claude-flow 3.10.39 → 3.10.41

package/.claude/helpers/statusline.cjs

@@ -42,10 +42,51 @@ const CONFIG = {
 const CWD = process.cwd();
 
 // ─── Delegation cache ───────────────────────────────────────────
-// Cache the CLI JSON result for 10s so rapid prompt re-renders
-// (e.g. every keypress in some shells) don't re-invoke npx each time.
+// Cache the CLI JSON result for 60s so rapid prompt re-renders
+// (Claude Code refreshes the statusline several times a second while
+// streaming) don't re-invoke the CLI each time. #2337: bumped 10s→60s
+// because 10s was far too short for how often Claude Code re-renders.
 const CACHE_FILE = path.join(os.tmpdir(), 'ruflo-statusline-cache-' + require('crypto').createHash('md5').update(CWD).digest('hex').slice(0, 8) + '.json');
-const CACHE_TTL_MS = 10000;
+const CACHE_TTL_MS = 60000;
+
+// #2337: resolve an already-installed @claude-flow/cli (or ruflo) bin so we
+// can invoke it directly via `node`. The previous version called
+// `npx --yes @claude-flow/cli@latest` on every uncached render, which forces
+// a registry resolution + cold-start of the entire CLI per render. With
+// multiple concurrent Claude Code sessions this storms the host (reporter
+// saw load average 40-65 on a 12-core box).
+//
+// Returns the absolute path to bin/cli.js or null. Mirrors getPkgVersion()'s
+// path probing (project, monorepo, plugin marketplace, global node_modules
+// including custom-prefix layouts like ~/.npm-global).
+function resolveCliBin() {
+  try {
+    const home = os.homedir();
+    const candidates = [
+      path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'bin', 'cli.js'),
+      path.join(CWD, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(CWD, 'node_modules', 'ruflo', 'bin', 'cli.js'),
+      path.join(CWD, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
+    ];
+    try {
+      const binDir = path.dirname(process.execPath);
+      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
+      for (const prefix of [process.env.npm_config_prefix, process.env.PREFIX, path.join(home, '.npm-global')]) {
+        if (prefix) globalModuleDirs.push(path.join(prefix, 'lib', 'node_modules'));
+      }
+      for (const gm of globalModuleDirs) {
+        candidates.push(
+          path.join(gm, 'ruflo', 'bin', 'cli.js'),
+          path.join(gm, '@claude-flow', 'cli', 'bin', 'cli.js'),
+        );
+      }
+    } catch { /* ignore */ }
+    for (const p of candidates) {
+      if (fs.existsSync(p)) return p;
+    }
+  } catch { /* ignore */ }
+  return null;
+}
 
 function readCache() {
   try {
@@ -76,16 +117,25 @@ function getStatuslineData() {
   if (cached) return cached;
 
   try {
+    // #2337: prefer an already-installed CLI bin via direct `node` invocation
+    // — no npx, no registry round-trip, no @latest re-resolve per render.
+    // Fall back to `npx --prefer-offline @claude-flow/cli` (no @latest) only
+    // when nothing is installed locally, so a cold environment still works.
+    const cliBin = resolveCliBin();
+    const cmd = cliBin
+      ? '"' + process.execPath + '" "' + cliBin + '" hooks statusline --json 2>/dev/null'
+      : 'npx --prefer-offline @claude-flow/cli hooks statusline --json 2>/dev/null';
     const raw = execSync(
-      'npx --yes @claude-flow/cli@latest hooks statusline --json 2>/dev/null',
+      cmd,
       { encoding: 'utf-8', timeout: 8000, stdio: ['pipe', 'pipe', 'pipe'], cwd: CWD }
     ).trim();
     // The CLI may emit preamble lines before the JSON — find the first '{'.
     const jsonStart = raw.indexOf('{');
     if (jsonStart === -1) throw new Error('no JSON in CLI output');
     const data = JSON.parse(raw.slice(jsonStart));
-    // Overlay real ADR count from both local directories (fast, no network).
-    data.adrs = getLocalADRCount();
+    // Overlay every block the CLI JSON omits (adrs/agentdb/tests/hooks/integration)
+    // with real local reads, so those segments reflect actual state instead of 0.
+    applyLocalOverlays(data);
     writeCache(data);
     return data;
   } catch { /* CLI unavailable or timed out */ }
@@ -118,13 +168,40 @@ function getLocalADRCount() {
   return { count: total, implemented: total, compliance: 0 };
 }
 
-// Minimal local fallback when the CLI is not installed or times out.
-// Returns a structure that matches the CLI JSON schema so the renderer works.
-function buildLocalFallback() {
-  const memMB = Math.floor(process.memoryUsage().heapUsed / 1024 / 1024);
-  const adrs = getLocalADRCount();
+// ─── Local overlays for segments the CLI JSON omits ──────────────
+// 'hooks statusline --json' only returns user/v3Progress/security/swarm/system.
+// agentdb/tests/hooks/integration are never populated, so without these overlays
+// they render as a permanent 0. Each reader is cheap and degrades to zeros.
 
