@claude-flow/cli 3.71.1 → 3.71.3

package/dist/src/commands/hive-mind.js

@@ -10,7 +10,7 @@ import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
 import { spawn as childSpawn } from 'child_process';
 import { mkdir, writeFile } from 'fs/promises';
-import { resolveWorkerMcpConfig, currentRufloServer, workCommand } from './hive-mind-worker.js';
+import { resolveWorkerMcpConfig, resolveWorkerModel, currentRufloServer, workCommand } from './hive-mind-worker.js';
 import { join } from 'path';
 import { resolveClaudeLaunchCommand } from '../runtime/claude-command.js';
 import { withHeadlessPlugins } from '../mods/headless-plugins.js';
@@ -168,6 +168,7 @@ async function spawnClaudeCodeInstance(swarmId, swarmName, objective, workers, f
         const workerGroups = groupWorkersByType(workers);
         const hiveMindPrompt = generateHiveMindPrompt(swarmId, swarmName, objective, workers, workerGroups, flags);
         spinner.succeed('Hive Mind coordination prompt ready!');
+        const { model: workerModel } = resolveWorkerModel(flags);
         // Display coordination summary
         output.writeln();
         output.writeln(output.bold('🧠 Hive Mind Configuration'));
@@ -179,6 +180,7 @@ async function spawnClaudeCodeInstance(swarmId, swarmName, objective, workers, f
             `Worker Count: ${output.highlight(String(workers.length))}`,
             `Worker Types: ${output.highlight(Object.keys(workerGroups).join(', '))}`,
             `Consensus: ${output.highlight(flags.consensus || 'byzantine')}`,
+            `Model: ${output.highlight(workerModel ?? 'Claude Code default')}`,
             `MCP Tools: ${output.success('Full Claude-Flow integration enabled')}`
         ]);
         // Ensure sessions directory exists
@@ -249,6 +251,10 @@ async function spawnClaudeCodeInstance(swarmId, swarmName, objective, workers, f
                     output.printWarning('Using --dangerously-skip-permissions for seamless hive-mind execution');
                 }
             }
+            // #1870: without --model the argv is unchanged and Claude Code picks its default.
+            if (workerModel) {
+                claudeArgs.push('--model', workerModel);
+            }
             // ADR-510 §2.2: a non-interactive (-p) run is a headless worker and loads
             // no marketplace plugins on a fresh config, so stage the worker profile
             // (default ruflo-mods) as --plugin-dir before the prompt. The interactive
@@ -344,11 +350,12 @@ async function spawnClaudeCodeInstance(swarmId, swarmName, objective, workers, f
             output.writeln();
             output.writeln(output.bold('📋 Manual Execution Instructions:'));
             output.writeln(output.dim('─'.repeat(50)));
+            const modelArg = workerModel ? ` --model ${workerModel}` : '';
             output.printList([
                 'Install Claude Code: npm install -g @anthropic-ai/claude-code',
-                `Run with saved prompt: claude < ${promptFile}`,
-                `Or copy manually: cat ${promptFile} | claude`,
-                `With auto-permissions: claude --dangerously-skip-permissions < ${promptFile}`
+                `Run with saved prompt: claude${modelArg} < ${promptFile}`,
+                `Or copy manually: cat ${promptFile} | claude${modelArg}`,
+                `With auto-permissions: claude${modelArg} --dangerously-skip-permissions < ${promptFile}`
             ]);
             return { success: true, promptFile };
         }
@@ -529,6 +536,12 @@ const spawnCommand = {
             description: 'Objective for the hive mind (used with --claude)',
             type: 'string'
         },
+        {
+            name: 'model',
+            short: 'm',
+            description: 'Model for the Claude Code worker started by --claude, passed as claude --model (e.g. sonnet, opus, or a full model id; default: the Claude Code default)',
+            type: 'string'
+        },
         {
             name: 'dangerously-skip-permissions',
             description: 'Skip permission prompts in Claude Code (use with caution)',
@@ -564,6 +577,7 @@ const spawnCommand = {
         { command: 'claude-flow hive-mind spawn -n 3 -r specialist', description: 'Spawn 3 specialists' },
         { command: 'claude-flow hive-mind spawn -t coder -p my-coder', description: 'Spawn coder with custom prefix' },
         { command: 'claude-flow hive-mind spawn --claude -o "Build a REST API"', description: 'Launch Claude Code with objective' },
+        { command: 'claude-flow hive-mind spawn --claude -m sonnet -o "Build a REST API"', description: 'Launch Claude Code on a pinned model' },
         { command: 'claude-flow hive-mind spawn -n 5 --claude -o "Research AI patterns"', description: 'Spawn workers and launch Claude Code' }
     ],
     action: async (ctx) => {
@@ -574,6 +588,15 @@ const spawnCommand = {
         const prefix = ctx.flags.prefix || 'hive-worker';
         const launchClaude = ctx.flags.claude;
         let objective = ctx.flags.objective || ctx.args.join(' ');
+        // #1870: refuse a bad --model before any worker is spawned.
+        const workerModel = resolveWorkerModel(ctx.flags);
+        if (workerModel.error) {
+            output.printError(workerModel.error);
+            return { success: false, exitCode: 1 };
+        }
+        if (workerModel.model && !launchClaude) {
+            output.printWarning('--model only applies with --claude; ignoring it');
+        }
         output.printInfo(`Spawning ${count} ${role} agent(s)...`);
         try {
             const result = await callMCPTool('hive-mind_spawn', {

