@claude-flow/cli 3.56.0 → 3.56.2

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.56.0",
+    "version": "3.56.2",
     "files": {
       "auto-memory-hook.mjs": "c8d218526a3c34034c2a69de23f507f0eb0f70d59c16426a8edc849e6ac22529",
       "hook-handler.cjs": "34d2aacfb59a73ff94b1467bb57ab9d9c4af89c0e470aadf3bd0d74a503a658d",
@@ -9,6 +9,6 @@
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "9T3S9rchP2NnIjrYOL9tV7QvDP3WlsrsR7WlBXpUpoGPCrhe2Mo9bQEU7JOCscuQ+UQsrP211p7vmc93+AlWDg==",
+  "signature": "03RFXZ6Pjgky6pMS4AtU7Ba4ohrtwT67+aH8+COTVfhl5eZ0R1LsSXrGfMlROX+5U+FRlrbGoEaiNmNOhHRPDg==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-08T21:48:51.902Z",
-  "gitSha": "527796ae",
+  "generatedAt": "2026-10-09T17:22:50.548Z",
+  "gitSha": "9f97475f",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/commands/config.js

@@ -309,7 +309,7 @@ const resetCommand = {
     ],
     action: async (ctx) => {
         try {
-            const configPath = configManager.reset(ctx.cwd);
+            const configPath = configManager.reset(ctx.cwd, ctx.flags.section);
             output.writeln(`Configuration reset to defaults: ${configPath}`);
             return { success: true };
         }

