@claude-flow/cli 3.71.4 → 3.72.0

package/dist/src/mcp-tools/security-tools.d.ts

@@ -10,6 +10,15 @@
  * Created with ❤️ by ruv.io
  */
 import type { MCPTool } from './types.js';
+/**
+ * Pattern-pack selection for the shared defender (#4785, ADR-517), read once
+ * per process from RUFLO_AIDEFENCE_PACKS:
+ *   unset/empty  current default (option omitted)
+ *   true|false   all enabled packs | built-in patterns only
+ *   a,b,c        exactly the named packs
+ * Anything else is refused rather than silently falling back.
+ */
+export declare function aidefencePackSelection(raw?: string | undefined): boolean | string[] | undefined;
 /**
  * Export all security tools
  */

package/dist/src/mcp-tools/security-tools.js

@@ -33,6 +33,42 @@ const wrapperStats = {
     quickScanCalls: 0,
     quickScanThreats: 0,
 };
+const KNOWN_PACKS = new Set([
+    'core',
+    'tool_invocation',
+    'exfil_url',
+    'encoded_instruction',
+    'slack_markup_forgery',
+    'instruction_override_i18n',
+]);
+/**
+ * Pattern-pack selection for the shared defender (#4785, ADR-517), read once
+ * per process from RUFLO_AIDEFENCE_PACKS:
+ *   unset/empty  current default (option omitted)
+ *   true|false   all enabled packs | built-in patterns only
+ *   a,b,c        exactly the named packs
+ * Anything else is refused rather than silently falling back.
+ */
+export function aidefencePackSelection(raw = process.env.RUFLO_AIDEFENCE_PACKS) {
+    const value = raw?.trim();
+    if (!value)
+        return undefined;
+    const lower = value.toLowerCase();
+    if (lower === 'true')
+        return true;
+    if (lower === 'false')
+        return false;
+    const names = value.split(',').map(name => name.trim()).filter(Boolean);
+    const unknown = names.filter(name => !KNOWN_PACKS.has(name));
+    if (names.length === 0 || unknown.length > 0) {
+        throw new Error(`Invalid RUFLO_AIDEFENCE_PACKS=${JSON.stringify(value)}: use true, false, or a comma list of ${[...KNOWN_PACKS].join(', ')}`);
+    }
+    return [...new Set(names)];
+}
+function aidefenceOptions() {
+    const packs = aidefencePackSelection();
+    return packs === undefined ? { enableLearning: true } : { enableLearning: true, packs };
+}
 /**
  * Get or create AIDefence instance (throws if unavailable)
  */
@@ -44,7 +80,7 @@ async function getAIDefence() {
     // First attempt - try to load via dynamic import (ESM)
     try {
         const aidefence = await import(packageName);
-        const instance = aidefence.createAIDefence({ enableLearning: true });
+        const instance = aidefence.createAIDefence(aidefenceOptions());
         if (!instance) {
             throw new Error('createAIDefence returned null');
         }
@@ -81,7 +117,7 @@ async function getAIDefence() {
     // the module cache is stable across the await boundary.
     try {
         const aidefence = await import(packageName);
-        const instance = aidefence.createAIDefence({ enableLearning: true });
+        const instance = aidefence.createAIDefence(aidefenceOptions());
         if (instance) {
             aidefenceInstance = instance;
             console.error(`[claude-flow] ${packageName} loaded after install (resolver path)`);
@@ -95,7 +131,7 @@ async function getAIDefence() {
         const modulePath = require.resolve(packageName);
         const cacheBust = `?t=${Date.now()}`;
         const aidefence = await import(`file://${modulePath}${cacheBust}`);
-        const instance = aidefence.createAIDefence({ enableLearning: true });
+        const instance = aidefence.createAIDefence(aidefenceOptions());
         if (!instance) {
             throw new Error('createAIDefence returned null after install');
         }

