@claude-flow/cli 3.54.0 → 3.55.0

package/.claude/helpers/helpers.manifest.json

@@ -1,14 +1,14 @@
 {
   "manifest": {
-    "version": "3.54.0",
+    "version": "3.55.0",
     "files": {
       "auto-memory-hook.mjs": "c8d218526a3c34034c2a69de23f507f0eb0f70d59c16426a8edc849e6ac22529",
-      "hook-handler.cjs": "c3f9e7d2f5b33fd396d43de24fc77cb2b33eaf962114dcb9ee92a8075746b0fe",
+      "hook-handler.cjs": "34d2aacfb59a73ff94b1467bb57ab9d9c4af89c0e470aadf3bd0d74a503a658d",
       "intelligence.cjs": "ac5033a77bcea9796856629d5d319bde9ab6b7edf0dcd0d4af187ce30af90836",
       "statusline.cjs": "4a48353b4f1566fa4379b00fd0321b6676a22b6cc91fbbd8380ac5183d619468",
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "670XlbndW0uatGNpiwtcNsZqZBQdr5vao9SQbLOBW7bXpMc198/7Qr59o2/AlT3vs/nQkQe+vUcngqY2IQZwBQ==",
+  "signature": "FT6oLMAU2RXu8iAdlOFTNGcjYZ52pkhrGFgn3/oKJdtVab0etCzO24Nr2ut1Hr9kn3tRAqb6D8MZwKfcoSqlCQ==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/hook-handler.cjs

