claude-flow 3.47.1 → 3.48.0

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.d.ts

@@ -205,7 +205,9 @@ export interface MemoryInitResult {
  * Ensure memory_entries table has all required columns
  * Adds missing columns for older databases (e.g., 'content' column)
  */
-export declare function ensureSchemaColumns(dbPath: string): Promise<{
+export declare function ensureSchemaColumns(dbPath: string, options?: {
+    encryptWrites?: boolean;
+}): Promise<{
     success: boolean;
     columnsAdded: string[];
     error?: string;
@@ -496,6 +498,8 @@ export declare function listEntries(options: {
     limit?: number;
     offset?: number;
     dbPath?: string;
+    /** Internal native-mirror writes must remain plaintext, including schema migration. */
+    encryptWrites?: boolean;
     /** #2073: When true, include the entry's full `content` string in each result. */
     includeContent?: boolean;
     /** ADR-323: restrict rows to these provenance types. */
@@ -549,6 +553,8 @@ export declare function deleteEntry(options: {
     key: string;
     namespace?: string;
     dbPath?: string;
+    /** Internal native-mirror writes must remain plaintext, including schema migration. */
+    encryptWrites?: boolean;
 }): Promise<{
     success: boolean;
     deleted: boolean;
@@ -573,6 +579,8 @@ export declare function withMemoryDbLock<T>(dbPath: string, fn: () => Promise<T>
 export declare function purgeNamespace(options: {
     namespace: string;
     dbPath?: string;
+    /** Internal native-mirror writes must remain plaintext, including schema migration. */
+    encryptWrites?: boolean;
 }): Promise<{
     success: boolean;
     deletedCount: number;

