDbPath } from '../memory/memory-initializer.js';
+/**
+ * #3228: a miss in one store is not a miss in the memory.
+ *
+ * 3.41.1 disclosed the sibling AgentDB store from `memory list` only. `retrieve`,
+ * `search` and `stats` kept reporting a clean negative — "Key not found", "No
+ * results" — while the rows sat in the file this interface does not read. On the
+ * reported Windows install that is 31,673 rows in the other store answering
+ * `found:false`. A confident negative is worse than an error, because nothing
+ * prompts anyone to look further.
+ */
+async function warnIfSiblingHasRows(pathFlag) {
+    const unread = await countSiblingStoreRows(resolveDbPath(pathFlag));
+    if (unread && unread.rows > 0) {
+        output.printWarning(`This read covered one store. ${unread.rows} entries are in ${unread.path} and were not searched. ` +
+            `That store is written by the MCP/AgentDB path; read it with --path ${unread.path}.`);
+    }
+}
 // Memory backends
 const BACKENDS = [
     { value: 'agentdb', label: 'AgentDB', hint: 'Vector database with HNSW indexing (150x-12,500x faster)' },
@@ -285,6 +304,7 @@ const retrieveCommand = {
             }
             if (!result.found || !result.entry) {
                 output.printWarning(`Key not found: ${key}`);
+                await warnIfSiblingHasRows(ctx.flags.path);
                 return { success: false, exitCode: 1, data: { key, found: false } };
             }
             const entry = result.entry;
@@ -665,6 +685,7 @@ const searchCommand = {
             output.writeln();
             if (results.length === 0) {
                 output.printWarning('No results found');
+                await warnIfSiblingHasRows(ctx.flags.path);
                 output.writeln(output.dim('Try: claude-flow memory store -k "key" --value "data"'));
                 return { success: true, data: [] };
             }
@@ -744,6 +765,7 @@ const listCommand = {
             output.writeln();
             if (entries.length === 0) {
                 output.printWarning('No entries found');
+                await warnIfSiblingHasRows(ctx.flags.path);
                 output.printInfo('Store data: claude-flow memory store -k "key" --value "data"');
                 return { success: true, data: [] };
             }
@@ -760,6 +782,15 @@ const listCommand = {
             });
             output.writeln();
             output.printInfo(`Showing ${entries.length} of ${listResult.total} entries`);
+            // #3196: AgentDB owns a sibling store next to this one. `total` counts only
+            // the file we read, so a bare count reads as "this is everything" while rows
+            // sit unreadable next door. Silence would be recoverable; a confident wrong
+            // total is not, because nothing prompts anyone to look further.
+            const unread = await countSiblingStoreRows(resolveDbPath(ctx.flags.path));
+            if (unread && unread.rows > 0) {
+                output.printWarning(`${unread.rows} more entries are in ${unread.path} and were not read here. ` +
+                    `That store is written by the MCP/AgentDB path; read it with --path ${unread.path}.`);
+            }
             return { success: true, data: listResult.entries };
         }
         catch (error) {

package/dist/src/memory/memory-bridge.d.ts

@@ -34,6 +34,10 @@ export declare function shouldDisableNativeBridge(platform?: NodeJS.Platform, en
  * noise. Suppress the banners, keep the bad news.
  */
 export declare function shouldSuppressInitLog(msg: string): boolean;
+/** Test seam: forget cached registries so a test can exercise a fresh open. */
+export declare function _resetRegistryCacheForTest(): void;
+/** #3196: the sibling store AgentDB owns next to a given sql.js database. */
+export declare function siblingAgentDbPath(dbPath: string): string | null;
 /**
  * Create/migrate the bridge's `memory_entries` table on `db`.
  *

