@claude-flow/cli 3.59.17 → 3.60.0

package/.claude/helpers/.helpers-version

@@ -1 +1 @@
-3.57.1
+3.59.17

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.59.17",
+    "version": "3.60.0",
     "files": {
       "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
       "hook-handler.cjs": "24502a3bcb78770971147940515c992e35b6736ae14ee2dc54e07d4cdef6a1d8",
@@ -9,6 +9,6 @@
       "router.cjs": "16648b3c0d73b6681ac2d8d13def6a68286c57f5a11004de5b19a0fa088c833d"
     }
   },
-  "signature": "WEe3Qca2Em0MEclN+uTae/yTPDwdrLx3HpKW6F3c2v1kA01PUCqSWtMBErDztcgdXum4tg8EGQGxFnU1VYh7Aw==",
+  "signature": "b9szLUO3BqVyn5KCnvZxUamxS/mMeVx0nel+X3AH77zUfO/t060rj9mOtUfAWHhNeXH3mGuqvR4nrKXa58t/Dg==",
   "algorithm": "ed25519"
 }

package/README.md

@@ -8,6 +8,7 @@
 [![npm version (ruflo)](https://img.shields.io/npm/v/ruflo?label=npx%20ruflo&style=for-the-badge&logo=npm&color=cb3837)](https://www.npmjs.com/package/ruflo)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://opensource.org/licenses/MIT)
 [![Star on GitHub](https://img.shields.io/github/stars/ruvnet/claude-flow?style=for-the-badge&logo=github&color=gold)](https://github.com/ruvnet/claude-flow)
+[![Follow @rUv on X](https://img.shields.io/badge/Follow-@rUv-000000?style=for-the-badge&logo=x&logoColor=white)](https://x.com/rUv)
 
 <p align="center">
 <a href="docs/harness-origins.md"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/e69e4b95aa08d65ea0f7715489bbf8e62a83a0d2/docs/assets/readme/badges/first-commit.svg" width="300" height="76" alt="Claude Flow lineage: first commit June 2, 2025 by rUv; inspect the evidence"></a>
@@ -242,7 +243,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
 | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
 | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
-| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.11/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
+| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.12/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
 
 #### Security & Compliance
 

package/catalog-manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-22T13:20:46.587Z",
-  "gitSha": "8b200962",
+  "generatedAt": "2026-10-23T17:21:46.374Z",
+  "gitSha": "7402c321",
   "catalog": {
-    "agents": 176,
-    "tools": 432,
+    "agents": 177,
+    "tools": 438,
     "skills": 34
   },
   "benchmark": null

package/dist/src/commands/agntcy/publish.js

@@ -87,7 +87,7 @@ const publishCommand = {
         }
         // Step 2 (stub, requires the not-yet-published runtime): the actual
         // Directory publish call.
-        const status = await detectAgntcyRuntime();
+        const status = await detectAgntcyRuntime(process.env, AGNTCY_PACKAGE_NAME, ['publishAgentRecord']);
         if (!status.configured) {
             output.printInfo(AGNTCY_NOT_CONFIGURED_MESSAGE);
             output.printInfo(`Validated OASF record at "${manifestPath}" locally (name=${parsed.name}, ` +

package/dist/src/commands/agntcy/runtime.d.ts

@@ -107,6 +107,9 @@ export interface AgntcyRuntimeStatus {
  * @param packageName Injectable for tests (to simulate "package not
  *   installed" without needing to actually uninstall the real optional
  *   dependency); defaults to {@link AGNTCY_PACKAGE_NAME}.
+ * @param requiredExports Function names the caller will use. A resolved module
+ *   missing any of them is reported as not configured, with the missing names
+ *   in `reason`, instead of failing later at the call site.
  */
-export declare function detectAgntcyRuntime(env?: NodeJS.ProcessEnv, packageName?: string): Promise<AgntcyRuntimeStatus>;
+export declare function detectAgntcyRuntime(env?: NodeJS.ProcessEnv, packageName?: string, requiredExports?: readonly string[]): Promise<AgntcyRuntimeStatus>;
 //# sourceMappingURL=runtime.d.ts.map

