@claude-flow/cli 3.48.0 → 3.50.0

package/dist/src/init/helper-companions.js

@@ -0,0 +1,34 @@
+/**
+ * CommonJS companion helpers that `hook-handler.cjs` requires but that are not
+ * in the signed critical set (#3555).
+ *
+ * They are CommonJS, so they ship as `.cjs`: a `.js` copy cannot load in a
+ * `"type":"module"` project. Installs made before the rename have only the
+ * `.js` copies, which the refreshed hook-handler no longer requires, so the
+ * refresh writes any missing `.cjs` companion from the CLI's own compiled
+ * generators (the trust root; no external file to verify). Stale `.js` copies
+ * are left in place and ignored. Existing `.cjs` files are never overwritten.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+export const COMMONJS_COMPANION_HELPERS = ['session.cjs', 'memory.cjs'];
+export async function ensureCommonJsCompanions(helpersDir) {
+    const missing = COMMONJS_COMPANION_HELPERS.filter((name) => !fs.existsSync(path.join(helpersDir, name)));
+    if (missing.length === 0)
+        return [];
+    const gen = await import('./helpers-generator.js');
+    const content = {
+        'session.cjs': gen.generateSessionManager,
+        'memory.cjs': gen.generateMemoryHelper,
+    };
+    const written = [];
+    for (const name of missing) {
+        try {
+            fs.writeFileSync(path.join(helpersDir, name), content[name](), { encoding: 'utf-8', mode: 0o755 });
+            written.push(name);
+        }
+        catch { /* best-effort: hook-handler degrades gracefully without it */ }
+    }
+    return written;
+}
+//# sourceMappingURL=helper-companions.js.map

package/dist/src/init/helper-integrity.d.ts

@@ -0,0 +1,21 @@
+export interface IntegrityResult {
+    /** Critical helper names whose on-disk hash doesn't match the signed manifest
+     *  (or that are missing from disk despite being part of the signed set). */
+    tampered: string[];
+    /** Set only when the package's OWN signed manifest can't be verified at all —
+     *  there's no ground truth to check the installed files against, distinct
+     *  from a clean `tampered: []` result. */
+    blocked?: string;
+}
+/**
+ * Re-verify each of `criticalHelpers` present on disk in `helpersDir` against
+ * `sourceDir`'s signed manifest. Read-only — safe to call without holding any
+ * refresh lock; callers only need to acquire one if `tampered` comes back
+ * non-empty and they intend to repair it.
+ *
+ * `sourceDir: null` (package source unresolvable) returns `{ tampered: [] }`
+ * — fails open rather than flagging every install as tampered when there is
+ * no ground truth at all to compare against.
+ */
+export declare function verifyInstalledCriticalHelpers(helpersDir: string, sourceDir: string | null, criticalHelpers: readonly string[], pubkeyPemOverride?: string): IntegrityResult;
+//# sourceMappingURL=helper-integrity.d.ts.map