-  // Test file count (pure directory walk, no file reads)
+// Real AgentDB stats from the local memory DB. Vectors live in .swarm/memory.db
+// (sql.js + HNSW); ruvector.db is an opaque redb store counted only toward size.
+// One read-only sqlite3 query (mode=ro never takes a write lock the daemon owns).
+function getLocalAgentDB() {
+  const result = { vectorCount: 0, dbSizeKB: 0, hasHnsw: false };
+  try {
+    let bytes = 0;
+    for (const f of ['.swarm/memory.db', 'ruvector.db']) {
+      try { bytes += fs.statSync(path.join(CWD, f)).size; } catch { /* missing */ }
+    }
+    result.dbSizeKB = Math.round(bytes / 1024);
+
+    const memDb = path.join(CWD, '.swarm', 'memory.db');
+    if (fs.existsSync(memDb)) {
+      const Q = String.fromCharCode(34);
+      const sql = Q + 'SELECT (SELECT COUNT(*) FROM memory_entries WHERE embedding IS NOT NULL)||' + "'|'" + '||(SELECT COUNT(*) FROM vector_indexes);' + Q;
+      const out = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + sql, 1500);
+      if (out && out.indexOf('|') !== -1) {
+        const parts = out.split('|');
+        result.vectorCount = parseInt(parts[0], 10) || 0;
+        result.hasHnsw = (parseInt(parts[1], 10) || 0) > 0;
+      }
+    }
+  } catch { /* ignore */ }
+  return result;
+}
+
+// Count test files via a bounded directory walk (no file reads).
+function getLocalTests() {
   let testFiles = 0;
   function countTests(dir, depth) {
     if ((depth || 0) > 4) return;
@@ -140,19 +217,82 @@ function buildLocalFallback() {
     } catch { /* ignore */ }
   }
   for (const d of ['tests', 'test', '__tests__', 'src', 'v3']) countTests(path.join(CWD, d));
+  return { testFiles, testCases: testFiles * 4 };
+}
 
-  return {
+// Count configured hooks from project .claude/settings.json. Claude Code hooks
+// have no enabled/disabled flag, so every configured hook counts as enabled.
+function getLocalHooks() {
+  const result = { enabled: 0, total: 0 };
+  try {
+    const settings = readJSON(path.join(CWD, '.claude', 'settings.json'));
+    const hooks = settings && settings.hooks;
+    if (hooks && typeof hooks === 'object') {
+      let n = 0;
+      for (const ev of Object.keys(hooks)) {
+        const groups = hooks[ev];
+        if (Array.isArray(groups)) {
+          for (const g of groups) {
+            if (g && Array.isArray(g.hooks)) n += g.hooks.length;
+          }
+        }
+      }
+      result.total = n;
+      result.enabled = n;
+    }
+  } catch { /* ignore */ }
+  return result;
+}
+
+// Best-effort integration block: DB presence + locally-configured stdio MCP
+// servers (project .mcp.json + global ~/.claude.json). Remote connectors are
+// account-managed and not present in local config, so they are not counted.
+function getLocalIntegration() {
+  const integration = { mcpServers: { enabled: 0, total: 0 }, hasDatabase: false };
+  try {
+    for (const f of ['.swarm/memory.db', 'ruvector.db']) {
+      if (fs.existsSync(path.join(CWD, f))) { integration.hasDatabase = true; break; }
+    }
+    const names = new Set();
+    const projMcp = readJSON(path.join(CWD, '.mcp.json'));
+    if (projMcp && projMcp.mcpServers) for (const k of Object.keys(projMcp.mcpServers)) names.add(k);
+    const claudeJson = readJSON(path.join(os.homedir(), '.claude.json'));
+    if (claudeJson) {
+      if (claudeJson.mcpServers) for (const k of Object.keys(claudeJson.mcpServers)) names.add(k);
+      const proj = claudeJson.projects && claudeJson.projects[CWD];
+      if (proj && proj.mcpServers && !Array.isArray(proj.mcpServers)) {
+        for (const k of Object.keys(proj.mcpServers)) names.add(k);
+      }
+    }
+    integration.mcpServers.total = names.size;
+    integration.mcpServers.enabled = names.size;
+  } catch { /* ignore */ }
+  return integration;
+}
+
+// Overlay every locally-derived block onto the CLI data (mutates in place).
+function applyLocalOverlays(data) {
+  data.adrs = getLocalADRCount();
+  data.agentdb = getLocalAgentDB();
+  data.tests = getLocalTests();
+  data.hooks = getLocalHooks();
+  data.integration = getLocalIntegration();
+  return data;
+}
+
+// Minimal local fallback when the CLI is not installed or times out.
+// Returns a structure that matches the CLI JSON schema so the renderer works.
+function buildLocalFallback() {
+  const memMB = Math.floor(process.memoryUsage().heapUsed / 1024 / 1024);
+
+  return applyLocalOverlays({
     user: { name: 'user', gitBranch: '', modelName: 'Claude Code' },
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
     security: { status: 'NONE', cvesFixed: 0, totalCves: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
     system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
-    adrs,
-    hooks: { enabled: 0, total: 0 },
-    agentdb: { vectorCount: 0, dbSizeKB: 0, hasHnsw: false },
-    tests: { testFiles, testCases: testFiles * 4 },
     lastUpdated: new Date().toISOString(),
-  };
+  });
 }
 