package/dist/src/commands/agntcy/runtime.js

@@ -100,8 +100,11 @@ export const AGNTCY_NOT_CONFIGURED_MESSAGE = `AGNTCY/SLIM transport is not confi
  * @param packageName Injectable for tests (to simulate "package not
  *   installed" without needing to actually uninstall the real optional
  *   dependency); defaults to {@link AGNTCY_PACKAGE_NAME}.
+ * @param requiredExports Function names the caller will use. A resolved module
+ *   missing any of them is reported as not configured, with the missing names
+ *   in `reason`, instead of failing later at the call site.
  */
-export async function detectAgntcyRuntime(env = process.env, packageName = AGNTCY_PACKAGE_NAME) {
+export async function detectAgntcyRuntime(env = process.env, packageName = AGNTCY_PACKAGE_NAME, requiredExports = []) {
     const endpoint = env[AGNTCY_ENDPOINT_ENV];
     if (!endpoint) {
         return { configured: false, reason: `${AGNTCY_ENDPOINT_ENV} is not set` };
@@ -112,7 +115,17 @@ export async function detectAgntcyRuntime(env = process.env, packageName = AGNTC
         // `await import('pg')`). Never a static `import` — a static import
         // would make @claude-flow/cli fail to build/run when the package is
         // absent, which is the one thing ADR-150/ADR-380 forbid.
-        await import(packageName);
+        const mod = await import(packageName);
+        if (requiredExports.length > 0) {
+            const missing = requiredExports.filter((name) => typeof mod[name] !== 'function');
+            if (missing.length > 0) {
+                return {
+                    configured: false,
+                    reason: `${packageName} resolved but does not export ${missing.join(', ')}; the installed SDK API is not the one this command implements`,
+                    endpoint,
+                };
+            }
+        }
         return { configured: true, reason: `${packageName} resolved`, endpoint };
     }
     catch (error) {

package/dist/src/commands/agntcy/swarm-join.js

@@ -54,7 +54,7 @@ const joinCommand = {
             output.printError(`Invalid namespace "${namespace}": ${nsCheck.error}`);
             return { success: false, exitCode: 1 };
         }
-        const status = await detectAgntcyRuntime();
+        const status = await detectAgntcyRuntime(process.env, AGNTCY_PACKAGE_NAME, ['joinGroup']);
         if (!status.configured) {
             output.printInfo(AGNTCY_NOT_CONFIGURED_MESSAGE);
             output.printInfo(`Namespace "${namespace}" was not joined via SLIM. Local swarm/hive-mind coordination ` +

package/dist/src/commands/agntcy/transport.js

@@ -37,7 +37,7 @@ const useCommand = {
             output.printInfo('Local transport remains the default and needs no explicit "use".');
             return { success: false, exitCode: 1 };
         }
-        const status = await detectAgntcyRuntime();
+        const status = await detectAgntcyRuntime(process.env, AGNTCY_PACKAGE_NAME, ['createSlimTransport']);
         if (!status.configured) {
             output.printInfo(AGNTCY_NOT_CONFIGURED_MESSAGE);
             output.printInfo('Active transport remains: local (in-process hooks routing).');

package/dist/src/commands/update.js

@@ -110,6 +110,8 @@ const allCommand = {
     ],
     async action(ctx) {
         const { flags } = ctx;
+        // The parser stores `--dry-run` as `dryRun`.
+        const dryRun = flags.dryRun === true || flags['dry-run'] === true;
         process.env.CLAUDE_FLOW_FORCE_UPDATE = 'true';
         try {
             output.printInfo('Checking for updates...');
@@ -135,14 +137,14 @@ const allCommand = {
                 }
             }
             output.printInfo(`Updating ${results.length} package(s)...`);
-            const updateResults = await executeMultipleUpdates(results, installedPackages, flags['dry-run']);
+            const updateResults = await executeMultipleUpdates(results, installedPackages, dryRun);
             const successful = updateResults.filter((r) => r.success);
             const failed = updateResults.filter((r) => !r.success);
             output.writeln();
-            output.writeln(output.highlight(flags['dry-run'] ? '═══ Dry Run - Would Update ═══' : '═══ Update Results ═══'));
+            output.writeln(output.highlight(dryRun ? '═══ Dry Run - Would Update ═══' : '═══ Update Results ═══'));
             output.writeln();
             if (successful.length > 0) {
-                output.printSuccess(`${successful.length} package(s) ${flags['dry-run'] ? 'would be ' : ''}updated:`);
+                output.printSuccess(`${successful.length} package(s) ${dryRun ? 'would be ' : ''}updated:`);
                 for (const r of successful) {
                     output.writeln(`  ${output.success('✓')} ${r.package}@${r.version}`);
                 }