package/dist/src/init/helper-integrity.js

@@ -0,0 +1,62 @@
+/**
+ * Post-install integrity re-verification for signed critical helpers (#3565).
+ *
+ * `helper-refresh.ts` verifies a helper's signature/hash once, at copy time,
+ * then stamps the target directory with the installed CLI version. Every
+ * later command short-circuited on "stamp already matches" with NO further
+ * verification — so a critical helper modified on disk after that point (a
+ * sibling package's postinstall, a stray older CLI process racing a write,
+ * direct tampering) stayed silently modified through any number of
+ * subsequent commands, forever. This module re-hashes the already-INSTALLED
+ * helpers against the signed manifest independent of the stamp, so callers
+ * can re-run it on every invocation rather than trusting a single past check.
+ *
+ * Deliberately has no opinion on WHAT to do about tampering (re-copy, warn,
+ * refuse) — that policy lives in helper-refresh.ts, which already owns the
+ * fail-closed verify-then-copy path this result feeds into to heal.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { verifyHelpersManifest, sha256Hex, HELPERS_MANIFEST_FILE, } from './helper-signing.js';
+/**
+ * Re-verify each of `criticalHelpers` present on disk in `helpersDir` against
+ * `sourceDir`'s signed manifest. Read-only — safe to call without holding any
+ * refresh lock; callers only need to acquire one if `tampered` comes back
+ * non-empty and they intend to repair it.
+ *
+ * `sourceDir: null` (package source unresolvable) returns `{ tampered: [] }`
+ * — fails open rather than flagging every install as tampered when there is
+ * no ground truth at all to compare against.
+ */
+export function verifyInstalledCriticalHelpers(helpersDir, sourceDir, criticalHelpers, pubkeyPemOverride) {
+    if (!sourceDir)
+        return { tampered: [] };
+    let trusted = null;
+    try {
+        trusted = verifyHelpersManifest(fs.readFileSync(path.join(sourceDir, HELPERS_MANIFEST_FILE), 'utf-8'), pubkeyPemOverride);
+    }
+    catch {
+        trusted = null;
+    }
+    if (!trusted)
+        return { tampered: [], blocked: 'signed helpers manifest missing or signature invalid' };
+    const tampered = [];
+    for (const name of criticalHelpers) {
+        const expected = trusted.files[name];
+        // Not part of THIS version's signed set (or source doesn't ship it) —
+        // nothing to compare the installed copy against.
+        if (!expected || !fs.existsSync(path.join(sourceDir, name)))
+            continue;
+        let actual = null;
+        try {
+            actual = sha256Hex(fs.readFileSync(path.join(helpersDir, name)));
+        }
+        catch {
+            actual = null;
+        }
+        if (actual !== expected)
+            tampered.push(name);
+    }
+    return { tampered };
+}
+//# sourceMappingURL=helper-integrity.js.map

package/dist/src/init/helper-refresh.d.ts

@@ -10,6 +10,20 @@ interface RefreshOptions {
     lockRetryMsOverride?: number;
     malformedLockStaleMsOverride?: number;
 }
+interface RefreshResult {
+    refreshed: boolean;
+    from?: string;
+    to?: string;
+    blocked?: string;
+    /** Set when `refreshed` was caused by #3565 healing, not a version bump —
+     *  the stamp already matched but one or more critical helpers failed
+     *  on-disk integrity verification and were re-copied from the verified
+     *  source. */
+    healed?: boolean;
+    /** Critical helper names that failed integrity verification, present only
+     *  alongside `healed: true`. */
+    tampered?: string[];
+}
 /**
  * ruflo-owned helpers that carry hook logic (or the render surface for the
  * funnel disclosure row) and must track the package version. Adding to this
@@ -19,6 +33,8 @@ interface RefreshOptions {
 export declare const CRITICAL_HELPERS: string[];
 /** Installed @claude-flow/cli version — the value the helpers are stamped with. */
 export declare function getInstalledCliVersion(): string;
+/** Locate the in-package `.claude/helpers` dir (the copy source). Null if not found. */
+export declare function findPackageHelpersDir(): string | null;
 /**
  * On CLI startup, refresh critical helpers if their stamp is older than the
  * installed CLI version. Two passes:
@@ -70,17 +86,8 @@ export declare function getInstalledCliVersion(): string;
  * compat with pre-3.31.3 callers). If the global pass ran, its own result is
  * carried in the optional `global` field.
  */
-export declare function autoRefreshHelpersIfStale(cwd: string, opts?: RefreshOptions): Promise<{
-    refreshed: boolean;
-    from?: string;
-    to?: string;
-    blocked?: string;
-    global?: {
-        refreshed: boolean;
-        from?: string;
-        to?: string;
-        blocked?: string;
-    };
+export declare function autoRefreshHelpersIfStale(cwd: string, opts?: RefreshOptions): Promise<RefreshResult & {
+    global?: RefreshResult;
 }>;
 export {};
 //# sourceMappingURL=helper-refresh.d.ts.map

