claude-flow 3.32.1 → 3.32.2

package/.claude/.proven-config-version

@@ -0,0 +1 @@
+sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319

package/.claude/helpers/statusline.cjs

@@ -26,8 +26,11 @@ const { execSync } = require('child_process');
 const os = require('os');
 
 // Configuration
-const CONFIG = {
-  maxAgents: 15,
+const CONFIG = {
+  maxAgents: 15,
+  // Header identity defaults to project/repository name. Set `author` to
+  // retain the previous `git config user.name` display (#2682).
+  identityMode: (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase(),
   // Session-cost display. Claude Code's cost.total_cost_usd is a client-side
   // estimate that "may differ from your actual bill" and reads as misleading on
   // subscription plans, where token usage is not billed per dollar. These let
@@ -210,7 +213,9 @@ function getStatuslineData() {
   // 60s TTL (#2337 — don't re-spawn the CLI on every rapid re-render) AND the
   // tighter promo-rotation clock (this fix — don't let a still-fresh 60s
   // cache silently freeze the promo/insight row across multiple 20s slots).
-  if (cache.fresh && cache.promoFresh) return overlayMemoPromo(cache.data);
+  if (cache.fresh && cache.promoFresh) {
+    return applyLocalOverlays(overlayMemoPromo(cache.data));
+  }
 
   // #2337: prefer an already-installed CLI bin via direct `node` invocation —
   // no npx, no registry round-trip, no @latest re-resolve per render. Try
@@ -417,7 +422,7 @@ function buildLocalFallback() {
   return applyLocalOverlays({
     user: { name: 'user', gitBranch: '', modelName: 'Claude Code' },
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
-    security: { status: 'NONE', cvesFixed: 0, totalCves: 0 },
+    security: { status: 'NONE', findings: 0, cvesFixed: 0, totalCves: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
     system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
     lastUpdated: new Date().toISOString(),
@@ -474,14 +479,16 @@ function readJSON(filePath) {
 
 // ─── Git info (pure-Node / single exec — needed for branch display) ──────────
 
-function getGitInfo() {
-  const result = {
-    name: 'user', gitBranch: '', modified: 0, untracked: 0,
-    staged: 0, ahead: 0, behind: 0,
-  };
-
-  const script = [
-    'git config user.name 2>/dev/null || echo user',
+function getGitInfo() {
+  const result = {
+    name: path.basename(CWD) || 'project', gitBranch: '', modified: 0, untracked: 0,
+    staged: 0, ahead: 0, behind: 0,
+  };
+
+  const script = [
+    'git rev-parse --show-toplevel 2>/dev/null || pwd',
+    'echo "---SEP---"',
+    'git config user.name 2>/dev/null || echo user',
     'echo "---SEP---"',
     'git branch --show-current 2>/dev/null',
     'echo "---SEP---"',
@@ -494,12 +501,14 @@ function getGitInfo() {
   if (!raw) return result;
 
   const parts = raw.split('---SEP---').map(function(s) { return s.trim(); });
-  if (parts.length >= 4) {
-    result.name = parts[0] || 'user';
-    result.gitBranch = parts[1] || '';
-
-    if (parts[2]) {
-      for (const line of parts[2].split('\n')) {
+  if (parts.length >= 5) {
+    const projectName = path.basename(parts[0] || CWD) || path.basename(CWD) || 'project';
+    const authorName = parts[1] || 'user';
+    result.name = CONFIG.identityMode === 'author' ? authorName : projectName;
+    result.gitBranch = parts[2] || '';
+
+    if (parts[3]) {
+      for (const line of parts[3].split('\n')) {
         if (!line || line.length < 2) continue;
         const x = line[0], y = line[1];
         if (x === '?' && y === '?') { result.untracked++; continue; }
@@ -508,7 +517,7 @@ function getGitInfo() {
       }
     }
 
