@claude-flow/cli 3.54.1 → 3.56.0

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.54.1",
+    "version": "3.56.0",
     "files": {
       "auto-memory-hook.mjs": "c8d218526a3c34034c2a69de23f507f0eb0f70d59c16426a8edc849e6ac22529",
       "hook-handler.cjs": "34d2aacfb59a73ff94b1467bb57ab9d9c4af89c0e470aadf3bd0d74a503a658d",
@@ -9,6 +9,6 @@
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "GORi4ozu4COfL048CD+GWNMiX4hdXVrn2/tvRXWcj9OioRiUknKlfhNwkL6PVtcNar+5xDn7J9BzGFBrPgblCA==",
+  "signature": "9T3S9rchP2NnIjrYOL9tV7QvDP3WlsrsR7WlBXpUpoGPCrhe2Mo9bQEU7JOCscuQ+UQsrP211p7vmc93+AlWDg==",
   "algorithm": "ed25519"
 }

package/.claude/settings.json

@@ -11,7 +11,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" pre-bash",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" pre-bash",
             "timeout": 5000
           }
         ]
@@ -23,7 +23,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" post-edit",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" post-edit",
             "timeout": 10000
           }
         ]
@@ -34,7 +34,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" route",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" route",
             "timeout": 10000
           }
         ]
@@ -46,13 +46,13 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" session-restore",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" session-restore",
             "timeout": 15000,
             "continueOnError": true
           },
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs" import",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs\" import",
             "timeout": 8000,
             "continueOnError": true
           }
@@ -64,7 +64,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" session-end",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" session-end",
             "timeout": 10000,
             "continueOnError": true
           }
@@ -76,7 +76,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" status",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" status",
             "timeout": 3000,
             "continueOnError": true
           }
@@ -88,7 +88,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs" sync",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs\" sync",
             "timeout": 10000,
             "continueOnError": true
           }
@@ -98,7 +98,7 @@
   },
   "statusLine": {
     "type": "command",
-    "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/statusline.cjs"",
+    "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/statusline.cjs\"",
     "refreshMs": 5000,
     "enabled": true
   },

package/bin/cli.js

@@ -301,7 +301,7 @@ if (isMCPMode) {
         }
 
         try {
-          const result = await callMCPTool(toolName, toolParams, { sessionId });
+          const result = await callMCPTool(toolName, toolParams, { sessionId, transport: 'stdio' });
           // Failed task outcomes are data; an explicit handler error is a tool failure.
           const isError = result !== null && typeof result === 'object'
             && typeof result.error === 'string' && result.error.trim().length > 0;

package/bin/mcp-server.js

@@ -190,7 +190,7 @@ async function handleMessage(message) {
         }
 
         try {
-          const result = await callMCPTool(toolName, toolParams, { sessionId });
+          const result = await callMCPTool(toolName, toolParams, { sessionId, transport: 'stdio' });
           return {
             jsonrpc: '2.0',
             id: message.id,

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-07T07:34:48.002Z",
-  "gitSha": "b9ce891c",
+  "generatedAt": "2026-10-08T21:48:51.902Z",
+  "gitSha": "527796ae",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/auth/client.js

