claude-flow 3.47.1 → 3.48.0

package/v3/@claude-flow/cli/dist/src/commands/memory.js

@@ -9,6 +9,8 @@ import { distillCommand } from './memory-distill.js';
 import { backupCommand } from './memory-backup.js';
 import { countSiblingStoreRows } from '../memory/sibling-store.js';
 import { resolveDbPath } from '../memory/memory-initializer.js';
+import { existsSync } from 'node:fs';
+import { siblingAgentDbPath } from '../memory/memory-bridge.js';
 /**
  * #3228: a miss in one store is not a miss in the memory.
  *
@@ -26,6 +28,24 @@ async function warnIfSiblingHasRows(pathFlag) {
             `That store is written by the MCP/AgentDB path; read it with --path ${unread.path}.`);
     }
 }
+/** Default CLI writes may be mirrored into AgentDB; remove both copies. */
+function removalDbTargets(pathFlag) {
+    const primary = resolveDbPath(pathFlag);
+    // An explicit file selection is a single-store operation, as documented by
+    // --path. Do not widen a caller's requested destructive scope.
+    if (pathFlag || process.env.CLAUDE_FLOW_DB_PATH)
+        return [{ dbPath: primary }];
+    const sibling = siblingAgentDbPath(primary);
+    // The AgentDB mirror is consumed by native SQLite and must stay plaintext.
+    // Pass this per operation, including preview migrations; never toggle the
+    // process encryption setting while asynchronous operations are in flight.
+    const targets = [
+        { dbPath: primary },
+        ...(sibling ? [{ dbPath: sibling, encryptWrites: false }] : []),
+    ].filter(target => existsSync(target.dbPath));
+    // Preserve the existing missing-database error when neither store exists.
+    return targets.length ? targets : [{ dbPath: primary }];
+}
 // Memory backends
 const BACKENDS = [
     { value: 'agentdb', label: 'AgentDB', hint: 'Vector database with HNSW indexing (150x-12,500x faster)' },
@@ -820,7 +840,7 @@ function formatRelativeTime(isoDate) {
 const deleteCommand = {
     name: 'delete',
     aliases: ['rm'],
-    description: 'Delete memory entry',
+    description: 'Delete a memory entry from the default store and its AgentDB mirror (use --path to select one store)',
     options: [
         {
             name: 'key',
@@ -870,16 +890,24 @@ const deleteCommand = {
         }
         // Use sql.js directly for consistent data access (Issue #980)
         try {
-            const { deleteEntry, resolveDbPath: _rdbDelete } = await import('../memory/memory-initializer.js');
-            const dbPathDelete = _rdbDelete(ctx.flags.path);
-            const result = await deleteEntry({ key, namespace, dbPath: dbPathDelete });
-            if (!result.success) {
-                output.printError(result.error || 'Failed to delete');
-                return { success: false, exitCode: 1 };
+            const { deleteEntry } = await import('../memory/memory-initializer.js');
+            const paths = removalDbTargets(ctx.flags.path);
+            const stores = [];
+            for (const target of paths) {
+                const { dbPath } = target;
+                const entry = await deleteEntry({ key, namespace, ...target });
+                if (!entry.success)
+                    throw new Error(`${dbPath}: ${entry.error || 'Failed to delete'}`);
+                stores.push({ dbPath, ...entry });
             }
+            const result = {
+                success: true, key, namespace, stores,
+                deleted: stores.some(entry => entry.deleted),
+                remainingEntries: stores.reduce((total, entry) => total + entry.remainingEntries, 0),
+            };
             if (result.deleted) {
                 output.printSuccess(`Deleted "${key}" from namespace "${namespace}"`);
-                output.printInfo(`Remaining entries: ${result.remainingEntries}`);
+                output.printInfo(`Remaining entries across ${paths.length} store(s): ${result.remainingEntries}`);
             }
             else {
                 output.printWarning(`Key not found: "${key}" in namespace "${namespace}"`);
@@ -901,7 +929,7 @@ const deleteCommand = {
 // either interactive confirmation or --force.
 const purgeCommand = {
     name: 'purge',
