@claude-flow/cli 3.56.9 → 3.56.10

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.42.0
+3.56.9

package/.claude/helpers/helpers.manifest.json

@@ -1,14 +1,14 @@
 {
   "manifest": {
-    "version": "3.56.9",
+    "version": "3.56.10",
     "files": {
       "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
       "hook-handler.cjs": "bc12b3cae92d5a7c8deef699fa00d0ef07b57625c18dbeac4387f15725b8e09f",
-      "intelligence.cjs": "f486be296eb2f0518f34b8f4453d9d0a988845e4aec6d18d8d47725aca6dd38b",
+      "intelligence.cjs": "a95ac9ee2759c340b14f9ff656765bcb05e0cefe2f018116bd26b3ba9987f3e4",
       "statusline.cjs": "d72417ecb38634011a19f095a30e07b9929e6f97663520172ece9be7491b2eaa",
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "1qMXitpeXl6mUlSGGx2dT68gaou7Uf1Z6YS+eT1K/3h+B//G2GqbgEmHhdfa5mKmcxM6eml2KlsUgMMW/WknAA==",
+  "signature": "hZ0iy15VIKpZOjC2iG2fPsV68csqXrMhn2mifCIvzsjngaB/wmP0P4iMF38nAo57MeANEM6wW1nhK7YvteUXCg==",
   "algorithm": "ed25519"
 }

package/.claude/helpers/intelligence.cjs

@@ -739,27 +739,69 @@ function appendRecall(detailed, meta) {
  * getContext(prompt) — Called from route. Budget: <15ms.
  * Matches prompt to ranked entries, returns top-5 formatted context.
  */
+/**
+ * Inflection variants of a prompt term (plural, -ed, -ing, -ion and their
+ * stems), so "migrations" finds an entry that says "migration" and "deploying"
+ * finds "deploy". Exact term matching alone lost what the old trigram overlap
+ * caught (#4136). The stem keeps at least 4 characters so short words stay exact.
+ */
+function termVariants(word) {
+  const out = new Set([word]);
+  for (const suffix of ['s', 'es', 'ed', 'ing', 'ion', 'ions']) out.add(word + suffix);
+  for (const suffix of ['ions', 'ion', 'ing', 'ed', 'es', 's']) {
+    if (word.length - suffix.length >= 4 && word.endsWith(suffix)) {
+      const stem = word.slice(0, -suffix.length);
+      out.add(stem); out.add(stem + 'e'); out.add(stem + 's');
+    }
+  }
+  return [...out];
+}
+
 function getContextDetailed(prompt) {
   if (!prompt) return null;
 
   const ranked = readJSON(RANKED_PATH);
   if (!ranked || !ranked.entries || ranked.entries.length === 0) return null;
 
-  const promptWords = tokenize(prompt);
+  const promptWords = [...new Set(tokenize(prompt))];
   if (promptWords.length === 0) return null;
-  const promptTrigrams = trigrams(promptWords);
 
-  const ALPHA = 0.6; // content match weight
-  const MIN_THRESHOLD = 0.05;
+  // Query coverage is independent of entry length: a short diagnostic prompt
+  // must still find its exact terms inside a long memory section (#4136).
+  // IDF downweights generic terms shared by many entries. Terms absent from
+  // every entry still count against coverage, so two incidental words cannot
+  // hide the rest of an unrelated prompt.
+  const candidates = ranked.entries.map(entry => ({ entry, words: new Set(entry.words || []) }));
+  const variants = promptWords.map(termVariants);
+  const hasTerm = (words, i) => variants[i].some(v => words.has(v));
+  const weights = promptWords.map((word, i) => {
+    const frequency = candidates.reduce((count, candidate) => count + Number(hasTerm(candidate.words, i)), 0);
+    return Math.log1p((candidates.length - frequency + 0.5) / (frequency + 0.5));
+  });
+  const totalWeight = weights.reduce((sum, weight) => sum + weight, 0);
+  if (totalWeight === 0) return null;
+
+  const MIN_COVERAGE = 0.15;
   const TOP_K = 5;
 
