claude-flow 3.10.38 → 3.10.40

package/README.md

@@ -35,7 +35,7 @@ Orchestrate 100+ specialized AI agents across machines, teams, and trust boundar
 
 ### What Ruflo Does
 
-One `npx ruvflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
+One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
 
 ```
 Self-Learning / Self-Optimizing Agent Architecture

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.10.38",
+  "version": "3.10.40",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/README.md

@@ -35,7 +35,7 @@ Orchestrate 100+ specialized AI agents across machines, teams, and trust boundar
 
 ### What Ruflo Does
 
-One `npx ruvflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
+One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
 
 ```
 Self-Learning / Self-Optimizing Agent Architecture

package/v3/@claude-flow/cli/dist/src/init/settings-generator.js

@@ -27,7 +27,7 @@ export function generateSettings(options) {
             'Bash(npx @claude-flow*)',
             'Bash(npx claude-flow*)',
             'Bash(node .claude/*)',
-            'mcp__claude-flow__:*',
+            'mcp__claude-flow__*',
         ],
         deny: [
             'Read(./.env)',

package/v3/@claude-flow/cli/dist/src/init/statusline-generator.js

@@ -107,8 +107,9 @@ function getStatuslineData() {
     const jsonStart = raw.indexOf('{');
     if (jsonStart === -1) throw new Error('no JSON in CLI output');
     const data = JSON.parse(raw.slice(jsonStart));
-    // Overlay real ADR count from both local directories (fast, no network).
-    data.adrs = getLocalADRCount();
+    // Overlay every block the CLI JSON omits (adrs/agentdb/tests/hooks/integration)
+    // with real local reads, so those segments reflect actual state instead of 0.
+    applyLocalOverlays(data);
     writeCache(data);
     return data;
   } catch { /* CLI unavailable or timed out */ }
@@ -141,13 +142,40 @@ function getLocalADRCount() {
   return { count: total, implemented: total, compliance: 0 };
 }
 
-// Minimal local fallback when the CLI is not installed or times out.
-// Returns a structure that matches the CLI JSON schema so the renderer works.
-function buildLocalFallback() {
-  const memMB = Math.floor(process.memoryUsage().heapUsed / 1024 / 1024);
-  const adrs = getLocalADRCount();
+// ─── Local overlays for segments the CLI JSON omits ──────────────
+// 'hooks statusline --json' only returns user/v3Progress/security/swarm/system.
+// agentdb/tests/hooks/integration are never populated, so without these overlays
+// they render as a permanent 0. Each reader is cheap and degrades to zeros.
+
+// Real AgentDB stats from the local memory DB. Vectors live in .swarm/memory.db
+// (sql.js + HNSW); ruvector.db is an opaque redb store counted only toward size.
+// One read-only sqlite3 query (mode=ro never takes a write lock the daemon owns).
+function getLocalAgentDB() {
+  const result = { vectorCount: 0, dbSizeKB: 0, hasHnsw: false };
+  try {
+    let bytes = 0;
+    for (const f of ['.swarm/memory.db', 'ruvector.db']) {
+      try { bytes += fs.statSync(path.join(CWD, f)).size; } catch { /* missing */ }
+    }
+    result.dbSizeKB = Math.round(bytes / 1024);
+
+    const memDb = path.join(CWD, '.swarm', 'memory.db');
+    if (fs.existsSync(memDb)) {
+      const Q = String.fromCharCode(34);
+      const sql = Q + 'SELECT (SELECT COUNT(*) FROM memory_entries WHERE embedding IS NOT NULL)||' + "'|'" + '||(SELECT COUNT(*) FROM vector_indexes);' + Q;
+      const out = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + sql, 1500);
+      if (out && out.indexOf('|') !== -1) {
+        const parts = out.split('|');
+        result.vectorCount = parseInt(parts[0], 10) || 0;
+        result.hasHnsw = (parseInt(parts[1], 10) || 0) > 0;
+      }
+    }
+  } catch { /* ignore */ }
+  return result;
+}
 