package/dist/src/memory/memory-bridge.js

@@ -19,9 +19,33 @@
 import * as path from 'path';
 import * as crypto from 'crypto';
 import { createRequire } from 'node:module';
-// ===== Lazy singleton =====
-let registryPromise = null;
-let registryInstance = null;
+// ===== Lazy registry cache, keyed by database path =====
+/**
+ * #3196: this cache is keyed by resolved database path, and that is the whole
+ * point of it.
+ *
+ * It used to be a single global instance. The first caller to touch the bridge
+ * decided which file the process would use, and every later caller's explicit
+ * `dbPath` was accepted and then silently ignored — `getRegistry()` returned the
+ * already-built instance without ever comparing paths. A `memory store --path A`
+ * following an MCP write therefore read and wrote B, reported success, and left
+ * two valid corpora that neither interface could see whole.
+ *
+ * Keying by path makes an explicit path mean what it says. Two paths in one
+ * process are two registries, which is the behaviour the CLI's `--path` flag and
+ * `CLAUDE_FLOW_DB_PATH` have always advertised.
+ */
+const registryPromises = new Map();
+const registryInstances = new Map();
+/**
+ * Test seam: when set, every path resolves to this registry.
+ *
+ * Kept separate from the path cache on purpose. A test installs a fake registry
+ * and then calls a bridge function with its own temp `dbPath`; keying the
+ * override by path would mean the seam only worked for callers that happened to
+ * pass the same path the seam guessed, which is how #2968's fixture broke.
+ */
+let testRegistryOverride = null;
 let bridgeAvailable = null;
 // #2652/#2120: rows created before the status column existed receive NULL
 // during migration. They are live rows, not tombstones. Every user-facing
@@ -172,10 +196,18 @@ async function getRegistry(dbPath) {
             : 'AgentDB native bridge disabled by CLAUDE_FLOW_DISABLE_BRIDGE=1';
         return null;
     }
+    if (testRegistryOverride)
+        return testRegistryOverride;
     if (bridgeAvailable === false)
         return null;
-    if (registryInstance)
-        return registryInstance;
+    // Resolve first, then cache on the resolved value: `undefined`, a relative
+    // path and its absolute form must not become three different registries over
+    // the same file.
+    const resolvedPath = dbPath ? path.resolve(dbPath) : getAgentDbPath();
+    const cached = registryInstances.get(resolvedPath);
+    if (cached)
+        return cached;
+    let registryPromise = registryPromises.get(resolvedPath);
     if (!registryPromise) {
         registryPromise = (async () => {
             try {
@@ -193,7 +225,7 @@ async function getRegistry(dbPath) {
                 try {
                     await registry.initialize({
                         // #2786: use agentdb-memory.db (plaintext) so native better-sqlite3 doesn't hit the encrypted memory.db.
-                        dbPath: dbPath || getAgentDbPath(),
+                        dbPath: resolvedPath,
                         embeddingModel: 'Xenova/all-MiniLM-L6-v2',
                         dimension: 384,
                         vectorBackend: 'auto',
@@ -440,7 +472,7 @@ async function getRegistry(dbPath) {
                 catch {
                     // Top-level catch — registry stays usable even if post-init wiring fails wholesale.
                 }
-                registryInstance = registry;
+                registryInstances.set(resolvedPath, registry);
                 bridgeAvailable = true;
                 bridgeFailureReason = null;
                 return registry;
@@ -451,13 +483,29 @@ async function getRegistry(dbPath) {
                 // makes the resulting sql.js-fallback refusal undiagnosable.
                 bridgeFailureReason = err instanceof Error ? err.message : String(err);
                 bridgeAvailable = false;
-                registryPromise = null;
+                registryPromises.delete(resolvedPath);
                 return null;
             }
         })();
+        registryPromises.set(resolvedPath, registryPromise);
     }
     return registryPromise;
 }
+/** Test seam: forget cached registries so a test can exercise a fresh open. */
+export function _resetRegistryCacheForTest() {
+    registryPromises.clear();
+    registryInstances.clear();
+    testRegistryOverride = null;
+    bridgeAvailable = null;
+    bridgeFailureReason = null;
+}
+/** #3196: the sibling store AgentDB owns next to a given sql.js database. */
+export function siblingAgentDbPath(dbPath) {
+    if (!dbPath || dbPath === ':memory:')
+        return null;
+    const sibling = path.join(path.dirname(path.resolve(dbPath)), 'agentdb-memory.db');
+    return path.resolve(dbPath) === sibling ? null : sibling;
+}
 // ===== Phase 2: BM25 hybrid scoring =====
 /**
  * BM25 scoring for keyword-based search.
@@ -1738,8 +1786,9 @@ export function getBridgeFailureReason() {
  * independent of package build order without changing production startup.
  */
 export function __setMemoryBridgeRegistryForTests(registry) {
-    registryInstance = registry;
-    registryPromise = registry ? Promise.resolve(registry) : null;
+    registryPromises.clear();
+    registryInstances.clear();
+    testRegistryOverride = registry;
     bridgeAvailable = registry ? true : null;
     bridgeFailureReason = null;
 }
@@ -1753,16 +1802,19 @@ export function __setMemoryBridgeRegistryForTests(registry) {
  * therefore had no recovery path short of a restart.
  */
 export async function shutdownBridge() {
-    if (registryInstance) {
+    // #3196: every cached registry owns an open database handle, so shutting down
+    // one of several would leave the rest holding files open.
+    for (const registry of registryInstances.values()) {
         try {
-            await registryInstance.shutdown();
+            await registry.shutdown();
         }
         catch {
             // Best-effort
         }
     }
-    registryInstance = null;
-    registryPromise = null;
+    registryInstances.clear();
+    registryPromises.clear();
+    testRegistryOverride = null;
     bridgeAvailable = null;
     bridgeFailureReason = null;
 }

