claude-flow 3.32.0 → 3.32.2

package/v3/@claude-flow/cli/dist/src/commands/hooks.js

@@ -3487,18 +3487,26 @@ const statuslineCommand = {
         }
         // Get user info
         function getUserInfo() {
-            let name = 'user';
+            const identityMode = (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase();
+            let name = path.basename(process.cwd()) || 'project';
             let gitBranch = '';
             const modelName = 'Opus 4.6 (1M context)';
             const isWindows = process.platform === 'win32';
             try {
-                const nameCmd = isWindows
-                    ? 'git config user.name 2>NUL || echo user'
-                    : 'git config user.name 2>/dev/null || echo "user"';
+                const rootCmd = isWindows
+                    ? 'git rev-parse --show-toplevel 2>NUL'
+                    : 'git rev-parse --show-toplevel 2>/dev/null';
                 const branchCmd = isWindows
                     ? 'git branch --show-current 2>NUL || echo.'
                     : 'git branch --show-current 2>/dev/null || echo ""';
-                name = execSync(nameCmd, { encoding: 'utf-8' }).trim();
+                const root = execSync(rootCmd, { encoding: 'utf-8' }).trim();
+                name = path.basename(root) || name;
+                if (identityMode === 'author') {
+                    const authorCmd = isWindows
+                        ? 'git config user.name 2>NUL || echo user'
+                        : 'git config user.name 2>/dev/null || echo "user"';
+                    name = execSync(authorCmd, { encoding: 'utf-8' }).trim() || 'user';
+                }
                 gitBranch = execSync(branchCmd, { encoding: 'utf-8' }).trim();
                 if (gitBranch === '.')
                     gitBranch = '';
@@ -3555,7 +3563,10 @@ const statuslineCommand = {
         const terminalCols = process.stdout.columns ?? 80;
         const autoCompact = !ctx.flags.full && terminalCols < COMPACT_WIDTH_THRESHOLD;
         if (ctx.flags.compact || autoCompact) {
-            const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} CVE:${security.cvesFixed}/${security.totalCves} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${system.contextPct}% Int:${system.intelligencePct}%`;
+            const securityCompact = security.findings > 0
+                ? `Findings:${security.findings}`
+                : `Security:${security.status}`;
+            const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} ${securityCompact} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${system.contextPct}% Int:${system.intelligencePct}%`;
             output.writeln(line);
             return { success: true, data: statusData };
         }
@@ -3729,13 +3740,13 @@ const statuslineCommand = {
             perfIndicator;
         const swarmIndicator = swarm.coordinationActive ? `${c.brightGreen}◉${c.reset}` : `${c.dim}○${c.reset}`;
         const agentsColor = swarm.activeAgents > 0 ? c.brightGreen : c.red;
-        const securityIcon = security.status === 'CLEAN' ? '🟢' : security.status === 'IN_PROGRESS' ? '🟡' : '🔴';
-        const securityColor = security.status === 'CLEAN' ? c.brightGreen : security.status === 'IN_PROGRESS' ? c.brightYellow : c.brightRed;
+        const securityIcon = security.status === 'CLEAN' ? '🟢' : security.status === 'PENDING' ? '🟡' : '🔴';
+        const securityColor = security.status === 'CLEAN' ? c.brightGreen : security.status === 'PENDING' ? c.brightYellow : c.brightRed;
         const hooksColor = hooksStats.enabled > 0 ? c.brightGreen : c.dim;
         const line2 = `${c.brightYellow}🤖 Swarm${c.reset}  ${swarmIndicator} [${agentsColor}${String(swarm.activeAgents).padStart(2)}${c.reset}/${c.brightWhite}${swarm.maxAgents}${c.reset}]  ` +
             `${c.brightPurple}👥 ${system.subAgents}${c.reset}    ` +
             `${c.brightBlue}🪝 ${hooksColor}${hooksStats.enabled}${c.reset}/${c.brightWhite}${hooksStats.total}${c.reset}    ` +
-            `${securityIcon} ${securityColor}CVE ${security.cvesFixed}${c.reset}/${c.brightWhite}${security.totalCves}${c.reset}    ` +
+            `${securityIcon} ${securityColor}${security.findings > 0 ? `Findings ${security.findings}` : `Security ${security.status}`}${c.reset}    ` +
             `${c.brightCyan}💾 ${system.memoryMB}MB${c.reset}    ` +
             `${c.brightPurple}🧠 ${String(system.intelligencePct).padStart(3)}%${c.reset}`;
         const dddColor = progress.dddProgress >= 50 ? c.brightGreen : progress.dddProgress > 0 ? c.yellow : c.red;