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js

@@ -8,6 +8,7 @@
  *
  * @module v3/cli/memory-initializer
  */
+import { liveMemoryRowSql } from './live-memory-row.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { AsyncLocalStorage } from 'node:async_hooks';
@@ -208,14 +209,14 @@ async function getBridge() {
  * missing better-sqlite3. Appending the recorded reason turns an unactionable
  * message into a diagnosis.
  */
-async function walRefusalError(operation) {
+async function walRefusalError(operation, bridgeDbPath) {
     const base = 'memory database has an active native WAL connection '
         + '(found -wal/-shm sidecar files) — refusing an unsafe sql.js '
         + `whole-image ${operation}. Retry once the native writer completes, or `
         + 'restore the native better-sqlite3 bridge.';
     try {
         const bridge = await getBridge();
-        const reason = bridge?.getBridgeFailureReason?.();
+        const reason = bridge?.getBridgeFailureReason?.(bridgeDbPath);
         if (reason)
             return `${base} Bridge unavailable: ${reason}`;
     }
@@ -1141,7 +1142,7 @@ INSERT OR IGNORE INTO vector_indexes (id, name, dimensions) VALUES
  * Ensure memory_entries table has all required columns
  * Adds missing columns for older databases (e.g., 'content' column)
  */
-export async function ensureSchemaColumns(dbPath) {
+export async function ensureSchemaColumns(dbPath, options = {}) {
     const columnsAdded = [];
     try {
         if (!fs.existsSync(dbPath)) {
@@ -1213,7 +1214,7 @@ export async function ensureSchemaColumns(dbPath) {
             if (modified) {
                 // Save updated database
                 const data = db.export();
-                writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
+                writeFileRestricted(dbPath, Buffer.from(data), { encrypt: options.encryptWrites ?? true });
             }
             db.close();
             return { success: true, columnsAdded };
@@ -1312,13 +1313,12 @@ async function activateControllerRegistry(verbose) {
         if (!bridge) {
             return { activated, failed, initTimeMs: performance.now() - startTime };
         }
-        const registry = await bridge.getControllerRegistry();
-        if (!registry) {
+        const controllers = await bridge.bridgeListControllers();
+        if (!controllers) {
             return { activated, failed, initTimeMs: performance.now() - startTime };
         }
         // Collect controller status from the registry
-        if (typeof registry.listControllers === 'function') {
-            const controllers = registry.listControllers();
+        if (controllers) {
             for (const ctrl of controllers) {
                 if (ctrl.enabled) {
                     activated.push(ctrl.name);
@@ -1879,7 +1879,7 @@ export async function checkMemoryInitialization(dbPath) {
         // Try to load with sql.js
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
-        const fileBuffer = fs.readFileSync(path_);
+        const fileBuffer = readFileMaybeEncrypted(path_, null);
         db = new SQL.Database(fileBuffer);
         // Check for metadata table
         const tables = db.exec("SELECT name FROM sqlite_master WHERE type='table'");
@@ -2579,7 +2579,7 @@ export async function storeEntry(options) {
             return {
                 success: false,
                 id: '',
-                error: await walRefusalError('write'),
+                error: await walRefusalError('write', options.dbPath),
             };
         }
         const id = `entry_${Date.now()}_${Math.random().toString(36).substring(7)}`;
@@ -2751,8 +2751,8 @@ export async function searchEntries(options) {
                     // query (no extra round-trip) so a provenance-filtered search
                     // still gets RaBitQ's speedup instead of falling back to brute
                     // force.
-                    const stmt = db.prepare('SELECT content, embedding, provenance_type FROM memory_entries WHERE id = ? AND status = ?');
-                    stmt.bind([candidate.id, 'active']);
+                    const stmt = db.prepare(`SELECT content, embedding, provenance_type FROM memory_entries WHERE id = ? AND ${liveMemoryRowSql()}`);
+                    stmt.bind([candidate.id]);
                     if (stmt.step()) {
                         const [content, embeddingJson, provenanceTypeVal] = stmt.get();
                         if (provenanceFilter?.length && !provenanceFilter.includes(provenanceTypeVal || 'unknown')) {
@@ -2812,29 +2812,28 @@ export async function searchEntries(options) {
                     const db = new SQL.Database(fileBuffer);
                     const provenanceByKey = new Map();
                     for (const r of filtered) {
-                        const stmt = db.prepare('SELECT provenance_type FROM memory_entries WHERE namespace = ? AND key = ? LIMIT 1');
+                        const stmt = db.prepare(`SELECT provenance_type FROM memory_entries WHERE namespace = ? AND key = ? AND ${liveMemoryRowSql()} LIMIT 1`);
                         stmt.bind([r.namespace, r.key]);
                         if (stmt.step()) {
-                            provenanceByKey.set(`${r.namespace}::${r.key}`, stmt.get()[0] || 'unknown');
+                            provenanceByKey.set(JSON.stringify([r.namespace, r.key]), stmt.get()[0] || 'unknown');
                         }
                         stmt.free();
                     }
                     db.close();
                     filtered = filtered
-                        .map(r => ({ ...r, provenanceType: provenanceByKey.get(`${r.namespace}::${r.key}`) || 'unknown' }));
+                        .filter(r => provenanceByKey.has(JSON.stringify([r.namespace, r.key])))
+                        .map(r => ({ ...r, provenanceType: provenanceByKey.get(JSON.stringify([r.namespace, r.key])) || 'unknown' }));
                     if (provenanceFilter?.length) {
                         filtered = filtered.filter(r => provenanceFilter.includes(r.provenanceType));
                     }
                 }
                 catch {
-                    // A requested trust filter fails closed. Unfiltered callers retain
