@claude-flow/cli 3.56.0 → 3.56.1

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.56.0",
+    "version": "3.56.1",
     "files": {
       "auto-memory-hook.mjs": "c8d218526a3c34034c2a69de23f507f0eb0f70d59c16426a8edc849e6ac22529",
       "hook-handler.cjs": "34d2aacfb59a73ff94b1467bb57ab9d9c4af89c0e470aadf3bd0d74a503a658d",
@@ -9,6 +9,6 @@
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "9T3S9rchP2NnIjrYOL9tV7QvDP3WlsrsR7WlBXpUpoGPCrhe2Mo9bQEU7JOCscuQ+UQsrP211p7vmc93+AlWDg==",
+  "signature": "eGhCbWbSEhufQTLyjtRuSNc3JX1kDYCMAbqj/mn4IpYUOX+pi9Xs5lPAo/kVgVolhF1JRspGhzFi3Y8spw0EBw==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-08T21:48:51.902Z",
-  "gitSha": "527796ae",
+  "generatedAt": "2026-10-09T04:37:42.484Z",
+  "gitSha": "58e0ae7e",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/commands/config.js

@@ -309,7 +309,7 @@ const resetCommand = {
     ],
     action: async (ctx) => {
         try {
-            const configPath = configManager.reset(ctx.cwd);
+            const configPath = configManager.reset(ctx.cwd, ctx.flags.section);
             output.writeln(`Configuration reset to defaults: ${configPath}`);
             return { success: true };
         }

