@claude-flow/cli 3.55.0 → 3.56.1

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.55.0",
+    "version": "3.56.1",
     "files": {
       "auto-memory-hook.mjs": "c8d218526a3c34034c2a69de23f507f0eb0f70d59c16426a8edc849e6ac22529",
       "hook-handler.cjs": "34d2aacfb59a73ff94b1467bb57ab9d9c4af89c0e470aadf3bd0d74a503a658d",
@@ -9,6 +9,6 @@
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "FT6oLMAU2RXu8iAdlOFTNGcjYZ52pkhrGFgn3/oKJdtVab0etCzO24Nr2ut1Hr9kn3tRAqb6D8MZwKfcoSqlCQ==",
+  "signature": "eGhCbWbSEhufQTLyjtRuSNc3JX1kDYCMAbqj/mn4IpYUOX+pi9Xs5lPAo/kVgVolhF1JRspGhzFi3Y8spw0EBw==",
   "algorithm": "ed25519"
 }

package/.claude/settings.json

@@ -11,7 +11,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" pre-bash",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" pre-bash",
             "timeout": 5000
           }
         ]
@@ -23,7 +23,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" post-edit",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" post-edit",
             "timeout": 10000
           }
         ]
@@ -34,7 +34,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" route",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" route",
             "timeout": 10000
           }
         ]
@@ -46,13 +46,13 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" session-restore",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" session-restore",
             "timeout": 15000,
             "continueOnError": true
           },
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs" import",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs\" import",
             "timeout": 8000,
             "continueOnError": true
           }
@@ -64,7 +64,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" session-end",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" session-end",
             "timeout": 10000,
             "continueOnError": true
           }
@@ -76,7 +76,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs" status",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" status",
             "timeout": 3000,
             "continueOnError": true
           }
@@ -88,7 +88,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs" sync",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs\" sync",
             "timeout": 10000,
             "continueOnError": true
           }
@@ -98,7 +98,7 @@
   },
   "statusLine": {
     "type": "command",
-    "command": "node "$CLAUDE_PROJECT_DIR/.claude/helpers/statusline.cjs"",
+    "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/statusline.cjs\"",
     "refreshMs": 5000,
     "enabled": true
   },

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-07T17:32:59.615Z",
-  "gitSha": "2ab3f99f",
+  "generatedAt": "2026-10-09T04:37:42.484Z",
+  "gitSha": "58e0ae7e",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/auth/client.js