package/v3/@claude-flow/cli/dist/src/commands/init.d.ts

@@ -3,6 +3,11 @@
  * Comprehensive initialization for Claude Flow with Claude Code integration
  */
 import type { Command } from '../types.js';
+export declare function runCodexInitializerCli(cwd: string, options: {
+    template: string;
+    force: boolean;
+    dual: boolean;
+}): boolean;
 export declare const initCommand: Command;
 export default initCommand;
 //# sourceMappingURL=init.d.ts.map

package/v3/@claude-flow/cli/dist/src/commands/init.js

@@ -6,6 +6,7 @@ import { output } from '../output.js';
 import { confirm, select, multiSelect, input } from '../prompt.js';
 import * as fs from 'fs';
 import * as path from 'path';
+import { spawnSync } from 'node:child_process';
 import { executeInit, executeUpgrade, executeUpgradeWithMissing, DEFAULT_INIT_OPTIONS, MINIMAL_INIT_OPTIONS, FULL_INIT_OPTIONS, } from '../init/index.js';
 import { ENROLLMENT_SCREEN, recordEnrollmentOutcome, shouldOfferEnrollment, } from '../funnel/enrollment.js';
 import { commandExists } from '../services/harness-hosts.js';
@@ -82,6 +83,27 @@ async function resolveCodexInitializer(cwd) {
     }
     return undefined;
 }
+// Keep Codex out of the CLI dependency graph so cold `npx ruflo --version`
+// remains fast (#2561). An explicit `init --codex` may fetch the small,
+// stable adapter on demand when it is not already installed by an umbrella
+// package, the current project, or the global npm prefix.
+export function runCodexInitializerCli(cwd, options) {
+    const npxArgs = [
+        '-y',
+        '@claude-flow/codex@latest',
+        'init',
+        '--template',
+        options.template,
+        ...(options.force ? ['--force'] : []),
+        ...(options.dual ? ['--dual'] : []),
+    ];
+    const result = process.platform === 'win32'
+        ? spawnSync(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', ['npx', ...npxArgs].join(' ')], { cwd, stdio: 'inherit', windowsHide: true })
+        : spawnSync('npx', npxArgs, { cwd, stdio: 'inherit' });
+    if (result.error)
+        throw result.error;
+    return result.status === 0;
+}
 // #2666-adjacent — quietly wire up Codex too when a plain `ruflo init` (no
 // --codex/--dual) runs on a machine that also has the OpenAI Codex CLI on
 // PATH: registers its MCP server and installs skills alongside the Claude
@@ -194,7 +216,14 @@ async function initCodexAction(ctx, options) {
     try {
         const CodexInitializer = await resolveCodexInitializer(ctx.cwd);
         if (!CodexInitializer) {
-            throw new Error('Cannot find module @claude-flow/codex');
+            spinner.stop();
+            output.printInfo('Fetching the stable Codex adapter for this initialization...');
+            const success = runCodexInitializerCli(ctx.cwd, { template, force, dual: dualMode });
+            if (!success) {
+                output.printError('Codex initialization failed while running @claude-flow/codex@latest.');
+                return { success: false, exitCode: 1 };
+            }
+            return { success: true, data: { adapter: '@claude-flow/codex@latest' } };
         }
         const initializer = new CodexInitializer();
         const result = await initializer.initialize({

