claude-flow 3.32.29 → 3.32.32

package/v3/@claude-flow/cli/dist/src/mcp-tools/capability-brain.js

@@ -125,8 +125,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'guidance',
         name: 'Capability Guidance',
-        description: 'Live capability inventory, task routing, workflow guidance, and system discovery.',
         prefixes: ['guidance_'],
+        description: 'Live capability inventory, task routing, workflow guidance, and system discovery.',
         taskSignals: ['guidance', 'discover', 'capability', 'what can ruflo do'],
         commands: ['guidance compile', 'guidance retrieve', 'guidance gates', 'guidance optimize'],
         skills: [],
@@ -140,8 +140,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'identity-auth',
         name: 'Cognitum Identity & OAuth',
-        description: 'Profile-aware PKCE/OOB authentication, credential status, consent-bound scopes, refresh, and local logout.',
         prefixes: ['auth_', 'oauth_'],
+        description: 'Profile-aware PKCE/OOB authentication, credential status, consent-bound scopes, refresh, and local logout.',
         taskSignals: ['auth', 'oauth', 'login', 'logout', 'credential', 'profile', 'scope', 'consent'],
         commands: ['auth login', 'auth login --no-browser', 'auth status', 'auth status --check', 'auth logout'],
         skills: ['security-audit'],
@@ -163,8 +163,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'policy-authorization',
         name: 'Policy Authorization',
-        description: 'Policy-decision evaluation and status for exact subject/action/resource requests.',
         prefixes: ['policy_'],
+        description: 'Policy-decision evaluation and status for exact subject/action/resource requests.',
         taskSignals: ['policy', 'authorization', 'permission', 'capability', 'access control'],
         commands: ['policy evaluate', 'policy status', 'guidance gates'],
         skills: ['claims', 'security-audit', 'v3-security-overhaul'],
@@ -181,8 +181,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'work-claims',
         name: 'Exclusive Work Claims',
-        description: 'Repository/task ownership claims, handoffs, contention, stealing, and rebalance.',
         prefixes: ['claims_'],
+        description: 'Repository/task ownership claims, handoffs, contention, stealing, and rebalance.',
         taskSignals: ['work claim', 'claim task', 'handoff', 'ownership', 'concurrent work', 'rebalance'],
         commands: ['claims claim', 'claims handoff', 'claims status'],
         skills: ['claims'],
@@ -198,8 +198,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'content-safety',
         name: 'AIDefence Content Safety',
-        description: 'Prompt/content safety, PII detection, learning, and security evidence.',
         prefixes: ['aidefence_', 'security_'],
+        description: 'Prompt/content safety, PII detection, learning, and security evidence.',
         taskSignals: ['security', 'content safety', 'pii', 'prompt injection', 'threat', 'audit'],
         commands: ['security scan'],
         skills: ['security-audit', 'v3-security-overhaul'],
@@ -215,8 +215,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'metaharness-flywheel',
         name: 'MetaHarness, Darwin & Flywheel',
-        description: 'Candidate scoring, static analysis, threat modeling, genome exploration, and controlled improvement loops.',
         prefixes: ['metaharness_', 'autopilot_'],
+        description: 'Candidate scoring, static analysis, threat modeling, genome exploration, and controlled improvement loops.',
         taskSignals: ['metaharness', 'darwin', 'flywheel', 'genome', 'optimize', 'autopilot'],
         commands: ['metaharness score', 'metaharness genome', 'autopilot run'],
         skills: ['metaharness-brain', 'performance-analysis'],
@@ -233,8 +233,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'memory-knowledge',
         name: 'Memory, AgentDB & Embeddings',
-        description: 'Persistent memory, semantic/vector retrieval, namespaces, embeddings, and AgentDB controllers.',
         prefixes: ['memory_', 'agentdb_', 'embeddings_'],
+        description: 'Persistent memory, semantic/vector retrieval, namespaces, embeddings, and AgentDB controllers.',
         taskSignals: ['memory', 'agentdb', 'vector', 'embedding', 'semantic', 'recall'],
         commands: ['memory search', 'memory store', 'memory retrieve'],
         skills: ['memory-management', 'agentdb-advanced', 'agentdb-vector-search'],
@@ -250,8 +250,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'memory-branching',
         name: 'Copy-on-Write & Speculative Memory',
-        description: 'Low-cost memory branching, checkpoint, rollback, comparison, and validated promotion.',
         prefixes: ['agenticow_'],
+        description: 'Low-cost memory branching, checkpoint, rollback, comparison, and validated promotion.',
         taskSignals: ['branch memory', 'checkpoint', 'rollback', 'speculative'],
         commands: [],
         skills: ['agentdb-learning'],
@@ -267,8 +267,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'agents-runtimes',
         name: 'Agent Lifecycle & Runtimes',
-        description: 'Local agents, managed cloud agents, WASM sandboxes, and inference runtimes.',
         prefixes: ['agent_', 'managed_agent_', 'wasm_agent_', 'wasm_gallery_', 'ruvllm_'],
+        description: 'Local agents, managed cloud agents, WASM sandboxes, and inference runtimes.',
         taskSignals: ['agent', 'worker', 'wasm', 'sandbox', 'inference', 'managed agent'],
         commands: ['agent spawn', 'agent status', 'agent stop'],
         skills: ['agent-coder', 'agent-tester', 'agent-reviewer'],
@@ -284,8 +284,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'swarm-coordination',
         name: 'Swarm & Coordination',
-        description: 'Topology-aware multi-agent coordination, task ownership, and collective scheduling.',
         prefixes: ['swarm_', 'coordination_', 'daa_'],
+        description: 'Topology-aware multi-agent coordination, task ownership, and collective scheduling.',
         taskSignals: ['swarm', 'concurrent', 'parallel', 'coordinate', 'multi-agent'],
         commands: ['swarm init', 'swarm status', 'swarm coordinate'],
         skills: ['swarm-orchestration', 'swarm-advanced'],
@@ -299,8 +299,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'consensus-federation',
         name: 'Hive Mind & Consensus',
-        description: 'Hive, quorum, voting, gossip, and distributed agreement primitives.',
         prefixes: ['hive_', 'hive-mind_', 'consensus_', 'quorum_'],