package/dist/src/commands/init.js

@@ -1091,6 +1091,7 @@ const wizardCommand = {
                             { value: 'github', label: 'GitHub', hint: 'GitHub integration skills', selected: true },
                             { value: 'flowNexus', label: 'Flow Nexus', hint: 'Cloud platform skills', selected: false },
                             { value: 'v3', label: 'V3', hint: 'V3 implementation skills', selected: true },
+                            { value: 'legacy', label: 'Legacy', hint: 'Skills that document commands v3 does not ship', selected: false },
                         ],
                     });
                     options.skills.core = skillSets.includes('core');
@@ -1098,6 +1099,7 @@ const wizardCommand = {
                     options.skills.github = skillSets.includes('github');
                     options.skills.flowNexus = skillSets.includes('flowNexus');
                     options.skills.v3 = skillSets.includes('v3');
+                    options.skills.legacy = skillSets.includes('legacy');
                 }
                 // Hooks selection
                 if (options.components.settings) {
@@ -1354,6 +1356,7 @@ const skillsCommand = {
         { name: 'agentdb', description: 'Install AgentDB skills', type: 'boolean', default: false },
         { name: 'github', description: 'Install GitHub skills', type: 'boolean', default: false },
         { name: 'v3', description: 'Install V3 skills', type: 'boolean', default: false },
+        { name: 'legacy', description: 'Install skills that document commands v3 does not ship (stream-chain, sparc)', type: 'boolean', default: false },
     ],
     action: async (ctx) => {
         const options = {
@@ -1380,6 +1383,7 @@ const skillsCommand = {
                 browser: false,
                 v3: ctx.flags.v3,
                 dualMode: false,
+                legacy: ctx.flags.legacy,
             },
         };
         const spinner = output.createSpinner({ text: 'Installing skills...' });

package/dist/src/commands/session.js

@@ -211,9 +211,9 @@ const saveCommand = {
             const result = await callMCPTool('session_save', {
                 name: sessionName,
                 description,
-                includeMemory: ctx.flags['include-memory'] !== false,
-                includeAgents: ctx.flags['include-agents'] !== false,
-                includeTasks: ctx.flags['include-tasks'] !== false
+                includeMemory: ctx.flags.includeMemory !== false && ctx.flags['include-memory'] !== false,
+                includeAgents: ctx.flags.includeAgents !== false && ctx.flags['include-agents'] !== false,
+                includeTasks: ctx.flags.includeTasks !== false && ctx.flags['include-tasks'] !== false
             });
             const failure = toolError(result);
             if (failure) {
@@ -342,9 +342,12 @@ const restoreCommand = {
         spinner.start();
         try {
             // Determine what to restore
-            const restoreMemory = !ctx.flags['agents-only'] && !ctx.flags['tasks-only'];
-            const restoreAgents = !ctx.flags['memory-only'] && !ctx.flags['tasks-only'];
-            const restoreTasks = !ctx.flags['memory-only'] && !ctx.flags['agents-only'];
+            const memoryOnly = ctx.flags.memoryOnly === true || ctx.flags['memory-only'] === true;
+            const agentsOnly = ctx.flags.agentsOnly === true || ctx.flags['agents-only'] === true;
+            const tasksOnly = ctx.flags.tasksOnly === true || ctx.flags['tasks-only'] === true;
+            const restoreMemory = !agentsOnly && !tasksOnly;
+            const restoreAgents = !memoryOnly && !tasksOnly;
+            const restoreTasks = !memoryOnly && !agentsOnly;
             const result = await callMCPTool('session_restore', {
                 sessionId,
                 restoreMemory,
@@ -552,7 +555,7 @@ const exportCommand = {
         try {
             const result = await callMCPTool('session_export', {
                 sessionId,
-                includeMemory: ctx.flags['include-memory'] !== false
+                includeMemory: ctx.flags.includeMemory !== false && ctx.flags['include-memory'] !== false
             });
             const failure = toolError(result);
             if (failure || result.data === undefined) {

