@claude-flow/cli 3.71.1 → 3.71.2

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.71.1",
+    "version": "3.71.2",
     "files": {
       "auto-memory-hook.mjs": "631fac9d518835e2852a406888316bbbddddb49e7ed8e406d2e971f46833df9a",
       "hook-handler.cjs": "0ce70981aa33f76d008b6f49626effaf4269918c4094f1a28c1ef6fceb097d6f",
@@ -10,6 +10,6 @@
       "learning-loop.cjs": "d046cd6f8efb7dd40e1d2451516c181fc8b26477aefb1124c0df5f52a23f9190"
     }
   },
-  "signature": "Ocl6MP3QExazQtRc7kRkNgyaKBUY3Y8YBX1mNYxfHzV/K9DHoZMefO89yD6WRsKf8XJUIXtfRUc4J4g45wMlCQ==",
+  "signature": "awy0GR0jee+KKCI+7BgzocA29zGZTAZcNYRAwp7IDQ6xwzc6Rby9hqhTnk+68AHde2YvpNpuO8AyqU/P9JDFBw==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-11-04T09:54:05.169Z",
-  "gitSha": "91e383bd",
+  "generatedAt": "2026-11-04T18:54:59.719Z",
+  "gitSha": "af95dd71",
   "catalog": {
     "agents": 177,
     "tools": 450,

package/dist/src/commands/embeddings.js

@@ -121,7 +121,7 @@ const searchCommand = {
         const threshold = rawThreshold === undefined || rawThreshold === null
             ? 0.5
             : parseFloat(String(rawThreshold));
-        const dbPath = ctx.flags['db-path'] || '.swarm/memory.db';
+        const dbPath = ctx.flags.dbPath || '.swarm/memory.db';
         if (!query) {
             output.printError('Query is required');
             return { success: false, exitCode: 1 };
@@ -394,7 +394,7 @@ const collectionsCommand = {
     ],
     action: async (ctx) => {
         const action = ctx.flags.action || 'list';
-        const dbPath = ctx.flags['db-path'] || '.swarm/memory.db';
+        const dbPath = ctx.flags.dbPath || '.swarm/memory.db';
         output.writeln();
         output.writeln(output.bold('Embedding Collections (Namespaces)'));
         output.writeln(output.dim('─'.repeat(60)));
@@ -500,7 +500,7 @@ const indexCommand = {
     action: async (ctx) => {
         const action = ctx.flags.action || 'status';
         const collection = ctx.flags.collection;
-        const efConstruction = parseInt(ctx.flags['ef-construction'] || '200', 10);
+        const efConstruction = parseInt(ctx.flags.efConstruction || '200', 10);
         const m = parseInt(ctx.flags.m || '16', 10);
         output.writeln();
         output.writeln(output.bold(`HNSW Index: ${action}`));
@@ -850,7 +850,7 @@ const chunkCommand = {
     action: async (ctx) => {
         const embeddings = await getEmbeddings();
         const text = ctx.flags.text || '';
-        const maxSize = parseInt(ctx.flags['max-size'] || '512', 10);
+        const maxSize = parseInt(ctx.flags.maxSize || '512', 10);
         const overlap = parseInt(ctx.flags.overlap || '50', 10);
         const strategy = ctx.flags.strategy || 'sentence';
         output.writeln();
@@ -1275,7 +1275,7 @@ const cacheCommand = {
     ],
     action: async (ctx) => {
         const action = ctx.flags.action || 'stats';
-        const dbPath = ctx.flags['db-path'] || '.cache/embeddings.db';
+        const dbPath = ctx.flags.dbPath || '.cache/embeddings.db';
         output.writeln();
         output.writeln(output.bold('Embedding Cache'));
         output.writeln(output.dim('─'.repeat(50)));
@@ -1479,7 +1479,7 @@ const benchmarkCommand = {
     ],
     action: async (ctx) => {
         const iterations = parseInt(ctx.flags.iterations || '10', 10);
-        const batchSize = parseInt(ctx.flags['batch-size'] || '5', 10);
+        const batchSize = parseInt(ctx.flags.batchSize || '5', 10);
         const full = ctx.flags.full === true;
         output.writeln();
         output.writeln(output.bold('Embedding Performance Benchmark'));

