@claude-flow/cli 3.56.9 → 3.57.0

package/dist/src/commands/doctor.js

@@ -2515,6 +2515,12 @@ export const doctorCommand = {
     name: 'doctor',
     description: 'System diagnostics and health checks',
     options: [
+        {
+            name: 'json',
+            description: 'Emit versioned JSON health checks (cannot be combined with repair flags)',
+            type: 'boolean',
+            default: false
+        },
         {
             name: 'fix',
             short: 'f',
@@ -2561,6 +2567,7 @@ export const doctorCommand = {
         }
     ],
     examples: [
+        { command: 'claude-flow doctor --json -c node', description: 'Emit machine-readable health checks' },
         { command: 'claude-flow doctor', description: 'Run full health check' },
         { command: 'claude-flow doctor --fix', description: 'Print suggested fix commands (does not auto-apply)' },
         { command: 'claude-flow doctor --install', description: 'Auto-install missing dependencies' },
@@ -2575,6 +2582,21 @@ export const doctorCommand = {
         const verbose = ctx.flags.verbose;
         // Parser camelCases kebab-case flag names — read via `fixHandles`, not `['fix-handles']`.
         const fixHandles = ctx.flags.fixHandles;
+        const json = ctx.flags.json;
+        const reportError = (message) => {
+            if (json)
+                output.writeln(JSON.stringify({ schemaVersion: 1, checks: [], error: message }));
+            else
+                output.printError(message);
+            return { success: false, exitCode: 1, message };
+        };
+        if (json && (showFix || autoInstall || fixHandles)) {
+            return reportError('--json cannot be combined with --fix, --install, or --fix-handles');
+        }
+        // Reuse the same callable for anonymous checks so their IDs do not depend
+        // on display names or on whether the full or component suite was selected.
+        const helperCheck = () => checkHelperIntegrity();
+        const nativeAddonCheck = () => checkNativeAddonHeaders();
         // #2677: `--component memory` now runs the whole memory-health suite,
         // not just the existence check. Values can be a single check or an
         // array — expanded at execution time. Stuinfla's report showed the
@@ -2592,7 +2614,7 @@ export const doctorCommand = {
             'browser': checkAgentBrowserVersion,
             'config': checkConfigFile,
             'stale-settings': checkStaleSettingsNpx, // #2448
-            'helpers': () => checkHelperIntegrity(), // #3565
+            'helpers': helperCheck, // #3565
             'daemon': checkDaemonStatus,
             get memory() {
                 return [
@@ -2608,7 +2630,7 @@ export const doctorCommand = {
                 ];
             },
             'memory-package': checkMemoryPackageVersion, // #3392
-            'native-addon': () => checkNativeAddonHeaders(), // #4055
+            'native-addon': nativeAddonCheck, // #4055
             'learning': checkLearningBridge, // #2545
             'learning-bridge': checkLearningBridge, // #2545
             'api': checkApiKeys,
@@ -2634,8 +2656,7 @@ export const doctorCommand = {
         };
         if (component !== undefined && !Object.hasOwn(componentMap, component)) {
             const message = `Unknown doctor component: ${JSON.stringify(component)}. Valid components: ${Object.keys(componentMap).join(', ')}`;
-            output.printError(message);
-            return { success: false, exitCode: 1, message };
+            return reportError(message);
         }
         // Early-return short-circuit: `--fix-handles` is a targeted mitigation, not
         // part of the health-check flow. Runs, reports, exits.
@@ -2699,12 +2720,15 @@ export const doctorCommand = {
             output.writeln(output.dim('Upstream tracking: https://github.com/anthropics/claude-code/issues/67888'));
             return { success: true };
         }
-        output.writeln();
-        output.writeln(output.bold('RuFlo Doctor'));
-        output.writeln(output.dim('System diagnostics and health check'));
-        output.writeln(output.dim('─'.repeat(50)));
-        output.writeln();
-        const nativeAgentDbChecks = (await existingNativeAgentDbPaths())
+        if (!json) {
+            output.writeln();
+            output.writeln(output.bold('RuFlo Doctor'));
+            output.writeln(output.dim('System diagnostics and health check'));
+            output.writeln(output.dim('─'.repeat(50)));
+            output.writeln();
+        }
+        const nativeAgentDbPaths = await existingNativeAgentDbPaths();
+        const nativeAgentDbChecks = nativeAgentDbPaths
             .map((dbPath) => () => checkNativeAgentDbStructuralIntegrity(dbPath));
         const allChecks = [
             checkVersionFreshness,
@@ -2716,7 +2740,7 @@ export const doctorCommand = {
             checkGitRepo,
             checkConfigFile,
             checkStaleSettingsNpx, // #2448/#2677 — runaway `npx @latest` in settings
-            () => checkHelperIntegrity(), // #3565 — installed signed helpers vs manifest
+            helperCheck, // #3565 — installed signed helpers vs manifest
             checkDaemonStatus,
             checkMemoryDatabase,
             checkMemoryStructuralIntegrity, // #2737 — bounded, native quick_check on every default run
@@ -2724,7 +2748,7 @@ export const doctorCommand = {
             checkMemoryPersistenceDriver, // #2968/#3321 — read-only native capability probe
             checkLearningBridge, // #2545 — can the auto-memory hook actually load @claude-flow/memory?
             checkMemoryPackageVersion, // #3392 — loaded @claude-flow/memory must satisfy the CLI's declared range
-            () => checkNativeAddonHeaders(), // #4055 — better-sqlite3 built against Node 24.19+ headers on 24.19-24.21