package/v3/@claude-flow/cli/dist/src/commands/security.js

@@ -6,6 +6,7 @@
  */
 import { output } from '../output.js';
 import { execSync } from 'node:child_process';
+import { createBuiltinAIDefence } from '../security/builtin-aidefence.js';
 // Scan subcommand
 const scanCommand = {
     name: 'scan',
@@ -861,16 +862,17 @@ const defendCommand = {
         output.writeln(output.bold('🛡️ AIDefence - AI Manipulation Defense System'));
         output.writeln(output.dim('─'.repeat(55)));
         // Dynamic import of aidefence (allows package to be optional)
-        let createAIDefence;
+        let defender;
         try {
             const aidefence = await import('@claude-flow/aidefence');
-            createAIDefence = aidefence.createAIDefence;
+            defender = aidefence.createAIDefence({ enableLearning });
         }
         catch {
-            output.error('AIDefence package not installed. Run: npm install @claude-flow/aidefence');
-            return { success: false, message: 'AIDefence not available' };
+            // Keep cold npx startup lean (#2561): the full learning engine remains
+            // user-installable, while the CLI always ships a deterministic scanner.
+            defender = createBuiltinAIDefence();
+            output.writeln(output.dim('Using built-in defense engine (install @claude-flow/aidefence for adaptive learning)'));
         }
-        const defender = createAIDefence({ enableLearning });
         // Show stats mode
         if (showStats) {
             const stats = await defender.getStats();
@@ -893,8 +895,8 @@ const defendCommand = {
                 output.writeln(output.dim(`Reading file: ${filePath}`));
             }
             catch (err) {
-                output.error(`Failed to read file: ${filePath}`);
-                return { success: false, message: 'File not found' };
+                output.printError(`Failed to read file: ${filePath}`);
+                return { success: false, exitCode: 2, message: 'File not found' };
             }
         }
         if (!textToScan) {
@@ -914,8 +916,9 @@ const defendCommand = {
         spinner.start();
         // Perform scan
         const startTime = performance.now();
-        const result = quickMode
-            ? { ...defender.quickScan(textToScan), threats: [], piiFound: false, detectionTimeMs: 0, inputHash: '', safe: !defender.quickScan(textToScan).threat }
+        const quickResult = quickMode ? defender.quickScan(textToScan) : undefined;
+        const result = quickResult
+            ? { ...quickResult, threats: [], piiFound: false, detectionTimeMs: 0, inputHash: '', safe: !quickResult.threat }
             : await defender.detect(textToScan);
         const scanTime = performance.now() - startTime;
         spinner.stop();
@@ -927,7 +930,8 @@ const defendCommand = {
                 piiFound: result.piiFound,
                 detectionTimeMs: scanTime,
             }, null, 2));
-            return { success: true };
+            const safe = result.safe && !result.piiFound;
+            return { success: safe, exitCode: safe ? 0 : 1 };
         }
         // Text output
         output.writeln();
@@ -969,7 +973,8 @@ const defendCommand = {
             }
         }
         output.writeln(output.dim(`Detection time: ${scanTime.toFixed(3)}ms`));
-        return { success: result.safe };
+        const safe = result.safe && !result.piiFound;
+        return { success: safe, exitCode: safe ? 0 : 1 };
     },
 };
 // Main security command

package/v3/@claude-flow/cli/dist/src/funnel/insights.d.ts

@@ -30,6 +30,7 @@ export interface LocalInsight {
 export interface LocalInsightContext {
     security?: {
         status: string;
+        findings?: number;
         cvesFixed: number;
         totalCves: number;
     };

package/v3/@claude-flow/cli/dist/src/funnel/insights.js

@@ -42,11 +42,11 @@ function securityInsight(ctx) {
     const s = ctx.security;
     if (!s)
         return null;
-    const pending = s.totalCves - s.cvesFixed;
-    if (pending > 0) {
+    const findings = Math.max(0, s.findings ?? 0);
+    if (s.status === 'ISSUES' || findings > 0) {
         return {
-            id: 'insight-cves-pending',
-            text: `⚠ ${pending} CVE${pending === 1 ? '' : 's'} pending — Run ruflo security scan --depth full`,
+            id: 'insight-security-findings',
+            text: `⚠ ${findings} security finding${findings === 1 ? '' : 's'} — Review the latest ruflo security scan`,
             priority: 90,
         };
     }

