@claude-flow/cli 3.56.8 → 3.56.10

package/dist/src/commands/security.js

@@ -155,6 +155,7 @@ const scanCommand = {
             spinner.start();
         const findings = [];
         let criticalCount = 0, highCount = 0, mediumCount = 0, lowCount = 0;
+        let depsSkipped;
         try {
             const fs = await import('fs');
             const path = await import('path');
@@ -178,35 +179,41 @@ const scanCommand = {
                             // npm audit exits non-zero when vulnerabilities found — stdout still has JSON
                             auditResult = (auditErr instanceof Error && 'stdout' in auditErr ? auditErr.stdout : undefined) || '{}';
                         }
-                        try {
-                            const audit = JSON.parse(auditResult);
-                            if (audit.vulnerabilities) {
-                                for (const [pkg, vuln] of Object.entries(audit.vulnerabilities)) {
-                                    const sev = vuln.severity || 'low';
-                                    const title = Array.isArray(vuln.via) && vuln.via[0]?.title ? vuln.via[0].title : 'Vulnerability';
-                                    if (sev === 'critical')
-                                        criticalCount++;
-                                    else if (sev === 'high')
-                                        highCount++;
-                                    else if (sev === 'moderate' || sev === 'medium')
-                                        mediumCount++;
-                                    else
-                                        lowCount++;
-                                    findings.push({
-                                        severity: sev === 'critical' ? 'critical' :
-                                            sev === 'high' ? 'high' :
-                                                sev === 'moderate' || sev === 'medium' ? 'medium' : 'low',
-                                        type: 'Dependency CVE',
-                                        location: `package.json:${pkg}`,
-                                        description: title.substring(0, 35),
-                                    });
-                                }
+                        const audit = interpretNpmAudit(auditResult, path.resolve(target));
+                        if (!audit.ok) {
+                            depsSkipped = audit.reason;
+                        }
+                        else {
+                            for (const [pkg, vuln] of Object.entries(audit.vulnerabilities)) {
+                                const sev = vuln.severity || 'low';
+                                const first = Array.isArray(vuln.via) ? vuln.via[0] : undefined;
+                                const title = typeof first === 'object' && first?.title ? first.title : 'Vulnerability';
+                                if (sev === 'critical')
+                                    criticalCount++;
+                                else if (sev === 'high')
+                                    highCount++;
+                                else if (sev === 'moderate' || sev === 'medium')
+                                    mediumCount++;
+                                else
+                                    lowCount++;
+                                findings.push({
+                                    severity: sev === 'critical' ? 'critical' :
+                                        sev === 'high' ? 'high' :
+                                            sev === 'moderate' || sev === 'medium' ? 'medium' : 'low',
+                                    type: 'Dependency CVE',
+                                    location: `package.json:${pkg}`,
+                                    description: title.substring(0, 35),
+                                });
                             }
                         }
-                        catch { /* JSON parse failed, no vulns */ }
                     }
+                    else {
+                        depsSkipped = 'No package.json found in the scan target; dependency scan could not run.';
+                    }
+                }
+                catch (err) {
+                    depsSkipped = `npm audit could not run: ${err instanceof Error ? err.message : String(err)}`;
                 }
-                catch { /* npm audit failed */ }
             }
             // Phase 2: Scan for hardcoded secrets
             if (scanType === 'all' || scanType === 'code') {
@@ -342,9 +349,14 @@ const scanCommand = {
                         output.writeln(output.dim(`... and ${findings.length - 20} more issues`));
                     }
                 }
+                else if (depsSkipped) {
+                    output.writeln(output.warning('No issues found by the checks that ran, but the dependency scan did not run.'));