package/dist/src/mcp-tools/config-tools.js

@@ -35,12 +35,110 @@ function ensureConfigDir() {
         mkdirSync(dir, { recursive: true, mode: 0o700 });
     }
 }
+// Plain CLI files and legacy MCP envelopes share the same path. Keep the
+// original plain document so MCP writes remain readable by the CLI.
+const plainDocuments = new WeakMap();
+const STORE_METADATA = new Set(['scopes', 'version', 'updatedAt']);
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function flattenValues(document) {
+    const values = {};
+    function visit(value, key) {
+        if (isRecord(value) && Object.keys(value).length > 0) {
+            for (const [child, entry] of Object.entries(value))
+                visit(entry, `${key}.${child}`);
+        }
+        else {
+            Object.defineProperty(values, key, { value, enumerable: true, configurable: true, writable: true });
+        }
+    }
+    for (const [key, value] of Object.entries(document)) {
+        if (!STORE_METADATA.has(key))
+            visit(value, key);
+    }
+    // CLI reads literal dotted keys before traversing nested objects.
+    for (const [key, value] of Object.entries(document)) {
+        if (key.includes('.'))
+            Object.defineProperty(values, key, { value, enumerable: true, configurable: true, writable: true });
+    }
+    return values;
+}
+function readDefaultValue(store, key) {
+    const document = plainDocuments.get(store);
+    if (!document)
+        return store.values[key];
+    return Object.hasOwn(document, key) ? document[key] : getNestedValue(document, key);
+}
+function writeDefaultValue(store, key, value) {
+    const document = plainDocuments.get(store);
+    if (!document) {
+        store.values[key] = value;
+        return;
+    }
+    // Keep existing literal dotted keys; otherwise use the CLI's nested shape.
+    if (Object.hasOwn(document, key)) {
+        // Reuse the same segment validation as nested writes.
+        setNestedValue({}, key, value);
+        document[key] = value;
+    }
+    else {
+        setNestedValue(document, key, value);
+    }
+    store.values = flattenValues(document);
+}
+function deleteDefaultValue(store, key) {
+    const document = plainDocuments.get(store);
+    if (!document)
+        return Object.hasOwn(store.values, key) && delete store.values[key];
+    let target = document;
+    let leaf = key;
+    if (!Object.hasOwn(document, key)) {
+        const parts = key.split('.');
+        leaf = parts.pop();
+        for (const part of parts) {
+            if (!Object.hasOwn(target, part) || !isRecord(target[part]))
+                return false;
+            target = target[part];
+        }
+    }
+    const deleted = Object.hasOwn(target, leaf) && delete target[leaf];
+    store.values = flattenValues(document);
+    return deleted;
+}
+function replaceDefaultValues(store, values) {
+    const document = plainDocuments.get(store);
+    if (!document) {
+        store.values = values;
+        return;
+    }
+    for (const key of Object.keys(document)) {
+        if (!STORE_METADATA.has(key))
+            delete document[key];
+    }
+    for (const [key, value] of Object.entries(values))
+        writeDefaultValue(store, key, value);
+}
 function loadConfigStore() {
     try {
         const path = getConfigPath();
         if (existsSync(path)) {
             const data = readFileSync(path, 'utf-8');
-            return JSON.parse(data);
+            const document = JSON.parse(data);
+            const isEnvelope = isRecord(document) && isRecord(document.values)
+                && isRecord(document.scopes) && typeof document.version === 'string'
+                && typeof document.updatedAt === 'string';
+            if (isRecord(document) && !isEnvelope) {
+                const store = {
+                    values: flattenValues(document),
+                    scopes: isRecord(document.scopes) ? document.scopes : {},
+                    version: typeof document.version === 'string' ? document.version : '3.0.0',
+                    updatedAt: typeof document.updatedAt === 'string' ? document.updatedAt : '',
+                };
+                plainDocuments.set(store, document);
+                return store;
+            }
+            return document;
         }
     }
     catch {
@@ -56,13 +154,20 @@ function loadConfigStore() {
 function saveConfigStore(store) {
     ensureConfigDir();
     store.updatedAt = new Date().toISOString();
-    writeFileSync(getConfigPath(), JSON.stringify(store, null, 2), 'utf-8');
+    const document = plainDocuments.get(store);
+    if (document) {
+        document.updatedAt = store.updatedAt;
+        if (Object.keys(store.scopes).length > 0 || Object.hasOwn(document, 'scopes')) {
+            document.scopes = store.scopes;
+        }
+    }
+    writeFileSync(getConfigPath(), JSON.stringify(document ?? store, null, 2), 'utf-8');
 }
 function getNestedValue(obj, key) {
     const parts = key.split('.');
     let current = obj;
     for (const part of parts) {
-        if (current && typeof current === 'object' && part in current) {
+        if (current && typeof current === 'object' && Object.hasOwn(current, part)) {
             current = current[part];
         }
         else {
@@ -95,7 +200,7 @@ function setNestedValue(obj, key, value) {
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];
-        if (!(part in current) || typeof current[part] !== 'object') {
+        if (!Object.hasOwn(current, part) || current[part] === null || typeof current[part] !== 'object') {
             current[part] = {};
         }
         current = current[part];
@@ -134,7 +239,7 @@ export const configTools = [
                 value = store.scopes[scope][key];
             }
             if (value === undefined) {
-                value = store.values[key];
+                value = readDefaultValue(store, key);
             }
             if (value === undefined) {
                 value = DEFAULT_CONFIG[key];
@@ -144,7 +249,7 @@ export const configTools = [
                 value,
                 scope,
                 exists: value !== undefined,
-                source: value !== undefined ? (store.values[key] !== undefined ? 'stored' : 'default') : 'none',
+                source: value !== undefined ? (readDefaultValue(store, key) !== undefined ? 'stored' : 'default') : 'none',
             };
         },
     },
@@ -175,9 +280,9 @@ export const configTools = [
             const key = input.key;
             const value = input.value;
             const scope = input.scope || 'default';
-            const previousValue = store.values[key];
+            const previousValue = readDefaultValue(store, key);
             if (scope === 'default') {
-                store.values[key] = value;
+                writeDefaultValue(store, key, value);
             }
             else {
                 if (!store.scopes[scope]) {
@@ -289,8 +394,7 @@ export const configTools = [
             if (key) {
                 // Reset specific key
                 if (scope === 'default') {
-                    if (key in store.values) {
-                        delete store.values[key];
+                    if (deleteDefaultValue(store, key)) {
                         resetKeys.push(key);
                     }
                 }
@@ -303,7 +407,7 @@ export const configTools = [
                 // Reset all keys in scope
                 if (scope === 'default') {
                     resetKeys = Object.keys(store.values);
-                    store.values = { ...DEFAULT_CONFIG };
+                    replaceDefaultValues(store, { ...DEFAULT_CONFIG });
                 }
                 else if (store.scopes[scope]) {
                     resetKeys = Object.keys(store.scopes[scope]);
@@ -385,10 +489,11 @@ export const configTools = [
             const importedKeys = Object.keys(config);
             if (scope === 'default') {
                 if (merge) {
-                    Object.assign(store.values, config);
+                    for (const [key, value] of Object.entries(config))
+                        writeDefaultValue(store, key, value);
                 }
                 else {
-                    store.values = { ...DEFAULT_CONFIG, ...config };
+                    replaceDefaultValues(store, { ...DEFAULT_CONFIG, ...config });
                 }
             }
             else {