package/dist/src/init/helper-refresh.js

@@ -20,6 +20,8 @@ import { fileURLToPath } from 'url';
 import { createRequire } from 'module';
 import * as semver from 'semver';
 import { verifyHelpersManifest, sha256Hex, HELPERS_MANIFEST_FILE, } from './helper-signing.js';
+import { ensureCommonJsCompanions } from './helper-companions.js';
+import { verifyInstalledCriticalHelpers } from './helper-integrity.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 /**
  * Walk up from `startDir` to the nearest ancestor whose `package.json` names
@@ -71,10 +73,11 @@ export const CRITICAL_HELPERS = [
     // statusline.cjs is here so the funnel disclosure row (ADR-301) reaches
     // existing installs on the next `ruflo` command, not only fresh `ruflo init`.
     'statusline.cjs',
-    // router.js is loaded by hook-handler.cjs to label each prompt with an agent.
+    // router.cjs is loaded by hook-handler.cjs to label each prompt with an agent.
     // Without it here, installs kept the pre-#2257 substring router forever
-    // ("latest" -> tester). ADR-389 / #3401.
-    'router.js',
+    // ("latest" -> tester). ADR-389 / #3401. It is CommonJS, so it ships as
+    // `.cjs`: a `.js` copy cannot load in a `"type":"module"` project (#3555).
+    'router.cjs',
 ];
 function errorCode(error) {
     return typeof error === 'object' && error !== null && 'code' in error
@@ -230,7 +233,7 @@ export function getInstalledCliVersion() {
     }
 }
 /** Locate the in-package `.claude/helpers` dir (the copy source). Null if not found. */
-function findPackageHelpersDir() {
+export function findPackageHelpersDir() {
     const candidates = [];
     try {
         const esmRequire = createRequire(import.meta.url);
@@ -313,7 +316,7 @@ async function writeCriticalHelpers(helpersDir, version, opts = {}) {
         'hook-handler.cjs': gen.generateHookHandler(),
         'intelligence.cjs': gen.generateIntelligenceStub(),
         'auto-memory-hook.mjs': gen.generateAutoMemoryHook(),
-        'router.js': gen.generateAgentRouter(), // ADR-389
+        'router.cjs': gen.generateAgentRouter(), // ADR-389 / #3555
         // Fallback needs the same generator inputs `ruflo init` uses. We match the
         // hardcoded default (maxAgents 15) because the fallback fires when the
         // installed package is unresolvable — no way to read the user's project
@@ -339,9 +342,12 @@ async function writeCriticalHelpers(helpersDir, version, opts = {}) {
 }
 /**
  * On CLI startup: if an initialized project's critical helpers are stamped older
- * than the installed CLI version, silently re-copy them. Fast path is a single
- * stamp read + string compare (sub-ms); the copy runs at most once per version
- * bump. Best-effort, never throws. No-op outside a ruflo project (requires an
+ * than the installed CLI version, silently re-copy them. Fast path is a stamp
+ * read + string compare, PLUS a re-hash of each installed critical helper
+ * against the signed manifest (#3565) — still sub-ms for the handful of small
+ * files involved, and lock-free unless a mismatch is found. The copy runs at
+ * most once per version bump; the heal-on-tamper path can run on any call.
+ * Best-effort, never throws. No-op outside a ruflo project (requires an
  * existing hook-handler.cjs — never creates files in an unrelated directory).
  *
  * FORWARD-ONLY (never downgrades): refreshing on any mere INEQUALITY, rather
@@ -365,6 +371,9 @@ async function writeCriticalHelpers(helpersDir, version, opts = {}) {
  * `pubkeyPemOverride` let a test build its own tiny, throwaway-keypair-
  * signed fixture and get real, deterministic coverage of the verify → hash →
  * copy logic without depending on that.
+ *
+ * #3565: also re-verifies on every stamp-match call (see helper-integrity.ts)
+ * and heals a mismatch via this same verify-then-copy path.
  */
 async function refreshOneHelpersDirLocked(helpersDir, version, opts) {
     if (!fs.existsSync(path.join(helpersDir, 'hook-handler.cjs')))
@@ -377,7 +386,9 @@ async function refreshOneHelpersDirLocked(helpersDir, version, opts) {
     // on this repo (CLAUDE.md "Concurrent-session helper corruption"). The