package/dist/src/commands/init.js

@@ -1091,6 +1091,7 @@ const wizardCommand = {
                             { value: 'github', label: 'GitHub', hint: 'GitHub integration skills', selected: true },
                             { value: 'flowNexus', label: 'Flow Nexus', hint: 'Cloud platform skills', selected: false },
                             { value: 'v3', label: 'V3', hint: 'V3 implementation skills', selected: true },
+                            { value: 'legacy', label: 'Legacy', hint: 'Skills that document commands v3 does not ship', selected: false },
                         ],
                     });
                     options.skills.core = skillSets.includes('core');
@@ -1098,6 +1099,7 @@ const wizardCommand = {
                     options.skills.github = skillSets.includes('github');
                     options.skills.flowNexus = skillSets.includes('flowNexus');
                     options.skills.v3 = skillSets.includes('v3');
+                    options.skills.legacy = skillSets.includes('legacy');
                 }
                 // Hooks selection
                 if (options.components.settings) {
@@ -1354,6 +1356,7 @@ const skillsCommand = {
         { name: 'agentdb', description: 'Install AgentDB skills', type: 'boolean', default: false },
         { name: 'github', description: 'Install GitHub skills', type: 'boolean', default: false },
         { name: 'v3', description: 'Install V3 skills', type: 'boolean', default: false },
+        { name: 'legacy', description: 'Install skills that document commands v3 does not ship (stream-chain, sparc)', type: 'boolean', default: false },
     ],
     action: async (ctx) => {
         const options = {
@@ -1380,6 +1383,7 @@ const skillsCommand = {
                 browser: false,
                 v3: ctx.flags.v3,
                 dualMode: false,
+                legacy: ctx.flags.legacy,
             },
         };
         const spinner = output.createSpinner({ text: 'Installing skills...' });

package/dist/src/commands/session.js

@@ -211,9 +211,9 @@ const saveCommand = {
             const result = await callMCPTool('session_save', {
                 name: sessionName,
                 description,
-                includeMemory: ctx.flags['include-memory'] !== false,
-                includeAgents: ctx.flags['include-agents'] !== false,
-                includeTasks: ctx.flags['include-tasks'] !== false
+                includeMemory: ctx.flags.includeMemory !== false && ctx.flags['include-memory'] !== false,
+                includeAgents: ctx.flags.includeAgents !== false && ctx.flags['include-agents'] !== false,
+                includeTasks: ctx.flags.includeTasks !== false && ctx.flags['include-tasks'] !== false
             });
             const failure = toolError(result);
             if (failure) {
@@ -342,9 +342,12 @@ const restoreCommand = {
         spinner.start();
         try {
             // Determine what to restore
-            const restoreMemory = !ctx.flags['agents-only'] && !ctx.flags['tasks-only'];
-            const restoreAgents = !ctx.flags['memory-only'] && !ctx.flags['tasks-only'];
-            const restoreTasks = !ctx.flags['memory-only'] && !ctx.flags['agents-only'];
+            const memoryOnly = ctx.flags.memoryOnly === true || ctx.flags['memory-only'] === true;
+            const agentsOnly = ctx.flags.agentsOnly === true || ctx.flags['agents-only'] === true;
+            const tasksOnly = ctx.flags.tasksOnly === true || ctx.flags['tasks-only'] === true;
+            const restoreMemory = !agentsOnly && !tasksOnly;
+            const restoreAgents = !memoryOnly && !tasksOnly;
+            const restoreTasks = !memoryOnly && !agentsOnly;
             const result = await callMCPTool('session_restore', {
                 sessionId,
                 restoreMemory,
@@ -552,7 +555,7 @@ const exportCommand = {
         try {
             const result = await callMCPTool('session_export', {
                 sessionId,
-                includeMemory: ctx.flags['include-memory'] !== false
+                includeMemory: ctx.flags.includeMemory !== false && ctx.flags['include-memory'] !== false
             });
             const failure = toolError(result);
             if (failure || result.data === undefined) {