+        description: 'Hive, quorum, voting, gossip, and distributed agreement primitives.',
         taskSignals: ['hive', 'consensus', 'quorum', 'byzantine', 'federation'],
         commands: ['hive-mind init', 'hive-mind status'],
         skills: ['hive-mind', 'hive-mind-advanced'],
@@ -314,8 +314,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'tasks-workflows-sessions',
         name: 'Tasks, Workflows, Sessions & Progress',
-        description: 'Task orchestration, reusable workflows, session state, progress, and handoff.',
         prefixes: ['task_', 'workflow_', 'session_', 'progress_'],
+        description: 'Task orchestration, reusable workflows, session state, progress, and handoff.',
         taskSignals: ['task', 'workflow', 'session', 'handoff', 'progress'],
         commands: ['task create', 'task status', 'workflow run'],
         skills: ['workflow-automation'],
@@ -329,8 +329,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'hooks-learning-routing',
         name: 'Hooks, Coverage & Learning Routing',
-        description: 'Lifecycle hooks, coverage-aware routing, background workers, and validated pattern capture.',
         prefixes: ['hooks_', 'coverage_'],
+        description: 'Lifecycle hooks, coverage-aware routing, background workers, and validated pattern capture.',
         taskSignals: ['hook', 'coverage', 'route', 'worker', 'learning'],
         commands: ['hooks pre-task', 'hooks post-task', 'hooks route', 'hooks coverage-gaps'],
         skills: ['hooks-automation'],
@@ -345,8 +345,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'analysis-quality',
         name: 'Analysis & Quality',
-        description: 'Code/project analysis, quality assessment, and change inspection.',
         prefixes: ['analyze_', 'analysis_'],
+        description: 'Code/project analysis, quality assessment, and change inspection.',
         taskSignals: ['analyze', 'review', 'quality', 'dependency'],
         commands: ['analyze code', 'analyze project'],
         skills: ['verification-quality'],
@@ -360,8 +360,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'test-generation',
         name: 'TDD Test Generation',
-        description: 'TDD repair and test-generation capability exported by Ruflo but intentionally reported as unregistered until the MCP registry enables it.',
         prefixes: ['testgen_'],
+        description: 'TDD repair and test-generation capability exported by Ruflo but intentionally reported as unregistered until the MCP registry enables it.',
         exactTools: ['testgen_tdd_repair'],
         taskSignals: ['generate tests', 'tdd repair', 'test generation'],
         commands: [],
@@ -379,8 +379,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'performance-neural',
         name: 'Performance & Neural Optimization',
-        description: 'Profiling, benchmarks, learned routing, pattern training, and optimization.',
         prefixes: ['performance_', 'neural_'],
+        description: 'Profiling, benchmarks, learned routing, pattern training, and optimization.',
         taskSignals: ['performance', 'benchmark', 'profile', 'latency', 'neural', 'train'],
         commands: ['performance benchmark', 'performance profile', 'neural train'],
         skills: ['performance-analysis', 'neural-training'],
@@ -396,8 +396,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'browser-web',
         name: 'Browser & Web Actions',
-        description: 'Browser sessions, page actions, intent routing, and guarded HTTP probes.',
         prefixes: ['browser_', 'http_fetch'],
+        description: 'Browser sessions, page actions, intent routing, and guarded HTTP probes.',
         taskSignals: ['browser', 'web page', 'navigate', 'click', 'http', 'fetch'],
         commands: ['browser open', 'browser act'],
         skills: [],
@@ -413,8 +413,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'github-delivery',
         name: 'GitHub & Delivery',
-        description: 'Issues, pull requests, workflows, releases, repository automation, and handoff.',
         prefixes: ['github_', 'pr_', 'release_'],
+        description: 'Issues, pull requests, workflows, releases, repository automation, and handoff.',
         taskSignals: ['github', 'issue', 'pull request', 'merge', 'release', 'publish'],
         commands: ['github pr', 'github release'],
         skills: ['github-automation', 'github-release-management'],
@@ -429,9 +429,9 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'business-collaboration',
         name: 'AgentBBS & Business Pods',
-        description: 'Federated business rooms, domain-affinity routing, and business-pod validation.',
         // Metadata classification only; execution remains behind the existing loadAgentbbs guard.
         prefixes: ['agentbbs_', 'business_pod_', 'federation_bbs_'],
+        description: 'Federated business rooms, domain-affinity routing, and business-pod validation.',
         taskSignals: ['business pod', 'bbs', 'room', 'domain affinity'],
         commands: [],
         skills: [],
@@ -447,8 +447,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'configuration-transfer',
         name: 'Configuration & Transfer',
-        description: 'Configuration state plus portable import, export, backup, and migration.',
         prefixes: ['config_', 'transfer_'],
+        description: 'Configuration state plus portable import, export, backup, and migration.',
         taskSignals: ['config', 'setup', 'import', 'export', 'backup', 'migrate'],
         commands: ['config show', 'memory export'],
         skills: [],
@@ -463,8 +463,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'system-terminal',
         name: 'System & Terminal Compatibility',
-        description: 'System diagnostics and legacy-compatible terminal execution surfaces.',
         prefixes: ['system_', 'terminal_', 'mcp_'],
+        description: 'System diagnostics and legacy-compatible terminal execution surfaces.',
         taskSignals: ['terminal', 'shell', 'doctor', 'system status'],
         commands: ['doctor', 'status'],
         skills: [],
@@ -479,8 +479,8 @@ export const CAPABILITY_DOMAINS = [
     {
         id: 'runtime-services',
         name: 'Other Registered Runtime Services',
-        description: 'Live MCP tools not yet assigned to a specialized domain; included so coverage is never silently incomplete.',
         prefixes: [],
+        description: 'Live MCP tools not yet assigned to a specialized domain; included so coverage is never silently incomplete.',
         taskSignals: [],
         commands: [],
         skills: [],

