claude-flow 3.32.2 → 3.32.9

package/v3/@claude-flow/cli/dist/src/commands/proxy-lifecycle.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `ruflo proxy install|start|stop|status|logs|update|uninstall` (ADR-307) —
+ * the full lifecycle command set, kept in its own file so
+ * src/commands/proxy.ts (the ADR-313/314/315 consent subcommands) stays
+ * under the repo's 500-line-per-file convention. Merged into one
+ * `proxyCommand` in proxy.ts.
+ */
+import type { Command } from '../types.js';
+import { type ProxyStatus } from '../proxy/lifecycle.js';
+/** Pinned and reviewed; later upgrades remain explicit commands. */
+export declare const DEFAULT_PROXY_RELEASE = "0.4.0";
+/**
+ * Human-oriented next steps for `ruflo proxy` and `ruflo proxy status`.
+ * Keep this independent of the command framework so the state-specific
+ * guidance has a small, direct regression-test surface.
+ */
+export declare function proxyConsoleGuidance(status: ProxyStatus): string[];
+export declare function printProxyConsoleGuidance(status: ProxyStatus): void;
+export declare const proxyLifecycleSubcommands: Command[];
+//# sourceMappingURL=proxy-lifecycle.d.ts.map

package/v3/@claude-flow/cli/dist/src/commands/proxy-lifecycle.js

@@ -0,0 +1,277 @@
+/**
+ * `ruflo proxy install|start|stop|status|logs|update|uninstall` (ADR-307) —
+ * the full lifecycle command set, kept in its own file so
+ * src/commands/proxy.ts (the ADR-313/314/315 consent subcommands) stays
+ * under the repo's 500-line-per-file convention. Merged into one
+ * `proxyCommand` in proxy.ts.
+ */
+import { output } from '../output.js';
+import { hasConsent, recordConsent, revokeConsent } from '../funnel/index.js';
+import { installProxy, uninstallProxy } from '../proxy/install.js';
+import { startForeground, startBackground, stopProxy, getProxyStatus, readProxyLogTail, watchProxyLog, ProxyNotInstalledError, ProxyAlreadyRunningError, } from '../proxy/lifecycle.js';
+import { proxyTokenPath } from '../proxy/paths.js';
+import { removeInjectedToken, startTokenRefreshPump } from '../proxy/token-bridge.js';
+/** Pinned and reviewed; later upgrades remain explicit commands. */
+export const DEFAULT_PROXY_RELEASE = '0.4.0';
+const PROXY_COMMAND = 'npx ruflo@latest proxy';
+const AUTH_COMMAND = 'npx ruflo@latest auth';
+/**
+ * Human-oriented next steps for `ruflo proxy` and `ruflo proxy status`.
+ * Keep this independent of the command framework so the state-specific
+ * guidance has a small, direct regression-test surface.
+ */
+export function proxyConsoleGuidance(status) {
+    if (!status.installed) {
+        return [
+            '',
+            'Next step',
+            `  ${PROXY_COMMAND} install --yes    Install signed Meta-Proxy v${DEFAULT_PROXY_RELEASE}`,
+            '',
+            'After installation, start it in the background:',
+            `  ${PROXY_COMMAND} start --service`,
+        ];
+    }
+    if (!status.running) {
+        return [
+            '',
+            'Next step',
+            `  ${PROXY_COMMAND} start --service    Start the proxy in the background`,
+            '',
+            'Foreground mode (shows live logs; Ctrl+C stops it):',
+            `  ${PROXY_COMMAND} start`,
+            '',
+            'Optional: enable Cognitum cloud routing (local-only is the default):',
+            `  ${AUTH_COMMAND} login`,
+            `  ${PROXY_COMMAND} config --cloud --yes`,
+        ];
+    }
+    return [
+        '',
+        'Meta Proxy is ready.',
+        `  Logs:    ${PROXY_COMMAND} logs`,
+        `  Stop:    ${PROXY_COMMAND} stop`,
+        '',
+        'Optional: enable Cognitum cloud routing (local-only is the default):',
+        `  ${AUTH_COMMAND} login`,
+        `  ${PROXY_COMMAND} config --cloud --yes`,
+    ];
+}
+export function printProxyConsoleGuidance(status) {
+    for (const line of proxyConsoleGuidance(status))
+        output.writeln(line);
+}
+const INSTALL_DISCLOSURE = [
+    'Installing the Meta LLM Proxy (ADR-304/307).',
+    '',
+    'This downloads a separately-released Rust binary (Ed25519-signature and',
+    'checksum verified before anything is written to disk) and runs it as a',
+    'local process bound to 127.0.0.1 only. The proxy routes to LOCAL',
+    'backends by default — no prompt leaves this machine. Cloud routing is a',
+    'separate, explicit opt-in (`ruflo proxy config --cloud`), never enabled',
+    'by install alone.',
+    '',
+    'Uninstall anytime: ruflo proxy uninstall',
+].join('\n');
+const installSub = {
+    name: 'install',
+    description: 'Download, verify, and install the meta-proxy binary (ADR-307)',
+    options: [
+        // NOT named 'version' — index.ts:107 globally intercepts any --version/-v