package/dist/src/init/executor.js

@@ -29,11 +29,9 @@ const SKILLS_MAP = {
     core: [
         'swarm-orchestration',
         'swarm-advanced',
-        'sparc-methodology',
         'hooks-automation',
         'pair-programming',
         'verification-quality',
-        'stream-chain',
         'skill-builder',
     ],
     browser: ['browser'], // agent-browser integration
@@ -47,12 +45,11 @@ const SKILLS_MAP = {
         'reasoningbank-agentdb',
         'reasoningbank-intelligence',
     ],
+    // github-code-review and github-project-management only use hooks, which v3
+    // ships; the other three drive `ruflo github`, so they live in skills.legacy.
     github: [
         'github-code-review',
-        'github-multi-repo',
         'github-project-management',
-        'github-release-management',
-        'github-workflow-automation',
     ],
     flowNexus: [
         'flow-nexus-neural',
@@ -70,6 +67,17 @@ const SKILLS_MAP = {
         'v3-security-overhaul',
         'v3-swarm-coordination',
     ],
+    // ADR-128 / #4539: skills that document v2-era verbs v3 does not ship
+    // (`stream-chain`, `sparc`, `github`). Their examples fail with `Unknown
+    // command`, so they are opt-in like skills.v3 instead of being installed by
+    // default.
+    legacy: [
+        'github-multi-repo',
+        'github-release-management',
+        'github-workflow-automation',
+        'sparc-methodology',
+        'stream-chain',
+    ],
 };
 /**
  * Commands to copy based on configuration
@@ -1077,6 +1085,8 @@ async function copySkills(targetDir, options, result) {
             skillsToCopy.push(...SKILLS_MAP.v3);
         if (skillsConfig.dualMode)
             skillsToCopy.push(...SKILLS_MAP.dualMode);
+        if (skillsConfig.legacy)
+            skillsToCopy.push(...SKILLS_MAP.legacy);
     }
     // Find source skills directory
     const sourceSkillsDir = findSourceDir('skills', options.sourceBaseDir);

package/dist/src/init/types.d.ts

@@ -76,6 +76,8 @@ export interface SkillsConfig {
     v3: boolean;
     /** Include dual-mode skills (Claude Code + Codex hybrid) */
     dualMode: boolean;
+    /** Include legacy skills that document commands v3 does not ship (opt-in) */
+    legacy: boolean;
     /** Include all available skills */
     all: boolean;
 }

package/dist/src/init/types.js

@@ -73,11 +73,12 @@ export const DEFAULT_INIT_OPTIONS = {
     skills: {
         core: true,
         agentdb: true,
-        github: true,
+        github: true, // #4539: only the hook-only GitHub skills remain; the rest are skills.legacy
         flowNexus: false,
         browser: true,
         v3: false, // ADR-128: opt-in like agents.v3; use --full or `init skills --v3`
         dualMode: false, // Optional: enable with --dual flag
+        legacy: false, // #4539: stream-chain/sparc document verbs v3 does not ship
         all: false,
     },
     commands: {
@@ -186,6 +187,7 @@ export const MINIMAL_INIT_OPTIONS = {
         browser: false,
         v3: false,
         dualMode: false,
+        legacy: false,
         all: false,
     },
     agents: {
@@ -246,6 +248,7 @@ export const FULL_INIT_OPTIONS = {
         browser: true,
         v3: true,
         dualMode: true, // Include in full init
+        legacy: true, // Include in full init
         all: true,
     },
     commands: {

package/dist/src/mcp-tools/claims-tools.js

@@ -402,6 +402,10 @@ export const claimsTools = [
             if (progress !== undefined) {
                 claim.progress = Math.min(100, Math.max(0, progress));
             }
+            // claims_status never sets 'stealable', so a claim it updates is no
+            // longer up for grabs: drop it from the list claims_stealable and
+            // claims_steal read.
+            delete store.stealable[issueId];
             store.claims[issueId] = claim;
             saveClaims(store);
             return {
@@ -592,7 +596,9 @@ export const claimsTools = [
             claim.claimant = stealer;
             claim.status = 'active';
             claim.statusChangedAt = now;
-            claim.context = stealableInfo.context;
+            // The context given to claims_mark-stealable is the handoff note for the
+            // stealer; without one, keep the context recorded with the claim.
+            claim.context = stealableInfo.context ?? claim.context;
             delete store.stealable[issueId];
             store.claims[issueId] = claim;
             saveClaims(store);