@@ -19,6 +19,8 @@ import { hasConsent } from '../funnel/index.js';
 import { domainForScope } from './scopes.js';
 /** Refresh before there is less than one minute left on the access token. */
 export const ACCESS_TOKEN_REFRESH_WINDOW_MS = 60_000;
+// A rotating refresh credential may be spent only once per process attempt.
+const pendingRefreshes = new Map();
 /**
  * Best-effort headlessness signal — a false negative just means the browser
  * flow is attempted and a real browser opens fine anyway; a false positive
@@ -213,30 +215,44 @@ export async function getValidAccessToken(profileName = 'default') {
     const cached = getSessionToken(profileName, ACCESS_TOKEN_REFRESH_WINDOW_MS);
     if (cached)
         return cached;
-    if (!profile.keychainRef)
+    const keychainRef = profile.keychainRef;
+    if (!keychainRef)
         throw new SessionOnlyExpiredError(profileName);
-    const sec = await loadSecurityOAuth();
-    const keychain = await sec.createKeychainAdapter();
-    const refreshTokenValue = await keychain.getSecret(KEYCHAIN_SERVICE, profile.keychainRef);
-    if (!refreshTokenValue)
-        throw new SessionOnlyExpiredError(profileName);
-    const refreshed = await refreshAccessToken(refreshTokenValue);
-    if (!refreshed.access_token)
-        throw new Error('Cognitum refresh response did not contain an access token');
-    // Cognitum rotates refresh tokens with reuse detection. Commit the rotated
-    // credential first; if this write fails, do not publish/cache the access
-    // token and do not retry the already-spent old refresh token here.
-    if (refreshed.refresh_token) {
-        await keychain.setSecret(KEYCHAIN_SERVICE, profile.keychainRef, refreshed.refresh_token);
-    }
-    const expiresAtMs = Date.now() + Math.max(0, refreshed.expires_in ?? 0) * 1000;
-    setSessionToken(profileName, refreshed.access_token, expiresAtMs);
-    setProfile(profileName, {
-        ...profile,
-        accountId: refreshed.account_email ?? profile.accountId,
-        accessTokenExpiresAt: new Date(expiresAtMs).toISOString(),
-        linkedAt: new Date().toISOString(),
-    });
-    return refreshed.access_token;
+    const refreshKey = JSON.stringify([profileName, keychainRef]);
+    const pending = pendingRefreshes.get(refreshKey);
+    if (pending)
+        return pending;
+    const refresh = (async () => {
+        const sec = await loadSecurityOAuth();
+        const keychain = await sec.createKeychainAdapter();
+        const refreshTokenValue = await keychain.getSecret(KEYCHAIN_SERVICE, keychainRef);
+        if (!refreshTokenValue)
+            throw new SessionOnlyExpiredError(profileName);
+        const refreshed = await refreshAccessToken(refreshTokenValue);
+        if (!refreshed.access_token)
+            throw new Error('Cognitum refresh response did not contain an access token');
+        // Cognitum rotates refresh tokens with reuse detection. Commit the rotated
+        // credential first; if this write fails, do not publish/cache the access
+        // token and do not retry the already-spent old refresh token here.
+        if (refreshed.refresh_token) {
+            await keychain.setSecret(KEYCHAIN_SERVICE, keychainRef, refreshed.refresh_token);
+        }
+        const expiresAtMs = Date.now() + Math.max(0, refreshed.expires_in ?? 0) * 1000;
+        setSessionToken(profileName, refreshed.access_token, expiresAtMs);
+        setProfile(profileName, {
+            ...profile,
+            accountId: refreshed.account_email ?? profile.accountId,
+            accessTokenExpiresAt: new Date(expiresAtMs).toISOString(),
+            linkedAt: new Date().toISOString(),
+        });
+        return refreshed.access_token;
+    })();
+    pendingRefreshes.set(refreshKey, refresh);
+    try {
+        return await refresh;
+    }
+    finally {
+        pendingRefreshes.delete(refreshKey);
+    }
 }
 //# sourceMappingURL=client.js.map

package/dist/src/commands/agent.js

@@ -294,6 +294,18 @@ const statusCommand = {
                 includeMetrics: true,
                 includeHistory: false,
             });
+            // The MCP tool answers an unknown id with status "not_found" and no other fields.
+            // Rendering that as a record printed "Agent: undefined", "Invalid Date" and
+            // "undefined%" and exited 0, so scripts and agents took it as success.
+            if ((status.status) === 'not_found') {
+                if (ctx.flags.format === 'json') {
+                    output.printJson(status);
+                }
+                else {
+                    output.printError(`Agent not found: ${agentId}`);
+                }
+                return { success: false, exitCode: 1 };
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(status);
                 return { success: true, data: status };