-                    // backward-compatible results with an explicit unknown label.
-                    filtered = provenanceFilter?.length
-                        ? []
-                        : filtered.map(r => ({ ...r, provenanceType: 'unknown' }));
+                    // An ANN hit alone cannot prove the row is still live. Fall back
+                    // to the authoritative SQL scan if liveness cannot be checked.
+                    filtered = [];
                 }
             }
-            if (!provenanceFilter?.length || filtered.length >= limit) {
+            if (filtered.length >= limit) {
                 return {
                     success: true,
                     results: filtered.slice(0, limit),
@@ -2853,7 +2852,7 @@ export async function searchEntries(options) {
         // Get entries with embeddings
         // ADR-323: build the WHERE clause incrementally so namespace and
         // provenance filters compose (both, either, or neither).
-        const whereClauses = [`status = 'active'`];
+        const whereClauses = [liveMemoryRowSql()];
         const whereParams = [];
         if (effectiveNamespace !== 'all') {
             whereClauses.push('namespace = ?');
@@ -2980,8 +2979,14 @@ export async function listEntries(options) {
         if (!fs.existsSync(dbPath)) {
             return { success: false, entries: [], total: 0, error: 'Database not found' };
         }
+        // Listing can migrate/backfill the schema, so it is also a whole-image
+        // writer. The newly selected native mirror may still have a live WAL.
+        await releaseOwnNativeHandle(dbPath);
+        if (hasNativeWalSidecars(dbPath)) {
+            return { success: false, entries: [], total: 0, error: await walRefusalError('read/write') };
+        }
         // Ensure schema has all required columns (migration for older DBs)
-        await ensureSchemaColumns(dbPath);
+        await ensureSchemaColumns(dbPath, options);
         const initSqlJs = (await import('sql.js')).default;
         const SQL = await initSqlJs();
         const fileBuffer = readFileMaybeEncrypted(dbPath, null);
@@ -2990,7 +2995,7 @@ export async function listEntries(options) {
         // that predate the status column may have NULL after migration.
         // See memory-bridge.ts:bridgeListEntries for full context.
         // Get total count
-        const whereClauses = [ACTIVE_MEMORY_ROW_SQL];
+        const whereClauses = [liveMemoryRowSql()];
         const whereParams = [];
         if (namespace) {
             whereClauses.push('namespace = ?');
@@ -3088,7 +3093,7 @@ export async function getEntry(options) {
             return {
                 success: false,
                 found: false,
-                error: await walRefusalError('read/write'),
+                error: await walRefusalError('read/write', options.dbPath),
             };
         }
         // #2878: this is a mutator, not a reader — the access_count bump below
@@ -3107,7 +3112,7 @@ export async function getEntry(options) {
             const getStmt = db.prepare(`
         SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, tags
         FROM memory_entries
-        WHERE ${ACTIVE_MEMORY_ROW_SQL}
+        WHERE ${liveMemoryRowSql()}
           AND key = ?
           AND namespace = ?
         LIMIT 1
@@ -3211,14 +3216,14 @@ export async function deleteEntry(options) {
                 key,
                 namespace,
                 remainingEntries: 0,
-                error: await walRefusalError('write'),
+                error: await walRefusalError('write', options.dbPath),
             };
         }
         // #2878: whole-image read-modify-write — without the lock a concurrent
         // writer's flush resurrects the row this call just tombstoned.
         return await withMemoryDbLock(dbPath, async () => {
             // Ensure schema has all required columns (migration for older DBs)
-            await ensureSchemaColumns(dbPath);
+            await ensureSchemaColumns(dbPath, options);
             const initSqlJs = (await import('sql.js')).default;
             const SQL = await initSqlJs();
             const fileBuffer = readFileMaybeEncrypted(dbPath, null);
@@ -3268,7 +3273,7 @@ export async function deleteEntry(options) {
             const remainingEntries = countResult[0]?.values?.[0]?.[0] || 0;
             // Save updated database
             const data = db.export();
-            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
+            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: options.encryptWrites ?? true });
             db.close();
             // Clean up in-memory HNSW index so ghost vectors don't appear in searches.
             // Remove the entry from the HNSW entries map and invalidate the index.
@@ -3420,7 +3425,12 @@ export async function purgeNamespace(options) {
             if (!fs.existsSync(dbPath)) {
                 return { success: false, deletedCount: 0, remainingEntries: 0, error: 'Database not found' };
             }
-            await ensureSchemaColumns(dbPath);
+            // Recheck at mutation time even when the CLI already read a preview.
+            await releaseOwnNativeHandle(dbPath);
+            if (hasNativeWalSidecars(dbPath)) {
+                return { success: false, deletedCount: 0, remainingEntries: 0, error: await walRefusalError('write') };
+            }
+            await ensureSchemaColumns(dbPath, options);
             const initSqlJs = (await import('sql.js')).default;
             const SQL = await initSqlJs();
             const fileBuffer = readFileMaybeEncrypted(dbPath, null);
@@ -3431,7 +3441,7 @@ export async function purgeNamespace(options) {
             const countResult = db.exec(`SELECT COUNT(*) FROM memory_entries WHERE status = 'active'`);
             const remainingEntries = countResult[0]?.values?.[0]?.[0] || 0;
             const data = db.export();
-            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: true });
+            writeFileRestricted(dbPath, Buffer.from(data), { encrypt: options.encryptWrites ?? true });
             db.close();
             if (deletedCount > 0 && hnswIndex?.entries) {
                 for (const [id, entry] of hnswIndex.entries) {