+            nativeAddonCheck, // #4055 — better-sqlite3 built against Node 24.19+ headers on 24.19-24.21
             checkApiKeys,
             checkMcpServers,
             checkMcpSchemaOverhead, // #2726 — fixed tools/list prompt cost
@@ -2747,21 +2771,59 @@ export const doctorCommand = {
             const entry = componentMap[component];
             checksToRun = Array.isArray(entry) ? entry : [entry];
         }
+        // These are API identifiers: keep them stable even when user-facing names
+        // change. Grouped components have a distinct ID for each individual check.
+        const checkIds = new Map([
+            [checkVersionFreshness, 'version'], [checkNodeVersion, 'node'],
+            [checkNpmVersion, 'npm'], [checkClaudeCode, 'claude'],
+            [checkAgentBrowserVersion, 'browser'], [checkGit, 'git'],
+            [checkGitRepo, 'git-repo'], [checkConfigFile, 'config'],
+            [checkStaleSettingsNpx, 'stale-settings'], [helperCheck, 'helpers'],
+            [checkDaemonStatus, 'daemon'], [checkMemoryDatabase, 'memory-presence'],
+            [checkMemoryStructuralIntegrity, 'memory-structural'],
+            [checkMemoryIntegrity, 'memory-integrity'],
+            [checkMemoryPersistenceDriver, 'memory-driver'],
+            [checkMemoryPackageVersion, 'memory-package'],
+            [checkMemoryContent, 'memory-content'],
+            [checkMemoryEmbeddingCoverage, 'memory-embeddings'],
+            [checkMemoryReflexionCoverage, 'memory-reflexion'],
+            [checkMemoryCritiqueCoverage, 'memory-critique'],
+            [checkLearningBridge, 'learning'], [nativeAddonCheck, 'native-addon'],
+            [checkApiKeys, 'api'], [checkMcpServers, 'mcp'],
+            [checkMcpSchemaOverhead, 'mcp-overhead'], [checkAIDefence, 'aidefence'],
+            [checkDiskSpace, 'disk'], [checkBuildTools, 'typescript'],
+            [checkAgenticFlow, 'agentic-flow'], [checkEncryptionAtRest, 'encryption'],
+            [checkFederationBreaker, 'federation'], [checkMetaharness, 'metaharness'],
+            [checkMetaharnessDeclaredPackages, 'metaharness-packages'],
+            [checkMetaharnessIntegration, 'metaharness-integration'],
+            [checkFunnel, 'funnel'], [checkProxySponsoredConsent, 'proxy-consent'],
+            [checkProxyBinary, 'proxy-binary'], [checkProxyProcess, 'proxy-process'],
+            [checkProxyBindAddress, 'proxy-bind'], [checkAuth, 'auth'],
+            [checkTypesafeRouter, 'typesafe'], [checkMods, 'mods'],
+        ]);
+        nativeAgentDbChecks.forEach((check, index) => {
+            // The path distinguishes simultaneous authority files; normalize separators.
+            checkIds.set(check, `memory-native:${nativeAgentDbPaths[index].replace(/\\/g, '/')}`);
+        });
+        if (json && checksToRun.some(check => !checkIds.has(check))) {
+            return reportError('Doctor check is missing a stable JSON ID');
+        }
         const results = [];
         const fixes = [];
         // OPTIMIZATION: Run all checks in parallel for 3-5x faster execution
-        const spinner = output.createSpinner({ text: 'Running health checks in parallel...', spinner: 'dots' });
-        spinner.start();
+        const spinner = json ? undefined : output.createSpinner({ text: 'Running health checks in parallel...', spinner: 'dots' });
+        spinner?.start();
         try {
             // Execute all checks concurrently
             const checkResults = await Promise.allSettled(checksToRun.map(check => check()));
-            spinner.stop();
+            spinner?.stop();
             // Process results in order
             for (const settledResult of checkResults) {
                 if (settledResult.status === 'fulfilled') {
                     const result = settledResult.value;
                     results.push(result);
-                    output.writeln(formatCheck(result));
+                    if (!json)
+                        output.writeln(formatCheck(result));
                     if (result.fix && (result.status === 'fail' || result.status === 'warn')) {
                         fixes.push(`${result.name}: ${result.fix}`);
                     }
@@ -2773,12 +2835,15 @@ export const doctorCommand = {
                         message: settledResult.reason?.message || 'Unknown error'
                     };
                     results.push(errorResult);
-                    output.writeln(formatCheck(errorResult));
+                    if (!json)
+                        output.writeln(formatCheck(errorResult));
                 }
             }
         }
         catch (error) {
-            spinner.stop();
+            spinner?.stop();
+            if (json)
+                return reportError(`Failed to run health checks: ${error instanceof Error ? error.message : String(error)}`);
             output.writeln(output.error('Failed to run health checks'));
         }
         // #2545: --fix / --install can actually repair the Learning Bridge by
@@ -2827,6 +2892,18 @@ export const doctorCommand = {
         const passed = results.filter(r => r.status === 'pass').length;
         const warnings = results.filter(r => r.status === 'warn').length;
         const failed = results.filter(r => r.status === 'fail').length;
+        if (json) {
+            const checks = results.map((result, index) => ({
+                id: checkIds.get(checksToRun[index]),
+                status: result.status,
+                name: result.name,
+                detail: result.message,
+                ...(result.fix ? { fix: result.fix } : {}),
+            }));
+            const data = { schemaVersion: 1, checks };
+            output.writeln(JSON.stringify(data));
+            return { success: failed === 0, exitCode: failed > 0 ? 1 : 0, data };
+        }
         output.writeln();
         output.writeln(output.dim('─'.repeat(50)));
         output.writeln();