package/dist/src/commands/analyze.js

@@ -254,14 +254,16 @@ const codeCommand = {
         const targetPath = resolve(ctx.flags.path || '.');
         const analysisType = ctx.flags.type || 'quality';
         const formatJson = ctx.flags.format === 'json';
-        output.writeln();
-        output.writeln(output.bold('Code Analysis'));
-        output.writeln(output.dim('-'.repeat(50)));
+        if (!formatJson) {
+            output.writeln();
+            output.writeln(output.bold('Code Analysis'));
+            output.writeln(output.dim('-'.repeat(50)));
+        }
         const spinner = output.createSpinner({ text: `Analyzing ${targetPath}...`, spinner: 'dots' });
         spinner.start();
         try {
             const files = await scanSourceFiles(targetPath);
-            if (files.length === 0) {
+            if (files.length === 0 && !formatJson) {
                 spinner.stop();
                 output.printWarning('No source files found');
                 return { success: true };
@@ -310,16 +312,16 @@ const codeCommand = {
             const totalTodos = fileStats.reduce((s, f) => s + f.todos, 0);
             const totalFunctions = fileStats.reduce((s, f) => s + f.functions, 0);
             const totalImports = fileStats.reduce((s, f) => s + f.imports, 0);
-            const avgFileSize = Math.round(totalLoc / files.length);
-            const longestFile = fileStats.reduce((a, b) => a.loc > b.loc ? a : b);
-            const avgFnPerFile = (totalFunctions / files.length).toFixed(1);
-            const deepestNesting = fileStats.reduce((a, b) => a.maxNesting > b.maxNesting ? a : b);
-            const allSecurityIssues = fileStats.filter(f => f.securityIssues.length > 0);
+            const avgFileSize = files.length > 0 ? Math.round(totalLoc / files.length) : 0;
             if (formatJson) {
                 const jsonData = { type: analysisType, path: targetPath, files: files.length, totalLoc, totalTodos, totalFunctions, totalImports, avgFileSize, fileStats: fileStats.map(f => ({ relativePath: path.relative(targetPath, f.file), loc: f.loc, todos: f.todos, functions: f.functions, imports: f.imports, maxNesting: f.maxNesting, securityIssues: f.securityIssues })) };
                 output.printJson(jsonData);
                 return { success: true, data: jsonData };
             }
+            const longestFile = fileStats.reduce((a, b) => a.loc > b.loc ? a : b);
+            const avgFnPerFile = (totalFunctions / files.length).toFixed(1);
+            const deepestNesting = fileStats.reduce((a, b) => a.maxNesting > b.maxNesting ? a : b);
+            const allSecurityIssues = fileStats.filter(f => f.securityIssues.length > 0);
             if (analysisType === 'quality') {
                 output.printBox([`Files: ${files.length}`, `Lines of Code: ${totalLoc.toLocaleString()}`, `Avg File Size: ${avgFileSize} LOC`, `TODO/FIXME: ${totalTodos}`, `Functions: ${totalFunctions}`, `Imports: ${totalImports}`].join('\n'), 'Quality Summary');
                 output.writeln();
@@ -549,7 +551,7 @@ const astCommand = {
                 }
             }
             spinner.stop();
-            if (results.length === 0) {
+            if (results.length === 0 && formatType !== 'json') {
                 output.printWarning('No files analyzed');
                 return { success: true };
             }
@@ -559,7 +561,7 @@ const astCommand = {
                 functions: results.reduce((sum, r) => sum + r.functions.length, 0),
                 classes: results.reduce((sum, r) => sum + r.classes.length, 0),
                 imports: results.reduce((sum, r) => sum + r.imports.length, 0),
-                avgComplexity: results.reduce((sum, r) => sum + r.complexity.cyclomatic, 0) / results.length,
+                avgComplexity: results.length > 0 ? results.reduce((sum, r) => sum + r.complexity.cyclomatic, 0) / results.length : 0,
                 totalLoc: results.reduce((sum, r) => sum + r.complexity.loc, 0),
             };
             // JSON output
@@ -1230,9 +1232,11 @@ const depsCommand = {
         const showOutdated = ctx.flags.outdated;
         const checkSecurity = ctx.flags.security;
         const formatJson = ctx.flags.format === 'json';
-        output.writeln();
-        output.writeln(output.bold('Dependency Analysis'));
-        output.writeln(output.dim('-'.repeat(50)));
+        if (!formatJson || showOutdated || checkSecurity) {
+            output.writeln();
+            output.writeln(output.bold('Dependency Analysis'));
+            output.writeln(output.dim('-'.repeat(50)));
+        }
         try {
             const pkgPath = resolve('package.json');
             let pkgContent;