 // ANSI colors
@@ -352,7 +492,14 @@ function getPkgVersion() {
     // (bin/node_modules) layouts.
     try {
       const binDir = path.dirname(process.execPath);
-      for (const gm of [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')]) {
+      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
+      // #2221 follow-up: a custom npm prefix (e.g. ~/.npm-global) is decoupled from
+      // the node binary location, so the binDir-derived probes above all miss. Also
+      // probe the npm prefix from the environment and the common ~/.npm-global default.
+      for (const prefix of [process.env.npm_config_prefix, process.env.PREFIX, path.join(home, '.npm-global')]) {
+        if (prefix) globalModuleDirs.push(path.join(prefix, 'lib', 'node_modules'));
+      }
+      for (const gm of globalModuleDirs) {
         pkgPaths.push(
           path.join(gm, 'ruflo', 'package.json'),
           path.join(gm, '@claude-flow', 'cli', 'package.json'),

package/README.md

@@ -35,7 +35,7 @@ Orchestrate 100+ specialized AI agents across machines, teams, and trust boundar
 
 ### What Ruflo Does
 
-One `npx ruvflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
+One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
 
 ```
 Self-Learning / Self-Optimizing Agent Architecture

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.10.39",
+  "version": "3.10.41",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/README.md

@@ -35,7 +35,7 @@ Orchestrate 100+ specialized AI agents across machines, teams, and trust boundar
 
 ### What Ruflo Does
 
-One `npx ruvflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
+One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
 
 ```
 Self-Learning / Self-Optimizing Agent Architecture

package/v3/@claude-flow/cli/dist/src/commands/hive-mind.js

@@ -306,7 +306,20 @@ async function spawnClaudeCodeInstance(swarmId, swarmName, objective, workers, f
             output.printSuccess('Claude Code launched with Hive Mind coordination');
             output.printInfo('The Queen coordinator will orchestrate all worker agents');
             output.writeln(output.dim(`Prompt file saved at: ${promptFile}`));
-            return { success: true, promptFile };
+            // #2297: await child exit before returning. Without this, the CLI
+            // process resolves immediately, finishes, and the still-initializing
+            // `claude` child loses its controlling terminal and is killed mid-launch
+            // — visible as a stray XTVERSION reply leaking onto the next shell
+            // prompt (the terminal queried for capabilities, but the child died
+            // before reading the answer). Awaiting also makes the existing
+            // claudeProcess.on('exit', ...) log lines actually print, and lets the
+            // non-interactive (-p / --non-interactive) path complete only after
+            // Claude Code finishes.
+            const claudeExitCode = await new Promise((resolve) => {
+                claudeProcess.on('exit', (c) => resolve(c ?? 0));
+                claudeProcess.on('error', () => resolve(1));
+            });
+            return { success: claudeExitCode === 0, promptFile };
         }
         else if (dryRun) {
             output.writeln();

package/v3/@claude-flow/cli/dist/src/commands/hooks.js

@@ -1560,6 +1560,19 @@ const postTaskCommand = {
             short: 'a',
             description: 'Agent that executed the task',
             type: 'string'
+        },
+        {
+            // ADR-147 P2: nested-subagent spawn-tree capture
+            name: 'parent-agent-id',
+            description: 'ID of the parent agent (from Claude Code\'s parent_agent_id OTel span tag). Omit for top-level work.',
+            type: 'string',
+            required: false
+        },
+        {
+            name: 'depth',
+            description: 'Chain depth from root lead session (0 = lead, 1+ = subagent). Used by ADR-147 P3 depth-aware guardrail.',
+            type: 'number',
+            required: false
         }
     ],
     examples: [
@@ -1579,6 +1592,9 @@ const postTaskCommand = {
                 quality: ctx.flags.quality,
                 agent: ctx.flags.agent,
                 timestamp: Date.now(),
+                // ADR-147 P2: forward spawn-tree lineage if caller supplied it
+                parentAgentId: ctx.flags.parentAgentId,
+                depth: ctx.flags.depth,
             });
             if (ctx.flags.format === 'json') {
                 output.printJson(result);

package/v3/@claude-flow/cli/dist/src/init/settings-generator.js

@@ -27,7 +27,7 @@ export function generateSettings(options) {
             'Bash(npx @claude-flow*)',
             'Bash(npx claude-flow*)',
             'Bash(node .claude/*)',
-            'mcp__claude-flow__:*',
+            'mcp__claude-flow__*',
         ],
         deny: [
             'Read(./.env)',

package/v3/@claude-flow/cli/dist/src/init/statusline-generator.js

@@ -65,10 +65,51 @@ const CONFIG = {
 const CWD = process.cwd();
 