package/dist/src/commands/memory.js

@@ -3,6 +3,7 @@
  * Memory operations for AgentDB integration
  */
 import { validateAppendConditions } from '../memory/append-conditions.js';
+import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.js';
 import { output } from '../output.js';
 import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
@@ -430,7 +431,7 @@ const searchCommand = {
             // default to 0.7, which silently re-broke #2558: `memory search` matched
             // content word-for-word and still returned nothing. Regression guard:
             // __tests__/memory-search-recall-2558.test.ts.
-            default: 0.3
+            default: 0.2
         },
         {
             name: 'type',
@@ -499,7 +500,9 @@ const searchCommand = {
         // coalescing preserves an explicit zero. Fallback aligned with the
         // option's declared `default: 0.7` (was `0.3` — the two disagreed
         // and --help advertised a default the code did not honor).
-        const threshold = ctx.flags.threshold ?? 0.3;
+        const threshold = ctx.flags.threshold ?? DEFAULT_SEARCH_THRESHOLD;
+        // The parser fills the option's declared default, so an untouched flag arrives as the default value.
+        const thresholdWasDefault = ctx.flags.threshold === undefined || ctx.flags.threshold === DEFAULT_SEARCH_THRESHOLD;
         const searchType = ctx.flags.type || 'semantic';
         const buildHnsw = (ctx.flags['build-hnsw'] || ctx.flags.buildHnsw);
         const requestedIntent = ctx.flags.intent || 'mixed';
@@ -738,6 +741,15 @@ const searchCommand = {
             output.writeln();
             if (results.length === 0) {
                 output.printWarning('No results found');
+                if (thresholdWasDefault) {
+                    const near = await nearMisses(searchEntries, { query, namespace, provenanceFilter, dbPath: dbPathSearch });
+                    if (near) {
+                        output.writeln(output.dim(`  ${near.hint.replace(' in nearMisses', ' below').replace('Pass threshold: 0', 'Pass --threshold 0')}`));
+                        for (const n of near.nearMisses) {
+                            output.writeln(output.dim(`    ${n.similarity.toFixed(2)}  ${n.namespace}/${n.key}`));
+                        }
+                    }
+                }
                 await warnIfSiblingHasRows(ctx.flags.path);
                 output.writeln(output.dim('Try: claude-flow memory store -k "key" --value "data"'));
                 return { success: true, data: [] };