package/v3/@claude-flow/cli/dist/src/ruvector/graph-analyzer.js

@@ -96,7 +96,10 @@ async function loadRuVector() {
 function extractImports(content, _filePath) {
     const imports = [];
     // ES6 import statements
-    const esImportRegex = /import\s+(?:(?:\{[^}]*\}|\*\s+as\s+\w+|\w+)\s*,?\s*)*\s*from\s*['"]([^'"]+)['"]/g;
+    // Keep the import clause's shape finite. Repeating an optional separator
+    // around alternatives lets ordinary prose such as "import one two three ..."
+    // backtrack exponentially when no `from` clause follows.
+    const esImportRegex = /\bimport\s+(?:type\s+)?(?:[\w$]+\s*,\s*)?(?:\{[^}]*\}|\*\s+as\s+[\w$]+|[\w$]+)\s+from\s*['"]([^'"]+)['"]/g;
     let match;
     while ((match = esImportRegex.exec(content)) !== null) {
         imports.push({ path: match[1], type: 'import' });

package/v3/@claude-flow/cli/dist/src/services/config-file-manager.js

@@ -80,12 +80,23 @@ export class ConfigFileManager {
         }
         try {
             const content = fs.readFileSync(this.configPath, 'utf-8');
-            this.config = JSON.parse(content);
+            const parsed = JSON.parse(content);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                throw new Error('Config file must contain a JSON object');
+            }
+            this.config = parsed;
             return this.config;
         }
-        catch {
+        catch (error) {
             this.config = null;
-            return null;
+            if (error.code === 'ENOENT') {
+                this.configPath = null;
+                return null;
+            }
+            // A parse/read failure is not a missing config. In particular, set()
+            // must never replace a recoverable file with fallback defaults.
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new Error(`Failed to load config ${this.configPath}: ${detail}`);
         }
     }
     /** Get the current config, loading if needed */
@@ -98,12 +109,23 @@ export class ConfigFileManager {
     /** Get a nested config value by dot-separated key */
     get(cwd, key) {
         const config = this.getConfig(cwd);
-        return getNestedValue(config, key);
+        return Object.hasOwn(config, key) ? config[key] : getNestedValue(config, key);
     }
     /** Set a nested config value by dot-separated key */
     set(cwd, key, value) {
-        const config = this.getConfig(cwd);
-        setNestedValue(config, key, value);
+        // Reject the entire path before touching cached config or disk.
+        if (key.split('.').some(part => part === '__proto__' || part === 'constructor' || part === 'prototype')) {
+            throw new Error(`Unsafe configuration key: ${key}`);
+        }
+        // A targeted update must not persist unrelated defaults (notably the
+        // default memory path, which would relocate an existing memory store).
+        const config = this.config ?? this.load(cwd) ?? {};
+        if (Object.hasOwn(config, key)) {
+            config[key] = value;
+        }
+        else {
+            setNestedValue(config, key, value);
+        }
         this.config = config;
         const targetPath = this.configPath ?? path.resolve(cwd, CONFIG_FILENAMES[0]);
         this.writeAtomic(targetPath, config);
@@ -181,7 +203,7 @@ function getNestedValue(obj, key) {
     const parts = key.split('.');
     let current = obj;
     for (const part of parts) {
-        if (current === null || current === undefined || typeof current !== 'object') {
+        if (current === null || current === undefined || typeof current !== 'object' || !Object.hasOwn(current, part)) {
             return undefined;
         }
         current = current[part];
@@ -194,7 +216,7 @@ function setNestedValue(obj, key, value) {
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];
-        if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
+        if (!Object.hasOwn(current, part) || typeof current[part] !== 'object' || current[part] === null) {
             current[part] = {};
         }
         current = current[part];