package/dist/src/commands/autopilot.js

@@ -181,8 +181,8 @@ const configCommand = {
     name: 'config',
     description: 'Configure max iterations, timeout, and task sources',
     options: [
-        { name: 'max-iterations', type: 'string', description: 'Max re-engagement iterations (1-1000)' },
-        { name: 'timeout', type: 'string', description: 'Timeout in minutes (1-1440)' },
+        { name: 'max-iterations', type: 'number', description: 'Max re-engagement iterations (1-1000)' },
+        { name: 'timeout', type: 'number', description: 'Timeout in minutes (1-1440)' },
         { name: 'task-sources', type: 'string', description: `Comma-separated task sources: ${[...VALID_TASK_SOURCES].join(', ')}` },
     ],
     action: async (ctx) => {

package/dist/src/commands/daemon.js

@@ -3,19 +3,22 @@
  * Manages background worker daemon (Node.js-based, similar to shell helpers)
  */
 import { output } from '../output.js';
-import { getDaemon, startDaemon, stopDaemon } from '../services/worker-daemon.js';
+import { getDaemon, startDaemon, stopDaemon, parseEnabledWorkers } from '../services/worker-daemon.js';
 import { resolveDaemonProjectRoot } from '../services/daemon-autostart.js';
 import { fork } from 'child_process';
 import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
 import { homedir } from 'os';
 import * as fs from 'fs';
+// Syntax guard for worker-name flags forwarded to a background child.
+// The start action validates the names against the daemon's supported workers.
+const WORKERS_RE = /^[a-z][a-z0-9_-]*(,[a-z][a-z0-9_-]*)*$/;
 // Start daemon subcommand
 const startCommand = {
     name: 'start',
     description: 'Start the worker daemon with all enabled background workers',
     options: [
-        { name: 'workers', short: 'w', type: 'string', description: 'Comma-separated list of workers to enable (default: map,audit,optimize,consolidate,testgaps)' },
+        { name: 'workers', short: 'w', type: 'string', description: 'Comma-separated list of workers to enable (default: saved selection or map,audit,optimize,consolidate,testgaps,backup,harness)' },
         // ADR-174 M3: consolidate now runs a real memory-distillation pass
         // (memory_entries -> episodes/reasoning_patterns/causal_edges) instead of
         // a no-op stub. This opt-out skips just that pass for the life of this
@@ -119,6 +122,16 @@ const startCommand = {
                 output.printWarning(`Ignoring invalid --ttl value: ${sanitize(rawTtl)}`);
             }
         }
+        if (ctx.flags.workers !== undefined) {
+            try {
+                config.enabledWorkers = parseEnabledWorkers(ctx.flags.workers);
+            }
+            catch (error) {
+                if (!quiet)
+                    output.printError(error.message);
+                return { success: false, exitCode: 1 };
+            }
+        }
         // Check if background daemon already running (skip if we ARE the daemon process)
         //
         // #2407 — without an atomic lockfile, N concurrent `daemon start` calls
@@ -518,7 +531,6 @@ async function startBackgroundDaemon(projectRoot, quiet, forwarded = {}) {
     // through — argv goes straight to a forked process so reject anything
     // that doesn't look like a comma-separated worker-name list or one of
     // the allowed sandbox modes.
-    const WORKERS_RE = /^[a-z][a-z0-9_-]*(,[a-z][a-z0-9_-]*)*$/;
     if (typeof workers === 'string' && workers.length > 0 && WORKERS_RE.test(workers)) {
         forkArgs.push('--workers', workers);
     }

