@claude-flow/cli 3.56.6 → 3.56.8

package/dist/src/mcp-tools/memory-tools.js

@@ -1402,7 +1402,8 @@ export const memoryTools = [
                 if (!v.valid)
                     throw new Error(v.error);
             }
-            const all = await listEntries({ limit: 100000, namespace });
+            // #4056: TTL hides expired rows from normal reads, so the cleanup has to ask for them.
+            const all = await listEntries({ limit: 100000, namespace, includeExpired: true });
             const now = Date.now();
             const expired = all.entries.filter(e => {
                 const exp = e.expiresAt;

package/dist/src/memory/live-memory-row.d.ts

@@ -1,3 +1,5 @@
 /** TTL is a read-time visibility rule, independent of background cleanup. */
-export declare function liveMemoryRowSql(): string;
+export declare function liveMemoryRowSql(opts?: {
+    includeExpired?: boolean;
+}): string;
 //# sourceMappingURL=live-memory-row.d.ts.map

package/dist/src/memory/live-memory-row.js

@@ -1,5 +1,7 @@
 /** TTL is a read-time visibility rule, independent of background cleanup. */
-export function liveMemoryRowSql() {
+export function liveMemoryRowSql(opts = {}) {
+    if (opts.includeExpired)
+        return `(status = 'active' OR status IS NULL)`;
     return `(status = 'active' OR status IS NULL) AND (expires_at IS NULL OR expires_at > ${Date.now()})`;
 }
 //# sourceMappingURL=live-memory-row.js.map

package/dist/src/memory/memory-bridge.d.ts

@@ -142,6 +142,8 @@ export declare function bridgeListEntries(options: {
     provenanceFilter?: string[];
     /** ADR-472: include each entry's embedding as int8+scale (`embeddingQ8`); at most MAX_LIST_EMBEDDINGS rows. */
     includeEmbedding?: boolean;
+    /** #4056: also return rows whose TTL has passed (with `expiresAt`). For cleanup only. */
+    includeExpired?: boolean;
 }): Promise<{
     success: boolean;
     entries: {
@@ -152,6 +154,8 @@ export declare function bridgeListEntries(options: {
         accessCount: number;
         createdAt: string;
         updatedAt: string;
+        /** #4056: epoch ms the row expires at; null when it never does. */
+        expiresAt?: number | null;
         hasEmbedding: boolean;
         /** #2073: Present when `includeContent: true` was requested. */
         content?: string;

package/dist/src/memory/memory-bridge.js

@@ -1453,7 +1453,7 @@ export async function bridgeListEntries(options) {
         // the `status = 'active'` filter matched zero. Treat NULL as
         // "legacy-active" — the safe default for any entry that predates the
         // status column.
-        const statusFilter = liveMemoryRowSql();
+        const statusFilter = liveMemoryRowSql({ includeExpired: options.includeExpired });
         // Count
         let total = 0;
         try {
@@ -1468,7 +1468,7 @@ export async function bridgeListEntries(options) {
         const entries = [];
         try {
             const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type
+        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type, expires_at
         FROM memory_entries
         WHERE ${statusFilter} ${extraFilter}
         ORDER BY updated_at DESC
@@ -1486,6 +1486,7 @@ export async function bridgeListEntries(options) {
                     accessCount: row.access_count ?? 0,
                     createdAt: row.created_at || new Date().toISOString(),
                     updatedAt: row.updated_at || new Date().toISOString(),
+                    expiresAt: row.expires_at ?? null,
                     hasEmbedding: !!(row.embedding && String(row.embedding).length > 10),
                     provenanceType: row.provenance_type || 'unknown',
                 };

package/dist/src/memory/memory-initializer.d.ts

@@ -511,6 +511,8 @@ export declare function listEntries(options: {
     provenanceFilter?: string[];
     /** ADR-472: include each entry's embedding as int8+scale (`embeddingQ8`); at most MAX_LIST_EMBEDDINGS rows. Read-only. */
     includeEmbedding?: boolean;
+    /** #4056: also return rows whose TTL has passed (with `expiresAt`). For cleanup only; normal reads hide them. */
+    includeExpired?: boolean;
 }): Promise<{
     success: boolean;
     entries: {
@@ -521,6 +523,8 @@ export declare function listEntries(options: {
         accessCount: number;
         createdAt: string;
         updatedAt: string;
+        /** #4056: epoch ms the row expires at; null when it never does. */
+        expiresAt?: number | null;
         hasEmbedding: boolean;
         /** #2073: Present when `includeContent: true` was requested. */
         content?: string;

