@claude-flow/cli 3.56.9 → 3.57.0

package/dist/src/mcp-tools/neural-tools.js

@@ -452,8 +452,24 @@ export const neuralTools = [
                     patternsStored++;
                 }
             }
+            // #4156: nothing stored means nothing was trained. Reporting success and "ready" made
+            // callers (the neural-train skill) believe the pattern store had been filled.
+            if (patternsStored === 0) {
+                model.status = 'untrained';
+                model.accuracy = 0;
+                saveNeuralStore(store);
+                return {
+                    success: false,
+                    status: 'empty',
+                    modelId,
+                    type: modelType,
+                    patternsStored: 0,
+                    totalPatterns: Object.keys(store.patterns).length,
+                    error: 'neural_train stored nothing: pass `data` (an array of strings or {text, label} entries). It does not read trajectories, SONA or the ReasoningBank: those (hooks_intelligence_*) are a separate store that neural_predict and neural_patterns do not see.',
+                };
+            }
             model.status = 'ready';
-            model.accuracy = patternsStored > 0 ? 1.0 : 0; // accuracy = data stored, not simulated
+            model.accuracy = 1.0; // accuracy = data stored, not simulated
             model.trainedAt = new Date().toISOString();
             saveNeuralStore(store);
             return {
@@ -484,6 +500,7 @@ export const neuralTools = [
                 modelId: { type: 'string', description: 'Model ID to use' },
                 input: { type: 'string', description: 'Input text or data' },
                 topK: { type: 'number', description: 'Number of top predictions' },
+                minSimilarity: { type: 'number', description: 'Minimum cosine similarity for a stored pattern to count as a match (default 0.5). A softmax over a single candidate is always 1.0, so without a floor any input matched the only stored pattern with confidence 1' },
             },
             required: ['input'],
         },
@@ -502,6 +519,7 @@ export const neuralTools = [
             const modelId = input.modelId;
             const inputText = input.input;
             const topK = input.topK || 3;
+            const minSimilarity = typeof input.minSimilarity === 'number' ? input.minSimilarity : 0.5;
             // Find model or use default
             const model = modelId ? store.models[modelId] : Object.values(store.models).find(m => m.status === 'ready');
             if (model && model.status !== 'ready') {
@@ -519,9 +537,10 @@ export const neuralTools = [
             // to 1, and we surface enough metadata to trust the result.
             const storedPatterns = Object.values(store.patterns);
             let predictions;
+            let bestSimilarity = null;
             if (storedPatterns.length > 0) {
                 // Step 1: k-NN with cosine
-                const scored = storedPatterns
+                let scored = storedPatterns
                     .map(p => {
                     const sim = cosineSimilarity(embedding, p.embedding);
                     return {
@@ -530,8 +549,10 @@ export const neuralTools = [
                         cosineSimilarity: sim,
                     };
                 })
-                    .sort((a, b) => b.cosineSimilarity - a.cosineSimilarity)
-                    .slice(0, topK);
+                    .sort((a, b) => b.cosineSimilarity - a.cosineSimilarity);
+                bestSimilarity = scored[0]?.cosineSimilarity ?? null;
+                // #4156: only patterns that reach the similarity floor are candidates.
+                scored = scored.filter((c) => c.cosineSimilarity >= minSimilarity).slice(0, topK);
                 // Step 2: temperature-softmax over the top-K so confidence sums to 1.
                 // Temperature 0.1 sharpens differences between similar candidates.
                 const tau = 0.1;
@@ -569,8 +590,11 @@ export const neuralTools = [
                 embedding: embedding.slice(0, 8), // Preview of embedding
                 embeddingDims: embedding.length,
                 latency,
+                ...(bestSimilarity !== null ? { bestSimilarity: Number(bestSimilarity.toFixed(4)), minSimilarity } : {}),
                 ...(storedPatterns.length === 0 ? {
                     _note: 'No patterns stored. Train with neural_train(modelType, trainingData) before predicting.',
+                } : predictions.length === 0 ? {
+                    _note: `No stored pattern reached the similarity floor (best ${bestSimilarity === null ? 'n/a' : bestSimilarity.toFixed(3)}, floor ${minSimilarity}); pass minSimilarity to lower it.`,
                 } : {}),
             };
         },
@@ -884,9 +908,6 @@ export const neuralTools = [
                 if (!v.valid)
                     return { success: false, error: v.error };
             }
-            // Resolve provider so embeddingProvider in the result matches the old
-            // eager-init reporting.
-            await ensureEmbeddings();
             const store = loadNeuralStore();