   // Score each entry
   const scored = [];
-  for (const entry of ranked.entries) {
-    const entryTrigrams = trigrams(entry.words || []);
-    const contentMatch = jaccardSimilarity(promptTrigrams, entryTrigrams);
-    const score = ALPHA * contentMatch + (1 - ALPHA) * (entry.pageRank || 0);
-    if (score >= MIN_THRESHOLD) {
+  for (const { entry, words } of candidates) {
+    let matchedWeight = 0;
+    let matchedTerms = 0;
+    for (let i = 0; i < promptWords.length; i++) {
+      if (weights[i] > 0 && hasTerm(words, i)) {
+        matchedWeight += weights[i];
+        matchedTerms++;
+      }
+    }
+    // A single common word in a long prompt is not evidence of relevance;
+    // PageRank can order relevant entries but cannot make one relevant.
+    if (matchedTerms < Math.min(2, promptWords.length)) continue;
+    const coverage = matchedWeight / totalWeight;
+    if (coverage >= MIN_COVERAGE) {
+      const pageRank = Math.max(0, Math.min(1, Number(entry.pageRank) || 0));
+      const score = 0.9 * coverage + 0.1 * pageRank;
       scored.push({ ...entry, score });
     }
   }

package/.claude/skills/verification-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: "Verification & Quality Assurance"
 description: |
-  Comprehensive truth scoring, code quality verification, and automatic rollback system with 0.95 accuracy threshold for ensuring high-quality agent outputs and codebase reliability.
+  Check code quality and change risk with ruflo's shipped analysis commands (analyze diff, analyze complexity, analyze code), and run or extend ruflo's own CI regression guards. Use when assessing a change's risk, finding complexity hot spots, or adding a regression guard to ruflo. The truth-scoring and auto-rollback commands described later in this file are design notes, not shipped CLI commands.
 ---
 
 # Verification & Quality Assurance Skill
@@ -62,31 +62,34 @@ node plugins/ruflo-core/scripts/witness/history.mjs --history verification/macos
 
 ## Prerequisites
 
-- Ruflo installed (`npx ruflo@alpha`)
+- Ruflo installed (`npx ruflo@latest`)
 - Git repository (for rollback features)
 - Node.js 18+ (for dashboard features)
 - `@noble/ed25519` (for the witness verifier — a single runtime dep, `npm i @noble/ed25519`)
 
 ## Quick Start
 
-```bash
-# View current truth scores
-npx ruflo@alpha truth
+These commands ship in the current CLI:
 
-# Run verification check
-npx ruflo@alpha verify check
+```bash
+# Change risk since HEAD~1 (without --risk it also shows classification and reviewers)
+npx ruflo@latest analyze diff HEAD~1 --risk
 
-# Verify specific file with custom threshold
-npx ruflo@alpha verify check --file src/app.js --threshold 0.98
+# Complexity hot spots in a directory
+npx ruflo@latest analyze complexity src/ --threshold 15
 