@@ -19,6 +19,8 @@ import { hasConsent } from '../funnel/index.js';
 import { domainForScope } from './scopes.js';
 /** Refresh before there is less than one minute left on the access token. */
 export const ACCESS_TOKEN_REFRESH_WINDOW_MS = 60_000;
+// A rotating refresh credential may be spent only once per process attempt.
+const pendingRefreshes = new Map();
 /**
  * Best-effort headlessness signal — a false negative just means the browser
  * flow is attempted and a real browser opens fine anyway; a false positive
@@ -213,30 +215,44 @@ export async function getValidAccessToken(profileName = 'default') {
     const cached = getSessionToken(profileName, ACCESS_TOKEN_REFRESH_WINDOW_MS);
     if (cached)
         return cached;
-    if (!profile.keychainRef)
+    const keychainRef = profile.keychainRef;
+    if (!keychainRef)
         throw new SessionOnlyExpiredError(profileName);
-    const sec = await loadSecurityOAuth();
-    const keychain = await sec.createKeychainAdapter();
-    const refreshTokenValue = await keychain.getSecret(KEYCHAIN_SERVICE, profile.keychainRef);
-    if (!refreshTokenValue)
-        throw new SessionOnlyExpiredError(profileName);
-    const refreshed = await refreshAccessToken(refreshTokenValue);
-    if (!refreshed.access_token)
-        throw new Error('Cognitum refresh response did not contain an access token');
-    // Cognitum rotates refresh tokens with reuse detection. Commit the rotated
-    // credential first; if this write fails, do not publish/cache the access
-    // token and do not retry the already-spent old refresh token here.
-    if (refreshed.refresh_token) {
-        await keychain.setSecret(KEYCHAIN_SERVICE, profile.keychainRef, refreshed.refresh_token);
-    }
-    const expiresAtMs = Date.now() + Math.max(0, refreshed.expires_in ?? 0) * 1000;
-    setSessionToken(profileName, refreshed.access_token, expiresAtMs);
-    setProfile(profileName, {
-        ...profile,
-        accountId: refreshed.account_email ?? profile.accountId,
-        accessTokenExpiresAt: new Date(expiresAtMs).toISOString(),
-        linkedAt: new Date().toISOString(),
-    });
-    return refreshed.access_token;
+    const refreshKey = JSON.stringify([profileName, keychainRef]);
+    const pending = pendingRefreshes.get(refreshKey);
+    if (pending)
+        return pending;
+    const refresh = (async () => {
+        const sec = await loadSecurityOAuth();
+        const keychain = await sec.createKeychainAdapter();
+        const refreshTokenValue = await keychain.getSecret(KEYCHAIN_SERVICE, keychainRef);
+        if (!refreshTokenValue)
+            throw new SessionOnlyExpiredError(profileName);
+        const refreshed = await refreshAccessToken(refreshTokenValue);
+        if (!refreshed.access_token)
+            throw new Error('Cognitum refresh response did not contain an access token');
+        // Cognitum rotates refresh tokens with reuse detection. Commit the rotated
+        // credential first; if this write fails, do not publish/cache the access
+        // token and do not retry the already-spent old refresh token here.
+        if (refreshed.refresh_token) {
+            await keychain.setSecret(KEYCHAIN_SERVICE, keychainRef, refreshed.refresh_token);
+        }
+        const expiresAtMs = Date.now() + Math.max(0, refreshed.expires_in ?? 0) * 1000;
+        setSessionToken(profileName, refreshed.access_token, expiresAtMs);
+        setProfile(profileName, {
+            ...profile,
+            accountId: refreshed.account_email ?? profile.accountId,
+            accessTokenExpiresAt: new Date(expiresAtMs).toISOString(),
+            linkedAt: new Date().toISOString(),
+        });
+        return refreshed.access_token;
+    })();
+    pendingRefreshes.set(refreshKey, refresh);
+    try {
+        return await refresh;
+    }
+    finally {
+        pendingRefreshes.delete(refreshKey);
+    }
 }
 //# sourceMappingURL=client.js.map

package/dist/src/commands/agent.js

@@ -294,6 +294,18 @@ const statusCommand = {
                 includeMetrics: true,
                 includeHistory: false,
             });
+            // The MCP tool answers an unknown id with status "not_found" and no other fields.
+            // Rendering that as a record printed "Agent: undefined", "Invalid Date" and
+            // "undefined%" and exited 0, so scripts and agents took it as success.
+            if ((status.status) === 'not_found') {
+                if (ctx.flags.format === 'json') {
+                    output.printJson(status);
+                }
+                else {
+                    output.printError(`Agent not found: ${agentId}`);
+                }
+                return { success: false, exitCode: 1 };
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(status);
                 return { success: true, data: status };