package/dist/src/commands/doctor.js

@@ -7,7 +7,7 @@
 import { output } from '../output.js';
 import { existsSync, readFileSync, statSync, openSync, readSync, closeSync } from 'fs';
 import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { createHash } from 'crypto';
 import { execSync, exec, execFile } from 'child_process';
 import { promisify } from 'util';
@@ -2117,7 +2117,7 @@ async function checkMetaharnessIntegration() {
     // Runtime smoke: import the similarity module and exercise it
     try {
         const modPath = join(pluginDir, 'scripts', '_similarity.mjs');
-        const mod = await import(modPath);
+        const mod = await import(pathToFileURL(modPath).href);
         if (typeof mod.similarity !== 'function') {
             return {
                 name: 'MetaHarness integration (ADR-150)',
@@ -2144,7 +2144,7 @@ async function checkMetaharnessIntegration() {
         // parallelization primitives oia-audit depends on; if they're
         // missing, oia-audit's import fails and the whole pipeline breaks.
         const harnessPath = join(pluginDir, 'scripts', '_harness.mjs');
-        const harnessMod = await import(harnessPath);
+        const harnessMod = await import(pathToFileURL(harnessPath).href);
         if (typeof harnessMod.parseMcpScanText !== 'function') {
             return {
                 name: 'MetaHarness integration (ADR-150)',
@@ -2580,6 +2580,67 @@ export const doctorCommand = {
         const verbose = ctx.flags.verbose;
         // Parser camelCases kebab-case flag names — read via `fixHandles`, not `['fix-handles']`.
         const fixHandles = ctx.flags.fixHandles;
+        // #2677: `--component memory` now runs the whole memory-health suite,
+        // not just the existence check. Values can be a single check or an
+        // array — expanded at execution time. Stuinfla's report showed the
+        // existence-only check reporting PASS on a 99.97%-empty and even a
+        // SQLite-malformed DB; the array here layers integrity → content →
+        // embedding coverage over the existing existence probe; check 6 then
+        // verifies that distilled episodes are actually Reflexion-retrievable and
+        // execution feedback carries a lesson.
+        const componentMap = {
+            'version': checkVersionFreshness,
+            'freshness': checkVersionFreshness,
+            'node': checkNodeVersion,
+            'npm': checkNpmVersion,
+            'claude': checkClaudeCode,
+            'browser': checkAgentBrowserVersion,
+            'config': checkConfigFile,
+            'stale-settings': checkStaleSettingsNpx, // #2448
+            'helpers': () => checkHelperIntegrity(), // #3565
+            'daemon': checkDaemonStatus,
+            get memory() {
+                return [
+                    checkMemoryDatabase, // existing: exists + statable (unchanged)
+                    checkMemoryIntegrity, // #2677 check 1: sql.js open + PRAGMA integrity_check
+                    ...nativeAgentDbChecks, // #3195: present AgentDB authority, checked independently
+                    checkMemoryPersistenceDriver, // #2968/#3321: read-only native capability probe
+                    checkMemoryPackageVersion, // #3392: loaded memory package satisfies the declared range
+                    checkMemoryContent, // #2677 check 2: memory_entries content coverage
+                    checkMemoryEmbeddingCoverage, // #2677 check 3: vector coverage on populated rows
+                    checkMemoryReflexionCoverage, // #2677 check 6: episodes are retrievable
+                    checkMemoryCritiqueCoverage, // #2677 check 6: feedback carries lessons
+                ];
+            },
+            'memory-package': checkMemoryPackageVersion, // #3392
+            'learning': checkLearningBridge, // #2545
+            'learning-bridge': checkLearningBridge, // #2545
+            'api': checkApiKeys,
+            'git': checkGit,
+            'mcp': checkMcpServers,
+            'mcp-overhead': checkMcpSchemaOverhead,
+            'aidefence': checkAIDefence, // #1807
+            'disk': checkDiskSpace,
+            'typescript': checkBuildTools,
+            'agentic-flow': checkAgenticFlow,
+            'encryption': checkEncryptionAtRest, // ADR-096 Phase 5
+            'federation': checkFederationBreaker, // ADR-097 Phase 4
+            'metaharness': [checkMetaharness, checkMetaharnessDeclaredPackages, checkMetaharnessIntegration], // ADR-150 — upstream + declared deps + ruflo-side
+            'metaharness-integration': checkMetaharnessIntegration, // iter 45 — ruflo-side
+            'funnel': checkFunnel, // ADR-305
+            // ADR-307 — deep-dive array, same pattern as 'memory' above: the cheap
+            // sponsored-consent check first, then binary/process/bind in the order
+            // a user would actually debug them (is it installed? running? exposed?).
