claude-flow 2.7.31 → 2.7.33

package/dist/src/utils/key-redactor.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/key-redactor.js"],"sourcesContent":["/**\n * API Key Redaction Utility\n * Prevents sensitive data from leaking into logs, memory, or git commits\n */\n\nexport class KeyRedactor {\n  static API_KEY_PATTERNS = [\n    // Anthropic API keys\n    /sk-ant-[a-zA-Z0-9_-]{95,}/gi,\n\n    // OpenRouter API keys\n    /sk-or-[a-zA-Z0-9_-]{32,}/gi,\n\n    // Google/Gemini API keys\n    /AIza[a-zA-Z0-9_-]{35}/gi,\n\n    // Generic API keys\n    /[a-zA-Z0-9_-]{20,}API[a-zA-Z0-9_-]{20,}/gi,\n\n    // Bearer tokens\n    /Bearer\\s+[a-zA-Z0-9_\\-\\.]{20,}/gi,\n\n    // Environment variable format\n    /([A-Z_]+_API_KEY|[A-Z_]+_TOKEN|[A-Z_]+_SECRET)=[\"']?([^\"'\\s]+)[\"']?/gi,\n\n    // Supabase keys\n    /eyJ[a-zA-Z0-9_-]*\\.eyJ[a-zA-Z0-9_-]*\\.[a-zA-Z0-9_-]*/gi,\n  ];\n\n  static SENSITIVE_FIELDS = [\n    'apiKey',\n    'api_key',\n    'token',\n    'secret',\n    'password',\n    'private_key',\n    'privateKey',\n    'accessToken',\n    'access_token',\n    'refreshToken',\n    'refresh_token',\n  ];\n\n  /**\n   * Redact API keys and sensitive data from text\n   */\n  static redact(text, showPrefix = true) {\n    if (!text) return text;\n\n    let redacted = text;\n\n    // Redact using patterns\n    this.API_KEY_PATTERNS.forEach(pattern => {\n      redacted = redacted.replace(pattern, (match) => {\n        if (showPrefix && match.length > 8) {\n          const prefix = match.substring(0, 8);\n          return `${prefix}...[REDACTED]`;\n        }\n        return '[REDACTED_API_KEY]';\n      });\n    });\n\n    return redacted;\n  }\n\n  /**\n   * Redact sensitive fields in objects\n   */\n  static redactObject(obj, deep = true) {\n    if (!obj || typeof obj !== 'object') return obj;\n\n    const redacted = { ...obj };\n\n    Object.keys(redacted).forEach(key => {\n      const lowerKey = key.toLowerCase();\n\n      // Check if field name is sensitive\n      const isSensitive = this.SENSITIVE_FIELDS.some(field =>\n        lowerKey.includes(field)\n      );\n\n      if (isSensitive && typeof redacted[key] === 'string') {\n        const value = redacted[key];\n        if (value && value.length > 8) {\n          redacted[key] = `${value.substring(0, 4)}...[REDACTED]`;\n        } else {\n          redacted[key] = '[REDACTED]';\n        }\n      } else if (deep && typeof redacted[key] === 'object' && redacted[key] !== null) {\n        redacted[key] = this.redactObject(redacted[key], deep);\n      } else if (typeof redacted[key] === 'string') {\n        // Redact any API keys in string values\n        redacted[key] = this.redact(redacted[key]);\n      }\n    });\n\n    return redacted;\n  }\n\n  /**\n   * Sanitize text for safe logging\n   */\n  static sanitize(text) {\n    return this.redact(text, true);\n  }\n\n  /**\n   * Sanitize command arguments\n   */\n  static sanitizeArgs(args) {\n    return args.map(arg => {\n      // Check if arg is a flag value pair\n      if (arg.includes('key') || arg.includes('token') || arg.includes('secret')) {\n        return this.redact(arg);\n      }\n      return arg;\n    });\n  }\n\n  /**\n   * Check if text contains unredacted sensitive data\n   */\n  static containsSensitiveData(text) {\n    return this.API_KEY_PATTERNS.some(pattern => pattern.test(text));\n  }\n\n  /**\n   * Validate that text is safe for logging/storage\n   */\n  static validate(text) {\n    const warnings = [];\n\n    this.API_KEY_PATTERNS.forEach((pattern, index) => {\n      if (pattern.test(text)) {\n        warnings.push(`Potential API key detected (pattern ${index + 1})`);\n      }\n    });\n\n    return {\n      safe: warnings.length === 0,\n      warnings,\n    };\n  }\n\n  /**\n   * Redact environment variables\n   */\n  static redactEnv(env) {\n    const redacted = {};\n\n    Object.keys(env).forEach(key => {\n      const value = env[key];\n      if (!value) {\n        redacted[key] = '';\n        return;\n      }\n\n      const lowerKey = key.toLowerCase();\n      const isSensitive = lowerKey.includes('key') ||\n                         lowerKey.includes('token') ||\n                         lowerKey.includes('secret') ||\n                         lowerKey.includes('password');\n\n      if (isSensitive) {\n        redacted[key] = value.length > 8\n          ? `${value.substring(0, 4)}...