package/dist/src/mcp-tools/daa-tools.js

@@ -28,17 +28,37 @@ function ensureDAADir() {
         mkdirSync(dir, { recursive: true });
     }
 }
+/**
+ * SECURITY: record maps are keyed by ids taken from MCP tool input, and
+ * validateIdentifier accepts names like `__proto__` and `constructor`. On a
+ * plain object those resolve to Object.prototype or a built-in, which a handler
+ * would then write into. Null-prototype maps only ever return own records.
+ */
+function withRecordMaps(store, keys) {
+    const maps = store;
+    for (const key of keys) {
+        const map = maps[key];
+        if (map && typeof map === 'object' && !Array.isArray(map))
+            Object.setPrototypeOf(map, null);
+        else
+            maps[key] = Object.create(null);
+    }
+    return store;
+}
+const DAA_MAPS = ['agents', 'workflows', 'knowledge'];
 function loadDAAStore() {
     try {
         const path = getDAAPath();
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                return withRecordMaps(parsed, DAA_MAPS);
         }
     }
     catch {
         // Return empty store
     }
-    return { agents: {}, workflows: {}, knowledge: {}, version: '3.0.0' };
+    return withRecordMaps({ agents: {}, workflows: {}, knowledge: {}, version: '3.0.0' }, DAA_MAPS);
 }
 function saveDAAStore(store) {
     ensureDAADir();

package/dist/src/mcp-tools/embeddings-tools.js

@@ -425,7 +425,8 @@ export const embeddingsTools = [
             }
             const query = input.query;
             const topK = input.topK || 5;
-            const threshold = input.threshold || 0.5;
+            // `??`, not `||`: threshold 0 is a valid request for every match, as in memory_search.
+            const threshold = input.threshold ?? 0.5;
             const namespace = input.namespace;
             {
                 const v = validateText(query, 'query');

package/dist/src/mcp-tools/session-tools.js

@@ -3,10 +3,10 @@
  *
  * Tool definitions for session management with file persistence.
  */
-import { existsSync, readFileSync, readdirSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { gunzipSync } from 'node:zlib';
-import { join } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { getProjectCwd } from './types.js';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
@@ -351,6 +351,41 @@ function isSessionRecordLike(value) {
     const v = value;
     return 'data' in v || 'stats' in v || 'sessionId' in v || 'savedAt' in v;
 }
+/**
+ * SECURITY: `outputPath` comes from MCP tool input. Resolve it against the
+ * project root and require the real (symlink-resolved) parent directory to stay
+ * inside the real project root, and refuse an existing symlink as the target,
+ * so session_export cannot write files elsewhere on the host. The CLI's
+ * `session export` writes its own file and does not pass outputPath.
+ */
+function containedExportPath(outputPath) {
+    if (!outputPath || outputPath.includes('\0'))
+        return null;
+    try {
+        const root = realpathSync(getProjectCwd());
+        const abs = resolve(root, outputPath);
+        const parent = realpathSync(dirname(abs));
+        const target = join(parent, basename(abs));
+        const rel = relative(root, target);
+        if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+            return null;
+        const existing = lstatOrNull(target);
+        if (existing && (existing.isSymbolicLink() || !existing.isFile()))
+            return null;
+        return target;
+    }
+    catch {
+        return null;
+    }
+}
+function lstatOrNull(p) {
+    try {
+        return lstatSync(p);
+    }
+    catch {
+        return null;
+    }
+}
 export const sessionTools = [
     {
         name: 'session_save',
@@ -705,9 +740,12 @@ export const sessionTools = [
             let path = null;
             const outputPath = input.outputPath ? String(input.outputPath) : null;
             if (outputPath) {
+                const target = containedExportPath(outputPath);
+                if (!target)
+                    return { sessionId, error: 'outputPath must be a file inside the project directory (no symlinks)' };
                 try {
-                    writeFileSync(outputPath, JSON.stringify(session, null, 2), 'utf-8');
-                    path = outputPath;
+                    writeFileSync(target, JSON.stringify(session, null, 2), 'utf-8');
+                    path = target;
                 }
                 catch (e) {
                     return { sessionId, error: `Could not write ${outputPath}: ${e.message}` };