package/dist/src/memory/memory-initializer.js

@@ -6,7 +6,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { createRequire } from 'node:module';
-import { readFileMaybeEncrypted, writeFileAtomic, writeFileRestricted } from '../fs-secure.js';
+import { readFileMaybeEncrypted, writeDbImagePreservingFormat, writeFileRestricted } from '../fs-secure.js';
 import { restoreMemoryDbFromBackup } from '../services/memory-backup.js';
 import { validateIdentifier } from '../mcp-tools/validate-input.js';
 /**
@@ -1248,7 +1248,7 @@ export async function ensureSchemaColumns(dbPath, options = {}) {
             if (modified) {
                 // Save updated database
                 const data = db.export();
-                writeFileRestricted(dbPath, Buffer.from(data), { encrypt: options.encryptWrites ?? true });
+                writeDbImagePreservingFormat(dbPath, data, { encrypt: options.encryptWrites ?? true });
             }
             db.close();
             return { success: true, columnsAdded };
@@ -1975,7 +1975,7 @@ export async function applyTemporalDecay(dbPath) {
         return await withMemoryDbLock(path_, async () => {
             const initSqlJs = (await import('sql.js')).default;
             const SQL = await initSqlJs();
-            const fileBuffer = fs.readFileSync(path_);
+            const fileBuffer = readFileMaybeEncrypted(path_, null);
             const db = new SQL.Database(fileBuffer);
             // Apply decay: confidence *= exp(-decay_rate * days_since_last_use)
             const now = Date.now();
@@ -1992,7 +1992,7 @@ export async function applyTemporalDecay(dbPath) {
             const changes = db.getRowsModified();
             // Save (atomic — issue #2584: a torn full-image flush corrupts the store)
             const data = db.export();
-            writeFileAtomic(path_, Buffer.from(data));
+            writeDbImagePreservingFormat(path_, data);
             db.close();
             return {
                 success: true,
@@ -2692,7 +2692,7 @@ export async function storeEntry(options) {
             }
             // Save
             const data = db.export();
-            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
+            writeDbImagePreservingFormat(dbPath, data);
             db.close();
         });
         // Add to HNSW index for faster future searches
@@ -3019,7 +3019,7 @@ export async function listEntries(options) {
         // that predate the status column may have NULL after migration.
         // See memory-bridge.ts:bridgeListEntries for full context.
         // Get total count
-        const whereClauses = [liveMemoryRowSql()];
+        const whereClauses = [liveMemoryRowSql({ includeExpired: options.includeExpired })];
         const whereParams = [];
         if (namespace) {
             whereClauses.push('namespace = ?');
@@ -3044,7 +3044,7 @@ export async function listEntries(options) {
         const safeLimit = Math.min(parseInt(String(limit), 10) || 100, options.includeEmbedding ? MAX_LIST_EMBEDDINGS : Number.MAX_SAFE_INTEGER);
         const safeOffset = parseInt(String(offset), 10) || 0;
         // #2120 — same NULL-as-active acceptance as the count above.
-        const listStmt = db.prepare(`SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type
+        const listStmt = db.prepare(`SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type, expires_at
        FROM memory_entries WHERE ${whereSql}
        ORDER BY updated_at DESC LIMIT ? OFFSET ?`);
         listStmt.bind([...whereParams, safeLimit, safeOffset]);
@@ -3057,7 +3057,7 @@ export async function listEntries(options) {
         const entries = [];
         if (result[0]?.values) {
             for (const row of result[0].values) {
-                const [id, key, ns, content, embedding, accessCount, createdAt, updatedAt, provenanceTypeVal] = row;
+                const [id, key, ns, content, embedding, accessCount, createdAt, updatedAt, provenanceTypeVal, expiresAtVal] = row;
                 const entry = {
                     // #2073: don't truncate id when content is requested — callers
                     // (notably memory_export) need the full id to round-trip via import.
@@ -3068,6 +3068,7 @@ export async function listEntries(options) {
                     accessCount: accessCount || 0,
                     createdAt: createdAt || new Date().toISOString(),
                     updatedAt: updatedAt || new Date().toISOString(),
+                    expiresAt: expiresAtVal ?? null,
                     hasEmbedding: !!embedding && embedding.length > 10,
                     provenanceType: provenanceTypeVal || 'unknown'
                 };
@@ -3166,7 +3167,7 @@ export async function getEntry(options) {
       `, [String(id)]);
             // Save updated database
             const data = db.export();
-            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
+            writeDbImagePreservingFormat(dbPath, data);
             db.close();
             let tags = [];
             if (tagsJson) {
@@ -3302,7 +3303,7 @@ export async function deleteEntry(options) {
             const remainingEntries = countResult[0]?.values?.[0]?.[0] || 0;
             // Save updated database
             const data = db.export();
-            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: options.encryptWrites ?? true });
+            writeDbImagePreservingFormat(dbPath, data, { encrypt: options.encryptWrites ?? true });
             db.close();
             // Clean up in-memory HNSW index so ghost vectors don't appear in searches.
             // Remove the entry from the HNSW entries map and invalidate the index.
@@ -3472,7 +3473,7 @@ export async function purgeNamespace(options) {
             const countResult = db.exec(`SELECT COUNT(*) FROM memory_entries WHERE status = 'active'`);
             const remainingEntries = countResult[0]?.values?.[0]?.[0] || 0;
             const data = db.export();
-            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: options.encryptWrites ?? true });
+            writeDbImagePreservingFormat(dbPath, data, { encrypt: options.encryptWrites ?? true });
             db.close();
             if (deletedCount > 0 && hnswIndex?.entries) {
                 for (const [id, entry] of hnswIndex.entries) {