package/dist/src/init/executor.js

@@ -29,11 +29,9 @@ const SKILLS_MAP = {
     core: [
         'swarm-orchestration',
         'swarm-advanced',
-        'sparc-methodology',
         'hooks-automation',
         'pair-programming',
         'verification-quality',
-        'stream-chain',
         'skill-builder',
     ],
     browser: ['browser'], // agent-browser integration
@@ -47,12 +45,11 @@ const SKILLS_MAP = {
         'reasoningbank-agentdb',
         'reasoningbank-intelligence',
     ],
+    // github-code-review and github-project-management only use hooks, which v3
+    // ships; the other three drive `ruflo github`, so they live in skills.legacy.
     github: [
         'github-code-review',
-        'github-multi-repo',
         'github-project-management',
-        'github-release-management',
-        'github-workflow-automation',
     ],
     flowNexus: [
         'flow-nexus-neural',
@@ -70,6 +67,17 @@ const SKILLS_MAP = {
         'v3-security-overhaul',
         'v3-swarm-coordination',
     ],
+    // ADR-128 / #4539: skills that document v2-era verbs v3 does not ship
+    // (`stream-chain`, `sparc`, `github`). Their examples fail with `Unknown
+    // command`, so they are opt-in like skills.v3 instead of being installed by
+    // default.
+    legacy: [
+        'github-multi-repo',
+        'github-release-management',
+        'github-workflow-automation',
+        'sparc-methodology',
+        'stream-chain',
+    ],
 };
 /**
  * Commands to copy based on configuration
@@ -1077,6 +1085,8 @@ async function copySkills(targetDir, options, result) {
             skillsToCopy.push(...SKILLS_MAP.v3);
         if (skillsConfig.dualMode)
             skillsToCopy.push(...SKILLS_MAP.dualMode);
+        if (skillsConfig.legacy)
+            skillsToCopy.push(...SKILLS_MAP.legacy);
     }
     // Find source skills directory
     const sourceSkillsDir = findSourceDir('skills', options.sourceBaseDir);

package/dist/src/init/settings-generator.js

@@ -210,6 +210,10 @@ function generateHooksConfig(config, scope) {
                         type: 'command',
                         command: hookHandlerCmd('pre-bash', scope),
                         timeout: config.timeout,
+                        // Claude Code 2.1.295+: if the safety gate can't start, times out or
+                        // exits with an unexpected code, block the command instead of letting
+                        // it run. Older versions ignore the key.
+                        onFailure: 'block',
                     },
                 ],
             },

package/dist/src/init/types.d.ts

@@ -76,6 +76,8 @@ export interface SkillsConfig {
     v3: boolean;
     /** Include dual-mode skills (Claude Code + Codex hybrid) */
     dualMode: boolean;
+    /** Include legacy skills that document commands v3 does not ship (opt-in) */
+    legacy: boolean;
     /** Include all available skills */
     all: boolean;
 }