package/v3/@claude-flow/cli/dist/src/mcp-tools/guidance-tools.js

@@ -814,7 +814,7 @@ const guidanceQuickRef = {
 };
 const guidanceBrain = {
     name: 'guidance_brain',
-    description: 'Query Ruflo’s live capability brain. Covers every registered MCP tool, separates registration from configuration/reachability/health/authorization, recommends capabilities for a task, and returns the validated implementation loop.',
+    description: 'Use when choosing how to execute a task with Ruflo. Queries the live capability brain, covers every registered MCP tool, separates registration from configuration/reachability/health/authorization, recommends capabilities, and returns the validated implementation loop.',
     inputSchema: {
         type: 'object',
         properties: {

package/v3/@claude-flow/cli/dist/src/services/harness-flywheel-runtime.d.ts

@@ -1,6 +1,26 @@
 import { type FlywheelResult } from './harness-flywheel.js';
 import { type GenerationResult } from './harness-flywheel-generations.js';
-import { type DarwinInvoker, type ProposerMode } from './flywheel-proposer.js';
+import { type DarwinInvoker, type ProposerMode, type SafetyEnvelope } from './flywheel-proposer.js';
+/**
+ * The ADR-322 retrieval safety envelope.
+ *
+ * It MUST describe the policy surface the proposer actually emits —
+ * `RetrievalConfig`. The v1 envelope allowed `topK`/`rerank`, which are
+ * `neural_patterns` search-call arguments not representable in
+ * `RetrievalConfig`, while omitting the three weight axes that
+ * `retrievalPolicyNeighbors` does mutate. Because `validateCandidate` checks
+ * EVERY key of a candidate policy (candidates are full snapshots, not deltas),
+ * that drift made every locally-proposed candidate inadmissible and the local
+ * evaluation path unreachable — no receipt, therefore no promotion, ever.
+ *
+ * Every axis carries a finite bound: an allowed key WITHOUT bounds is an
+ * unbounded key, because `validateCandidate` applies bounds only when present.
+ * A Darwin proposer could otherwise submit arbitrary weights on the three axes.
+ *
+ * Exported so tests can bind the REAL envelope to the REAL proposer; the drift
+ * survived review precisely because no test wired those two together.
+ */
+export declare function retrievalSafetyEnvelope(ref?: string): SafetyEnvelope;
 /**
  * Run one live flywheel tick against `projectRoot`. Opt-in + $0 default: with
  * RUFLO_HARNESS_LOOP unset it is a no-op. Best-effort; never throws.

