@claude-flow/cli 3.71.0 → 3.71.2

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.71.0",
+    "version": "3.71.2",
     "files": {
       "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
       "hook-handler.cjs": "0ce70981aa33f76d008b6f49626effaf4269918c4094f1a28c1ef6fceb097d6f",
@@ -10,6 +10,6 @@
       "learning-loop.cjs": "d046cd6f8efb7dd40e1d2451516c181fc8b26477aefb1124c0df5f52a23f9190"
     }
   },
-  "signature": "KB4MvG90TT/O/OQIfSmwOW+cxr0l/Q5pwbOl1H8hSsjF4pQM5WCxB7tjBN7fH6RFYrQqlaS+4wRTgxcaGtmuAg==",
+  "signature": "awy0GR0jee+KKCI+7BgzocA29zGZTAZcNYRAwp7IDQ6xwzc6Rby9hqhTnk+68AHde2YvpNpuO8AyqU/P9JDFBw==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-11-01T20:14:57.317Z",
-  "gitSha": "5f3dacc5",
+  "generatedAt": "2026-11-04T18:54:59.719Z",
+  "gitSha": "af95dd71",
   "catalog": {
     "agents": 177,
     "tools": 450,

package/dist/src/commands/deployment.js

@@ -79,7 +79,7 @@ const deployCommand = {
     action: async (ctx) => {
         try {
             const envName = String(ctx.flags['env'] || 'staging');
-            const dryRun = Boolean(ctx.flags['dry-run']);
+            const dryRun = ctx.flags.dryRun === true || ctx.flags['dry-run'] === true;
             const description = ctx.flags['description'] ? String(ctx.flags['description']) : undefined;
             let version = ctx.flags['version'] ? String(ctx.flags['version']) : null;
             if (!version) {

package/dist/src/commands/embeddings.js

@@ -121,7 +121,7 @@ const searchCommand = {
         const threshold = rawThreshold === undefined || rawThreshold === null
             ? 0.5
             : parseFloat(String(rawThreshold));
-        const dbPath = ctx.flags['db-path'] || '.swarm/memory.db';
+        const dbPath = ctx.flags.dbPath || '.swarm/memory.db';
         if (!query) {
             output.printError('Query is required');
             return { success: false, exitCode: 1 };
@@ -394,7 +394,7 @@ const collectionsCommand = {
     ],
     action: async (ctx) => {
         const action = ctx.flags.action || 'list';
-        const dbPath = ctx.flags['db-path'] || '.swarm/memory.db';
+        const dbPath = ctx.flags.dbPath || '.swarm/memory.db';
         output.writeln();
         output.writeln(output.bold('Embedding Collections (Namespaces)'));
         output.writeln(output.dim('─'.repeat(60)));
@@ -500,7 +500,7 @@ const indexCommand = {
     action: async (ctx) => {
         const action = ctx.flags.action || 'status';
         const collection = ctx.flags.collection;
-        const efConstruction = parseInt(ctx.flags['ef-construction'] || '200', 10);
+        const efConstruction = parseInt(ctx.flags.efConstruction || '200', 10);
         const m = parseInt(ctx.flags.m || '16', 10);
         output.writeln();
         output.writeln(output.bold(`HNSW Index: ${action}`));
@@ -850,7 +850,7 @@ const chunkCommand = {
     action: async (ctx) => {
         const embeddings = await getEmbeddings();
         const text = ctx.flags.text || '';
-        const maxSize = parseInt(ctx.flags['max-size'] || '512', 10);
+        const maxSize = parseInt(ctx.flags.maxSize || '512', 10);
         const overlap = parseInt(ctx.flags.overlap || '50', 10);
         const strategy = ctx.flags.strategy || 'sentence';
         output.writeln();
@@ -1275,7 +1275,7 @@ const cacheCommand = {
     ],
     action: async (ctx) => {
         const action = ctx.flags.action || 'stats';
-        const dbPath = ctx.flags['db-path'] || '.cache/embeddings.db';
+        const dbPath = ctx.flags.dbPath || '.cache/embeddings.db';
         output.writeln();
         output.writeln(output.bold('Embedding Cache'));
         output.writeln(output.dim('─'.repeat(50)));
@@ -1479,7 +1479,7 @@ const benchmarkCommand = {
     ],
     action: async (ctx) => {
         const iterations = parseInt(ctx.flags.iterations || '10', 10);
-        const batchSize = parseInt(ctx.flags['batch-size'] || '5', 10);
+        const batchSize = parseInt(ctx.flags.batchSize || '5', 10);
         const full = ctx.flags.full === true;
         output.writeln();
         output.writeln(output.bold('Embedding Performance Benchmark'));