package/dist/src/mods/claude-installs.js

@@ -69,13 +69,17 @@ export function judgeInstalls(installs, enableEnvSet) {
         : '';
     const runs = `${first.path} (${first.version ?? 'version unknown'})`;
     if (!first.version)
-        return { status: 'warn', message: `claude resolves to ${runs}${mixed}` };
+        return { status: 'warn', message: `claude resolves to ${runs}${mixed}`, fix: `run \`${first.path} --version\` and reinstall Claude Code if it prints nothing` };
     if (!versionLess(first.version, MODS_DEFAULT_ON)) {
-        return { status: others.length ? 'warn' : 'pass', message: `claude resolves to ${runs}: mods on by default${mixed}` };
+        return others.length
+            ? { status: 'warn', message: `claude resolves to ${runs}: mods on by default${mixed}`, fix: `put the claude you want first on PATH, or remove: ${others.map((i) => i.path).join(' ')}` }
+            : { status: 'pass', message: `claude resolves to ${runs}: mods on by default` };
     }
     if (!versionLess(first.version, MODS_FIRST)) {
         return enableEnvSet
-            ? { status: others.length ? 'warn' : 'pass', message: `claude resolves to ${runs}: mods load with CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 (set)${mixed}` }
+            ? (others.length
+                ? { status: 'warn', message: `claude resolves to ${runs}: mods load with CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 (set)${mixed}`, fix: `put the claude you want first on PATH, or remove: ${others.map((i) => i.path).join(' ')}` }
+                : { status: 'pass', message: `claude resolves to ${runs}: mods load with CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 (set)` })
             : { status: 'warn', message: `claude resolves to ${runs}: below ${MODS_DEFAULT_ON}, mods need CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 (not set)${mixed}`, fix: `upgrade to >= ${MODS_DEFAULT_ON}, or export CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1` };
     }
     return { status: 'warn', message: `claude resolves to ${runs}: predates mods (< ${MODS_FIRST}); classic hooks handle every event${mixed}`, fix: `upgrade to >= ${MODS_DEFAULT_ON} and remove the stale install from PATH` };