package/dist/src/commands/analyze.js

@@ -254,14 +254,16 @@ const codeCommand = {
         const targetPath = resolve(ctx.flags.path || '.');
         const analysisType = ctx.flags.type || 'quality';
         const formatJson = ctx.flags.format === 'json';
-        output.writeln();
-        output.writeln(output.bold('Code Analysis'));
-        output.writeln(output.dim('-'.repeat(50)));
+        if (!formatJson) {
+            output.writeln();
+            output.writeln(output.bold('Code Analysis'));
+            output.writeln(output.dim('-'.repeat(50)));
+        }
         const spinner = output.createSpinner({ text: `Analyzing ${targetPath}...`, spinner: 'dots' });
         spinner.start();
         try {
             const files = await scanSourceFiles(targetPath);
-            if (files.length === 0) {
+            if (files.length === 0 && !formatJson) {
                 spinner.stop();
                 output.printWarning('No source files found');
                 return { success: true };
@@ -310,16 +312,16 @@ const codeCommand = {
             const totalTodos = fileStats.reduce((s, f) => s + f.todos, 0);
             const totalFunctions = fileStats.reduce((s, f) => s + f.functions, 0);
             const totalImports = fileStats.reduce((s, f) => s + f.imports, 0);
-            const avgFileSize = Math.round(totalLoc / files.length);
-            const longestFile = fileStats.reduce((a, b) => a.loc > b.loc ? a : b);
-            const avgFnPerFile = (totalFunctions / files.length).toFixed(1);
-            const deepestNesting = fileStats.reduce((a, b) => a.maxNesting > b.maxNesting ? a : b);
-            const allSecurityIssues = fileStats.filter(f => f.securityIssues.length > 0);
+            const avgFileSize = files.length > 0 ? Math.round(totalLoc / files.length) : 0;
             if (formatJson) {
                 const jsonData = { type: analysisType, path: targetPath, files: files.length, totalLoc, totalTodos, totalFunctions, totalImports, avgFileSize, fileStats: fileStats.map(f => ({ relativePath: path.relative(targetPath, f.file), loc: f.loc, todos: f.todos, functions: f.functions, imports: f.imports, maxNesting: f.maxNesting, securityIssues: f.securityIssues })) };
                 output.printJson(jsonData);
                 return { success: true, data: jsonData };
             }
+            const longestFile = fileStats.reduce((a, b) => a.loc > b.loc ? a : b);
+            const avgFnPerFile = (totalFunctions / files.length).toFixed(1);
+            const deepestNesting = fileStats.reduce((a, b) => a.maxNesting > b.maxNesting ? a : b);
+            const allSecurityIssues = fileStats.filter(f => f.securityIssues.length > 0);
             if (analysisType === 'quality') {
                 output.printBox([`Files: ${files.length}`, `Lines of Code: ${totalLoc.toLocaleString()}`, `Avg File Size: ${avgFileSize} LOC`, `TODO/FIXME: ${totalTodos}`, `Functions: ${totalFunctions}`, `Imports: ${totalImports}`].join('\n'), 'Quality Summary');
                 output.writeln();
@@ -549,7 +551,7 @@ const astCommand = {
                 }
             }
             spinner.stop();
-            if (results.length === 0) {
+            if (results.length === 0 && formatType !== 'json') {
                 output.printWarning('No files analyzed');
                 return { success: true };
             }
@@ -559,7 +561,7 @@ const astCommand = {
                 functions: results.reduce((sum, r) => sum + r.functions.length, 0),
                 classes: results.reduce((sum, r) => sum + r.classes.length, 0),
                 imports: results.reduce((sum, r) => sum + r.imports.length, 0),
-                avgComplexity: results.reduce((sum, r) => sum + r.complexity.cyclomatic, 0) / results.length,
+                avgComplexity: results.length > 0 ? results.reduce((sum, r) => sum + r.complexity.cyclomatic, 0) / results.length : 0,
                 totalLoc: results.reduce((sum, r) => sum + r.complexity.loc, 0),
             };
             // JSON output
@@ -1230,9 +1232,11 @@ const depsCommand = {
         const showOutdated = ctx.flags.outdated;
         const checkSecurity = ctx.flags.security;
         const formatJson = ctx.flags.format === 'json';
-        output.writeln();
-        output.writeln(output.bold('Dependency Analysis'));
-        output.writeln(output.dim('-'.repeat(50)));
+        if (!formatJson || showOutdated || checkSecurity) {
+            output.writeln();
+            output.writeln(output.bold('Dependency Analysis'));
+            output.writeln(output.dim('-'.repeat(50)));
+        }
         try {
             const pkgPath = resolve('package.json');
             let pkgContent;