             const method = input.method || 'quantize';
             const targetReduction = input.targetSize || 0.5;
@@ -895,38 +916,25 @@ export const neuralTools = [
                 return { success: false, error: 'No patterns to compress. Train patterns first with neural_train.' };
             }
             const beforeCount = patterns.length;
-            const beforeSize = patterns.reduce((s, p) => s + (p.embedding?.length || 0) * 4, 0); // Float32 = 4 bytes
             if (method === 'quantize') {
-                try {
-                    const { quantizeInt8, getQuantizationStats } = await import('../memory/memory-initializer.js');
-                    let totalCompressed = 0;
-                    for (const pattern of patterns) {
-                        if (pattern.embedding && pattern.embedding.length > 0) {
-                            const stats = getQuantizationStats(pattern.embedding);
-                            const quantized = quantizeInt8(pattern.embedding);
-                            // Store quantized metadata (keep original embedding for search)
-                            pattern._quantized = {
-                                scale: quantized.scale,
-                                zeroPoint: quantized.zeroPoint,
-                                compressionRatio: stats.compressionRatio,
-                            };
-                            totalCompressed++;
-                        }
-                    }
-                    saveNeuralStore(store);
-                    return {
-                        success: true, _real: true, method,
-                        embeddingProvider: embeddingServiceName,
-                        patternsCompressed: totalCompressed,
-                        compressionRatio: '3.92x (Int8)',
-                        beforeBytes: beforeSize,
-                        afterBytes: Math.round(beforeSize / 3.92),
-                    };
-                }
-                catch {
-                    return { success: false, error: 'Quantization requires memory-initializer. Run `memory init` first.' };
-                }
+                // Neural-store readers consume `embedding` as a full-precision number[]
+                // (search, prediction, deduplication, and optimization). The former
+                // implementation discarded the Int8 vector, persisted only metadata,
+                // and reported a calculated 3.92x reduction. Refuse until the store has
+                // a persisted representation with a reader-side decode contract.
+                const storedBytes = readFileSync(getNeuralPath()).byteLength;
+                return {
+                    success: false,
+                    error: 'Quantized embeddings are not persisted: neural-store readers require full-precision embedding arrays.',
+                    method,
+                    patternsCompressed: 0,
+                    beforeBytes: storedBytes,
+                    afterBytes: storedBytes,
+                    compressionRatio: '1.00x (unchanged JSON storage)',
+                };
             }
+            // Resolve provider only for operations that actually use embeddings.
+            await ensureEmbeddings();
             if (method === 'prune') {
                 // Prune patterns with low usage count below threshold (targetReduction as min usage)
                 const threshold = targetReduction;
@@ -1112,24 +1120,10 @@ export const neuralTools = [
                 if (duplicatesRemoved > 0)
                     actions.push(`Removed ${duplicatesRemoved} near-duplicate patterns`);
             }
-            // memory / balanced: quantize large embeddings
+            // memory / balanced: report the unsupported persisted representation
+            // instead of attaching metadata for a discarded Int8 vector.
             if (target === 'memory' || target === 'balanced') {
-                try {
-                    const { quantizeInt8, getQuantizationStats } = await import('../memory/memory-initializer.js');
-                    for (const p of Object.values(store.patterns)) {
-                        if (p.embedding && p.embedding.length > 0 && !p._quantized) {
-                            const stats = getQuantizationStats(p.embedding);
-                            const q = quantizeInt8(p.embedding);
-                            p._quantized = { scale: q.scale, zeroPoint: q.zeroPoint, compressionRatio: stats.compressionRatio };
-                            patternsQuantized++;
-                        }
-                    }
-                    if (patternsQuantized > 0)
-                        actions.push(`Quantized ${patternsQuantized} pattern embeddings (Int8, ~3.92x)`);
-                }
-                catch {
-                    actions.push('Quantization skipped (memory-initializer not available)');
-                }
+                actions.push('Quantization skipped: neural-store readers require persisted full-precision embedding arrays.');
             }
             // accuracy / balanced: prune low-usage, zero-embedding patterns
             if (target === 'accuracy' || target === 'balanced') {