@@ -486,6 +486,7 @@ const handlers = {
     // Join literal quote fragments and normalize root paths without shell evaluation.
     function hasRootDelete(command, depth = 0) {
       let word = '', quote = '', started = false, redirect = false
+      let ansiNul = false // a NUL inside $'...' ends that string, as in bash
       let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
       const isRoot = (operand) => {
         if (!operand.startsWith('/')) return false
@@ -497,22 +498,55 @@ const handlers = {
         }
         return parts.length === 0 || /[*?\[]/.test(parts[0])
       }
+      // One backslash escape inside $'...', from the character after the backslash.
+      // Returns the text it stands for and the index of its last character. An unknown escape keeps its backslash.
+      // The command arrives lowercased, so an uppercase-U escape reads as a lowercase one: eight digits starting 0000 are one code point.
+      const ansiEscape = (s, at) => {
+        const c = s[at]
+        const simple = { a: '\x07', b: '\b', e: '\x1b', f: '\f', n: '\n', r: '\r', t: '\t', v: '\v', '\\': '\\', "'": "'", '"': '"', '?': '?' }
+        if (simple[c] !== undefined) return [simple[c], at]
+        const digits = (from, max, pattern) => pattern.exec(s.slice(from, from + max))?.[0]
+        const octal = digits(at, 3, /^[0-7]+/)
+        if (octal) return [String.fromCharCode(parseInt(octal, 8) & 255), at + octal.length - 1]
+        const hex = c === 'x' ? digits(at + 1, 2, /^[0-9a-f]+/) : undefined
+        if (hex) return [String.fromCharCode(parseInt(hex, 16)), at + hex.length]
+        const wide = c === 'u' ? (digits(at + 1, 8, /^0000[0-9a-f]{4}$/) ?? digits(at + 1, 4, /^[0-9a-f]+/)) : undefined
+        if (wide) return [String.fromCodePoint(parseInt(wide, 16)), at + wide.length]
+        if (c === 'c' && at + 1 < s.length) return [String.fromCharCode(s.charCodeAt(at + 1) & 31), at + 1]
+        return ['\\' + c, at]
+      }
       const finishWord = () => {
         if (!started) return false
         // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
         // Bound rescanning to four levels; beyond that retain its conservative check.
-        if (word.includes('rm') && /[\s;&|()]/.test(word)) {
+        if (/[\s;&|()\x60]/.test(word)) {
           if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
         }
         if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
         else if (!optionsEnded && word === '--') optionsEnded = true
         else if (!optionsEnded && word.startsWith('-')) {
-          recursive = recursive || word === '--recursive' || /^-[a-z]*r[a-z]*$/.test(word)
-          force = force || word === '--force' || /^-[a-z]*f[a-z]*$/.test(word)
+          // GNU getopt accepts any unambiguous long-option prefix: --r, --recur, --forc.
+          recursive = recursive || (word.length > 2 && '--recursive'.startsWith(word)) || /^-[a-z]*r[a-z]*$/.test(word)
+          force = force || (word.length > 2 && '--force'.startsWith(word)) || /^-[a-z]*f[a-z]*$/.test(word)
         } else root = root || isRoot(word)
         word = ''; started = false
         return inRm && recursive && force && root
       }
+      // A command substitution's body, from just after its opening backtick. Bash removes a
+      // backslash only before $, a backtick or a backslash (and " inside double quotes) and
+      // drops backslash-newline; any other backslash stays for the nested scan.
+      const substitution = (from, inDouble) => {
+        let body = '', j = from
+        for (; j < command.length && command[j] !== '\x60'; j++) {
+          const next = command[j + 1]
+          if (command[j] === '\\' && j + 1 < command.length) {
+            if (next === '\n') { j++; continue }
+            if (next === '$' || next === '\x60' || next === '\\' || (inDouble && next === '"')) { body += next; j++; continue }
+          }
+          body += command[j]
+        }
+        return [j, depth < 4 ? hasRootDelete(body, depth + 1) : body.includes('rm -rf /')]
+      }
       const finishCommand = () => {
         const denied = inRm && recursive && force && root
         inRm = optionsEnded = recursive = force = root = false
@@ -523,7 +557,25 @@ const handlers = {
         const redirectionAmpersand = char === '&' && (redirect || command[i + 1] === '>')
         redirect = false
         if (quote) {
+          if (quote === "$'") {
+            if (char === "'") { quote = ''; ansiNul = false }
+            else if (char === '\\' && i + 1 < command.length) {
+              const [text, last] = ansiEscape(command, i + 1)
+              i = last
+              if (!ansiNul) { const nul = text.indexOf('\0'); if (nul < 0) word += text; else { word += text.slice(0, nul); ansiNul = true } }
+            } else if (!ansiNul) word += char
+            continue
+          }
           if (char === quote) quote = ''
+          else if (quote === '"' && char === '\x60' && command.indexOf('\x60', i + 1) > i) {
+            const [end, denied] = substitution(i + 1, true)
+            if (denied) return true
+            // The substitution is gone from the word, as bash's empty output is (a quoted empty substitution glued to -rf leaves -rf).
+            // A # right after it is still inside the word: a placeholder keeps a rescan (sh -c "...")
+            // from reading it as the start of a comment.
+            if (command[end + 1] === '#') word += '\u0001'
+            i = end
+          }
           else if (quote === '"' && char === '\\' && i + 1 < command.length &&
             (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
               command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
@@ -535,6 +587,16 @@ const handlers = {
         if (char === '\\' && i + 1 < command.length) {
           const next = command[++i]
           if (next !== '\n') { word += next; started = true }
+        } else if (char === '\x60' && command.indexOf('\x60', i + 1) > i) {
+          // Command substitution: scan the body as its own command; the substitution
+          // stays inside the enclosing word, so the rm being parsed keeps its state,
+          // and the word has started (a # right after it is not a comment).
+          const [end, denied] = substitution(i + 1, false)
+          if (denied) return true
+          i = end; started = true
+        } else if (char === '$' && (command[i + 1] === "'" || command[i + 1] === '"')) {
+          // ANSI-C ($'...': escapes decoded) and locale ($"...") quoting: the $ is not part of the word.
+          quote = command[i + 1] === "'" ? "$'" : '"'; started = true; i++
         } else if (char === '"' || char === "'") {
           quote = char; started = true
         } else if (char === '#' && !started) {

package/bin/cli.js

@@ -301,7 +301,7 @@ if (isMCPMode) {
         }
 
         try {
-          const result = await callMCPTool(toolName, toolParams, { sessionId });
+          const result = await callMCPTool(toolName, toolParams, { sessionId, transport: 'stdio' });
           // Failed task outcomes are data; an explicit handler error is a tool failure.
           const isError = result !== null && typeof result === 'object'
             && typeof result.error === 'string' && result.error.trim().length > 0;

package/bin/mcp-server.js

@@ -190,7 +190,7 @@ async function handleMessage(message) {
         }
 
         try {
-          const result = await callMCPTool(toolName, toolParams, { sessionId });
+          const result = await callMCPTool(toolName, toolParams, { sessionId, transport: 'stdio' });
           return {
             jsonrpc: '2.0',
             id: message.id,