 // ─── Delegation cache ───────────────────────────────────────────
-// Cache the CLI JSON result for 10s so rapid prompt re-renders
-// (e.g. every keypress in some shells) don't re-invoke npx each time.
+// Cache the CLI JSON result for 60s so rapid prompt re-renders
+// (Claude Code refreshes the statusline several times a second while
+// streaming) don't re-invoke the CLI each time. #2337: bumped 10s→60s
+// because 10s was far too short for how often Claude Code re-renders.
 const CACHE_FILE = path.join(os.tmpdir(), 'ruflo-statusline-cache-' + require('crypto').createHash('md5').update(CWD).digest('hex').slice(0, 8) + '.json');
-const CACHE_TTL_MS = 10000;
+const CACHE_TTL_MS = 60000;
+
+// #2337: resolve an already-installed @claude-flow/cli (or ruflo) bin so we
+// can invoke it directly via \`node\`. The previous version called
+// \`npx --yes @claude-flow/cli@latest\` on every uncached render, which forces
+// a registry resolution + cold-start of the entire CLI per render. With
+// multiple concurrent Claude Code sessions this storms the host (reporter
+// saw load average 40-65 on a 12-core box).
+//
+// Returns the absolute path to bin/cli.js or null. Mirrors getPkgVersion()'s
+// path probing (project, monorepo, plugin marketplace, global node_modules
+// including custom-prefix layouts like ~/.npm-global).
+function resolveCliBin() {
+  try {
+    const home = os.homedir();
+    const candidates = [
+      path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', 'bin', 'cli.js'),
+      path.join(CWD, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
+      path.join(CWD, 'node_modules', 'ruflo', 'bin', 'cli.js'),
+      path.join(CWD, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
+    ];
+    try {
+      const binDir = path.dirname(process.execPath);
+      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
+      for (const prefix of [process.env.npm_config_prefix, process.env.PREFIX, path.join(home, '.npm-global')]) {
+        if (prefix) globalModuleDirs.push(path.join(prefix, 'lib', 'node_modules'));
+      }
+      for (const gm of globalModuleDirs) {
+        candidates.push(
+          path.join(gm, 'ruflo', 'bin', 'cli.js'),
+          path.join(gm, '@claude-flow', 'cli', 'bin', 'cli.js'),
+        );
+      }
+    } catch { /* ignore */ }
+    for (const p of candidates) {
+      if (fs.existsSync(p)) return p;
+    }
+  } catch { /* ignore */ }
+  return null;
+}
 
 function readCache() {
   try {
@@ -99,16 +140,25 @@ function getStatuslineData() {
   if (cached) return cached;
 
   try {
+    // #2337: prefer an already-installed CLI bin via direct \`node\` invocation
+    // — no npx, no registry round-trip, no @latest re-resolve per render.
+    // Fall back to \`npx --prefer-offline @claude-flow/cli\` (no @latest) only
+    // when nothing is installed locally, so a cold environment still works.
+    const cliBin = resolveCliBin();
+    const cmd = cliBin
+      ? '"' + process.execPath + '" "' + cliBin + '" hooks statusline --json 2>/dev/null'
+      : 'npx --prefer-offline @claude-flow/cli hooks statusline --json 2>/dev/null';
     const raw = execSync(
-      'npx --yes @claude-flow/cli@latest hooks statusline --json 2>/dev/null',
+      cmd,
       { encoding: 'utf-8', timeout: 8000, stdio: ['pipe', 'pipe', 'pipe'], cwd: CWD }
     ).trim();
     // The CLI may emit preamble lines before the JSON — find the first '{'.
     const jsonStart = raw.indexOf('{');
     if (jsonStart === -1) throw new Error('no JSON in CLI output');
     const data = JSON.parse(raw.slice(jsonStart));
-    // Overlay real ADR count from both local directories (fast, no network).
-    data.adrs = getLocalADRCount();
+    // Overlay every block the CLI JSON omits (adrs/agentdb/tests/hooks/integration)
+    // with real local reads, so those segments reflect actual state instead of 0.
+    applyLocalOverlays(data);
     writeCache(data);
     return data;
   } catch { /* CLI unavailable or timed out */ }
@@ -141,13 +191,40 @@ function getLocalADRCount() {
   return { count: total, implemented: total, compliance: 0 };
 }
 
-// Minimal local fallback when the CLI is not installed or times out.
-// Returns a structure that matches the CLI JSON schema so the renderer works.
-function buildLocalFallback() {
-  const memMB = Math.floor(process.memoryUsage().heapUsed / 1024 / 1024);
-  const adrs = getLocalADRCount();
+// ─── Local overlays for segments the CLI JSON omits ──────────────
+// 'hooks statusline --json' only returns user/v3Progress/security/swarm/system.
+// agentdb/tests/hooks/integration are never populated, so without these overlays
+// they render as a permanent 0. Each reader is cheap and degrades to zeros.
 