package/dist/src/mcp-tools/policy-tools.js

@@ -24,9 +24,11 @@ export const policyTools = [
         category: 'security',
         inputSchema: {
             type: 'object',
-            properties: {},
+            properties: {
+                full: { type: 'boolean', description: 'Also replay the archived receipts to verify the complete historical ledger, not just the retained hot tail (#3164)' },
+            },
         },
-        handler: async (_input, context) => {
+        handler: async (input, context) => {
             const root = typeof context?.projectRoot === 'string' ? context.projectRoot : process.cwd();
             const state = loadPolicyState(root);
             return {
@@ -39,7 +41,7 @@ export const policyTools = [
                     approvals: state.approvals.length,
                     receipts: state.receipts.length,
                 },
-                ledger: await verifyPolicyLedger(root),
+                ledger: await verifyPolicyLedger(root, { full: input.full === true }),
             };
         },
     },

package/dist/src/mcp-tools/ruvllm-tools.js

@@ -43,7 +43,13 @@ export const ruvllmWasmTools = [
                     nativeBackend = {
                         available: iStats._ruvllmBackend === 'active',
                         coordinator: iStats._ruvllmBackend || 'unavailable',
+                        // `trajectories` is the in-process SonaCoordinator buffer — it is
+                        // 0 in any process that did not itself record (e.g. this MCP
+                        // server while the daemon / hook processes do the recording).
                         trajectories: iStats._ruvllmTrajectories || 0,
+                        // Project-persisted total across all processes
+                        // (.claude-flow/neural/stats.json).
+                        trajectoriesRecorded: iStats.trajectoriesRecorded || 0,
                         contrastiveTrainer: sStats._contrastiveTrainer !== 'unavailable' ? 'active' : 'unavailable',
                         trainingBackend: iStats._trainingBackend || 'unknown',
                     };