package/dist/src/commands/config.js

@@ -309,7 +309,7 @@ const resetCommand = {
     ],
     action: async (ctx) => {
         try {
-            const configPath = configManager.reset(ctx.cwd);
+            const configPath = configManager.reset(ctx.cwd, ctx.flags.section);
             output.writeln(`Configuration reset to defaults: ${configPath}`);
             return { success: true };
         }

package/dist/src/commands/daemon.js

@@ -3,24 +3,22 @@
  * Manages background worker daemon (Node.js-based, similar to shell helpers)
  */
 import { output } from '../output.js';
-import { getDaemon, startDaemon, stopDaemon } from '../services/worker-daemon.js';
+import { getDaemon, startDaemon, stopDaemon, parseEnabledWorkers } from '../services/worker-daemon.js';
 import { resolveDaemonProjectRoot } from '../services/daemon-autostart.js';
 import { fork } from 'child_process';
 import { fileURLToPath } from 'url';
 import { dirname, join, resolve } from 'path';
 import { homedir } from 'os';
 import * as fs from 'fs';
-// #1968 / #3547: shared validator for `--workers <list>`, used both when
-// reading the flag into DaemonConfig (below) and when forwarding it to the
-// forked background child's argv (startBackgroundDaemon). One pattern, one
-// place, so the two paths can't drift out of sync on what they accept.
+// Syntax guard for worker-name flags forwarded to a background child.
+// The start action validates the names against the daemon's supported workers.
 const WORKERS_RE = /^[a-z][a-z0-9_-]*(,[a-z][a-z0-9_-]*)*$/;
 // Start daemon subcommand
 const startCommand = {
     name: 'start',
     description: 'Start the worker daemon with all enabled background workers',
     options: [
-        { name: 'workers', short: 'w', type: 'string', description: 'Comma-separated list of workers to enable (default: map,audit,optimize,consolidate,testgaps)' },
+        { name: 'workers', short: 'w', type: 'string', description: 'Comma-separated list of workers to enable (default: saved selection or map,audit,optimize,consolidate,testgaps,backup,harness)' },
         // ADR-174 M3: consolidate now runs a real memory-distillation pass
         // (memory_entries -> episodes/reasoning_patterns/causal_edges) instead of
         // a no-op stub. This opt-out skips just that pass for the life of this
@@ -124,20 +122,14 @@ const startCommand = {
                 output.printWarning(`Ignoring invalid --ttl value: ${sanitize(rawTtl)}`);
             }
         }
-        // #3547 (#1968 follow-up): `--workers` was forwarded to the forked
-        // background child's argv (below, in startBackgroundDaemon) but never
-        // read into DaemonConfig here, so WorkerDaemon always fell back to
-        // DEFAULT_WORKERS (7 enabled) regardless of what was requested — in
-        // both foreground mode (this same action, run directly) and background
-        // mode (this same action, re-run in the forked child with --foreground
-        // and the forwarded --workers flag).
-        const rawWorkers = ctx.flags.workers;
-        if (typeof rawWorkers === 'string' && rawWorkers.length > 0) {
-            if (WORKERS_RE.test(rawWorkers)) {
-                config.enabledWorkers = rawWorkers.split(',');
+        if (ctx.flags.workers !== undefined) {
+            try {
+                config.enabledWorkers = parseEnabledWorkers(ctx.flags.workers);
             }
-            else if (!quiet) {
-                output.printWarning(`Ignoring invalid --workers value: ${sanitize(rawWorkers)}`);
+            catch (error) {
+                if (!quiet)
+                    output.printError(error.message);
+                return { success: false, exitCode: 1 };
             }
         }
         // Check if background daemon already running (skip if we ARE the daemon process)