+                }
                 else {
                     output.writeln(output.success('No security issues found!'));
                 }
+                if (depsSkipped)
+                    output.writeln(output.warning(`Dependency scan skipped: ${depsSkipped}`));
                 output.writeln();
                 output.printBox([
                     `Target: ${target}`,
@@ -367,6 +379,7 @@ const scanCommand = {
                     low: lowCount,
                     total: findings.length,
                 },
+                ...(depsSkipped ? { incomplete: true, skipped: { deps: depsSkipped } } : {}),
                 findings,
             };
             // Persist the scan result so downstream consumers (the statusline's
@@ -408,6 +421,11 @@ const scanCommand = {
                 output.printJson(record);
             else if (outputFormat === 'sarif')
                 output.printJson(scanSarif(findings));
+            if (depsSkipped) {
+                if (outputFormat !== 'text')
+                    output.printError(`Dependency scan skipped: ${depsSkipped}`);
+                return { success: false, exitCode: 2 };
+            }
             return { success: findings.length === 0 || (criticalCount === 0 && highCount === 0) };
         }
         catch (error) {
@@ -418,6 +436,36 @@ const scanCommand = {
         }
     },
 };
+export function interpretNpmAudit(raw, dir) {
+    let audit;
+    try {
+        audit = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, reason: 'npm audit did not return a JSON report.' };
+    }
+    if (audit && typeof audit === 'object' && audit.error) {
+        const code = typeof audit.error.code === 'string' ? audit.error.code : 'error';
+        const summary = typeof audit.error.summary === 'string' ? audit.error.summary : 'npm audit failed.';
+        return { ok: false, reason: `npm audit failed (${code}): ${summary}${code === 'ENOLOCK' ? auditHint(dir) : ''}` };
+    }
+    if (!audit || typeof audit !== 'object' || !audit.vulnerabilities || typeof audit.vulnerabilities !== 'object' || Array.isArray(audit.vulnerabilities)) {
+        return { ok: false, reason: 'npm audit returned no vulnerability report.' };
+    }
+    return { ok: true, vulnerabilities: audit.vulnerabilities };
+}
+function auditHint(dir) {
+    if (!dir)
+        return '';
+    const has = (f) => existsSync(resolvePath(dir, f));
+    if (has('pnpm-lock.yaml'))
+        return ' This is a pnpm project: run `pnpm audit` instead.';
+    if (has('yarn.lock'))
+        return ' This is a yarn project: run `yarn npm audit` (Berry) or `yarn audit` (v1) instead.';
+    if (has('bun.lock') || has('bun.lockb'))
+        return ' This is a bun project: run `bun audit` instead.';
+    return ' Create one with `npm i --package-lock-only`, or use your package manager\'s audit.';
+}
 // CVE subcommand
 const cveCommand = {
     name: 'cve',
@@ -451,22 +499,20 @@ const cveCommand = {
             // npm audit exits non-zero when vulnerabilities found — stdout still has JSON
             auditJson = (e instanceof Error && 'stdout' in e ? e.stdout : '') || '{}';
         }
-        let audit;
-        try {
-            audit = JSON.parse(auditJson);
-        }
-        catch {
-            output.writeln(output.warning('⚠ Could not parse `npm audit --json` output.'));
-            output.writeln(output.dim('Make sure you are inside a project with a package.json.'));
+        const audit = interpretNpmAudit(auditJson, process.cwd());
+        if (!audit.ok) {
+            output.writeln(output.warning(`⚠ Could not check dependencies: ${audit.reason}`));
+            output.writeln(output.dim('No result is reported rather than a false all-clear.'));
             return { success: false, exitCode: 2 };
         }
-        const vulns = audit.vulnerabilities || {};
+        const vulns = audit.vulnerabilities;
         const cveRows = [];
         const CVE_RE = /CVE-\d{4}-\d{4,7}/g;
         for (const [pkg, v] of Object.entries(vulns)) {
             const sev = v.severity || 'low';
-            const titles = (v.via || []).filter((x) => typeof x === 'object' && x?.title).map((x) => x.title);
-            const urls = (v.via || []).filter((x) => typeof x === 'object' && x?.url).map((x) => x.url);
+            const via = (v.via || []).filter((x) => typeof x === 'object' && x !== null);
+            const titles = via.filter((x) => x.title).map((x) => x.title);
+            const urls = via.filter((x) => x.url).map((x) => x.url);
             const allText = `${titles.join(' ')} ${urls.join(' ')}`;
             const cveIds = Array.from(new Set(allText.match(CVE_RE) || []));
             cveRows.push({ pkg, severity: sev, cveIds, title: titles[0] || 'Vulnerability', url: urls[0] });