-  // Test file count (pure directory walk, no file reads)
+// Count test files via a bounded directory walk (no file reads).
+function getLocalTests() {
   let testFiles = 0;
   function countTests(dir, depth) {
     if ((depth || 0) > 4) return;
@@ -163,19 +191,82 @@ function buildLocalFallback() {
     } catch { /* ignore */ }
   }
   for (const d of ['tests', 'test', '__tests__', 'src', 'v3']) countTests(path.join(CWD, d));
+  return { testFiles, testCases: testFiles * 4 };
+}
 
-  return {
+// Count configured hooks from project .claude/settings.json. Claude Code hooks
+// have no enabled/disabled flag, so every configured hook counts as enabled.
+function getLocalHooks() {
+  const result = { enabled: 0, total: 0 };
+  try {
+    const settings = readJSON(path.join(CWD, '.claude', 'settings.json'));
+    const hooks = settings && settings.hooks;
+    if (hooks && typeof hooks === 'object') {
+      let n = 0;
+      for (const ev of Object.keys(hooks)) {
+        const groups = hooks[ev];
+        if (Array.isArray(groups)) {
+          for (const g of groups) {
+            if (g && Array.isArray(g.hooks)) n += g.hooks.length;
+          }
+        }
+      }
+      result.total = n;
+      result.enabled = n;
+    }
+  } catch { /* ignore */ }
+  return result;
+}
+
+// Best-effort integration block: DB presence + locally-configured stdio MCP
+// servers (project .mcp.json + global ~/.claude.json). Remote connectors are
+// account-managed and not present in local config, so they are not counted.
+function getLocalIntegration() {
+  const integration = { mcpServers: { enabled: 0, total: 0 }, hasDatabase: false };
+  try {
+    for (const f of ['.swarm/memory.db', 'ruvector.db']) {
+      if (fs.existsSync(path.join(CWD, f))) { integration.hasDatabase = true; break; }
+    }
+    const names = new Set();
+    const projMcp = readJSON(path.join(CWD, '.mcp.json'));
+    if (projMcp && projMcp.mcpServers) for (const k of Object.keys(projMcp.mcpServers)) names.add(k);
+    const claudeJson = readJSON(path.join(os.homedir(), '.claude.json'));
+    if (claudeJson) {
+      if (claudeJson.mcpServers) for (const k of Object.keys(claudeJson.mcpServers)) names.add(k);
+      const proj = claudeJson.projects && claudeJson.projects[CWD];
+      if (proj && proj.mcpServers && !Array.isArray(proj.mcpServers)) {
+        for (const k of Object.keys(proj.mcpServers)) names.add(k);
+      }
+    }
+    integration.mcpServers.total = names.size;
+    integration.mcpServers.enabled = names.size;
+  } catch { /* ignore */ }
+  return integration;
+}
+
+// Overlay every locally-derived block onto the CLI data (mutates in place).
+function applyLocalOverlays(data) {
+  data.adrs = getLocalADRCount();
+  data.agentdb = getLocalAgentDB();
+  data.tests = getLocalTests();
+  data.hooks = getLocalHooks();
+  data.integration = getLocalIntegration();
+  return data;
+}
+
+// Minimal local fallback when the CLI is not installed or times out.
+// Returns a structure that matches the CLI JSON schema so the renderer works.
+function buildLocalFallback() {
+  const memMB = Math.floor(process.memoryUsage().heapUsed / 1024 / 1024);
+
+  return applyLocalOverlays({
     user: { name: 'user', gitBranch: '', modelName: 'Claude Code' },
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
     security: { status: 'NONE', cvesFixed: 0, totalCves: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
     system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
-    adrs,
-    hooks: { enabled: 0, total: 0 },
-    agentdb: { vectorCount: 0, dbSizeKB: 0, hasHnsw: false },
-    tests: { testFiles, testCases: testFiles * 4 },
     lastUpdated: new Date().toISOString(),
-  };
+  });
 }
 