-# Rollback last failed verification
-npx ruflo@alpha verify rollback --last-good
+# Size, functions and TODOs per file
+npx ruflo@latest analyze code -p ./src
 ```
 
+There is no truth-scoring, `verify check` or `verify rollback` command (`ruflo verify` only checks an installed ruflo package against its signed witness manifest). To verify agent output, run the project's own tests, linters and type checks, and roll back with git (`git restore <file>`, `git revert <commit>`). Inside the ruflo repo, run the guards in [Run the guards locally](#run-the-guards-locally).
+
 ---
 
 ## Complete Guide
 
+> **Design notes, not shipped.** Everything below describes a planned truth-scoring, verification and rollback surface. `ruflo truth`, `ruflo verify check` and `ruflo verify rollback` are not commands in the current CLI, so do not run the examples below; use the commands in [Quick Start](#quick-start) instead.
+
 ### Truth Scoring System
 
 #### View Truth Metrics

package/README.md

@@ -51,7 +51,7 @@ MCP exposes Ruflo tools to your client. The console and mods above are Claude Co
 
 <img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Prefer a plain terminal? Optional.** The console also runs on its own, with no Claude Code: `npx ruflo tui` (add `--plain` to print one frame for scripts). It shows Overview, Cost, Swarm, Events and Missions, plus an optional AI page. [Terminal UI guide](docs/USERGUIDE.md#terminal-ui-optional)
 
-<p align="center"><img src="docs/assets/ruflo-tui-compact.svg" width="640" alt="Looping recording of the optional ruflo terminal UI cycling through Overview, Cost, Swarm, Events and Missions in a sample project"></p>
+<p align="center"><img src="docs/assets/ruflo-tui-compact.svg" width="640" alt="Looping recording of the optional ruflo terminal UI with its pictures: Overview in the Classic BBS look, the Orbital look with its moving globe, and the Swarm graph, in a sample project"></p>
 
 [Compare install paths](#quick-start) · [Open the console](#console-walkthrough) · [User guide](docs/USERGUIDE.md)
 

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-12T21:03:06.737Z",
-  "gitSha": "55e2c901",
+  "generatedAt": "2026-10-14T16:22:09.483Z",
+  "gitSha": "1882006a",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/dist/src/autopilot-state.d.ts

@@ -80,6 +80,8 @@ export declare function discoverTasks(sources: string[]): TaskInfo[];
 export declare function isTerminal(status: string): boolean;
 export declare function getProgress(tasks: TaskInfo[]): TaskProgress;
 export declare function calculateReward(iterations: number, durationMs: number): number;
+/** Why the last tryLoadLearning() returned null (null when it succeeded or was never called). */
+export declare function getLearningLoadError(): string | null;
 export declare function tryLoadLearning(): Promise<{
     initialize: () => Promise<boolean>;
     [key: string]: unknown;

package/dist/src/autopilot-state.js

@@ -9,7 +9,9 @@
  */
 import { randomUUID } from 'node:crypto';
 import { existsSync, readFileSync, mkdirSync, readdirSync } from 'node:fs';
-import { resolve, join } from 'node:path';
+import { resolve, join, dirname } from 'node:path';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
 import { homedir } from 'node:os';
 import { writeFileAtomic } from './fs-secure.js';
 // ── Constants ─────────────────────────────────────────────────
@@ -288,17 +290,43 @@ export function calculateReward(iterations, durationMs) {
     return Math.round((iterFactor + timeFactor) * 100) / 100;
 }
 // ── Learning Integration ──────────────────────────────────────
+let lastLearningLoadError = null;
+/** Why the last tryLoadLearning() returned null (null when it succeeded or was never called). */
+export function getLearningLoadError() {
+    return lastLearningLoadError;
+}
+/**
+ * agentic-flow's `exports` map does not expose dist/coordination/*, so a bare
+ * specifier import throws ERR_PACKAGE_PATH_NOT_EXPORTED (#4146). Resolve the
+ * package root through its exported entry point and import the file by URL.
+ */
+function resolveAutopilotLearningUrl() {
+    const req = createRequire(import.meta.url);
+    let dir = dirname(req.resolve('agentic-flow'));
+    for (let i = 0; i < 6; i++) {