-  // Test file count (pure directory walk, no file reads)
+// Real AgentDB stats from the local memory DB. Vectors live in .swarm/memory.db
+// (sql.js + HNSW); ruvector.db is an opaque redb store counted only toward size.
+// One read-only sqlite3 query (mode=ro never takes a write lock the daemon owns).
+function getLocalAgentDB() {
+  const result = { vectorCount: 0, dbSizeKB: 0, hasHnsw: false };
+  try {
+    let bytes = 0;
+    for (const f of ['.swarm/memory.db', 'ruvector.db']) {
+      try { bytes += fs.statSync(path.join(CWD, f)).size; } catch { /* missing */ }
+    }
+    result.dbSizeKB = Math.round(bytes / 1024);
+
+    const memDb = path.join(CWD, '.swarm', 'memory.db');
+    if (fs.existsSync(memDb)) {
+      const Q = String.fromCharCode(34);
+      const sql = Q + 'SELECT (SELECT COUNT(*) FROM memory_entries WHERE embedding IS NOT NULL)||' + "'|'" + '||(SELECT COUNT(*) FROM vector_indexes);' + Q;
+      const out = safeExec("sqlite3 'file:" + memDb + "?mode=ro' " + sql, 1500);
+      if (out && out.indexOf('|') !== -1) {
+        const parts = out.split('|');
+        result.vectorCount = parseInt(parts[0], 10) || 0;
+        result.hasHnsw = (parseInt(parts[1], 10) || 0) > 0;
+      }
+    }
+  } catch { /* ignore */ }
+  return result;
+}
+
+// Count test files via a bounded directory walk (no file reads).
+function getLocalTests() {
   let testFiles = 0;
   function countTests(dir, depth) {
     if ((depth || 0) > 4) return;
@@ -163,19 +240,82 @@ function buildLocalFallback() {
     } catch { /* ignore */ }
   }
   for (const d of ['tests', 'test', '__tests__', 'src', 'v3']) countTests(path.join(CWD, d));
+  return { testFiles, testCases: testFiles * 4 };
+}
 
-  return {
+// Count configured hooks from project .claude/settings.json. Claude Code hooks
+// have no enabled/disabled flag, so every configured hook counts as enabled.
+function getLocalHooks() {
+  const result = { enabled: 0, total: 0 };
+  try {
+    const settings = readJSON(path.join(CWD, '.claude', 'settings.json'));
+    const hooks = settings && settings.hooks;
+    if (hooks && typeof hooks === 'object') {
+      let n = 0;
+      for (const ev of Object.keys(hooks)) {
+        const groups = hooks[ev];
+        if (Array.isArray(groups)) {
+          for (const g of groups) {
+            if (g && Array.isArray(g.hooks)) n += g.hooks.length;
+          }
+        }
+      }
+      result.total = n;
+      result.enabled = n;
+    }
+  } catch { /* ignore */ }
+  return result;
+}
+
+// Best-effort integration block: DB presence + locally-configured stdio MCP
+// servers (project .mcp.json + global ~/.claude.json). Remote connectors are
+// account-managed and not present in local config, so they are not counted.
+function getLocalIntegration() {
+  const integration = { mcpServers: { enabled: 0, total: 0 }, hasDatabase: false };
+  try {
+    for (const f of ['.swarm/memory.db', 'ruvector.db']) {
+      if (fs.existsSync(path.join(CWD, f))) { integration.hasDatabase = true; break; }
+    }
+    const names = new Set();
+    const projMcp = readJSON(path.join(CWD, '.mcp.json'));
+    if (projMcp && projMcp.mcpServers) for (const k of Object.keys(projMcp.mcpServers)) names.add(k);
+    const claudeJson = readJSON(path.join(os.homedir(), '.claude.json'));
+    if (claudeJson) {
+      if (claudeJson.mcpServers) for (const k of Object.keys(claudeJson.mcpServers)) names.add(k);
+      const proj = claudeJson.projects && claudeJson.projects[CWD];
+      if (proj && proj.mcpServers && !Array.isArray(proj.mcpServers)) {
+        for (const k of Object.keys(proj.mcpServers)) names.add(k);
+      }
+    }
+    integration.mcpServers.total = names.size;
+    integration.mcpServers.enabled = names.size;
+  } catch { /* ignore */ }
+  return integration;
+}
+
+// Overlay every locally-derived block onto the CLI data (mutates in place).
+function applyLocalOverlays(data) {
+  data.adrs = getLocalADRCount();
+  data.agentdb = getLocalAgentDB();
+  data.tests = getLocalTests();
+  data.hooks = getLocalHooks();
+  data.integration = getLocalIntegration();
+  return data;
+}
+
+// Minimal local fallback when the CLI is not installed or times out.
+// Returns a structure that matches the CLI JSON schema so the renderer works.
+function buildLocalFallback() {
+  const memMB = Math.floor(process.memoryUsage().heapUsed / 1024 / 1024);
+
+  return applyLocalOverlays({
     user: { name: 'user', gitBranch: '', modelName: 'Claude Code' },
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
     security: { status: 'NONE', cvesFixed: 0, totalCves: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
     system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
-    adrs,
-    hooks: { enabled: 0, total: 0 },
-    agentdb: { vectorCount: 0, dbSizeKB: 0, hasHnsw: false },
-    tests: { testFiles, testCases: testFiles * 4 },
     lastUpdated: new Date().toISOString(),
-  };
+  });
 }
 