package/dist/src/mcp-tools/session-tools.js

@@ -9,6 +9,7 @@ import { gunzipSync } from 'node:zlib';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
 import { containedWritePath } from './path-containment.js';
+import { MAX_IMPORT_BYTES, readImportFile } from './import-limits.js';
 import { mkdirRestricted, readFileMaybeEncrypted, writeFileRestricted, } from '../fs-secure.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 function isRecord(value) {
@@ -729,7 +730,7 @@ export const sessionTools = [
         inputSchema: {
             type: 'object',
             properties: {
-                inputPath: { type: 'string', description: 'Path to the session JSON file to import (or pass data)' },
+                inputPath: { type: 'string', description: 'Path to the session JSON file to import (or pass data); file and gzip output are each limited to 16 MiB' },
                 data: { type: 'object', description: 'The session record itself, as written by session_export (or pass inputPath)' },
                 name: { type: 'string', description: 'Override the imported session name' },
                 activate: { type: 'boolean', description: 'Restore the imported session into the active stores' },
@@ -747,8 +748,9 @@ export const sessionTools = [
                 if (!existsSync(inputPath))
                     return { error: `File not found: ${inputPath}` };
                 try {
-                    const bytes = readFileSync(inputPath);
-                    const content = bytes[0] === 0x1f && bytes[1] === 0x8b ? gunzipSync(bytes) : bytes;
+                    const bytes = readImportFile(inputPath);
+                    const content = bytes[0] === 0x1f && bytes[1] === 0x8b
+                        ? gunzipSync(bytes, { maxOutputLength: MAX_IMPORT_BYTES }) : bytes;
                     parsed = JSON.parse(content.toString('utf-8'));
                 }
                 catch (e) {

package/dist/src/mcp-tools/swarm-tools.js

@@ -4,9 +4,9 @@
  * Tool definitions for swarm coordination with file-based state persistence.
  * Replaces previous stub implementations with real state tracking.
  */
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { closeSync, existsSync, mkdirSync, openSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { join } from 'node:path';
-import { nullPrototypeRecords } from './record-store.js';
+import { nullPrototypeRecords, readPreservedJsonStore } from './record-store.js';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier } from './validate-input.js';
 import { createApscState, isApscAgentEligible, normalizeApscConfig, recordApscSignal, } from '../services/pheromone-adaptive.js';
@@ -85,16 +85,17 @@ function reconcileOrphanSwarms(store) {
 // #2085 — exported so `agent-tools.ts agent_spawn` can push into
 // `swarm.agents` (the field `swarm_status` reads).
 export function loadSwarmStore() {
-    let store = { swarms: {}, version: '3.0.0' };
-    try {
-        const path = getSwarmStatePath();
-        if (existsSync(path)) {
-            store = JSON.parse(readFileSync(path, 'utf-8'));
-        }
-    }
-    catch { /* fall through with default */ }
-    if (!store || typeof store !== 'object' || Array.isArray(store))
-        store = { swarms: {}, version: '3.0.0' };
+    // #4737: a parse error used to fall through to an empty store, and the next
+    // save (or orphan reconcile) overwrote swarm-state.json. Only a missing
+    // file is empty; corrupt bytes are copied aside and the error is reported.
+    const store = readPreservedJsonStore(getSwarmStatePath(), 'swarm', () => ({ swarms: {}, version: '3.0.0' }), (candidate) => {
+        const swarms = candidate.swarms;
+        return swarms === undefined || (!!swarms && typeof swarms === 'object' && !Array.isArray(swarms));
+    });
+    if (!store.swarms)
+        store.swarms = {};
+    // Record ids come from MCP input. A null prototype stops `__proto__` and
+    // `constructor` from resolving onto Object.prototype.
     store.swarms = nullPrototypeRecords(store.swarms);
     // #1799 — reconcile orphans on every load and persist if anything changed.
     // Cheap (process.kill(pid, 0) is sub-millisecond) and means
@@ -369,14 +370,18 @@ export const swarmTools = [
             }
             const store = loadSwarmStore();
             const swarmId = input.swarmId;
-            if (swarmId && store.swarms[swarmId]) {
+            if (swarmId && !store.swarms[swarmId]) {
+                return { success: false, error: `Swarm ${swarmId} not found` };
+            }
+            const { getLiveAgentIds } = await import('./agent-tools.js');
+            if (swarmId) {
                 const swarm = store.swarms[swarmId];
                 return {
                     swarmId: swarm.swarmId,
                     status: swarm.status,
                     topology: swarm.topology,
                     maxAgents: swarm.maxAgents,
-                    agentCount: swarm.agents.length,
+                    agentCount: getLiveAgentIds(swarm.agents).length,
                     taskCount: swarm.tasks.length,
                     config: swarm.config,
                     apsc: apscStateOf(swarm),
@@ -401,7 +406,7 @@ export const swarmTools = [
                 status: latest.status,
                 topology: latest.topology,
                 maxAgents: latest.maxAgents,
-                agentCount: latest.agents.length,
+                agentCount: getLiveAgentIds(latest.agents).length,
                 taskCount: latest.tasks.length,
                 config: latest.config,
                 apsc: apscStateOf(latest),
@@ -433,7 +438,7 @@ export const swarmTools = [
             const swarmId = input.swarmId;
             // Find the swarm
             let target;
-            if (swarmId && store.swarms[swarmId]) {
+            if (swarmId) {
                 target = store.swarms[swarmId];
             }
             else {
@@ -456,6 +461,19 @@ export const swarmTools = [
                     error: 'Swarm already terminated',
                 };
             }
+            const { agentTools, getLiveAgentIds } = await import('./agent-tools.js');
+            const terminateAgent = agentTools.find(tool => tool.name === 'agent_terminate');
+            let agentsTerminated = 0;
+            for (const agentId of getLiveAgentIds(target.agents)) {
+                const result = await terminateAgent.handler({
+                    agentId,
+                    force: input.graceful === false,
+                });
+                if (!result.success) {
+                    return { success: false, swarmId: target.swarmId, agentsTerminated, error: result.error };
+                }
+                agentsTerminated++;
+            }
             target.status = 'terminated';
             target.updatedAt = new Date().toISOString();
             saveSwarmStore(store);
@@ -464,7 +482,7 @@ export const swarmTools = [
                 swarmId: target.swarmId,
                 terminated: true,
                 graceful: input.graceful ?? true,
-                agentsTerminated: target.agents.length,
+                agentsTerminated,
                 terminatedAt: target.updatedAt,
             };
         },