package/dist/src/mcp-tools/terminal-tools.js

@@ -132,6 +132,11 @@ export const terminalTools = [
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const command = input.command;
+            // An explicit sessionId must name a stored session; only fall back to
+            // (or create) the default session when no sessionId was given.
+            if (sessionId && !store.sessions[sessionId]) {
+                return { success: false, error: 'Session not found' };
+            }
             // Find or create default session
             let session = sessionId ? store.sessions[sessionId] : Object.values(store.sessions).find(s => s.status === 'active');
             if (!session) {

package/dist/src/mcp-tools/workflow-tools.js

@@ -55,18 +55,37 @@ function ensureWorkflowDir() {
         mkdirSync(dir, { recursive: true });
     }
 }
+/**
+ * SECURITY: record maps are keyed by ids taken from MCP tool input, and
+ * validateIdentifier accepts names like `__proto__` and `constructor`. On a
+ * plain object those resolve to Object.prototype or a built-in, which a handler
+ * would then write into. Null-prototype maps only ever return own records.
+ */
+function withRecordMaps(store, keys) {
+    const maps = store;
+    for (const key of keys) {
+        const map = maps[key];
+        if (map && typeof map === 'object' && !Array.isArray(map))
+            Object.setPrototypeOf(map, null);
+        else
+            maps[key] = Object.create(null);
+    }
+    return store;
+}
+const WORKFLOW_MAPS = ['workflows', 'templates'];
 function loadWorkflowStore() {
     try {
         const path = getWorkflowPath();
         if (existsSync(path)) {
-            const data = readFileSync(path, 'utf-8');
-            return JSON.parse(data);
+            const data = JSON.parse(readFileSync(path, 'utf-8'));
+            if (data && typeof data === 'object' && !Array.isArray(data))
+                return withRecordMaps(data, WORKFLOW_MAPS);
         }
     }
     catch {
         // Return default store on error
     }
-    return { workflows: {}, templates: {}, version: '3.0.0' };
+    return withRecordMaps({ workflows: {}, templates: {}, version: '3.0.0' }, WORKFLOW_MAPS);
 }
 function saveWorkflowStore(store) {
     ensureWorkflowDir();

package/dist/src/memory/memory-bridge.js

@@ -1540,15 +1540,39 @@ export async function bridgeListEntries(options) {
         // List
         const entries = [];
         try {
-            // Include tags so export/list can round-trip them.
-            const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type, expires_at, tags
+            const columns = 'id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type, expires_at, tags';
+            const listLimit = options.includeEmbedding ? Math.min(safeLimit, MAX_LIST_EMBEDDINGS) : safeLimit;
+            // #4686: sort only row identities first, then fetch the payload for the
+            // page. The old query sorted full `content`/`embedding` payloads for
+            // every row and discarded all but the requested page.
+            const pagedSql = `
+        SELECT ${columns}
+        FROM memory_entries
+        WHERE _rowid_ IN (
+          SELECT _rowid_
+          FROM memory_entries
+          WHERE ${statusFilter} ${extraFilter}
+          ORDER BY updated_at DESC
+          LIMIT ? OFFSET ?
+        )
+        ORDER BY updated_at DESC
+      `;
+            const originalSql = `
+        SELECT ${columns}
         FROM memory_entries
         WHERE ${statusFilter} ${extraFilter}
         ORDER BY updated_at DESC
         LIMIT ? OFFSET ?
-      `);
-            const rows = stmt.all(...filterParams, options.includeEmbedding ? Math.min(safeLimit, MAX_LIST_EMBEDDINGS) : safeLimit, safeOffset);
+      `;
+            let rows;
+            try {
+                rows = ctx.db.prepare(pagedSql).all(...filterParams, listLimit, safeOffset);
+            }
+            catch {
+                // WITHOUT ROWID/legacy tables have no _rowid_: preserve the original
+                // query rather than failing the page.
+                rows = ctx.db.prepare(originalSql).all(...filterParams, listLimit, safeOffset);
+            }
             for (const row of rows) {
                 let tags = [];
                 if (row.tags) {