 // ANSI colors
@@ -375,7 +466,14 @@ function getPkgVersion() {
     // (bin/node_modules) layouts.
     try {
       const binDir = path.dirname(process.execPath);
-      for (const gm of [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')]) {
+      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
+      // #2221 follow-up: a custom npm prefix (e.g. ~/.npm-global) is decoupled from
+      // the node binary location, so the binDir-derived probes above all miss. Also
+      // probe the npm prefix from the environment and the common ~/.npm-global default.
+      for (const prefix of [process.env.npm_config_prefix, process.env.PREFIX, path.join(home, '.npm-global')]) {
+        if (prefix) globalModuleDirs.push(path.join(prefix, 'lib', 'node_modules'));
+      }
+      for (const gm of globalModuleDirs) {
         pkgPaths.push(
           path.join(gm, 'ruflo', 'package.json'),
           path.join(gm, '@claude-flow', 'cli', 'package.json'),

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -3931,7 +3931,10 @@ export const hooksModelRoute = {
             alternatives: result.alternatives,
             inferenceTimeUs: result.inferenceTimeUs,
             costMultiplier: result.costMultiplier,
-            implementation: 'tiny-dancer-neural',
+            // Historical name kept for telemetry / dashboard schema stability.
+            // The shipped router is the heuristic + Thompson-bandit described in
+            // ruvector/model-router.ts — not a neural network. See #2329.
+            implementation: 'heuristic-thompson-bandit',
         };
     },
 };

package/v3/@claude-flow/cli/dist/src/ruvector/enhanced-model-router.d.ts

@@ -71,7 +71,7 @@ export interface EnhancedModelRouterConfig {
  */
 export declare class EnhancedModelRouter {
     private config;
-    private tinyDancerRouter;
+    private baseRouter;
     constructor(config?: Partial<EnhancedModelRouterConfig>);
     /**
      * Detect code editing intent from task description