package/dist/src/mcp-tools/config-tools.js

@@ -35,12 +35,110 @@ function ensureConfigDir() {
         mkdirSync(dir, { recursive: true, mode: 0o700 });
     }
 }
+// Plain CLI files and legacy MCP envelopes share the same path. Keep the
+// original plain document so MCP writes remain readable by the CLI.
+const plainDocuments = new WeakMap();
+const STORE_METADATA = new Set(['scopes', 'version', 'updatedAt']);
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function flattenValues(document) {
+    const values = {};
+    function visit(value, key) {
+        if (isRecord(value) && Object.keys(value).length > 0) {
+            for (const [child, entry] of Object.entries(value))
+                visit(entry, `${key}.${child}`);
+        }
+        else {
+            Object.defineProperty(values, key, { value, enumerable: true, configurable: true, writable: true });
+        }
+    }
+    for (const [key, value] of Object.entries(document)) {
+        if (!STORE_METADATA.has(key))
+            visit(value, key);
+    }
+    // CLI reads literal dotted keys before traversing nested objects.
+    for (const [key, value] of Object.entries(document)) {
+        if (key.includes('.'))
+            Object.defineProperty(values, key, { value, enumerable: true, configurable: true, writable: true });
+    }
+    return values;
+}
+function readDefaultValue(store, key) {
+    const document = plainDocuments.get(store);
+    if (!document)
+        return store.values[key];
+    return Object.hasOwn(document, key) ? document[key] : getNestedValue(document, key);
+}
+function writeDefaultValue(store, key, value) {
+    const document = plainDocuments.get(store);
+    if (!document) {
+        store.values[key] = value;
+        return;
+    }
+    // Keep existing literal dotted keys; otherwise use the CLI's nested shape.
+    if (Object.hasOwn(document, key)) {
+        // Reuse the same segment validation as nested writes.
+        setNestedValue({}, key, value);
+        document[key] = value;
+    }
+    else {
+        setNestedValue(document, key, value);
+    }
+    store.values = flattenValues(document);
+}
+function deleteDefaultValue(store, key) {
+    const document = plainDocuments.get(store);
+    if (!document)
+        return Object.hasOwn(store.values, key) && delete store.values[key];
+    let target = document;
+    let leaf = key;
+    if (!Object.hasOwn(document, key)) {
+        const parts = key.split('.');
+        leaf = parts.pop();
+        for (const part of parts) {
+            if (!Object.hasOwn(target, part) || !isRecord(target[part]))
+                return false;
+            target = target[part];
+        }
+    }
+    const deleted = Object.hasOwn(target, leaf) && delete target[leaf];
+    store.values = flattenValues(document);
+    return deleted;
+}
+function replaceDefaultValues(store, values) {
+    const document = plainDocuments.get(store);
+    if (!document) {
+        store.values = values;
+        return;
+    }
+    for (const key of Object.keys(document)) {
+        if (!STORE_METADATA.has(key))
+            delete document[key];
+    }
+    for (const [key, value] of Object.entries(values))
+        writeDefaultValue(store, key, value);
+}
 function loadConfigStore() {
     try {
         const path = getConfigPath();
         if (existsSync(path)) {
             const data = readFileSync(path, 'utf-8');
-            return JSON.parse(data);
+            const document = JSON.parse(data);
+            const isEnvelope = isRecord(document) && isRecord(document.values)
+                && isRecord(document.scopes) && typeof document.version === 'string'
+                && typeof document.updatedAt === 'string';
+            if (isRecord(document) && !isEnvelope) {
+                const store = {
+                    values: flattenValues(document),
+                    scopes: isRecord(document.scopes) ? document.scopes : {},
+                    version: typeof document.version === 'string' ? document.version : '3.0.0',
+                    updatedAt: typeof document.updatedAt === 'string' ? document.updatedAt : '',
+                };
+                plainDocuments.set(store, document);
+                return store;
+            }
+            return document;
         }
     }
     catch {
@@ -56,13 +154,20 @@ function loadConfigStore() {
 function saveConfigStore(store) {
     ensureConfigDir();
     store.updatedAt = new Date().toISOString();
-    writeFileSync(getConfigPath(), JSON.stringify(store, null, 2), 'utf-8');
+    const document = plainDocuments.get(store);
+    if (document) {
+        document.updatedAt = store.updatedAt;
+        if (Object.keys(store.scopes).length > 0 || Object.hasOwn(document, 'scopes')) {
+            document.scopes = store.scopes;
+        }
+    }
+    writeFileSync(getConfigPath(), JSON.stringify(document ?? store, null, 2), 'utf-8');
 }
 function getNestedValue(obj, key) {
     const parts = key.split('.');
     let current = obj;
     for (const part of parts) {
-        if (current && typeof current === 'object' && part in current) {
+        if (current && typeof current === 'object' && Object.hasOwn(current, part)) {
             current = current[part];
         }
         else {
@@ -95,7 +200,7 @@ function setNestedValue(obj, key, value) {
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];
-        if (!(part in current) || typeof current[part] !== 'object') {
+        if (!Object.hasOwn(current, part) || current[part] === null || typeof current[part] !== 'object') {
             current[part] = {};
         }
         current = current[part];
@@ -134,7 +239,7 @@ export const configTools = [
                 value = store.scopes[scope][key];
             }
             if (value === undefined) {
-                value = store.values[key];
+                value = readDefaultValue(store, key);
             }
             if (value === undefined) {
                 value = DEFAULT_CONFIG[key];
@@ -144,7 +249,7 @@ export const configTools = [
                 value,
                 scope,
                 exists: value !== undefined,
-                source: value !== undefined ? (store.values[key] !== undefined ? 'stored' : 'default') : 'none',
+                source: value !== undefined ? (readDefaultValue(store, key) !== undefined ? 'stored' : 'default') : 'none',
             };
         },
     },
@@ -175,9 +280,9 @@ export const configTools = [
             const key = input.key;
             const value = input.value;
             const scope = input.scope || 'default';
-            const previousValue = store.values[key];
+            const previousValue = readDefaultValue(store, key);
             if (scope === 'default') {
-                store.values[key] = value;
+                writeDefaultValue(store, key, value);
             }
             else {
                 if (!store.scopes[scope]) {
@@ -289,8 +394,7 @@ export const configTools = [
             if (key) {
                 // Reset specific key
                 if (scope === 'default') {
-                    if (key in store.values) {
-                        delete store.values[key];
+                    if (deleteDefaultValue(store, key)) {
                         resetKeys.push(key);
                     }
                 }
@@ -303,7 +407,7 @@ export const configTools = [
                 // Reset all keys in scope
                 if (scope === 'default') {
                     resetKeys = Object.keys(store.values);
-                    store.values = { ...DEFAULT_CONFIG };
+                    replaceDefaultValues(store, { ...DEFAULT_CONFIG });
                 }
                 else if (store.scopes[scope]) {
                     resetKeys = Object.keys(store.scopes[scope]);
@@ -385,10 +489,11 @@ export const configTools = [
             const importedKeys = Object.keys(config);
             if (scope === 'default') {
                 if (merge) {
-                    Object.assign(store.values, config);
+                    for (const [key, value] of Object.entries(config))
+                        writeDefaultValue(store, key, value);
                 }
                 else {
-                    store.values = { ...DEFAULT_CONFIG, ...config };
+                    replaceDefaultValues(store, { ...DEFAULT_CONFIG, ...config });
                 }
             }
             else {