+        // anywhere in argv (`if (flags.version || flags.V) { showVersion(); return; }`)
+        // BEFORE subcommand dispatch, regardless of which command defines it. A
+        // subcommand-local --version is silently swallowed by the CLI's own
+        // `ruflo --version` handling — confirmed the hard way in E2E testing.
+        { name: 'release', description: `Release version to install (default: ${DEFAULT_PROXY_RELEASE})`, type: 'string' },
+        { name: 'yes', description: 'Skip the confirmation prompt', type: 'boolean', default: false },
+    ],
+    action: async (ctx) => {
+        // Resolve the reviewed default before the consent gate. An explicit empty
+        // override still fails below without recording a consent receipt.
+        const version = typeof ctx.flags.release === 'string' ? ctx.flags.release : DEFAULT_PROXY_RELEASE;
+        if (!version) {
+            output.printError('ruflo proxy install requires --release <x.y.z> — there is no version-discovery ' +
+                'endpoint yet (see the plan doc for the tracked follow-up). Find the latest at ' +
+                'the release channel and pass it explicitly.');
+            return { success: false, exitCode: 1 };
+        }
+        if (!hasConsent('proxy-install')) {
+            output.writeln(INSTALL_DISCLOSURE);
+            output.writeln('');
+            const confirmed = Boolean(ctx.flags.yes);
+            if (!confirmed) {
+                output.writeln(`Re-run with --yes to confirm: ruflo proxy install --yes (installs ${version})`);
+                return { success: true, data: { confirmed: false } };
+            }
+            recordConsent('proxy-install', true, 'proxy-install');
+        }
+        try {
+            const spinner = output.createSpinner({ text: `Installing meta-proxy ${version}...`, spinner: 'dots' });
+            spinner.start();
+            const result = await installProxy({ version, log: (line) => spinner.setText(line) });
+            spinner.succeed(`meta-proxy ${version} installed`);
+            output.writeln(`  binary: ${result.binaryPath}`);
+            output.writeln(`  sha256: ${result.sha256}`);
+            return { success: true, data: result };
+        }
+        catch (e) {
+            const message = e instanceof Error ? e.message : String(e);
+            output.printError('Install failed', message);
+            return { success: false, message, exitCode: 1 };
+        }
+    },
+};
+const updateSub = {
+    name: 'update',
+    description: 'Re-verify and replace the installed binary with a specific version (never automatic)',
+    options: [{ name: 'release', description: 'Release version to install', type: 'string', required: true }],
+    action: async (ctx) => {
+        const version = typeof ctx.flags.release === 'string' ? ctx.flags.release : undefined;
+        if (!version) {
+            output.printError('ruflo proxy update requires --release <x.y.z>');
+            return { success: false, exitCode: 1 };
+        }
+        try {
+            const spinner = output.createSpinner({ text: `Updating meta-proxy to ${version}...`, spinner: 'dots' });
+            spinner.start();
+            const result = await installProxy({ version, log: (line) => spinner.setText(line) });
+            spinner.succeed(`meta-proxy updated to ${version}`);
+            output.writeln(`  binary: ${result.binaryPath}`);
+            return { success: true, data: result };
+        }
+        catch (e) {
+            const message = e instanceof Error ? e.message : String(e);
+            output.printError('Update failed', message);
+            return { success: false, message, exitCode: 1 };
+        }
+    },
+};
+const startSub = {
+    name: 'start',
+    description: 'Start meta-proxy (foreground by default; --service to detach)',
+    options: [
+        { name: 'service', description: 'Run detached (background), survives terminal close but not a reboot — full OS-service registration is not yet implemented', type: 'boolean', default: false },
+    ],
+    action: async (ctx) => {
+        const service = Boolean(ctx.flags.service);
+        try {
+            if (service) {
+                const { pid } = await startBackground();
+                output.printSuccess(`meta-proxy started in the background (pid ${pid})`);
+                output.writeln('  Note: survives this terminal closing, but not a reboot — OS-service registration is not yet implemented.');
+                output.writeln('  Logs: ruflo proxy logs');
+                return { success: true, data: { pid } };
+            }
+            output.writeln('Starting meta-proxy in the foreground — press Ctrl+C to stop.');