package/v3/@claude-flow/cli/dist/src/services/harness-flywheel-runtime.js

@@ -24,6 +24,51 @@ const ANCHOR = [
     ['Q-learning encoder keyword block', ['q-state encoder', 'route q-state', 'keyword block', '#2239', 'q-encoder']],
     ['security hardening crypto random IDs', ['cwe-347', 'crypto.randomuuid', 'security fix', 'random id', 'crypto random']],
 ].map(([q, labels], i) => ({ id: `q${String(i).padStart(2, '0')}`, input: { id: `q${String(i).padStart(2, '0')}`, q: q }, expected: labels }));
+/**
+ * The ADR-322 retrieval safety envelope.
+ *
+ * It MUST describe the policy surface the proposer actually emits —
+ * `RetrievalConfig`. The v1 envelope allowed `topK`/`rerank`, which are
+ * `neural_patterns` search-call arguments not representable in
+ * `RetrievalConfig`, while omitting the three weight axes that
+ * `retrievalPolicyNeighbors` does mutate. Because `validateCandidate` checks
+ * EVERY key of a candidate policy (candidates are full snapshots, not deltas),
+ * that drift made every locally-proposed candidate inadmissible and the local
+ * evaluation path unreachable — no receipt, therefore no promotion, ever.
+ *
+ * Every axis carries a finite bound: an allowed key WITHOUT bounds is an
+ * unbounded key, because `validateCandidate` applies bounds only when present.
+ * A Darwin proposer could otherwise submit arbitrary weights on the three axes.
+ *
+ * Exported so tests can bind the REAL envelope to the REAL proposer; the drift
+ * survived review precisely because no test wired those two together.
+ */
+export function retrievalSafetyEnvelope(ref) {
+    const allowedPolicyKeys = ['alpha', 'subjectWeight', 'mmrLambda', 'bodyWeight', 'typePenaltyFactor'];
+    const numericBounds = {
+        alpha: { min: 0.1, max: 0.9 },
+        subjectWeight: { min: 0.1, max: 10 },
+        mmrLambda: { min: 0.3, max: 0.9 },
+        bodyWeight: { min: 0.1, max: 10 },
+        typePenaltyFactor: { min: 0.1, max: 10 },
+    };
+    return {
+        ref: ref ?? sha256Ref(JSON.stringify({
+            schema: 'ruflo.retrieval-safety-envelope/v2',
+            allowedPolicyKeys,
+            numericBounds,
+        })),
+        allowedPolicyKeys,
+        numericBounds,
+        // Retrieval evaluations are local and report zero provider spend today;
+        // finite ceilings make any future resource evidence fail closed.
+        maxP95LatencyMicros: 5_000_000,
+        maxCostMicrosPerTask: 10_000,
+        maxTokensPerTask: 100_000,
+        maxFailureRate: 0.01,
+        maxEvaluationCostMicros: 1_000_000,
+    };
+}
 /**
  * Run one live flywheel tick against `projectRoot`. Opt-in + $0 default: with
  * RUFLO_HARNESS_LOOP unset it is a no-op. Best-effort; never throws.
@@ -53,30 +98,7 @@ export async function runFlywheelWorker(projectRoot, opts = {}) {
             ...DEFAULT_CONFIG,
             ...(applier.activeChampion(projectRoot)?.params ?? {}),
         };
-        const safetyEnvelope = {
-            ref: opts.safetyEnvelopeRef ?? sha256Ref(JSON.stringify({
-                schema: 'ruflo.retrieval-safety-envelope/v1',
-                allowedPolicyKeys: ['alpha', 'topK', 'rerank', 'mmrLambda'],
-                numericBounds: {
-                    alpha: { min: 0.1, max: 0.9 },
-                    topK: { min: 5, max: 20 },
-                    mmrLambda: { min: 0.3, max: 0.9 },
-                },
-            })),
-            allowedPolicyKeys: ['alpha', 'topK', 'rerank', 'mmrLambda'],
-            numericBounds: {
-                alpha: { min: 0.1, max: 0.9 },
-                topK: { min: 5, max: 20 },
-                mmrLambda: { min: 0.3, max: 0.9 },
-            },
-            // Retrieval evaluations are local and report zero provider spend today;
-            // finite ceilings make any future resource evidence fail closed.
-            maxP95LatencyMicros: 5_000_000,
-            maxCostMicrosPerTask: 10_000,
-            maxTokensPerTask: 100_000,
-            maxFailureRate: 0.01,
-            maxEvaluationCostMicros: 1_000_000,
-        };
+        const safetyEnvelope = retrievalSafetyEnvelope(opts.safetyEnvelopeRef);
         // CLI flag opts.proposer takes precedence over RUFLO_FLYWHEEL_PROPOSER.
         const proposerMode = opts.proposer
             ?? (process.env.RUFLO_FLYWHEEL_PROPOSER ?? 'auto');