package/dist/src/mcp-tools/task-tools.d.ts

@@ -4,5 +4,10 @@
  * Tool definitions for task management with file persistence.
  */
 import { type MCPTool } from './types.js';
+export declare const TASK_STATUSES: readonly ["pending", "in_progress", "completed", "failed", "cancelled"];
+type TaskStatus = (typeof TASK_STATUSES)[number];
+/** The canonical status for a written one (trimmed, any case, known aliases), or null when it is none of the five. */
+export declare function statusOf(value: unknown): TaskStatus | null;
 export declare const taskTools: MCPTool[];
+export {};
 //# sourceMappingURL=task-tools.d.ts.map

package/dist/src/mcp-tools/task-tools.js

@@ -12,6 +12,21 @@ import { validateIdentifier, validateText } from './validate-input.js';
 const STORAGE_DIR = '.claude-flow';
 const TASK_DIR = 'tasks';
 const TASK_FILE = 'store.json';
+export const TASK_STATUSES = ['pending', 'in_progress', 'completed', 'failed', 'cancelled'];
+// Spellings agents write for the same five states (seen in the wild: "complete").
+const STATUS_ALIASES = {
+    complete: 'completed', done: 'completed', canceled: 'cancelled',
+    running: 'in_progress', 'in-progress': 'in_progress', inprogress: 'in_progress',
+};
+/** The canonical status for a written one (trimmed, any case, known aliases), or null when it is none of the five. */
+export function statusOf(value) {
+    if (typeof value !== 'string')
+        return null;
+    const key = value.trim().toLowerCase();
+    if (TASK_STATUSES.includes(key))
+        return key;
+    return Object.hasOwn(STATUS_ALIASES, key) ? STATUS_ALIASES[key] : null;
+}
 function getTaskDir() {
     return join(getProjectCwd(), STORAGE_DIR, TASK_DIR);
 }
@@ -290,7 +305,9 @@ export const taskTools = [
             type: 'object',
             properties: {
                 taskId: { type: 'string', description: 'Task ID' },
-                status: { type: 'string', description: 'New status' },
+                // No schema enum: the HTTP/WebSocket registry validates enums before the handler, which would refuse the aliases there
+                // while stdio accepted them. The handler is the one place that normalises and refuses, for every transport.
+                status: { type: 'string', description: 'New status: pending, in_progress, completed, failed or cancelled' },
                 progress: { type: 'number', description: 'Progress percentage (0-100)' },
                 assignTo: { type: 'array', items: { type: 'string' }, description: 'Agent IDs to assign' },
                 result: { type: 'object', description: 'Result data (e.g. the failure of a failed task)' },
@@ -302,26 +319,52 @@ export const taskTools = [
             const vId = validateIdentifier(input.taskId, 'taskId');
             if (!vId.valid)
                 return { success: false, error: vId.error };
+            // A status outside the five is stored as written otherwise, and every reader that buckets
+            // by status (task_list filters, the console kanban) then miscounts it: "complete" read as pending.
+            const status = input.status === undefined ? undefined : statusOf(input.status);
+            if (status === null) {
+                return { success: false, error: `status must be one of ${TASK_STATUSES.join(', ')}` };
+            }
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
             if (task) {
-                if (input.status) {
-                    const newStatus = input.status;
+                // Worker effects run AFTER the task store is saved, as task_complete does: a failed save must not leave
+                // workers freed and counted against a task that still reads unfinished.
+                let afterSave;
+                if (status !== undefined) {
+                    const newStatus = status;
+                    const wasCompleted = task.status === 'completed';
                     task.status = newStatus;
                     if (newStatus === 'in_progress' && !task.startedAt) {
                         task.startedAt = new Date().toISOString();
                     }
-                    // A failed task frees its workers, as task_complete and task_cancel do;
-                    // otherwise a worker whose run failed stays `busy` forever.
-                    if (newStatus === 'failed') {
+                    // A finished task frees its workers, as task_complete and task_cancel do; otherwise a worker
+                    // whose task was finished through task_update stays `busy` forever, and a later task_complete
+                    // returns early because the status already reads completed.
+                    if (newStatus === 'failed' || newStatus === 'cancelled') {
+                        task.completedAt = new Date().toISOString();
+                        afterSave = () => releaseAgents(task.assignedTo, taskId);
+                    }
+                    if (newStatus === 'completed' && !wasCompleted) {
                         task.completedAt = new Date().toISOString();
-                        releaseAgents(task.assignedTo, taskId);
+                        // Credited only to a worker still holding this task, so complete -> pending -> complete
+                        // (no reassignment in between) never counts the same work twice.
+                        afterSave = () => updateAgents(task.assignedTo, (agent) => {
+                            if (agent.currentTask === taskId) {
+                                agent.status = 'idle';
+                                agent.currentTask = null;
+                                agent.taskCount = (agent.taskCount || 0) + 1;
+                            }
+                        });
                     }
                 }
                 if (typeof input.progress === 'number') {
                     task.progress = Math.min(100, Math.max(0, input.progress));
                 }
+                // Completing is 100% whatever progress the same call carried.
+                if (task.status === 'completed')
+                    task.progress = 100;
                 if (input.assignTo) {
                     task.assignedTo = input.assignTo;
                 }
@@ -329,6 +372,7 @@ export const taskTools = [
                     task.result = input.result;
                 }
                 saveTaskStore(store);
+                afterSave?.();
                 return {
                     success: true,
                     taskId: task.taskId,