+            'proxy': [checkProxySponsoredConsent, checkProxyBinary, checkProxyProcess, checkProxyBindAddress],
+            'auth': checkAuth, // ADR-306
+            'typesafe': checkTypesafeRouter, // opt-in @ruvector/typesafe task router
+            'mods': checkMods, // ADR-404 — ruflo as a Claude Code mod
+        };
+        if (component !== undefined && !Object.hasOwn(componentMap, component)) {
+            const message = `Unknown doctor component: ${JSON.stringify(component)}. Valid components: ${Object.keys(componentMap).join(', ')}`;
+            output.printError(message);
+            return { success: false, exitCode: 1, message };
+        }
         // Early-return short-circuit: `--fix-handles` is a targeted mitigation, not
         // part of the health-check flow. Runs, reports, exits.
         if (fixHandles) {
@@ -2684,62 +2745,8 @@ export const doctorCommand = {
             checkAuth, // ADR-306 — Cognitum identity (warn-only; never fails bare `ruflo doctor`)
             checkMods, // ADR-404 — Claude Code mod path (warn-only)
         ];
-        // #2677: `--component memory` now runs the whole memory-health suite,
-        // not just the existence check. Values can be a single check or an
-        // array — expanded at execution time. Stuinfla's report showed the
-        // existence-only check reporting PASS on a 99.97%-empty and even a
-        // SQLite-malformed DB; the array here layers integrity → content →
-        // embedding coverage over the existing existence probe; check 6 then
-        // verifies that distilled episodes are actually Reflexion-retrievable and
-        // execution feedback carries a lesson.
-        const componentMap = {
-            'version': checkVersionFreshness,
-            'freshness': checkVersionFreshness,
-            'node': checkNodeVersion,
-            'npm': checkNpmVersion,
-            'claude': checkClaudeCode,
-            'browser': checkAgentBrowserVersion,
-            'config': checkConfigFile,
-            'stale-settings': checkStaleSettingsNpx, // #2448
-            'helpers': () => checkHelperIntegrity(), // #3565
-            'daemon': checkDaemonStatus,
-            'memory': [
-                checkMemoryDatabase, // existing: exists + statable (unchanged)
-                checkMemoryIntegrity, // #2677 check 1: sql.js open + PRAGMA integrity_check
-                ...nativeAgentDbChecks, // #3195: present AgentDB authority, checked independently
-                checkMemoryPersistenceDriver, // #2968/#3321: read-only native capability probe
-                checkMemoryPackageVersion, // #3392: loaded memory package satisfies the declared range
-                checkMemoryContent, // #2677 check 2: memory_entries content coverage
-                checkMemoryEmbeddingCoverage, // #2677 check 3: vector coverage on populated rows
-                checkMemoryReflexionCoverage, // #2677 check 6: episodes are retrievable
-                checkMemoryCritiqueCoverage, // #2677 check 6: feedback carries lessons
-            ],
-            'memory-package': checkMemoryPackageVersion, // #3392
-            'learning': checkLearningBridge, // #2545
-            'learning-bridge': checkLearningBridge, // #2545
-            'api': checkApiKeys,
-            'git': checkGit,
-            'mcp': checkMcpServers,
-            'mcp-overhead': checkMcpSchemaOverhead,
-            'aidefence': checkAIDefence, // #1807
-            'disk': checkDiskSpace,
-            'typescript': checkBuildTools,
-            'agentic-flow': checkAgenticFlow,
-            'encryption': checkEncryptionAtRest, // ADR-096 Phase 5
-            'federation': checkFederationBreaker, // ADR-097 Phase 4
-            'metaharness': [checkMetaharness, checkMetaharnessDeclaredPackages, checkMetaharnessIntegration], // ADR-150 — upstream + declared deps + ruflo-side
-            'metaharness-integration': checkMetaharnessIntegration, // iter 45 — ruflo-side
-            'funnel': checkFunnel, // ADR-305
-            // ADR-307 — deep-dive array, same pattern as 'memory' above: the cheap
-            // sponsored-consent check first, then binary/process/bind in the order
-            // a user would actually debug them (is it installed? running? exposed?).
-            'proxy': [checkProxySponsoredConsent, checkProxyBinary, checkProxyProcess, checkProxyBindAddress],
-            'auth': checkAuth, // ADR-306
-            'typesafe': checkTypesafeRouter, // opt-in @ruvector/typesafe task router
-            'mods': checkMods, // ADR-404 — ruflo as a Claude Code mod
-        };
         let checksToRun = allChecks;
-        if (component && componentMap[component]) {
+        if (component !== undefined) {
             const entry = componentMap[component];
             checksToRun = Array.isArray(entry) ? entry : [entry];
         }