package/v3/@claude-flow/cli/dist/src/services/memory-backup.d.ts

@@ -25,7 +25,7 @@ export interface RestoreResult {
     restored: boolean;
     /** The backup file that was restored. */
     from?: string;
-    /** memory_entries count in the restored DB (-1 if it couldn't be verified). */
+    /** Verified memory_entries count in the restored DB. */
     rows?: number;
     /** Where the corrupt live DB was parked before the swap. */
     corruptBackupPath?: string;

package/v3/@claude-flow/cli/dist/src/services/memory-backup.js

@@ -14,6 +14,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import { readFileMaybeEncrypted } from '../fs-secure.js';
 export function defaultMemoryDbPath(cwd = process.cwd()) {
     return path.join(cwd, '.swarm', 'memory.db');
 }
@@ -21,6 +22,19 @@ export function defaultMemoryDbPath(cwd = process.cwd()) {
 function fileStamp(ms) {
     return new Date(ms).toISOString().replace(/[:.]/g, '-');
 }
+/** Keep legacy memory.db names; give every other basename its own snapshot set. */
+function snapshotPrefix(dbPath) {
+    const name = path.basename(dbPath);
+    // A distinct namespace prevents an extensionless `memory` database from
+    // colliding with the historical `memory.db` prefix. Encoding is injective
+    // within the nondefault namespace, including names that contain `%`.
+    return name === 'memory.db' ? 'memory-' : `store-${encodeURIComponent(name)}-`;
+}
+function isSnapshotFor(file, dbPath) {
+    const prefix = snapshotPrefix(dbPath);
+    return file.startsWith(prefix)
+        && /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z\.db$/.test(file.slice(prefix.length));
+}
 export async function backupMemoryDb(opts = {}) {
     const dbPath = opts.dbPath ?? defaultMemoryDbPath();
     if (!dbPath || !fs.existsSync(dbPath))
@@ -38,7 +52,7 @@ export async function backupMemoryDb(opts = {}) {
         fs.mkdirSync(destDir, { recursive: true });
     }
     catch { /* */ }
-    const destPath = path.join(destDir, `memory-${fileStamp(opts.timestamp ?? Date.now())}.db`);
+    const destPath = path.join(destDir, `${snapshotPrefix(dbPath)}${fileStamp(opts.timestamp ?? Date.now())}.db`);
     // WAL-safe online backup: read-only source, consistent snapshot to destPath.
     let db;
     try {
@@ -68,7 +82,7 @@ export async function backupMemoryDb(opts = {}) {
                 const keep = typeof opts.keep === 'number' && opts.keep > 0 ? opts.keep : 7;
                 const rotatedAway = [];
                 try {
-                    const snaps = fs.readdirSync(destDir).filter(f => /^memory-.*\.db$/.test(f)).sort();
+                    const snaps = fs.readdirSync(destDir).filter(f => isSnapshotFor(f, dbPath)).sort();
                     while (snaps.length > keep) {
                         const old = snaps.shift();
                         try {
@@ -107,7 +121,7 @@ export async function backupMemoryDb(opts = {}) {
     const keep = typeof opts.keep === 'number' && opts.keep > 0 ? opts.keep : 7;
     const rotatedAway = [];
     try {
-        const snaps = fs.readdirSync(destDir).filter(f => /^memory-.*\.db$/.test(f)).sort();
+        const snaps = fs.readdirSync(destDir).filter(f => isSnapshotFor(f, dbPath)).sort();
         while (snaps.length > keep) {
             const old = snaps.shift();
             try {
@@ -136,6 +150,48 @@ export async function backupMemoryDb(opts = {}) {
     }
     return { backedUp: true, path: destPath, sizeBytes, rotatedAway, gcsUri };
 }
+/** Verify a snapshot without modifying it, including RFE1 images and WASM-only hosts. */
+async function verifiedBackupRows(file, Database) {
+    if (Database) {
+        let db;
+        try {
+            db = new Database(file, { readonly: true });