-    description: 'Permanently delete every entry in a namespace (hard delete — not the soft delete/tombstone that `memory delete` uses)',
+    description: 'Permanently delete a namespace from the default store and its AgentDB mirror (use --path to select one store)',
     options: [
         {
             name: 'namespace',
@@ -939,17 +967,22 @@ const purgeCommand = {
             return { success: false, exitCode: 1 };
         }
         try {
-            const { listEntries, purgeNamespace, resolveDbPath: _rdbPurge } = await import('../memory/memory-initializer.js');
-            const resolvedDbPath = _rdbPurge(dbPath);
-            const preview = await listEntries({ namespace, limit: 1, dbPath: resolvedDbPath });
-            const previewCount = preview.total ?? preview.entries?.length ?? 0;
+            const { listEntries, purgeNamespace } = await import('../memory/memory-initializer.js');
+            const paths = removalDbTargets(dbPath);
+            let previewCount = 0;
+            for (const target of paths) {
+                const preview = await listEntries({ namespace, limit: 1, ...target });
+                if (!preview.success)
+                    throw new Error(`${target.dbPath}: ${preview.error || 'Failed to read purge target'}`);
+                previewCount += preview.total ?? preview.entries?.length ?? 0;
+            }
             if (dryRun) {
-                output.printInfo(`Would permanently delete ${previewCount} entr${previewCount === 1 ? 'y' : 'ies'} from namespace "${namespace}" (dry run — nothing deleted)`);
+                output.printInfo(`Would permanently delete ${previewCount} entr${previewCount === 1 ? 'y' : 'ies'} from namespace "${namespace}" across ${paths.length} store(s) (dry run — nothing deleted)`);
                 return { success: true, data: { namespace, wouldDelete: previewCount } };
             }
             if (!force && ctx.interactive) {
                 const confirmed = await confirm({
-                    message: `Permanently delete ${previewCount} entr${previewCount === 1 ? 'y' : 'ies'} from namespace "${namespace}"? This is a hard delete — not reversible with \`memory delete\`'s soft-undo.`,
+                    message: `Permanently delete ${previewCount} entr${previewCount === 1 ? 'y' : 'ies'} from namespace "${namespace}" across ${paths.length} store(s)? This is a hard delete — not reversible with \`memory delete\`'s soft-undo.`,
                     default: false
                 });
                 if (!confirmed) {
@@ -961,13 +994,20 @@ const purgeCommand = {
                 output.printError(`Refusing to purge namespace "${namespace}" without --force in non-interactive mode`);
                 return { success: false, exitCode: 1 };
             }
-            const result = await purgeNamespace({ namespace, dbPath: resolvedDbPath });
-            if (!result.success) {
-                output.printError(result.error || 'Failed to purge');
-                return { success: false, exitCode: 1 };
+            const stores = [];
+            for (const target of paths) {
+                const purged = await purgeNamespace({ namespace, ...target });
+                if (!purged.success)
+                    throw new Error(`${target.dbPath}: ${purged.error || 'Failed to purge'}`);
+                stores.push({ dbPath: target.dbPath, ...purged });
             }
+            const result = {
+                success: true, stores,
+                deletedCount: stores.reduce((total, store) => total + store.deletedCount, 0),
+                remainingEntries: stores.reduce((total, store) => total + store.remainingEntries, 0),
+            };
             output.printSuccess(`Purged ${result.deletedCount} entr${result.deletedCount === 1 ? 'y' : 'ies'} from namespace "${namespace}"`);
-            output.printInfo(`Remaining entries (all namespaces): ${result.remainingEntries}`);
+            output.printInfo(`Remaining entries (all namespaces, ${paths.length} store(s)): ${result.remainingEntries}`);
             return { success: true, data: result };
         }
         catch (error) {
@@ -984,8 +1024,16 @@ const statsCommand = {
     action: async (ctx) => {
         // Call MCP memory/stats tool for real statistics