+            await startTokenRefreshPump();
+            await startForeground(); // never returns normally
+            return { success: true };
+        }
+        catch (e) {
+            if (e instanceof ProxyNotInstalledError || e instanceof ProxyAlreadyRunningError) {
+                output.printError(e.message);
+                return { success: false, message: e.message, exitCode: 1 };
+            }
+            const message = e instanceof Error ? e.message : String(e);
+            output.printError('Failed to start meta-proxy', message);
+            return { success: false, message, exitCode: 1 };
+        }
+    },
+};
+const superviseSub = {
+    name: 'supervise',
+    description: 'Internal detached supervisor for token refresh and meta-proxy lifecycle',
+    action: async () => {
+        await startTokenRefreshPump();
+        await startForeground(true);
+        return { success: true };
+    },
+};
+const stopSub = {
+    name: 'stop',
+    description: 'Stop a running meta-proxy process',
+    action: async () => {
+        const result = await stopProxy();
+        removeInjectedToken();
+        if (!result.wasRunning) {
+            output.writeln('meta-proxy was not running.');
+            return { success: true, data: result };
+        }
+        output.printSuccess(`meta-proxy stopped (was pid ${result.pid})`);
+        return { success: true, data: result };
+    },
+};
+const statusSub = {
+    name: 'status',
+    description: 'Show meta-proxy install + process status',
+    options: [{ name: 'json', description: 'Machine-readable output', type: 'boolean', default: false }],
+    action: async (ctx) => {
+        const status = getProxyStatus();
+        if (ctx.flags.json) {
+            output.printJson(status);
+            return { success: true, data: status };
+        }
+        output.writeln('Meta Proxy');
+        output.writeln(`  Installation: ${status.installed ? 'ready' : 'not installed'}`);
+        output.writeln(`  Process: ${status.running ? `running (pid ${status.pid})` : 'not running'}`);
+        if (status.stalePidFile)
+            output.writeln('  (a stale PID file was found and will be cleared on next start)');
+        printProxyConsoleGuidance(status);
+        return { success: true, data: status };
+    },
+};
+const logsSub = {
+    name: 'logs',
+    description: 'Show meta-proxy --service logs',
+    options: [
+        { name: 'follow', short: 'f', description: 'Stream new log lines as they arrive', type: 'boolean', default: false },
+    ],
+    action: async (ctx) => {
+        if (ctx.flags.follow) {
+            output.writeln('Following meta-proxy logs — press Ctrl+C to stop.');
+            try {
+                const watcher = watchProxyLog((line) => output.writeln(line));
+                await new Promise((resolve) => {
+                    process.on('SIGINT', () => {
+                        watcher.close();
+                        resolve();
+                    });
+                });
+                return { success: true };
+            }
+            catch (e) {
+                const message = e instanceof Error ? e.message : String(e);
+                output.printError(message);
+                return { success: false, message, exitCode: 1 };
+            }
+        }
+        const tail = readProxyLogTail();
+        if (!tail) {
+            output.writeln('No log content yet — meta-proxy has never been started in --service mode.');
+            return { success: true, data: { empty: true } };
+        }
+        output.writeln(tail);
+        return { success: true };
+    },
+};
+const uninstallSub = {
+    name: 'uninstall',
+    description: 'Stop the proxy (if running), remove the binary, token, and consent receipt',
+    action: async () => {
+        const status = getProxyStatus();
+        if (status.running) {
+            await stopProxy();
+            output.writeln('Stopped the running meta-proxy process.');
+        }
+        const removed = await uninstallProxy();
+        const { existsSync, unlinkSync } = await import('node:fs');
+        const tokenPath = proxyTokenPath();
+        if (existsSync(tokenPath))
+            unlinkSync(tokenPath);
+        removeInjectedToken();
+        revokeConsent('proxy-install', 'proxy-uninstall');
+        output.printSuccess(removed ? 'meta-proxy uninstalled.' : 'Nothing was installed — cleaned up any leftover state.');
+        return { success: true, data: { removed } };
+    },
+};
+export const proxyLifecycleSubcommands = [installSub, updateSub, startSub, superviseSub, stopSub, statusSub, logsSub, uninstallSub];
+//# sourceMappingURL=proxy-lifecycle.js.map