package/dist/src/commands/init.js

@@ -1091,6 +1091,7 @@ const wizardCommand = {
                             { value: 'github', label: 'GitHub', hint: 'GitHub integration skills', selected: true },
                             { value: 'flowNexus', label: 'Flow Nexus', hint: 'Cloud platform skills', selected: false },
                             { value: 'v3', label: 'V3', hint: 'V3 implementation skills', selected: true },
+                            { value: 'legacy', label: 'Legacy', hint: 'Skills that document commands v3 does not ship', selected: false },
                         ],
                     });
                     options.skills.core = skillSets.includes('core');
@@ -1098,6 +1099,7 @@ const wizardCommand = {
                     options.skills.github = skillSets.includes('github');
                     options.skills.flowNexus = skillSets.includes('flowNexus');
                     options.skills.v3 = skillSets.includes('v3');
+                    options.skills.legacy = skillSets.includes('legacy');
                 }
                 // Hooks selection
                 if (options.components.settings) {
@@ -1354,6 +1356,7 @@ const skillsCommand = {
         { name: 'agentdb', description: 'Install AgentDB skills', type: 'boolean', default: false },
         { name: 'github', description: 'Install GitHub skills', type: 'boolean', default: false },
         { name: 'v3', description: 'Install V3 skills', type: 'boolean', default: false },
+        { name: 'legacy', description: 'Install skills that document commands v3 does not ship (stream-chain, sparc)', type: 'boolean', default: false },
     ],
     action: async (ctx) => {
         const options = {
@@ -1380,6 +1383,7 @@ const skillsCommand = {
                 browser: false,
                 v3: ctx.flags.v3,
                 dualMode: false,
+                legacy: ctx.flags.legacy,
             },
         };
         const spinner = output.createSpinner({ text: 'Installing skills...' });

package/dist/src/commands/ruvector/backup.js

@@ -437,7 +437,7 @@ const restoreSubcommand = {
         const config = getConnectionConfig(ctx);
         const inputPath = ctx.flags.input;
         const clean = ctx.flags.clean;
-        const dryRun = ctx.flags['dry-run'];
+        const dryRun = ctx.flags.dryRun === true || ctx.flags['dry-run'] === true;
         output.writeln();
         output.writeln(output.bold('RuVector Restore'));
         output.writeln(output.dim('='.repeat(60)));

package/dist/src/commands/ruvector/migrate.js

@@ -246,7 +246,7 @@ export const migrateCommand = {
     ],
     action: async (ctx) => {
         const config = getConnectionConfig(ctx);
-        const dryRun = ctx.flags['dry-run'];
+        const dryRun = ctx.flags.dryRun === true || ctx.flags['dry-run'] === true;
         const force = ctx.flags.force;
         const targetVersion = ctx.flags.to;
         const rollback = ctx.flags.down;

package/dist/src/commands/session.js

@@ -211,9 +211,9 @@ const saveCommand = {
             const result = await callMCPTool('session_save', {
                 name: sessionName,
                 description,
-                includeMemory: ctx.flags['include-memory'] !== false,
-                includeAgents: ctx.flags['include-agents'] !== false,
-                includeTasks: ctx.flags['include-tasks'] !== false
+                includeMemory: ctx.flags.includeMemory !== false && ctx.flags['include-memory'] !== false,
+                includeAgents: ctx.flags.includeAgents !== false && ctx.flags['include-agents'] !== false,
+                includeTasks: ctx.flags.includeTasks !== false && ctx.flags['include-tasks'] !== false
             });
             const failure = toolError(result);
             if (failure) {
@@ -342,9 +342,12 @@ const restoreCommand = {
         spinner.start();
         try {
             // Determine what to restore
-            const restoreMemory = !ctx.flags['agents-only'] && !ctx.flags['tasks-only'];
-            const restoreAgents = !ctx.flags['memory-only'] && !ctx.flags['tasks-only'];
-            const restoreTasks = !ctx.flags['memory-only'] && !ctx.flags['agents-only'];
+            const memoryOnly = ctx.flags.memoryOnly === true || ctx.flags['memory-only'] === true;
+            const agentsOnly = ctx.flags.agentsOnly === true || ctx.flags['agents-only'] === true;
+            const tasksOnly = ctx.flags.tasksOnly === true || ctx.flags['tasks-only'] === true;
+            const restoreMemory = !agentsOnly && !tasksOnly;
+            const restoreAgents = !memoryOnly && !tasksOnly;
+            const restoreTasks = !memoryOnly && !agentsOnly;
             const result = await callMCPTool('session_restore', {
                 sessionId,
                 restoreMemory,
@@ -552,7 +555,7 @@ const exportCommand = {
         try {
             const result = await callMCPTool('session_export', {
                 sessionId,
-                includeMemory: ctx.flags['include-memory'] !== false
+                includeMemory: ctx.flags.includeMemory !== false && ctx.flags['include-memory'] !== false
             });
             const failure = toolError(result);
             if (failure || result.data === undefined) {