package/dist/src/mcp-client.js

@@ -33,6 +33,9 @@ import { performanceTools } from './mcp-tools/performance-tools.js';
 import { githubTools } from './mcp-tools/github-tools.js';
 import { daaTools } from './mcp-tools/daa-tools.js';
 import { coordinationTools } from './mcp-tools/coordination-tools.js';
+// ruRE Phase 1 (plugins/ruflo-rure ADR-0001/0002) — JS/Electron static
+// analysis. Always registered: pure-TS, no native engine dependency.
+import { rureTools } from './mcp-tools/rure-tools.js';
 import { browserTools } from './mcp-tools/browser-tools.js';
 import { browserSessionTools } from './mcp-tools/browser-session-tools.js';
 // ADR-175 — page-agent natural-language intent layer (browser_act). Always
@@ -150,6 +153,7 @@ registerTools([
     ...githubTools,
     ...daaTools,
     ...coordinationTools,
+    ...rureTools,
     ...getBrowserTools(),
     ...getBrowserSessionTools(),
     ...getBrowserIntentTools(),

package/dist/src/mcp-tools/agentbbs-tools.js

@@ -98,6 +98,13 @@ function validateRoomId(roomId) {
     if (!/^[A-Za-z0-9_.\-:/@#]+$/.test(roomId)) {
         throw new Error('roomId may only contain [A-Za-z0-9_.\\-:/@#]');
     }
+    // `.` and `/` are allowed chars, so reject `..` explicitly. The roomId is
+    // joined into a file path in roomLogPath; without this check a value like
+    // ../../../../tmp/x escapes the .agentbbs directory. Matches the validator
+    // in agentbbs-federation.ts.
+    if (roomId.includes('..')) {
+        throw new Error('roomId must not contain ..');
+    }
     return roomId;
 }
 function ensureDir(dir) {

package/dist/src/mcp-tools/capability-brain.js

@@ -411,6 +411,22 @@ export const CAPABILITY_DOMAINS = [
         useWhen: 'Interacting with web surfaces or testing endpoints under explicit network policy.',
         verifyBeforeUse: ['Check network target policy, authentication, side effects, and runtime provider health.'],
     },
+    {
+        id: 'reverse-engineering',
+        name: 'Reverse Engineering (ruRE)',
+        prefixes: ['rure_'],
+        description: 'Static JS/Electron analysis: evidence-sourced module/import/export graphs and Electron process-boundary detection. Parses only, never executes analyzed code; Phase 1 of ADR-0001 — native binary, .NET, EVM and dynamic-instrumentation analysis are future phases.',
+        taskSignals: ['reverse engineer', 'how does this feature work', 'electron app', 'asar', 'decompile', 'static analysis'],
+        commands: [],
+        skills: ['analyze-app'],
+        agents: ['reverse-engineer'],
+        maturity: 'experimental',
+        authority: 'capability-plane',
+        risk: 'reversible',
+        riskFlags: ['read', 'local-write', 'credential-pii'],
+        useWhen: 'Understanding or reimplementing a feature from a local app you are authorized to study; refuses DRM/license-circumvention requests.',
+        verifyBeforeUse: ['Confirm authorization context (own app, licensed target, or research/CTF). Never trust redacted-content markers as absent data — report them as withheld.'],
+    },
     {
         id: 'github-delivery',
         name: 'GitHub & Delivery',
@@ -554,6 +570,7 @@ const TOOL_OWNERSHIP = [
     { prefixes: ['guidance_'], packageOwner: '@claude-flow/guidance', pluginOwner: 'ruflo-core' },
     { prefixes: ['seraphina_'], packageOwner: '@claude-flow/cli', pluginOwner: 'ruflo-core' },
     { prefixes: ['x_federation_'], packageOwner: '@claude-flow/cli', pluginOwner: 'ruflo-x-gateway' },
+    { prefixes: ['rure_'], packageOwner: '@claude-flow/cli', pluginOwner: 'ruflo-rure' },
     { prefixes: ['team_'], packageOwner: '@claude-flow/cli' },
 ];
 function ownershipForTool(toolName, definition) {