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-07T03:21:20.523Z",
-  "gitSha": "70a9d5ec",
+  "generatedAt": "2026-10-07T17:32:59.615Z",
+  "gitSha": "2ab3f99f",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/blocking-stdio.d.ts

@@ -0,0 +1,11 @@
+/**
+ * #3851: stdout/stderr writes to a pipe are asynchronous on POSIX, so the
+ * `process.exit()` calls that follow a command (bin wrappers, CLI.run error
+ * paths, commands that exit themselves) discard whatever the consumer has not
+ * read yet, i.e. everything past the pipe buffer (64 KiB). Switching the pipe
+ * handles to blocking mode makes every write complete before it returns, so
+ * every exit path is safe. Same technique as the MCP stdio server.
+ * Files and TTYs are already synchronous and are left alone.
+ */
+export declare function ensureBlockingStdio(): void;
+//# sourceMappingURL=blocking-stdio.d.ts.map

package/dist/src/blocking-stdio.js

@@ -0,0 +1,23 @@
+/**
+ * #3851: stdout/stderr writes to a pipe are asynchronous on POSIX, so the
+ * `process.exit()` calls that follow a command (bin wrappers, CLI.run error
+ * paths, commands that exit themselves) discard whatever the consumer has not
+ * read yet, i.e. everything past the pipe buffer (64 KiB). Switching the pipe
+ * handles to blocking mode makes every write complete before it returns, so
+ * every exit path is safe. Same technique as the MCP stdio server.
+ * Files and TTYs are already synchronous and are left alone.
+ */
+export function ensureBlockingStdio() {
+    for (const stream of [process.stdout, process.stderr]) {
+        const s = stream;
+        if (s.isTTY)
+            continue;
+        try {
+            s._handle?.setBlocking?.(true);
+        }
+        catch {
+            // best effort: never fail the CLI because stdio could not be switched
+        }
+    }
+}
+//# sourceMappingURL=blocking-stdio.js.map

package/dist/src/commands/autopilot.js

@@ -181,8 +181,8 @@ const configCommand = {
     name: 'config',
     description: 'Configure max iterations, timeout, and task sources',
     options: [
-        { name: 'max-iterations', type: 'string', description: 'Max re-engagement iterations (1-1000)' },
-        { name: 'timeout', type: 'string', description: 'Timeout in minutes (1-1440)' },
+        { name: 'max-iterations', type: 'number', description: 'Max re-engagement iterations (1-1000)' },
+        { name: 'timeout', type: 'number', description: 'Timeout in minutes (1-1440)' },
         { name: 'task-sources', type: 'string', description: `Comma-separated task sources: ${[...VALID_TASK_SOURCES].join(', ')}` },
     ],
     action: async (ctx) => {