     // existing semver.gte guard below still fires for normal installs — this
     // is the escape hatch for the small set of users editing helpers directly.
-    // Applies to whichever dir this call is refreshing (project or global).
+    // Applies to whichever dir this call is refreshing (project or global),
+    // and also exempts it from the #3565 integrity re-check below — a
+    // deliberate local edit is not "tampering".
     if (fs.existsSync(path.join(helpersDir, '.LOCKED'))) {
         return { refreshed: false, blocked: '.LOCKED marker present — refresh skipped (delete to re-enable)' };
     }
@@ -386,8 +397,28 @@ async function refreshOneHelpersDirLocked(helpersDir, version, opts) {
         stamped = fs.readFileSync(path.join(helpersDir, HELPERS_STAMP_FILE), 'utf-8').trim();
     }
     catch { /* pre-feature: unstamped */ }
-    if (stamped === version)
-        return { refreshed: false }; // up to date — fast path
+    if (stamped === version) {
+        const source = opts.sourceDirOverride ?? findPackageHelpersDir();
+        const integrity = verifyInstalledCriticalHelpers(helpersDir, source, CRITICAL_HELPERS, opts.pubkeyPemOverride);
+        if (integrity.blocked)
+            return { refreshed: false, blocked: integrity.blocked };
+        if (integrity.tampered.length === 0)
+            return { refreshed: false }; // up to date AND verified intact
+        // Tampering detected post-install — heal via the same fail-closed
+        // verify-then-copy path a version-bump refresh already uses.
+        await opts.beforeWriteOverride?.();
+        const healRes = await writeCriticalHelpers(helpersDir, version, {
+            sourceDirOverride: opts.sourceDirOverride,
+            pubkeyPemOverride: opts.pubkeyPemOverride,
+        });
+        if (healRes.blocked)
+            return { refreshed: false, blocked: healRes.blocked };
+        if (healRes.wrote)
+            await ensureCommonJsCompanions(helpersDir); // #3555
+        return healRes.wrote
+            ? { refreshed: true, healed: true, tampered: integrity.tampered, from: stamped, to: version }
+            : { refreshed: false };
+    }
     if (stamped && semver.valid(stamped) && semver.valid(version) && semver.gte(stamped, version)) {
         // Stamped version is already >= what this binary reports — refreshing
         // would silently DOWNGRADE the helpers. Skip, untouched.
@@ -400,6 +431,8 @@ async function refreshOneHelpersDirLocked(helpersDir, version, opts) {
     });
     if (res.blocked)
         return { refreshed: false, blocked: res.blocked };
+    if (res.wrote)
+        await ensureCommonJsCompanions(helpersDir); // #3555
     return res.wrote ? { refreshed: true, from: stamped || '(unstamped)', to: version } : { refreshed: false };
 }
 async function refreshOneHelpersDir(helpersDir, version, opts) {
@@ -412,8 +445,18 @@ async function refreshOneHelpersDir(helpersDir, version, opts) {
         return { refreshed: false, blocked: '.LOCKED marker present — refresh skipped (delete to re-enable)' };
     }
     try {
-        if (fs.readFileSync(path.join(helpersDir, HELPERS_STAMP_FILE), 'utf-8').trim() === version)
-            return { refreshed: false };
+        if (fs.readFileSync(path.join(helpersDir, HELPERS_STAMP_FILE), 'utf-8').trim() === version) {
+            // #3565: re-hash before trusting a stamp match (helper-integrity.ts).
+            // Read-only — no lock needed unless something's actually wrong; the
+            // (rare) heal path below re-verifies under lock.
+            const source = opts.sourceDirOverride ?? findPackageHelpersDir();
+            const integrity = verifyInstalledCriticalHelpers(helpersDir, source, CRITICAL_HELPERS, opts.pubkeyPemOverride);
+            if (integrity.blocked)
+                return { refreshed: false, blocked: integrity.blocked };
+            if (integrity.tampered.length === 0)
+                return { refreshed: false };
+            // else: tampering found — fall through to acquire the lock and heal.
+        }
     }
     catch { /* unstamped: continue to the locked path */ }
     const releaseLock = await acquireRefreshLock(helpersDir, opts);