package/dist/src/commands/tui.d.ts

@@ -1,6 +1,15 @@
 import type { Command } from '../types.js';
 /** `<own install>/plugins/ruflo-console/dist/tui.mjs`, the first that exists. */
 export declare function locateTuiBundle(startDir?: string): string | null;
+/** The look and motion flags: `--look bbs|orbital|plain` (default bbs, as in the console), `--fps N` (0-30, default 8; 0 draws pictures still), `--no-anim`, `--no-pictures`. A bad value is ignored, never passed on. */
+export declare function lookFlags(flags: Record<string, unknown> | undefined): {
+    look?: string;
+    fps?: number;
+    anim?: boolean;
+    pictures?: boolean;
+    boot?: boolean;
+    mouse?: boolean;
+};
 /** The AI page's settings from the flags (and one environment variable for the endpoint list). Absent flags leave the defaults; a bad number is ignored, never passed on. */
 export declare function aiPage(flags: Record<string, unknown> | undefined): {
     model?: string;

package/dist/src/commands/tui.js

@@ -34,6 +34,20 @@ function cliEntry() {
     const entry = join(__dirname, '..', '..', '..', 'bin', 'cli.js');
     return existsSync(entry) ? entry : undefined;
 }
+/** The look and motion flags: `--look bbs|orbital|plain` (default bbs, as in the console), `--fps N` (0-30, default 8; 0 draws pictures still), `--no-anim`, `--no-pictures`. A bad value is ignored, never passed on. */
+export function lookFlags(flags) {
+    const look = flags?.look;
+    const fps = flags?.fps;
+    const number = typeof fps === 'number' ? fps : typeof fps === 'string' && /^\d{1,2}$/.test(fps) ? Number(fps) : undefined;
+    return {
+        ...(look === 'bbs' || look === 'orbital' || look === 'plain' ? { look } : {}),
+        ...(number !== undefined && Number.isFinite(number) && number >= 0 && number <= 30 ? { fps: Math.floor(number) } : {}),
+        ...(flags?.anim === false ? { anim: false } : {}),
+        ...(flags?.pictures === false ? { pictures: false } : {}),
+        ...(flags?.boot === true ? { boot: true } : {}),
+        ...(flags?.mouse === true ? { mouse: true } : {}),
+    };
+}
 /** The AI page's settings from the flags (and one environment variable for the endpoint list). Absent flags leave the defaults; a bad number is ignored, never passed on. */
 export function aiPage(flags) {
     const model = typeof flags?.model === 'string' && flags.model !== '' ? flags.model : undefined;
@@ -46,11 +60,17 @@ export const tuiCommand = {
     name: 'tui',
     description: 'The ruflo console in your terminal: Overview, Cost, Swarm, Events, Missions (read-only) and an AI page that asks Codex or OpenRouter, each question after a card.',
     options: [
-        { name: 'view', description: `Page to open: ${VIEWS.join(' | ')}`, type: 'string', default: 'overview' },
+        { name: 'view', description: `Page to open: ${VIEWS.join(' | ')}, or any console view (menu, federation, settings, ...): 0 opens the menu and : goes to a page by name`, type: 'string', default: 'overview' },
         { name: 'ai', description: 'The AI page (ask Codex read-only or OpenRouter, each question after a confirm card). --no-ai turns it off', type: 'boolean', default: true },
         { name: 'model', description: 'OpenRouter model for this session (default openrouter/auto)', type: 'string' },
         { name: 'max-spend-usd', description: 'Stop sending to OpenRouter once the provider-reported spend reaches this (default 0.5)', type: 'number' },
         { name: 'convo-targets', description: 'Extra OpenAI-compatible endpoints, the console convoTargets syntax: endpoint:<name>=<https-base-url>|<KEY_ENV>|<model>;... (a key is named by its environment variable). Also RUFLO_TUI_CONVO_TARGETS', type: 'string' },