package/dist/src/commands/doctor.js

@@ -7,7 +7,7 @@
 import { output } from '../output.js';
 import { existsSync, readFileSync, statSync, openSync, readSync, closeSync } from 'fs';
 import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { createHash } from 'crypto';
 import { execSync, exec, execFile } from 'child_process';
 import { promisify } from 'util';
@@ -2117,7 +2117,7 @@ async function checkMetaharnessIntegration() {
     // Runtime smoke: import the similarity module and exercise it
     try {
         const modPath = join(pluginDir, 'scripts', '_similarity.mjs');
-        const mod = await import(modPath);
+        const mod = await import(pathToFileURL(modPath).href);
         if (typeof mod.similarity !== 'function') {
             return {
                 name: 'MetaHarness integration (ADR-150)',
@@ -2144,7 +2144,7 @@ async function checkMetaharnessIntegration() {
         // parallelization primitives oia-audit depends on; if they're
         // missing, oia-audit's import fails and the whole pipeline breaks.
         const harnessPath = join(pluginDir, 'scripts', '_harness.mjs');
-        const harnessMod = await import(harnessPath);
+        const harnessMod = await import(pathToFileURL(harnessPath).href);
         if (typeof harnessMod.parseMcpScanText !== 'function') {
             return {
                 name: 'MetaHarness integration (ADR-150)',
@@ -2580,6 +2580,67 @@ export const doctorCommand = {
         const verbose = ctx.flags.verbose;
         // Parser camelCases kebab-case flag names — read via `fixHandles`, not `['fix-handles']`.
         const fixHandles = ctx.flags.fixHandles;
+        // #2677: `--component memory` now runs the whole memory-health suite,
+        // not just the existence check. Values can be a single check or an
+        // array — expanded at execution time. Stuinfla's report showed the
+        // existence-only check reporting PASS on a 99.97%-empty and even a
+        // SQLite-malformed DB; the array here layers integrity → content →
+        // embedding coverage over the existing existence probe; check 6 then
+        // verifies that distilled episodes are actually Reflexion-retrievable and
+        // execution feedback carries a lesson.
+        const componentMap = {
+            'version': checkVersionFreshness,
+            'freshness': checkVersionFreshness,
+            'node': checkNodeVersion,
+            'npm': checkNpmVersion,
+            'claude': checkClaudeCode,
+            'browser': checkAgentBrowserVersion,
+            'config': checkConfigFile,
+            'stale-settings': checkStaleSettingsNpx, // #2448
+            'helpers': () => checkHelperIntegrity(), // #3565
+            'daemon': checkDaemonStatus,
+            get memory() {
+                return [
+                    checkMemoryDatabase, // existing: exists + statable (unchanged)
+                    checkMemoryIntegrity, // #2677 check 1: sql.js open + PRAGMA integrity_check
+                    ...nativeAgentDbChecks, // #3195: present AgentDB authority, checked independently
+                    checkMemoryPersistenceDriver, // #2968/#3321: read-only native capability probe
+                    checkMemoryPackageVersion, // #3392: loaded memory package satisfies the declared range
+                    checkMemoryContent, // #2677 check 2: memory_entries content coverage
+                    checkMemoryEmbeddingCoverage, // #2677 check 3: vector coverage on populated rows
+                    checkMemoryReflexionCoverage, // #2677 check 6: episodes are retrievable
+                    checkMemoryCritiqueCoverage, // #2677 check 6: feedback carries lessons
+                ];
+            },
+            'memory-package': checkMemoryPackageVersion, // #3392
+            'learning': checkLearningBridge, // #2545
+            'learning-bridge': checkLearningBridge, // #2545
+            'api': checkApiKeys,
+            'git': checkGit,
+            'mcp': checkMcpServers,
+            'mcp-overhead': checkMcpSchemaOverhead,
+            'aidefence': checkAIDefence, // #1807
+            'disk': checkDiskSpace,
+            'typescript': checkBuildTools,
+            'agentic-flow': checkAgenticFlow,
+            'encryption': checkEncryptionAtRest, // ADR-096 Phase 5
+            'federation': checkFederationBreaker, // ADR-097 Phase 4
+            'metaharness': [checkMetaharness, checkMetaharnessDeclaredPackages, checkMetaharnessIntegration], // ADR-150 — upstream + declared deps + ruflo-side
+            'metaharness-integration': checkMetaharnessIntegration, // iter 45 — ruflo-side
+            'funnel': checkFunnel, // ADR-305
+            // ADR-307 — deep-dive array, same pattern as 'memory' above: the cheap
+            // sponsored-consent check first, then binary/process/bind in the order
+            // a user would actually debug them (is it installed? running? exposed?).