+            if (String(db.pragma('integrity_check', { simple: true })).toLowerCase() !== 'ok')
+                return null;
+            const rows = Number(db.prepare('SELECT COUNT(*) AS c FROM memory_entries').get()?.c ?? 0);
+            return rows > 0 ? rows : null;
+        }
+        catch {
+            // Native SQLite cannot open encrypted RFE1 images. Verify the decrypted
+            // bytes below; a failed native open is never evidence of a good backup.
+        }
+        finally {
+            try {
+                db?.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    let db;
+    try {
+        const initSqlJs = (await import('sql.js')).default;
+        const SQL = await initSqlJs();
+        db = new SQL.Database(readFileMaybeEncrypted(file, null));
+        const integrity = db.exec('PRAGMA integrity_check')[0]?.values?.[0]?.[0];
+        const rows = Number(db.exec('SELECT COUNT(*) FROM memory_entries')[0]?.values?.[0]?.[0] ?? 0);
+        return String(integrity).toLowerCase() === 'ok' && rows > 0 ? rows : null;
+    }
+    catch {
+        // No verifier, wrong key, failed authentication, or invalid SQLite image.
+        return null;
+    }
+    finally {
+        try {
+            db?.close();
+        }
+        catch { /* best effort */ }
+    }
+}
 /**
  * Restore the newest integrity-ok backup over a corrupt/malformed memory DB
  * (issue #2584).
@@ -158,7 +214,7 @@ export async function restoreMemoryDbFromBackup(dbPath, opts = {}) {
     try {
         snaps = fs
             .readdirSync(destDir)
-            .filter(f => /^memory-.*\.db$/.test(f))
+            .filter(f => isSnapshotFor(f, dbPath))
             .map(f => path.join(destDir, f))
             .sort() // ISO-stamped names sort chronologically
             .reverse(); // newest first
@@ -168,39 +224,23 @@ export async function restoreMemoryDbFromBackup(dbPath, opts = {}) {
     }
     if (!snaps.length)
         return { restored: false, skipped: 'no-backups' };
-    // better-sqlite3 verifies a candidate's integrity. Absent (WASM-only host) →
-    // accept the newest non-empty snapshot, flagged rows=-1 (unverified).
+    // Prefer native verification for plaintext snapshots. sql.js verifies
+    // encrypted snapshots and provides the same checks on WASM-only hosts.
     let Database = null;
     try {
         const mod = 'better-sqlite3';
         Database = (await import(mod)).default;
     }
     catch {
-        /* verifier unavailable — trust newest non-empty */
+        /* use the sql.js verifier */
     }
     let chosen = null;
     for (const file of snaps) {
-        try {
-            if (Database) {
-                const db = new Database(file, { readonly: true });
-                const integ = String(db.pragma('integrity_check', { simple: true }) ?? '');
-                let rows = 0;
-                try {
-                    rows = db.prepare('SELECT COUNT(*) AS c FROM memory_entries').get()?.c ?? 0;
-                }
-                catch { /* no entries table — not a usable memory DB */ }
-                db.close();
-                if (integ.toLowerCase() === 'ok' && rows > 0) {
-                    chosen = { file, rows };
-                    break;
-                }
-            }
-            else if (fs.statSync(file).size > 0) {
-                chosen = { file, rows: -1 };
-                break;
-            }
+        const rows = await verifiedBackupRows(file, Database);
+        if (rows !== null) {
+            chosen = { file, rows };
+            break;
         }
-        catch { /* unreadable snapshot — try the next-older one */ }
     }
     if (!chosen)
         return { restored: false, skipped: 'no-integrity-ok-backup' };