package/dist/src/mcp-tools/security-tools.js

@@ -12,6 +12,7 @@
 import { validateText, validateIdentifier } from './validate-input.js';
 import { autoInstallPackage } from './auto-install.js';
 import { createRequire } from 'module';
+import { findKnownMiss, recordKnownMiss } from './aidefence-known-misses.js';
 // Create require for resolving module paths
 const require = createRequire(import.meta.url);
 // Lazy-loaded AIDefence instance
@@ -152,7 +153,8 @@ const aidefenceScanTool = {
                     piiPresent = !!defender.hasPII(input);
                 }
                 catch { /* hasPII unavailable */ }
-                const threatDetected = result.threat || piiPresent;
+                const knownMiss = findKnownMiss(input);
+                const threatDetected = result.threat || piiPresent || !!knownMiss;
                 wrapperStats.quickScanCalls++;
                 if (threatDetected)
                     wrapperStats.quickScanThreats++;
@@ -164,24 +166,29 @@ const aidefenceScanTool = {
                                 threatDetected,
                                 confidence: result.confidence,
                                 piiDetected: piiPresent,
-                                promptInjectionDetected: result.threat,
+                                promptInjectionDetected: result.threat || !!knownMiss,
+                                ...(knownMiss ? { knownMiss: { threatType: knownMiss.threatType, reportedAt: knownMiss.reportedAt } } : {}),
                                 mode: 'quick',
                             }, null, 2),
                         }],
                 };
             }
             const result = await defender.detect(input);
+            const knownMiss = findKnownMiss(input);
             return {
                 content: [{
                         type: 'text',
                         text: JSON.stringify({
-                            safe: result.safe,
-                            threats: result.threats.map(t => ({
-                                type: t.type,
-                                severity: t.severity,
-                                confidence: t.confidence,
-                                description: t.description,
-                            })),
+                            safe: result.safe && !knownMiss,
+                            threats: [
+                                ...result.threats.map(t => ({
+                                    type: t.type,
+                                    severity: t.severity,
+                                    confidence: t.confidence,
+                                    description: t.description,
+                                })),
+                                ...(knownMiss ? [{ type: knownMiss.threatType, severity: 'high', confidence: 1, description: 'Matches an input previously reported as a missed threat (aidefence_learn)' }] : []),
+                            ],
                             piiFound: result.piiFound,
                             detectionTimeMs: result.detectionTimeMs,
                         }, null, 2),
@@ -398,11 +405,33 @@ const aidefenceLearnTool = {
             const defender = await getAIDefence();
             // Re-detect to get result for learning
             const result = await defender.detect(input);
-            // Learn from detection
-            await defender.learnFromDetection(input, result, {
-                wasAccurate,
-                userVerdict: verdict,
-            });
+            // A false negative (wasAccurate=false, nothing detected) gives
+            // learnFromDetection() no threat to store, so record the miss itself.
+            const falseNegative = !wasAccurate && result.threats.length === 0;
+            const missType = threatType || 'prompt_injection';
+            let learned = result.threats.length;
+            let newlyRecorded = false;
+            if (falseNegative) {
+                newlyRecorded = recordKnownMiss(input, missType);
+                if (newlyRecorded) {
+                    const synthetic = {
+                        ...result,
+                        safe: false,
+                        threats: [{
+                                type: missType,
+                                severity: 'high',
+                                confidence: 1,
+                                pattern: 'user-reported-miss',
+                                description: verdict || 'Reported by user as a missed threat',
+                            }],
+                    };
+                    await defender.learnFromDetection(input, synthetic, { wasAccurate, userVerdict: verdict });
+                }
+                learned = 1;
+            }
+            else {
+                await defender.learnFromDetection(input, result, { wasAccurate, userVerdict: verdict });
+            }
             // Record mitigation if provided
             if (threatType && mitigationStrategy && mitigationSuccess !== undefined) {
                 await defender.recordMitigation(threatType, mitigationStrategy, mitigationSuccess);
@@ -412,7 +441,14 @@ const aidefenceLearnTool = {
                         type: 'text',
                         text: JSON.stringify({
                             success: true,
-                            message: 'Feedback recorded for pattern learning',
+                            message: falseNegative
+                                ? (newlyRecorded
+                                    ? 'Missed threat recorded: this exact input (normalised for case/whitespace) will now be flagged by aidefence_scan and aidefence_is_safe. Detection is pattern-based and does not generalise from it.'
+                                    : 'This input was already recorded as a missed threat')
+                                : (learned === 0
+                                    ? 'Feedback noted, but no threat was detected so no pattern was learned. To teach a missed threat, pass wasAccurate=false.'
+                                    : 'Feedback recorded for pattern learning'),
+                            learned,
                             learnedFrom: {
                                 input: input.slice(0, 50) + (input.length > 50 ? '...' : ''),
                                 wasAccurate,
@@ -468,7 +504,8 @@ const aidefenceIsSafeTool = {
                 piiPresent = !!defender.hasPII(input);
             }
             catch { /* hasPII unavailable */ }
-            const safe = promptSafe && !piiPresent;
+            const knownMiss = findKnownMiss(input);
+            const safe = promptSafe && !piiPresent && !knownMiss;
             wrapperStats.isSafeCalls++;
             if (!safe)
                 wrapperStats.isSafeUnsafeVerdicts++;
@@ -477,8 +514,9 @@ const aidefenceIsSafeTool = {
                         type: 'text',
                         text: JSON.stringify({
                             safe,
-                            promptSafe,
+                            promptSafe: promptSafe && !knownMiss,
                             piiPresent,
+                            ...(knownMiss ? { knownMiss: { threatType: knownMiss.threatType, reportedAt: knownMiss.reportedAt } } : {}),
                         }, null, 2),
                     }],
             };