+        { name: 'look', description: 'The console look: bbs (default, as in Claude Code) | orbital | plain. Key t cycles them', type: 'string' },
+        { name: 'fps', description: 'Frames per second for moving pictures, 0-30 (default 8; 0 draws every picture still)', type: 'number' },
+        { name: 'anim', description: 'Animate the pictures. --no-anim draws them still', type: 'boolean', default: true },
+        { name: 'pictures', description: 'Draw the pictures of the console (title art, swarm graph, gauges). --no-pictures shows their words only', type: 'boolean', default: true },
+        { name: 'mouse', description: 'Read mouse reports: click a page in the bar, scroll with the wheel (every action also has a key)', type: 'boolean', default: false },
+        { name: 'boot', description: 'Play the look\'s start-up screen first (as the console\'s boot setting)', type: 'boolean', default: false },
         { name: 'plain', description: 'Print one frame as plain text and exit 0 (scripts and CI). Without it, a non-terminal gets a hint and exit 2', type: 'boolean', default: false },
     ],
     examples: [
@@ -62,7 +82,9 @@ export const tuiCommand = {
     async action(context) {
         const ctx = context;
         const wanted = ctx.flags?.view ?? ctx.args?.find(arg => !arg.startsWith('-')) ?? 'overview';
-        if (!VIEWS.includes(wanted)) {
+        // The six pages are known here; any other console view (menu, federation, settings, …) is checked against the bundle's own list once it is loaded.
+        const isKnown = VIEWS.includes(wanted);
+        if (!isKnown && !/^[a-z]{2,16}$/.test(wanted)) {
             output.writeln(output.error(`tui: unknown view "${String(wanted).slice(0, 40)}". Use one of: ${VIEWS.join(', ')}`));
             return { success: false, exitCode: 2, data: { error: 'unknown-view' } };
         }
@@ -80,12 +102,16 @@ export const tuiCommand = {
             output.writeln(output.error(`tui: could not load the console bundle: ${error instanceof Error ? error.message.slice(0, 160) : 'unknown error'}`));
             return { success: false, exitCode: 1, data: { error: 'bundle-load-failed' } };
         }
+        if (!isKnown && mod.isPage?.(wanted) !== true) {
+            output.writeln(output.error(`tui: unknown view "${String(wanted).slice(0, 40)}". Use one of: ${VIEWS.join(', ')}, or any console view such as menu, federation, settings`));
+            return { success: false, exitCode: 2, data: { error: 'unknown-view' } };
+        }
         const stop = new AbortController();
         const onSignal = () => stop.abort();
         process.once('SIGTERM', onSignal);
         process.once('SIGHUP', onSignal);
         try {
-            const code = await mod.runTui({ cwd: ctx.cwd ?? process.cwd(), view: wanted, ...(ctx.flags?.plain === true && { plain: true }), ...(ctx.flags?.ai !== false && { aiPage: aiPage(ctx.flags) }), ...(cliEntry() !== undefined && { cliEntry: cliEntry() }), ...(process.env.CLAUDE_CONFIG_DIR !== undefined && { configDir: process.env.CLAUDE_CONFIG_DIR }) }, { stdin: process.stdin, stdout: process.stdout, stderr: process.stderr, env: process.env, signal: stop.signal });
+            const code = await mod.runTui({ cwd: ctx.cwd ?? process.cwd(), view: wanted, ...lookFlags(ctx.flags), ...(ctx.flags?.plain === true && { plain: true }), ...(ctx.flags?.ai !== false && { aiPage: aiPage(ctx.flags) }), ...(cliEntry() !== undefined && { cliEntry: cliEntry() }), ...(process.env.CLAUDE_CONFIG_DIR !== undefined && { configDir: process.env.CLAUDE_CONFIG_DIR }) }, { stdin: process.stdin, stdout: process.stdout, stderr: process.stderr, env: process.env, signal: stop.signal });
             return { success: code === 0, exitCode: code };
         }
         finally {

