claude-flow 3.47.1 → 3.49.0

package/v3/@claude-flow/cli/dist/src/commands/security.js

@@ -13,6 +13,7 @@ import { createBuiltinAIDefence } from '../security/builtin-aidefence.js';
 // for both validation and the traversal-depth maps below.
 const SCAN_DEPTHS = ['quick', 'standard', 'deep'];
 const SCAN_TYPES = ['code', 'deps', 'all'];
+const SCAN_OUTPUTS = ['text', 'json', 'sarif'];
 // Real type predicates, not `as` casts. Array.includes() does not narrow a
 // string to a literal union on its own, so without these the depth-map lookups
 // below need an unchecked assertion — and an unchecked assertion would let a
@@ -23,6 +24,37 @@ const SCAN_TYPES = ['code', 'deps', 'all'];
 // is being fixed for.
 const isScanDepth = (v) => SCAN_DEPTHS.includes(v);
 const isScanType = (v) => SCAN_TYPES.includes(v);
+const isScanOutput = (v) => SCAN_OUTPUTS.includes(v);
+function scanSarif(findings) {
+    const ruleId = (type) => `RUFLO-${type.toUpperCase().replace(/[^A-Z0-9]+/g, '-')}`;
+    const level = (severity) => severity === 'critical' || severity === 'high' ? 'error' :
+        severity === 'medium' ? 'warning' : 'note';
+    const rules = [...new Map(findings.map(finding => [finding.type, {
+                id: ruleId(finding.type),
+                name: finding.type,
+                shortDescription: { text: finding.type },
+            }])).values()];
+    return {
+        version: '2.1.0',
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        runs: [{
+                tool: { driver: { name: 'Ruflo Security Scan', rules } },
+                results: findings.map(finding => {
+                    const lineMatch = /^(.*):(\d+)$/.exec(finding.location);
+                    const file = lineMatch?.[1] ?? (finding.location.startsWith('package.json:') ? 'package.json' : finding.location);
+                    return {
+                        ruleId: ruleId(finding.type),
+                        level: level(finding.severity),
+                        message: { text: finding.description },
+                        locations: [{ physicalLocation: {
+                                    artifactLocation: { uri: file.replace(/\\/g, '/') },
+                                    ...(lineMatch ? { region: { startLine: Number(lineMatch[2]) } } : {}),
+                                } }],
+                    };
+                }),
+            }],
+    };
+}
 // `full` was never a supported depth, but the CLI itself printed it — the
 // statusline insight, the announcement, the release-notes blurb, the CLAUDE.md
 // that `init` generates, and two shipped agent definitions all tell people to
@@ -62,6 +94,7 @@ const scanCommand = {
         const target = ctx.flags.target || '.';
         const requestedDepth = ctx.flags.depth || 'standard';
         const scanType = ctx.flags.type || 'all';
+        const requestedOutput = ctx.flags.output || 'text';
         const fix = ctx.flags.fix;
         // A security scanner must never silently degrade on an unrecognised enum
         // value. An unknown --depth used to fall through to the shallowest
@@ -91,6 +124,11 @@ const scanCommand = {
             output.printError(`Invalid --type '${scanType}'. Expected one of: ${SCAN_TYPES.join(', ')}.`);
             return { success: false, exitCode: 1 };
         }
+        if (!isScanOutput(requestedOutput)) {
+            output.printError(`Invalid --output '${requestedOutput}'. Expected one of: ${SCAN_OUTPUTS.join(', ')}.`);
+            return { success: false, exitCode: 1 };
+        }
+        const outputFormat = requestedOutput;
         // --target names WHAT gets scanned, and was never validated. A path that
         // does not exist (or is a file, not a directory) made every phase read
         // nothing, and the swallowed dir-read catches turned that into zero
@@ -106,11 +144,14 @@ const scanCommand = {
             output.printError(`Target is not a directory: ${resolvedTarget}`);
             return { success: false, exitCode: 1 };
         }
-        output.writeln();
-        output.writeln(output.bold('Security Scan'));
-        output.writeln(output.dim('─'.repeat(50)));
+        if (outputFormat === 'text') {
+            output.writeln();
+            output.writeln(output.bold('Security Scan'));
+            output.writeln(output.dim('─'.repeat(50)));
+        }
         const spinner = output.createSpinner({ text: `Scanning ${target}...`, spinner: 'dots' });
-        spinner.start();
+        if (outputFormat === 'text')
+            spinner.start();
         const findings = [];
         let criticalCount = 0, highCount = 0, mediumCount = 0, lowCount = 0;
         try {
@@ -151,9 +192,9 @@ const scanCommand = {
                                     else
                                         lowCount++;
                                     findings.push({
-                                        severity: sev === 'critical' ? output.error('CRITICAL') :
-                                            sev === 'high' ? output.warning('HIGH') :
-                                                sev === 'moderate' || sev === 'medium' ? output.warning('MEDIUM') : output.info('LOW'),
+                                        severity: sev === 'critical' ? 'critical' :
+                                            sev === 'high' ? 'high' :
+                                                sev === 'moderate' || sev === 'medium' ? 'medium' : 'low',
                                         type: 'Dependency CVE',
                                         location: `package.json:${pkg}`,
                                         description: title.substring(0, 35),
@@ -206,7 +247,7 @@ const scanCommand = {
                                             if (pattern.test(lines[i])) {
                                                 highCount++;
                                                 findings.push({
-                                                    severity: output.warning('HIGH'),