package/dist/src/init/helpers-generator.js

@@ -242,7 +242,7 @@ const [,, command, ...args] = process.argv;
 if (command && commands[command]) {
   commands[command](...args);
 } else {
-  console.log('Usage: session.js <start|restore|end|status|update|metric> [args]');
+  console.log('Usage: session.cjs <start|restore|end|status|update|metric> [args]');
 }
 
 module.exports = commands;
@@ -336,7 +336,7 @@ if (require.main === module) {
     const result = routeTask(task);
     console.log(JSON.stringify(result, null, 2));
   } else {
-    console.log('Usage: router.js <task description>');
+    console.log('Usage: router.cjs <task description>');
     console.log('\\nAvailable agents:', Object.keys(AGENT_CAPABILITIES).join(', '));
   }
 }
@@ -427,7 +427,7 @@ const value = valueParts.join(' ');
 if (command && commands[command]) {
   commands[command](key, value);
 } else {
-  console.log('Usage: memory.js <get|set|delete|clear|keys> [key] [value]');
+  console.log('Usage: memory.cjs <get|set|delete|clear|keys> [key] [value]');
 }
 
 module.exports = commands;
@@ -504,9 +504,9 @@ export function generateHookHandler() {
         '  return null;',
         '}',
         '',
-        "const router = safeRequire(path.join(helpersDir, 'router.js'));",
-        "const session = safeRequire(path.join(helpersDir, 'session.js'));",
-        "const memory = safeRequire(path.join(helpersDir, 'memory.js'));",
+        "const router = safeRequire(path.join(helpersDir, 'router.cjs'));",
+        "const session = safeRequire(path.join(helpersDir, 'session.cjs'));",
+        "const memory = safeRequire(path.join(helpersDir, 'memory.cjs'));",
         "const intelligence = safeRequire(path.join(helpersDir, 'intelligence.cjs'));",
         '',
         'const [,, command, ...args] = process.argv;',
@@ -530,7 +530,19 @@ export function generateHookHandler() {
         '  });',
         '}',
         '',
+        // ADR-404: same handshake as the shipped hook-handler.cjs, so a helper
+        // regenerated by the refresh fallback still hands route/post-edit to the mod.
+        '// ADR-404: the ruflo mod names the events it runs in-process in',
+        '// RUFLO_MODS_OWNS; only side-effect events hand over, guards always run.',
+        "const MOD_OWNABLE_EVENTS = new Set(['route', 'post-edit']);",
+        'function ownedByMod(cmd, env) {',
+        '  env = env || process.env;',
+        '  if (!MOD_OWNABLE_EVENTS.has(cmd)) return false;',
+        "  return String(env.RUFLO_MODS_OWNS || '').split(',').some(function (owned) { return owned.trim() === cmd; });",
+        '}',
+        '',
         'async function main() {',
+        '  if (ownedByMod(command)) return;',
         '  let stdinData = "";',
         '  try { stdinData = await readStdin(); } catch (e) { /* ignore */ }',
         '  let hookInput = {};',
@@ -1358,7 +1370,7 @@ const [,, command, ...args] = process.argv;
 if (command && commands[command]) {
   commands[command](...args);
 } else {
-  console.log('Usage: session.js <start|restore|end|status>');
+  console.log('Usage: session.cjs <start|restore|end|status>');
   console.log(\`Platform: \${platform}\`);
   console.log(\`Data dir: \${SESSION_DIR}\`);
 }
@@ -1376,9 +1388,9 @@ export function generateHelpers(options) {
         helpers['pre-commit'] = generatePreCommitHook();
         helpers['post-commit'] = generatePostCommitHook();
         // Cross-platform Node.js scripts
-        helpers['session.js'] = generateCrossPlatformSessionManager();
-        helpers['router.js'] = generateAgentRouter();
-        helpers['memory.js'] = generateMemoryHelper();
+        helpers['session.cjs'] = generateCrossPlatformSessionManager();
+        helpers['router.cjs'] = generateAgentRouter();
+        helpers['memory.cjs'] = generateMemoryHelper();
         // Windows-specific scripts
         helpers['daemon-manager.ps1'] = generateWindowsDaemonManager();
         helpers['daemon-manager.cmd'] = generateWindowsBatchWrapper();