package/v3/@claude-flow/cli/dist/src/funnel/local-signals.d.ts

@@ -1,6 +1,11 @@
 export interface SecurityStatus {
-    status: 'CLEAN' | 'IN_PROGRESS' | 'PENDING';
+    status: 'CLEAN' | 'ISSUES' | 'PENDING';
+    /** Generic code-pattern findings from `ruflo security scan` (not CVEs). */
+    findings: number;
+    scannedAt?: string;
+    /** @deprecated Retained as a zero-valued compatibility field. */
     cvesFixed: number;
+    /** @deprecated Retained as a zero-valued compatibility field. */
     totalCves: number;
 }
 export declare function getSecurityStatus(cwd?: string): SecurityStatus;

package/v3/@claude-flow/cli/dist/src/funnel/local-signals.js

@@ -11,30 +11,39 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 export function getSecurityStatus(cwd = process.cwd()) {
+    const empty = {
+        status: 'PENDING', findings: 0, cvesFixed: 0, totalCves: 0,
+    };
     const scanResultsPath = path.join(cwd, '.claude', 'security-scans');
-    let cvesFixed = 0;
-    const totalCves = 3;
-    if (fs.existsSync(scanResultsPath)) {
-        try {
-            const scans = fs.readdirSync(scanResultsPath).filter((f) => f.endsWith('.json'));
-            cvesFixed = Math.min(totalCves, scans.length);
-        }
-        catch {
-            // Ignore
+    if (!fs.existsSync(scanResultsPath))
+        return empty;
+    try {
+        const files = fs.readdirSync(scanResultsPath).filter((f) => f.endsWith('.json'));
+        if (files.length === 0)
+            return empty;
+        let newest = files[0];
+        let newestMtime = -1;
+        for (const f of files) {
+            const st = fs.statSync(path.join(scanResultsPath, f));
+            if (st.mtimeMs > newestMtime) {
+                newestMtime = st.mtimeMs;
+                newest = f;
+            }
         }
+        const scan = JSON.parse(fs.readFileSync(path.join(scanResultsPath, newest), 'utf-8'));
+        const rawFindings = scan.summary?.total ?? scan.totalFindings ?? scan.findings?.length ?? 0;
+        const findings = Math.max(0, Number.isFinite(rawFindings) ? rawFindings : 0);
+        return {
+            status: findings > 0 ? 'ISSUES' : 'CLEAN',
+            findings,
+            scannedAt: typeof scan.timestamp === 'string' ? scan.timestamp : undefined,
+            cvesFixed: 0,
+            totalCves: 0,
+        };
     }
-    const auditPath = path.join(cwd, '.swarm', 'security');
-    if (fs.existsSync(auditPath)) {
-        try {
-            const audits = fs.readdirSync(auditPath).filter((f) => f.includes('audit'));
-            cvesFixed = Math.min(totalCves, Math.max(cvesFixed, audits.length));
-        }
-        catch {
-            // Ignore
-        }
+    catch {
+        return empty;
     }
-    const status = cvesFixed >= totalCves ? 'CLEAN' : cvesFixed > 0 ? 'IN_PROGRESS' : 'PENDING';
-    return { status, cvesFixed, totalCves };
 }
 export function getSwarmStatus() {
     let activeAgents = 0;

package/v3/@claude-flow/cli/dist/src/init/executor.js

@@ -619,7 +619,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 initialized: new Date().toISOString(),
                 status: 'PENDING',
                 cvesFixed: 0,
-                totalCves: 3,
+                totalCves: 0,
                 lastScan: null,
                 _note: 'Run: npx @claude-flow/cli@latest security scan'
             };
@@ -1541,7 +1541,7 @@ async function writeInitialMetrics(targetDir, options, result) {
             initialized: new Date().toISOString(),
             status: 'PENDING',
             cvesFixed: 0,
-            totalCves: 3,
+            totalCves: 0,
             lastScan: null,
             _note: 'Run: npx @claude-flow/cli@latest security scan'
         };