 // ANSI colors
@@ -375,7 +515,14 @@ function getPkgVersion() {
     // (bin/node_modules) layouts.
     try {
       const binDir = path.dirname(process.execPath);
-      for (const gm of [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')]) {
+      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
+      // #2221 follow-up: a custom npm prefix (e.g. ~/.npm-global) is decoupled from
+      // the node binary location, so the binDir-derived probes above all miss. Also
+      // probe the npm prefix from the environment and the common ~/.npm-global default.
+      for (const prefix of [process.env.npm_config_prefix, process.env.PREFIX, path.join(home, '.npm-global')]) {
+        if (prefix) globalModuleDirs.push(path.join(prefix, 'lib', 'node_modules'));
+      }
+      for (const gm of globalModuleDirs) {
         pkgPaths.push(
           path.join(gm, 'ruflo', 'package.json'),
           path.join(gm, '@claude-flow', 'cli', 'package.json'),

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -1239,6 +1239,9 @@ export const hooksPostTask = {
             quality: { type: 'number', description: 'Quality score (0-1)' },
             task: { type: 'string', description: 'Task description text (used for learning keyword extraction)' },
             storeDecisions: { type: 'boolean', description: 'Also store routing decision in memory DB' },
+            // ADR-147 P2: nested-subagent spawn-tree capture
+            parentAgentId: { type: 'string', description: 'ID of the parent agent (from Claude Code\'s parent_agent_id OTel span tag / x-claude-code-parent-agent-id header). Omit for top-level work.' },
+            depth: { type: 'number', description: 'Chain depth from root lead session (0 = lead, 1+ = subagent). Used by ADR-147 P3 depth-aware guardrail.' },
         },
         required: ['taskId'],
     },
@@ -1258,6 +1261,22 @@ export const hooksPostTask = {
             if (!v.valid)
                 return { success: false, error: v.error };
         }
+        // ADR-147 P2: validate spawn-tree lineage if provided
+        const parentAgentId = params.parentAgentId;
+        if (parentAgentId !== undefined) {
+            const v = validateIdentifier(parentAgentId, 'parentAgentId');
+            if (!v.valid)
+                return { success: false, error: v.error };
+        }
+        const depthRaw = params.depth;
+        let depth;
+        if (depthRaw !== undefined && depthRaw !== null) {
+            const n = Number(depthRaw);
+            if (!Number.isInteger(n) || n < 0 || n > 32) {
+                return { success: false, error: 'depth must be a non-negative integer ≤ 32' };
+            }
+            depth = n;
+        }
         // Phase 3: Wire recordFeedback through bridge → LearningSystem + ReasoningBank
         let feedbackResult = null;
         try {
@@ -1269,6 +1288,9 @@ export const hooksPostTask = {
                 agent,
                 duration: params.duration || undefined,
                 patterns: params.patterns || undefined,
+                // ADR-147 P2: forward spawn-tree lineage so it lands in feedback + memory
+                parentAgentId,
+                depth,
             });
         }
         catch {
@@ -3931,7 +3953,10 @@ export const hooksModelRoute = {
             alternatives: result.alternatives,
             inferenceTimeUs: result.inferenceTimeUs,
             costMultiplier: result.costMultiplier,
-            implementation: 'tiny-dancer-neural',
+            // Historical name kept for telemetry / dashboard schema stability.
+            // The shipped router is the heuristic + Thompson-bandit described in
+            // ruvector/model-router.ts — not a neural network. See #2329.
+            implementation: 'heuristic-thompson-bandit',
         };
     },
 };

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.d.ts

@@ -265,6 +265,8 @@ export declare function bridgeRecordFeedback(options: {
     duration?: number;
     patterns?: string[];
     dbPath?: string;
+    parentAgentId?: string;
+    depth?: number;
 }): Promise<{
     success: boolean;
     controller: string;