package/dist/src/memory/memory-initializer.js

@@ -1235,7 +1235,11 @@ export async function ensureSchemaColumns(dbPath, options = {}) {
             if (columnsAdded.includes('status') || existingColumns.has('status')) {
                 try {
                     db.run(`UPDATE memory_entries SET status = 'active' WHERE status IS NULL`);
-                    modified = true;
+                    // #3918: only a backfill that changed rows dirties the image. Setting
+                    // this unconditionally rewrote every up-to-date store on each open (and,
+                    // with encryption at rest, with a fresh nonce, so the bytes changed too).
+                    if (db.getRowsModified() > 0)
+                        modified = true;
                 }
                 catch {
                     /* table is read-only or doesn't exist — skip */

package/dist/src/services/config-file-manager.d.ts

@@ -18,8 +18,8 @@ export declare class ConfigFileManager {
     set(cwd: string, key: string, value: unknown): void;
     /** Create a new config file with defaults */
     create(cwd: string, overrides?: Record<string, unknown>, force?: boolean): string;
-    /** Reset config to defaults */
-    reset(cwd: string): string;
+    /** Reset all configuration or only the selected section to defaults. */
+    reset(cwd: string, section?: string): string;
     /** Export config to a specific path */
     exportTo(cwd: string, exportPath: string): void;
     /** Import config from a specific path */