-    const ab = (parts[3] || '0 0').split(/\s+/);
+    const ab = (parts[4] || '0 0').split(/\s+/);
     result.ahead = parseInt(ab[0]) || 0;
     result.behind = parseInt(ab[1]) || 0;
   }
@@ -722,8 +731,7 @@ function generateStatusline() {
   const intelligencePct = system.intelligencePct || 0;
   const memoryMB = system.memoryMB || 0;
   const subAgents = system.subAgents || 0;
-  const cvesFixed = security.cvesFixed || 0;
-  const totalCves = security.totalCves || 0;
+  const findings = Math.max(0, security.findings || 0);
   const secStatus = security.status || 'NONE';
   const adrCount = adrs.count || 0;
   const adrImpl = adrs.implemented || 0;
@@ -778,8 +786,7 @@ function generateStatusline() {
   const hooksColor = hooksEnabled > 0 ? c.brightGreen : c.dim;
   const intellColor = intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
   const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset + ' ' : c.dim + '○' + c.reset + ' ';
-  const cvesClean = totalCves === 0 || cvesFixed === totalCves;
-  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && cvesClean;
+  const healthAllGreen = (secStatus === 'CLEAN' || secStatus === 'NONE') && findings === 0;
   const opsParts = [];
   opsParts.push(c.cyan + 'Swarm ' + swarmInd + agentsColor + activeAgents + c.reset + '/' + c.brightWhite + maxAgents + c.reset);
   if (subAgents > 0) opsParts.push(c.brightPurple + '👥 ' + subAgents + c.reset);
@@ -790,14 +797,14 @@ function generateStatusline() {
   if (healthAllGreen) {
     opsParts.push(c.brightGreen + '🛡 ✓' + c.reset);
   } else {
-    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
-    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
-    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
-    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
-    if (totalCves > 0 && cvesFixed < totalCves) {
-      const unfixed = totalCves - cvesFixed;
-      opsParts.push(c.brightRed + '⚠ ' + unfixed + ' CVE' + (unfixed === 1 ? '' : 's') + c.reset);
-    }
+    if (secStatus === 'PENDING') opsParts.push(c.brightYellow + '🛡 scan pending' + c.reset);
+    else if (secStatus === 'IN_PROGRESS') opsParts.push(c.brightYellow + '🛡 scanning…' + c.reset);
+    else if (secStatus === 'ISSUES') opsParts.push(c.brightRed + '🛡 findings' + c.reset);
+    else if (secStatus === 'STALE') opsParts.push(c.brightYellow + '🛡 scan stale' + c.reset);
+    else if (secStatus !== 'NONE' && secStatus !== 'CLEAN') opsParts.push(c.brightRed + '🛡 ' + secStatus.toLowerCase() + c.reset);
+    if (findings > 0) {
+      opsParts.push(c.brightRed + '⚠ ' + findings + ' finding' + (findings === 1 ? '' : 's') + c.reset);
+    }
   }
   lines.push(opsParts.join('  ' + c.dim + '·' + c.reset + '  '));
 

package/.claude/proven-config.json

@@ -0,0 +1,42 @@
+{
+  "adoptedAt": 1784256882562,
+  "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
+  "manifest": {
+    "schema": "ruflo.proven-config/v1",
+    "policy": {
+      "ref": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
+      "value": {
+        "alpha": 0.3,
+        "subjectWeight": 1,
+        "mmrLambda": 0.5,
+        "bodyWeight": 1.5,
+        "typePenaltyFactor": 0.5
+      }
+    },
+    "layer": "framework/node-cli",
+    "compatibility": {
+      "ruflo": ">=3.24.0"
+    },
+    "benchmark": {
+      "corpus": "ADR-081-labelled-v1",
+      "corpusHash": "sha256:2f700b5c363e20a3bd88ce2bc9b87bbbbaa61732c6177894c6ec37890f888982"
+    },
+    "receipt": {
+      "heldOutDelta": 0.07381404928570845,
+      "redblue": "PASS",
+      "drift": 0,
+      "canary": {
+        "rollbackRate": 0,
+        "latencyP95": 244.612458000076,
+        "costPerTask": 0
+      },
+      "receiptCoverage": 1
+    },
+    "platform": [
+      "linux",
+      "macOS",
+      "windows"
+    ]
+  },
+  "previous": ""
+}