package/dist/src/config/proven-config-refresh.d.ts

@@ -15,6 +15,15 @@ export declare const ADOPTED_CONFIG_FILE = "proven-config.json";
 export declare function loadShippedChampion(srcPath: string): SignedProvenConfig | null;
 /** Build the local environment the champion's constraints are checked against. */
 export declare function currentInstallEnv(cwd?: string): InstallEnv;
+/**
+ * #4176: is `cwd` a ruflo project? A bare `.claude/` is not enough: Claude Code
+ * itself creates `.claude/.cc-writes/` in whatever directory a Bash command ran
+ * in, so every subdirectory a session cd-ed into used to qualify and received a
+ * proven-config.json. A ruflo project carries `ruflo init`'s own markers: a
+ * `.claude/settings.json`, the `.claude/helpers/` directory, or an earlier
+ * adoption stamp.
+ */
+export declare function isRufloProject(cwd: string): boolean;
 export interface AdoptResult {
     adopted: boolean;
     from?: string;

package/dist/src/config/proven-config-refresh.js

@@ -84,6 +84,27 @@ export function currentInstallEnv(cwd = process.cwd()) {
     catch { /* none */ }
     return env;
 }
+/**
+ * #4176: is `cwd` a ruflo project? A bare `.claude/` is not enough: Claude Code
+ * itself creates `.claude/.cc-writes/` in whatever directory a Bash command ran
+ * in, so every subdirectory a session cd-ed into used to qualify and received a
+ * proven-config.json. A ruflo project carries `ruflo init`'s own markers: a
+ * `.claude/settings.json`, the `.claude/helpers/` directory, or an earlier
+ * adoption stamp.
+ */
+export function isRufloProject(cwd) {
+    try {
+        const claudeDir = path.join(cwd, '.claude');
+        if (!fs.statSync(claudeDir).isDirectory())
+            return false;
+        return fs.existsSync(path.join(claudeDir, 'settings.json'))
+            || fs.existsSync(path.join(claudeDir, 'helpers'))
+            || fs.existsSync(path.join(claudeDir, PROVEN_CONFIG_STAMP));
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * The testable adoption core: given a signed champion and the local env, adopt
  * it into `cwd/.claude` iff it is newer than the stamp AND passes both gates.
@@ -92,8 +113,8 @@ export function currentInstallEnv(cwd = process.cwd()) {
 export function adoptSignedConfig(cwd, signed, env, opts = {}) {
     try {
         const claudeDir = path.join(cwd, '.claude');
-        if (!fs.existsSync(claudeDir))
-            return { adopted: false }; // not a ruflo project
+        if (!isRufloProject(cwd))
+            return { adopted: false }; // not a ruflo project (#4176)
         const championId = signed.manifest?.policy?.ref;
         if (!championId)
             return { adopted: false, skipped: 'manifest missing policy.ref' };
@@ -137,7 +158,7 @@ export function adoptSignedConfig(cwd, signed, env, opts = {}) {
  */
 export async function autoAdoptProvenConfigIfStale(cwd = process.cwd()) {
     try {
-        if (!fs.existsSync(path.join(cwd, '.claude')))
+        if (!isRufloProject(cwd))
             return { adopted: false };
         const src = findPackageProvenConfig();
         if (!src)

package/dist/src/funnel/local-signals.js

@@ -34,7 +34,8 @@ export function getSecurityStatus(cwd = process.cwd()) {
         const rawFindings = scan.summary?.total ?? scan.totalFindings ?? scan.findings?.length ?? 0;
         const findings = Math.max(0, Number.isFinite(rawFindings) ? rawFindings : 0);
         return {
-            status: findings > 0 ? 'ISSUES' : 'CLEAN',
+            // #4124: a scan whose dependency phase could not run is not a clean scan.
+            status: findings > 0 ? 'ISSUES' : scan.incomplete === true ? 'PENDING' : 'CLEAN',
             findings,
             scannedAt: typeof scan.timestamp === 'string' ? scan.timestamp : undefined,
             cvesFixed: 0,

package/dist/src/index.js

@@ -16,6 +16,7 @@ import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { commandParser } from './parser.js';
 import { output } from './output.js';
+import { resolveTargetCommand } from './command-resolution.js';
 import { commands, getCommandsByCategory, getCommand, getCommandAsync, getCommandNames, getLazyCommandNames, hasCommand } from './commands/index.js';
 import { suggestCommand } from './suggest.js';
 import { runStartupUpdateCheck } from './update/index.js';
@@ -264,48 +265,11 @@ export class CLI {
                 this.output.writeln(this.output.dim(`  ${message}`));
                 process.exit(1);
             }
-            // Handle subcommand (supports nested subcommands)
-            let targetCommand = command;
-            let subcommandArgs = positional;
-            // Process command path (e.g., ['hooks', 'worker', 'list'])
-            // Note: When parser includes subcommand in commandPath, positional already excludes it
-            if (commandPath.length > 1 && command.subcommands) {
-                const subcommandName = commandPath[1];
-                const subcommand = command.subcommands.find(sc => sc.name === subcommandName || sc.aliases?.includes(subcommandName));
-                if (subcommand) {
-                    targetCommand = subcommand;
-                    // Parser already extracted subcommand from positional, so use as-is
-                    subcommandArgs = positional;
-                    // Check for nested subcommand (level 2)
-                    if (commandPath.length > 2 && subcommand.subcommands) {
-                        const nestedName = commandPath[2];
-                        const nestedSubcommand = subcommand.subcommands.find(sc => sc.name === nestedName || sc.aliases?.includes(nestedName));
-                        if (nestedSubcommand) {
-                            targetCommand = nestedSubcommand;
-                            // Parser already extracted nested subcommand too
-                            subcommandArgs = positional;
-                        }
-                    }
-                }
-            }
-            else if (positional.length > 0 && command.subcommands) {
-                // Check if first positional is a subcommand
-                const subcommandName = positional[0];
-                const subcommand = command.subcommands.find(sc => sc.name === subcommandName || sc.aliases?.includes(subcommandName));
-                if (subcommand) {
-                    targetCommand = subcommand;
-                    subcommandArgs = positional.slice(1);
-                    // Check for nested subcommand (level 2 from positional)
-                    if (subcommandArgs.length > 0 && subcommand.subcommands) {
-                        const nestedName = subcommandArgs[0];
-                        const nestedSubcommand = subcommand.subcommands.find(sc => sc.name === nestedName || sc.aliases?.includes(nestedName));
-                        if (nestedSubcommand) {
-                            targetCommand = nestedSubcommand;
-                            subcommandArgs = subcommandArgs.slice(1);
-                        }
-                    }
-                }
-            }
+            // Handle subcommands at any depth (#4157): walk the parsed command path, or the
+            // positional arguments when the path only names the top-level command.
+            const resolved = resolveTargetCommand(command, commandPath, positional);
+            const targetCommand = resolved.target;
+            const subcommandArgs = resolved.args;
             // Validate flags
             const validationErrors = this.parser.validateFlags(flags, targetCommand);
             if (validationErrors.length > 0) {