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.js

@@ -1422,6 +1422,8 @@ export async function bridgeRecordFeedback(options) {
                     await learningSystem.recordFeedback({
                         taskId: options.taskId, success: options.success, quality: options.quality,
                         agent: options.agent, duration: options.duration, timestamp: Date.now(),
+                        // ADR-147 P2: forward spawn-tree lineage if present
+                        parentAgentId: options.parentAgentId, depth: options.depth,
                     });
                     controller = 'learningSystem';
                     updated++;

package/v3/@claude-flow/cli/dist/src/ruvector/enhanced-model-router.d.ts

@@ -71,7 +71,7 @@ export interface EnhancedModelRouterConfig {
  */
 export declare class EnhancedModelRouter {
     private config;
-    private tinyDancerRouter;
+    private baseRouter;
     constructor(config?: Partial<EnhancedModelRouterConfig>);
     /**
      * Detect code editing intent from task description

package/v3/@claude-flow/cli/dist/src/ruvector/enhanced-model-router.js

@@ -177,7 +177,12 @@ const LANGUAGE_MAP = {
  */
 export class EnhancedModelRouter {
     config;
-    tinyDancerRouter;
+    // The base text-routing path delegated to here is the local
+    // heuristic + Thompson-bandit ModelRouter — NOT the @ruvector/tiny-dancer
+    // neural router that an earlier design (ADR-026) described (#2329). The
+    // public `getStats()` return still exposes the field as `tinyDancerStats`
+    // for telemetry-schema stability.
+    baseRouter;
     constructor(config) {
         this.config = {
             agentBoosterEnabled: true,
@@ -199,7 +204,7 @@ export class EnhancedModelRouter {
             preferQuality: false,
             ...config,
         };
-        this.tinyDancerRouter = getModelRouter();
+        this.baseRouter = getModelRouter();
     }
     /**
      * Detect code editing intent from task description
@@ -355,13 +360,13 @@ export class EnhancedModelRouter {
                 // AST analysis not available, continue with text-based routing
             }
         }
-        // Step 4: Text-based complexity + tiny-dancer routing
-        const tinyDancerResult = await this.tinyDancerRouter.route(task);
-        // Step 5: Combine AST complexity with tiny-dancer result
-        // Also boost if single tier3 keyword found
+        // Step 4: Text-based complexity via the local heuristic + bandit router.
+        const baseResult = await this.baseRouter.route(task);
+        // Step 5: Combine AST complexity with the text-routing result.
+        // Also boost if a single tier3 keyword is found.
         let finalComplexity = astComplexity !== undefined
-            ? (astComplexity + tinyDancerResult.complexity) / 2
-            : tinyDancerResult.complexity;
+            ? (astComplexity + baseResult.complexity) / 2
+            : baseResult.complexity;
         // Boost complexity if tier3 keywords found (even just one)
         if (tier3Check.matches) {
             finalComplexity = Math.min(1.0, finalComplexity + 0.25);
@@ -373,7 +378,7 @@ export class EnhancedModelRouter {
                 tier: 2,
                 handler: 'haiku',
                 model: 'haiku',
-                confidence: tinyDancerResult.confidence,
+                confidence: baseResult.confidence,
                 complexity: finalComplexity,
                 reasoning: `Low complexity (${(finalComplexity * 100).toFixed(0)}%) - using haiku`,
                 canSkipLLM: false,
@@ -386,7 +391,7 @@ export class EnhancedModelRouter {
                 tier: 2,
                 handler: 'sonnet',
                 model: 'sonnet',
-                confidence: tinyDancerResult.confidence,
+                confidence: baseResult.confidence,
                 complexity: finalComplexity,
                 reasoning: `Medium complexity (${(finalComplexity * 100).toFixed(0)}%) - using sonnet`,
                 canSkipLLM: false,
@@ -398,7 +403,7 @@ export class EnhancedModelRouter {
             tier: 3,
             handler: 'opus',
             model: 'opus',
-            confidence: tinyDancerResult.confidence,
+            confidence: baseResult.confidence,
             complexity: finalComplexity,
             reasoning: `High complexity (${(finalComplexity * 100).toFixed(0)}%) - using opus`,
             canSkipLLM: false,
@@ -494,7 +499,10 @@ export class EnhancedModelRouter {
     getStats() {
         return {
             config: { ...this.config },
-            tinyDancerStats: this.tinyDancerRouter.getStats(),
+            // Field name kept as `tinyDancerStats` for telemetry-schema
+            // stability; the underlying router is the local heuristic + bandit
+            // ModelRouter, not @ruvector/tiny-dancer. See #2329.
+            tinyDancerStats: this.baseRouter.getStats(),
         };
     }
 }