package/dist/src/mcp-tools/hooks-tools.d.ts

@@ -12,11 +12,24 @@ import { type RouterEmbedderKind } from '../ruvector/router-embedder.js';
 export declare function scrubReasoningBlocks(text: string): string;
 /** Test hook: drop the cached semantic index so the next route rebuilds it. */
 export declare function resetSemanticRouterForTests(): void;
-/** Exported for tests. */
-export declare function suggestAgentsForTask(task: string): {
+/**
+ * Confidence for a task nothing matched (#3567). It must rank below every real
+ * signal: keyword hits are >= 0.8, learned outcomes >= 0.7, and a semantic
+ * match is only eligible above 0.4. Matches the helper router's 0.3 fall-through.
+ */
+export declare const NO_MATCH_CONFIDENCE = 0.3;
+export interface TaskAgentSuggestion {
     agents: string[];
     confidence: number;
-};
+    /** false when no keyword or learned pattern matched; the agents are a default, not a decision. */
+    matched: boolean;
+    reason?: 'no-match-default';
+    note?: string;
+}
+/** True when the task has at least one letter or digit in any script. */
+export declare function hasRoutableText(task: string): boolean;
+/** Exported for tests. */
+export declare function suggestAgentsForTask(task: string): TaskAgentSuggestion;
 export declare const hooksPreEdit: MCPTool;
 export declare const hooksPostEdit: MCPTool;
 export declare const hooksPreCommand: MCPTool;