+        if (existsSync(join(dir, 'package.json')) && existsSync(join(dir, 'dist', 'coordination', 'autopilot-learning.js'))) {
+            return pathToFileURL(join(dir, 'dist', 'coordination', 'autopilot-learning.js')).href;
+        }
+        dir = dirname(dir);
+    }
+    throw new Error('agentic-flow does not ship dist/coordination/autopilot-learning.js');
+}
 export async function tryLoadLearning() {
+    lastLearningLoadError = null;
     try {
-        const modPath = 'agentic-flow/dist/coordination/autopilot-learning.js';
-        const mod = await import(/* webpackIgnore: true */ modPath).catch(() => null);
-        if (mod?.AutopilotLearning) {
-            const instance = new mod.AutopilotLearning();
-            if (await instance.initialize())
-                return instance;
+        const mod = await import(/* webpackIgnore: true */ resolveAutopilotLearningUrl());
+        if (!mod?.AutopilotLearning) {
+            lastLearningLoadError = 'agentic-flow autopilot-learning module has no AutopilotLearning export';
+            return null;
         }
+        const instance = new mod.AutopilotLearning();
+        if (await instance.initialize())
+            return instance;
+        lastLearningLoadError = 'AutopilotLearning.initialize() returned false (AgentDB not initialized)';
+    }
+    catch (e) {
+        lastLearningLoadError = `Could not load agentic-flow autopilot learning: ${e instanceof Error ? e.message : String(e)}`;
     }
-    catch { /* not available */ }
     return null;
 }
 //# sourceMappingURL=autopilot-state.js.map

package/dist/src/command-resolution.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Resolve which (sub)command an invocation targets.
+ *
+ * The parser reports the matched command path (for example
+ * ['hooks', 'transfer', 'store', 'search']) and the remaining positional arguments.
+ * Resolution walks the whole path through each command's `subcommands`, so a command
+ * can sit at any depth. #4157: it used to stop two levels below the top-level command,
+ * so `hooks transfer store search` ran the `store` help instead of `search`.
+ */
+import type { Command } from './types.js';
+export declare function resolveTargetCommand(command: Command, commandPath: string[], positional: string[]): {
+    target: Command;
+    args: string[];
+};
+//# sourceMappingURL=command-resolution.d.ts.map

package/dist/src/command-resolution.js

@@ -0,0 +1,25 @@
+const matches = (sc, name) => sc.name === name || !!sc.aliases?.includes(name);
+export function resolveTargetCommand(command, commandPath, positional) {
+    let target = command;
+    if (commandPath.length > 1 && command.subcommands) {
+        // The parser already removed the path from `positional`.
+        for (const name of commandPath.slice(1)) {
+            const next = target.subcommands?.find((sc) => matches(sc, name));
+            if (!next)
+                break;
+            target = next;
+        }
+        return { target, args: positional };
+    }
+    // Positional form: the path only named the top-level command.
+    let args = positional;
+    while (args.length > 0 && target.subcommands) {
+        const next = target.subcommands.find((sc) => matches(sc, args[0]));
+        if (!next)
+            break;
+        target = next;
+        args = args.slice(1);
+    }
+    return { target, args };
+}
+//# sourceMappingURL=command-resolution.js.map

package/dist/src/commands/agent.js

@@ -736,15 +736,16 @@ const healthCommand = {
             output.writeln(output.bold('Agent Health'));
             output.writeln();
             // Overall summary with null checks
-            const overall = result.overall ?? { healthy: 0, degraded: 0, unhealthy: 0, avgCpu: 0, avgMemory: 0 };
-            const avgCpu = overall.avgCpu ?? 0;
-            const avgMemory = overall.avgMemory ?? 0;
+            const overall = result.overall ?? { healthy: 0, degraded: 0, unhealthy: 0, unknown: 0 };
+            const avgCpu = overall.avgCpu ?? overall.cpu;
+            const avgMemory = overall.avgMemory ?? overall.memory;
             output.printBox([
                 `Healthy: ${output.success(String(overall.healthy ?? 0))}`,
                 `Degraded: ${output.warning(String(overall.degraded ?? 0))}`,