package/.claude-plugin/scripts/ruflo-hook.cjs

@@ -14,7 +14,7 @@
  * Behaviour mirrors ruflo-hook.sh:
  *   1. Reads hook JSON payload from stdin.
  *   2. Prefers a locally installed `ruflo` or `claude-flow` binary.
- *   3. Falls back to `npx --prefer-offline ruflo@alpha`.
+ *   3. Falls back to `npx --prefer-offline ruflo@latest`.
  *   4. Always exits 0 — hook subcommands are best-effort telemetry.
  *   5. Swallows all stderr — nothing should surface to Claude Code.
  *
@@ -157,7 +157,7 @@ function main() {
   // a spurious failure even though the shim itself works correctly.
   // The bash version doesn't hit this because it backgrounded the work.
   if (process.env.RUFLO_HOOK_SKIP_NPX !== '1') {
-    invokeHook('npx', ['--prefer-offline', '--yes', 'ruflo@alpha'], hookArgs, stdinData);
+    invokeHook('npx', ['--prefer-offline', '--yes', 'ruflo@latest'], hookArgs, stdinData);
   }
 
   done();

package/.claude-plugin/scripts/ruflo-hook.sh

@@ -24,14 +24,29 @@
 # so redirecting it is a pure cleanup with no functional cost.
 exec 1>/dev/null 2>/dev/null
 
-run() { "$@" || true; }
+# Bound every hook process. A partially initialized native embedding pool can
+# otherwise keep a logically completed Stop hook alive indefinitely (#2691).
+run() {
+  "$@" &
+  child=$!
+  (
+    sleep 15
+    kill -TERM "$child" 2>/dev/null || true
+    sleep 1
+    kill -KILL "$child" 2>/dev/null || true
+  ) &
+  watchdog=$!
+  wait "$child" 2>/dev/null || true
+  kill "$watchdog" 2>/dev/null || true
+  wait "$watchdog" 2>/dev/null || true
+}
 
 if command -v ruflo >/dev/null 2>&1; then
   run ruflo hooks "$@"
 elif command -v claude-flow >/dev/null 2>&1; then
   run claude-flow hooks "$@"
 else
-  run npx --prefer-offline --yes ruflo@alpha hooks "$@"
+  run npx --prefer-offline --yes ruflo@latest hooks "$@"
 fi
 
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.32.1",
+  "version": "3.32.2",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 1,
-  "generatedAt": "2026-07-16T23:50:36.870Z",
-  "gitSha": "81447ce7",
+  "generatedAt": "2026-07-17T04:00:15.717Z",
+  "gitSha": "61047df4",
   "catalog": {
     "agents": 164,
     "tools": 387,