+                                                    severity: 'high',
                                                     type: 'Hardcoded Secret',
                                                     location: `${path.relative(target, fullPath)}:${i + 1}`,
                                                     description: type,
@@ -261,7 +302,7 @@ const scanCommand = {
                                                 else
                                                     mediumCount++;
                                                 findings.push({
-                                                    severity: severity === 'high' ? output.warning('HIGH') : output.warning('MEDIUM'),
+                                                    severity: severity === 'high' ? 'high' : 'medium',
                                                     type,
                                                     location: `${path.relative(target, fullPath)}:${i + 1}`,
                                                     description: desc,
@@ -280,35 +321,57 @@ const scanCommand = {
                 const scanDepth = CODE_SCAN_DEPTH[depth];
                 scanCodeDir(path.resolve(target), scanDepth);
             }
-            spinner.succeed('Scan complete');
+            if (outputFormat === 'text')
+                spinner.succeed('Scan complete');
             // Display results
-            output.writeln();
-            if (findings.length > 0) {
-                output.printTable({
-                    columns: [
-                        { key: 'severity', header: 'Severity', width: 12 },
-                        { key: 'type', header: 'Type', width: 18 },
-                        { key: 'location', header: 'Location', width: 25 },
-                        { key: 'description', header: 'Description', width: 35 },
-                    ],
-                    data: findings.slice(0, 20), // Show first 20
-                });
-                if (findings.length > 20) {
-                    output.writeln(output.dim(`... and ${findings.length - 20} more issues`));
+            if (outputFormat === 'text') {
+                output.writeln();
+                if (findings.length > 0) {
+                    output.printTable({
+                        columns: [
+                            { key: 'severity', header: 'Severity', width: 12 },
+                            { key: 'type', header: 'Type', width: 18 },
+                            { key: 'location', header: 'Location', width: 25 },
+                            { key: 'description', header: 'Description', width: 35 },
+                        ],
+                        data: findings.slice(0, 20).map(finding => ({
+                            ...finding,
+                            severity: finding.severity === 'critical' ? output.error('CRITICAL') :
+                                finding.severity === 'high' ? output.warning('HIGH') :
+                                    finding.severity === 'medium' ? output.warning('MEDIUM') : output.info('LOW'),
+                        })), // Show first 20
+                    });
+                    if (findings.length > 20) {
+                        output.writeln(output.dim(`... and ${findings.length - 20} more issues`));
+                    }
                 }
+                else {
+                    output.writeln(output.success('No security issues found!'));
+                }
+                output.writeln();
+                output.printBox([
+                    `Target: ${target}`,
+                    `Depth: ${depth}`,
+                    `Type: ${scanType}`,
+                    ``,
+                    `Critical: ${criticalCount}  High: ${highCount}  Medium: ${mediumCount}  Low: ${lowCount}`,
+                    `Total Issues: ${findings.length}`,
+                ].join('\n'), 'Scan Summary');
             }
-            else {
-                output.writeln(output.success('No security issues found!'));
-            }
-            output.writeln();
-            output.printBox([
-                `Target: ${target}`,
-                `Depth: ${depth}`,
-                `Type: ${scanType}`,
-                ``,
-                `Critical: ${criticalCount}  High: ${highCount}  Medium: ${mediumCount}  Low: ${lowCount}`,
-                `Total Issues: ${findings.length}`,
-            ].join('\n'), 'Scan Summary');
+            const record = {
+                timestamp: new Date().toISOString(),
+                target,
+                depth,
+                type: scanType,
+                summary: {
+                    critical: criticalCount,
+                    high: highCount,
+                    medium: mediumCount,
+                    low: lowCount,
+                    total: findings.length,
+                },
+                findings,
+            };
             // Persist the scan result so downstream consumers (the statusline's
             // getSecurityStatus in funnel/local-signals.ts, which reads
             // `.claude/security-scans/*.json`) reflect real scan state. Best-effort:
@@ -316,20 +379,6 @@ const scanCommand = {
             try {
                 const scanDirOut = path.join(path.resolve(target), '.claude', 'security-scans');
                 fs.mkdirSync(scanDirOut, { recursive: true });
-                const record = {
-                    timestamp: new Date().toISOString(),
-                    target,
-                    depth,
-                    type: scanType,
-                    summary: {
-                        critical: criticalCount,
-                        high: highCount,
-                        medium: mediumCount,
-                        low: lowCount,
-                        total: findings.length,
-                    },
-                    findings,
-                };
                 // Deterministic name keyed on scan config so repeated runs overwrite
                 // rather than accumulate stale reports.