package/v3/@claude-flow/cli/dist/src/commands/proxy.js

@@ -23,6 +23,8 @@ import { clearRateLimitStatus, readRateLimitStatus } from '../funnel/rate-limit-
 import { clearQuotaLowStatus, readQuotaLowStatus } from '../funnel/power-saver-notifier.js';
 import { getInstalledCliVersion } from '../init/helper-refresh.js';
 import * as path from 'path';
+import { proxyLifecycleSubcommands, printProxyConsoleGuidance } from './proxy-lifecycle.js';
+import { getProxyStatus } from '../proxy/lifecycle.js';
 const PROXY_CONFIG_FILE = 'proxy-config.toml';
 /**
  * Minimal hand-rolled TOML writer — this config has exactly one boolean
@@ -40,12 +42,12 @@ function readProxyConfigRaw() {
         return '';
     }
 }
-function writeConsentMirrorLine(field, value) {
+function writeConfigLine(field, rawValue) {
     const dir = funnelStateDir();
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     const target = path.join(dir, PROXY_CONFIG_FILE);
     const raw = readProxyConfigRaw();
-    const line = `${field} = ${value}`;
+    const line = `${field} = ${rawValue}`;
     const pattern = new RegExp(`^${field}\\s*=.*$`, 'm');
     let next;
     if (pattern.test(raw)) {
@@ -58,6 +60,9 @@ function writeConsentMirrorLine(field, value) {
     fs.writeFileSync(tmp, next, { encoding: 'utf-8', mode: 0o600 });
     fs.renameSync(tmp, target);
 }
+function writeConsentMirrorLine(field, value) {
+    writeConfigLine(field, String(value));
+}
 function writeSponsoredConsentMirror(granted) {
     writeConsentMirrorLine('sponsored_consent_granted', granted);
 }
@@ -67,6 +72,78 @@ function writePowerSaverConsentMirror(granted) {
 function writeTrainingShareConsentMirror(granted) {
     writeConsentMirrorLine('training_share_consent_granted', granted);
 }
+/**
+ * `default_data_plane` — the ADR-304 cloud-routing toggle. Values confirmed
+ * against meta-proxy's actual `DataPlane` enum (`src/config.rs`,
+ * `#[serde(rename_all = "snake_case")]`): "local" | "cloud" | "sponsored" |
+ * "passthrough" (the last two are not written by this command — sponsored
+ * is ADR-313's own consent flag, passthrough is the proxy's own default).
+ */
+function readDataPlane() {
+    const raw = readProxyConfigRaw();
+    const match = raw.match(/^default_data_plane\s*=\s*"([^"]*)"/m);
+    return match ? match[1] : 'passthrough'; // matches the Rust struct's own default
+}
+function writeDataPlane(plane) {
+    writeConfigLine('default_data_plane', `"${plane}"`);
+}
+const CLOUD_ROUTING_DISCLOSURE = [
+    'Enabling cloud routing.',
+    '',
+    'With cloud routing ON, prompts for cloud-tier requests are sent to',
+    'api.cognitum.one and forwarded to the selected provider',
+    '(Claude / GPT / Gemini / DeepSeek / OpenRouter).',
+    '',
+    'Requests routed to local backends never leave this machine.',
+    '',
+    'Disable anytime: ruflo proxy config --local-only',
+].join('\n');
+const configSub = {
+    name: 'config',
+    description: 'Toggle cloud routing (ADR-304) — local backends only by default',
+    options: [
+        { name: 'cloud', description: 'Enable cloud routing (requires cloud-routing consent)', type: 'boolean', default: false },
+        { name: 'local-only', description: 'Disable cloud routing, revert to local-only routing', type: 'boolean', default: false },
+        { name: 'yes', description: 'Skip the confirmation prompt', type: 'boolean', default: false },
+    ],
+    action: async (ctx) => {
+        const wantCloud = Boolean(ctx.flags.cloud);
+        const wantLocalOnly = Boolean(ctx.flags.localOnly ?? ctx.flags['local-only']);
+        if (wantCloud && wantLocalOnly) {
+            output.printError('Pass either --cloud or --local-only, not both.');
+            return { success: false, exitCode: 1 };
+        }
+        if (!wantCloud && !wantLocalOnly) {
+            const plane = readDataPlane();