package/dist/src/commands/policy.js

@@ -30,6 +30,7 @@ export const policyCommand = {
         { name: 'mode', type: 'string', description: 'Policy mode: legacy | observe | enforce' },
         { name: 'project-root', type: 'string', description: 'Project root containing .claude-flow/policy' },
         { name: 'establish-anchor', type: 'boolean', description: 'verify: explicitly anchor a ledger that has receipts but no anchor (interactive, logged with user and time)' },
+        { name: 'full', type: 'boolean', description: 'verify: additionally replay the archived receipts (receipts.ledger.jsonl) to verify the complete historical chain, not just the retained hot tail' },
     ],
     async action(context) {
         const args = context.args ?? [];
@@ -93,9 +94,13 @@ export const policyCommand = {
             }
             if (operation === 'verify') {
                 const establishAnchor = flags['establish-anchor'] === true || flags.establishAnchor === true;
+                const full = flags.full === true;
                 if (establishAnchor)
                     requireInteractiveAdministrator();
-                const ledger = await verifyPolicyLedger(root, { establishAnchor });
+                const ledger = await verifyPolicyLedger(root, { establishAnchor, full });
+                if (ledger.error === 'receipt-key-id-mismatch') {
+                    output.printError('Restore the original CLAUDE_FLOW_POLICY_KEY_ID for this ledger; do not rewrite or re-sign historical receipts.');
+                }
                 const result = print({ ...ledger, anchors: anchorPosture(root), scope: LEDGER_TRUST_SCOPE });
                 return ledger.valid ? result : { ...result, success: false, exitCode: 1 };
             }

package/dist/src/commands/security-code-patterns.d.ts

@@ -6,8 +6,8 @@
  *  - every rule is tested after comment text is blanked, so a comment naming `child_process.execFile` or `eval(` is
  *    not a finding;
  *  - eval needs a word start: "retrieval (" in prose is not a call; `eval(` and `window.eval(` still are;
- *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and no longer skips
- *    execSync as `exec[^S]` did;
+ *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and also catches
+ *    dynamic exec/execSync command strings when the import was on another line;
  *  - a pg placeholder such as `$${paramCount + 1}` is a parameter number, not a value in the SQL text. It is exempt only
  *    when its expression is a number, a loop letter, `params.length`-style, or a name containing `param` or `placeholder`, it
  *    stands where SQL takes a value, and it is not inside a quoted SQL string.