package/dist/src/mcp-tools/task-tools.js

@@ -93,6 +93,37 @@ function releaseAgents(agentIds, taskId) {
         }
     });
 }
+/**
+ * Stores `task_assign` may bind an agent from.
+ *
+ * The canonical file is `.claude-flow/agents/store.json`. `hive-mind_spawn`
+ * writes its workers to `.claude-flow/agents.json` instead (#1916), so an id
+ * that exists in either store is a real agent. A corrupt canonical store
+ * throws, matching the read this handler already performed, so a bad file is
+ * never replaced. The hive file stays best-effort: a corrupt copy must not
+ * hide agents that are present in the canonical store.
+ */
+function assignableAgentStores() {
+    const canonical = readRecordStore(join(getProjectCwd(), STORAGE_DIR, 'agents', 'store.json'), 'agents', () => ({ agents: {} }));
+    const stores = [canonical.agents];
+    const hivePath = join(getProjectCwd(), STORAGE_DIR, 'agents.json');
+    try {
+        if (!existsSync(hivePath))
+            return stores;
+        const parsed = JSON.parse(readFileSync(hivePath, 'utf-8'));
+        const agents = parsed?.agents;
+        if (agents && typeof agents === 'object' && !Array.isArray(agents)) {
+            stores.push(agents);
+        }
+    }
+    catch {
+        // Best-effort, same as updateAgents.
+    }
+    return stores;
+}
+function agentIsAssignable(id, stores) {
+    return stores.some((agents) => Object.prototype.hasOwnProperty.call(agents, id) && Boolean(agents[id]));
+}
 export const taskTools = [
     {
         name: 'task_create',
@@ -450,10 +481,20 @@ export const taskTools = [
             if (!task) {
                 return { taskId, error: 'Task not found' };
             }
+            // Completed and cancelled tasks are terminal (#4725). Assigning a
+            // completed task marks the agent busy, and task_complete then returns
+            // without releasing it; task_cancel refuses a finished task too, so
+            // nothing ever sets that agent back to idle.
+            if (task.status === 'completed' || task.status === 'cancelled') {
+                return {
+                    success: false,
+                    taskId,
+                    status: task.status,
+                    error: `Cannot assign a ${task.status} task`,
+                };
+            }
             const previouslyAssigned = [...task.assignedTo];
-            // Load agent store to sync worker state
-            const agentStorePath = join(getProjectCwd(), STORAGE_DIR, 'agents', 'store.json');
-            readRecordStore(agentStorePath, 'agents', () => ({ agents: {} }));
+            const agentStores = assignableAgentStores();
             if (input.unassign) {
                 // Revert previously assigned agents to idle
                 releaseAgents(previouslyAssigned, taskId);
@@ -461,6 +502,20 @@ export const taskTools = [
             }
             else {
                 const agentIds = input.agentIds || [];
+                // An id in neither store is a ghost owner: the task would go
+                // in_progress with nobody to do the work (#4725).
+                if (Array.isArray(agentIds)) {
+                    const missing = agentIds.filter((id) => typeof id === 'string' && !agentIsAssignable(id, agentStores));
+                    if (missing.length > 0) {
+                        const listed = missing.join(', ');
+                        return {
+                            success: false,
+                            taskId,
+                            status: task.status,
+                            error: missing.length === 1 ? `Agent not found: ${listed}` : `Agents not found: ${listed}`,
+                        };
+                    }
+                }
                 // Revert old agents to idle
                 releaseAgents(previouslyAssigned.filter((id) => !agentIds.includes(id)), taskId);
                 // Set new agents to active
@@ -569,21 +624,29 @@ export const taskTools = [
             const original = store.tasks[taskId];
             if (!original)
                 return { success: false, taskId, error: 'Task not found' };
+            const retainState = input.resetState === false;
             const newTaskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-            store.tasks[newTaskId] = {
+            const retry = {
                 taskId: newTaskId,
                 type: original.type,
                 description: original.description,
                 priority: original.priority,
                 status: 'pending',
-                progress: 0,
+                progress: retainState ? original.progress ?? 0 : 0,
                 assignedTo: [...original.assignedTo],
                 tags: [...original.tags, 'retry-of:' + taskId],
                 createdAt: new Date().toISOString(),
                 startedAt: null,
                 completedAt: null,
             };
+            if (retainState && original.result !== undefined)
+                retry.result = original.result;
+            store.tasks[newTaskId] = retry;
             saveTaskStore(store);
+            updateAgents(retry.assignedTo, (agent) => {
+                agent.status = 'busy';
+                agent.currentTask = newTaskId;
+            });
             return {
                 taskId,
                 newTaskId,