         try {
-            const statsResult = await callMCPTool('memory_stats', {});
+            const dbPath = resolveDbPath(ctx.flags.path);
+            const statsResult = await callMCPTool('memory_stats', { dbPath });
+            if (statsResult.available === false) {
+                output.printError(`Failed to get stats: ${statsResult.error || 'Store unavailable'}`);
+                return { success: false, exitCode: 1 };
+            }
+            const unreadStore = await countSiblingStoreRows(dbPath);
             const stats = {
+                ...(unreadStore ? { unreadStore } : {}),
+                ...(statsResult.truncated ? { truncated: true } : {}),
                 backend: statsResult.backend,
                 entries: {
                     total: statsResult.totalEntries,
@@ -993,7 +1041,7 @@ const statsCommand = {
                     text: statsResult.totalEntries
                 },
                 storage: {
-                    total: statsResult.totalSize,
+                    total: statsResult.totalSize ?? 'unknown',
                     location: statsResult.location
                 },
                 version: statsResult.version,
@@ -1004,6 +1052,9 @@ const statsCommand = {
                 output.printJson(stats);
                 return { success: true, data: stats };
             }
+            if (unreadStore) {
+                output.printWarning(`${unreadStore.rows} entries are in ${unreadStore.path} and were not read here. Read them with --path ${unreadStore.path}.`);
+            }
             output.writeln();
             output.writeln(output.bold('Memory Statistics'));
             output.writeln();
@@ -1245,19 +1296,27 @@ const cleanupCommand = {
         { command: 'claude-flow memory cleanup --expired-only', description: 'Clean expired entries' }
     ],
     action: async (ctx) => {
-        const dryRun = ctx.flags.dryRun;
-        const force = ctx.flags.force;
+        const dryRun = ctx.flags.dryRun === true;
+        const force = ctx.flags.force === true;
+        if (ctx.flags.format === 'json' && !dryRun && !force) {
+            output.printJson({ success: false, error: 'Use --dry-run to preview or --force to authorize cleanup with --format json.' });
+            return { success: false, exitCode: 1 };
+        }
         if (dryRun) {
             output.writeln(output.warning('DRY RUN - No changes will be made'));
         }
         output.printInfo('Analyzing memory for cleanup...');
         try {
-            const result = await callMCPTool('memory_cleanup', {
-                dryRun,
+            const selectors = {
                 olderThan: ctx.flags.olderThan,
                 expiredOnly: ctx.flags.expiredOnly,
                 lowQualityThreshold: ctx.flags.lowQuality,
                 namespace: ctx.flags.namespace,
+            };
+            // Preview before asking: dryRun:false executes deletion inside the tool.
+            let result = await callMCPTool('memory_cleanup', {
+                ...selectors,
+                dryRun: dryRun || !force,
             });
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
@@ -1286,6 +1345,7 @@ const cleanupCommand = {
                     output.printInfo('Cleanup cancelled');
                     return { success: true, data: result };
                 }
+                result = await callMCPTool('memory_cleanup', { ...selectors, dryRun: false });
             }
             if (!dryRun) {
                 output.writeln();
@@ -1525,7 +1585,8 @@ const importCommand = {
             short: 'n',
             description: 'Import into specific namespace',
             type: 'string'
-        }
+        },
+        DB_PATH_OPTION
     ],
     examples: [
         { command: 'claude-flow memory import -i ./backup.json', description: 'Import from file' },
@@ -1543,6 +1604,7 @@ const importCommand = {
                 inputPath,
                 merge: ctx.flags.merge ?? true,
                 namespace: ctx.flags.namespace,
+                dbPath: resolveDbPath(ctx.flags.path),
             });
             output.printSuccess(`Imported from ${result.inputPath}`);
             output.printList([