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.32.29",
+  "version": "3.32.32",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -40,11 +40,7 @@
     "self-learning",
     "enterprise"
   ],
-  "author": {
-    "name": "RuvNet",
-    "email": "ruv@ruv.io",
-    "url": "https://ruv.io"
-  },
+  "author": "RuvNet <ruv@ruv.io> (https://ruv.io)",
   "license": "MIT",
   "exports": {
     ".": {
@@ -102,18 +98,30 @@
   },
   "dependencies": {
     "@claude-flow/cli-core": "3.7.0-alpha.5",
+    "@claude-flow/codex": "3.0.3",
     "@claude-flow/mcp": "3.0.0-alpha.8",
     "@claude-flow/neural": "3.0.0-alpha.9",
+    "@claude-flow/plugin-agent-federation": "1.0.0-alpha.18",
+    "@claude-flow/security": "3.0.0-alpha.14",
     "@claude-flow/shared": "3.0.0-alpha.7",
+    "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",
+    "bcryptjs": "^3.0.3",
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "fs-extra": "^11.2.0",
+    "inquirer": "^9.2.0",
     "semver": "7.7.3",
     "sql.js": "^1.13.0",
-    "yaml": "^2.8.0"
+    "toml": "^3.0.0",
+    "ws": "^8.21.0",
+    "yaml": "^2.8.0",
+    "zod": "^3.22.0"
   },
   "optionalDependencies": {
+    "@napi-rs/keyring": "1.3.0",
     "@claude-flow/memory": "^3.0.0-alpha.21",
-    "@claude-flow/security": "^3.0.0-alpha.14",
     "agentdb": "^3.0.0-alpha.17",
     "agentic-flow": "^3.0.0-alpha.1",
     "better-sqlite3": "^12.9.0",
@@ -154,5 +162,13 @@
     "@opentelemetry/sdk-node": ">=0.220.0",
     "agentdb": "$agentdb",
     "better-sqlite3": "^12.9.0"
+  },
+  "bundleDependencies": [
+    "@claude-flow/codex",
+    "@claude-flow/plugin-agent-federation",
+    "@claude-flow/security"
+  ],
+  "directories": {
+    "doc": "docs"
   }
 }

package/.claude/.proven-config-version

@@ -1 +0,0 @@
-sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319

package/.claude/proven-config.json

@@ -1,42 +0,0 @@
-{
-  "adoptedAt": 1785298809901,
-  "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
-  "manifest": {
-    "schema": "ruflo.proven-config/v1",
-    "policy": {
-      "ref": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
-      "value": {
-        "alpha": 0.3,
-        "subjectWeight": 1,
-        "mmrLambda": 0.5,
-        "bodyWeight": 1.5,
-        "typePenaltyFactor": 0.5
-      }
-    },
-    "layer": "framework/node-cli",
-    "compatibility": {
-      "ruflo": ">=3.24.0"
-    },
-    "benchmark": {
-      "corpus": "ADR-081-labelled-v1",
-      "corpusHash": "sha256:2f700b5c363e20a3bd88ce2bc9b87bbbbaa61732c6177894c6ec37890f888982"
-    },
-    "receipt": {
-      "heldOutDelta": 0.07381404928570845,
-      "redblue": "PASS",
-      "drift": 0,
-      "canary": {
-        "rollbackRate": 0,
-        "latencyP95": 244.612458000076,
-        "costPerTask": 0
-      },
-      "receiptCoverage": 1
-    },
-    "platform": [
-      "linux",
-      "macOS",
-      "windows"
-    ]
-  },
-  "previous": ""
-}