package/dist/src/mods/install.js

@@ -107,18 +107,38 @@ export function installMod(projectRoot, scope, dryRun = false, plugins = MOD_PLU
         backup = `${settingsFile}.bak-ruflo-mods-${Date.now()}`;
         copyFileSync(settingsFile, backup);
     }
-    writeJson(settingsFile, next);
-    // What ruflo added once is still ruflo's to remove: merge into the record.
-    const record = readRecord(projectRoot) ?? { version: 2, installedAt: '', files: {} };
-    const before = record.files[settingsFile] ?? { plugins: [], marketplace: false, env: false };
-    record.files[settingsFile] = {
-        plugins: [...new Set([...before.plugins, ...added.plugins])],
-        marketplace: before.marketplace || added.marketplace,
-        env: before.env || added.env,
-        claudeInstalled: before.claudeInstalled ?? [],
-    };
-    record.installedAt = new Date().toISOString();
-    writeJson(join(resolve(projectRoot), INSTALL_RECORD), record);
+    // One operation: the settings and the record that lets uninstall take them back are written together.
+    // If the record cannot be written, the settings go back as they were (or the file ruflo created goes
+    // away), so nothing is left half-installed with no record to remove it by.
+    try {
+        writeJson(settingsFile, next);
+        // What ruflo added once is still ruflo's to remove: merge into the record.
+        const record = readRecord(projectRoot) ?? { version: 2, installedAt: '', files: {} };
+        const before = record.files[settingsFile] ?? { plugins: [], marketplace: false, env: false };
+        record.files[settingsFile] = {
+            plugins: [...new Set([...before.plugins, ...added.plugins])],
+            marketplace: before.marketplace || added.marketplace,
+            env: before.env || added.env,
+            claudeInstalled: before.claudeInstalled ?? [],
+        };
+        record.installedAt = new Date().toISOString();
+        writeJson(join(resolve(projectRoot), INSTALL_RECORD), record);
+    }
+    catch (error) {
+        try {
+            if (backup) {
+                copyFileSync(backup, settingsFile);
+                unlinkSync(backup);
+            }
+            else if (existsSync(settingsFile)) {
+                unlinkSync(settingsFile);
+            }
+        }
+        catch {
+            // the restore itself failed: the original error below is the one to report
+        }
+        throw error;
+    }
     return { settingsFile, backup, added, dryRun, next };
 }
 /** The install record, v1 (3.50.0: one file, ruflo-mods only) read as v2. */

package/dist/src/mods/plugin-resolve.js

@@ -160,7 +160,9 @@ export function resolveFindings(projectRoot, scope, configDir, fs = nodeReadFs,
         else if (!market.location) {
             findings.push(installed.installed
                 ? { name, status: 'pass', message: `installed (${installed.scope} scope, ${installed.installPath})` }
-                : { name, status: 'warn', message: plugin.required ? 'loads once Claude Code has cloned the marketplace' : 'pending: not released in the ruflo marketplace yet' });
+                : plugin.required
+                    ? { name, status: 'warn', message: 'loads once Claude Code has cloned the marketplace (a headless `claude -p` run on a fresh config does not clone it, so the mod is absent there)', fix }
+                    : { name, status: 'warn', message: 'pending: not released in the ruflo marketplace yet' });
         }
         else if (!plugin.required) {
             findings.push({ name, status: 'warn', message: `pending: not in the ruflo marketplace yet (${market.location})${also}` });