+            output.writeln(`Current data plane: ${plane}`);
+            output.writeln(plane === 'cloud'
+                ? 'Cloud routing is ON — cloud-tier requests go to api.cognitum.one.'
+                : 'Cloud routing is OFF — requests never leave this machine (or use your own Claude subscription on Passthrough).');
+            return { success: true, data: { plane } };
+        }
+        if (wantLocalOnly) {
+            writeDataPlane('local');
+            revokeConsent('cloud-routing', 'proxy-config-local-only');
+            output.printSuccess('Cloud routing disabled — reverted to local-only routing.');
+            return { success: true, data: { plane: 'local' } };
+        }
+        // wantCloud
+        if (!hasConsent('cloud-routing')) {
+            output.writeln(CLOUD_ROUTING_DISCLOSURE);
+            output.writeln('');
+            if (!ctx.flags.yes) {
+                output.writeln('Re-run with --yes to confirm: ruflo proxy config --cloud --yes');
+                return { success: true, data: { confirmed: false } };
+            }
+            recordConsent('cloud-routing', true, 'proxy-config-cloud');
+        }
+        writeDataPlane('cloud');
+        output.printSuccess('Cloud routing enabled.');
+        output.writeln('  Requests routed to local backends still never leave this machine.');
+        output.writeln('  Disable anytime: ruflo proxy config --local-only');
+        return { success: true, data: { plane: 'cloud' } };
+    },
+};
 const SPONSOR_DISCLOSURE = [
     'Enabling sponsored downtime mode.',
     '',
@@ -292,19 +369,35 @@ const trainingShareStatusSub = {
 };
 export const proxyCommand = {
     name: 'proxy',
-    description: 'Meta LLM Proxy — sponsored downtime + power saver + training-data sharing (ADR-304/307/313/314/315)',
+    description: 'Meta LLM Proxy — install/lifecycle + sponsored downtime + power saver + training-data sharing (ADR-304/307/313/314/315)',
     subcommands: [
+        ...proxyLifecycleSubcommands,
+        configSub,
         sponsorEnableSub, sponsorDisableSub, sponsorStatusSub, sponsorClearSub,
         powerSaverEnableSub, powerSaverDisableSub, powerSaverStatusSub, powerSaverClearSub,
         trainingShareEnableSub, trainingShareDisableSub, trainingShareStatusSub,
     ],
     examples: [
+        { command: 'ruflo proxy install --yes', description: 'Install the signed Meta-Proxy v0.4.0 binary' },
+        { command: 'ruflo proxy start', description: 'Start meta-proxy in the foreground' },
+        { command: 'ruflo proxy status', description: 'Show install + process status' },
+        { command: 'ruflo proxy config --cloud --yes', description: 'Enable cloud routing (ADR-304)' },
+        { command: 'ruflo proxy config --local-only', description: 'Revert to local-only routing' },
         { command: 'ruflo proxy sponsor-status', description: 'Show current sponsored-mode state' },
         { command: 'ruflo proxy sponsor-enable --yes', description: 'Opt into sponsored downtime capacity' },
         { command: 'ruflo proxy power-saver-enable --yes', description: 'Opt into power saver mode' },
         { command: 'ruflo proxy training-share-enable --yes', description: 'Opt into training-data sharing (ADR-315)' },
     ],
-    action: sponsorStatusSub.action,
+    action: async () => {
+        const status = getProxyStatus();
+        output.writeln('Meta Proxy');
+        output.writeln(`  Installation: ${status.installed ? 'ready' : 'not installed'}`);
+        output.writeln(`  Process: ${status.running ? `running (pid ${status.pid})` : 'not running'}`);
+        if (status.stalePidFile)
+            output.writeln('  (a stale PID file was found and will be cleared on next start)');
+        printProxyConsoleGuidance(status);
+        return { success: true, data: status };
+    },
 };
 export default proxyCommand;
 //# sourceMappingURL=proxy.js.map