package/dist/src/init/helpers-generator.js

@@ -478,7 +478,8 @@ module.exports = commands;
 }
 // Literal-word root guard mirrored in the mod and both shipped classic helpers.
 const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, depth = 0) {
-  let word = '', quote = '', started = false, redirect = false
+  // mask has one letter per character of word: 'u' unquoted, 'q' quoted or escaped (only unquoted braces expand).
+  let word = '', mask = '', quote = '', started = false, redirect = false
   let ansiNul = false // a NUL inside $'...' ends that string, as in bash
   let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
   const isRoot = (operand) => {
@@ -508,23 +509,92 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     if (c === 'c' && at + 1 < s.length) return [String.fromCharCode(s.charCodeAt(at + 1) & 31), at + 1]
     return ['\\' + c, at]
   }
-  const finishWord = () => {
-    if (!started) return false
-    // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
-    // Bound rescanning to four levels; beyond that retain its conservative check.
-    if (/[\s;&|()\x60]/.test(word)) {
-      if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
+  // Past the rescan bound (or the brace budget), a string is judged by its tokens: an rm and a possible root operand
+  // anywhere in it deny. Quote characters are dropped first, so r"m" is still rm; a path token with braces may expand to /.
+  const looseRootDelete = (text) => {
+    const tokens = text.replace(/["'\\]/g, '').split(/[\s;&|()\x60$]+/)
+    return tokens.some(t => t === 'rm' || t.endsWith('/rm')) && tokens.some(t => isRoot(t) || (t.includes('/') && /[{}]/.test(t)))
+  }
+  // Bash brace expansion of one word ({a,b} lists, nested or glued to text), and nothing else: no {1..3} sequences, and
+  // nothing inside parameter braces after a dollar sign. Only unquoted braces and commas count. Iterative and bounded:
+  // past BRACE_WORDS words or BRACE_CHARS characters of work in this call it returns undefined.
+  const BRACE_WORDS = 4096
+  let braceChars = 1_000_000
+  // The leftmost expandable group: an unquoted {...} with an unquoted comma at its own level, outside any dollar-brace parameter. One pass.
+  const firstGroup = (text, marks) => {
+    const stack = []
+    let dollars = 0
+    let best
+    for (let k = 0; k < text.length; k++) {
+      if (marks[k] !== 'u') continue
+      const c = text[k]
+      if (c === '{') {
+        const dollar = k > 0 && text[k - 1] === '$' && marks[k - 1] === 'u'
+        if (dollar) dollars++
+        stack.push({ open: k, commas: [], dollar: dollar || dollars > 0 })
+      } else if (c === ',' && stack.length > 0) stack[stack.length - 1].commas.push(k)
+      else if (c === '}' && stack.length > 0) {
+        const top = stack.pop()
+        if (top.dollar && text[top.open - 1] === '$' && marks[top.open - 1] === 'u') dollars--
+        if (!top.dollar && top.commas.length > 0 && (best === undefined || top.open < best[0])) best = [top.open, top.commas, k]
+      }
+    }
+    return best
+  }
+  const braceExpand = (text, marks) => {
+    const out = []
+    const todo = [[text, marks]]
+    while (todo.length > 0) {
+      const [t, m] = todo.pop()
+      if ((braceChars -= t.length) < 0) return undefined
+      const group = firstGroup(t, m)
+      if (group === undefined) {
+        out.push(t)
+        if (out.length > BRACE_WORDS) return undefined
+        continue
+      }
+      const [open, commas, close] = group
+      const cuts = [open, ...commas, close]
+      // Pushed in reverse, so the words come out in bash's left-to-right order.
+      for (let c = cuts.length - 2; c >= 0; c--) {
+        const from = cuts[c] + 1, to = cuts[c + 1]
+        todo.push([t.slice(0, open) + t.slice(from, to) + t.slice(close + 1), m.slice(0, open) + m.slice(from, to) + m.slice(close + 1)])
+      }
+      if (todo.length > BRACE_WORDS) return undefined
     }
-    if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
-    else if (!optionsEnded && word === '--') optionsEnded = true
-    else if (!optionsEnded && word.startsWith('-')) {
+    return out
+  }
+  const takeWord = (w) => {
+    if (!inRm) inRm = w === 'rm' || w.endsWith('/rm')
+    else if (!optionsEnded && w === '--') optionsEnded = true
+    else if (!optionsEnded && w.startsWith('-')) {
       // GNU getopt accepts any unambiguous long-option prefix: --r, --recur, --forc.
-      recursive = recursive || (word.length > 2 && '--recursive'.startsWith(word)) || /^-[a-z]*r[a-z]*$/.test(word)
-      force = force || (word.length > 2 && '--force'.startsWith(word)) || /^-[a-z]*f[a-z]*$/.test(word)
-    } else root = root || isRoot(word)
-    word = ''; started = false
+      recursive = recursive || (w.length > 2 && '--recursive'.startsWith(w)) || (/^-[a-z]*$/.test(w) && w.includes('r'))
+      force = force || (w.length > 2 && '--force'.startsWith(w)) || (/^-[a-z]*$/.test(w) && w.includes('f'))
+    } else root = root || isRoot(w)
     return inRm && recursive && force && root
   }
+  const finishWord = () => {
+    if (!started) return false
+    const text = word, marks = mask
+    word = ''; mask = ''; started = false
+    // Literal shell strings (e.g. sh -c 'rm -rf /', or sh -c '{rm,-rf,/}') also carried the old guard.
+    // Bound rescanning to four levels; beyond that judge the string by its tokens.
+    if (/[\s;&|()\x60{]/.test(text)) {