package/dist/src/init/types.js

@@ -73,11 +73,12 @@ export const DEFAULT_INIT_OPTIONS = {
     skills: {
         core: true,
         agentdb: true,
-        github: true,
+        github: true, // #4539: only the hook-only GitHub skills remain; the rest are skills.legacy
         flowNexus: false,
         browser: true,
         v3: false, // ADR-128: opt-in like agents.v3; use --full or `init skills --v3`
         dualMode: false, // Optional: enable with --dual flag
+        legacy: false, // #4539: stream-chain/sparc document verbs v3 does not ship
         all: false,
     },
     commands: {
@@ -186,6 +187,7 @@ export const MINIMAL_INIT_OPTIONS = {
         browser: false,
         v3: false,
         dualMode: false,
+        legacy: false,
         all: false,
     },
     agents: {
@@ -246,6 +248,7 @@ export const FULL_INIT_OPTIONS = {
         browser: true,
         v3: true,
         dualMode: true, // Include in full init
+        legacy: true, // Include in full init
         all: true,
     },
     commands: {

package/dist/src/mcp-tools/agentdb-tools.js

@@ -985,12 +985,12 @@ export const agentdbBatch = {
 // ===== agentdb_context_synthesize — Synthesize context from memories =====
 export const agentdbContextSynthesize = {
     name: 'agentdb_context-synthesize',
-    description: 'Synthesize context from stored memories for a given query Use when generic memory_* tools are wrong because you need AgentDB-specific controllers (HNSW vector search, hierarchical tiers, causal-graph links, pattern store/recall, RaBitQ quantization). For simple key-value persistence, memory_store/memory_retrieve are simpler. For unrelated file work, native Read/Write are fine.',
+    description: 'Summarize validated task episodes (task, reward, success, critique) that match a query: observed success rate, reward and critique-derived patterns. Ordinary documents, research notes and graph entities are not episodes, so for them it answers no-memories or no-eligible-episodes; read those with memory_search or memory_retrieve instead. Use when generic memory_* tools are wrong because you need AgentDB-specific controllers (HNSW vector search, hierarchical tiers, causal-graph links, pattern store/recall, RaBitQ quantization). For simple key-value persistence, memory_store/memory_retrieve are simpler. For unrelated file work, native Read/Write are fine.',
     inputSchema: {
         type: 'object',
         properties: {
-            query: { type: 'string', description: 'Query to synthesize context for' },
-            maxEntries: { type: 'number', description: 'Maximum entries to include (default: 10)' },
+            query: { type: 'string', description: 'Task to find matching validated episodes for' },
+            maxEntries: { type: 'number', description: 'Maximum episodes to include (default: 10)' },
         },
         required: ['query'],
     },

package/dist/src/mcp-tools/claims-tools.js

@@ -36,6 +36,10 @@ function formatClaimant(claimant) {
         ? `human:${claimant.userId}:${claimant.name}`
         : `agent:${claimant.agentId}:${claimant.agentType}`;
 }
+/** An agent's claim that is still work in hand (not completed). */
+function isOpenAgentClaim(claim) {
+    return claim.claimant.type === 'agent' && claim.status !== 'completed';
+}
 function parseClaimant(str) {
     const parts = str.split(':');
     if (parts[0] === 'human' && parts.length >= 3) {
@@ -274,6 +278,10 @@ export const claimsTools = [
             if (progress !== undefined) {
                 claim.progress = Math.min(100, Math.max(0, progress));
             }
+            // A claim being handed to a named claimant is no longer up for grabs:
+            // drop it from the list claims_stealable and claims_steal read, so it
+            // cannot be stolen while the handoff is pending or after it is accepted.
+            delete store.stealable[issueId];
             store.claims[issueId] = claim;
             saveClaims(store);
             return {
@@ -402,6 +410,10 @@ export const claimsTools = [
             if (progress !== undefined) {
                 claim.progress = Math.min(100, Math.max(0, progress));
             }
+            // claims_status never sets 'stealable', so a claim it updates is no
+            // longer up for grabs: drop it from the list claims_stealable and
+            // claims_steal read.
+            delete store.stealable[issueId];
             store.claims[issueId] = claim;
             saveClaims(store);
             return {
@@ -592,7 +604,9 @@ export const claimsTools = [
             claim.claimant = stealer;
             claim.status = 'active';
             claim.statusChangedAt = now;
-            claim.context = stealableInfo.context;
+            // The context given to claims_mark-stealable is the handoff note for the
+            // stealer; without one, keep the context recorded with the claim.
+            claim.context = stealableInfo.context ?? claim.context;
             delete store.stealable[issueId];
             store.claims[issueId] = claim;
             saveClaims(store);
@@ -672,12 +686,12 @@ export const claimsTools = [
                     return { success: false, error: v.error };
             }
             const store = loadClaims();
-            const claims = Object.values(store.claims);
+            // A completed claim stays in the store but is no longer work in hand,
+            // so it does not count toward an agent's load.
+            const openAgentClaims = Object.values(store.claims).filter(isOpenAgentClaim);
             // Group claims by agent
             const agentLoads = new Map();
-            for (const claim of claims) {
-                if (claim.claimant.type !== 'agent')
-                    continue;
+            for (const claim of openAgentClaims) {
                 const key = claim.claimant.agentId;
                 if (!agentLoads.has(key)) {
                     agentLoads.set(key, {
@@ -717,7 +731,7 @@ export const claimsTools = [
                 success: true,
                 loads: result,
                 totalAgents: result.length,
-                totalClaims: claims.filter(c => c.claimant.type === 'agent').length,
+                totalClaims: openAgentClaims.length,
                 avgUtilization: result.length > 0
                     ? result.reduce((sum, l) => sum + l.utilization, 0) / result.length
                     : 0,
@@ -796,12 +810,11 @@ export const claimsTools = [
             const dryRun = input.dryRun !== false;
             const targetUtilization = input.targetUtilization || 0.7;
             const store = loadClaims();
-            const claims = Object.values(store.claims);
+            // Completed claims are not load, as in claims_load.
+            const openAgentClaims = Object.values(store.claims).filter(isOpenAgentClaim);
             // Group by agent
             const agentLoads = new Map();
-            for (const claim of claims) {
-                if (claim.claimant.type !== 'agent')
-                    continue;
+            for (const claim of openAgentClaims) {
                 const key = claim.claimant.agentId;
                 if (!agentLoads.has(key)) {
                     agentLoads.set(key, { agentId: key, agentType: claim.claimant.agentType, claims: [] });