[REDACTED]`\n          : '[REDACTED]';\n      } else {\n        redacted[key] = value;\n      }\n    });\n\n    return redacted;\n  }\n}\n\n// Export singleton instance\nexport const redactor = KeyRedactor;\n"],"names":["KeyRedactor","API_KEY_PATTERNS","SENSITIVE_FIELDS","redact","text","showPrefix","redacted","forEach","pattern","replace","match","length","prefix","substring","redactObject","obj","deep","Object","keys","key","lowerKey","toLowerCase","isSensitive","some","field","includes","value","sanitize","sanitizeArgs","args","map","arg","containsSensitiveData","test","validate","warnings","index","push","safe","redactEnv","env","redactor"],"mappings":"AAKA,OAAO,MAAMA;IACX,OAAOC,mBAAmB;QAExB;QAGA;QAGA;QAGA;QAGA;QAGA;QAGA;KACD,CAAC;IAEF,OAAOC,mBAAmB;QACxB;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAAC;IAKF,OAAOC,OAAOC,IAAI,EAAEC,aAAa,IAAI,EAAE;QACrC,IAAI,CAACD,MAAM,OAAOA;QAElB,IAAIE,WAAWF;QAGf,IAAI,CAACH,gBAAgB,CAACM,OAAO,CAACC,CAAAA;YAC5BF,WAAWA,SAASG,OAAO,CAACD,SAAS,CAACE;gBACpC,IAAIL,cAAcK,MAAMC,MAAM,GAAG,GAAG;oBAClC,MAAMC,SAASF,MAAMG,SAAS,CAAC,GAAG;oBAClC,OAAO,GAAGD,OAAO,aAAa,CAAC;gBACjC;gBACA,OAAO;YACT;QACF;QAEA,OAAON;IACT;IAKA,OAAOQ,aAAaC,GAAG,EAAEC,OAAO,IAAI,EAAE;QACpC,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU,OAAOA;QAE5C,MAAMT,WAAW;YAAE,GAAGS,GAAG;QAAC;QAE1BE,OAAOC,IAAI,CAACZ,UAAUC,OAAO,CAACY,CAAAA;YAC5B,MAAMC,WAAWD,IAAIE,WAAW;YAGhC,MAAMC,cAAc,IAAI,CAACpB,gBAAgB,CAACqB,IAAI,CAACC,CAAAA,QAC7CJ,SAASK,QAAQ,CAACD;YAGpB,IAAIF,eAAe,OAAOhB,QAAQ,CAACa,IAAI,KAAK,UAAU;gBACpD,MAAMO,QAAQpB,QAAQ,CAACa,IAAI;gBAC3B,IAAIO,SAASA,MAAMf,MAAM,GAAG,GAAG;oBAC7BL,QAAQ,CAACa,IAAI,GAAG,GAAGO,MAAMb,SAAS,CAAC,GAAG,GAAG,aAAa,CAAC;gBACzD,OAAO;oBACLP,QAAQ,CAACa,IAAI,GAAG;gBAClB;YACF,OAAO,IAAIH,QAAQ,OAAOV,QAAQ,CAACa,IAAI,KAAK,YAAYb,QAAQ,CAACa,IAAI,KAAK,MAAM;gBAC9Eb,QAAQ,CAACa,IAAI,GAAG,IAAI,CAACL,YAAY,CAACR,QAAQ,CAACa,IAAI,EAAEH;YACnD,OAAO,IAAI,OAAOV,QAAQ,CAACa,IAAI,KAAK,UAAU;gBAE5Cb,QAAQ,CAACa,IAAI,GAAG,IAAI,CAAChB,MAAM,CAACG,QAAQ,CAACa,IAAI;YAC3C;QACF;QAEA,OAAOb;IACT;IAKA,OAAOqB,SAASvB,IAAI,EAAE;QACpB,OAAO,IAAI,CAACD,MAAM,CAACC,MAAM;IAC3B;IAKA,OAAOwB,aAAaC,IAAI,EAAE;QACxB,OAAOA,KAAKC,GAAG,CAACC,CAAAA;YAEd,IAAIA,IAAIN,QAAQ,CAAC,UAAUM,IAAIN,QAAQ,CAAC,YAAYM,IAAIN,QAAQ,CAAC,WAAW;gBAC1E,OAAO,IAAI,CAACtB,MAAM,CAAC4B;YACrB;YACA,OAAOA;QACT;IACF;IAKA,OAAOC,sBAAsB5B,IAAI,EAAE;QACjC,OAAO,IAAI,CAACH,gBAAgB,CAACsB,IAAI,CAACf,CAAAA,UAAWA,QAAQyB,IAAI,CAAC7B;IAC5D;IAKA,OAAO8B,SAAS9B,IAAI,EAAE;QACpB,MAAM+B,WAAW,EAAE;QAEnB,IAAI,CAAClC,gBAAgB,CAACM,OAAO,CAAC,CAACC,SAAS4B;YACtC,IAAI5B,QAAQyB,IAAI,CAAC7B,OAAO;gBACtB+B,SAASE,IAAI,CAAC,CAAC,oCAAoC,EAAED,QAAQ,EAAE,CAAC,CAAC;YACnE;QACF;QAEA,OAAO;YACLE,MAAMH,SAASxB,MAAM,KAAK;YAC1BwB;QACF;IACF;IAKA,OAAOI,UAAUC,GAAG,EAAE;QACpB,MAAMlC,WAAW,CAAC;QAElBW,OAAOC,IAAI,CAACsB,KAAKjC,OAAO,CAACY,CAAAA;YACvB,MAAMO,QAAQc,GAAG,CAACrB,IAAI;YACtB,IAAI,CAACO,OAAO;gBACVpB,QAAQ,CAACa,IAAI,GAAG;gBAChB;YACF;YAEA,MAAMC,WAAWD,IAAIE,WAAW;YAChC,MAAMC,cAAcF,SAASK,QAAQ,CAAC,UACnBL,SAASK,QAAQ,CAAC,YAClBL,SAASK,QAAQ,CAAC,aAClBL,SAASK,QAAQ,CAAC;YAErC,IAAIH,aAAa;gBACfhB,QAAQ,CAACa,IAAI,GAAGO,MAAMf,MAAM,GAAG,IAC3B,GAAGe,MAAMb,SAAS,CAAC,GAAG,GAAG,aAAa,CAAC,GACvC;YACN,OAAO;gBACLP,QAAQ,CAACa,IAAI,GAAGO;YAClB;QACF;QAEA,OAAOpB;IACT;AACF;AAGA,OAAO,MAAMmC,WAAWzC,YAAY"},GAAG,CAACrB,IAAI;YACtB,IAAI,CAACO,OAAO;gBACVpB,QAAQ,CAACa,IAAI,GAAG;gBAChB;YACF;YAEA,MAAMC,WAAWD,IAAIE,WAAW;YAChC,MAAMC,cAAcF,SAASK,QAAQ,CAAC,UACnBL,SAASK,QAAQ,CAAC,YAClBL,SAASK,QAAQ,CAAC,aAClBL,SAASK,QAAQ,CAAC;YAErC,IAAIH,aAAa;gBACfhB,QAAQ,CAACa,IAAI,GAAGO,MAAMf,MAAM,GAAG,IAC3B,GAAGe,MAAMb,SAAS,CAAC,GAAG,GAAG,aAAa,CAAC,GACvC;YACN,OAAO;gBACLP,QAAQ,CAACa,IAAI,GAAGO;YAClB;QACF;QAEA,OAAOpB;IACT;AACF;AAGA,OAAO,MAAMmC,WAAWzC,YAAY"}