package/dist/src/commands/daemon.js

@@ -10,6 +10,11 @@ import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
 import { homedir } from 'os';
 import * as fs from 'fs';
+// #1968 / #3547: shared validator for `--workers <list>`, used both when
+// reading the flag into DaemonConfig (below) and when forwarding it to the
+// forked background child's argv (startBackgroundDaemon). One pattern, one
+// place, so the two paths can't drift out of sync on what they accept.
+const WORKERS_RE = /^[a-z][a-z0-9_-]*(,[a-z][a-z0-9_-]*)*$/;
 // Start daemon subcommand
 const startCommand = {
     name: 'start',
@@ -119,6 +124,22 @@ const startCommand = {
                 output.printWarning(`Ignoring invalid --ttl value: ${sanitize(rawTtl)}`);
             }
         }
+        // #3547 (#1968 follow-up): `--workers` was forwarded to the forked
+        // background child's argv (below, in startBackgroundDaemon) but never
+        // read into DaemonConfig here, so WorkerDaemon always fell back to
+        // DEFAULT_WORKERS (7 enabled) regardless of what was requested — in
+        // both foreground mode (this same action, run directly) and background
+        // mode (this same action, re-run in the forked child with --foreground
+        // and the forwarded --workers flag).
+        const rawWorkers = ctx.flags.workers;
+        if (typeof rawWorkers === 'string' && rawWorkers.length > 0) {
+            if (WORKERS_RE.test(rawWorkers)) {
+                config.enabledWorkers = rawWorkers.split(',');
+            }
+            else if (!quiet) {
+                output.printWarning(`Ignoring invalid --workers value: ${sanitize(rawWorkers)}`);
+            }
+        }
         // Check if background daemon already running (skip if we ARE the daemon process)
         //
         // #2407 — without an atomic lockfile, N concurrent `daemon start` calls
@@ -518,7 +539,6 @@ async function startBackgroundDaemon(projectRoot, quiet, forwarded = {}) {
     // through — argv goes straight to a forked process so reject anything
     // that doesn't look like a comma-separated worker-name list or one of
     // the allowed sandbox modes.
-    const WORKERS_RE = /^[a-z][a-z0-9_-]*(,[a-z][a-z0-9_-]*)*$/;
     if (typeof workers === 'string' && workers.length > 0 && WORKERS_RE.test(workers)) {
         forkArgs.push('--workers', workers);
     }

package/dist/src/commands/hive-mind.js

@@ -1016,6 +1016,13 @@ const consensusCommand = {
         const action = ctx.flags.action || 'list';
         try {
             const result = await callMCPTool('hive-mind_consensus', { action, proposalId: ctx.flags.proposalId, type: ctx.flags.type, value: ctx.flags.value, vote: ctx.flags.vote === 'yes', voterId: ctx.flags.voterId, hiveToken: getHiveTokenForCli() });
+            if (result.error) {
+                if (ctx.flags.format === 'json')
+                    output.printJson(result);
+                else
+                    output.printError(`Consensus error: ${String(result.error)}`);
+                return { success: false, exitCode: 1, data: result };
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
                 return { success: true, data: result };