                 `Unhealthy: ${output.error(String(overall.unhealthy ?? 0))}`,
-                `Avg CPU: ${avgCpu.toFixed(1)}%`,
-                `Avg Memory: ${(avgMemory * 100).toFixed(1)}%`
+                `Unknown: ${String(overall.unknown ?? 0)}`,
+                `Avg CPU: ${typeof avgCpu === 'number' ? `${avgCpu.toFixed(1)}%` : 'n/a'}`,
+                `Avg Memory: ${typeof avgMemory === 'number' ? `${(avgMemory * 100).toFixed(1)}%` : 'n/a'}`
             ].join('  |  '), 'Overall Status');
             const healthAgents = result.agents ?? [];
             output.writeln();
@@ -753,14 +754,14 @@ const healthCommand = {
                     { key: 'id', header: 'Agent ID', width: 18 },
                     { key: 'type', header: 'Type', width: 12 },
                     { key: 'health', header: 'Health', width: 10, format: formatHealthStatus },
-                    { key: 'cpu', header: 'CPU %', width: 8, align: 'right', format: (v) => `${Number(v ?? 0).toFixed(1)}%` },
+                    { key: 'cpu', header: 'CPU %', width: 8, align: 'right', format: (v) => typeof v === 'number' ? `${v.toFixed(1)}%` : 'n/a' },
                     { key: 'memory', header: 'Memory', width: 10, align: 'right', format: (v) => {
                             const mem = v;
-                            if (!mem)
-                                return '0%';
+                            if (!mem || !mem.limit)
+                                return 'n/a';
                             return `${(mem.used / mem.limit * 100).toFixed(0)}%`;
                         } },
-                    { key: 'tasks', header: 'Tasks', width: 12, align: 'right', format: (v) => {
+                    { key: 'tasks', header: 'Calls', width: 12, align: 'right', format: (v) => {
                             const t = v;
                             if (!t)
                                 return '0/0';
@@ -775,15 +776,14 @@ const healthCommand = {
                 for (const agent of healthAgents) {
                     output.writeln();
                     output.writeln(output.highlight(agent.id));
-                    const uptime = agent.uptime ?? 0;
-                    const latency = agent.latency ?? { avg: 0, p99: 0 };
-                    const tasks = agent.tasks ?? { completed: 0, failed: 0, queued: 0 };
-                    const errors = agent.errors ?? { count: 0 };
+                    const latency = agent.latency;
+                    const tasks = agent.tasks;
+                    const errors = agent.errors;
                     output.printList([
-                        `Uptime: ${(uptime / 1000 / 60).toFixed(1)} min`,
-                        `Latency: avg ${(latency.avg ?? 0).toFixed(1)}ms, p99 ${(latency.p99 ?? 0).toFixed(1)}ms`,
-                        `Tasks: ${tasks.completed ?? 0} completed, ${tasks.failed ?? 0} failed, ${tasks.queued ?? 0} queued`,
-                        `Errors: ${errors.count ?? 0}${errors.lastError ? ` (${errors.lastError})` : ''}`
+                        `Registry age: ${typeof agent.registryAgeMs === 'number' ? `${(agent.registryAgeMs / 1000 / 60).toFixed(1)} min` : 'n/a'}`,
+                        `Latency: p50 ${typeof latency?.p50 === 'number' ? `${latency.p50.toFixed(1)}ms` : 'n/a'}, p95 ${typeof latency?.p95 === 'number' ? `${latency.p95.toFixed(1)}ms` : 'n/a'}`,
+                        `Observed provider calls (last 20): ${tasks?.completed ?? 0} API-success, ${tasks?.failed ?? 0} error`,
+                        `Errors: ${errors?.count ?? 0}${errors?.lastError ? ` (${errors.lastError})` : ''}`
                     ]);
                 }
             }

package/dist/src/commands/claims.js

@@ -5,7 +5,8 @@
  * Created with ❤️ by ruv.io
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { resolve, dirname, join } from 'node:path';
+import { homedir } from 'node:os';
 import { output } from '../output.js';
 const CLAIMS_CONFIG_PATHS = [
     '.claude-flow/claims.json',
@@ -15,7 +16,9 @@ function getClaimsConfigPaths() {
     return [
         resolve(CLAIMS_CONFIG_PATHS[0]),
         resolve(CLAIMS_CONFIG_PATHS[1]),
-        resolve(process.env.HOME || '~', '.config/claude-flow/claims.json'),
+        // os.homedir(), not $HOME: HOME is normally unset on Windows, and the old