package/dist/src/services/config-file-manager.js

@@ -148,11 +148,30 @@ export class ConfigFileManager {
         this.configPath = targetPath;
         return targetPath;
     }
-    /** Reset config to defaults */
-    reset(cwd) {
+    /** Reset all configuration or only the selected section to defaults. */
+    reset(cwd, section = 'all') {
+        if (!['agents', 'swarm', 'memory', 'mcp', 'providers', 'all'].includes(section)) {
+            throw new Error(`Unknown configuration section: ${section}`);
+        }
         this.selectProject(cwd);
         const targetPath = this.findConfig(cwd) ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
-        const config = structuredClone(DEFAULT_CONFIG);
+        const config = section === 'all'
+            ? structuredClone(DEFAULT_CONFIG)
+            : structuredClone(this.load(cwd) ?? {});
+        if (section === 'providers') {
+            // Provider defaults are supplied by the provider command, so remove
+            // only the persisted override, as a whole reset already does.
+            delete config.providers;
+        }
+        else if (section !== 'all') {
+            config[section] = structuredClone(DEFAULT_CONFIG[section]);
+        }
+        if (section !== 'all') {
+            for (const key of Object.keys(config)) {
+                if (key.startsWith(`${section}.`))
+                    delete config[key];
+            }
+        }
         this.writeAtomic(targetPath, config);
         this.config = config;
         this.configPath = targetPath;

package/dist/src/services/policy-ledger-anchor.d.ts

@@ -22,6 +22,14 @@ export type AnchorAssessment = {
 };
 export type AnchorWriter = (file: string, value: unknown) => Promise<void>;
 export declare const anchorLogPath: (projectRoot: string) => string;
+/**
+ * Directory holding per-project trust material (anchor mirror, HMAC key).
+ * Resolved from the environment at call time (#3919): $XDG_CONFIG_HOME when it
+ * is absolute, else $HOME/.config (os.homedir() honours $HOME), so a scratch
+ * HOME keeps tests and sandboxed runs out of the developer's real home. An XDG
+ * user who already has trust state under the legacy ~/.config keeps using it.
+ */
+export declare function policyTrustRoot(): string;
 /**
  * How the stored anchors relate to `state`; read-only. `rebuild` is the
  * explicit-establish path: an unreadable log or mirror is treated as absent, but

package/dist/src/services/policy-ledger-anchor.js

@@ -13,14 +13,29 @@
  */
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { userInfo } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
 const LOG_FILE = 'ledger-anchors.json';
 const MIRROR_FILE = 'ledger-anchor-head.json';
 export const anchorLogPath = (projectRoot) => join(resolve(projectRoot), '.claude-flow', 'policy', LOG_FILE);
+/**
+ * Directory holding per-project trust material (anchor mirror, HMAC key).
+ * Resolved from the environment at call time (#3919): $XDG_CONFIG_HOME when it
+ * is absolute, else $HOME/.config (os.homedir() honours $HOME), so a scratch
+ * HOME keeps tests and sandboxed runs out of the developer's real home. An XDG
+ * user who already has trust state under the legacy ~/.config keeps using it.
+ */
+export function policyTrustRoot() {
+    const legacy = join(homedir(), '.config', 'ruflo', 'policy-trust');
+    const xdg = process.env.XDG_CONFIG_HOME;
+    if (!xdg || !isAbsolute(xdg))
+        return legacy;
+    const preferred = join(xdg, 'ruflo', 'policy-trust');
+    return !existsSync(preferred) && existsSync(legacy) ? legacy : preferred;
+}
 function mirrorPath(projectRoot) {
     const id = createHash('sha256').update(realpathSync(projectRoot)).digest('hex');
-    return join(userInfo().homedir, '.config', 'ruflo', 'policy-trust', id, MIRROR_FILE);
+    return join(policyTrustRoot(), id, MIRROR_FILE);
 }
 function entryHash(entry) {
     return createHash('sha256').update(JSON.stringify([

package/dist/src/services/policy-runtime.js

@@ -5,7 +5,7 @@ import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync,
 import { dirname, join, resolve } from 'node:path';
 import { hostname, userInfo } from 'node:os';
 import { syncPolicyProjection } from '../mods/policy-projection.js';
-import { assessAnchors, recordAnchor } from './policy-ledger-anchor.js';
+import { assessAnchors, policyTrustRoot, recordAnchor } from './policy-ledger-anchor.js';
 const POLICY_DIR = join('.claude-flow', 'policy');
 const POLICY_FILE = 'state.json';
 const LOCK_FILE = 'state.lock';
@@ -194,7 +194,7 @@ async function writeJsonAtomic(file, value) {
     }
 }
 function trustPaths(projectRoot) {
-    const trustRoot = join(userInfo().homedir, '.config', 'ruflo', 'policy-trust');
+    const trustRoot = policyTrustRoot();
     const projectId = createHash('sha256').update(realpathSync(projectRoot)).digest('hex');
     const dir = join(trustRoot, projectId);
     return { key: join(dir, 'anchor.key'), anchor: join(dir, 'state.anchor.json') };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.56.0",
+  "version": "3.56.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/plugins/ruflo-metaharness/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruflo-metaharness",
   "description": "MetaHarness integration for ruflo — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150's architectural constraint that MetaHarness remains an optional augmentation, never a required runtime dependency. As a mod (ADR-445): confirms flywheel promotion, keeps secrets out of inputs, /metaharness-mod, and a status file the console shows",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet"