+{"version":3,"sources":["../../../src/utils/key-redactor.ts"],"sourcesContent":["/**\n * API Key Redaction Utility\n * Prevents sensitive data from leaking into logs, memory, or git commits\n */\n\nexport interface RedactionConfig {\n  patterns: RegExp[];\n  replacement: string;\n  maskLength: number;\n}\n\nexport class KeyRedactor {\n  private static readonly API_KEY_PATTERNS = [\n    // Anthropic API keys\n    /sk-ant-[a-zA-Z0-9_-]{95,}/gi,\n\n    // OpenRouter API keys\n    /sk-or-[a-zA-Z0-9_-]{32,}/gi,\n\n    // Google/Gemini API keys\n    /AIza[a-zA-Z0-9_-]{35}/gi,\n\n    // Generic API keys\n    /[a-zA-Z0-9_-]{20,}API[a-zA-Z0-9_-]{20,}/gi,\n\n    // Bearer tokens\n    /Bearer\\s+[a-zA-Z0-9_\\-\\.]{20,}/gi,\n\n    // Environment variable format\n    /([A-Z_]+_API_KEY|[A-Z_]+_TOKEN|[A-Z_]+_SECRET)=[\"']?([^\"'\\s]+)[\"']?/gi,\n\n    // Supabase keys\n    /eyJ[a-zA-Z0-9_-]*\\.eyJ[a-zA-Z0-9_-]*\\.[a-zA-Z0-9_-]*/gi,\n  ];\n\n  private static readonly SENSITIVE_FIELDS = [\n    'apiKey',\n    'api_key',\n    'token',\n    'secret',\n    'password',\n    'private_key',\n    'privateKey',\n    'accessToken',\n    'access_token',\n    'refreshToken',\n    'refresh_token',\n  ];\n\n  /**\n   * Redact API keys and sensitive data from text\n   */\n  static redact(text: string, showPrefix = true): string {\n    if (!text) return text;\n\n    let redacted = text;\n\n    // Redact using patterns\n    this.API_KEY_PATTERNS.forEach(pattern => {\n      redacted = redacted.replace(pattern, (match) => {\n        if (showPrefix && match.length > 8) {\n          const prefix = match.substring(0, 8);\n          return `${prefix}...[REDACTED]`;\n        }\n        return '[REDACTED_API_KEY]';\n      });\n    });\n\n    return redacted;\n  }\n\n  /**\n   * Redact sensitive fields in objects\n   */\n  static redactObject<T extends Record<string, any>>(obj: T, deep = true): T {\n    if (!obj || typeof obj !== 'object') return obj;\n\n    const redacted = { ...obj };\n\n    Object.keys(redacted).forEach(key => {\n      const lowerKey = key.toLowerCase();\n\n      // Check if field name is sensitive\n      const isSensitive = this.SENSITIVE_FIELDS.some(field =>\n        lowerKey.includes(field)\n      );\n\n      if (isSensitive && typeof redacted[key] === 'string') {\n        const value = redacted[key] as string;\n        if (value && value.length > 8) {\n          redacted[key] = `${value.substring(0, 4)}...[REDACTED]` as any;\n        } else {\n          redacted[key] = '[REDACTED]' as any;\n        }\n      } else if (deep && typeof redacted[key] === 'object' && redacted[key] !== null) {\n        redacted[key] = this.redactObject(redacted[key], deep);\n      } else if (typeof redacted[key] === 'string') {\n        // Redact any API keys in string values\n        redacted[key] = this.redact(redacted[key]) as any;\n      }\n    });\n\n    return redacted;\n  }\n\n  /**\n   * Sanitize text for safe logging\n   */\n  static sanitize(text: string): string {\n    return this.redact(text, true);\n  }\n\n  /**\n   * Sanitize command arguments\n   */\n  static sanitizeArgs(args: string[]): string[] {\n    return args.map(arg => {\n      // Check if arg is a flag value pair\n      if (arg.includes('key') || arg.includes('token') || arg.includes('secret')) {\n        return this.redact(arg);\n      }\n      return arg;\n    });\n  }\n\n  /**\n   * Check if text contains unredacted sensitive data\n   */\n  static containsSensitiveData(text: string): boolean {\n    return this.API_KEY_PATTERNS.some(pattern => pattern.test(text));\n  }\n\n  /**\n   * Validate that text is safe for logging/storage\n   */\n  static validate(text: string): { safe: boolean; warnings: string[] } {\n    const warnings: string[] = [];\n\n    this.API_KEY_PATTERNS.forEach((pattern, index) => {\n      if (pattern.test(text)) {\n        warnings.push(`Potential API key detected (pattern ${index + 1})`);\n      }\n    });\n\n    return {\n      safe: warnings.length === 0,\n      warnings,\n    };\n  }\n\n  /**\n   * Redact environment variables\n   */\n  static redactEnv(env: Record<string, string | undefined>): Record<string, string> {\n    const redacted: Record<string, string> = {};\n\n    Object.keys(env).forEach(key => {\n      const value = env[key];\n      if (!value) {\n        redacted[key] = '';\n        return;\n      }\n\n      const lowerKey = key.toLowerCase();\n      const isSensitive = lowerKey.includes('key') ||\n                         lowerKey.includes('token') ||\n                         lowerKey.includes('secret') ||\n                         lowerKey.includes('password');\n\n      if (isSensitive) {\n        redacted[key] = value.length > 8\n          ? `${value.substring(0, 4)}...[REDACTED]`\n          : '[REDACTED]';\n      } else {\n        redacted[key] = value;\n      }\n    });\n\n    return redacted;\n  }\n}\n\n// Export singleton instance\nexport const redactor = KeyRedactor;\n"],"names":["KeyRedactor","API_KEY_PATTERNS","SENSITIVE_FIELDS","redact","text","showPrefix","redacted","forEach","pattern","replace","match","length","prefix","substring","redactObject","obj","deep","Object","keys","key","lowerKey","toLowerCase","isSensitive","some","field","includes","value","sanitize","sanitizeArgs","args","map","arg","containsSensitiveData","test","validate","warnings","index","push","safe","redactEnv","env","redactor"],"mappings":"AAWA,OAAO,MAAMA;IACX,OAAwBC,mBAAmB;QAEzC;QAGA;QAGA;QAGA;QAGA;QAGA;QAGA;KACD,CAAC;IAEF,OAAwBC,mBAAmB;QACzC;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAAC;IAKF,OAAOC,OAAOC,IAAY,EAAEC,aAAa,IAAI,EAAU;QACrD,IAAI,CAACD,MAAM,OAAOA;QAElB,IAAIE,WAAWF;QAGf,IAAI,CAACH,gBAAgB,CAACM,OAAO,CAACC,CAAAA;YAC5BF,WAAWA,SAASG,OAAO,CAACD,SAAS,CAACE;gBACpC,IAAIL,cAAcK,MAAMC,MAAM,GAAG,GAAG;oBAClC,MAAMC,SAASF,MAAMG,SAAS,CAAC,GAAG;oBAClC,OAAO,GAAGD,OAAO,aAAa,CAAC;gBACjC;gBACA,OAAO;YACT;QACF;QAEA,OAAON;IACT;IAKA,OAAOQ,aAA4CC,GAAM,EAAEC,OAAO,IAAI,EAAK;QACzE,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU,OAAOA;QAE5C,MAAMT,WAAW;YAAE,GAAGS,GAAG;QAAC;QAE1BE,OAAOC,IAAI,CAACZ,UAAUC,OAAO,CAACY,CAAAA;YAC5B,MAAMC,WAAWD,IAAIE,WAAW;YAGhC,MAAMC,cAAc,IAAI,CAACpB,gBAAgB,CAACqB,IAAI,CAACC,CAAAA,QAC7CJ,SAASK,QAAQ,CAACD;YAGpB,IAAIF,eAAe,OAAOhB,QAAQ,CAACa,IAAI,KAAK,UAAU;gBACpD,MAAMO,QAAQpB,QAAQ,CAACa,IAAI;gBAC3B,IAAIO,SAASA,MAAMf,MAAM,GAAG,GAAG;oBAC7BL,QAAQ,CAACa,IAAI,GAAG,GAAGO,MAAMb,SAAS,CAAC,GAAG,GAAG,aAAa,CAAC;gBACzD,OAAO;oBACLP,QAAQ,CAACa,IAAI,GAAG;gBAClB;YACF,OAAO,IAAIH,QAAQ,OAAOV,QAAQ,CAACa,IAAI,KAAK,YAAYb,QAAQ,CAACa,IAAI,KAAK,MAAM;gBAC9Eb,QAAQ,CAACa,IAAI,GAAG,IAAI,CAACL,YAAY,CAACR,QAAQ,CAACa,IAAI,EAAEH;YACnD,OAAO,IAAI,OAAOV,QAAQ,CAACa,IAAI,KAAK,UAAU;gBAE5Cb,QAAQ,CAACa,IAAI,GAAG,IAAI,CAAChB,MAAM,CAACG,QAAQ,CAACa,IAAI;YAC3C;QACF;QAEA,OAAOb;IACT;IAKA,OAAOqB,SAASvB,IAAY,EAAU;QACpC,OAAO,IAAI,CAACD,MAAM,CAACC,MAAM;IAC3B;IAKA,OAAOwB,aAAaC,IAAc,EAAY;QAC5C,OAAOA,KAAKC,GAAG,CAACC,CAAAA;YAEd,IAAIA,IAAIN,QAAQ,CAAC,UAAUM,IAAIN,QAAQ,CAAC,YAAYM,IAAIN,QAAQ,CAAC,WAAW;gBAC1E,OAAO,IAAI,CAACtB,MAAM,CAAC4B;YACrB;YACA,OAAOA;QACT;IACF;IAKA,OAAOC,sBAAsB5B,IAAY,EAAW;QAClD,OAAO,IAAI,CAACH,gBAAgB,CAACsB,IAAI,CAACf,CAAAA,UAAWA,QAAQyB,IAAI,CAAC7B;IAC5D;IAKA,OAAO8B,SAAS9B,IAAY,EAAyC;QACnE,MAAM+B,WAAqB,EAAE;QAE7B,IAAI,CAAClC,gBAAgB,CAACM,OAAO,CAAC,CAACC,SAAS4B;YACtC,IAAI5B,QAAQyB,IAAI,CAAC7B,OAAO;gBACtB+B,SAASE,IAAI,CAAC,CAAC,oCAAoC,EAAED,QAAQ,EAAE,CAAC,CAAC;YACnE;QACF;QAEA,OAAO;YACLE,MAAMH,SAASxB,MAAM,KAAK;YAC1BwB;QACF;IACF;IAKA,OAAOI,UAAUC,GAAuC,EAA0B;QAChF,MAAMlC,WAAmC,CAAC;QAE1CW,OAAOC,IAAI,CAACsB,KAAKjC,OAAO,CAACY,CAAAA;YACvB,MAAMO,QAAQc,GAAG,CAACrB,IAAI;YACtB,IAAI,CAACO,OAAO;gBACVpB,QAAQ,CAACa,IAAI,GAAG;gBAChB;YACF;YAEA,MAAMC,WAAWD,IAAIE,WAAW;YAChC,MAAMC,cAAcF,SAASK,QAAQ,CAAC,UACnBL,SAASK,QAAQ,CAAC,YAClBL,SAASK,QAAQ,CAAC,aAClBL,SAASK,QAAQ,CAAC;YAErC,IAAIH,aAAa;gBACfhB,QAAQ,CAACa,IAAI,GAAGO,MAAMf,MAAM,GAAG,IAC3B,GAAGe,MAAMb,SAAS,CAAC,GAAG,GAAG,aAAa,CAAC,GACvC;YACN,OAAO;gBACLP,QAAQ,CAACa,IAAI,GAAGO;YAClB;QACF;QAEA,OAAOpB;IACT;AACF;AAGA,OAAO,MAAMmC,WAAWzC,YAAY"}