package/dist/src/memory/memory-initializer.js

@@ -3115,16 +3115,38 @@ export async function listEntries(options) {
         const total = countRows[0]?.[0] || 0;
         // Get entries. ADR-472: embedding rows are capped at MAX_LIST_EMBEDDINGS.
         const listLimit = options.includeEmbedding ? Math.min(safeLimit, MAX_LIST_EMBEDDINGS) : safeLimit;
-        // Include tags so export/list can round-trip them.
-        const listStmt = db.prepare(`SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type, expires_at, tags
-       FROM memory_entries WHERE ${whereSql}
-       ORDER BY updated_at DESC LIMIT ? OFFSET ?`);
-        listStmt.bind([...whereParams, listLimit, safeOffset]);
-        const listRows = [];
-        while (listStmt.step()) {
-            listRows.push(listStmt.get());
-        }
-        listStmt.free();
+        const columns = 'id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type, expires_at, tags';
+        // #4686: page row identities first so the temporary sort B-tree does not
+        // carry full content/embedding payloads for rows outside the page.
+        const pagedSql = `SELECT ${columns} FROM memory_entries
+       WHERE _rowid_ IN (
+         SELECT _rowid_ FROM memory_entries WHERE ${whereSql}
+         ORDER BY updated_at DESC LIMIT ? OFFSET ?
+       )
+       ORDER BY updated_at DESC`;
+        const originalSql = `SELECT ${columns} FROM memory_entries WHERE ${whereSql}
+       ORDER BY updated_at DESC LIMIT ? OFFSET ?`;
+        let listRows = [];
+        const runList = (sql) => {
+            const stmt = db.prepare(sql);
+            try {
+                stmt.bind([...whereParams, listLimit, safeOffset]);
+                const rows = [];
+                while (stmt.step())
+                    rows.push(stmt.get());
+                return rows;
+            }
+            finally {
+                stmt.free();
+            }
+        };
+        try {
+            listRows = runList(pagedSql);
+        }
+        catch {
+            // Legacy WITHOUT ROWID tables have no _rowid_: keep the original query.
+            listRows = runList(originalSql);
+        }
         const entries = [];
         for (const row of listRows) {
             const [id, key, ns, content, embedding, accessCount, createdAt, updatedAt, provenanceTypeVal, expiresAtVal, tagsJson] = row;

package/dist/src/services/claims-store.js

@@ -11,7 +11,7 @@ export function readClaimsStore(file) {
     }
     catch (error) {
         if (error.code === 'ENOENT')
-            return { claims: {}, stealable: {}, contests: {} };
+            return { claims: Object.create(null), stealable: Object.create(null), contests: Object.create(null) };
         throw error;
     }
     const data = JSON.parse(text);
@@ -35,6 +35,9 @@ export function readClaimsStore(file) {
         if (data[key] !== undefined && !record(data[key]))
             throw new Error(`Invalid claims store: ${key} must be an object`);
     }
-    return { ...data, claims, stealable: data.stealable ?? {}, contests: data.contests ?? {} };
+    // SECURITY: issue ids come from tool input; null-prototype maps keep a lookup
+    // by `constructor`/`__proto__` from resolving to an inherited built-in.
+    const nullProto = (map) => Object.assign(Object.create(null), map ?? {});
+    return { ...data, claims, stealable: nullProto(data.stealable), contests: nullProto(data.contests) };
 }
 //# sourceMappingURL=claims-store.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.71.1",
+  "version": "3.71.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",