package/dist/src/commands/hive-mind.js

@@ -1016,6 +1016,13 @@ const consensusCommand = {
         const action = ctx.flags.action || 'list';
         try {
             const result = await callMCPTool('hive-mind_consensus', { action, proposalId: ctx.flags.proposalId, type: ctx.flags.type, value: ctx.flags.value, vote: ctx.flags.vote === 'yes', voterId: ctx.flags.voterId, hiveToken: getHiveTokenForCli() });
+            if (result.error) {
+                if (ctx.flags.format === 'json')
+                    output.printJson(result);
+                else
+                    output.printError(`Consensus error: ${String(result.error)}`);
+                return { success: false, exitCode: 1, data: result };
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
                 return { success: true, data: result };

package/dist/src/commands/mcp.js

@@ -8,7 +8,7 @@
 import { output } from '../output.js';
 import { confirm } from '../prompt.js';
 import { installParentDeathWatchdog } from '../runtime/parent-death-watchdog.js';
-import { getServerManager, getMCPServerStatus, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
+import { getServerManager, getMCPServerStatus, resolveMcpHttpAuthToken, isLoopbackHost, filterAdvertisedMcpTools, parseMcpToolSelection, } from '../mcp-server.js';
 import { listMCPTools, callMCPTool, hasTool } from '../mcp-client.js';
 // MCP tools categories
 const TOOL_CATEGORIES = [
@@ -71,6 +71,16 @@ const startCommand = {
             description: 'HTTP request timeout in milliseconds (default 30000; env RUFLO_MCP_REQUEST_TIMEOUT_MS)',
             type: 'number'
         },
+        {
+            name: 'auth-token-file',
+            description: 'Read the HTTP bearer token from this file (http transport). Preferred over --auth-token; env RUFLO_MCP_HTTP_TOKEN also works',
+            type: 'string'
+        },
+        {
+            name: 'auth-token',
+            description: 'HTTP bearer token (16+ printable ASCII chars). Visible in argv/ps - prefer RUFLO_MCP_HTTP_TOKEN or --auth-token-file',
+            type: 'string'
+        },
         {
             name: 'daemon',
             short: 'd',
@@ -90,6 +100,8 @@ const startCommand = {
         { command: 'claude-flow mcp start', description: 'Start with defaults (stdio)' },
         { command: 'claude-flow mcp start -p 8080 -t http', description: 'Start HTTP server' },
         { command: 'claude-flow mcp start -t http --request-timeout-ms 120000', description: 'Allow slower cold-start HTTP tools' },
+        { command: 'RUFLO_MCP_HTTP_TOKEN=<16+ chars> claude-flow mcp start -t http', description: 'HTTP server requiring "Authorization: Bearer <token>" on every request (except GET /health)' },
+        { command: 'RUFLO_MCP_HTTP_TOKEN=<16+ chars> claude-flow mcp start -t http --host 0.0.0.0', description: 'Non-loopback bind: allowed only with a token (or RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1)' },
         { command: 'claude-flow mcp start -d', description: 'Start as daemon' },