package/dist/src/memory/memory-initializer.js

@@ -1235,7 +1235,11 @@ export async function ensureSchemaColumns(dbPath, options = {}) {
             if (columnsAdded.includes('status') || existingColumns.has('status')) {
                 try {
                     db.run(`UPDATE memory_entries SET status = 'active' WHERE status IS NULL`);
-                    modified = true;
+                    // #3918: only a backfill that changed rows dirties the image. Setting
+                    // this unconditionally rewrote every up-to-date store on each open (and,
+                    // with encryption at rest, with a fresh nonce, so the bytes changed too).
+                    if (db.getRowsModified() > 0)
+                        modified = true;
                 }
                 catch {
                     /* table is read-only or doesn't exist — skip */

package/dist/src/services/config-file-manager.d.ts

@@ -18,8 +18,8 @@ export declare class ConfigFileManager {
     set(cwd: string, key: string, value: unknown): void;
     /** Create a new config file with defaults */
     create(cwd: string, overrides?: Record<string, unknown>, force?: boolean): string;
-    /** Reset config to defaults */
-    reset(cwd: string): string;
+    /** Reset all configuration or only the selected section to defaults. */
+    reset(cwd: string, section?: string): string;
     /** Export config to a specific path */
     exportTo(cwd: string, exportPath: string): void;
     /** Import config from a specific path */

package/dist/src/services/config-file-manager.js

@@ -148,11 +148,30 @@ export class ConfigFileManager {
         this.configPath = targetPath;
         return targetPath;
     }
-    /** Reset config to defaults */
-    reset(cwd) {
+    /** Reset all configuration or only the selected section to defaults. */
+    reset(cwd, section = 'all') {
+        if (!['agents', 'swarm', 'memory', 'mcp', 'providers', 'all'].includes(section)) {
+            throw new Error(`Unknown configuration section: ${section}`);
+        }
         this.selectProject(cwd);
         const targetPath = this.findConfig(cwd) ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
-        const config = structuredClone(DEFAULT_CONFIG);
+        const config = section === 'all'
+            ? structuredClone(DEFAULT_CONFIG)
+            : structuredClone(this.load(cwd) ?? {});
+        if (section === 'providers') {
+            // Provider defaults are supplied by the provider command, so remove
+            // only the persisted override, as a whole reset already does.
+            delete config.providers;
+        }
+        else if (section !== 'all') {
+            config[section] = structuredClone(DEFAULT_CONFIG[section]);
+        }
+        if (section !== 'all') {
+            for (const key of Object.keys(config)) {
+                if (key.startsWith(`${section}.`))
+                    delete config[key];
+            }
+        }
         this.writeAtomic(targetPath, config);
         this.config = config;
         this.configPath = targetPath;