+        // `process.env.HOME || '~'` fallback resolved to a literal <cwd>/~ folder.
+        join(homedir(), '.config', 'claude-flow', 'claims.json'),
     ];
 }
 function loadClaimsConfig() {
@@ -152,18 +155,13 @@ const checkCommand = {
         const spinner = output.createSpinner({ text: 'Evaluating claim...', spinner: 'dots' });
         spinner.start();
         const fs = await import('fs');
-        const path = await import('path');
         // Real claims evaluation from config file
         let isGranted = false;
         let reason = 'Claim not found in policy';
         let policySource = 'default';
         try {
             // Check for claims config file
-            const claimsConfigPaths = [
-                path.resolve('.claude-flow/claims.json'),
-                path.resolve('claude-flow.claims.json'),
-                path.resolve(process.env.HOME || '~', '.config/claude-flow/claims.json'),
-            ];
+            const claimsConfigPaths = getClaimsConfigPaths();
             let claimsConfig = {
                 // Default policy - allows basic operations
                 roles: {

package/dist/src/commands/daemon.js

@@ -164,37 +164,44 @@ const startCommand = {
                 fs.mkdirSync(stateDir, { recursive: true });
             }
             catch { /* exists */ }
-            try {
-                lockFd = fs.openSync(lockFile, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
-                fs.writeSync(lockFd, String(process.pid));
-            }
-            catch (e) {
-                if (e.code === 'EEXIST') {
-                    // Another `daemon start` is mid-spawn. Wait up to 5s for it to
-                    // finish, then re-check the PID file. If the holder crashed
-                    // mid-spawn, fall through and reset; killStaleDaemons + a fresh
-                    // attempt will recover.
-                    const deadline = Date.now() + 5000;
-                    while (Date.now() < deadline) {
-                        await new Promise((r) => setTimeout(r, 100));
-                        const winnerPid = getBackgroundDaemonPid(projectRoot);
-                        if (winnerPid && isProcessRunning(winnerPid)) {
-                            if (!quiet) {
-                                output.printWarning(`Daemon already running in background (PID: ${winnerPid}). Stop it first with: daemon stop`);
-                            }
-                            return { success: true };
+            lockFd = tryAcquireDaemonLock(lockFile);
+            if (lockFd === null) {
+                // Another `daemon start` is mid-spawn. Wait for it while its holder
+                // is alive; only a lock whose holder is DEAD is stale and may be
+                // retaken — atomically, via O_EXCL again, never by proceeding
+                // lockless. The old fixed 5s timeout + unlink let every waiter
+                // through on Windows, where the holder's killStaleDaemons
+                // (`tasklist /v`) routinely takes longer than that, and each waiter
+                // then forked its own daemon (3 per workspace observed).
+                const waitMs = Number(process.env.RUFLO_DAEMON_LOCK_WAIT_MS) > 0
+                    ? Number(process.env.RUFLO_DAEMON_LOCK_WAIT_MS)
+                    : 60_000;
+                const deadline = Date.now() + waitMs;
+                while (lockFd === null) {
+                    const winnerPid = getBackgroundDaemonPid(projectRoot);
+                    if (winnerPid && isProcessRunning(winnerPid)) {
+                        if (!quiet) {
+                            output.printWarning(`Daemon already running in background (PID: ${winnerPid}). Stop it first with: daemon stop`);
                         }
+                        return { success: true };
                     }
-                    // Stale lockfile from a crashed prior attempt — clear it and
-                    // proceed without a held lock. Worst case we double-spawn ONCE
-                    // and the killStaleDaemons sweep below cleans up.
-                    try {
-                        fs.unlinkSync(lockFile);
+                    if (daemonLockIsStale(lockFile)) {
+                        try {