package/v3/@claude-flow/cli/dist/src/commands/metaharness.js

@@ -279,6 +279,7 @@ export const metaharnessCommand = {
             'verbose', 'v',
             'quiet', 'q',
             'help', 'h',
+            'interactive', 'i', // CLI-only default; plugin scripts are non-interactive
         ]);
         // Parser normalizes kebab-case → camelCase (--per-dimension → perDimension).
         // Plugin scripts expect kebab-case at argv, so we re-kebab here.

package/v3/@claude-flow/cli/dist/src/commands/security.js

@@ -13,6 +13,7 @@ import { createBuiltinAIDefence } from '../security/builtin-aidefence.js';
 // for both validation and the traversal-depth maps below.
 const SCAN_DEPTHS = ['quick', 'standard', 'deep'];
 const SCAN_TYPES = ['code', 'deps', 'all'];
+const SCAN_OUTPUTS = ['text', 'json', 'sarif'];
 // Real type predicates, not `as` casts. Array.includes() does not narrow a
 // string to a literal union on its own, so without these the depth-map lookups
 // below need an unchecked assertion — and an unchecked assertion would let a
@@ -23,6 +24,37 @@ const SCAN_TYPES = ['code', 'deps', 'all'];
 // is being fixed for.
 const isScanDepth = (v) => SCAN_DEPTHS.includes(v);
 const isScanType = (v) => SCAN_TYPES.includes(v);
+const isScanOutput = (v) => SCAN_OUTPUTS.includes(v);
+function scanSarif(findings) {
+    const ruleId = (type) => `RUFLO-${type.toUpperCase().replace(/[^A-Z0-9]+/g, '-')}`;
+    const level = (severity) => severity === 'critical' || severity === 'high' ? 'error' :
+        severity === 'medium' ? 'warning' : 'note';
+    const rules = [...new Map(findings.map(finding => [finding.type, {
+                id: ruleId(finding.type),
+                name: finding.type,
+                shortDescription: { text: finding.type },
+            }])).values()];
+    return {
+        version: '2.1.0',
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        runs: [{
+                tool: { driver: { name: 'Ruflo Security Scan', rules } },
+                results: findings.map(finding => {
+                    const lineMatch = /^(.*):(\d+)$/.exec(finding.location);
+                    const file = lineMatch?.[1] ?? (finding.location.startsWith('package.json:') ? 'package.json' : finding.location);
+                    return {
+                        ruleId: ruleId(finding.type),
+                        level: level(finding.severity),
+                        message: { text: finding.description },
+                        locations: [{ physicalLocation: {
+                                    artifactLocation: { uri: file.replace(/\\/g, '/') },
+                                    ...(lineMatch ? { region: { startLine: Number(lineMatch[2]) } } : {}),
+                                } }],
+                    };
+                }),
+            }],
+    };
+}
 // `full` was never a supported depth, but the CLI itself printed it — the
 // statusline insight, the announcement, the release-notes blurb, the CLAUDE.md
 // that `init` generates, and two shipped agent definitions all tell people to
@@ -62,6 +94,7 @@ const scanCommand = {
         const target = ctx.flags.target || '.';
         const requestedDepth = ctx.flags.depth || 'standard';
         const scanType = ctx.flags.type || 'all';
+        const requestedOutput = ctx.flags.output || 'text';
         const fix = ctx.flags.fix;
         // A security scanner must never silently degrade on an unrecognised enum
         // value. An unknown --depth used to fall through to the shallowest
@@ -91,6 +124,11 @@ const scanCommand = {
             output.printError(`Invalid --type '${scanType}'. Expected one of: ${SCAN_TYPES.join(', ')}.`);
             return { success: false, exitCode: 1 };
         }
+        if (!isScanOutput(requestedOutput)) {
+            output.printError(`Invalid --output '${requestedOutput}'. Expected one of: ${SCAN_OUTPUTS.join(', ')}.`);
+            return { success: false, exitCode: 1 };
+        }
+        const outputFormat = requestedOutput;
         // --target names WHAT gets scanned, and was never validated. A path that
         // does not exist (or is a file, not a directory) made every phase read
         // nothing, and the swallowed dir-read catches turned that into zero
@@ -106,11 +144,14 @@ const scanCommand = {
             output.printError(`Target is not a directory: ${resolvedTarget}`);
             return { success: false, exitCode: 1 };
         }
-        output.writeln();
-        output.writeln(output.bold('Security Scan'));
-        output.writeln(output.dim('─'.repeat(50)));
+        if (outputFormat === 'text') {
+            output.writeln();
+            output.writeln(output.bold('Security Scan'));
+            output.writeln(output.dim('─'.repeat(50)));
+        }
         const spinner = output.createSpinner({ text: `Scanning ${target}...`, spinner: 'dots' });
-        spinner.start();
+        if (outputFormat === 'text')
+            spinner.start();
         const findings = [];