package/v3/@claude-flow/cli/dist/src/funnel/message-transport.d.ts

@@ -5,16 +5,23 @@
  *
  * Design discipline:
  *   1. **Never blocks the render.** The statusline reads only the local
- *      cache. This module refreshes the cache in the background; a fresh
- *      install shows the in-code fallback pool until the first refresh
- *      lands (usually seconds after CLI startup).
+ *      cache. This module refreshes the cache in the background; per
+ *      ADR-311 "zero local promo content" there is NO in-code fallback
+ *      pool — a genuinely fresh install (empty cache) shows nothing on
+ *      the promo/disclosure row until the first background refresh lands
+ *      (see hook-handler.cjs's SessionStart-triggered detached
+ *      `hooks refresh-funnel`, usually within seconds of CLI startup, but
+ *      contingent on network reachability to the messages endpoint). This
+ *      comment previously (incorrectly) described an in-code fallback
+ *      pool; there has never been one since ADR-311 — see disclosure.ts's
+ *      own "fail-closed" doc comment for the authoritative statement.
  *   2. **Content pipeline stays authoritative.** Every message the server
  *      returns is validated by `isValidMessage()` from `messages.ts` —
  *      same schema, same host allowlist, same control-char strip, same
  *      80-column cap. A tampered or accidentally-broken remote feed can
  *      pollute nothing.
  *   3. **Fail silent.** Any network/parse/validation failure leaves the
- *      previously-cached (or in-code) pool intact.
+ *      previously-cached pool intact (empty, if nothing has landed yet).
  *   4. **Bounded cache size.** ≤ 128 KiB and ≤ 200 messages — matches
  *      ADR-309's bounded-local-queue discipline.
  *   5. **Kill switch.** `RUFLO_FUNNEL_MESSAGES=0` (or `RUFLO_FUNNEL=0`)