package/dist/src/init/executor.js

@@ -29,11 +29,9 @@ const SKILLS_MAP = {
     core: [
         'swarm-orchestration',
         'swarm-advanced',
-        'sparc-methodology',
         'hooks-automation',
         'pair-programming',
         'verification-quality',
-        'stream-chain',
         'skill-builder',
     ],
     browser: ['browser'], // agent-browser integration
@@ -47,12 +45,11 @@ const SKILLS_MAP = {
         'reasoningbank-agentdb',
         'reasoningbank-intelligence',
     ],
+    // github-code-review and github-project-management only use hooks, which v3
+    // ships; the other three drive `ruflo github`, so they live in skills.legacy.
     github: [
         'github-code-review',
-        'github-multi-repo',
         'github-project-management',
-        'github-release-management',
-        'github-workflow-automation',
     ],
     flowNexus: [
         'flow-nexus-neural',
@@ -70,6 +67,17 @@ const SKILLS_MAP = {
         'v3-security-overhaul',
         'v3-swarm-coordination',
     ],
+    // ADR-128 / #4539: skills that document v2-era verbs v3 does not ship
+    // (`stream-chain`, `sparc`, `github`). Their examples fail with `Unknown
+    // command`, so they are opt-in like skills.v3 instead of being installed by
+    // default.
+    legacy: [
+        'github-multi-repo',
+        'github-release-management',
+        'github-workflow-automation',
+        'sparc-methodology',
+        'stream-chain',
+    ],
 };
 /**
  * Commands to copy based on configuration
@@ -1077,6 +1085,8 @@ async function copySkills(targetDir, options, result) {
             skillsToCopy.push(...SKILLS_MAP.v3);
         if (skillsConfig.dualMode)
             skillsToCopy.push(...SKILLS_MAP.dualMode);
+        if (skillsConfig.legacy)
+            skillsToCopy.push(...SKILLS_MAP.legacy);
     }
     // Find source skills directory
     const sourceSkillsDir = findSourceDir('skills', options.sourceBaseDir);

package/dist/src/init/types.d.ts

@@ -76,6 +76,8 @@ export interface SkillsConfig {
     v3: boolean;
     /** Include dual-mode skills (Claude Code + Codex hybrid) */
     dualMode: boolean;
+    /** Include legacy skills that document commands v3 does not ship (opt-in) */
+    legacy: boolean;
     /** Include all available skills */
     all: boolean;
 }

package/dist/src/init/types.js

@@ -73,11 +73,12 @@ export const DEFAULT_INIT_OPTIONS = {
     skills: {
         core: true,
         agentdb: true,
-        github: true,
+        github: true, // #4539: only the hook-only GitHub skills remain; the rest are skills.legacy
         flowNexus: false,
         browser: true,
         v3: false, // ADR-128: opt-in like agents.v3; use --full or `init skills --v3`
         dualMode: false, // Optional: enable with --dual flag
+        legacy: false, // #4539: stream-chain/sparc document verbs v3 does not ship
         all: false,
     },
     commands: {
@@ -186,6 +187,7 @@ export const MINIMAL_INIT_OPTIONS = {
         browser: false,
         v3: false,
         dualMode: false,
+        legacy: false,
         all: false,
     },
     agents: {
@@ -246,6 +248,7 @@ export const FULL_INIT_OPTIONS = {
         browser: true,
         v3: true,
         dualMode: true, // Include in full init
+        legacy: true, // Include in full init
         all: true,
     },
     commands: {