package/v3/@claude-flow/cli/dist/src/commands/hooks.js

@@ -3487,18 +3487,26 @@ const statuslineCommand = {
         }
         // Get user info
         function getUserInfo() {
-            let name = 'user';
+            const identityMode = (process.env.RUFLO_STATUSLINE_IDENTITY || 'project').toLowerCase();
+            let name = path.basename(process.cwd()) || 'project';
             let gitBranch = '';
             const modelName = 'Opus 4.6 (1M context)';
             const isWindows = process.platform === 'win32';
             try {
-                const nameCmd = isWindows
-                    ? 'git config user.name 2>NUL || echo user'
-                    : 'git config user.name 2>/dev/null || echo "user"';
+                const rootCmd = isWindows
+                    ? 'git rev-parse --show-toplevel 2>NUL'
+                    : 'git rev-parse --show-toplevel 2>/dev/null';
                 const branchCmd = isWindows
                     ? 'git branch --show-current 2>NUL || echo.'
                     : 'git branch --show-current 2>/dev/null || echo ""';
-                name = execSync(nameCmd, { encoding: 'utf-8' }).trim();
+                const root = execSync(rootCmd, { encoding: 'utf-8' }).trim();
+                name = path.basename(root) || name;
+                if (identityMode === 'author') {
+                    const authorCmd = isWindows
+                        ? 'git config user.name 2>NUL || echo user'
+                        : 'git config user.name 2>/dev/null || echo "user"';
+                    name = execSync(authorCmd, { encoding: 'utf-8' }).trim() || 'user';
+                }
                 gitBranch = execSync(branchCmd, { encoding: 'utf-8' }).trim();
                 if (gitBranch === '.')
                     gitBranch = '';
@@ -3555,7 +3563,10 @@ const statuslineCommand = {
         const terminalCols = process.stdout.columns ?? 80;
         const autoCompact = !ctx.flags.full && terminalCols < COMPACT_WIDTH_THRESHOLD;
         if (ctx.flags.compact || autoCompact) {
-            const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} CVE:${security.cvesFixed}/${security.totalCves} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${system.contextPct}% Int:${system.intelligencePct}%`;
+            const securityCompact = security.findings > 0
+                ? `Findings:${security.findings}`
+                : `Security:${security.status}`;
+            const line = `DDD:${progress.domainsCompleted}/${progress.totalDomains} ${securityCompact} Swarm:${swarm.activeAgents}/${swarm.maxAgents} Ctx:${system.contextPct}% Int:${system.intelligencePct}%`;
             output.writeln(line);
             return { success: true, data: statusData };
         }
@@ -3729,13 +3740,13 @@ const statuslineCommand = {
             perfIndicator;
         const swarmIndicator = swarm.coordinationActive ? `${c.brightGreen}◉${c.reset}` : `${c.dim}○${c.reset}`;
         const agentsColor = swarm.activeAgents > 0 ? c.brightGreen : c.red;
-        const securityIcon = security.status === 'CLEAN' ? '🟢' : security.status === 'IN_PROGRESS' ? '🟡' : '🔴';
-        const securityColor = security.status === 'CLEAN' ? c.brightGreen : security.status === 'IN_PROGRESS' ? c.brightYellow : c.brightRed;
+        const securityIcon = security.status === 'CLEAN' ? '🟢' : security.status === 'PENDING' ? '🟡' : '🔴';
+        const securityColor = security.status === 'CLEAN' ? c.brightGreen : security.status === 'PENDING' ? c.brightYellow : c.brightRed;
         const hooksColor = hooksStats.enabled > 0 ? c.brightGreen : c.dim;
         const line2 = `${c.brightYellow}🤖 Swarm${c.reset}  ${swarmIndicator} [${agentsColor}${String(swarm.activeAgents).padStart(2)}${c.reset}/${c.brightWhite}${swarm.maxAgents}${c.reset}]  ` +
             `${c.brightPurple}👥 ${system.subAgents}${c.reset}    ` +
             `${c.brightBlue}🪝 ${hooksColor}${hooksStats.enabled}${c.reset}/${c.brightWhite}${hooksStats.total}${c.reset}    ` +
-            `${securityIcon} ${securityColor}CVE ${security.cvesFixed}${c.reset}/${c.brightWhite}${security.totalCves}${c.reset}    ` +
+            `${securityIcon} ${securityColor}${security.findings > 0 ? `Findings ${security.findings}` : `Security ${security.status}`}${c.reset}    ` +
             `${c.brightCyan}💾 ${system.memoryMB}MB${c.reset}    ` +
             `${c.brightPurple}🧠 ${String(system.intelligencePct).padStart(3)}%${c.reset}`;
         const dddColor = progress.dddProgress >= 50 ? c.brightGreen : progress.dddProgress > 0 ? c.yellow : c.red;