package/dist/src/memory/sibling-store.d.ts

@@ -0,0 +1,11 @@
+export interface SiblingStoreReport {
+    path: string;
+    rows: number;
+}
+/**
+ * Count rows in the sibling AgentDB store, read-only. Returns null when there
+ * is no sibling, it does not exist, or it cannot be read — an unreadable store
+ * is not evidence of an empty one, so we stay silent rather than claim zero.
+ */
+export declare function countSiblingStoreRows(dbPath: string): Promise<SiblingStoreReport | null>;
+//# sourceMappingURL=sibling-store.d.ts.map

package/dist/src/memory/sibling-store.js

@@ -0,0 +1,53 @@
+/**
+ * #3196: report the store this interface is NOT reading.
+ *
+ * `memory.db` (sql.js, encrypted at rest when enabled) and `agentdb-memory.db`
+ * (native better-sqlite3, plaintext) are deliberately separate files — see
+ * #2786; pointing native at an encrypted file fails and silently disables the
+ * learning system. Both are legitimate stores, and a read of one is not a read
+ * of the other.
+ *
+ * The danger is not the split. It is a count that describes one file as though
+ * it described the memory. This module exists so the CLI can say what it did
+ * not read, without opening, migrating or modifying that file.
+ */
+import { existsSync } from 'node:fs';
+import { siblingAgentDbPath } from './memory-bridge.js';
+/**
+ * Count rows in the sibling AgentDB store, read-only. Returns null when there
+ * is no sibling, it does not exist, or it cannot be read — an unreadable store
+ * is not evidence of an empty one, so we stay silent rather than claim zero.
+ */
+export async function countSiblingStoreRows(dbPath) {
+    const sibling = siblingAgentDbPath(dbPath);
+    if (!sibling || !existsSync(sibling))
+        return null;
+    try {
+        const require = (await import('node:module')).createRequire(import.meta.url);
+        // Optional native dependency: absence must degrade to silence, never throw.
+        const Database = require('better-sqlite3');
+        const db = new Database(sibling, { readonly: true, fileMustExist: true });
+        try {
+            const table = db
+                .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='memory_entries'")
+                .get();
+            if (!table)
+                return null;
+            const row = db
+                .prepare("SELECT COUNT(*) AS n FROM memory_entries WHERE (status = 'active' OR status IS NULL)")
+                .get();
+            const rows = Number(row?.n ?? 0);
+            return rows > 0 ? { path: sibling, rows } : null;
+        }
+        finally {
+            try {
+                db.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=sibling-store.js.map

package/dist/src/services/daemon-autostart.js

@@ -54,14 +54,32 @@ export function isDaemonAlive(projectRoot) {
 }
 /** Project-local opt-out: `{ "daemon": { "autostart": false } }` in claude-flow.config.json. */
 function autostartDisabledByProjectConfig(projectRoot) {
-    try {
-        const raw = fs.readFileSync(path.join(projectRoot, 'claude-flow.config.json'), 'utf-8');
-        const cfg = JSON.parse(raw);
-        return cfg?.daemon?.autostart === false;
-    }
-    catch {
-        return false; // absent/malformed config = not disabled
+    // #3278: read BOTH files, and both spellings.
+    //
+    // This used to consult only `claude-flow.config.json` with the key
+    // `daemon.autostart`. But `init` generates `.claude/settings.json` with
+    // `claudeFlow.daemon.autoStart` — a different file and a different capital S —
+    // and writes it `false` under the comment "Opt-in only — prevents unintended
+    // token consumption (#1427, #1330)". So the one setting a fresh project
+    // actually ships was never read, and the runtime spent tokens the generated
+    // config existed to prevent. Accept either spelling in either file: a user who
+    // wrote the word "autostart: false" anywhere sensible meant it.
+    const readsFalse = (v) => v === false;
+    for (const [file, pick] of [
+        ['claude-flow.config.json', (c) => c?.daemon],
+        [path.join('.claude', 'settings.json'), (c) => c?.claudeFlow?.daemon],
+    ]) {
+        try {
+            const cfg = JSON.parse(fs.readFileSync(path.join(projectRoot, file), 'utf-8'));
+            const d = pick(cfg);
+            if (readsFalse(d?.autostart) || readsFalse(d?.autoStart))
+                return true;
+        }
+        catch {
+            // absent/malformed config = this file says nothing; keep checking the others
+        }
     }
+    return false;
 }
 function autostartDisabled(projectRoot) {
     if (/^(0|false|no|off)$/i.test(process.env.RUFLO_DAEMON_AUTOSTART ?? ''))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.41.0",
+  "version": "3.41.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",