package/dist/src/mcp-tools/claims-tools.js

@@ -402,6 +402,10 @@ export const claimsTools = [
             if (progress !== undefined) {
                 claim.progress = Math.min(100, Math.max(0, progress));
             }
+            // claims_status never sets 'stealable', so a claim it updates is no
+            // longer up for grabs: drop it from the list claims_stealable and
+            // claims_steal read.
+            delete store.stealable[issueId];
             store.claims[issueId] = claim;
             saveClaims(store);
             return {
@@ -592,7 +596,9 @@ export const claimsTools = [
             claim.claimant = stealer;
             claim.status = 'active';
             claim.statusChangedAt = now;
-            claim.context = stealableInfo.context;
+            // The context given to claims_mark-stealable is the handoff note for the
+            // stealer; without one, keep the context recorded with the claim.
+            claim.context = stealableInfo.context ?? claim.context;
             delete store.stealable[issueId];
             store.claims[issueId] = claim;
             saveClaims(store);

package/dist/src/mcp-tools/daa-tools.js

@@ -28,17 +28,37 @@ function ensureDAADir() {
         mkdirSync(dir, { recursive: true });
     }
 }
+/**
+ * SECURITY: record maps are keyed by ids taken from MCP tool input, and
+ * validateIdentifier accepts names like `__proto__` and `constructor`. On a
+ * plain object those resolve to Object.prototype or a built-in, which a handler
+ * would then write into. Null-prototype maps only ever return own records.
+ */
+function withRecordMaps(store, keys) {
+    const maps = store;
+    for (const key of keys) {
+        const map = maps[key];
+        if (map && typeof map === 'object' && !Array.isArray(map))
+            Object.setPrototypeOf(map, null);
+        else
+            maps[key] = Object.create(null);
+    }
+    return store;
+}
+const DAA_MAPS = ['agents', 'workflows', 'knowledge'];
 function loadDAAStore() {
     try {
         const path = getDAAPath();
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                return withRecordMaps(parsed, DAA_MAPS);
         }
     }
     catch {
         // Return empty store
     }
-    return { agents: {}, workflows: {}, knowledge: {}, version: '3.0.0' };
+    return withRecordMaps({ agents: {}, workflows: {}, knowledge: {}, version: '3.0.0' }, DAA_MAPS);
 }
 function saveDAAStore(store) {
     ensureDAADir();

package/dist/src/mcp-tools/embeddings-tools.js

@@ -425,7 +425,8 @@ export const embeddingsTools = [
             }
             const query = input.query;
             const topK = input.topK || 5;
-            const threshold = input.threshold || 0.5;
+            // `??`, not `||`: threshold 0 is a valid request for every match, as in memory_search.
+            const threshold = input.threshold ?? 0.5;
             const namespace = input.namespace;
             {
                 const v = validateText(query, 'query');

package/dist/src/mcp-tools/memory-tools.js

@@ -203,6 +203,14 @@ function resolveProjectMemoryDir(claudeProjectsDir, projectPathOverride) {
         if (/^[A-Za-z]:[\\/]/.test(source)) {
             candidates.add(source.replace(/[:\\/]/g, '-').replace(/\s+/g, '-'));
         }
+        // Candidate 6: Claude Code's own rule, which replaces every character
+        // other than [A-Za-z0-9] with `-` (the cost tracker's
+        // _encode-project-path.mjs does the same, #4366). The candidates above
+        // keep `_`, `.` and the like, so `/work/my_app` never found its folder
+        // `-work-my-app`. A WSL path is also tried in its Windows form.
+        candidates.add(source.replace(/[^a-zA-Z0-9]/g, '-'));
+        if (wsl)
+            candidates.add(`${wsl[1].toUpperCase()}:${wsl[2] ?? ''}`.replace(/[^a-zA-Z0-9]/g, '-'));
     }
     for (const projectHash of candidates) {
         const memDir = join(claudeProjectsDir, projectHash, 'memory');