package/dist/src/commands/mcp.js

@@ -8,7 +8,7 @@
 import { output } from '../output.js';
 import { confirm } from '../prompt.js';
 import { installParentDeathWatchdog } from '../runtime/parent-death-watchdog.js';
-import { getServerManager, getMCPServerStatus, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
+import { getServerManager, getMCPServerStatus, resolveMcpHttpAuthToken, isLoopbackHost, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
 import { listMCPTools, callMCPTool, hasTool } from '../mcp-client.js';
 // MCP tools categories
 const TOOL_CATEGORIES = [
@@ -71,6 +71,16 @@ const startCommand = {
             description: 'HTTP request timeout in milliseconds (default 30000; env RUFLO_MCP_REQUEST_TIMEOUT_MS)',
             type: 'number'
         },
+        {
+            name: 'auth-token-file',
+            description: 'Read the HTTP bearer token from this file (http transport). Preferred over --auth-token; env RUFLO_MCP_HTTP_TOKEN also works',
+            type: 'string'
+        },
+        {
+            name: 'auth-token',
+            description: 'HTTP bearer token (16+ printable ASCII chars). Visible in argv/ps - prefer RUFLO_MCP_HTTP_TOKEN or --auth-token-file',
+            type: 'string'
+        },
         {
             name: 'daemon',
             short: 'd',
@@ -90,6 +100,8 @@ const startCommand = {
         { command: 'claude-flow mcp start', description: 'Start with defaults (stdio)' },
         { command: 'claude-flow mcp start -p 8080 -t http', description: 'Start HTTP server' },
         { command: 'claude-flow mcp start -t http --request-timeout-ms 120000', description: 'Allow slower cold-start HTTP tools' },
+        { command: 'RUFLO_MCP_HTTP_TOKEN=<16+ chars> claude-flow mcp start -t http', description: 'HTTP server requiring "Authorization: Bearer <token>" on every request (except GET /health)' },
+        { command: 'RUFLO_MCP_HTTP_TOKEN=<16+ chars> claude-flow mcp start -t http --host 0.0.0.0', description: 'Non-loopback bind: allowed only with a token (or RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1)' },
         { command: 'claude-flow mcp start -d', description: 'Start as daemon' },
         { command: 'claude-flow mcp start -f', description: 'Force restart (kill existing)' }
     ],
@@ -109,6 +121,17 @@ const startCommand = {
             output.printError('Request timeout must be an integer from 1 to 3600000 milliseconds');
             return { success: false, exitCode: 1 };
         }
+        let authToken;
+        try {
+            authToken = resolveMcpHttpAuthToken({
+                token: (ctx.flags.authToken ?? ctx.flags['auth-token']),
+                tokenFile: (ctx.flags.authTokenFile ?? ctx.flags['auth-token-file']),
+            });
+        }
+        catch (error) {
+            output.printError(error.message);
+            return { success: false, exitCode: 1 };
+        }
         const daemon = ctx.flags.daemon ?? false;
         const force = ctx.flags.force ?? false;
         output.writeln();
@@ -166,6 +189,7 @@ const startCommand = {
             port,
             tools: !tools || tools === 'all' ? 'all' : tools.split(','),
             ...(requestTimeoutMs === undefined ? {} : { requestTimeoutMs }),
+            ...(authToken ? { authToken } : {}),
             daemonize: daemon,
         };
         try {
@@ -218,6 +242,15 @@ const startCommand = {
             if (transport === 'http') {
                 output.writeln(output.dim(`  Health: http://${host}:${port}/health`));
                 output.writeln(output.dim(`  RPC: http://${host}:${port}/rpc`));
+                if (authToken) {
+                    output.writeln(output.dim('  Auth: bearer token required (Authorization: Bearer <token>); /health is public'));
+                }
+                else if (isLoopbackHost(host)) {
+                    output.printWarning('No auth token set: any local process (and DNS-rebinding web pages) can call tools. Set RUFLO_MCP_HTTP_TOKEN to require a bearer token.');
+                }
+                else {
+                    output.printWarning('Running UNAUTHENTICATED on a non-loopback host (RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP is set).');
+                }
             }
             else if (transport === 'websocket') {
                 output.writeln(output.dim(`  WebSocket: ws://${host}:${port}/ws`));
@@ -596,6 +629,7 @@ const execCommand = {
             const startTime = performance.now();
             const result = await callMCPTool(tool, params, {
                 sessionId: `cli-${Date.now().toString(36)}`,
+                transport: 'cli',
                 requestId: `exec-${Date.now()}`,
             });
             const duration = performance.now() - startTime;

package/dist/src/commands/policy.js

@@ -1,3 +1,4 @@
+import { anchorPosture } from '../services/policy-ledger-anchor.js';
 import { output } from '../output.js';
 import { autoMigratePolicyStateIfNeeded, evaluatePolicyRequest, loadPolicyState, revokePolicyApproval, setPolicyBudget, setPolicyMode, upsertPolicyRule, verifyPolicyLedger, } from '../services/policy-runtime.js';
 function argJson(value, label) {
@@ -19,12 +20,16 @@ function requireInteractiveAdministrator() {
         throw new Error('policy administration requires an interactive local terminal');
     }
 }
+// #3602: say what verify can and cannot prove.
+const LEDGER_TRUST_SCOPE = 'detects edits confined to state.json or to the project directory; '
+    + 'does not defend against an attacker who can rewrite both the project directory and ~/.config/ruflo (ADR-475)';
 export const policyCommand = {
     name: 'policy',
     description: 'Agentic policy engine — evaluate actions, manage rules/approvals, and verify the decision ledger (ADR-324)',
     options: [
         { name: 'mode', type: 'string', description: 'Policy mode: legacy | observe | enforce' },
         { name: 'project-root', type: 'string', description: 'Project root containing .claude-flow/policy' },
+        { name: 'establish-anchor', type: 'boolean', description: 'verify: explicitly anchor a ledger that has receipts but no anchor (interactive, logged with user and time)' },
     ],
     async action(context) {
         const args = context.args ?? [];
@@ -87,8 +92,11 @@ export const policyCommand = {
                 return print({ receipts: state.receipts });
             }
             if (operation === 'verify') {
-                const ledger = await verifyPolicyLedger(root);
-                const result = print(ledger);
+                const establishAnchor = flags['establish-anchor'] === true || flags.establishAnchor === true;
+                if (establishAnchor)
+                    requireInteractiveAdministrator();
+                const ledger = await verifyPolicyLedger(root, { establishAnchor });
+                const result = print({ ...ledger, anchors: anchorPosture(root), scope: LEDGER_TRUST_SCOPE });
                 return ledger.valid ? result : { ...result, success: false, exitCode: 1 };
             }
             throw new Error(`unknown policy operation: ${operation}`);