         let criticalCount = 0, highCount = 0, mediumCount = 0, lowCount = 0;
         try {
@@ -151,9 +192,9 @@ const scanCommand = {
                                     else
                                         lowCount++;
                                     findings.push({
-                                        severity: sev === 'critical' ? output.error('CRITICAL') :
-                                            sev === 'high' ? output.warning('HIGH') :
-                                                sev === 'moderate' || sev === 'medium' ? output.warning('MEDIUM') : output.info('LOW'),
+                                        severity: sev === 'critical' ? 'critical' :
+                                            sev === 'high' ? 'high' :
+                                                sev === 'moderate' || sev === 'medium' ? 'medium' : 'low',
                                         type: 'Dependency CVE',
                                         location: `package.json:${pkg}`,
                                         description: title.substring(0, 35),
@@ -206,7 +247,7 @@ const scanCommand = {
                                             if (pattern.test(lines[i])) {
                                                 highCount++;
                                                 findings.push({
-                                                    severity: output.warning('HIGH'),
+                                                    severity: 'high',
                                                     type: 'Hardcoded Secret',
                                                     location: `${path.relative(target, fullPath)}:${i + 1}`,
                                                     description: type,
@@ -261,7 +302,7 @@ const scanCommand = {
                                                 else
                                                     mediumCount++;
                                                 findings.push({
-                                                    severity: severity === 'high' ? output.warning('HIGH') : output.warning('MEDIUM'),
+                                                    severity: severity === 'high' ? 'high' : 'medium',
                                                     type,
                                                     location: `${path.relative(target, fullPath)}:${i + 1}`,
                                                     description: desc,
@@ -280,35 +321,57 @@ const scanCommand = {
                 const scanDepth = CODE_SCAN_DEPTH[depth];
                 scanCodeDir(path.resolve(target), scanDepth);
             }
-            spinner.succeed('Scan complete');
+            if (outputFormat === 'text')
+                spinner.succeed('Scan complete');
             // Display results
-            output.writeln();
-            if (findings.length > 0) {
-                output.printTable({
-                    columns: [
-                        { key: 'severity', header: 'Severity', width: 12 },
-                        { key: 'type', header: 'Type', width: 18 },
-                        { key: 'location', header: 'Location', width: 25 },
-                        { key: 'description', header: 'Description', width: 35 },
-                    ],
-                    data: findings.slice(0, 20), // Show first 20
-                });
-                if (findings.length > 20) {
-                    output.writeln(output.dim(`... and ${findings.length - 20} more issues`));
+            if (outputFormat === 'text') {
+                output.writeln();
+                if (findings.length > 0) {
+                    output.printTable({
+                        columns: [
+                            { key: 'severity', header: 'Severity', width: 12 },
+                            { key: 'type', header: 'Type', width: 18 },
+                            { key: 'location', header: 'Location', width: 25 },
+                            { key: 'description', header: 'Description', width: 35 },
+                        ],
+                        data: findings.slice(0, 20).map(finding => ({
+                            ...finding,
+                            severity: finding.severity === 'critical' ? output.error('CRITICAL') :
+                                finding.severity === 'high' ? output.warning('HIGH') :
+                                    finding.severity === 'medium' ? output.warning('MEDIUM') : output.info('LOW'),
+                        })), // Show first 20
+                    });
+                    if (findings.length > 20) {
+                        output.writeln(output.dim(`... and ${findings.length - 20} more issues`));
+                    }
                 }
+                else {
+                    output.writeln(output.success('No security issues found!'));
+                }
+                output.writeln();
+                output.printBox([
+                    `Target: ${target}`,
+                    `Depth: ${depth}`,
+                    `Type: ${scanType}`,