package/v3/@claude-flow/cli/dist/src/commands/security.js

@@ -6,6 +6,7 @@
  */
 import { output } from '../output.js';
 import { execSync } from 'node:child_process';
+import { createBuiltinAIDefence } from '../security/builtin-aidefence.js';
 // Scan subcommand
 const scanCommand = {
     name: 'scan',
@@ -861,16 +862,17 @@ const defendCommand = {
         output.writeln(output.bold('🛡️ AIDefence - AI Manipulation Defense System'));
         output.writeln(output.dim('─'.repeat(55)));
         // Dynamic import of aidefence (allows package to be optional)
-        let createAIDefence;
+        let defender;
         try {
             const aidefence = await import('@claude-flow/aidefence');
-            createAIDefence = aidefence.createAIDefence;
+            defender = aidefence.createAIDefence({ enableLearning });
         }
         catch {
-            output.error('AIDefence package not installed. Run: npm install @claude-flow/aidefence');
-            return { success: false, message: 'AIDefence not available' };
+            // Keep cold npx startup lean (#2561): the full learning engine remains
+            // user-installable, while the CLI always ships a deterministic scanner.
+            defender = createBuiltinAIDefence();
+            output.writeln(output.dim('Using built-in defense engine (install @claude-flow/aidefence for adaptive learning)'));
         }
-        const defender = createAIDefence({ enableLearning });
         // Show stats mode
         if (showStats) {
             const stats = await defender.getStats();
@@ -893,8 +895,8 @@ const defendCommand = {
                 output.writeln(output.dim(`Reading file: ${filePath}`));
             }
             catch (err) {
-                output.error(`Failed to read file: ${filePath}`);
-                return { success: false, message: 'File not found' };
+                output.printError(`Failed to read file: ${filePath}`);
+                return { success: false, exitCode: 2, message: 'File not found' };
             }
         }
         if (!textToScan) {
@@ -914,8 +916,9 @@ const defendCommand = {
         spinner.start();
         // Perform scan
         const startTime = performance.now();
-        const result = quickMode
-            ? { ...defender.quickScan(textToScan), threats: [], piiFound: false, detectionTimeMs: 0, inputHash: '', safe: !defender.quickScan(textToScan).threat }
+        const quickResult = quickMode ? defender.quickScan(textToScan) : undefined;
+        const result = quickResult
+            ? { ...quickResult, threats: [], piiFound: false, detectionTimeMs: 0, inputHash: '', safe: !quickResult.threat }
             : await defender.detect(textToScan);
         const scanTime = performance.now() - startTime;
         spinner.stop();
@@ -927,7 +930,8 @@ const defendCommand = {
                 piiFound: result.piiFound,
                 detectionTimeMs: scanTime,
             }, null, 2));
-            return { success: true };
+            const safe = result.safe && !result.piiFound;
+            return { success: safe, exitCode: safe ? 0 : 1 };
         }
         // Text output
         output.writeln();
@@ -969,7 +973,8 @@ const defendCommand = {
             }
         }
         output.writeln(output.dim(`Detection time: ${scanTime.toFixed(3)}ms`));
-        return { success: result.safe };
+        const safe = result.safe && !result.piiFound;
+        return { success: safe, exitCode: safe ? 0 : 1 };
     },
 };
 // Main security command

package/v3/@claude-flow/cli/dist/src/funnel/insights.d.ts

@@ -30,6 +30,7 @@ export interface LocalInsight {
 export interface LocalInsightContext {
     security?: {
         status: string;
+        findings?: number;
         cvesFixed: number;
         totalCves: number;
     };