package/plugins/ruflo-metaharness/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 Newest first. One `## <version> — <date>` heading per version, then `feat:`, `fix:`, `breaking:` and `chore:` bullets (ADR-478). Built from git history; this is the whole history.
 
+## 0.2.5 — 2026-10-09
+- fix: seven harness-* skill descriptions no longer carry angle-bracket placeholders (claude.ai strips them as XML tags)
+
 ## 0.2.4 — 2026-10-07
 - fix: run the installed ruflo CLI before `npx @claude-flow/cli@latest` in cost-tracker, adr and metaharness
 - chore: 3.55.0 versions, leaf pins, lockfiles, plugin bumps, changelog

package/plugins/ruflo-metaharness/scripts/smoke.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Structural smoke test for ruflo-metaharness v0.2.4 (ADR-150 Phase 1).
+# Structural smoke test for ruflo-metaharness v0.2.5 (ADR-150 Phase 1).
 set -u
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 PASS=0
@@ -32,10 +32,10 @@ else
   bad "extraction-regex-rot: EXPECTED_TOOLS=$EXPECTED_TOOLS EXPECTED_SUBS=$EXPECTED_SUBS"
 fi
 
-step "1. plugin.json declares 0.2.4 with adr-150 keywords"
+step "1. plugin.json declares 0.2.5 with adr-150 keywords"
 v=$(grep -E '"version"' "$ROOT/.claude-plugin/plugin.json" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-if [[ "$v" != "0.2.4" ]]; then
-  bad "expected 0.2.4, got '$v'"
+if [[ "$v" != "0.2.5" ]]; then
+  bad "expected 0.2.5, got '$v'"
 else
   miss=""
   for k in ruflo metaharness harness scorecard genome mcp-scan threat-model router adr-150 adr-148 adr-149 optional-dependency graceful-degradation subprocess phase-1-mvp; do

package/plugins/ruflo-metaharness/skills/harness-bench/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: harness-bench
-description: Manage `@metaharness/darwin` bench suites — `bench create <repo>` scaffolds a JSON suite from a repo's test corpus; `bench verify <suite.json>` checks suite well-formedness. Bench suites are the fixed evaluation corpora that `harness-evolve --bench <suite.json>` scores variants against, decoupling evolution from the repo's natural tests. Degrades gracefully when @metaharness/darwin is absent.
+description: Manage `@metaharness/darwin` bench suites — `bench create {repo}` scaffolds a JSON suite from a repo's test corpus; `bench verify {suite.json}` checks suite well-formedness. Bench suites are the fixed evaluation corpora that `harness-evolve --bench {suite.json}` scores variants against, decoupling evolution from the repo's natural tests. Degrades gracefully when @metaharness/darwin is absent.
 argument-hint: "--op create --repo <path> [--out <path>]  |  --op verify --suite <path>"
 allowed-tools: Bash
 ---