package/dist/src/mcp-tools/daa-tools.js

@@ -151,26 +151,34 @@ export const daaTools = [
             if (!agent) {
                 return { success: false, error: 'Agent not found' };
             }
-            const performanceScore = input.performanceScore || 0.8;
+            // #4426: `|| 0.8` turned a failing 0 (and a missing score) into a 0.8
+            // success. A given score must be in [0, 1]; a missing one records none.
+            const performanceScore = input.performanceScore === undefined ? null : input.performanceScore;
+            if (performanceScore !== null && (typeof performanceScore !== 'number' || !Number.isFinite(performanceScore) || performanceScore < 0 || performanceScore > 1)) {
+                return { success: false, error: 'performanceScore must be a number between 0 and 1' };
+            }
             // Update agent metrics
             agent.metrics.adaptations++;
-            agent.metrics.successRate = (agent.metrics.successRate + performanceScore) / 2;
+            if (performanceScore !== null)
+                agent.metrics.successRate = (agent.metrics.successRate + performanceScore) / 2;
             agent.lastActivity = new Date().toISOString();
             agent.status = 'active';
             saveDAAStore(store);
             // Store adaptation feedback in AgentDB for pattern learning (backward compat: JSON store above)
             let _storedIn = 'json-store';
-            try {
-                const bridge = await import('../memory/memory-bridge.js');
-                await bridge.bridgeRecordFeedback({
-                    taskId: `adapt-${agentId}-${agent.metrics.adaptations}`,
-                    success: performanceScore >= 0.5,
-                    quality: performanceScore,
-                    agent: agentId,
-                });
-                _storedIn = 'agentdb';
+            if (performanceScore !== null) {
+                try {
+                    const bridge = await import('../memory/memory-bridge.js');
+                    await bridge.bridgeRecordFeedback({
+                        taskId: `adapt-${agentId}-${agent.metrics.adaptations}`,
+                        success: performanceScore >= 0.5,
+                        quality: performanceScore,
+                        agent: agentId,
+                    });
+                    _storedIn = 'agentdb';
+                }
+                catch { /* AgentDB not available */ }
             }
-            catch { /* AgentDB not available */ }
             return {
                 success: true,
                 agentId,