+      if (depth < 4 ? hasRootDelete(text, depth + 1) : looseRootDelete(text)) return true
+    }
+    // An unquoted {a,b} becomes separate words, as bash expands it: rm -rf {/*,} is rm -rf /*.
+    const words = text.includes('{') ? braceExpand(text, marks) : [text]
+    if (words === undefined) {
+      // Too many alternatives to check: one of them may be the root (an rm in progress fails closed), or the
+      // list itself may spell the rm: judge its tokens.
+      if (inRm) root = true
+      if (looseRootDelete(text.replace(/[{},]/g, ' '))) return true
+      return takeWord(text)
+    }
+    for (const w of words) if (w !== '' && takeWord(w)) return true
+    return false
+  }
   // A command substitution's body, from just after its opening backtick. Bash removes a
   // backslash only before $, a backtick or a backslash (and " inside double quotes) and
   // drops backslash-newline; any other backslash stays for the nested scan.
@@ -538,7 +608,7 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
       }
       body += command[j]
     }
-    return [j, depth < 4 ? hasRootDelete(body, depth + 1) : body.includes('rm -rf /')]
+    return [j, depth < 4 ? hasRootDelete(body, depth + 1) : looseRootDelete(body)]
   }
   const finishCommand = () => {
     const denied = inRm && recursive && force && root
@@ -555,8 +625,8 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
         else if (char === '\\' && i + 1 < command.length) {
           const [text, last] = ansiEscape(command, i + 1)
           i = last
-          if (!ansiNul) { const nul = text.indexOf('\0'); if (nul < 0) word += text; else { word += text.slice(0, nul); ansiNul = true } }
-        } else if (!ansiNul) word += char
+          if (!ansiNul) { const nul = text.indexOf('\0'); const kept = nul < 0 ? text : text.slice(0, nul); word += kept; mask += 'q'.repeat(kept.length); if (nul >= 0) ansiNul = true }
+        } else if (!ansiNul) { word += char; mask += 'q' }
         continue
       }
       if (char === quote) quote = ''
@@ -566,20 +636,20 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
         // The substitution is gone from the word, as bash's empty output is (a quoted empty substitution glued to -rf leaves -rf).
         // A # right after it is still inside the word: a placeholder keeps a rescan (sh -c "...")
         // from reading it as the start of a comment.
-        if (command[end + 1] === '#') word += '\u0001'
+        if (command[end + 1] === '#') { word += '\u0001'; mask += 'q' }
         i = end
       }
       else if (quote === '"' && char === '\\' && i + 1 < command.length &&
         (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
           command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
         const next = command[++i]
-        if (next !== '\n') word += next
-      } else word += char
+        if (next !== '\n') { word += next; mask += 'q' }
+      } else { word += char; mask += 'q' }
       continue
     }
     if (char === '\\' && i + 1 < command.length) {
       const next = command[++i]
-      if (next !== '\n') { word += next; started = true }
+      if (next !== '\n') { word += next; mask += 'q'; started = true }
     } else if (char === '\x60' && command.indexOf('\x60', i + 1) > i) {
       // Command substitution: scan the body as its own command; the substitution
       // stays inside the enclosing word, so the rm being parsed keeps its state,
@@ -602,10 +672,26 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
       redirect = char === '<' || char === '>'
       if (!redirectionAmpersand && (char === '\n' || ';|&()'.includes(char)) && finishCommand()) return true
     } else {
-      word += char; started = true
+      word += char; mask += 'u'; started = true
     }
   }
   return finishWord() || finishCommand()
+}
+
+// A fork bomb's definition as bash reads it, whatever the spacing or the name: f(){ f|f& }, function f { f|f& },
+// function f(){ f|f& }. Defining one is the danger: the call may come anywhere later.
+function hasForkBomb(command) {
+  const s = command.replace(/\s+/g, '')
+  for (let brace = s.indexOf('{'); brace >= 0; brace = s.indexOf('{', brace + 1)) {
+    const end = s.startsWith('()', brace - 2) ? brace - 2 : brace
+    let start = end
+    while (start > 0 && end - start < 72 && /[a-z0-9_:.-]/.test(s[start - 1])) start--
+    const run = s.slice(start, end)
+    for (const name of run.startsWith('function') && run.length > 8 ? [run, run.slice(8)] : [run]) {
+      if (name && s.startsWith(name + '|' + name + '&}', brace + 1)) return true
+    }
+  }
+  return false
 }`;
 /**
  * Generate hook-handler.cjs (cross-platform hook dispatcher)
@@ -816,7 +902,7 @@ export function generateHookHandler() {
         "    var dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\\\', ':(){:|:&};:'];",
         ROOT_DELETE_CHECK_SOURCE.split('\n').map((line) => '    ' + line).join('\n'),
         '    for (var i = 0; i < dangerous.length; i++) {',
-        "      if (dangerous[i] === 'rm -rf /' ? hasRootDelete(cmd) : cmd.includes(dangerous[i])) {",
+        "      if (dangerous[i] === 'rm -rf /' ? hasRootDelete(cmd) : dangerous[i] === ':(){:|:&};:' ? hasForkBomb(cmd) : cmd.includes(dangerous[i])) {",
         "        console.error('[BLOCKED] Dangerous command detected: ' + dangerous[i]);",
         '        // Claude Code PreToolUse: exit 2 blocks execution; exit 1 is non-blocking.',
         '        process.exit(2);',