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.d.ts

@@ -124,8 +124,8 @@ export declare class WorkerDaemon extends EventEmitter {
     static isWslEnvironment(): boolean;
     static getEffectiveCpuCount(): number;
     /**
-     * Read daemon-specific config from .claude-flow/config.{json,yaml,yml}.
-     * Supports dot-notation keys like 'daemon.resourceThresholds.maxCpuLoad'.
+     * Read daemon-specific config from CLI JSON paths or .claude-flow/config.{yaml,yml}.
+     * Supports dotted and nested keys like 'daemon.resourceThresholds.maxCpuLoad'.
      * #1844: prefer JSON when both exist (existing behavior) but fall back
      * to YAML so operators using the v3 canonical YAML format aren't silently
      * ignored. The chosen path (or a parse warning) is returned rather than

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js

@@ -10,6 +10,7 @@
  *   causal_edges (30 min interval, ADR-174; RUFLO_DAEMON_NO_DISTILL=1 / --no-distill to skip)
  * - testgaps: Test coverage analysis (20 min interval)
  */
+import { ConfigFileManager } from './config-file-manager.js';
 import { EventEmitter } from 'events';
 import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, unlinkSync } from 'fs';
 import { cpus } from 'os';
@@ -339,8 +340,8 @@ export class WorkerDaemon extends EventEmitter {
         return cpus().length || 1;
     }
     /**
-     * Read daemon-specific config from .claude-flow/config.{json,yaml,yml}.
-     * Supports dot-notation keys like 'daemon.resourceThresholds.maxCpuLoad'.
+     * Read daemon-specific config from CLI JSON paths or .claude-flow/config.{yaml,yml}.
+     * Supports dotted and nested keys like 'daemon.resourceThresholds.maxCpuLoad'.
      * #1844: prefer JSON when both exist (existing behavior) but fall back
      * to YAML so operators using the v3 canonical YAML format aren't silently
      * ignored. The chosen path (or a parse warning) is returned rather than
@@ -352,13 +353,14 @@ export class WorkerDaemon extends EventEmitter {
      * The caller logs these once `this.config` exists.
      */
     readDaemonConfigFromFile(claudeFlowDir) {
-        const jsonPath = join(claudeFlowDir, 'config.json');
+        // Share the CLI's JSON search order, including root and explicit config files.
+        const jsonPath = new ConfigFileManager().findConfig(join(claudeFlowDir, '..'));
         const yamlPath = join(claudeFlowDir, 'config.yaml');
         const ymlPath = join(claudeFlowDir, 'config.yml');
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         let raw;
         let chosenPath;
-        if (existsSync(jsonPath)) {
+        if (jsonPath) {
             try {
                 raw = JSON.parse(readFileSync(jsonPath, 'utf-8'));
                 chosenPath = jsonPath;
@@ -390,21 +392,28 @@ export class WorkerDaemon extends EventEmitter {
             return {};
         }
         try {
-            // Support both flat keys at root and nested under scopes.project
-            const cfg = raw?.scopes?.project ?? raw;
-            const rawCpuLoad = cfg['daemon.resourceThresholds.maxCpuLoad'] ?? raw['daemon.resourceThresholds.maxCpuLoad'];
-            const rawMinMem = cfg['daemon.resourceThresholds.minFreeMemoryPercent'] ?? raw['daemon.resourceThresholds.minFreeMemoryPercent'];
-            const rawMaxConcurrent = cfg['daemon.maxConcurrent'] ?? raw['daemon.maxConcurrent'];
-            const rawTimeout = cfg['daemon.workerTimeoutMs'] ?? raw['daemon.workerTimeoutMs'];
+            // The CLI writes nested objects; legacy files use dotted keys. Scoped
+            // values retain precedence, including explicit false and zero.
+            const read = (obj, key) => {
+                if (!obj)
+                    return undefined;
+                return obj[key] ?? key.split('.').reduce((value, part) => value && typeof value === 'object' && Object.hasOwn(value, part) ? value[part] : undefined, obj);
+            };
+            const get = (key) => read(raw?.scopes?.project, key) ?? read(raw, key);
+            const rawAutoStart = get('daemon.autoStart');
+            const rawCpuLoad = get('daemon.resourceThresholds.maxCpuLoad');
+            const rawMinMem = get('daemon.resourceThresholds.minFreeMemoryPercent');
+            const rawMaxConcurrent = get('daemon.maxConcurrent');
+            const rawTimeout = get('daemon.workerTimeoutMs');
             // #2356 — lifecycle limits are configured in SECONDS in config.json
             // (`daemon.ttlSecs` / `daemon.idleSecs`) for parity with the CLI flag
             // and env var; stored internally as ms. An explicit 0 disables.
-            const rawTtl = cfg['daemon.ttlSecs'] ?? raw['daemon.ttlSecs'];
-            const rawIdle = cfg['daemon.idleSecs'] ?? raw['daemon.idleSecs'];
+            const rawTtl = get('daemon.ttlSecs');
+            const rawIdle = get('daemon.idleSecs');
             // #2661 — explicit opt-in for scheduled AI workers.
-            const rawAiEnabled = cfg['daemon.aiWorkers.enabled'] ?? raw['daemon.aiWorkers.enabled'];
+            const rawAiEnabled = get('daemon.aiWorkers.enabled');
             return {
-                autoStart: typeof raw['daemon.autoStart'] === 'boolean' ? raw['daemon.autoStart'] : undefined,
+                autoStart: typeof rawAutoStart === 'boolean' ? rawAutoStart : undefined,
                 maxConcurrent: (typeof rawMaxConcurrent === 'number' && rawMaxConcurrent > 0) ? rawMaxConcurrent : undefined,
                 workerTimeoutMs: (typeof rawTimeout === 'number' && rawTimeout > 0) ? rawTimeout : undefined,
                 maxCpuLoad: (typeof rawCpuLoad === 'number' && rawCpuLoad > 0 && rawCpuLoad < 1000) ? rawCpuLoad : undefined,