package/docs/AGENT_FOLDER_STRUCTURE_FIX.md

@@ -0,0 +1,192 @@
+# Agent Folder Structure Fix
+
+## Issue
+
+The `.claude/agents` folder was being generated with unnecessary nested subdirectories (e.g., `.claude/agents/analysis/code-review/`, `.claude/agents/architecture/system-design/`), creating too many hierarchy levels.
+
+## Required Structure
+
+All agent `.md` files should be directly in their category folders:
+- ✅ `.claude/agents/analysis/code-analyzer.md`
+- ✅ `.claude/agents/architecture/arch-system-design.md`
+- ✅ `.claude/agents/development/dev-backend-api.md`
+- ❌ ~~`.claude/agents/analysis/code-review/analyze-code-quality.md`~~ (too nested)
+
+## Fix Applied
+
+**File**: `src/cli/simple-commands/init/agent-copier.js`
+
+**Function**: `createAgentDirectories()` (lines 137-164)
+
+### Changes Made
+
+Removed nested subdirectories from the `agentDirs` array:
+
+```diff
+  const agentDirs = [
+    '.claude',
+    '.claude/agents',
+    '.claude/agents/core',
+    '.claude/agents/swarm',
+    '.claude/agents/hive-mind',
+    '.claude/agents/consensus',
+    '.claude/agents/optimization',
+    '.claude/agents/github',
+    '.claude/agents/sparc',
+    '.claude/agents/testing',
+-   '.claude/agents/testing/unit',
+-   '.claude/agents/testing/validation',
+    '.claude/agents/templates',
+    '.claude/agents/analysis',
+-   '.claude/agents/analysis/code-review',
+    '.claude/agents/architecture',
+-   '.claude/agents/architecture/system-design',
+    '.claude/agents/data',
+-   '.claude/agents/data/ml',
+    '.claude/agents/development',
+-   '.claude/agents/development/backend',
+    '.claude/agents/devops',
+-   '.claude/agents/devops/ci-cd',
+    '.claude/agents/documentation',
+-   '.claude/agents/documentation/api-docs',
+    '.claude/agents/specialized',
+-   '.claude/agents/specialized/mobile',
+    '.claude/agents/flow-nexus',
++   '.claude/agents/goal',
++   '.claude/agents/neural',
++   '.claude/agents/reasoning',
+    '.claude/commands',
+    '.claude/commands/flow-nexus'
+  ];
+```
+
+### Changes Summary
+
+**Removed** (11 nested directories):
+- `.claude/agents/testing/unit`
+- `.claude/agents/testing/validation`
+- `.claude/agents/analysis/code-review`
+- `.claude/agents/architecture/system-design`
+- `.claude/agents/data/ml`
+- `.claude/agents/development/backend`
+- `.claude/agents/devops/ci-cd`
+- `.claude/agents/documentation/api-docs`
+- `.claude/agents/specialized/mobile`
+
+**Added** (3 missing categories):
+- `.claude/agents/goal`
+- `.claude/agents/neural`
+- `.claude/agents/reasoning`
+
+**Total directories**: Reduced from 30 to 24 (flat structure)
+
+## Test Results
+
+### Test Execution
+
+```bash
+$ node -e "import { createAgentDirectories, copyAgentFiles } from './dist/src/cli/simple-commands/init/agent-copier.js';
+async function test() {
+  const targetDir = 'tests/agent-structure-test';
+  await createAgentDirectories(targetDir, false);
+  await copyAgentFiles(targetDir, { force: true });
+}
+test().catch(console.error);"
+```
+
+### Verification
+
+```bash
+# Count nested directories (should be 0)
+$ find tests/agent-structure-test/.claude/agents -type d -mindepth 2 | wc -l
+0
+
+# Verify files copied correctly
+$ find tests/agent-structure-test/.claude/agents -type f -name "*.md" | wc -l
+76
+
+# Check category structure
+$ find tests/agent-structure-test/.claude/agents -type d | wc -l
+22  # 1 base + 21 categories = 22 total
+```
+
+### Verified Folder Contents
+
+✅ **Analysis** (flat):
+- `analyze-code-quality.md`
+- `code-analyzer.md`
+
+✅ **Architecture** (flat):
+- `arch-system-design.md`
+
+✅ **Development** (flat):
+- `dev-backend-api.md`
+
+✅ **Testing** (flat):
+- `production-validator.md`
+- `tdd-london-swarm.md`
+
+## Impact
+
+### Before Fix ❌
+```
+.claude/agents/
+├── analysis/
+│   ├── code-review/           # ❌ Unnecessary nesting
+│   │   └── analyze-code-quality.md
+│   └── code-analyzer.md
+├── architecture/