+                            fs.unlinkSync(lockFile);
+                        }
+                        catch { /* raced with another taker */ }
+                        lockFd = tryAcquireDaemonLock(lockFile);
+                        continue;
                     }
-                    catch { /* ignore */ }
-                }
-                else {
-                    throw e;
+                    if (Date.now() >= deadline) {
+                        // A live process is still starting the daemon. Spawning another
+                        // would be the duplicate this lock exists to prevent.
+                        if (!quiet) {
+                            output.printWarning('Another `daemon start` is still in progress for this workspace; not starting a second daemon.');
+                        }
+                        return { success: true };
+                    }
+                    await new Promise((r) => setTimeout(r, 100));
                 }
             }
             // Dedup check while holding the lock.
@@ -298,15 +305,22 @@ const startCommand = {
             // NOTE: Do NOT write PID file here — startDaemon() writes it internally.
             // Writing it before startDaemon() causes checkExistingDaemon() to detect
             // our own PID and return early, leaving no workers scheduled (#1478 Bug 1).
-            // Clean up PID file on exit
+            // Clean up PID file on exit — only if it is OURS. A process that lost
+            // the singleton race must never delete the winner's PID file, or the
+            // next auto-start sees "no daemon" and forks yet another one.
             const cleanup = () => {
                 try {
-                    if (fs.existsSync(pidFile)) {
+                    if (fs.existsSync(pidFile) && fs.readFileSync(pidFile, 'utf-8').trim() === String(process.pid)) {
                         fs.unlinkSync(pidFile);
                     }
                 }
                 catch { /* ignore */ }
             };
+            // WorkerDaemon.start() declines (returns without running) when another
+            // live daemon already owns daemon.pid. Such a process must exit rather
+            // than park on the keep-alive below: it has no workers and no TTL, so
+            // it would linger as an idle duplicate forever.
+            const declined = (d) => !d.getStatus().running;
             process.on('exit', cleanup);
             process.on('SIGINT', () => { cleanup(); process.exit(0); });
             process.on('SIGTERM', () => { cleanup(); process.exit(0); });
@@ -319,6 +333,11 @@ const startCommand = {
                 spinner.start();
                 const daemon = await startDaemon(projectRoot, config);
                 const status = daemon.getStatus();
+                if (declined(daemon)) {
+                    spinner.stop();
+                    output.printWarning(`Daemon already running (PID: ${getBackgroundDaemonPid(projectRoot) ?? 'unknown'}); not starting a second one.`);
+                    return { success: true };
+                }
                 spinner.succeed('Worker daemon started (foreground mode)');
                 output.writeln();
                 output.printBox([
@@ -371,7 +390,9 @@ const startCommand = {
                 await new Promise(() => { }); // Never resolves - daemon runs until killed
             }
             else {
-                await startDaemon(projectRoot, config);
+                const daemon = await startDaemon(projectRoot, config);
+                if (declined(daemon))
+                    return { success: true };
                 setInterval(() => { }, 60_000); // Keep alive with ref'd handle (#1478)
                 await new Promise(() => { }); // Keep alive
             }
@@ -910,6 +931,40 @@ function getBackgroundDaemonPid(projectRoot) {
         return null;
     }
 }
+/**
+ * Atomically create the launcher lock and stamp it with our PID.
+ * Returns the fd, or null when another process holds the lock.
+ */
+function tryAcquireDaemonLock(lockFile) {
+    try {
+        const fd = fs.openSync(lockFile, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
+        fs.writeSync(fd, String(process.pid));
+        return fd;
+    }
+    catch (e) {