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.47.1",
+  "version": "3.48.0",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -98,13 +98,13 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@claude-flow/cli-core": "3.7.0-alpha.6",
+    "@claude-flow/cli-core": "3.7.0",
     "@claude-flow/codex": "3.0.3",
-    "@claude-flow/mcp": "3.0.0-alpha.10",
-    "@claude-flow/neural": "3.0.0-alpha.10",
-    "@claude-flow/plugin-agent-federation": "1.0.0-alpha.18",
-    "@claude-flow/security": "3.0.0-alpha.14",
-    "@claude-flow/shared": "3.0.0-alpha.7",
+    "@claude-flow/mcp": "3.0.0",
+    "@claude-flow/neural": "3.0.0",
+    "@claude-flow/plugin-agent-federation": "1.0.0",
+    "@claude-flow/security": "3.0.0",
+    "@claude-flow/shared": "3.0.0",
     "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
     "@ruvector/rabitq-wasm": "0.1.0",
@@ -125,11 +125,11 @@
     "ws": "^8.21.0",
     "yaml": "^2.8.0",
     "zod": "^3.22.0",
-    "@claude-flow/memory": "3.0.0-alpha.26"
+    "@claude-flow/memory": "3.0.0"
   },
   "optionalDependencies": {
     "@agntcy/slim-bindings": "2.0.0-alpha.5",
-    "@claude-flow/memory": "3.0.0-alpha.26",
+    "@claude-flow/memory": "3.0.0",
     "@metaharness/darwin": "~0.10.2",
     "@metaharness/flywheel": "~0.1.10",
     "@metaharness/radio": "~0.1.0",