package/dist/src/mods/probe.js

@@ -8,8 +8,8 @@ import { existsSync, readFileSync } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { join, resolve } from 'node:path';
 import { findClaudeInstalls, judgeInstalls } from './claude-installs.js';
-import { ENABLE_ENV, MOD_PLUGIN_ID, MOD_PLUGIN_IDS, readRecord, readSettingsFile, settingsFileFor } from './install.js';
-import { claudeConfigDir, resolveFindings } from './plugin-resolve.js';
+import { ENABLE_ENV, MARKETPLACE_NAME, MOD_PLUGIN_ID, MOD_PLUGIN_IDS, readRecord, readSettingsFile, settingsFileFor } from './install.js';
+import { claudeConfigDir, installedState, resolveFindings } from './plugin-resolve.js';
 import { PROJECTION_RELATIVE } from './policy-projection.js';
 export const HANDSHAKE_MARKER = 'RUFLO_MODS_OWNS';
 export const HEARTBEAT_RELATIVE = join('.claude-flow', 'mods', 'session.json');
@@ -53,6 +53,65 @@ export function legacyCliHooks(files) {
         return commands(LEGACY_EVENTS[sub]).some((c) => word.test(c));
     });
 }
+/** Settings files (in the order given) where `enabledPlugins[id]` is exactly `value`. */
+function enabledValues(files, id) {
+    const out = new Map();
+    for (const f of files) {
+        try {
+            const v = get(readSettingsFile(f), 'enabledPlugins', id);
+            if (v !== undefined)
+                out.set(f, v);
+        }
+        catch {
+            // an unparseable file is reported elsewhere; never overwritten
+        }
+    }
+    return out;
+}
+function partialInstallFindings(root, files, _inputs) {
+    const enabled = new Set(MOD_PLUGIN_IDS.filter((id) => [...enabledValues(files, id).values()].includes(true)));
+    const out = [];
+    const parts = [];
+    if (enabled.size > 0 && enabled.size < MOD_PLUGIN_IDS.length) {
+        const missing = MOD_PLUGIN_IDS.filter((id) => !enabled.has(id) && ![...enabledValues(files, id).values()].includes(false));
+        if (missing.length)
+            parts.push(`enabled ${[...enabled].join(', ')} but not ${missing.join(', ')}`);
+    }
+    if (enabled.size > 0) {
+        const declared = files.some((f) => {
+            try {
+                return get(readSettingsFile(f), 'extraKnownMarketplaces', MARKETPLACE_NAME) !== undefined;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!declared)
+            parts.push(`no \`${MARKETPLACE_NAME}\` marketplace is declared in settings for Claude Code to load them from`);
+    }
+    const record = readRecord(root);
+    if (record) {
+        const lost = [];
+        for (const [file, added] of Object.entries(record.files)) {
+            try {
+                const now = readSettingsFile(file);
+                for (const id of added.plugins)
+                    if (get(now, 'enabledPlugins', id) !== true && get(now, 'enabledPlugins', id) !== false)
+                        lost.push(id);
+                if (added.marketplace && get(now, 'extraKnownMarketplaces', MARKETPLACE_NAME) === undefined)
+                    lost.push(`${MARKETPLACE_NAME} marketplace`);
+            }
+            catch {
+                // unreadable settings: nothing to compare
+            }
+        }
+        if (lost.length)
+            parts.push(`the install record says ruflo added ${[...new Set(lost)].join(', ')}, which the settings no longer have`);
+    }
+    if (parts.length)
+        out.push({ name: 'partial install', status: 'warn', message: parts.join('; '), fix: 'ruflo mods install' });
+    return out;
+}
 export function probeMods(inputs) {
     const root = resolve(inputs.projectRoot);
     const home = inputs.home ?? homedir();