package/dist/src/mcp-tools/terminal-tools.js

@@ -144,6 +144,15 @@ export const terminalTools = [
             }
             // Find or create default session
             let session = sessionId ? store.sessions[sessionId] : Object.values(store.sessions).find(s => s.status === 'active');
+            // #4730: terminal_close only flips status to "closed". Executing anyway
+            // ran the command and then wrote status back to "active", so a closed
+            // session kept accepting commands. Reject anything that is not active
+            // before the process is spawned and before that status write. When no
+            // sessionId was given, the lookup above already selected an active
+            // session (or we create one below).
+            if (session && session.status !== 'active') {
+                return { success: false, error: `Session is not active (${session.status})` };
+            }
             if (!session) {
                 // Create default session
                 const id = `term-${Date.now()}-${randomBytes(4).toString('hex')}`;

package/dist/src/mcp-tools/workflow-tools.js

@@ -8,6 +8,7 @@ import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier, validatePath, validateText } from './validate-input.js';
 import { executeAgentTask } from './agent-execute-core.js';
+import { readPreservedJsonStore } from './record-store.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const WORKFLOW_DIR = 'workflows';
@@ -73,19 +74,19 @@ function withRecordMaps(store, keys) {
     return store;
 }
 const WORKFLOW_MAPS = ['workflows', 'templates'];
+function isRecordMap(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
 function loadWorkflowStore() {
-    try {
-        const path = getWorkflowPath();
-        if (existsSync(path)) {
-            const data = JSON.parse(readFileSync(path, 'utf-8'));
-            if (data && typeof data === 'object' && !Array.isArray(data))
-                return withRecordMaps(data, WORKFLOW_MAPS);
-        }
-    }
-    catch {
-        // Return default store on error
-    }
-    return withRecordMaps({ workflows: {}, templates: {}, version: '3.0.0' }, WORKFLOW_MAPS);
+    // #4737: a parse error used to return an empty store, and the next save
+    // overwrote the file. Only a missing file is empty; corrupt bytes are
+    // copied aside and the error is reported.
+    const path = getWorkflowPath();
+    const data = readPreservedJsonStore(path, 'workflow', () => ({ workflows: {}, templates: {}, version: '3.0.0' }), (store) => WORKFLOW_MAPS.every((key) => {
+        const map = store[key];
+        return map === undefined || isRecordMap(map);
+    }));
+    return withRecordMaps(data, WORKFLOW_MAPS);
 }
 function saveWorkflowStore(store) {
     ensureWorkflowDir();