package/v3/@claude-flow/cli/dist/src/funnel/message-transport.js

@@ -5,16 +5,23 @@
  *
  * Design discipline:
  *   1. **Never blocks the render.** The statusline reads only the local
- *      cache. This module refreshes the cache in the background; a fresh
- *      install shows the in-code fallback pool until the first refresh
- *      lands (usually seconds after CLI startup).
+ *      cache. This module refreshes the cache in the background; per
+ *      ADR-311 "zero local promo content" there is NO in-code fallback
+ *      pool — a genuinely fresh install (empty cache) shows nothing on
+ *      the promo/disclosure row until the first background refresh lands
+ *      (see hook-handler.cjs's SessionStart-triggered detached
+ *      `hooks refresh-funnel`, usually within seconds of CLI startup, but
+ *      contingent on network reachability to the messages endpoint). This
+ *      comment previously (incorrectly) described an in-code fallback
+ *      pool; there has never been one since ADR-311 — see disclosure.ts's
+ *      own "fail-closed" doc comment for the authoritative statement.
  *   2. **Content pipeline stays authoritative.** Every message the server
  *      returns is validated by `isValidMessage()` from `messages.ts` —
  *      same schema, same host allowlist, same control-char strip, same
  *      80-column cap. A tampered or accidentally-broken remote feed can
  *      pollute nothing.
  *   3. **Fail silent.** Any network/parse/validation failure leaves the
- *      previously-cached (or in-code) pool intact.
+ *      previously-cached pool intact (empty, if nothing has landed yet).
  *   4. **Bounded cache size.** ≤ 128 KiB and ≤ 200 messages — matches
  *      ADR-309's bounded-local-queue discipline.
  *   5. **Kill switch.** `RUFLO_FUNNEL_MESSAGES=0` (or `RUFLO_FUNNEL=0`)

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -389,7 +389,7 @@ export const memoryTools = [
             type: 'object',
             properties: {
                 query: { type: 'string', description: 'Search query (semantic similarity)' },
-                namespace: { type: 'string', description: 'Namespace to search (default: "default")' },
+                namespace: { type: 'string', description: 'Namespace to search (default: all namespaces — omit to search across every namespace)' },
                 limit: { type: 'number', description: 'Maximum results (default: 10)' },
                 threshold: { type: 'number', description: 'Minimum similarity threshold 0-1 (default: 0.3)' },
                 smart: { type: 'boolean', description: 'Enable SmartRetrieval pipeline — query expansion, RRF fusion, recency boost, MMR diversity (default: false)' },
@@ -400,10 +400,18 @@ export const memoryTools = [
             await ensureInitialized();
             const { searchEntries } = await getMemoryFunctions();
             const query = input.query;
-            const namespace = input.namespace || 'default';
+            // #2646 (3rd occurrence of #1123/#1131 shape): do NOT coerce an omitted
+            // namespace to the literal string 'default' here. Both searchEntries()
+            // and bridgeSearchEntries() already resolve an omitted/undefined
+            // namespace to 'all' (fan out across every namespace) — but 'default'
+            // is truthy, so passing it defeats that fallback and silently scopes
+            // the search to a namespace that is usually empty. Leave namespace
+            // undefined when not provided so the underlying `|| 'all'` fallback
+            // in the search layer actually fires.
+            const namespace = input.namespace;
             const limit = input.limit ?? 10;
             const threshold = input.threshold ?? 0.3;
-            validateMemoryInput(undefined, undefined, query);
+            validateMemoryInput(undefined, undefined, query, namespace);
             const startTime = performance.now();
             try {
                 // #1846: feature-detect smartSearch on the resolved memory package.

package/v3/@claude-flow/cli/dist/src/memory/graph-edge-writer.d.ts

@@ -90,6 +90,15 @@ export declare function countGraphEdges(dbPath?: string): Promise<number>;
  * #2431 fix: also explicitly closes the prior handle so file locks
  * release immediately — better-sqlite3 holds an OS-level file handle
  * which the prior sql.js implementation did not.
+ *
+ * #2736-followup fix: `close()` alone only checkpoints the WAL back into
+ * the main file as a best-effort PASSIVE checkpoint when SQLite considers
+ * this the last connection — which is not guaranteed to fully flush under
+ * contention, and was observed leaving writes invisible to a same-process
+ * sql.js reader that re-reads the raw file immediately after close() on
+ * Linux CI runners (not reproduced on Windows). Force a blocking TRUNCATE
+ * checkpoint before close so cross-engine readers always see committed
+ * writes deterministically, regardless of platform/timing.
  */
 export declare function _resetBridgeDb(): void;
 //# sourceMappingURL=graph-edge-writer.d.ts.map