@@ -69,9 +128,38 @@ export function probeMods(inputs) {
             return false;
         }
     });
+    // A plugin a person set to false is their decision: `ruflo mods install` never flips it, so it is not the repair.
+    const disabledIn = enabledIn ? undefined : files.find((f) => {
+        try {
+            return get(readSettingsFile(f), 'enabledPlugins', MOD_PLUGIN_ID) === false;
+        }
+        catch {
+            return false;
+        }
+    });
+    const cachedInstall = enabledIn || disabledIn ? { installed: false } : installedState(root, configDir, MOD_PLUGIN_ID, inputs.fs);
+    const scopeOf = (f) => (f === files[0] ? 'local' : f === files[1] ? 'project' : 'user');
     findings.push(enabledIn
         ? { name: 'ruflo-mods plugin', status: 'pass', message: `enabled in settings: ${enabledIn} (whether Claude Code can load it: see below)` }
-        : { name: 'ruflo-mods plugin', status: 'warn', message: 'not enabled; classic hooks handle every event', fix: 'ruflo mods install' });
+        : disabledIn
+            ? {
+                name: 'ruflo-mods plugin',
+                status: 'warn',
+                message: `disabled in ${disabledIn} (enabledPlugins is false): the mod does not load and classic hooks handle every event; \`ruflo mods install\` leaves a plugin you switched off alone`,
+                fix: `claude plugin enable ${MOD_PLUGIN_ID} --scope ${scopeOf(disabledIn)}`,
+            }
+            : cachedInstall.installed
+                ? {
+                    name: 'ruflo-mods plugin',
+                    status: 'warn',
+                    message: `installed (${cachedInstall.scope} scope) but not enabled in this project's settings: the mod does not load`,
+                    fix: `claude plugin enable ${MOD_PLUGIN_ID} --scope ${cachedInstall.scope === 'user' ? 'user' : 'local'}`,
+                }
+                : { name: 'ruflo-mods plugin', status: 'warn', message: 'not enabled; classic hooks handle every event', fix: 'ruflo mods install' });
+    // 1b. A half-finished install: some of the mod plugins enabled and not the rest, a plugin enabled with no
+    // marketplace declared for Claude Code to load it from, or keys the install record says ruflo added that
+    // the settings file no longer has. `ruflo mods install` is idempotent and adds exactly what is missing.
+    findings.push(...partialInstallFindings(root, files, inputs));
     // 1a. Enabled is a request; Claude Code silently skips a plugin its
     // marketplace clone does not carry (a clone older than the plugin).
     if (enabledIn) {
@@ -163,7 +251,7 @@ export function probeMods(inputs) {
     const owned = get(beat, 'owned');
     findings.push(typeof startedAt === 'string'
         ? { name: 'last mod start', status: 'pass', message: `${startedAt}, owning ${Array.isArray(owned) && owned.length ? owned.join(', ') : 'nothing'}` }
-        : { name: 'last mod start', status: enabledIn ? 'warn' : 'pass', message: 'the mod has not started in this project' + (enabledIn ? ' (restart Claude Code; check function hooks above)' : '') });
+        : { name: 'last mod start', status: enabledIn ? 'warn' : 'pass', message: 'the mod has not started in this project' + (enabledIn ? ' (restart Claude Code; check function hooks above)' : ''), ...(enabledIn ? { fix: 'restart Claude Code in this project, then run /ruflo mods' } : {}) });
     if (readRecord(root))
         findings.push({ name: 'install record', status: 'pass', message: join(root, '.claude-flow', 'mods', 'install.json') });
     return findings;