package/dist/src/mcp-tools/github-tools.js

@@ -70,17 +70,25 @@ function run(cmd, cwd) {
  * strings stay literal.
  */
 function runArgv(file, args, cwd) {
+    const r = runArgvResult(file, args, cwd);
+    return 'out' in r ? r.out : null;
+}
+/** runArgv that keeps the failure text (stderr, else the error message) for reporting. */
+function runArgvResult(file, args, cwd) {
     try {
-        return execFileSync(file, args, {
-            encoding: 'utf-8',
-            timeout: 15000,
-            cwd: cwd || getProjectCwd(),
-            stdio: ['pipe', 'pipe', 'pipe'],
-            shell: false,
-        }).trim();
+        return {
+            out: execFileSync(file, args, {
+                encoding: 'utf-8',
+                timeout: 15000,
+                cwd: cwd || getProjectCwd(),
+                stdio: ['pipe', 'pipe', 'pipe'],
+                shell: false,
+            }).trim(),
+        };
     }
-    catch {
-        return null;
+    catch (err) {
+        const e = err;
+        return { error: String(e.stderr ?? '').trim() || e.message || 'unknown error' };
     }
 }
 /**
@@ -255,9 +263,12 @@ export const githubTools = [
             const store = loadGitHubStore();
             const action = input.action || 'list';
             const gh = hasGhCli();
+            // #4424: like #2963 for issues — owner/repo were validated but never
+            // passed to `gh`, so PR actions (including merge/close) hit the cwd's repo.
+            const repoArgs = input.owner && input.repo ? ['--repo', `${input.owner}/${input.repo}`] : [];
             if (action === 'list') {
                 if (gh) {
-                    const raw = run('gh pr list --state all --limit 20 --json number,title,state,headRefName,createdAt');
+                    const raw = runArgv('gh', ['pr', 'list', '--state', 'all', '--limit', '20', '--json', 'number,title,state,headRefName,createdAt', ...repoArgs]);
                     if (raw) {
                         try {
                             const prs = JSON.parse(raw);
@@ -285,6 +296,7 @@ export const githubTools = [
                         '--base', baseBranch,
                         '--head', headBranch,
                         '--body', body,
+                        ...repoArgs,
                     ]);
                     if (result) {
                         return { success: true, _real: true, action: 'created', url: result };
@@ -306,6 +318,7 @@ export const githubTools = [
                     const raw = runArgv('gh', [
                         'pr', 'view', String(prNumber),
                         '--json', 'number,title,state,body,additions,deletions,changedFiles,reviews,mergeable,statusCheckRollup',
+                        ...repoArgs,
                     ]);
                     if (raw) {
                         try {
@@ -316,36 +329,28 @@ export const githubTools = [
                 }
                 return { success: false, error: prNumber ? 'gh CLI not available or PR not found. Install gh: https://cli.github.com' : 'prNumber is required (positive integer) for review.' };
             }
-            if (action === 'merge') {
-                const prNumber = toPositiveInt(input.prNumber);
-                if (gh && prNumber) {
-                    const result = runArgv('gh', ['pr', 'merge', String(prNumber), '--merge']);
-                    if (result !== null) {
-                        return { success: true, _real: true, action: 'merged', prNumber, mergedAt: new Date().toISOString() };
-                    }
-                }
-                // Fallback: local store
-                const prKey = prNumber ? Object.keys(store.prs).find(k => k.includes(String(prNumber))) : undefined;
-                if (prKey && store.prs[prKey]) {
-                    store.prs[prKey].status = 'merged';
-                    saveGitHubStore(store);
-                }
-                return { success: true, source: 'local-store', action: 'merged', prNumber, mergedAt: new Date().toISOString() };
-            }
-            if (action === 'close') {
+            if (action === 'merge' || action === 'close') {
+                // #4424: a failed `gh` call, or a local fallback that matched nothing,
+                // used to be reported as success. Fail instead; offline, only update a
+                // local record whose id is exactly `pr-<prNumber>`.
                 const prNumber = toPositiveInt(input.prNumber);
-                if (gh && prNumber) {
-                    const result = runArgv('gh', ['pr', 'close', String(prNumber)]);
-                    if (result !== null) {
-                        return { success: true, _real: true, action: 'closed', prNumber, closedAt: new Date().toISOString() };
+                if (!prNumber)
+                    return { success: false, error: `prNumber is required (positive integer) for ${action}.` };
+                const status = action === 'merge' ? 'merged' : 'closed';
+                if (gh) {
+                    const argv = action === 'merge' ? ['pr', 'merge', String(prNumber), '--merge'] : ['pr', 'close', String(prNumber)];
+                    const r = runArgvResult('gh', [...argv, ...repoArgs]);
+                    if ('error' in r) {
+                        return { success: false, source: 'gh-cli', error: `gh pr ${action} ${prNumber} failed: ${r.error}` };
                     }
+                    return { success: true, _real: true, action: status, prNumber, [`${status}At`]: new Date().toISOString() };
                 }
-                const prKey = prNumber ? Object.keys(store.prs).find(k => k.includes(String(prNumber))) : undefined;
-                if (prKey && store.prs[prKey]) {
-                    store.prs[prKey].status = 'closed';
-                    saveGitHubStore(store);
-                }
-                return { success: true, source: 'local-store', action: 'closed', prNumber, closedAt: new Date().toISOString() };