package/dist/src/commands/security-code-patterns.js

@@ -6,14 +6,72 @@
  *  - every rule is tested after comment text is blanked, so a comment naming `child_process.execFile` or `eval(` is
  *    not a finding;
  *  - eval needs a word start: "retrieval (" in prose is not a call; `eval(` and `window.eval(` still are;
- *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and no longer skips
- *    execSync as `exec[^S]` did;
+ *  - command injection keeps the old rule's reach (any `exec` after `child_process` on the line), and also catches
+ *    dynamic exec/execSync command strings when the import was on another line;
  *  - a pg placeholder such as `$${paramCount + 1}` is a parameter number, not a value in the SQL text. It is exempt only
  *    when its expression is a number, a loop letter, `params.length`-style, or a name containing `param` or `placeholder`, it
  *    stands where SQL takes a value, and it is not inside a quoted SQL string.
  */
 /** No `g` flag, so `test` keeps no lastIndex between lines. */
 const re = (pattern) => (line) => pattern.test(line);
+/** Detect a dynamic shell command at an exec/execSync call site, independent of its import. */
+const interpolatedExec = (line) => {
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (quote !== null) {
+            if (ch === '\\') {
+                i++;
+                continue;
+            }
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === "'" || ch === '"' || ch === '`') {
+            quote = ch;
+            continue;
+        }
+        if (i > 0 && /[\w$]/.test(line[i - 1]))
+            continue;
+        const name = line.startsWith('execSync', i) ? 'execSync' : line.startsWith('exec', i) ? 'exec' : '';
+        if (!name)
+            continue;
+        let arg = i + name.length;
+        while (/\s/.test(line[arg] ?? ''))
+            arg++;
+        if (line[arg++] !== '(')
+            continue;
+        while (/\s/.test(line[arg] ?? ''))
+            arg++;
+        const delimiter = line[arg];
+        if (delimiter !== '`' && delimiter !== "'" && delimiter !== '"')
+            continue;
+        for (let end = arg + 1; end < line.length; end++) {
+            if (line[end] === '\\') {
+                end++;
+                continue;
+            }
+            if (delimiter === '`' && line[end] === '$' && line[end + 1] === '{')
+                return true;
+            if (line[end] !== delimiter)
+                continue;
+            if (delimiter !== '`') {
+                let next = end + 1;
+                while (/\s/.test(line[next] ?? ''))
+                    next++;
+                if (line[next++] === '+') {
+                    while (/\s/.test(line[next] ?? ''))
+                        next++;
+                    if (/[A-Za-z_$]/.test(line[next] ?? ''))
+                        return true;
+                }
+            }
+            break;
+        }
+    }
+    return false;
+};
 // A `.length` counts only on a param-, value- or arg-named array: `req.body.length` is whatever the client sent.
 const COUNTER = /^\s*(?:\d+|[ijkn]|(?:[A-Za-z_$][\w$]*(?:Params?|Placeholders?|Values?|Args?)|params?|placeholders?|values?|args?)\.length|[A-Za-z_$]*(?:[Pp]aram|[Pp]laceholder)[\w$]*)\s*(?:[+-]\s*\d+\s*)?$/;
 // Where a pg parameter stands in SQL: after a comparison, a list or call opener, or a clause keyword.
@@ -70,7 +128,7 @@ export const CODE_PATTERNS = [
     { match: re(/(?<![\w$])eval\s*\(/), type: 'Eval Usage', severity: 'medium', desc: 'eval() can execute arbitrary code' },
     { match: re(/innerHTML\s*=/), type: 'innerHTML', severity: 'medium', desc: 'XSS risk with innerHTML' },
     { match: re(/dangerouslySetInnerHTML/), type: 'React XSS', severity: 'medium', desc: 'React XSS risk' },
-    { match: re(/child_process.*exec/), type: 'Command Injection', severity: 'high', desc: 'Possible command injection' },
+    { match: line => /child_process.*exec/.test(line) || interpolatedExec(line), type: 'Command Injection', severity: 'high', desc: 'Possible command injection' },
     { match: line => sqlInterpolation(line) && sqlInterpolation(withoutPlaceholders(line)), type: 'SQL Injection', severity: 'high', desc: 'Possible SQL injection' },
 ];
 /**

package/dist/src/commands/security.d.ts

@@ -5,6 +5,30 @@
  * Created with ❤️ by ruv.io
  */
 import type { Command } from '../types.js';
+/**
+ * #4124: `npm audit` can fail without exiting through the vulnerability path.
+ * In a pnpm/yarn/bun project there is no package-lock.json, so it prints
+ * `{"error":{"code":"ENOLOCK",...}}`. That has no `vulnerabilities` key, and
+ * both `scan` and `cve` used to read it as a clean tree. Only a report with a
+ * `vulnerabilities` object counts as a scan; anything else is "could not scan".
+ */
+type NpmAuditVuln = {
+    severity: string;
+    via: Array<{
+        title?: string;
+        url?: string;
+        source?: number;
+        name?: string;
+    } | string>;
+};
+export type NpmAuditResult = {
+    ok: true;
+    vulnerabilities: Record<string, NpmAuditVuln>;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function interpretNpmAudit(raw: string, dir?: string): NpmAuditResult;
 export declare const securityCommand: Command;
 export default securityCommand;
 //# sourceMappingURL=security.d.ts.map