package/v3/@claude-flow/cli/dist/src/funnel/insights.js

@@ -42,11 +42,11 @@ function securityInsight(ctx) {
     const s = ctx.security;
     if (!s)
         return null;
-    const pending = s.totalCves - s.cvesFixed;
-    if (pending > 0) {
+    const findings = Math.max(0, s.findings ?? 0);
+    if (s.status === 'ISSUES' || findings > 0) {
         return {
-            id: 'insight-cves-pending',
-            text: `⚠ ${pending} CVE${pending === 1 ? '' : 's'} pending — Run ruflo security scan --depth full`,
+            id: 'insight-security-findings',
+            text: `⚠ ${findings} security finding${findings === 1 ? '' : 's'} — Review the latest ruflo security scan`,
             priority: 90,
         };
     }

package/v3/@claude-flow/cli/dist/src/funnel/local-signals.d.ts

@@ -1,6 +1,11 @@
 export interface SecurityStatus {
-    status: 'CLEAN' | 'IN_PROGRESS' | 'PENDING';
+    status: 'CLEAN' | 'ISSUES' | 'PENDING';
+    /** Generic code-pattern findings from `ruflo security scan` (not CVEs). */
+    findings: number;
+    scannedAt?: string;
+    /** @deprecated Retained as a zero-valued compatibility field. */
     cvesFixed: number;
+    /** @deprecated Retained as a zero-valued compatibility field. */
     totalCves: number;
 }
 export declare function getSecurityStatus(cwd?: string): SecurityStatus;

package/v3/@claude-flow/cli/dist/src/funnel/local-signals.js

@@ -11,30 +11,39 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 export function getSecurityStatus(cwd = process.cwd()) {
+    const empty = {
+        status: 'PENDING', findings: 0, cvesFixed: 0, totalCves: 0,
+    };
     const scanResultsPath = path.join(cwd, '.claude', 'security-scans');
-    let cvesFixed = 0;
-    const totalCves = 3;
-    if (fs.existsSync(scanResultsPath)) {
-        try {
-            const scans = fs.readdirSync(scanResultsPath).filter((f) => f.endsWith('.json'));
-            cvesFixed = Math.min(totalCves, scans.length);
-        }
-        catch {
-            // Ignore
+    if (!fs.existsSync(scanResultsPath))
+        return empty;
+    try {
+        const files = fs.readdirSync(scanResultsPath).filter((f) => f.endsWith('.json'));
+        if (files.length === 0)
+            return empty;
+        let newest = files[0];
+        let newestMtime = -1;
+        for (const f of files) {
+            const st = fs.statSync(path.join(scanResultsPath, f));
+            if (st.mtimeMs > newestMtime) {
+                newestMtime = st.mtimeMs;
+                newest = f;
+            }
         }
+        const scan = JSON.parse(fs.readFileSync(path.join(scanResultsPath, newest), 'utf-8'));
+        const rawFindings = scan.summary?.total ?? scan.totalFindings ?? scan.findings?.length ?? 0;
+        const findings = Math.max(0, Number.isFinite(rawFindings) ? rawFindings : 0);
+        return {
+            status: findings > 0 ? 'ISSUES' : 'CLEAN',
+            findings,
+            scannedAt: typeof scan.timestamp === 'string' ? scan.timestamp : undefined,
+            cvesFixed: 0,
+            totalCves: 0,
+        };
     }
-    const auditPath = path.join(cwd, '.swarm', 'security');
-    if (fs.existsSync(auditPath)) {
-        try {
-            const audits = fs.readdirSync(auditPath).filter((f) => f.includes('audit'));
-            cvesFixed = Math.min(totalCves, Math.max(cvesFixed, audits.length));
-        }
-        catch {
-            // Ignore
-        }
+    catch {
+        return empty;
     }
-    const status = cvesFixed >= totalCves ? 'CLEAN' : cvesFixed > 0 ? 'IN_PROGRESS' : 'PENDING';
-    return { status, cvesFixed, totalCves };
 }
 export function getSwarmStatus() {
     let activeAgents = 0;