+                    ``,
+                    `Critical: ${criticalCount}  High: ${highCount}  Medium: ${mediumCount}  Low: ${lowCount}`,
+                    `Total Issues: ${findings.length}`,
+                ].join('\n'), 'Scan Summary');
             }
-            else {
-                output.writeln(output.success('No security issues found!'));
-            }
-            output.writeln();
-            output.printBox([
-                `Target: ${target}`,
-                `Depth: ${depth}`,
-                `Type: ${scanType}`,
-                ``,
-                `Critical: ${criticalCount}  High: ${highCount}  Medium: ${mediumCount}  Low: ${lowCount}`,
-                `Total Issues: ${findings.length}`,
-            ].join('\n'), 'Scan Summary');
+            const record = {
+                timestamp: new Date().toISOString(),
+                target,
+                depth,
+                type: scanType,
+                summary: {
+                    critical: criticalCount,
+                    high: highCount,
+                    medium: mediumCount,
+                    low: lowCount,
+                    total: findings.length,
+                },
+                findings,
+            };
             // Persist the scan result so downstream consumers (the statusline's
             // getSecurityStatus in funnel/local-signals.ts, which reads
             // `.claude/security-scans/*.json`) reflect real scan state. Best-effort:
@@ -316,20 +379,6 @@ const scanCommand = {
             try {
                 const scanDirOut = path.join(path.resolve(target), '.claude', 'security-scans');
                 fs.mkdirSync(scanDirOut, { recursive: true });
-                const record = {
-                    timestamp: new Date().toISOString(),
-                    target,
-                    depth,
-                    type: scanType,
-                    summary: {
-                        critical: criticalCount,
-                        high: highCount,
-                        medium: mediumCount,
-                        low: lowCount,
-                        total: findings.length,
-                    },
-                    findings,
-                };
                 // Deterministic name keyed on scan config so repeated runs overwrite
                 // rather than accumulate stale reports.
                 const outFile = path.join(scanDirOut, `scan-${scanType}-${depth}.json`);
@@ -340,24 +389,33 @@ const scanCommand = {
             }
             // Auto-fix if requested
             if (fix && criticalCount + highCount > 0) {
-                output.writeln();
+                if (outputFormat === 'text')
+                    output.writeln();
                 const fixSpinner = output.createSpinner({ text: 'Attempting to fix vulnerabilities...', spinner: 'dots' });
-                fixSpinner.start();
+                if (outputFormat === 'text')
+                    fixSpinner.start();
                 try {
                     try {
                         execSync('npm audit fix', { cwd: path.resolve(target), encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
                     }
                     catch { /* npm audit fix may exit non-zero */ }
-                    fixSpinner.succeed('Applied available fixes (run scan again to verify)');
+                    if (outputFormat === 'text')
+                        fixSpinner.succeed('Applied available fixes (run scan again to verify)');
                 }
                 catch {
-                    fixSpinner.fail('Some fixes could not be applied automatically');
+                    if (outputFormat === 'text')
+                        fixSpinner.fail('Some fixes could not be applied automatically');
                 }
             }
+            if (outputFormat === 'json')
+                output.printJson(record);
+            else if (outputFormat === 'sarif')
+                output.printJson(scanSarif(findings));
             return { success: findings.length === 0 || (criticalCount === 0 && highCount === 0) };
         }
         catch (error) {
-            spinner.fail('Scan failed');
+            if (outputFormat === 'text')
+                spinner.fail('Scan failed');
             output.printError(`Error: ${error}`);
             return { success: false };
         }
@@ -1039,7 +1097,7 @@ const defendCommand = {
                         medium: output.info,
                         low: output.dim,
                     }[threat.severity] || output.dim;
-                    output.writeln(`  ${severityColor(`[${threat.severity.toUpperCase()}]`)} ${threat.type}`);
+                    output.writeln(`  ${severityColor.call(output, `[${threat.severity.toUpperCase()}]`)} ${threat.type}`);
                     output.writeln(`    ${output.dim(threat.description)}`);
                     output.writeln(`    Confidence: ${(threat.confidence * 100).toFixed(1)}%`);
                     output.writeln();