package/dist/src/mcp-tools/daa-tools.js

@@ -28,17 +28,37 @@ function ensureDAADir() {
         mkdirSync(dir, { recursive: true });
     }
 }
+/**
+ * SECURITY: record maps are keyed by ids taken from MCP tool input, and
+ * validateIdentifier accepts names like `__proto__` and `constructor`. On a
+ * plain object those resolve to Object.prototype or a built-in, which a handler
+ * would then write into. Null-prototype maps only ever return own records.
+ */
+function withRecordMaps(store, keys) {
+    const maps = store;
+    for (const key of keys) {
+        const map = maps[key];
+        if (map && typeof map === 'object' && !Array.isArray(map))
+            Object.setPrototypeOf(map, null);
+        else
+            maps[key] = Object.create(null);
+    }
+    return store;
+}
+const DAA_MAPS = ['agents', 'workflows', 'knowledge'];
 function loadDAAStore() {
     try {
         const path = getDAAPath();
         if (existsSync(path)) {
-            return JSON.parse(readFileSync(path, 'utf-8'));
+            const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                return withRecordMaps(parsed, DAA_MAPS);
         }
     }
     catch {
         // Return empty store
     }
-    return { agents: {}, workflows: {}, knowledge: {}, version: '3.0.0' };
+    return withRecordMaps({ agents: {}, workflows: {}, knowledge: {}, version: '3.0.0' }, DAA_MAPS);
 }
 function saveDAAStore(store) {
     ensureDAADir();

package/dist/src/mcp-tools/embeddings-tools.js

@@ -425,7 +425,8 @@ export const embeddingsTools = [
             }
             const query = input.query;
             const topK = input.topK || 5;
-            const threshold = input.threshold || 0.5;
+            // `??`, not `||`: threshold 0 is a valid request for every match, as in memory_search.
+            const threshold = input.threshold ?? 0.5;
             const namespace = input.namespace;
             {
                 const v = validateText(query, 'query');