+            'proxy': [checkProxySponsoredConsent, checkProxyBinary, checkProxyProcess, checkProxyBindAddress],
+            'auth': checkAuth, // ADR-306
+            'typesafe': checkTypesafeRouter, // opt-in @ruvector/typesafe task router
+            'mods': checkMods, // ADR-404 — ruflo as a Claude Code mod
+        };
+        if (component !== undefined && !Object.hasOwn(componentMap, component)) {
+            const message = `Unknown doctor component: ${JSON.stringify(component)}. Valid components: ${Object.keys(componentMap).join(', ')}`;
+            output.printError(message);
+            return { success: false, exitCode: 1, message };
+        }
         // Early-return short-circuit: `--fix-handles` is a targeted mitigation, not
         // part of the health-check flow. Runs, reports, exits.
         if (fixHandles) {
@@ -2684,62 +2745,8 @@ export const doctorCommand = {
             checkAuth, // ADR-306 — Cognitum identity (warn-only; never fails bare `ruflo doctor`)
             checkMods, // ADR-404 — Claude Code mod path (warn-only)
         ];
-        // #2677: `--component memory` now runs the whole memory-health suite,
-        // not just the existence check. Values can be a single check or an
-        // array — expanded at execution time. Stuinfla's report showed the
-        // existence-only check reporting PASS on a 99.97%-empty and even a
-        // SQLite-malformed DB; the array here layers integrity → content →
-        // embedding coverage over the existing existence probe; check 6 then
-        // verifies that distilled episodes are actually Reflexion-retrievable and
-        // execution feedback carries a lesson.
-        const componentMap = {
-            'version': checkVersionFreshness,
-            'freshness': checkVersionFreshness,
-            'node': checkNodeVersion,
-            'npm': checkNpmVersion,
-            'claude': checkClaudeCode,
-            'browser': checkAgentBrowserVersion,
-            'config': checkConfigFile,
-            'stale-settings': checkStaleSettingsNpx, // #2448
-            'helpers': () => checkHelperIntegrity(), // #3565
-            'daemon': checkDaemonStatus,
-            'memory': [
-                checkMemoryDatabase, // existing: exists + statable (unchanged)
-                checkMemoryIntegrity, // #2677 check 1: sql.js open + PRAGMA integrity_check
-                ...nativeAgentDbChecks, // #3195: present AgentDB authority, checked independently
-                checkMemoryPersistenceDriver, // #2968/#3321: read-only native capability probe
-                checkMemoryPackageVersion, // #3392: loaded memory package satisfies the declared range
-                checkMemoryContent, // #2677 check 2: memory_entries content coverage
-                checkMemoryEmbeddingCoverage, // #2677 check 3: vector coverage on populated rows
-                checkMemoryReflexionCoverage, // #2677 check 6: episodes are retrievable
-                checkMemoryCritiqueCoverage, // #2677 check 6: feedback carries lessons
-            ],
-            'memory-package': checkMemoryPackageVersion, // #3392
-            'learning': checkLearningBridge, // #2545
-            'learning-bridge': checkLearningBridge, // #2545
-            'api': checkApiKeys,
-            'git': checkGit,
-            'mcp': checkMcpServers,
-            'mcp-overhead': checkMcpSchemaOverhead,
-            'aidefence': checkAIDefence, // #1807
-            'disk': checkDiskSpace,
-            'typescript': checkBuildTools,
-            'agentic-flow': checkAgenticFlow,
-            'encryption': checkEncryptionAtRest, // ADR-096 Phase 5
-            'federation': checkFederationBreaker, // ADR-097 Phase 4
-            'metaharness': [checkMetaharness, checkMetaharnessDeclaredPackages, checkMetaharnessIntegration], // ADR-150 — upstream + declared deps + ruflo-side
-            'metaharness-integration': checkMetaharnessIntegration, // iter 45 — ruflo-side
-            'funnel': checkFunnel, // ADR-305
-            // ADR-307 — deep-dive array, same pattern as 'memory' above: the cheap
-            // sponsored-consent check first, then binary/process/bind in the order
-            // a user would actually debug them (is it installed? running? exposed?).
-            'proxy': [checkProxySponsoredConsent, checkProxyBinary, checkProxyProcess, checkProxyBindAddress],
-            'auth': checkAuth, // ADR-306
-            'typesafe': checkTypesafeRouter, // opt-in @ruvector/typesafe task router
-            'mods': checkMods, // ADR-404 — ruflo as a Claude Code mod
-        };
         let checksToRun = allChecks;
-        if (component && componentMap[component]) {
+        if (component !== undefined) {
             const entry = componentMap[component];
             checksToRun = Array.isArray(entry) ? entry : [entry];
         }