package/dist/src/init/types.js

@@ -76,7 +76,7 @@ export const DEFAULT_INIT_OPTIONS = {
         github: true,
         flowNexus: false,
         browser: true,
-        v3: true,
+        v3: false, // ADR-128: opt-in like agents.v3; use --full or `init skills --v3`
         dualMode: false, // Optional: enable with --dual flag
         all: false,
     },

package/dist/src/mcp-tools/agent-execute-core.d.ts

@@ -7,6 +7,7 @@
  * keeps the wire from agent_spawn → ProviderManager (real) in one
  * place rather than duplicated.
  */
+import { type AgentExecutionSample } from './agent-health-metrics.js';
 type ClaudeModel = 'haiku' | 'sonnet' | 'opus' | 'opus-4.7' | 'inherit';
 export interface AgentRecord {
     agentId: string;
@@ -32,6 +33,7 @@ export interface AgentRecord {
     /** ADR-148 phase 2 — concrete OpenRouter slug when provider='openrouter'. */
     openrouterModel?: string;
     lastResult?: Record<string, unknown>;
+    executionHistory?: AgentExecutionSample[];
 }
 export declare const DEFAULT_ANTHROPIC_MODEL = "claude-sonnet-5";
 export declare function modelRejectsSamplingParams(model: string): boolean;