package/dist/src/services/command-recording.d.ts

@@ -0,0 +1,17 @@
+/** Longest command text kept per row. */
+export declare const MAX_RECORDED_COMMAND_CHARS = 2000;
+/**
+ * True when command recording is switched off. Any one of these turns it off:
+ *   - `CLAUDE_FLOW_HOOKS_RECORD_COMMANDS` = 0 | false | off | no
+ *   - `CLAUDE_FLOW_HOOKS_ENABLED`         = 0 | false | off | no
+ *   - `hooks.recordCommands: false` in `claude-flow.config.json` or `.claude-flow/config.json`
+ */
+export declare function commandRecordingDisabled(env?: Record<string, string | undefined>, cwd?: string): boolean;
+/**
+ * The form of a command that may be written to the store: secrets of the
+ * common shapes replaced with `[redacted]`, and the text capped at
+ * `MAX_RECORDED_COMMAND_CHARS`. This is best effort, not a guarantee; the off
+ * switch is the guarantee.
+ */
+export declare function redactCommandForStorage(command: string): string;
+//# sourceMappingURL=command-recording.d.ts.map

package/dist/src/services/command-recording.js

@@ -0,0 +1,91 @@
+/**
+ * Policy for what the PostToolUse Bash hook may keep (#4056).
+ *
+ * `hooks post-command` used to store every command in full as
+ * `commands/cmd-<ts>`: 27k rows / 285 MB on one project, full command text
+ * that can carry tokens, and no way to switch it off. This module answers two
+ * questions for that writer:
+ *
+ *   1. May a command be recorded at all?  (`commandRecordingDisabled`)
+ *   2. What form of it may be stored?     (`redactCommandForStorage`)
+ *
+ * Every pattern below is bounded, and the input is capped before any pattern
+ * runs, so a hostile command cannot stall the hook (the same lesson as the
+ * settings-risk scanner, #4053).
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/** Longest command text kept per row. */
+export const MAX_RECORDED_COMMAND_CHARS = 2000;
+/** Only this much of a command is ever scanned; the stored text is shorter still. */
+const MAX_SCANNED_CHARS = 8000;
+const OFF_VALUES = new Set(['0', 'false', 'off', 'no']);
+const isOff = (v) => v !== undefined && OFF_VALUES.has(v.trim().toLowerCase());
+function configDisablesRecording(cwd) {
+    for (const file of [
+        path.resolve(cwd, 'claude-flow.config.json'),
+        path.resolve(cwd, '.claude-flow', 'config.json'),
+    ]) {
+        try {
+            if (!fs.existsSync(file))
+                continue;
+            const raw = JSON.parse(fs.readFileSync(file, 'utf-8'));
+            if (raw?.hooks?.recordCommands === false)
+                return true;
+        }
+        catch {
+            /* malformed config: keep the default (recording on) rather than guess */
+        }
+    }
+    return false;
+}
+/**
+ * True when command recording is switched off. Any one of these turns it off:
+ *   - `CLAUDE_FLOW_HOOKS_RECORD_COMMANDS` = 0 | false | off | no
+ *   - `CLAUDE_FLOW_HOOKS_ENABLED`         = 0 | false | off | no
+ *   - `hooks.recordCommands: false` in `claude-flow.config.json` or `.claude-flow/config.json`
+ */
+export function commandRecordingDisabled(env = process.env, cwd = process.cwd()) {
+    if (isOff(env.CLAUDE_FLOW_HOOKS_RECORD_COMMANDS))
+        return true;
+    if (isOff(env.CLAUDE_FLOW_HOOKS_ENABLED))
+        return true;
+    return configDisablesRecording(cwd);
+}
+const QUOTED_OR_BARE = `"[^"]{0,512}"|'[^']{0,512}'|[^\\s"']{1,512}`;
+// Order matters little; each rule only ever shortens the text.
+const RULES = [
+    // Authorization: Bearer xyz   /   authorization=Basic xyz
+    [/(authorization["']?\s*[:=]\s*)(?:(?:bearer|basic|token)\s+)?[^\s"']{1,512}/gi, '$1[redacted]'],
+    // --password x / --token=x / --api-key "x" / -token x
+    [new RegExp(`(--?(?:password|passwd|pwd|token|secret|api[-_]?key|access[-_]?token|auth[-_]?token|client[-_]?secret)(?:=|\\s+))(?:${QUOTED_OR_BARE})`, 'gi'), '$1[redacted]'],
+    // NPM_TOKEN=x  AWS_SECRET_ACCESS_KEY=x  DB_PASSWORD=x
+    [new RegExp(`\\b([A-Za-z_][A-Za-z0-9_]{0,63}(?:TOKEN|SECRET|PASSWORD|PASSWD|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|CREDENTIALS?))=(?:${QUOTED_OR_BARE})`, 'gi'), '$1=[redacted]'],
+    // user:password@host in a URL
+    [/(:\/\/[^\s:@/]{1,128}:)[^\s@/]{1,256}(@)/g, '$1[redacted]$2'],
+    // well-known token shapes
+    [/\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|npm_[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})/g, '[redacted]'],
+];
+/**
+ * The form of a command that may be written to the store: secrets of the
+ * common shapes replaced with `[redacted]`, and the text capped at
+ * `MAX_RECORDED_COMMAND_CHARS`. This is best effort, not a guarantee; the off
+ * switch is the guarantee.
+ */
+export function redactCommandForStorage(command) {
+    let text = String(command);
+    if (text.length > MAX_SCANNED_CHARS) {
+        // Cut at a token boundary so a half-token at the cut is not left behind.
+        const cut = text.slice(0, MAX_SCANNED_CHARS);
+        const lastSpace = cut.search(/\s\S*$/);
+        text = lastSpace > 0 ? cut.slice(0, lastSpace) : cut;
+        text += ' ';
+    }
+    for (const [re, replacement] of RULES)
+        text = text.replace(re, replacement);
+    if (text.length > MAX_RECORDED_COMMAND_CHARS) {
+        text = `${text.slice(0, MAX_RECORDED_COMMAND_CHARS)} …[truncated]`;
+    }
+    return text.trimEnd();
+}
+//# sourceMappingURL=command-recording.js.map