package/dist/src/commands/memory-backup.d.ts

@@ -1,7 +1,7 @@
 /**
  * V3 CLI `memory backup` command.
  *
- * WAL-safe snapshot of the vector-memory DB (`.swarm/memory.db`) with rotation
+ * WAL-safe snapshots of the active CLI and AgentDB stores with rotation
  * and optional GCS offsite. Thin surface over ../services/memory-backup.js; the
  * daemon's nightly `backup` worker calls the same service.
  */

package/dist/src/commands/memory-backup.js

@@ -1,39 +1,53 @@
 import { output } from '../output.js';
-import { backupMemoryDb, defaultMemoryDbPath } from '../services/memory-backup.js';
+import { backupMemoryDb, backupProjectMemoryDbs } from '../services/memory-backup.js';
 export const backupCommand = {
     name: 'backup',
-    description: 'Snapshot the vector-memory DB (.swarm/memory.db) — WAL-safe, rotated, optional GCS offsite',
+    description: 'Snapshot active project memory stores — WAL-safe, rotated, optional GCS offsite',
     options: [
-        { name: 'db', description: 'Source DB (default: .swarm/memory.db)', type: 'string' },
+        { name: 'db', description: 'Source DB (default: configured CLI and AgentDB stores)', type: 'string' },
         { name: 'dir', description: 'Destination dir (default: .swarm/backups)', type: 'string' },
         { name: 'keep', description: 'Rotation — keep the newest N snapshots (default 7)', type: 'number', default: 7 },
         { name: 'gcs', description: 'Also upload the snapshot to a gs://bucket/prefix (offsite)', type: 'string' },
         { name: 'verbose', short: 'v', description: 'Verbose logging', type: 'boolean' },
     ],
     examples: [
-        { command: 'claude-flow memory backup', description: 'Snapshot to .swarm/backups, keep last 7' },
+        { command: 'claude-flow memory backup', description: 'Snapshot active project stores, keep last 7' },
         { command: 'claude-flow memory backup --keep 30', description: 'Keep a month of nightly snapshots' },
         { command: 'claude-flow memory backup --gcs gs://my-bucket/ruflo-backups', description: 'Also upload offsite to GCS' },
     ],
     action: async (ctx) => {
-        const r = await backupMemoryDb({
-            dbPath: ctx.flags.db || defaultMemoryDbPath(ctx.cwd),
+        const options = {
             destDir: ctx.flags.dir,
             keep: typeof ctx.flags.keep === 'number' ? ctx.flags.keep : 7,
             gcs: ctx.flags.gcs,
             verbose: ctx.flags.verbose === true,
-        });
+        };
+        const explicitDb = ctx.flags.db;
+        let r;
+        let receipts;
+        if (explicitDb) {
+            r = await backupMemoryDb({ ...options, dbPath: explicitDb });
+            receipts = [r];
+        }
+        else {
+            const project = await backupProjectMemoryDbs(ctx.cwd, options);
+            r = project;
+            receipts = project.backups;
+        }
         if (!r.backedUp) {
             // no-db is a benign "nothing to back up yet"; anything else is a real skip.
             if (r.skipped === 'no-db') {
-                output.printWarning('No memory DB found to back up (.swarm/memory.db). Nothing to do.');
+                output.printWarning('No memory DB found to back up. Nothing to do.');
                 return { success: true, data: r };
             }
             output.printError(`Backup skipped: ${r.skipped}`);
             return { success: false, exitCode: 1, data: r };
         }
         output.writeln();
-        output.writeln(output.success(`Backed up → ${r.path}`));
+        for (const receipt of receipts) {
+            if (receipt.backedUp)
+                output.writeln(output.success(`Backed up → ${receipt.path}`));
+        }
         output.printList([
             `Size:      ${Math.round((r.sizeBytes ?? 0) / 1024)} KB`,
             `Rotated:   ${r.rotatedAway?.length ?? 0} old snapshot(s) removed`,