package/dist/src/services/policy-ledger-anchor.d.ts

@@ -22,6 +22,14 @@ export type AnchorAssessment = {
 };
 export type AnchorWriter = (file: string, value: unknown) => Promise<void>;
 export declare const anchorLogPath: (projectRoot: string) => string;
+/**
+ * Directory holding per-project trust material (anchor mirror, HMAC key).
+ * Resolved from the environment at call time (#3919): $XDG_CONFIG_HOME when it
+ * is absolute, else $HOME/.config (os.homedir() honours $HOME), so a scratch
+ * HOME keeps tests and sandboxed runs out of the developer's real home. An XDG
+ * user who already has trust state under the legacy ~/.config keeps using it.
+ */
+export declare function policyTrustRoot(): string;
 /**
  * How the stored anchors relate to `state`; read-only. `rebuild` is the
  * explicit-establish path: an unreadable log or mirror is treated as absent, but

package/dist/src/services/policy-ledger-anchor.js

@@ -13,14 +13,29 @@
  */
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { userInfo } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
 const LOG_FILE = 'ledger-anchors.json';
 const MIRROR_FILE = 'ledger-anchor-head.json';
 export const anchorLogPath = (projectRoot) => join(resolve(projectRoot), '.claude-flow', 'policy', LOG_FILE);
+/**
+ * Directory holding per-project trust material (anchor mirror, HMAC key).
+ * Resolved from the environment at call time (#3919): $XDG_CONFIG_HOME when it
+ * is absolute, else $HOME/.config (os.homedir() honours $HOME), so a scratch
+ * HOME keeps tests and sandboxed runs out of the developer's real home. An XDG
+ * user who already has trust state under the legacy ~/.config keeps using it.
+ */
+export function policyTrustRoot() {
+    const legacy = join(homedir(), '.config', 'ruflo', 'policy-trust');
+    const xdg = process.env.XDG_CONFIG_HOME;
+    if (!xdg || !isAbsolute(xdg))
+        return legacy;
+    const preferred = join(xdg, 'ruflo', 'policy-trust');
+    return !existsSync(preferred) && existsSync(legacy) ? legacy : preferred;
+}
 function mirrorPath(projectRoot) {
     const id = createHash('sha256').update(realpathSync(projectRoot)).digest('hex');
-    return join(userInfo().homedir, '.config', 'ruflo', 'policy-trust', id, MIRROR_FILE);
+    return join(policyTrustRoot(), id, MIRROR_FILE);
 }
 function entryHash(entry) {
     return createHash('sha256').update(JSON.stringify([

package/dist/src/services/policy-runtime.js

@@ -5,7 +5,7 @@ import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync,
 import { dirname, join, resolve } from 'node:path';
 import { hostname, userInfo } from 'node:os';
 import { syncPolicyProjection } from '../mods/policy-projection.js';
-import { assessAnchors, recordAnchor } from './policy-ledger-anchor.js';
+import { assessAnchors, policyTrustRoot, recordAnchor } from './policy-ledger-anchor.js';
 const POLICY_DIR = join('.claude-flow', 'policy');
 const POLICY_FILE = 'state.json';
 const LOCK_FILE = 'state.lock';
@@ -194,7 +194,7 @@ async function writeJsonAtomic(file, value) {
     }
 }
 function trustPaths(projectRoot) {
-    const trustRoot = join(userInfo().homedir, '.config', 'ruflo', 'policy-trust');
+    const trustRoot = policyTrustRoot();
     const projectId = createHash('sha256').update(realpathSync(projectRoot)).digest('hex');
     const dir = join(trustRoot, projectId);
     return { key: join(dir, 'anchor.key'), anchor: join(dir, 'state.anchor.json') };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.56.0",
+  "version": "3.56.1",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",