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -2010,8 +2010,9 @@ export const hooksSessionEnd = {
         }
         // Phase 5: Wire ReflexionMemory session end + NightlyLearner consolidation via bridge
         let sessionPersistence = null;
+        let bridge = null;
         try {
-            const bridge = await import('../memory/memory-bridge.js');
+            bridge = await import('../memory/memory-bridge.js');
             const result = await bridge.bridgeSessionEnd({
                 sessionId,
                 summary: saveState ? 'Session ended with state saved' : 'Session ended',
@@ -2028,6 +2029,17 @@ export const hooksSessionEnd = {
         catch {
             // Bridge not available
         }
+        finally {
+            // Release AgentDB/ONNX resources after one-shot session persistence.
+            // A partially initialized native pool can otherwise keep Node alive
+            // after the command has completed all logical work (#2691).
+            try {
+                await bridge?.shutdownBridge();
+            }
+            catch {
+                // Cleanup is best-effort and must not fail session-end.
+            }
+        }
         return {
             sessionId,
             duration: 3600000, // 1 hour in ms

package/v3/@claude-flow/cli/dist/src/security/builtin-aidefence.d.ts

@@ -0,0 +1,34 @@
+export interface BuiltinThreat {
+    type: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    description: string;
+    confidence: number;
+}
+export interface DefenceResult {
+    safe: boolean;
+    threats: BuiltinThreat[];
+    piiFound: boolean;
+    detectionTimeMs: number;
+    inputHash: string;
+}
+export interface DefenceEngine {
+    detect(input: string): Promise<DefenceResult>;
+    quickScan(input: string): {
+        threat: boolean;
+        confidence: number;
+        type?: string;
+    };
+    getStats(): Promise<{
+        detectionCount: number;
+        avgDetectionTimeMs: number;
+        learnedPatterns: number;
+        mitigationStrategies: number;
+        avgMitigationEffectiveness: number;
+    }>;
+    getBestMitigation(type: string): Promise<{
+        strategy: string;
+        effectiveness: number;
+    } | null>;
+}
+export declare function createBuiltinAIDefence(): DefenceEngine;
+//# sourceMappingURL=builtin-aidefence.d.ts.map