package/dist/src/commands/memory.d.ts

@@ -1,7 +1,3 @@
-/**
- * V3 CLI Memory Command
- * Memory operations for AgentDB integration
- */
 import type { Command } from '../types.js';
 export declare const memoryCommand: Command;
 export default memoryCommand;

package/dist/src/commands/memory.js

@@ -2,6 +2,7 @@
  * V3 CLI Memory Command
  * Memory operations for AgentDB integration
  */
+import { validateAppendConditions } from '../memory/append-conditions.js';
 import { output } from '../output.js';
 import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
@@ -110,6 +111,10 @@ const storeCommand = {
             type: 'boolean',
             default: false
         },
+        { name: 'embedding', type: 'boolean', description: 'Generate an embedding (default true; --no-embedding stores structured data only)' },
+        { name: 'append-conditions', type: 'string', description: 'JSON predicates checked atomically with a native append-only write' },
+        { name: 'require-native', type: 'boolean', description: 'Refuse whole-image and in-memory fallback memory writers' },
+        { name: 'append-only', type: 'boolean', description: 'Immutable insert; never update or resurrect an existing key' },
         {
             name: 'upsert',
             short: 'u',
@@ -233,7 +238,7 @@ const storeCommand = {
             size: Buffer.byteLength(value, 'utf8')
         };
         output.printInfo(`Storing in ${namespace}/${key}...`);
-        // Use direct sql.js storage with automatic embedding generation
+        // Use the canonical provider; embedding and native immutable append controls are explicit.
         try {
             const { storeEntry, resolveDbPath: _rdbStore } = await import('../memory/memory-initializer.js');
             const dbPath = _rdbStore(ctx.flags.path);
@@ -244,7 +249,10 @@ const storeCommand = {
                 key,
                 value,
                 namespace,
-                generateEmbeddingFlag: true, // Always generate embeddings for semantic search
+                generateEmbeddingFlag: ctx.flags.embedding !== false,
+                requireNative: ctx.flags.requireNative === true,
+                appendOnly: ctx.flags.appendOnly === true,
+                ...(typeof ctx.flags.appendConditions === 'string' ? { appendConditions: validateAppendConditions(JSON.parse(ctx.flags.appendConditions)) } : {}),
                 tags,
                 ttl,
                 upsert,