package/v3/@claude-flow/cli/dist/src/ruvector/enhanced-model-router.js

@@ -177,7 +177,12 @@ const LANGUAGE_MAP = {
  */
 export class EnhancedModelRouter {
     config;
-    tinyDancerRouter;
+    // The base text-routing path delegated to here is the local
+    // heuristic + Thompson-bandit ModelRouter — NOT the @ruvector/tiny-dancer
+    // neural router that an earlier design (ADR-026) described (#2329). The
+    // public `getStats()` return still exposes the field as `tinyDancerStats`
+    // for telemetry-schema stability.
+    baseRouter;
     constructor(config) {
         this.config = {
             agentBoosterEnabled: true,
@@ -199,7 +204,7 @@ export class EnhancedModelRouter {
             preferQuality: false,
             ...config,
         };
-        this.tinyDancerRouter = getModelRouter();
+        this.baseRouter = getModelRouter();
     }
     /**
      * Detect code editing intent from task description
@@ -355,13 +360,13 @@ export class EnhancedModelRouter {
                 // AST analysis not available, continue with text-based routing
             }
         }
-        // Step 4: Text-based complexity + tiny-dancer routing
-        const tinyDancerResult = await this.tinyDancerRouter.route(task);
-        // Step 5: Combine AST complexity with tiny-dancer result
-        // Also boost if single tier3 keyword found
+        // Step 4: Text-based complexity via the local heuristic + bandit router.
+        const baseResult = await this.baseRouter.route(task);
+        // Step 5: Combine AST complexity with the text-routing result.
+        // Also boost if a single tier3 keyword is found.
         let finalComplexity = astComplexity !== undefined
-            ? (astComplexity + tinyDancerResult.complexity) / 2
-            : tinyDancerResult.complexity;
+            ? (astComplexity + baseResult.complexity) / 2
+            : baseResult.complexity;
         // Boost complexity if tier3 keywords found (even just one)
         if (tier3Check.matches) {
             finalComplexity = Math.min(1.0, finalComplexity + 0.25);
@@ -373,7 +378,7 @@ export class EnhancedModelRouter {
                 tier: 2,
                 handler: 'haiku',
                 model: 'haiku',
-                confidence: tinyDancerResult.confidence,
+                confidence: baseResult.confidence,
                 complexity: finalComplexity,
                 reasoning: `Low complexity (${(finalComplexity * 100).toFixed(0)}%) - using haiku`,
                 canSkipLLM: false,
@@ -386,7 +391,7 @@ export class EnhancedModelRouter {
                 tier: 2,
                 handler: 'sonnet',
                 model: 'sonnet',
-                confidence: tinyDancerResult.confidence,
+                confidence: baseResult.confidence,
                 complexity: finalComplexity,
                 reasoning: `Medium complexity (${(finalComplexity * 100).toFixed(0)}%) - using sonnet`,
                 canSkipLLM: false,
@@ -398,7 +403,7 @@ export class EnhancedModelRouter {
             tier: 3,
             handler: 'opus',
             model: 'opus',
-            confidence: tinyDancerResult.confidence,
+            confidence: baseResult.confidence,
             complexity: finalComplexity,
             reasoning: `High complexity (${(finalComplexity * 100).toFixed(0)}%) - using opus`,
             canSkipLLM: false,
@@ -494,7 +499,10 @@ export class EnhancedModelRouter {
     getStats() {
         return {
             config: { ...this.config },
-            tinyDancerStats: this.tinyDancerRouter.getStats(),
+            // Field name kept as `tinyDancerStats` for telemetry-schema
+            // stability; the underlying router is the local heuristic + bandit
+            // ModelRouter, not @ruvector/tiny-dancer. See #2329.
+            tinyDancerStats: this.baseRouter.getStats(),
         };
     }
 }

package/v3/@claude-flow/cli/dist/src/ruvector/model-router.d.ts

@@ -1,20 +1,33 @@
 /**
- * Intelligent Model Router using Tiny Dancer
+ * Intelligent Model Router — lexical complexity heuristic + Thompson bandit
  *
- * Dynamically routes requests to optimal Claude model (haiku/sonnet/opus)
- * based on task complexity, confidence scores, and historical performance.
+ * Dynamically routes requests to the optimal Claude model (haiku/sonnet/opus)
+ * based on task complexity, uncertainty, and online-learned routing outcomes.
  *
- * Features:
- * - FastGRNN-based routing decisions (<100μs)
- * - Uncertainty quantification for model escalation
- * - Circuit breaker for failover
- * - Online learning from routing outcomes
- * - Complexity scoring via embeddings
+ * Mechanism (shipped):
+ * - Complexity score = blend of lexical, semantic-depth, task-scope, and
+ *   uncertainty heuristics (see `computeLexicalComplexity` and friends).
+ *   Pure JS arithmetic — no model load, no tensor math.
+ * - Model selection = Thompson-sampling Beta-Bernoulli bandit with
+ *   complexity-bucketed Beta(α,β) priors, persisted to
+ *   `.swarm/model-router-state.json` and updated by `recordOutcome` after
+ *   each routing decision.
+ * - Uncertainty quantification + a circuit breaker drive escalation when
+ *   the bandit's confidence is low or downstream failures are observed.
  *
  * Routing Strategy:
- * - Haiku: High confidence, low complexity (fast, cheap)
- * - Sonnet: Medium confidence, moderate complexity (balanced)
- * - Opus: Low confidence, high complexity (most capable)
+ * - Haiku: high confidence, low complexity (fast, cheap)
+ * - Sonnet: medium confidence, moderate complexity (balanced)
+ * - Opus: low confidence, high complexity (most capable)
+ *
+ * Note (#2329): An earlier design (ADR-026 + this file's previous header)
+ * described a Tiny-Dancer / FastGRNN neural router with embedding-based
+ * complexity scoring. That path was never wired in — `@ruvector/tiny-dancer`
+ * is not imported here and the `embedding`-consuming branch in
+ * `computeSemanticDepth` is only reachable via the externally-callable
+ * `routeToModelFull(task, embedding)` wrapper (no internal callers). The
+ * shipped router is the heuristic + bandit described above; the neural
+ * path remains a future direction tracked in #2329.
  *
  * @module model-router
  */