package/v3/@claude-flow/cli/dist/src/security/builtin-aidefence.js

@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto';
+const THREAT_PATTERNS = [
+    {
+        type: 'prompt-injection',
+        severity: 'high',
+        confidence: 0.96,
+        description: 'Attempts to override or discard trusted instructions',
+        pattern: /\b(?:ignore|disregard|forget|override)\b[\s\S]{0,40}\b(?:previous|prior|system|developer|trusted)\b[\s\S]{0,24}\b(?:instructions?|prompts?|rules?|messages?)\b/i,
+    },
+    {
+        type: 'system-prompt-extraction',
+        severity: 'high',
+        confidence: 0.94,
+        description: 'Attempts to reveal hidden system or developer instructions',
+        pattern: /\b(?:reveal|show|print|repeat|dump|expose)\b[\s\S]{0,32}\b(?:system|developer|hidden|initial)\b[\s\S]{0,20}\b(?:prompt|message|instructions?)\b/i,
+    },
+    {
+        type: 'jailbreak',
+        severity: 'high',
+        confidence: 0.91,
+        description: 'Attempts to bypass model safeguards or enter an unrestricted mode',
+        pattern: /\b(?:developer mode|DAN mode|jailbreak|bypass (?:all )?(?:safeguards|restrictions|filters)|unrestricted mode)\b/i,
+    },
+    {
+        type: 'data-exfiltration',
+        severity: 'critical',
+        confidence: 0.93,
+        description: 'Attempts to transmit secrets or credentials to an external destination',
+        pattern: /\b(?:send|upload|post|exfiltrate|transmit)\b[\s\S]{0,48}\b(?:secret|credential|password|api key|token|private key)\b/i,
+    },
+];
+const PII_PATTERNS = [
+    /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i,
+    /\b\d{3}-\d{2}-\d{4}\b/,
+    /\b(?:sk-|ghp_|xox[baprs]-)[A-Za-z0-9_-]{16,}\b/,
+    /\bAKIA[A-Z0-9]{16}\b/,
+];
+export function createBuiltinAIDefence() {
+    let detectionCount = 0;
+    let totalDetectionTimeMs = 0;
+    const scan = (input) => THREAT_PATTERNS
+        .filter(({ pattern }) => pattern.test(input))
+        .map(({ pattern: _pattern, ...threat }) => threat);
+    return {
+        async detect(input) {
+            const startedAt = performance.now();
+            const threats = scan(input);
+            const piiFound = PII_PATTERNS.some((pattern) => pattern.test(input));
+            const detectionTimeMs = performance.now() - startedAt;
+            detectionCount++;
+            totalDetectionTimeMs += detectionTimeMs;
+            return {
+                safe: threats.length === 0 && !piiFound,
+                threats,
+                piiFound,
+                detectionTimeMs,
+                inputHash: createHash('sha256').update(input).digest('hex'),
+            };
+        },
+        quickScan(input) {
+            const threat = scan(input)[0];
+            return threat
+                ? { threat: true, confidence: threat.confidence, type: threat.type }
+                : { threat: false, confidence: 0 };
+        },
+        async getStats() {
+            return {
+                detectionCount,
+                avgDetectionTimeMs: detectionCount === 0 ? 0 : totalDetectionTimeMs / detectionCount,
+                learnedPatterns: 0,
+                mitigationStrategies: 4,
+                avgMitigationEffectiveness: 0.9,
+            };
+        },
+        async getBestMitigation(type) {
+            const strategies = {
+                'prompt-injection': 'Keep trusted instructions immutable and reject instruction overrides',
+                'system-prompt-extraction': 'Do not disclose system or developer messages',
+                jailbreak: 'Apply the configured policy without adopting alternate personas',
+                'data-exfiltration': 'Block external transmission and rotate exposed credentials',
+            };
+            return strategies[type] ? { strategy: strategies[type], effectiveness: 0.9 } : null;
+        },
+    };
+}
+//# sourceMappingURL=builtin-aidefence.js.map

package/v3/@claude-flow/cli/dist/src/services/fable-harness.d.ts

@@ -90,6 +90,7 @@ export interface ReflectResult {
 export interface CoPilotSnapshot {
     security?: {
         status: string;
+        findings?: number;
         cvesFixed: number;
         totalCves: number;
     };

package/v3/@claude-flow/cli/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.0",
+  "version": "3.32.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
   "sideEffects": false,
   "bin": {
-    "cli": "./bin/cli.js",
-    "claude-flow": "./bin/cli.js",
-    "claude-flow-mcp": "./bin/mcp-server.js"
+    "cli": "bin/cli.js",
+    "claude-flow": "bin/cli.js",
+    "claude-flow-mcp": "bin/mcp-server.js"
   },
   "homepage": "https://github.com/ruvnet/claude-flow#readme",
   "bugs": {
@@ -17,7 +17,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/ruvnet/claude-flow.git",
+    "url": "git+https://github.com/ruvnet/claude-flow.git",
     "directory": "v3/@claude-flow/cli"
   },
   "keywords": [
@@ -90,8 +90,9 @@
     "test:plugin-store": "npx tsx src/plugins/tests/standalone-test.ts",
     "test:pattern-store": "npx tsx src/transfer/store/tests/standalone-test.ts",
     "postinstall": "node ./scripts/postinstall.cjs",
-    "prepublishOnly": "cp ../../../README.md ./README.md && rm -rf plugins && mkdir -p plugins && cp -r ../../../plugins/ruflo-metaharness plugins/ && node scripts/generate-catalog-manifest.mjs && node scripts/sign-helpers.mjs && node scripts/verify-helpers.mjs",
-    "release": "npm version prerelease --preid=alpha && npm run publish:all",
+    "prepublishOnly": "node scripts/prepare-publish.mjs",
+    "release": "npm publish --access public --tag latest",
+    "release:alpha": "npm version prerelease --preid=alpha && npm run publish:all",
     "publish:all": "./scripts/publish.sh"
   },
   "devDependencies": {
@@ -110,7 +111,7 @@
     "yaml": "^2.8.0"
   },
   "optionalDependencies": {
-    "@claude-flow/memory": "^3.0.0-alpha.21",
+    "@claude-flow/memory": "^3.0.0-alpha.21",
     "@claude-flow/security": "^3.0.0-alpha.10",
     "agentdb": "^3.0.0-alpha.17",
     "agentic-flow": "^3.0.0-alpha.1",