package/dist/src/commands/session.js

@@ -7,6 +7,8 @@ import { confirm, input, select } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
 import * as fs from 'fs';
 import * as path from 'path';
+import { stringify as stringifyYaml } from 'yaml';
+import { gzipSync, gunzipSync } from 'node:zlib';
 // Format date for display
 function formatDate(dateStr) {
     if (!dateStr)
@@ -561,7 +563,7 @@ const exportCommand = {
             // Format output
             let content;
             if (exportFormat === 'yaml') {
-                content = toSimpleYaml(result.data);
+                content = stringifyYaml(result.data);
             }
             else {
                 content = JSON.stringify(result.data, null, 2);
@@ -570,7 +572,8 @@ const exportCommand = {
             const absolutePath = path.isAbsolute(outputPath)
                 ? outputPath
                 : path.join(ctx.cwd, outputPath);
-            fs.writeFileSync(absolutePath, content, 'utf-8');
+            const bytes = compress ? gzipSync(content) : Buffer.from(content, 'utf-8');
+            fs.writeFileSync(absolutePath, bytes);
             spinner.succeed('Session exported');
             output.writeln();
             // session_export returns the whole record under `data`; its stats live there.
@@ -587,14 +590,14 @@ const exportCommand = {
                     { property: 'Agents', value: exportStats.agentCount ?? exportStats.agents ?? 0 },
                     { property: 'Tasks', value: exportStats.taskCount ?? exportStats.tasks ?? 0 },
                     { property: 'Memory Entries', value: exportStats.memoryEntries ?? 0 },
-                    { property: 'File Size', value: formatSize(content.length) }
+                    { property: 'File Size', value: formatSize(bytes.length) }
                 ]
             });
             output.writeln();
             output.printSuccess(`Session exported to ${outputPath}`);
             return {
                 success: true,
-                data: { sessionId, outputPath, format: exportFormat, size: content.length }
+                data: { sessionId, outputPath, format: exportFormat, size: bytes.length }
             };
         }
         catch (error) {
@@ -647,9 +650,11 @@ const importCommand = {
         try {
             // The YAML written by `session export --format yaml` is display-only;
             // there is no YAML parser here, so say so instead of failing obscurely.
-            if (absolutePath.endsWith('.yaml') || absolutePath.endsWith('.yml')) {
+            if (/\.ya?ml(?:\.gz)?$/i.test(absolutePath)) {
                 try {
-                    JSON.parse(fs.readFileSync(absolutePath, 'utf-8'));
+                    const bytes = fs.readFileSync(absolutePath);
+                    const content = bytes[0] === 0x1f && bytes[1] === 0x8b ? gunzipSync(bytes) : bytes;
+                    JSON.parse(content.toString('utf-8'));
                 }
                 catch {
                     spinner.fail('Failed to import session');
@@ -783,37 +788,6 @@ function formatDuration(ms) {
     }
     return `${seconds}s`;
 }
-function toSimpleYaml(obj, indent = 0) {
-    // Simple YAML serializer (for basic types)
-    if (obj === null)
-        return 'null';
-    if (typeof obj === 'boolean')
-        return String(obj);
-    if (typeof obj === 'number')
-        return String(obj);
-    if (typeof obj === 'string')
-        return obj.includes(':') ? `"${obj}"` : obj;
-    const spaces = '  '.repeat(indent);
-    let result = '';
-    if (Array.isArray(obj)) {
-        for (const item of obj) {
-            result += `${spaces}- ${toSimpleYaml(item, indent + 1).trim()}\n`;
-        }
-        return result;
-    }
-    if (typeof obj === 'object') {
-        for (const [key, value] of Object.entries(obj)) {
-            if (typeof value === 'object' && value !== null) {
-                result += `${spaces}${key}:\n${toSimpleYaml(value, indent + 1)}`;
-            }
-            else {
-                result += `${spaces}${key}: ${toSimpleYaml(value, indent)}\n`;
-            }
-        }
-        return result;
-    }
-    return String(obj);
-}
 // Main session command
 export const sessionCommand = {
     name: 'session',