package/dist/src/mcp-tools/x-federation-join.js

@@ -1,14 +1,53 @@
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join, dirname } from 'node:path';
-// ADR-125 precedence: tool args (relayHttp / relayWs / keyFile) take precedence over the
-// RUFLO_X_RELAY_HTTP / RUFLO_X_RELAY_WS / RUFLO_NOSTR_KEY_FILE env vars, which precede defaults.
+import { join, dirname, isAbsolute, relative, resolve } from 'node:path';
+// Host configuration precedes defaults. Caller key overrides stay under ~/.ruflo;
+// a caller relayWs must match the configured relay. relayHttp keeps ADR-125 precedence.
 const HTTP_BASE = (o) => (o || process.env.RUFLO_X_RELAY_HTTP || 'https://relay.ruv.io').replace(/\/$/, '');
 const RELAY_WS = (o) => o || process.env.RUFLO_X_RELAY_WS || 'wss://relay.ruv.io';
 const KEY_FILE = () => process.env.RUFLO_NOSTR_KEY_FILE || join(homedir(), '.ruflo', 'nostr.key');
 const hex = (b) => Buffer.from(b).toString('hex');
 const unhex = (h) => Uint8Array.from(Buffer.from(h, 'hex'));
+function callerKeyFile(value) {
+    // Host configuration is trusted; an MCP argument cannot select a different host file.
+    if (value === undefined)
+        return KEY_FILE();
+    if (typeof value !== 'string' || !value)
+        throw new Error('keyFile must name a file under ~/.ruflo');
+    const root = resolve(homedir(), '.ruflo');
+    const target = resolve(value);
+    const rel = relative(root, target);
+    if (!rel || rel === '..' || rel.startsWith('../') || rel.startsWith('..\\') || isAbsolute(rel)) {
+        throw new Error('keyFile must name a file under ~/.ruflo');
+    }
+    for (let current = target;; current = dirname(current)) {
+        try {
+            if (lstatSync(current).isSymbolicLink())
+                throw new Error('keyFile must not follow symlinks');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (relative(root, current) === '')
+            break;
+    }
+    return target;
+}
+function configuredRelay(value) {
+    const configured = new URL(RELAY_WS());
+    if (value !== undefined && typeof value !== 'string')
+        throw new Error('relayWs must be the configured relay URL');
+    const requested = new URL(value === undefined ? configured.href : value);
+    const localTestRelay = Boolean(process.env.RUFLO_X_RELAY_WS)
+        && configured.protocol === 'ws:' && ['localhost', '127.0.0.1', '[::1]'].includes(configured.hostname);
+    if ((!localTestRelay && configured.protocol !== 'wss:') || requested.href !== configured.href
+        || requested.username || requested.password || requested.hash) {
+        throw new Error('relayWs must use wss and match the configured relay (explicit loopback ws configuration is allowed)');
+    }
+    return requested.href;
+}
 async function loadNostrTools() {
     try {
         return (await import('nostr-tools/pure'));
@@ -24,7 +63,7 @@ export function loadOrCreateKey(nt, file = KEY_FILE()) {
     }
     mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
     const sk = nt.generateSecretKey();
-    writeFileSync(file, hex(sk), { mode: 0o600 });
+    writeFileSync(file, hex(sk), { mode: 0o600, flag: 'wx' });
     return { sk, pubkey: nt.getPublicKey(sk), created: true };
 }
 export function nip98Header(nt, sk, url, method, body) {
@@ -80,24 +119,26 @@ export const xFederationJoinTools = [{
                 code: { type: 'string', description: 'Optional private invite code (v2.…), for invite-only relays.' },
                 gatewayUrl: { type: 'string', description: 'Public registration gateway origin; defaults to https://x.ruv.io.' },
                 relayHttp: { type: 'string', description: 'Relay HTTPS base for the claim; takes precedence over RUFLO_X_RELAY_HTTP.' },
-                relayWs: { type: 'string', description: 'Relay wss URL for NIP-42; takes precedence over RUFLO_X_RELAY_WS.' },
-                keyFile: { type: 'string', description: 'Key file path; takes precedence over RUFLO_NOSTR_KEY_FILE (default ~/.ruflo/nostr.key).' }
+                relayWs: { type: 'string', description: 'Relay wss URL for NIP-42; must match RUFLO_X_RELAY_WS or the default relay.' },
+                keyFile: { type: 'string', description: 'Caller-selected file under ~/.ruflo (no symlinks). Omit to use host RUFLO_NOSTR_KEY_FILE or ~/.ruflo/nostr.key.' }
             }, required: [] },
         handler: async (input) => {
             const i = input;
-            const nt = await loadNostrTools();