package/dist/src/mcp-tools/workflow-tools.js

@@ -12,6 +12,35 @@ import { executeAgentTask } from './agent-execute-core.js';
 const STORAGE_DIR = '.claude-flow';
 const WORKFLOW_DIR = 'workflows';
 const WORKFLOW_FILE = 'store.json';
+function parseCondition(when) {
+    if (typeof when !== 'string' || !when.trim()) {
+        return new Error('condition step requires a non-empty config.when');
+    }
+    const expression = when.trim();
+    if (expression === 'true' || expression === 'false') {
+        return { constant: expression === 'true' };
+    }
+    const match = expression.match(/^([a-zA-Z_]\w*)\s*===?\s*(?:'([^']*)'|"([^"]*)"|(-?\d+(?:\.\d+)?)|(true|false))$/);
+    if (!match) {
+        return new Error('condition config.when must compare a variable to a quoted string, number, or boolean using == or ===');
+    }
+    const expected = match[2] ?? match[3] ?? (match[4] !== undefined ? Number(match[4]) : match[5] === 'true');
+    return { variable: match[1], expected };
+}
+function validateExecutableStep(step) {
+    if (step.type === 'parallel' || step.type === 'loop') {
+        return `step type '${step.type}' is not implemented by the workflow runtime`;
+    }
+    if (step.type === 'condition') {
+        const parsed = parseCondition(step.config?.when);
+        if (parsed instanceof Error)
+            return parsed.message;
+    }
+    else if (step.type !== 'task' && step.type !== 'wait') {
+        return `unsupported workflow step type '${step.type}'`;
+    }
+    return undefined;
+}
 function getWorkflowDir() {
     return join(getProjectCwd(), STORAGE_DIR, WORKFLOW_DIR);
 }
@@ -181,8 +210,8 @@ export const workflowTools = [
                         type: 'object',
                         properties: {
                             name: { type: 'string' },
-                            type: { type: 'string', enum: ['task', 'condition', 'parallel', 'loop', 'wait'] },
-                            config: { type: 'object' },
+                            type: { type: 'string', enum: ['task', 'condition', 'wait'] },
+                            config: { type: 'object', description: 'Condition steps require config.when; parallel and loop steps are not yet supported' },
                         },
                     },
                 },
@@ -209,6 +238,11 @@ export const workflowTools = [
                 config: s.config || {},
                 status: 'pending',
             }));
+            for (const step of steps) {
+                const error = validateExecutableStep(step);
+                if (error)
+                    return { success: false, error: `${step.stepId} (${step.name}): ${error}` };
+            }
             const workflow = {
                 workflowId,
                 name: input.name,
@@ -257,6 +291,20 @@ export const workflowTools = [
             if (workflow.status === 'running') {
                 return { workflowId, error: 'Workflow already running' };
             }
+            // Older stored workflows may predate creation-time validation. Reject
+            // unsupported steps before dispatching any task with side effects.
+            for (const step of workflow.steps) {
+                const error = validateExecutableStep(step);
+                if (error) {
+                    workflow.status = 'failed';
+                    workflow.error = `${step.stepId} (${step.name}): ${error}`;
+                    step.status = 'failed';
+                    step.result = { error: workflow.error };
+                    workflow.completedAt = new Date().toISOString();
+                    saveWorkflowStore(store);
+                    return { workflowId, status: 'failed', failedStep: step.stepId, error: workflow.error };
+                }
+            }
             // Indices may name a step or the end boundary (used when resuming
             // after the final step). Reject invalid control flow before any writes.
             const validIndex = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= workflow.steps.length;
@@ -382,19 +430,14 @@ export const workflowTools = [
                         stepEntry = { stepId: step.stepId, type: 'wait', status: 'completed', durationMs: ms };