package/dist/src/mcp-tools/hooks-tools.js

@@ -4096,11 +4096,21 @@ export const hooksIntelligenceLearn = {
     inputSchema: {
         type: 'object',
         properties: {
-            trajectoryIds: { type: 'array', items: { type: 'string' }, description: 'Specific trajectories to learn from' },
+            trajectoryIds: { type: 'array', items: { type: 'string' }, description: 'Not supported: a learning cycle always covers every recorded trajectory. Supplying this returns an error and runs nothing, rather than learning from more than was asked (#4693).' },
             consolidate: { type: 'boolean', description: 'Run EWC++ consolidation' },
         },
     },
     handler: async (params) => {
+        // #4693: distillLearning() and the background pass have no way to select
+        // trajectories, so a request scoped to some must not trigger learning over all.
+        // Refuse it before anything is imported or mutated; omitting the field is unchanged.
+        if (params.trajectoryIds !== undefined) {
+            return {
+                success: false,
+                learned: false,
+                error: 'hooks_intelligence_learn: trajectoryIds is not supported; a learning cycle always covers every recorded trajectory. Omit trajectoryIds to run it.',
+            };
+        }
         const consolidate = params.consolidate !== false;
         const startTime = Date.now();
         // AUDIT FIX #5: actually TRIGGER a learning/consolidation cycle instead of

package/dist/src/mcp-tools/session-tools.js

@@ -3,10 +3,10 @@
  *
  * Tool definitions for session management with file persistence.
  */
-import { existsSync, readFileSync, readdirSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, unlinkSync, statSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { gunzipSync } from 'node:zlib';
-import { join } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { getProjectCwd } from './types.js';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
@@ -351,6 +351,41 @@ function isSessionRecordLike(value) {
     const v = value;
     return 'data' in v || 'stats' in v || 'sessionId' in v || 'savedAt' in v;
 }
+/**
+ * SECURITY: `outputPath` comes from MCP tool input. Resolve it against the
+ * project root and require the real (symlink-resolved) parent directory to stay
+ * inside the real project root, and refuse an existing symlink as the target,
+ * so session_export cannot write files elsewhere on the host. The CLI's
+ * `session export` writes its own file and does not pass outputPath.
+ */
+function containedExportPath(outputPath) {
+    if (!outputPath || outputPath.includes('\0'))
+        return null;
+    try {
+        const root = realpathSync(getProjectCwd());
+        const abs = resolve(root, outputPath);
+        const parent = realpathSync(dirname(abs));
+        const target = join(parent, basename(abs));
+        const rel = relative(root, target);
+        if (!rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+            return null;
+        const existing = lstatOrNull(target);
+        if (existing && (existing.isSymbolicLink() || !existing.isFile()))
+            return null;
+        return target;
+    }
+    catch {
+        return null;
+    }
+}
+function lstatOrNull(p) {
+    try {
+        return lstatSync(p);
+    }
+    catch {
+        return null;
+    }
+}
 export const sessionTools = [
     {
         name: 'session_save',
@@ -705,9 +740,12 @@ export const sessionTools = [
             let path = null;
             const outputPath = input.outputPath ? String(input.outputPath) : null;
             if (outputPath) {
+                const target = containedExportPath(outputPath);
+                if (!target)
+                    return { sessionId, error: 'outputPath must be a file inside the project directory (no symlinks)' };
                 try {
-                    writeFileSync(outputPath, JSON.stringify(session, null, 2), 'utf-8');
-                    path = outputPath;
+                    writeFileSync(target, JSON.stringify(session, null, 2), 'utf-8');
+                    path = target;
                 }
                 catch (e) {
                     return { sessionId, error: `Could not write ${outputPath}: ${e.message}` };

package/dist/src/mcp-tools/task-tools.js

@@ -117,6 +117,10 @@ export const taskTools = [
             const vDesc = validateText(input.description, 'description');
             if (!vDesc.valid)
                 return { success: false, error: vDesc.error };
+            if (input.assignTo !== undefined && (!Array.isArray(input.assignTo)
+                || !input.assignTo.every(id => validateIdentifier(id, 'assignTo').valid))) {
+                return { success: false, error: 'assignTo must be an array of agent ids' };
+            }
             const store = loadTaskStore();
             const taskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const task = {
@@ -134,6 +138,13 @@ export const taskTools = [
             };
             store.tasks[taskId] = task;
             saveTaskStore(store);
+            // Assigning at creation must mark the workers busy, as task_assign and task_update do;
+            // otherwise they read idle while holding the task, and task_complete or task_cancel,
+            // which only release a worker whose currentTask is this task, never free them either.
+            updateAgents(task.assignedTo, (agent) => {
+                agent.status = 'busy';
+                agent.currentTask = taskId;
+            });
             return {
                 taskId,
                 type: task.type,