package/dist/src/mcp-tools/hooks-tools.js

@@ -722,12 +722,41 @@ const KEYWORD_MATCHERS = Object.entries(KEYWORD_PATTERNS).map(([keyword, result]
     const body = /[\s/]/.test(keyword) ? escaped : `${escaped}(?:s|es|ing|ed)?`;
     return { regex: new RegExp(`\\b${body}\\b`, 'i'), result };
 });
+/**
+ * Confidence for a task nothing matched (#3567). It must rank below every real
+ * signal: keyword hits are >= 0.8, learned outcomes >= 0.7, and a semantic
+ * match is only eligible above 0.4. Matches the helper router's 0.3 fall-through.
+ */
+export const NO_MATCH_CONFIDENCE = 0.3;
+/** True when the task has at least one letter or digit in any script. */
+export function hasRoutableText(task) {
+    return /[\p{L}\p{N}]/u.test(task);
+}
+// Keyword matchers are English regexes; letters outside Latin script can never hit them.
+const NON_LATIN_LETTER = /(?![A-Za-zÀ-ɏ])\p{L}/u;
+function noMatchNote(task) {
+    if (!hasRoutableText(task))
+        return 'Task has no words to match.';
+    if (NON_LATIN_LETTER.test(task)) {
+        return 'Keyword matchers are English-only, so non-English text cannot match them.';
+    }
+    return 'No keyword or learned pattern matched.';
+}
 /** Exported for tests. */
 export function suggestAgentsForTask(task) {
+    const noMatch = () => ({
+        agents: ['coder', 'researcher', 'tester'],
+        confidence: NO_MATCH_CONFIDENCE,
+        matched: false,
+        reason: 'no-match-default',
+        note: noMatchNote(task),
+    });
+    if (!hasRoutableText(task))
+        return noMatch();
     // Check static keyword patterns first
     for (const { regex, result } of KEYWORD_MATCHERS) {
         if (regex.test(task)) {
-            return result;
+            return { ...result, matched: true };
         }
     }
     // Check runtime-learned patterns from successful task outcomes
@@ -747,11 +776,10 @@ export function suggestAgentsForTask(task) {
         }
         // Require at least 2 keyword overlap to prevent false positives
         if (bestAgent && bestOverlap >= 2) {
-            return { agents: [bestAgent], confidence: Math.min(0.6 + bestOverlap * 0.05, 0.85) };
+            return { agents: [bestAgent], confidence: Math.min(0.6 + bestOverlap * 0.05, 0.85), matched: true };
         }
     }
-    // Default fallback
-    return { agents: ['coder', 'researcher', 'tester'], confidence: 0.7 };
+    return noMatch();
 }
 function assessCommandRisk(command) {
     const warnings = [];
@@ -1205,6 +1233,7 @@ async function routeTaskLocal(task, context, useSemanticRouter, embedderOverride
     let agents;
     let confidence;
     let matchedPattern = '';
+    let noMatchDetail = null;
     // Both static and learned patterns are gated on the same similarity
     // score. Learned patterns additionally require support/reliability as a
     // quality guard, but do NOT need a higher score bar — a learned pattern
@@ -1212,7 +1241,9 @@ async function routeTaskLocal(task, context, useSemanticRouter, embedderOverride
     // (#2864: a 25pp higher threshold made a top-scoring learned-researcher
     // match at 0.57 lose to a static match at 0.52, discarding the learned
     // store's output on the majority of routes).
-    const eligibleSemantic = semanticResult.find((match) => {
+    // A task with no letters or digits has nothing for the embedder to mean;
+    // any similarity it scores is noise, so it never becomes a semantic match.
+    const eligibleSemantic = !hasRoutableText(task) ? undefined : semanticResult.find((match) => {
         if (match.score <= 0.4)
             return false;
         const learned = match.intent.startsWith('learned-') || match.metadata.source === 'learned';
@@ -1232,9 +1263,16 @@ async function routeTaskLocal(task, context, useSemanticRouter, embedderOverride
         const suggestion = suggestAgentsForTask(task);
         agents = suggestion.agents;
         confidence = suggestion.confidence;
-        matchedPattern = 'keyword-fallback';
         routingMethod = 'keyword';
-        backendInfo = 'keyword matching';
+        if (suggestion.matched) {
+            matchedPattern = 'keyword-fallback';
+            backendInfo = 'keyword matching';
+        }
+        else {
+            matchedPattern = 'no-match-default';
+            backendInfo = 'keyword matching (no match)';
+            noMatchDetail = suggestion.note ?? 'No pattern matched.';
+        }
     }
     // Determine complexity
     const taskLower = task.toLowerCase();
@@ -1252,6 +1290,9 @@ async function routeTaskLocal(task, context, useSemanticRouter, embedderOverride
             throughput: routingLatencyMs > 0 ? `${Math.round(1000 / routingLatencyMs)} routes/s` : 'N/A',
         },
         matchedPattern,
+        // #3567: callers branch on `matched`; a no-match result is a default, not a decision.
+        matched: noMatchDetail === null,
+        ...(noMatchDetail !== null ? { reason: 'no-match-default', note: noMatchDetail } : {}),
         semanticMatches: semanticResult.slice(0, 3).map(r => ({
             pattern: r.intent,
             score: Math.round(r.score * 100) / 100,