+│   ├── system-design/         # ❌ Unnecessary nesting
+│   │   └── arch-system-design.md
+└── development/
+    └── backend/               # ❌ Unnecessary nesting
+        └── dev-backend-api.md
+```
+
+### After Fix ✅
+```
+.claude/agents/
+├── analysis/
+│   ├── analyze-code-quality.md  # ✅ Flat structure
+│   └── code-analyzer.md         # ✅ Flat structure
+├── architecture/
+│   └── arch-system-design.md    # ✅ Flat structure
+└── development/
+    └── dev-backend-api.md       # ✅ Flat structure
+```
+
+## Benefits
+
+1. **Simpler Structure**: Reduced nesting depth from 3-4 levels to 2 levels
+2. **Easier Navigation**: All agents in a category are immediately visible
+3. **Consistent Naming**: Agent files can be found at predictable paths
+4. **Better Organization**: Clear separation between categories without over-structuring
+5. **Maintenance**: Easier to add/remove agents without managing subdirectories
+
+## Backward Compatibility
+
+✅ **No Breaking Changes**
+- The `copyRecursive()` function preserves the existing source structure
+- Agent files are copied exactly as they exist in source
+- Only the directory creation is affected
+- Users with existing `.claude/agents` folders are unaffected
+
+## Files Modified
+
+- `src/cli/simple-commands/init/agent-copier.js` (lines 137-164)
+
+## Testing
+
+**Test Directory**: `tests/agent-structure-test/`
+
+**Status**: ✅ All tests passed
+- 0 nested subdirectories created
+- 76 agent files copied successfully
+- 21 category folders created
+- All files in correct flat structure
+
+---
+
+**Status**: ✅ **FIXED AND VERIFIED**
+
+**Ready for**: Next release (v2.7.33 or patch)

package/docs/BUG_REPORT_MEMORY_STATS.md

@@ -0,0 +1,355 @@
+# Bug Report: `memory stats` Command Returns Zero for ReasoningBank Data
+
+## Executive Summary
+
+The `memory stats` command always returns zero entries/namespaces/size, even when ReasoningBank contains data. This is caused by the command exclusively reading from the legacy JSON file (`./memory/memory-store.json`) instead of querying the active ReasoningBank SQLite database.
+
+## Bug Details
+
+### Issue
+- **Command**: `npx claude-flow@alpha memory stats`
+- **Expected**: Shows statistics for ReasoningBank database (19 entries found via direct SQL query)
+- **Actual**: Returns all zeros (0 entries, 0 namespaces, 0.00 KB)
+- **Severity**: High - Users cannot see their stored data statistics
+- **Affected Versions**: v2.7.30 and likely earlier
+
+### Evidence
+
+```bash
+# Command returns zeros
+$ npx claude-flow@alpha memory stats
+✅ Memory Bank Statistics:
+   Total Entries: 0
+   Namespaces: 0
+   Size: 0.00 KB
+
+# But ReasoningBank list shows 10+ entries
+$ npx claude-flow@alpha memory list --reasoningbank
+✅ ReasoningBank memories (10 shown):
+📌 test-key
+📌 test-sqlite
+📌 api-design
+[... 16 more entries]
+
+# Direct SQL query confirms 19 entries exist
+$ sqlite3 .swarm/memory.db "SELECT COUNT(*) FROM patterns WHERE type = 'reasoning_memory';"
+19
+
+# ReasoningBank status confirms data exists
+$ npx claude-flow@alpha memory status --reasoningbank
+✅ 📊 ReasoningBank Status:
+   Total memories: 19
+   Average confidence: 80.0%
+   Embeddings: 19
+   Trajectories: 0
+```
+
+## Root Cause Analysis
+
+### Code Analysis (src/cli/simple-commands/memory.js)
+
+**Problem Location**: Lines 217-244
+
+```javascript
+async function showMemoryStats(loadMemory) {
+  try {
+    const data = await loadMemory();  // ❌ Only reads JSON file
+    let totalEntries = 0;
+    const namespaceStats = {};
+
+    for (const [namespace, entries] of Object.entries(data)) {
+      namespaceStats[namespace] = entries.length;
+      totalEntries += entries.length;
+    }
+
+    printSuccess('Memory Bank Statistics:');
+    console.log(`   Total Entries: ${totalEntries}`);
+    console.log(`   Namespaces: ${Object.keys(data).length}`);
+    console.log(`   Size: ${(new TextEncoder().encode(JSON.stringify(data)).length / 1024).toFixed(2)} KB`);
+    // ...