package/v3/@claude-flow/cli/dist/src/ruvector/model-router.d.ts

@@ -1,20 +1,33 @@
 /**
- * Intelligent Model Router using Tiny Dancer
+ * Intelligent Model Router — lexical complexity heuristic + Thompson bandit
  *
- * Dynamically routes requests to optimal Claude model (haiku/sonnet/opus)
- * based on task complexity, confidence scores, and historical performance.
+ * Dynamically routes requests to the optimal Claude model (haiku/sonnet/opus)
+ * based on task complexity, uncertainty, and online-learned routing outcomes.
  *
- * Features:
- * - FastGRNN-based routing decisions (<100μs)
- * - Uncertainty quantification for model escalation
- * - Circuit breaker for failover
- * - Online learning from routing outcomes
- * - Complexity scoring via embeddings
+ * Mechanism (shipped):
+ * - Complexity score = blend of lexical, semantic-depth, task-scope, and
+ *   uncertainty heuristics (see `computeLexicalComplexity` and friends).
+ *   Pure JS arithmetic — no model load, no tensor math.
+ * - Model selection = Thompson-sampling Beta-Bernoulli bandit with
+ *   complexity-bucketed Beta(α,β) priors, persisted to
+ *   `.swarm/model-router-state.json` and updated by `recordOutcome` after
+ *   each routing decision.
+ * - Uncertainty quantification + a circuit breaker drive escalation when
+ *   the bandit's confidence is low or downstream failures are observed.
  *
  * Routing Strategy:
- * - Haiku: High confidence, low complexity (fast, cheap)
- * - Sonnet: Medium confidence, moderate complexity (balanced)
- * - Opus: Low confidence, high complexity (most capable)
+ * - Haiku: high confidence, low complexity (fast, cheap)
+ * - Sonnet: medium confidence, moderate complexity (balanced)
+ * - Opus: low confidence, high complexity (most capable)
+ *
+ * Note (#2329): An earlier design (ADR-026 + this file's previous header)
+ * described a Tiny-Dancer / FastGRNN neural router with embedding-based
+ * complexity scoring. That path was never wired in — `@ruvector/tiny-dancer`
+ * is not imported here and the `embedding`-consuming branch in
+ * `computeSemanticDepth` is only reachable via the externally-callable
+ * `routeToModelFull(task, embedding)` wrapper (no internal callers). The
+ * shipped router is the heuristic + bandit described above; the neural
+ * path remains a future direction tracked in #2329.
  *
  * @module model-router
  */

package/v3/@claude-flow/cli/dist/src/ruvector/model-router.js

@@ -1,20 +1,33 @@
 /**
- * Intelligent Model Router using Tiny Dancer
+ * Intelligent Model Router — lexical complexity heuristic + Thompson bandit
  *
- * Dynamically routes requests to optimal Claude model (haiku/sonnet/opus)
- * based on task complexity, confidence scores, and historical performance.
+ * Dynamically routes requests to the optimal Claude model (haiku/sonnet/opus)
+ * based on task complexity, uncertainty, and online-learned routing outcomes.
  *
- * Features:
- * - FastGRNN-based routing decisions (<100μs)
- * - Uncertainty quantification for model escalation
- * - Circuit breaker for failover
- * - Online learning from routing outcomes
- * - Complexity scoring via embeddings
+ * Mechanism (shipped):
+ * - Complexity score = blend of lexical, semantic-depth, task-scope, and
+ *   uncertainty heuristics (see `computeLexicalComplexity` and friends).
+ *   Pure JS arithmetic — no model load, no tensor math.
+ * - Model selection = Thompson-sampling Beta-Bernoulli bandit with
+ *   complexity-bucketed Beta(α,β) priors, persisted to
+ *   `.swarm/model-router-state.json` and updated by `recordOutcome` after
+ *   each routing decision.
+ * - Uncertainty quantification + a circuit breaker drive escalation when
+ *   the bandit's confidence is low or downstream failures are observed.
  *
  * Routing Strategy:
- * - Haiku: High confidence, low complexity (fast, cheap)
- * - Sonnet: Medium confidence, moderate complexity (balanced)
- * - Opus: Low confidence, high complexity (most capable)
+ * - Haiku: high confidence, low complexity (fast, cheap)
+ * - Sonnet: medium confidence, moderate complexity (balanced)
+ * - Opus: low confidence, high complexity (most capable)
+ *
+ * Note (#2329): An earlier design (ADR-026 + this file's previous header)
+ * described a Tiny-Dancer / FastGRNN neural router with embedding-based
+ * complexity scoring. That path was never wired in — `@ruvector/tiny-dancer`
+ * is not imported here and the `embedding`-consuming branch in
+ * `computeSemanticDepth` is only reachable via the externally-callable
+ * `routeToModelFull(task, embedding)` wrapper (no internal callers). The
+ * shipped router is the heuristic + bandit described above; the neural
+ * path remains a future direction tracked in #2329.
  *
  * @module model-router
  */

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.10.39",
+  "version": "3.10.41",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/.claude/scheduled_tasks.lock

@@ -1 +0,0 @@
-{"sessionId":"52c25bf9-4a48-4a92-b86e-952e2e8c9fd2","pid":39252,"acquiredAt":1780929066497}