@@ -1261,15 +1302,18 @@ async function routeTaskLocal(task, context, useSemanticRouter, embedderOverride
             confidence: Math.round(confidence * 100) / 100,
             reason: routingMethod.startsWith('semantic')
                 ? `Semantic similarity to "${matchedPattern}" pattern (${Math.round(confidence * 100)}%)`
-                : `Task contains keywords matching ${agents[0]} specialization`,
+                : noMatchDetail !== null
+                    ? `Nothing matched; default suggestion only. ${noMatchDetail}`
+                    : `Task contains keywords matching ${agents[0]} specialization`,
         },
         alternativeAgents: agents.slice(1).map((agent, i) => ({
             type: agent,
-            confidence: Math.round((confidence - (0.1 * (i + 1))) * 100) / 100,
-            reason: `Alternative agent for ${agent} capabilities`,
+            confidence: Math.max(0, Math.round((confidence - (0.1 * (i + 1))) * 100) / 100),
+            reason: noMatchDetail !== null ? 'Default suggestion (nothing matched)' : `Alternative agent for ${agent} capabilities`,
         })),
         estimatedMetrics: {
-            successProbability: Math.round(confidence * 100) / 100,
+            // No pattern means no basis for a success estimate.
+            successProbability: noMatchDetail !== null ? null : Math.round(confidence * 100) / 100,
             estimatedDuration: complexity === 'high' ? '2-4 hours' : complexity === 'medium' ? '30-60 min' : '10-30 min',
             complexity,
         },
@@ -1506,12 +1550,15 @@ export const hooksPreTask = {
         return {
             taskId,
             description,
+            agentsMatched: suggestion.matched,
             suggestedAgents: suggestion.agents.map((agent, i) => ({
                 type: agent,
                 confidence: suggestion.confidence - (0.05 * i),
-                reason: i === 0
-                    ? `Primary agent for ${agent} tasks based on learned patterns`
-                    : `Alternative agent with ${agent} capabilities`,
+                reason: !suggestion.matched
+                    ? 'Default suggestion (nothing matched)'
+                    : i === 0
+                        ? `Primary agent for ${agent} tasks based on learned patterns`
+                        : `Alternative agent with ${agent} capabilities`,
             })),
             complexity,
             estimatedDuration: complexity === 'high' ? '2-4 hours' : complexity === 'medium' ? '30-60 min' : '10-30 min',
@@ -1856,8 +1903,34 @@ export const hooksExplain = {
         catch {
             // File unreadable; leave as null
         }
+        // #3567: when nothing matched, say so instead of explaining a match that did not happen.
+        if (!suggestion.matched) {
+            return {
+                task,
+                matched: false,
+                reason: 'no-match-default',
+                explanation: `No keyword or learned pattern matched this task. ${suggestion.note ?? ''} ` +
+                    `"${suggestion.agents[0]}" is a default suggestion, not a routing decision.`.trim(),
+                factors: [
+                    { factor: 'Keyword Match', weight: 0.4, value: null, impact: 'No keyword matched' },
+                    { factor: 'Historical Success', weight: 0.3, value: historicalSuccess, impact: historicalNote },
+                    { factor: 'Agent Availability', weight: 0.2, value: null, impact: 'Agent availability tracking not implemented' },
+                    { factor: 'Task Complexity', weight: 0.1, value: task.length > 100 ? 0.8 : 0.3, impact: 'Complexity assessment' },
+                ],
+                patterns: matchedPatterns,
+                decision: {
+                    agent: suggestion.agents[0],
+                    confidence: suggestion.confidence,
+                    reasoning: [
+                        'No pattern matched; the agent is a default suggestion',
+                        `Confidence ${(suggestion.confidence * 100).toFixed(0)}% is below every real match`,
+                    ],
+                },
+            };
+        }
         return {
             task,
+            matched: true,
             explanation: `The routing decision was made based on keyword analysis of the task description. ` +
                 `The task contains keywords that match the "${suggestion.agents[0]}" specialization with ${(suggestion.confidence * 100).toFixed(0)}% confidence.`,
             factors: [

package/dist/src/mcp-tools/memory-tools.d.ts

@@ -10,5 +10,12 @@
  * @module v3/cli/mcp-tools/memory-tools
  */
 import type { MCPTool } from './types.js';
+export declare const DANGEROUS_KEY_PATTERN: RegExp;
+/**
+ * #3570: the one key rule for every memory write path (MCP store, CLI store,
+ * import). Plain `/` stays legal (`probe/x`); traversal and shell metacharacters
+ * do not. Returns the error message, or null when the key is acceptable.
+ */
+export declare function memoryKeyError(key: string): string | null;
 export declare const memoryTools: MCPTool[];
 //# sourceMappingURL=memory-tools.d.ts.map