package/dist/src/services/policy-ledger-anchor.js

@@ -14,10 +14,28 @@
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
-import { homedir } from 'node:os';
+import { homedir, userInfo } from 'node:os';
 const LOG_FILE = 'ledger-anchors.json';
 const MIRROR_FILE = 'ledger-anchor-head.json';
 export const anchorLogPath = (projectRoot) => join(resolve(projectRoot), '.claude-flow', 'policy', LOG_FILE);
+/**
+ * The home directory trust material lives under: $HOME when it is an absolute path, else the account's home. An empty or relative
+ * $HOME (an unset variable in a wrapper script, `HOME=. cmd`) would make join() yield a path relative to the working directory and
+ * drop the HMAC key and anchor mirror into the project; that is never wanted, so it falls back to the account home or refuses.
+ */
+function trustHome() {
+    const home = homedir();
+    if (home && isAbsolute(home))
+        return home;
+    let account = '';
+    try {
+        account = userInfo().homedir;
+    }
+    catch { /* no account entry for this uid */ }
+    if (account && isAbsolute(account))
+        return account;
+    throw new Error('policy-trust-home-unresolved: $HOME is empty or relative and this account has no home directory; set HOME to an absolute path');
+}
 /**
  * Directory holding per-project trust material (anchor mirror, HMAC key).
  * Resolved from the environment at call time (#3919): $XDG_CONFIG_HOME when it
@@ -26,7 +44,7 @@ export const anchorLogPath = (projectRoot) => join(resolve(projectRoot), '.claud
  * user who already has trust state under the legacy ~/.config keeps using it.
  */
 export function policyTrustRoot() {
-    const legacy = join(homedir(), '.config', 'ruflo', 'policy-trust');
+    const legacy = join(trustHome(), '.config', 'ruflo', 'policy-trust');
     const xdg = process.env.XDG_CONFIG_HOME;
     if (!xdg || !isAbsolute(xdg))
         return legacy;

package/node_modules/@claude-flow/codex/README.md

@@ -751,19 +751,36 @@ enabled = true
 
 ### .codex/config.toml (Local Overrides)
 
+`init` creates this gitignored file with **standard** trust by default:
+
 ```toml
 # Local development overrides (gitignored)
 # These settings override .agents/config.toml
 
-approval_policy = "never"
-sandbox_mode = "danger-full-access"
-web_search = "live"
+approval_policy = "on-request"
+sandbox_mode = "workspace-write"
+web_search = "cached"
 
 # Disable MCP in local if needed
 [mcp_servers.claude-flow]
 enabled = false
 ```
 
+Codex can then write inside the workspace only and asks before anything riskier.
+Opt in to the old permissive file (`approval_policy = "never"`,
+`sandbox_mode = "danger-full-access"`, `web_search = "live"`) explicitly:
+
+```bash
+npx ruflo@latest init --dual --codex-trust full     # or: RUFLO_CODEX_TRUST=full
+npx @claude-flow/codex init --codex-trust full
+```
+
+`init` prints which level you got. An existing `.codex/config.toml` is never
+rewritten, not even with `--force` (it holds your own sandbox and approval
+choices), so to change the level of an existing file edit those three keys.
+Unknown `--codex-trust` values are rejected on the command line and fall back to
+`standard` (with a warning) from the environment variable.
+
 ### Environment Variables
 
 ```bash

package/node_modules/@claude-flow/codex/dist/cli.js

@@ -75,6 +75,7 @@ program
     .option('-s, --skills <skills>', 'Comma-separated list of skills to include')
     .option('-f, --force', 'Overwrite existing files', false)
     .option('--dual', 'Generate both Codex and Claude Code configurations', false)
+    .option('--codex-trust <level>', 'Trust level of the generated .codex/config.toml: standard (default: workspace-write sandbox, on-request approvals) or full (danger-full-access, no approvals)')
     .option('-p, --path <path>', 'Project path', process.cwd())
     .option('-q, --quiet', 'Suppress verbose output', false)
     .action(async (options) => {
@@ -82,6 +83,11 @@ program
         if (!options.quiet) {
             printBanner();
         }
+        if (options.codexTrust !== undefined && !['standard', 'full'].includes(options.codexTrust)) {
+            console.error(chalk.red(`Invalid --codex-trust: ${options.codexTrust}`));
+            console.log(chalk.gray('Valid levels: standard, full'));
+            process.exit(1);
+        }
         // Validate template
         const validTemplates = ['minimal', 'default', 'full', 'enterprise'];
         if (!validTemplates.includes(options.template)) {
@@ -120,6 +126,7 @@ program
             skills,
             force: options.force,
             dual: options.dual,
+            codexTrust: options.codexTrust,
         });
         if (result.success) {
             console.log(chalk.green.bold('\n  Project initialized successfully!'));