+                const pr = store.prs[`pr-${prNumber}`];
+                if (!pr)
+                    return { success: false, source: 'local-store', error: `gh CLI not available and no local PR pr-${prNumber}` };
+                pr.status = status;
+                saveGitHubStore(store);
+                return { success: true, source: 'local-store', action: status, prNumber, [`${status}At`]: new Date().toISOString() };
             }
             return { success: false, error: 'Unknown action' };
         },
@@ -435,51 +440,49 @@ export const githubTools = [
                 saveGitHubStore(store);
                 return { success: true, source: 'local-store', action: 'created', issue };
             }
-            if (action === 'update') {
+            if (action === 'update' || action === 'close') {
+                // #4424: same contract as github_pr_manage merge/close — a failed `gh`
+                // call or an unmatched local fallback is a failure, not a success.
                 const issueNumber = toPositiveInt(input.issueNumber);
-                if (gh && issueNumber) {
-                    const argv = ['issue', 'edit', String(issueNumber)];
-                    if (input.title)
-                        argv.push('--title', input.title);
-                    if (input.labels) {
-                        const labels = sanitizeLabels(input.labels);
-                        if (labels === null)
-                            return { success: false, error: 'labels contains disallowed characters' };
-                        if (labels.length > 0)
+                if (!issueNumber)
+                    return { success: false, error: `issueNumber is required (positive integer) for ${action}.` };
+                const labels = input.labels === undefined ? undefined : sanitizeLabels(input.labels);
+                if (labels === null)
+                    return { success: false, error: 'labels contains disallowed characters' };
+                if (gh) {
+                    const argv = ['issue', action === 'update' ? 'edit' : 'close', String(issueNumber)];
+                    if (action === 'update') {
+                        if (input.title)
+                            argv.push('--title', input.title);
+                        if (labels && labels.length > 0)
                             argv.push('--add-label', labels.join(','));
+                        if (argv.length === 3)
+                            return { success: false, error: 'update requires title or labels' };
                     }
-                    if (argv.length > 3) {
-                        const result = runArgv('gh', [...argv, ...repoArgs]);
-                        if (result !== null)
-                            return { success: true, _real: true, action: 'updated', issueNumber };
-                    }
-                }
-                const issueKey = issueNumber ? Object.keys(store.issues).find(k => k.includes(String(issueNumber))) : undefined;
-                if (issueKey && store.issues[issueKey]) {
-                    if (input.title)
-                        store.issues[issueKey].title = input.title;
-                    if (input.labels) {
-                        const labels = sanitizeLabels(input.labels);
-                        if (labels !== null)
-                            store.issues[issueKey].labels = labels;
+                    const r = runArgvResult('gh', [...argv, ...repoArgs]);
+                    if ('error' in r) {
+                        return { success: false, source: 'gh-cli', error: `gh issue ${argv[1]} ${issueNumber} failed: ${r.error}` };
                     }
-                    saveGitHubStore(store);
+                    return action === 'update'
+                        ? { success: true, _real: true, action: 'updated', issueNumber }
+                        : { success: true, _real: true, action: 'closed', issueNumber, closedAt: new Date().toISOString() };
                 }
-                return { success: true, source: 'local-store', action: 'updated', issueNumber };
-            }
-            if (action === 'close') {
-                const issueNumber = toPositiveInt(input.issueNumber);
-                if (gh && issueNumber) {
-                    const result = runArgv('gh', ['issue', 'close', String(issueNumber), ...repoArgs]);
-                    if (result !== null)
-                        return { success: true, _real: true, action: 'closed', issueNumber, closedAt: new Date().toISOString() };
+                const issue = store.issues[`issue-${issueNumber}`];
+                if (!issue)
+                    return { success: false, source: 'local-store', error: `gh CLI not available and no local issue issue-${issueNumber}` };
+                if (action === 'close') {
+                    issue.status = 'closed';
                 }
-                const issueKey = issueNumber ? Object.keys(store.issues).find(k => k.includes(String(issueNumber))) : undefined;
-                if (issueKey && store.issues[issueKey]) {
-                    store.issues[issueKey].status = 'closed';
-                    saveGitHubStore(store);
+                else {
+                    if (input.title)
+                        issue.title = input.title;
+                    if (labels)
+                        issue.labels = labels;
                 }
-                return { success: true, source: 'local-store', action: 'closed', issueNumber, closedAt: new Date().toISOString() };
+                saveGitHubStore(store);
+                return action === 'update'
+                    ? { success: true, source: 'local-store', action: 'updated', issueNumber }
+                    : { success: true, source: 'local-store', action: 'closed', issueNumber, closedAt: new Date().toISOString() };
             }
             return { success: false, error: 'Unknown action' };
         },