+  }
+}
+```
+
+**The `loadMemory()` function** (line 26-33):
+```javascript
+async function loadMemory() {
+  try {
+    const content = await fs.readFile(memoryStore, 'utf8');  // hardcoded JSON path
+    return JSON.parse(content);
+  } catch {
+    return {};
+  }
+}
+```
+
+Where `memoryStore = './memory/memory-store.json'` (line 14)
+
+### Why It's Broken
+
+1. **Hardcoded JSON File**: `showMemoryStats()` only reads from `./memory/memory-store.json`
+2. **No Mode Detection**: Unlike other commands (`store`, `query`, `list`), `stats` doesn't call `detectMemoryMode()` (line 23)
+3. **No ReasoningBank Support**: The switch statement (lines 56-87) routes `stats` directly to `showMemoryStats()` without checking if ReasoningBank is active
+4. **Inconsistent with Other Commands**: `store`, `query`, and `list` all support `--reasoningbank` flag via `handleReasoningBankCommand()`, but `stats` doesn't
+
+### Working Commands for Comparison
+
+```javascript
+// ✅ These commands properly detect mode and support ReasoningBank
+case 'store':
+  await storeMemory(subArgs, loadMemory, saveMemory, namespace, enableRedaction);
+  break;
+
+case 'query':
+  await queryMemory(subArgs, loadMemory, namespace, enableRedaction);
+  break;
+
+case 'list':
+  await listNamespaces(loadMemory);
+  break;
+
+// ❌ This command ignores mode detection
+case 'stats':
+  await showMemoryStats(loadMemory);  // Never checks ReasoningBank!
+  break;
+```
+
+## Expected Behavior
+
+The `memory stats` command should:
+
+1. **Detect the active memory mode** (basic JSON vs ReasoningBank SQLite)
+2. **Show appropriate statistics** based on the active mode:
+   - **ReasoningBank mode**: Query SQLite database for accurate counts
+   - **Basic mode**: Read JSON file (current behavior)
+   - **Auto mode**: Check both and show combined statistics
+3. **Support `--reasoningbank` flag** to force ReasoningBank stats
+4. **Display backend information**: Show which storage backend is being used
+
+### Proposed Output
+
+```bash
+# Auto mode (should detect ReasoningBank if initialized)
+$ npx claude-flow@alpha memory stats
+✅ Memory Bank Statistics:
+   Storage Backend: ReasoningBank (SQLite)
+   Total Entries: 19
+   Namespaces: 3
+   Size: 9.14 MB
+
+📁 Namespace Breakdown:
+   default: 12 entries
+   test-namespace: 5 entries
+   api: 2 entries
+
+💡 Use 'memory stats --basic' for JSON statistics
+
+# Force ReasoningBank mode
+$ npx claude-flow@alpha memory stats --reasoningbank
+✅ ReasoningBank Statistics:
+   Database: .swarm/memory.db
+   Total Memories: 19
+   Total Embeddings: 19
+   Average Confidence: 80.0%
+   Trajectories: 0
+   Links: 0
+   Database Size: 9.14 MB
+
+# Force basic mode
+$ npx claude-flow@alpha memory stats --basic
+✅ JSON Memory Statistics:
+   Total Entries: 0
+   Namespaces: 0
+   Size: 0.00 KB
+   ⚠️  Consider migrating to ReasoningBank for better performance
+```
+
+## Proposed Solution
+
+### Option 1: Add ReasoningBank Support to stats (Recommended)
+
+Modify `src/cli/simple-commands/memory.js`:
+
+```javascript
+// Line 65-67: Add mode detection to stats case
+case 'stats':
+  if (mode === 'reasoningbank') {
+    await handleReasoningBankStats(getStatus);
+  } else {
+    await showMemoryStats(loadMemory);
+  }
+  break;
+
+// Add new handler function (around line 718)
+async function handleReasoningBankStats(getStatus) {
+  try {
+    const stats = await getStatus();
+
+    printSuccess('ReasoningBank Statistics:');
+    console.log(`   Database: ${stats.database_path || '.swarm/memory.db'}`);
+    console.log(`   Total Memories: ${stats.total_memories}`);
+    console.log(`   Total Categories: ${stats.total_categories}`);
+    console.log(`   Average Confidence: ${(stats.avg_confidence * 100).toFixed(1)}%`);
+    console.log(`   Embeddings: ${stats.total_embeddings}`);
+    console.log(`   Trajectories: ${stats.total_trajectories}`);
+    console.log(`   Links: ${stats.total_links || 0}`);
+    console.log(`   Storage Backend: ${stats.storage_backend}`);
+
+    if (stats.database_path) {
+      const dbSize = await getFileSize(stats.database_path);
+      console.log(`   Database Size: ${(dbSize / 1024 / 1024).toFixed(2)} MB`);
+    }
+  } catch (error) {
+    printError(`Failed to get ReasoningBank stats: ${error.message}`);
+  }
+}
+
+// Helper function
+async function getFileSize(path) {
+  try {
+    const stats = await fs.stat(path);
+    return stats.size;
+  } catch {
+    return 0;
+  }
+}
+```
+
+### Option 2: Create Unified Stats Command
+
+Show both JSON and ReasoningBank statistics in one output:
+
+```javascript
+async function showMemoryStats(loadMemory, mode) {
+  const rbInitialized = await isReasoningBankInitialized();
+
+  printSuccess('Memory Bank Statistics:\n');