                 const outFile = path.join(scanDirOut, `scan-${scanType}-${depth}.json`);
@@ -340,24 +389,33 @@ const scanCommand = {
             }
             // Auto-fix if requested
             if (fix && criticalCount + highCount > 0) {
-                output.writeln();
+                if (outputFormat === 'text')
+                    output.writeln();
                 const fixSpinner = output.createSpinner({ text: 'Attempting to fix vulnerabilities...', spinner: 'dots' });
-                fixSpinner.start();
+                if (outputFormat === 'text')
+                    fixSpinner.start();
                 try {
                     try {
                         execSync('npm audit fix', { cwd: path.resolve(target), encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
                     }
                     catch { /* npm audit fix may exit non-zero */ }
-                    fixSpinner.succeed('Applied available fixes (run scan again to verify)');
+                    if (outputFormat === 'text')
+                        fixSpinner.succeed('Applied available fixes (run scan again to verify)');
                 }
                 catch {
-                    fixSpinner.fail('Some fixes could not be applied automatically');
+                    if (outputFormat === 'text')
+                        fixSpinner.fail('Some fixes could not be applied automatically');
                 }
             }
+            if (outputFormat === 'json')
+                output.printJson(record);
+            else if (outputFormat === 'sarif')
+                output.printJson(scanSarif(findings));
             return { success: findings.length === 0 || (criticalCount === 0 && highCount === 0) };
         }
         catch (error) {
-            spinner.fail('Scan failed');
+            if (outputFormat === 'text')
+                spinner.fail('Scan failed');
             output.printError(`Error: ${error}`);
             return { success: false };
         }
@@ -1039,7 +1097,7 @@ const defendCommand = {
                         medium: output.info,
                         low: output.dim,
                     }[threat.severity] || output.dim;
-                    output.writeln(`  ${severityColor(`[${threat.severity.toUpperCase()}]`)} ${threat.type}`);
+                    output.writeln(`  ${severityColor.call(output, `[${threat.severity.toUpperCase()}]`)} ${threat.type}`);
                     output.writeln(`    ${output.dim(threat.description)}`);
                     output.writeln(`    Confidence: ${(threat.confidence * 100).toFixed(1)}%`);
                     output.writeln();

package/v3/@claude-flow/cli/dist/src/commands/session.js

@@ -28,6 +28,33 @@ function formatDate(dateStr) {
     // Otherwise show date
     return date.toLocaleDateString() + ' ' + date.toLocaleTimeString();
 }
+/**
+ * #3575: the session MCP tools report failure as `{ error }` (or
+ * `success: false`) rather than throwing, so every call site must check before
+ * printing a success line or reading result fields.