package/v3/@claude-flow/cli/dist/src/init/executor.js

@@ -619,7 +619,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 initialized: new Date().toISOString(),
                 status: 'PENDING',
                 cvesFixed: 0,
-                totalCves: 3,
+                totalCves: 0,
                 lastScan: null,
                 _note: 'Run: npx @claude-flow/cli@latest security scan'
             };
@@ -1541,7 +1541,7 @@ async function writeInitialMetrics(targetDir, options, result) {
             initialized: new Date().toISOString(),
             status: 'PENDING',
             cvesFixed: 0,
-            totalCves: 3,
+            totalCves: 0,
             lastScan: null,
             _note: 'Run: npx @claude-flow/cli@latest security scan'
         };

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -2010,8 +2010,9 @@ export const hooksSessionEnd = {
         }
         // Phase 5: Wire ReflexionMemory session end + NightlyLearner consolidation via bridge
         let sessionPersistence = null;
+        let bridge = null;
         try {
-            const bridge = await import('../memory/memory-bridge.js');
+            bridge = await import('../memory/memory-bridge.js');
             const result = await bridge.bridgeSessionEnd({
                 sessionId,
                 summary: saveState ? 'Session ended with state saved' : 'Session ended',
@@ -2028,6 +2029,17 @@ export const hooksSessionEnd = {
         catch {
             // Bridge not available
         }
+        finally {
+            // Release AgentDB/ONNX resources after one-shot session persistence.
+            // A partially initialized native pool can otherwise keep Node alive
+            // after the command has completed all logical work (#2691).
+            try {
+                await bridge?.shutdownBridge();
+            }
+            catch {
+                // Cleanup is best-effort and must not fail session-end.
+            }
+        }
         return {
             sessionId,
             duration: 3600000, // 1 hour in ms

package/v3/@claude-flow/cli/dist/src/security/builtin-aidefence.d.ts

@@ -0,0 +1,34 @@
+export interface BuiltinThreat {
+    type: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    description: string;
+    confidence: number;
+}
+export interface DefenceResult {
+    safe: boolean;
+    threats: BuiltinThreat[];
+    piiFound: boolean;
+    detectionTimeMs: number;
+    inputHash: string;
+}
+export interface DefenceEngine {
+    detect(input: string): Promise<DefenceResult>;
+    quickScan(input: string): {
+        threat: boolean;
+        confidence: number;
+        type?: string;
+    };
+    getStats(): Promise<{
+        detectionCount: number;
+        avgDetectionTimeMs: number;
+        learnedPatterns: number;
+        mitigationStrategies: number;
+        avgMitigationEffectiveness: number;
+    }>;
+    getBestMitigation(type: string): Promise<{
+        strategy: string;
+        effectiveness: number;
+    } | null>;
+}
+export declare function createBuiltinAIDefence(): DefenceEngine;
+//# sourceMappingURL=builtin-aidefence.d.ts.map