package/v3/@claude-flow/cli/dist/src/ruvector/model-router.js

@@ -1,20 +1,33 @@
 /**
- * Intelligent Model Router using Tiny Dancer
+ * Intelligent Model Router — lexical complexity heuristic + Thompson bandit
  *
- * Dynamically routes requests to optimal Claude model (haiku/sonnet/opus)
- * based on task complexity, confidence scores, and historical performance.
+ * Dynamically routes requests to the optimal Claude model (haiku/sonnet/opus)
+ * based on task complexity, uncertainty, and online-learned routing outcomes.
  *
- * Features:
- * - FastGRNN-based routing decisions (<100μs)
- * - Uncertainty quantification for model escalation
- * - Circuit breaker for failover
- * - Online learning from routing outcomes
- * - Complexity scoring via embeddings
+ * Mechanism (shipped):
+ * - Complexity score = blend of lexical, semantic-depth, task-scope, and
+ *   uncertainty heuristics (see `computeLexicalComplexity` and friends).
+ *   Pure JS arithmetic — no model load, no tensor math.
+ * - Model selection = Thompson-sampling Beta-Bernoulli bandit with
+ *   complexity-bucketed Beta(α,β) priors, persisted to
+ *   `.swarm/model-router-state.json` and updated by `recordOutcome` after
+ *   each routing decision.
+ * - Uncertainty quantification + a circuit breaker drive escalation when
+ *   the bandit's confidence is low or downstream failures are observed.
  *
  * Routing Strategy:
- * - Haiku: High confidence, low complexity (fast, cheap)
- * - Sonnet: Medium confidence, moderate complexity (balanced)
- * - Opus: Low confidence, high complexity (most capable)
+ * - Haiku: high confidence, low complexity (fast, cheap)
+ * - Sonnet: medium confidence, moderate complexity (balanced)
+ * - Opus: low confidence, high complexity (most capable)
+ *
+ * Note (#2329): An earlier design (ADR-026 + this file's previous header)
+ * described a Tiny-Dancer / FastGRNN neural router with embedding-based
+ * complexity scoring. That path was never wired in — `@ruvector/tiny-dancer`
+ * is not imported here and the `embedding`-consuming branch in
+ * `computeSemanticDepth` is only reachable via the externally-callable
+ * `routeToModelFull(task, embedding)` wrapper (no internal callers). The
+ * shipped router is the heuristic + bandit described above; the neural
+ * path remains a future direction tracked in #2329.
  *
  * @module model-router
  */

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.10.38",
+  "version": "3.10.40",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -109,7 +109,7 @@
     "@claude-flow/codex": "^3.0.0-alpha.8",
     "@claude-flow/embeddings": "^3.0.0-alpha.18",
     "@claude-flow/guidance": "^3.0.0-alpha.1",
-    "@claude-flow/memory": "^3.0.0-alpha.17",
+    "@claude-flow/memory": "^3.0.0-alpha.20",
     "@claude-flow/plugin-gastown-bridge": "^0.1.3",
     "@claude-flow/security": "^3.0.0-alpha.10",
     "@ruvector/attention": "^0.1.32",

package/.claude/scheduled_tasks.lock

@@ -1 +0,0 @@
-{"sessionId":"fd9b0530-a395-4da0-9b21-a26731cef01f","pid":91923,"procStart":"Mon May 11 02:12:51 2026","acquiredAt":1778466450635}