package/.claude/helpers/.helpers-version

@@ -1 +0,0 @@
-3.29.0

package/.claude/helpers/helpers.manifest.json

@@ -1,13 +0,0 @@
-{
-  "manifest": {
-    "version": "3.29.0",
-    "files": {
-      "auto-memory-hook.mjs": "e3e1033b24704992ddef6b31c7fa9dd7fcd9e1af7935dd77ef73402b916b31e6",
-      "hook-handler.cjs": "f51fb035d8a4110fdf763cee2913e285bcdbbaa618cbee980e032f89ffaf89d2",
-      "intelligence.cjs": "5a55d979cb7ba5c8c4f27f3b2e6d686fbb1045d180023b803da672a37e05b915",
-      "statusline.cjs": "8416172e504b03f9ec2266a47bba048578c3b1e30c5c7c97a0a8261460cd601d"
-    }
-  },
-  "signature": "F0YZmNYCOnPOkf/kqbUoXtZ/jfYsX+Mn3QTGvtR6dafHx+oZ4uoobOKu/GYls+z+vHN2beL9c9GK53YKB1txBA==",
-  "algorithm": "ed25519"
-}

package/.claude/helpers/hidden-hook.vbs

@@ -1,43 +0,0 @@
-' hidden-hook.vbs — Windowless launcher for Claude Code hooks on Windows.
-'
-' Workaround for anthropics/claude-code#14828 / #70200 — Claude Code's
-' child_process.spawn for hook commands is missing windowsHide/CREATE_NO_WINDOW,
-' so every hook fire flashes a visible cmd.exe window. This shim is invoked via
-' wscript.exe (a GUI-subsystem host with no console), so Claude Code's outer
-' spawn attaches no console. Internally it runs node hidden via
-' WScript.Shell.Run(cmd, 0, True).
-'
-' Usage from settings.local.json:
-'   "command": "wscript.exe \"${CLAUDE_PROJECT_DIR}\\.claude\\helpers\\hidden-hook.vbs\" hook-handler.cjs pre-bash"
-'
-' TRADE-OFF: wscript.exe has no stdin. Claude Code sends hook event data as
-' JSON via stdin, so hooks routed through this shim run WITHOUT their event
-' payload. Most ruflo hooks (env-var driven) still work; hooks like `route`
-' that need the user's prompt will have reduced context.
-'
-' Exit code from the wrapped node process is propagated back to Claude Code.
-
-Option Explicit
-
-If WScript.Arguments.Count < 1 Then
-    WScript.Quit 2
-End If
-
-Dim shell, cmd, i, arg
-Set shell = CreateObject("WScript.Shell")
-
-' Resolve helpers dir from this script's own path (avoids env-var dependency)
-Dim scriptDir
-scriptDir = Left(WScript.ScriptFullName, InStrRev(WScript.ScriptFullName, "\"))
-
-' First arg is the hook-handler script name (e.g. "hook-handler.cjs"),
-' remaining args are passed through to node.
-cmd = "node """ & scriptDir & WScript.Arguments(0) & """"
-For i = 1 To WScript.Arguments.Count - 1
-    arg = WScript.Arguments(i)
-    arg = Replace(arg, """", "\""")
-    cmd = cmd & " """ & arg & """"
-Next
-
-' 0 = SW_HIDE, True = wait for completion (propagates exit code synchronously)
-WScript.Quit shell.Run(cmd, 0, True)