package/dist/src/mcp-tools/terminal-tools.js

@@ -132,6 +132,11 @@ export const terminalTools = [
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const command = input.command;
+            // An explicit sessionId must name a stored session; only fall back to
+            // (or create) the default session when no sessionId was given.
+            if (sessionId && !store.sessions[sessionId]) {
+                return { success: false, error: 'Session not found' };
+            }
             // Find or create default session
             let session = sessionId ? store.sessions[sessionId] : Object.values(store.sessions).find(s => s.status === 'active');
             if (!session) {

package/dist/src/mcp-tools/workflow-tools.js

@@ -55,18 +55,37 @@ function ensureWorkflowDir() {
         mkdirSync(dir, { recursive: true });
     }
 }
+/**
+ * SECURITY: record maps are keyed by ids taken from MCP tool input, and
+ * validateIdentifier accepts names like `__proto__` and `constructor`. On a
+ * plain object those resolve to Object.prototype or a built-in, which a handler
+ * would then write into. Null-prototype maps only ever return own records.
+ */
+function withRecordMaps(store, keys) {
+    const maps = store;
+    for (const key of keys) {
+        const map = maps[key];
+        if (map && typeof map === 'object' && !Array.isArray(map))
+            Object.setPrototypeOf(map, null);
+        else
+            maps[key] = Object.create(null);
+    }
+    return store;
+}
+const WORKFLOW_MAPS = ['workflows', 'templates'];
 function loadWorkflowStore() {
     try {
         const path = getWorkflowPath();
         if (existsSync(path)) {
-            const data = readFileSync(path, 'utf-8');
-            return JSON.parse(data);
+            const data = JSON.parse(readFileSync(path, 'utf-8'));
+            if (data && typeof data === 'object' && !Array.isArray(data))
+                return withRecordMaps(data, WORKFLOW_MAPS);
         }
     }
     catch {
         // Return default store on error
     }
-    return { workflows: {}, templates: {}, version: '3.0.0' };
+    return withRecordMaps({ workflows: {}, templates: {}, version: '3.0.0' }, WORKFLOW_MAPS);
 }
 function saveWorkflowStore(store) {
     ensureWorkflowDir();

package/dist/src/memory/memory-bridge.js

@@ -1540,15 +1540,39 @@ export async function bridgeListEntries(options) {
         // List
         const entries = [];
         try {
-            // Include tags so export/list can round-trip them.
-            const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type, expires_at, tags
+            const columns = 'id, key, namespace, content, embedding, access_count, created_at, updated_at, provenance_type, expires_at, tags';
+            const listLimit = options.includeEmbedding ? Math.min(safeLimit, MAX_LIST_EMBEDDINGS) : safeLimit;
+            // #4686: sort only row identities first, then fetch the payload for the
+            // page. The old query sorted full `content`/`embedding` payloads for
+            // every row and discarded all but the requested page.
+            const pagedSql = `
+        SELECT ${columns}
+        FROM memory_entries
+        WHERE _rowid_ IN (
+          SELECT _rowid_
+          FROM memory_entries
+          WHERE ${statusFilter} ${extraFilter}
+          ORDER BY updated_at DESC
+          LIMIT ? OFFSET ?
+        )
+        ORDER BY updated_at DESC
+      `;
+            const originalSql = `
+        SELECT ${columns}
         FROM memory_entries
         WHERE ${statusFilter} ${extraFilter}
         ORDER BY updated_at DESC
         LIMIT ? OFFSET ?
-      `);
-            const rows = stmt.all(...filterParams, options.includeEmbedding ? Math.min(safeLimit, MAX_LIST_EMBEDDINGS) : safeLimit, safeOffset);
+      `;
+            let rows;
+            try {
+                rows = ctx.db.prepare(pagedSql).all(...filterParams, listLimit, safeOffset);
+            }
+            catch {
+                // WITHOUT ROWID/legacy tables have no _rowid_: preserve the original
+                // query rather than failing the page.
+                rows = ctx.db.prepare(originalSql).all(...filterParams, listLimit, safeOffset);
+            }
             for (const row of rows) {
                 let tags = [];
                 if (row.tags) {