             // Validate input before the optional-dependency check so a bad code fails fast and identically
             // whether or not nostr-tools is present.
             if (i.code !== undefined && !/^v2\.[A-Za-z0-9._-]{8,}$/.test(i.code))
                 throw new Error('invite code must look like v2.<token>');
+            const registrationBase = i.code ? undefined : secureBase(i.gatewayUrl || process.env.RUFLO_X_GATEWAY_URL || 'https://x.ruv.io');
+            const keyFile = callerKeyFile(i.keyFile);
+            const relayWs = configuredRelay(i.relayWs);
+            const nt = await loadNostrTools();
             if (!nt)
                 return { degraded: true, reason: 'nostr-tools not installed', hint: 'npm i -g nostr-tools  (secp256k1 signing is not in node:crypto)' };
-            const registrationBase = i.code ? undefined : secureBase(i.gatewayUrl || process.env.RUFLO_X_GATEWAY_URL || 'https://x.ruv.io');
-            const { sk, pubkey, created } = loadOrCreateKey(nt, i.keyFile);
+            const { sk, pubkey, created } = loadOrCreateKey(nt, keyFile);
             // Existing members need no new grant. In particular never downgrade/re-admit
             // their key just because they run join again.
             if (!i.code) {
-                const existing = await verifyMembership(nt, sk, RELAY_WS(i.relayWs));
+                const existing = await verifyMembership(nt, sk, relayWs);
                 if (existing.ok)
                     return { ok: true, pubkey, keyCreated: created, membershipVerified: true, alreadyMember: true };
             }
@@ -108,7 +149,7 @@ export const xFederationJoinTools = [{
                 r = await fetch(url, { method: 'POST', redirect: 'error', headers: { Authorization: nip98Header(nt, sk, url, 'POST', body), 'Content-Type': 'application/json' }, body, signal: AbortSignal.timeout(20_000) });
             }
             catch {
-                const check = await verifyMembership(nt, sk, RELAY_WS(i.relayWs));
+                const check = await verifyMembership(nt, sk, relayWs);
                 if (check.ok)
                     return { ok: true, pubkey, keyCreated: created, membershipVerified: true };
                 throw new Error('Admission response unavailable and relay membership unverified. Keep your local key and retry; do not create another identity.');
@@ -117,12 +158,12 @@ export const xFederationJoinTools = [{
             if (!r.ok) {
                 // A lost acknowledgment can follow a successful grant. Check with the
                 // relay before declaring failure; never silently generate a second key.
-                const check = await verifyMembership(nt, sk, RELAY_WS(i.relayWs));
+                const check = await verifyMembership(nt, sk, relayWs);
                 if (check.ok)
                     return { ok: true, pubkey, keyCreated: created, membershipVerified: true };
                 throw new Error(`join rejected (${r.status}): ${claim.error ?? claim.message ?? 'unknown'}`);
             }
-            const auth = await verifyMembership(nt, sk, RELAY_WS(i.relayWs));
+            const auth = await verifyMembership(nt, sk, relayWs);
             return { ok: auth.ok, pubkey, keyCreated: created, role: claim.role ?? 'member', membershipVerified: auth.ok, ...(auth.ok ? {} : { reason: auth.reason }),
                 next: 'Publish kind-1 events tagged ["t","ruflo-swarm"] — or run `ruflo federation sync` to read the swarm.' };
         },

package/dist/src/memory/intelligence.d.ts

@@ -152,6 +152,12 @@ declare class LocalReasoningBank {
     private persistenceEnabled;
     private dirty;
     private saveTimeout;
+    /** IDs changed locally since the last successful flush. */
+    private dirtyIds;
+    /** IDs deleted locally; a disk copy must not be resurrected. */
+    private deletedIds;
+    /** A local clear() must remove disk entries too. */
+    private clearRequested;
     constructor(options: {
         maxSize: number;
         persistence?: boolean;
@@ -168,6 +174,11 @@ declare class LocalReasoningBank {
     private saveToDisk;
     /**
      * Immediately flush patterns to disk
+     *
+     * Re-reads the file under the cooperating-writer lock and merges only the
+     * patterns this process changed, so a long-lived daemon cannot erase patterns
+     * written by another hook/process (#4735). Deletions and clear() are carried
+     * as tombstones; the write itself is temp-file + rename.
      */
     flushToDisk(): void;
     /**