package/dist/src/mcp-tools/session-tools.js

@@ -3,10 +3,10 @@
  *
  * Tool definitions for session management with file persistence.
  */
-import { existsSync, readFileSync, readdirSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { gunzipSync } from 'node:zlib';
-import { join } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { getProjectCwd } from './types.js';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
@@ -351,6 +351,41 @@ function isSessionRecordLike(value) {
     const v = value;
     return 'data' in v || 'stats' in v || 'sessionId' in v || 'savedAt' in v;
 }
+/**
+ * SECURITY: `outputPath` comes from MCP tool input. Resolve it against the
+ * project root and require the real (symlink-resolved) parent directory to stay
+ * inside the real project root, and refuse an existing symlink as the target,
+ * so session_export cannot write files elsewhere on the host. The CLI's
+ * `session export` writes its own file and does not pass outputPath.
+ */
+function containedExportPath(outputPath) {
+    if (!outputPath || outputPath.includes('\0'))
+        return null;
+    try {
+        const root = realpathSync(getProjectCwd());
+        const abs = resolve(root, outputPath);
+        const parent = realpathSync(dirname(abs));
+        const target = join(parent, basename(abs));
+        const rel = relative(root, target);
+        if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+            return null;
+        const existing = lstatOrNull(target);
+        if (existing && (existing.isSymbolicLink() || !existing.isFile()))
+            return null;
+        return target;
+    }
+    catch {
+        return null;
+    }
+}
+function lstatOrNull(p) {
+    try {
+        return lstatSync(p);
+    }
+    catch {
+        return null;
+    }
+}
 export const sessionTools = [
     {
         name: 'session_save',
@@ -705,9 +740,12 @@ export const sessionTools = [
             let path = null;
             const outputPath = input.outputPath ? String(input.outputPath) : null;
             if (outputPath) {
+                const target = containedExportPath(outputPath);
+                if (!target)
+                    return { sessionId, error: 'outputPath must be a file inside the project directory (no symlinks)' };
                 try {
-                    writeFileSync(outputPath, JSON.stringify(session, null, 2), 'utf-8');
-                    path = outputPath;
+                    writeFileSync(target, JSON.stringify(session, null, 2), 'utf-8');
+                    path = target;
                 }
                 catch (e) {
                     return { sessionId, error: `Could not write ${outputPath}: ${e.message}` };

package/dist/src/mcp-tools/terminal-tools.js

@@ -132,6 +132,11 @@ export const terminalTools = [
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const command = input.command;
+            // An explicit sessionId must name a stored session; only fall back to
+            // (or create) the default session when no sessionId was given.
+            if (sessionId && !store.sessions[sessionId]) {
+                return { success: false, error: 'Session not found' };
+            }
             // Find or create default session
             let session = sessionId ? store.sessions[sessionId] : Object.values(store.sessions).find(s => s.status === 'active');
             if (!session) {

package/dist/src/mcp-tools/workflow-tools.js

@@ -55,18 +55,37 @@ function ensureWorkflowDir() {
         mkdirSync(dir, { recursive: true });
     }
 }
+/**
+ * SECURITY: record maps are keyed by ids taken from MCP tool input, and
+ * validateIdentifier accepts names like `__proto__` and `constructor`. On a
+ * plain object those resolve to Object.prototype or a built-in, which a handler
+ * would then write into. Null-prototype maps only ever return own records.
+ */
+function withRecordMaps(store, keys) {
+    const maps = store;
+    for (const key of keys) {
+        const map = maps[key];
+        if (map && typeof map === 'object' && !Array.isArray(map))
+            Object.setPrototypeOf(map, null);
+        else
+            maps[key] = Object.create(null);
+    }
+    return store;
+}
+const WORKFLOW_MAPS = ['workflows', 'templates'];
 function loadWorkflowStore() {
     try {
         const path = getWorkflowPath();
         if (existsSync(path)) {
-            const data = readFileSync(path, 'utf-8');
-            return JSON.parse(data);
+            const data = JSON.parse(readFileSync(path, 'utf-8'));
+            if (data && typeof data === 'object' && !Array.isArray(data))
+                return withRecordMaps(data, WORKFLOW_MAPS);
         }
     }
     catch {
         // Return default store on error
     }
-    return { workflows: {}, templates: {}, version: '3.0.0' };
+    return withRecordMaps({ workflows: {}, templates: {}, version: '3.0.0' }, WORKFLOW_MAPS);
 }
 function saveWorkflowStore(store) {
     ensureWorkflowDir();

package/dist/src/memory/memory-bridge.d.ts

@@ -614,6 +614,12 @@ export declare function bridgeHealthCheck(dbPath?: string): Promise<{
         hits: number;
         misses: number;
     };
+    /** Why AgentDB failed to open, or null when it opened (#4654). */
+    agentdbInitError?: string | null;
+    /** Last bridge-level failure, including the AgentDB lock cause (#4622/#4654). */
+    bridgeFailureReason?: string | null;
+    /** Actionable next step when a second process owns the native store. */
+    hint?: string;
     hierarchicalMemory?: {
         controller: string;
         durable: boolean;