+
+  // Show JSON stats
+  const jsonData = await loadMemory();
+  let totalEntries = Object.values(jsonData).reduce((sum, arr) => sum + arr.length, 0);
+
+  console.log('📁 JSON Storage (./memory/memory-store.json):');
+  console.log(`   Total Entries: ${totalEntries}`);
+  console.log(`   Namespaces: ${Object.keys(jsonData).length}`);
+  console.log(`   Size: ${(new TextEncoder().encode(JSON.stringify(jsonData)).length / 1024).toFixed(2)} KB`);
+
+  // Show ReasoningBank stats if initialized
+  if (rbInitialized) {
+    const { getStatus } = await import('../../reasoningbank/reasoningbank-adapter.js');
+    const rbStats = await getStatus();
+
+    console.log('\n🧠 ReasoningBank Storage (.swarm/memory.db):');
+    console.log(`   Total Memories: ${rbStats.total_memories}`);
+    console.log(`   Categories: ${rbStats.total_categories}`);
+    console.log(`   Average Confidence: ${(rbStats.avg_confidence * 100).toFixed(1)}%`);
+    console.log(`   Embeddings: ${rbStats.total_embeddings}`);
+
+    console.log('\n💡 Active Mode: ReasoningBank (auto-selected)');
+  } else {
+    console.log('\n⚠️  ReasoningBank not initialized (using JSON storage)');
+    console.log('   Run "memory init --reasoningbank" to enable AI features');
+  }
+}
+```
+
+## Testing Plan
+
+### Test Cases
+
+1. **Test with empty JSON, empty ReasoningBank**
+   ```bash
+   rm -rf memory/ .swarm/
+   npx claude-flow@alpha memory stats
+   # Expected: Show zeros for both backends
+   ```
+
+2. **Test with data in ReasoningBank only**
+   ```bash
+   npx claude-flow@alpha memory store "test" "value" --reasoningbank
+   npx claude-flow@alpha memory stats
+   # Expected: Show ReasoningBank stats with 1 entry
+   ```
+
+3. **Test with data in JSON only**
+   ```bash
+   npx claude-flow@alpha memory store "test" "value" --basic
+   npx claude-flow@alpha memory stats
+   # Expected: Show JSON stats with 1 entry
+   ```
+
+4. **Test with data in both backends**
+   ```bash
+   npx claude-flow@alpha memory store "json-key" "json-value" --basic
+   npx claude-flow@alpha memory store "rb-key" "rb-value" --reasoningbank
+   npx claude-flow@alpha memory stats
+   # Expected: Show stats for both backends
+   ```
+
+5. **Test with flags**
+   ```bash
+   npx claude-flow@alpha memory stats --reasoningbank
+   npx claude-flow@alpha memory stats --basic
+   npx claude-flow@alpha memory stats --auto
+   # Expected: Respect mode flags
+   ```
+
+## Impact Assessment
+
+### User Impact: High
+- Users relying on `memory stats` are seeing incorrect information
+- New users testing ReasoningBank features think it's not working
+- Migration from JSON to ReasoningBank appears unsuccessful
+
+### Workarounds
+Users can check ReasoningBank data using:
+1. `memory status --reasoningbank` - Shows basic stats
+2. `memory list --reasoningbank` - Lists all entries
+3. Direct SQLite query: `sqlite3 .swarm/memory.db "SELECT COUNT(*) FROM patterns;"`
+
+## Related Issues
+
+- Memory mode detection works correctly for `store`, `query`, `list` commands
+- The `status --reasoningbank` command works and shows accurate statistics
+- This bug affects only the `stats` command (without flags)
+
+## Files to Modify
+
+1. **src/cli/simple-commands/memory.js**
+   - Lines 65-67: Add mode detection to `stats` case
+   - Lines 217-244: Modify `showMemoryStats()` to support ReasoningBank
+   - Add new `handleReasoningBankStats()` function (around line 718)
+
+## Backward Compatibility
+
+✅ No breaking changes - existing JSON-based stats will continue to work
+✅ New flag `--reasoningbank` is optional
+✅ Auto mode will fall back to JSON if ReasoningBank not initialized
+
+## Priority Recommendation
+
+**Priority: High** - This is a user-facing bug that makes a primary feature (statistics) non-functional for ReasoningBank users.
+
+**Suggested for**: v2.7.31 hotfix
+
+---
+
+## Additional Context
+
+### System Information
+- Version: v2.7.30 (and likely earlier)
+- Database: SQLite 3.x at `.swarm/memory.db`
+- ReasoningBank: Initialized and contains 19 entries
+- JSON Storage: Empty (0 entries)
+
+### Reproduction Steps
+1. Initialize ReasoningBank: `npx claude-flow@alpha memory init --reasoningbank`
+2. Store data: `npx claude-flow@alpha memory store test-key "test value" --reasoningbank`
+3. Verify storage: `npx claude-flow@alpha memory list --reasoningbank` (shows data)
+4. Run stats: `npx claude-flow@alpha memory stats` (shows zeros ❌)
+
+### Related Files
+- `/workspaces/claude-code-flow/src/cli/simple-commands/memory.js` (main bug location)
+- `/workspaces/claude-code-flow/src/reasoningbank/reasoningbank-adapter.js` (working `getStatus()` function)
+- `.swarm/memory.db` (SQLite database with 19 entries)
+- `./memory/memory-store.json` (empty JSON file)