                     }
                     else if (step.type === 'condition') {
-                        // Simple condition: config.when is a JS expression evaluated against workflow.variables.
-                        // For safety, we only support `var === 'value'` or `var === number`.
                         const cfg = step.config;
-                        const expr = String(cfg.when || 'true').trim();
-                        const m = expr.match(/^([a-zA-Z_][\w]*)\s*===?\s*(['\"])?([^'\"]*)\2?$/);
-                        let truthy = false;
-                        if (m) {
-                            const v = workflow.variables[m[1]];
-                            const expected = m[2] ? m[3] : Number(m[3]);
-                            truthy = v === expected;
-                        }
-                        else if (expr === 'true')
-                            truthy = true;
+                        const parsed = parseCondition(cfg.when);
+                        if (parsed instanceof Error)
+                            throw parsed;
+                        const truthy = 'constant' in parsed
+                            ? parsed.constant
+                            : workflow.variables[parsed.variable] === parsed.expected;
+                        const expr = String(cfg.when).trim();
                         step.result = { conditionExpr: expr, truthy };
                         // condition can declare a target step index to jump to via cfg.thenStep / cfg.elseStep
                         if (typeof cfg.thenStep === 'number' && truthy)
@@ -404,9 +447,7 @@ export const workflowTools = [
                         stepEntry = { stepId: step.stepId, type: 'condition', status: 'completed' };
                     }
                     else {
-                        // parallel/loop are deferred — mark skipped honestly rather than mock-completing.
-                        step.result = { _note: `step type '${step.type}' not yet implemented in runtime` };
-                        stepEntry = { stepId: step.stepId, type: step.type, status: 'skipped' };
+                        throw new Error(`step type '${step.type}' is not implemented by the workflow runtime`);
                     }
                     step.status = stepEntry.status === 'skipped' ? 'skipped' : 'completed';
                     step.completedAt = new Date().toISOString();
@@ -906,6 +947,14 @@ export const workflowTools = [
                         const agentSet = new Set();
                         steps.forEach((s, i) => {
                             const step = (s ?? {});
+                            if (typeof step.type === 'string') {
+                                const error = validateExecutableStep({
+                                    type: step.type,
+                                    config: (step.config ?? {}),
+                                });
+                                if (error)
+                                    errors.push({ line: i + 1, message: `step ${i + 1}: ${error}`, severity: 'error' });
+                            }
                             // Match workflow_execute: control steps do not dispatch agents,
                             // and task steps use config.agentId or the workflow default.
                             const config = step.config;

package/dist/src/memory/intelligence.d.ts

@@ -175,8 +175,12 @@ declare class LocalReasoningBank {
      * Deduplicates by content: if a pattern with the same content already
      * exists, the existing entry is updated (bumped usageCount, higher
      * confidence wins, refreshed lastUsedAt) instead of adding a duplicate.
+     *
+     * Returns true only when a NEW pattern was added (#3979 item 4): callers that
+     * keep a "patterns learned" counter must not count a merge or an update of an
+     * existing pattern as a newly learned one.
      */
-    store(pattern: Omit<StoredPattern, 'usageCount' | 'createdAt' | 'lastUsedAt'> & Partial<StoredPattern>): void;
+    store(pattern: Omit<StoredPattern, 'usageCount' | 'createdAt' | 'lastUsedAt'> & Partial<StoredPattern>): boolean;
     /**
      * Find similar patterns by embedding.
      *