+        if (e.code === 'EEXIST')
+            return null;
+        throw e;
+    }
+}
+/**
+ * A lock is stale only when its holder is gone. An empty lock is the brief
+ * window between O_EXCL create and the PID write, so it counts as held
+ * unless it has been empty for a while (holder crashed in that window).
+ */
+function daemonLockIsStale(lockFile) {
+    try {
+        const raw = fs.readFileSync(lockFile, 'utf-8').trim();
+        const pid = parseInt(raw, 10);
+        if (!raw || Number.isNaN(pid)) {
+            return Date.now() - fs.statSync(lockFile).mtimeMs > 10_000;
+        }
+        return pid !== process.pid && !isProcessRunning(pid);
+    }
+    catch {
+        return false; // vanished: the next O_EXCL attempt decides
+    }
+}
 /**
  * Check if a process is running
  */

package/dist/src/commands/memory.js

@@ -3,6 +3,7 @@
  * Memory operations for AgentDB integration
  */
 import { validateAppendConditions } from '../memory/append-conditions.js';
+import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.js';
 import { output } from '../output.js';
 import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
@@ -430,7 +431,7 @@ const searchCommand = {
             // default to 0.7, which silently re-broke #2558: `memory search` matched
             // content word-for-word and still returned nothing. Regression guard:
             // __tests__/memory-search-recall-2558.test.ts.
-            default: 0.3
+            default: 0.2
         },
         {
             name: 'type',
@@ -499,7 +500,9 @@ const searchCommand = {
         // coalescing preserves an explicit zero. Fallback aligned with the
         // option's declared `default: 0.7` (was `0.3` — the two disagreed
         // and --help advertised a default the code did not honor).
-        const threshold = ctx.flags.threshold ?? 0.3;
+        const threshold = ctx.flags.threshold ?? DEFAULT_SEARCH_THRESHOLD;
+        // The parser fills the option's declared default, so an untouched flag arrives as the default value.
+        const thresholdWasDefault = ctx.flags.threshold === undefined || ctx.flags.threshold === DEFAULT_SEARCH_THRESHOLD;
         const searchType = ctx.flags.type || 'semantic';
         const buildHnsw = (ctx.flags['build-hnsw'] || ctx.flags.buildHnsw);
         const requestedIntent = ctx.flags.intent || 'mixed';
@@ -738,6 +741,15 @@ const searchCommand = {
             output.writeln();
             if (results.length === 0) {
                 output.printWarning('No results found');
+                if (thresholdWasDefault) {
+                    const near = await nearMisses(searchEntries, { query, namespace, provenanceFilter, dbPath: dbPathSearch });
+                    if (near) {
+                        output.writeln(output.dim(`  ${near.hint.replace(' in nearMisses', ' below').replace('Pass threshold: 0', 'Pass --threshold 0')}`));
+                        for (const n of near.nearMisses) {
+                            output.writeln(output.dim(`    ${n.similarity.toFixed(2)}  ${n.namespace}/${n.key}`));
+                        }
+                    }
+                }
                 await warnIfSiblingHasRows(ctx.flags.path);
                 output.writeln(output.dim('Try: claude-flow memory store -k "key" --value "data"'));
                 return { success: true, data: [] };

package/dist/src/commands/security-code-patterns.d.ts

@@ -6,8 +6,8 @@
  *  - every rule is tested after comment text is blanked, so a comment naming `child_process.execFile` or `eval(` is
  *    not a finding;
  *  - eval needs a word start: "retrieval (" in prose is not a call; `eval(` and `window.eval(` still are;
- *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and no longer skips
- *    execSync as `exec[^S]` did;
+ *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and also catches
+ *    dynamic exec/execSync command strings when the import was on another line;
  *  - a pg placeholder such as `$${paramCount + 1}` is a parameter number, not a value in the SQL text. It is exempt only
  *    when its expression is a number, a loop letter, `params.length`-style, or a name containing `param` or `placeholder`, it
  *    stands where SQL takes a value, and it is not inside a quoted SQL string.