         { command: 'claude-flow mcp start -f', description: 'Force restart (kill existing)' }
     ],
@@ -109,6 +121,17 @@ const startCommand = {
             output.printError('Request timeout must be an integer from 1 to 3600000 milliseconds');
             return { success: false, exitCode: 1 };
         }
+        let authToken;
+        try {
+            authToken = resolveMcpHttpAuthToken({
+                token: (ctx.flags.authToken ?? ctx.flags['auth-token']),
+                tokenFile: (ctx.flags.authTokenFile ?? ctx.flags['auth-token-file']),
+            });
+        }
+        catch (error) {
+            output.printError(error.message);
+            return { success: false, exitCode: 1 };
+        }
         const daemon = ctx.flags.daemon ?? false;
         const force = ctx.flags.force ?? false;
         output.writeln();
@@ -166,6 +189,7 @@ const startCommand = {
             port,
             tools: !tools || tools === 'all' ? 'all' : tools.split(','),
             ...(requestTimeoutMs === undefined ? {} : { requestTimeoutMs }),
+            ...(authToken ? { authToken } : {}),
             daemonize: daemon,
         };
         try {
@@ -218,6 +242,15 @@ const startCommand = {
             if (transport === 'http') {
                 output.writeln(output.dim(`  Health: http://${host}:${port}/health`));
                 output.writeln(output.dim(`  RPC: http://${host}:${port}/rpc`));
+                if (authToken) {
+                    output.writeln(output.dim('  Auth: bearer token required (Authorization: Bearer <token>); /health is public'));
+                }
+                else if (isLoopbackHost(host)) {
+                    output.printWarning('No auth token set: any local process (and DNS-rebinding web pages) can call tools. Set RUFLO_MCP_HTTP_TOKEN to require a bearer token.');
+                }
+                else {
+                    output.printWarning('Running UNAUTHENTICATED on a non-loopback host (RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP is set).');
+                }
             }
             else if (transport === 'websocket') {
                 output.writeln(output.dim(`  WebSocket: ws://${host}:${port}/ws`));
@@ -596,6 +629,7 @@ const execCommand = {
             const startTime = performance.now();
             const result = await callMCPTool(tool, params, {
                 sessionId: `cli-${Date.now().toString(36)}`,
+                transport: 'cli',
                 requestId: `exec-${Date.now()}`,
             });
             const duration = performance.now() - startTime;

package/dist/src/commands/memory-backup.d.ts

@@ -1,7 +1,7 @@
 /**
  * V3 CLI `memory backup` command.
  *
- * WAL-safe snapshot of the vector-memory DB (`.swarm/memory.db`) with rotation
+ * WAL-safe snapshots of the active CLI and AgentDB stores with rotation
  * and optional GCS offsite. Thin surface over ../services/memory-backup.js; the
  * daemon's nightly `backup` worker calls the same service.
  */