package/v3/@claude-flow/cli/dist/src/memory/graph-edge-writer.js

@@ -203,9 +203,22 @@ export async function countGraphEdges(dbPath) {
  * #2431 fix: also explicitly closes the prior handle so file locks
  * release immediately — better-sqlite3 holds an OS-level file handle
  * which the prior sql.js implementation did not.
+ *
+ * #2736-followup fix: `close()` alone only checkpoints the WAL back into
+ * the main file as a best-effort PASSIVE checkpoint when SQLite considers
+ * this the last connection — which is not guaranteed to fully flush under
+ * contention, and was observed leaving writes invisible to a same-process
+ * sql.js reader that re-reads the raw file immediately after close() on
+ * Linux CI runners (not reproduced on Windows). Force a blocking TRUNCATE
+ * checkpoint before close so cross-engine readers always see committed
+ * writes deterministically, regardless of platform/timing.
  */
 export function _resetBridgeDb() {
     if (_db) {
+        try {
+            _db.pragma('wal_checkpoint(TRUNCATE)');
+        }
+        catch { /* best-effort */ }
         try {
             _db.close();
         }

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.js

@@ -23,6 +23,28 @@ import { createRequire } from 'node:module';
 let registryPromise = null;
 let registryInstance = null;
 let bridgeAvailable = null;
+// #2735 — the native-bridge -> sql.js whole-image fallback used to be
+// completely silent: a registry init failure cached `bridgeAvailable =
+// false` for the rest of the process, and a per-operation bridge exception
+// swallowed itself with a bare `catch { return null; }` — in both cases the
+// caller fell back to memory-initializer.ts's unsafe whole-image sql.js
+// path with zero diagnostic trail. When that path corrupted a database, the
+// demotion that caused it was structurally unknowable after the fact. Log
+// once per distinct reason (not once per call — a hot per-op catch could
+// otherwise spam stderr on every single memory operation) so the first
+// occurrence is attributable. Stderr only — never stdout, which callers may
+// be parsing as JSON.
+const loggedDemotions = new Set();
+function logDemotionOnce(where, reason) {
+    const dedupeKey = `${where}:${reason}`;
+    if (loggedDemotions.has(dedupeKey))
+        return;
+    loggedDemotions.add(dedupeKey);
+    try {
+        process.stderr.write(`[memory-bridge] demoted to sql.js fallback in ${where}: ${reason}\n`);
+    }
+    catch { /* stderr unavailable — nothing more we can do */ }
+}
 /**
  * Resolve database path with path traversal protection.
  * Only allows paths within or below the project's working directory,
@@ -350,9 +372,10 @@ async function getRegistry(dbPath) {
                 bridgeAvailable = true;
                 return registry;
             }
-            catch {
+            catch (err) {
                 bridgeAvailable = false;
                 registryPromise = null;
+                logDemotionOnce('getRegistry (process-wide, cached for the rest of this process)', err instanceof Error ? err.message : String(err));
                 return null;
             }
         })();
@@ -737,7 +760,8 @@ export async function bridgeStoreEntry(options) {
             attested: true,
         };
     }
-    catch {
+    catch (err) {
+        logDemotionOnce('bridgeStoreEntry', err instanceof Error ? err.message : String(err));
         return null;
     }
 }
@@ -1017,7 +1041,8 @@ export async function bridgeGetEntry(options) {
         await cacheSet(registry, cacheKey, entry);
         return { success: true, found: true, cacheHit: false, entry };
     }
-    catch {
+    catch (err) {
+        logDemotionOnce('bridgeGetEntry', err instanceof Error ? err.message : String(err));
         return null;
     }
 }
@@ -1077,7 +1102,8 @@ export async function bridgeDeleteEntry(options) {
             guarded: true,
         };
     }
-    catch {
+    catch (err) {
+        logDemotionOnce('bridgeDeleteEntry', err instanceof Error ? err.message : String(err));
         return null;
     }
 }
@@ -1128,7 +1154,8 @@ export async function bridgePurgeNamespace(options) {
             guarded: true,
         };
     }
-    catch {
+    catch (err) {
+        logDemotionOnce('bridgePurgeNamespace', err instanceof Error ? err.message : String(err));
         return null;
     }
 }