package/dist/src/index.js

@@ -19,6 +19,7 @@ import { output } from './output.js';
 import { commands, getCommandsByCategory, getCommand, getCommandAsync, getCommandNames, getLazyCommandNames, hasCommand } from './commands/index.js';
 import { suggestCommand } from './suggest.js';
 import { runStartupUpdateCheck } from './update/index.js';
+import { ensureBlockingStdio } from './blocking-stdio.js';
 // Read version from package.json at runtime
 function getPackageVersion() {
     try {
@@ -66,6 +67,8 @@ export class CLI {
      * Run the CLI with given arguments
      */
     async run(args = process.argv.slice(2)) {
+        // #3851: keep piped output intact across the process.exit() calls below
+        ensureBlockingStdio();
         try {
             // #1791.2 — If the user invoked a lazy command (e.g. `hive-mind task`),
             // pre-load it BEFORE parsing so the parser can build scoped flag

package/dist/src/init/executor.js

@@ -1464,6 +1464,7 @@ data/
 logs/
 sessions/
 neural/
+console/
 *.log
 *.tmp
 `;

package/dist/src/init/helpers-generator.js

@@ -436,6 +436,7 @@ module.exports = commands;
 // Literal-word root guard mirrored in the mod and both shipped classic helpers.
 const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, depth = 0) {
   let word = '', quote = '', started = false, redirect = false
+  let ansiNul = false // a NUL inside $'...' ends that string, as in bash
   let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
   const isRoot = (operand) => {
     if (!operand.startsWith('/')) return false
@@ -447,22 +448,55 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     }
     return parts.length === 0 || /[*?\[]/.test(parts[0])
   }
+  // One backslash escape inside $'...', from the character after the backslash.
+  // Returns the text it stands for and the index of its last character. An unknown escape keeps its backslash.
+  // The command arrives lowercased, so an uppercase-U escape reads as a lowercase one: eight digits starting 0000 are one code point.
+  const ansiEscape = (s, at) => {
+    const c = s[at]
+    const simple = { a: '\x07', b: '\b', e: '\x1b', f: '\f', n: '\n', r: '\r', t: '\t', v: '\v', '\\': '\\', "'": "'", '"': '"', '?': '?' }
+    if (simple[c] !== undefined) return [simple[c], at]
+    const digits = (from, max, pattern) => pattern.exec(s.slice(from, from + max))?.[0]
+    const octal = digits(at, 3, /^[0-7]+/)
+    if (octal) return [String.fromCharCode(parseInt(octal, 8) & 255), at + octal.length - 1]
+    const hex = c === 'x' ? digits(at + 1, 2, /^[0-9a-f]+/) : undefined
+    if (hex) return [String.fromCharCode(parseInt(hex, 16)), at + hex.length]
+    const wide = c === 'u' ? (digits(at + 1, 8, /^0000[0-9a-f]{4}$/) ?? digits(at + 1, 4, /^[0-9a-f]+/)) : undefined
+    if (wide) return [String.fromCodePoint(parseInt(wide, 16)), at + wide.length]
+    if (c === 'c' && at + 1 < s.length) return [String.fromCharCode(s.charCodeAt(at + 1) & 31), at + 1]
+    return ['\\' + c, at]
+  }
   const finishWord = () => {
     if (!started) return false
     // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
     // Bound rescanning to four levels; beyond that retain its conservative check.
-    if (word.includes('rm') && /[\s;&|()]/.test(word)) {
+    if (/[\s;&|()\x60]/.test(word)) {
       if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
     }
     if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
     else if (!optionsEnded && word === '--') optionsEnded = true
     else if (!optionsEnded && word.startsWith('-')) {
-      recursive = recursive || word === '--recursive' || /^-[a-z]*r[a-z]*$/.test(word)
-      force = force || word === '--force' || /^-[a-z]*f[a-z]*$/.test(word)
+      // GNU getopt accepts any unambiguous long-option prefix: --r, --recur, --forc.