package/plugins/ruflo-metaharness/skills/harness-evolve/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: harness-evolve
-description: Run `@metaharness/darwin evolve <repo>` to mutate a harness's seven policy surfaces (planner/contextBuilder/reviewer/retryPolicy/toolPolicy/memoryPolicy/scorePolicy), sandbox-score each variant, and promote only measured wins. The model is frozen; the harness evolves. Closes the loop ADR-150 opens (score+genome describe; evolve changes). Degrades gracefully when @metaharness/darwin is absent (ADR-150 + ADR-153 architectural constraints).
+description: Run `@metaharness/darwin evolve {repo}` to mutate a harness's seven policy surfaces (planner/contextBuilder/reviewer/retryPolicy/toolPolicy/memoryPolicy/scorePolicy), sandbox-score each variant, and promote only measured wins. The model is frozen; the harness evolves. Closes the loop ADR-150 opens (score+genome describe; evolve changes). Degrades gracefully when @metaharness/darwin is absent (ADR-150 + ADR-153 architectural constraints).
 argument-hint: "--repo <path> [--generations 3] [--children 3] [--concurrency 2] [--sandbox real|mock|agent] [--selection pareto|quality-diversity|...] [--mutator deterministic|ruvllm] [--diagnose] [--confirm]"
 allowed-tools: Bash
 ---

package/plugins/ruflo-metaharness/skills/harness-genome/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: harness-genome
-description: 7-section repo readiness report from `metaharness genome <path>`. Returns repo_type / agent_topology / risk_score / mcp_surface / test_confidence / publish_readiness. Pure-read; degrades gracefully (ADR-150).
+description: 7-section repo readiness report from `metaharness genome {path}`. Returns repo_type / agent_topology / risk_score / mcp_surface / test_confidence / publish_readiness. Pure-read; degrades gracefully (ADR-150).
 argument-hint: "[--path .] [--alert-on-risk-above 0.5] [--format table|json]"
 allowed-tools: Bash
 ---

package/plugins/ruflo-metaharness/skills/harness-mcp-scan/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: harness-mcp-scan
-description: Static security scan of a harness's declared MCP surface via `harness mcp-scan <path>`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch. Exits 1 on findings at or above `--fail-on` severity.
+description: Static security scan of a harness's declared MCP surface via `harness mcp-scan {path}`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch. Exits 1 on findings at or above `--fail-on` severity.
 argument-hint: "[--path .] [--fail-on low|medium|high] [--format table|json]"
 allowed-tools: Bash
 ---

package/plugins/ruflo-metaharness/skills/harness-mint/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: harness-mint
-description: Scaffold a custom AI agent harness via `metaharness new <name> --template <id> --host <id>`. Defaults to DRY-RUN (no writes) unless --confirm is passed. Refuses to write to the calling repo root or anywhere inside it. Honors ADR-150 architectural constraint + ruflo's "destructive-action confirmation" pattern.
+description: Scaffold a custom AI agent harness via `metaharness new {name} --template {id} --host {id}`. Defaults to DRY-RUN (no writes) unless --confirm is passed. Refuses to write to the calling repo root or anywhere inside it. Honors ADR-150 architectural constraint + ruflo's "destructive-action confirmation" pattern.
 argument-hint: "--name <id> --template <vertical:coding|minimal|…> [--host claude-code|codex|…] [--target /abs/path] [--confirm] [--format table|json]"
 allowed-tools: Bash
 ---

package/plugins/ruflo-metaharness/skills/harness-score/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: harness-score
-description: 5-dimension harness readiness scorecard from `metaharness score <path>`. Returns harnessFit / compileConfidence / taskCoverage / toolSafety / memoryUsefulness + estCostPerRunUsd + scaffoldReady. Pure-read; subprocess invocation; degrades gracefully when MetaHarness is absent (ADR-150 architectural constraint).
+description: 5-dimension harness readiness scorecard from `metaharness score {path}`. Returns harnessFit / compileConfidence / taskCoverage / toolSafety / memoryUsefulness + estCostPerRunUsd + scaffoldReady. Pure-read; subprocess invocation; degrades gracefully when MetaHarness is absent (ADR-150 architectural constraint).
 argument-hint: "[--path .] [--alert-on-fit-below 70] [--format table|json]"
 allowed-tools: Bash
 ---

package/plugins/ruflo-metaharness/skills/harness-threat-model/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: harness-threat-model
-description: Enterprise-review-grade threat model from `harness threat-model <path>`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
+description: Enterprise-review-grade threat model from `harness threat-model {path}`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
 argument-hint: "[--path .] [--fail-on clean|low|medium|high] [--format table|json]"
 allowed-tools: Bash
 ---