package/v3/@claude-flow/cli/dist/src/commands/session.js

@@ -324,18 +324,18 @@ const restoreCommand = {
                 data: [
                     {
                         component: 'Memory',
-                        status: result.restored.memory ? output.success('Restored') : output.dim('Skipped'),
-                        count: result.stats.memoryEntriesRestored
+                        status: result.restoredComponents.memory ? output.success('Restored') : output.dim('Skipped'),
+                        count: result.restoredComponents.memory ? result.stats.memoryEntries : 0
                     },
                     {
                         component: 'Agents',
-                        status: result.restored.agents ? output.success('Restored') : output.dim('Skipped'),
-                        count: result.stats.agentsRestored
+                        status: result.restoredComponents.agents ? output.success('Restored') : output.dim('Skipped'),
+                        count: result.restoredComponents.agents ? result.stats.agents : 0
                     },
                     {
                         component: 'Tasks',
-                        status: result.restored.tasks ? output.success('Restored') : output.dim('Skipped'),
-                        count: result.stats.tasksRestored
+                        status: result.restoredComponents.tasks ? output.success('Restored') : output.dim('Skipped'),
+                        count: result.restoredComponents.tasks ? result.stats.tasks : 0
                     }
                 ]
             });

package/v3/@claude-flow/cli/dist/src/commands/task.js

@@ -154,7 +154,7 @@ const createCommand = {
                 type: taskType,
                 description,
                 priority: priority || 'normal',
-                assignedTo: ctx.flags.assign ? [ctx.flags.assign] : undefined,
+                assignTo: ctx.flags.assign ? String(ctx.flags.assign).split(',').map(id => id.trim()).filter(Boolean) : undefined,
                 parentId: ctx.flags.parent,
                 dependencies,
                 tags,
@@ -245,14 +245,15 @@ const listCommand = {
         }
     ],
     action: async (ctx) => {
-        const status = ctx.flags.all ? 'all' : ctx.flags.status || 'pending,running';
+        const requestedStatus = ctx.flags.all ? 'all' : ctx.flags.status || 'pending,in_progress';
+        const status = requestedStatus === 'all' ? undefined : requestedStatus.replace(/\brunning\b/g, 'in_progress');
         const limit = ctx.flags.limit;
         try {
             const result = await callMCPTool('task_list', {
                 status,
                 type: ctx.flags.type,
                 priority: ctx.flags.priority,
-                agentId: ctx.flags.agent,
+                assignedTo: ctx.flags.agent,
                 limit,
                 offset: 0
             });
@@ -277,7 +278,7 @@ const listCommand = {
                     { key: 'progress', header: 'Progress', width: 10 }
                 ],
                 data: result.tasks.map(t => ({
-                    id: t.id,
+                    id: t.taskId,
                     type: t.type,
                     description: t.description.length > 27
                         ? t.description.slice(0, 27) + '...'

package/v3/@claude-flow/cli/dist/src/init/helpers-generator.js

@@ -1005,12 +1005,14 @@ export function generateAutoMemoryHook() {
  */
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { join, dirname } from 'path';
+import { join, dirname, resolve } from 'path';
 import { fileURLToPath } from 'url';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
-const PROJECT_ROOT = join(__dirname, '../..');
+const PROJECT_ROOT = process.env.CLAUDE_PROJECT_DIR
+  ? resolve(process.env.CLAUDE_PROJECT_DIR)
+  : join(__dirname, '../..');
 const DATA_DIR = join(PROJECT_ROOT, '.claude-flow', 'data');
 const STORE_PATH = join(DATA_DIR, 'auto-memory-store.json');
 

package/v3/@claude-flow/cli/dist/src/mcp-server.js

@@ -27,6 +27,12 @@ import { fileURLToPath } from 'url';
 import { dirname } from 'path';
 import { trackRequest } from './mcp-tools/request-tracker.js';
 import { isPolicyEnforcementEnabled, loadMcpPolicy, evaluateToolCall, } from './mcp-tools/policy-enforcer.js';
+/** A failed task can be valid data; only an explicit error denotes tool failure. */
+function hasToolError(result) {
+    return result !== null && typeof result === 'object'
+        && typeof result.error === 'string'
+        && result.error.trim().length > 0;
+}
 // ESM-compatible __dirname
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -666,11 +672,12 @@ export class MCPServerManager extends EventEmitter {
                     }
                     try {
                         const result = await callMCPTool(toolName, toolParams, { sessionId });
-                        trackRequest(toolName, true);
+                        const isError = hasToolError(result);
+                        trackRequest(toolName, !isError);
                         return {
                             jsonrpc: '2.0',
                             id: message.id,
-                            result: { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] },
+                            result: { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }], isError },
                         };
                     }
                     catch (error) {
@@ -741,7 +748,7 @@ export class MCPServerManager extends EventEmitter {
             handler: async (input, context) => {
                 try {
                     const result = await callMCPTool(tool.name, input || {}, { sessionId: context?.sessionId || fallbackSessionId });
-                    trackRequest(tool.name, true);
+                    trackRequest(tool.name, !hasToolError(result));
                     return result;
                 }
                 catch (error) {