package/dist/src/mcp-tools/neural-tools.js

@@ -899,7 +899,7 @@ export const neuralTools = [
             properties: {
                 modelId: { type: 'string', description: 'Model ID to compress' },
                 method: { type: 'string', enum: ['quantize', 'prune', 'distill'], description: 'Compression method' },
-                targetSize: { type: 'number', description: 'Target size reduction (0-1)' },
+                targetSize: { type: 'number', description: 'Not used: quantize (#4195) and prune (#4423) are unavailable, and distill merges by similarity' },
             },
         },
         handler: async (input) => {
@@ -910,7 +910,6 @@ export const neuralTools = [
             }
             const store = loadNeuralStore();
             const method = input.method || 'quantize';
-            const targetReduction = input.targetSize || 0.5;
             const patterns = Object.values(store.patterns);
             if (patterns.length === 0) {
                 return { success: false, error: 'No patterns to compress. Train patterns first with neural_train.' };
@@ -936,23 +935,18 @@ export const neuralTools = [
             // Resolve provider only for operations that actually use embeddings.
             await ensureEmbeddings();
             if (method === 'prune') {
-                // Prune patterns with low usage count below threshold (targetReduction as min usage)
-                const threshold = targetReduction;
-                const toRemove = [];
-                for (const [id, pattern] of Object.entries(store.patterns)) {
-                    if ((pattern.usageCount || 0) < threshold)
-                        toRemove.push(id);
-                }
-                for (const id of toRemove)
-                    delete store.patterns[id];
-                saveNeuralStore(store);
+                // #4423: prune deleted patterns with usageCount below targetSize, but
+                // nothing in the neural store records usage (patterns are written with
+                // 0 and only max-merged), so any targetSize > 0, including the old 0.5
+                // default, deleted and persisted every pattern. Refuse until usage is
+                // tracked, the same way quantize refuses (#4195). The store is untouched.
                 return {
-                    success: true, _real: true, method,
-                    embeddingProvider: embeddingServiceName,
-                    threshold,
-                    patternsRemoved: toRemove.length,
+                    success: false,
+                    error: 'Pruning is unavailable: neural patterns do not record usage, so there is no signal to choose which to remove.',
+                    method,
+                    patternsRemoved: 0,
                     patternsBefore: beforeCount,
-                    patternsAfter: Object.keys(store.patterns).length,
+                    patternsAfter: beforeCount,
                 };
             }
             if (method === 'distill') {

package/dist/src/mcp-tools/rure-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * ruRE Phase 1 MCP Tools — JS/Electron static analysis.
+ *
+ * See plugins/ruflo-rure/docs/adrs/0001-scope-and-dual-use-policy.md and
+ * 0002-phase1-architecture.md. These tools parse local files; they never
+ * execute analyzed code, and all extracted text is routed through the
+ * AIDefence gate before being returned to the caller.
+ */
+import type { MCPTool } from './types.js';
+export declare const rureTools: MCPTool[];
+//# sourceMappingURL=rure-tools.d.ts.map