+      recursive = recursive || (word.length > 2 && '--recursive'.startsWith(word)) || /^-[a-z]*r[a-z]*$/.test(word)
+      force = force || (word.length > 2 && '--force'.startsWith(word)) || /^-[a-z]*f[a-z]*$/.test(word)
     } else root = root || isRoot(word)
     word = ''; started = false
     return inRm && recursive && force && root
   }
+  // A command substitution's body, from just after its opening backtick. Bash removes a
+  // backslash only before $, a backtick or a backslash (and " inside double quotes) and
+  // drops backslash-newline; any other backslash stays for the nested scan.
+  const substitution = (from, inDouble) => {
+    let body = '', j = from
+    for (; j < command.length && command[j] !== '\x60'; j++) {
+      const next = command[j + 1]
+      if (command[j] === '\\' && j + 1 < command.length) {
+        if (next === '\n') { j++; continue }
+        if (next === '$' || next === '\x60' || next === '\\' || (inDouble && next === '"')) { body += next; j++; continue }
+      }
+      body += command[j]
+    }
+    return [j, depth < 4 ? hasRootDelete(body, depth + 1) : body.includes('rm -rf /')]
+  }
   const finishCommand = () => {
     const denied = inRm && recursive && force && root
     inRm = optionsEnded = recursive = force = root = false
@@ -473,7 +507,25 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     const redirectionAmpersand = char === '&' && (redirect || command[i + 1] === '>')
     redirect = false
     if (quote) {
+      if (quote === "$'") {
+        if (char === "'") { quote = ''; ansiNul = false }
+        else if (char === '\\' && i + 1 < command.length) {
+          const [text, last] = ansiEscape(command, i + 1)
+          i = last
+          if (!ansiNul) { const nul = text.indexOf('\0'); if (nul < 0) word += text; else { word += text.slice(0, nul); ansiNul = true } }
+        } else if (!ansiNul) word += char
+        continue
+      }
       if (char === quote) quote = ''
+      else if (quote === '"' && char === '\x60' && command.indexOf('\x60', i + 1) > i) {
+        const [end, denied] = substitution(i + 1, true)
+        if (denied) return true
+        // The substitution is gone from the word, as bash's empty output is (a quoted empty substitution glued to -rf leaves -rf).
+        // A # right after it is still inside the word: a placeholder keeps a rescan (sh -c "...")
+        // from reading it as the start of a comment.
+        if (command[end + 1] === '#') word += '\u0001'
+        i = end
+      }
       else if (quote === '"' && char === '\\' && i + 1 < command.length &&
         (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
           command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
@@ -485,6 +537,16 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     if (char === '\\' && i + 1 < command.length) {
       const next = command[++i]
       if (next !== '\n') { word += next; started = true }
+    } else if (char === '\x60' && command.indexOf('\x60', i + 1) > i) {
+      // Command substitution: scan the body as its own command; the substitution
+      // stays inside the enclosing word, so the rm being parsed keeps its state,
+      // and the word has started (a # right after it is not a comment).
+      const [end, denied] = substitution(i + 1, false)
+      if (denied) return true
+      i = end; started = true
+    } else if (char === '$' && (command[i + 1] === "'" || command[i + 1] === '"')) {
+      // ANSI-C ($'...': escapes decoded) and locale ($"...") quoting: the $ is not part of the word.
+      quote = command[i + 1] === "'" ? "$'" : '"'; started = true; i++
     } else if (char === '"' || char === "'") {
       quote = char; started = true
     } else if (char === '#' && !started) {