package/dist/src/commands/security.js

@@ -155,6 +155,7 @@ const scanCommand = {
             spinner.start();
         const findings = [];
         let criticalCount = 0, highCount = 0, mediumCount = 0, lowCount = 0;
+        let depsSkipped;
         try {
             const fs = await import('fs');
             const path = await import('path');
@@ -178,35 +179,41 @@ const scanCommand = {
                             // npm audit exits non-zero when vulnerabilities found — stdout still has JSON
                             auditResult = (auditErr instanceof Error && 'stdout' in auditErr ? auditErr.stdout : undefined) || '{}';
                         }
-                        try {
-                            const audit = JSON.parse(auditResult);
-                            if (audit.vulnerabilities) {
-                                for (const [pkg, vuln] of Object.entries(audit.vulnerabilities)) {
-                                    const sev = vuln.severity || 'low';
-                                    const title = Array.isArray(vuln.via) && vuln.via[0]?.title ? vuln.via[0].title : 'Vulnerability';
-                                    if (sev === 'critical')
-                                        criticalCount++;
-                                    else if (sev === 'high')
-                                        highCount++;
-                                    else if (sev === 'moderate' || sev === 'medium')
-                                        mediumCount++;
-                                    else
-                                        lowCount++;
-                                    findings.push({
-                                        severity: sev === 'critical' ? 'critical' :
-                                            sev === 'high' ? 'high' :
-                                                sev === 'moderate' || sev === 'medium' ? 'medium' : 'low',
-                                        type: 'Dependency CVE',
-                                        location: `package.json:${pkg}`,
-                                        description: title.substring(0, 35),
-                                    });
-                                }
+                        const audit = interpretNpmAudit(auditResult, path.resolve(target));
+                        if (!audit.ok) {
+                            depsSkipped = audit.reason;
+                        }
+                        else {
+                            for (const [pkg, vuln] of Object.entries(audit.vulnerabilities)) {
+                                const sev = vuln.severity || 'low';
+                                const first = Array.isArray(vuln.via) ? vuln.via[0] : undefined;
+                                const title = typeof first === 'object' && first?.title ? first.title : 'Vulnerability';
+                                if (sev === 'critical')
+                                    criticalCount++;
+                                else if (sev === 'high')
+                                    highCount++;
+                                else if (sev === 'moderate' || sev === 'medium')
+                                    mediumCount++;
+                                else
+                                    lowCount++;
+                                findings.push({
+                                    severity: sev === 'critical' ? 'critical' :
+                                        sev === 'high' ? 'high' :
+                                            sev === 'moderate' || sev === 'medium' ? 'medium' : 'low',
+                                    type: 'Dependency CVE',
+                                    location: `package.json:${pkg}`,
+                                    description: title.substring(0, 35),
+                                });
                             }
                         }
-                        catch { /* JSON parse failed, no vulns */ }
                     }
+                    else {
+                        depsSkipped = 'No package.json found in the scan target; dependency scan could not run.';
+                    }
+                }
+                catch (err) {
+                    depsSkipped = `npm audit could not run: ${err instanceof Error ? err.message : String(err)}`;
                 }
-                catch { /* npm audit failed */ }
             }
             // Phase 2: Scan for hardcoded secrets
             if (scanType === 'all' || scanType === 'code') {
@@ -342,9 +349,14 @@ const scanCommand = {
                         output.writeln(output.dim(`... and ${findings.length - 20} more issues`));
                     }
                 }
+                else if (depsSkipped) {
+                    output.writeln(output.warning('No issues found by the checks that ran, but the dependency scan did not run.'));
+                }
                 else {
                     output.writeln(output.success('No security issues found!'));
                 }
+                if (depsSkipped)
+                    output.writeln(output.warning(`Dependency scan skipped: ${depsSkipped}`));
                 output.writeln();
                 output.printBox([
                     `Target: ${target}`,
@@ -367,6 +379,7 @@ const scanCommand = {