package/v3/@claude-flow/cli/dist/src/security/builtin-aidefence.js

@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto';
+const THREAT_PATTERNS = [
+    {
+        type: 'prompt-injection',
+        severity: 'high',
+        confidence: 0.96,
+        description: 'Attempts to override or discard trusted instructions',
+        pattern: /\b(?:ignore|disregard|forget|override)\b[\s\S]{0,40}\b(?:previous|prior|system|developer|trusted)\b[\s\S]{0,24}\b(?:instructions?|prompts?|rules?|messages?)\b/i,
+    },
+    {
+        type: 'system-prompt-extraction',
+        severity: 'high',
+        confidence: 0.94,
+        description: 'Attempts to reveal hidden system or developer instructions',
+        pattern: /\b(?:reveal|show|print|repeat|dump|expose)\b[\s\S]{0,32}\b(?:system|developer|hidden|initial)\b[\s\S]{0,20}\b(?:prompt|message|instructions?)\b/i,
+    },
+    {
+        type: 'jailbreak',
+        severity: 'high',
+        confidence: 0.91,
+        description: 'Attempts to bypass model safeguards or enter an unrestricted mode',
+        pattern: /\b(?:developer mode|DAN mode|jailbreak|bypass (?:all )?(?:safeguards|restrictions|filters)|unrestricted mode)\b/i,
+    },
+    {
+        type: 'data-exfiltration',
+        severity: 'critical',
+        confidence: 0.93,
+        description: 'Attempts to transmit secrets or credentials to an external destination',
+        pattern: /\b(?:send|upload|post|exfiltrate|transmit)\b[\s\S]{0,48}\b(?:secret|credential|password|api key|token|private key)\b/i,
+    },
+];
+const PII_PATTERNS = [
+    /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i,
+    /\b\d{3}-\d{2}-\d{4}\b/,
+    /\b(?:sk-|ghp_|xox[baprs]-)[A-Za-z0-9_-]{16,}\b/,
+    /\bAKIA[A-Z0-9]{16}\b/,
+];
+export function createBuiltinAIDefence() {
+    let detectionCount = 0;
+    let totalDetectionTimeMs = 0;
+    const scan = (input) => THREAT_PATTERNS
+        .filter(({ pattern }) => pattern.test(input))
+        .map(({ pattern: _pattern, ...threat }) => threat);
+    return {
+        async detect(input) {
+            const startedAt = performance.now();
+            const threats = scan(input);
+            const piiFound = PII_PATTERNS.some((pattern) => pattern.test(input));
+            const detectionTimeMs = performance.now() - startedAt;
+            detectionCount++;
+            totalDetectionTimeMs += detectionTimeMs;
+            return {
+                safe: threats.length === 0 && !piiFound,
+                threats,
+                piiFound,
+                detectionTimeMs,
+                inputHash: createHash('sha256').update(input).digest('hex'),
+            };
+        },
+        quickScan(input) {
+            const threat = scan(input)[0];
+            return threat
+                ? { threat: true, confidence: threat.confidence, type: threat.type }
+                : { threat: false, confidence: 0 };
+        },
+        async getStats() {
+            return {
+                detectionCount,
+                avgDetectionTimeMs: detectionCount === 0 ? 0 : totalDetectionTimeMs / detectionCount,
+                learnedPatterns: 0,
+                mitigationStrategies: 4,
+                avgMitigationEffectiveness: 0.9,
+            };
+        },
+        async getBestMitigation(type) {
+            const strategies = {
+                'prompt-injection': 'Keep trusted instructions immutable and reject instruction overrides',
+                'system-prompt-extraction': 'Do not disclose system or developer messages',
+                jailbreak: 'Apply the configured policy without adopting alternate personas',
+                'data-exfiltration': 'Block external transmission and rotate exposed credentials',
+            };
+            return strategies[type] ? { strategy: strategies[type], effectiveness: 0.9 } : null;
+        },
+    };
+}
+//# sourceMappingURL=builtin-aidefence.js.map

package/v3/@claude-flow/cli/dist/src/services/fable-harness.d.ts

@@ -90,6 +90,7 @@ export interface ReflectResult {
 export interface CoPilotSnapshot {
     security?: {
         status: string;
+        findings?: number;
         cvesFixed: number;
         totalCves: number;
     };

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.1",
+  "version": "3.32.2",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -111,7 +111,7 @@
     "yaml": "^2.8.0"
   },
   "optionalDependencies": {
-    "@claude-flow/memory": "^3.0.0-alpha.21",
+    "@claude-flow/memory": "^3.0.0-alpha.21",
     "@claude-flow/security": "^3.0.0-alpha.10",
     "agentdb": "^3.0.0-alpha.17",
     "agentic-flow": "^3.0.0-alpha.1",