                     low: lowCount,
                     total: findings.length,
                 },
+                ...(depsSkipped ? { incomplete: true, skipped: { deps: depsSkipped } } : {}),
                 findings,
             };
             // Persist the scan result so downstream consumers (the statusline's
@@ -408,6 +421,11 @@ const scanCommand = {
                 output.printJson(record);
             else if (outputFormat === 'sarif')
                 output.printJson(scanSarif(findings));
+            if (depsSkipped) {
+                if (outputFormat !== 'text')
+                    output.printError(`Dependency scan skipped: ${depsSkipped}`);
+                return { success: false, exitCode: 2 };
+            }
             return { success: findings.length === 0 || (criticalCount === 0 && highCount === 0) };
         }
         catch (error) {
@@ -418,6 +436,36 @@ const scanCommand = {
         }
     },
 };
+export function interpretNpmAudit(raw, dir) {
+    let audit;
+    try {
+        audit = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, reason: 'npm audit did not return a JSON report.' };
+    }
+    if (audit && typeof audit === 'object' && audit.error) {
+        const code = typeof audit.error.code === 'string' ? audit.error.code : 'error';
+        const summary = typeof audit.error.summary === 'string' ? audit.error.summary : 'npm audit failed.';
+        return { ok: false, reason: `npm audit failed (${code}): ${summary}${code === 'ENOLOCK' ? auditHint(dir) : ''}` };
+    }
+    if (!audit || typeof audit !== 'object' || !audit.vulnerabilities || typeof audit.vulnerabilities !== 'object' || Array.isArray(audit.vulnerabilities)) {
+        return { ok: false, reason: 'npm audit returned no vulnerability report.' };
+    }
+    return { ok: true, vulnerabilities: audit.vulnerabilities };
+}
+function auditHint(dir) {
+    if (!dir)
+        return '';
+    const has = (f) => existsSync(resolvePath(dir, f));
+    if (has('pnpm-lock.yaml'))
+        return ' This is a pnpm project: run `pnpm audit` instead.';
+    if (has('yarn.lock'))
+        return ' This is a yarn project: run `yarn npm audit` (Berry) or `yarn audit` (v1) instead.';
+    if (has('bun.lock') || has('bun.lockb'))
+        return ' This is a bun project: run `bun audit` instead.';
+    return ' Create one with `npm i --package-lock-only`, or use your package manager\'s audit.';
+}
 // CVE subcommand
 const cveCommand = {
     name: 'cve',
@@ -451,22 +499,20 @@ const cveCommand = {
             // npm audit exits non-zero when vulnerabilities found — stdout still has JSON
             auditJson = (e instanceof Error && 'stdout' in e ? e.stdout : '') || '{}';
         }
-        let audit;
-        try {
-            audit = JSON.parse(auditJson);
-        }
-        catch {
-            output.writeln(output.warning('⚠ Could not parse `npm audit --json` output.'));
-            output.writeln(output.dim('Make sure you are inside a project with a package.json.'));
+        const audit = interpretNpmAudit(auditJson, process.cwd());
+        if (!audit.ok) {
+            output.writeln(output.warning(`⚠ Could not check dependencies: ${audit.reason}`));
+            output.writeln(output.dim('No result is reported rather than a false all-clear.'));
             return { success: false, exitCode: 2 };
         }
-        const vulns = audit.vulnerabilities || {};
+        const vulns = audit.vulnerabilities;
         const cveRows = [];
         const CVE_RE = /CVE-\d{4}-\d{4,7}/g;
         for (const [pkg, v] of Object.entries(vulns)) {
             const sev = v.severity || 'low';
-            const titles = (v.via || []).filter((x) => typeof x === 'object' && x?.title).map((x) => x.title);
-            const urls = (v.via || []).filter((x) => typeof x === 'object' && x?.url).map((x) => x.url);
+            const via = (v.via || []).filter((x) => typeof x === 'object' && x !== null);
+            const titles = via.filter((x) => x.title).map((x) => x.title);
+            const urls = via.filter((x) => x.url).map((x) => x.url);
             const allText = `${titles.join(' ')} ${urls.join(' ')}`;
             const cveIds = Array.from(new Set(allText.match(CVE_RE) || []));
             cveRows.push({ pkg, severity: sev, cveIds, title: titles[0] || 'Vulnerability', url: urls[0] });

package/dist/src/commands/tui.d.ts

@@ -1,6 +1,15 @@
 import type { Command } from '../types.js';
 /** `<own install>/plugins/ruflo-console/dist/tui.mjs`, the first that exists. */
 export declare function locateTuiBundle(startDir?: string): string | null;
+/** The look and motion flags: `--look bbs|orbital|plain` (default bbs, as in the console), `--fps N` (0-30, default 8; 0 draws pictures still), `--no-anim`, `--no-pictures`. A bad value is ignored, never passed on. */
+export declare function lookFlags(flags: Record<string, unknown> | undefined): {
+    look?: string;
+    fps?: number;
+    anim?: boolean;
+    pictures?: boolean;
+    boot?: boolean;
+    mouse?: boolean;
+};
 /** The AI page's settings from the flags (and one environment variable for the endpoint list). Absent flags leave the defaults; a bad number is ignored, never passed on. */
 export declare function aiPage(flags: Record<string, unknown> | undefined): {
     model?: string;