+ */
+function toolError(result) {
+    if (!result || typeof result !== 'object')
+        return 'the tool returned no result';
+    const r = result;
+    if (typeof r.error === 'string' && r.error.length > 0)
+        return r.error;
+    if (r.success === false)
+        return 'the operation failed';
+    return null;
+}
+/** #3573: say what happened to memory instead of printing an invented 0. */
+function memoryCaptureLabel(capture, fallback) {
+    if (!capture)
+        return fallback ?? 'unknown';
+    if (!capture.requested)
+        return 'not included';
+    if (capture.status === 'error')
+        return `not captured (${capture.error || 'error'})`;
+    if (capture.status === 'no-store')
+        return '0 (no memory store found)';
+    return capture.entries;
+}
 // Format session status
 function formatStatus(status) {
     switch (status) {
@@ -186,6 +213,12 @@ const saveCommand = {
                 includeAgents: ctx.flags['include-agents'] !== false,
                 includeTasks: ctx.flags['include-tasks'] !== false
             });
+            const failure = toolError(result);
+            if (failure) {
+                spinner.fail('Failed to save session');
+                output.printError(failure);
+                return { success: false, exitCode: 1 };
+            }
             spinner.succeed('Session saved');
             output.writeln();
             const stats = result.stats || {};
@@ -201,10 +234,13 @@ const saveCommand = {
                     { property: 'Saved At', value: new Date(result.savedAt).toLocaleString() },
                     { property: 'Agents', value: stats.agentCount ?? stats.agents ?? 0 },
                     { property: 'Tasks', value: stats.taskCount ?? stats.tasks ?? 0 },
-                    { property: 'Memory Entries', value: stats.memoryEntries ?? 0 },
+                    { property: 'Memory Entries', value: memoryCaptureLabel(result.memoryCapture, stats.memoryEntries) },
                     { property: 'Total Size', value: formatSize(stats.totalSize ?? 0) }
                 ]
             });
+            if (result.memoryCapture?.status === 'error') {
+                output.printWarning(`Memory was requested but could not be captured: ${result.memoryCapture.error}`);
+            }
             output.writeln();
             output.printSuccess(`Session saved: ${result.sessionId}`);
             output.printInfo(`Restore with: claude-flow session restore ${result.sessionId}`);
@@ -313,8 +349,25 @@ const restoreCommand = {
                 restoreAgents,
                 restoreTasks
             });
-            spinner.succeed('Session restored');
+            const failure = toolError(result) ?? (result.restored === false ? 'Session not found' : null);
+            if (failure) {
+                spinner.fail('Failed to restore session');
+                output.printError(failure);
+                return { success: false, exitCode: 1 };
+            }
+            const memoryRestore = result.memoryRestore;
+            const memoryPartial = !!memoryRestore && memoryRestore.failed > 0;
+            if (memoryPartial) {
+                spinner.fail('Session restored with memory errors');
+            }
+            else {
+                spinner.succeed('Session restored');
+            }
             output.writeln();
+            // #3573: distinguish "not requested" from "the session holds no memory".
+            const memoryStatus = result.restoredComponents.memory
+                ? (memoryPartial ? output.error('Partial') : output.success('Restored'))
+                : restoreMemory ? output.dim('Not in session') : output.dim('Skipped');
             output.printTable({
                 columns: [
                     { key: 'component', header: 'Component', width: 20 },
@@ -324,27 +377,37 @@ const restoreCommand = {
                 data: [
                     {
                         component: 'Memory',
-                        status: result.restored.memory ? output.success('Restored') : output.dim('Skipped'),
-                        count: result.stats.memoryEntriesRestored
+                        status: memoryStatus,
+                        count: result.restoredComponents.memory
+                            ? (result.stats.memoryEntriesRestored ?? result.stats.memoryEntries)
+                            : 0
                     },
                     {
                         component: 'Agents',
-                        status: result.restored.agents ? output.success('Restored') : output.dim('Skipped'),
-                        count: result.stats.agentsRestored
+                        status: result.restoredComponents.agents ? output.success('Restored') : output.dim('Skipped'),
+                        count: result.restoredComponents.agents ? result.stats.agents : 0
                     },
                     {
                         component: 'Tasks',
-                        status: result.restored.tasks ? output.success('Restored') : output.dim('Skipped'),
-                        count: result.stats.tasksRestored
+                        status: result.restoredComponents.tasks ? output.success('Restored') : output.dim('Skipped'),
+                        count: result.restoredComponents.tasks ? result.stats.tasks : 0
                     }
                 ]
             });
             output.writeln();
-            output.printSuccess(`Session ${sessionId} restored successfully`);
+            if (memoryPartial) {
+                output.printWarning(`${memoryRestore.failed} memory entries could not be restored` +
+                    (memoryRestore.errors.length ? `: ${memoryRestore.errors.join('; ')}` : ''));
+            }
+            else {
+                output.printSuccess(`Session ${sessionId} restored successfully`);
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
             }
-            return { success: true, data: result };
+            return memoryPartial
+                ? { success: false, exitCode: 1, data: result }
+                : { success: true, data: result };
         }
         catch (error) {
             spinner.fail('Failed to restore session');
@@ -391,6 +454,11 @@ const deleteCommand = {
         }
         try {
             const result = await callMCPTool('session_delete', { sessionId });
+            const failure = toolError(result) ?? (result.deleted === false ? 'Session not found' : null);
+            if (failure) {
+                output.printError(`Failed to delete session: ${failure}`);
+                return { success: false, exitCode: 1 };
+            }
             output.writeln();
             output.printSuccess(`Session ${sessionId} deleted`);
             if (ctx.flags.format === 'json') {
@@ -412,7 +480,7 @@ const deleteCommand = {
 // Export subcommand
 const exportCommand = {
     name: 'export',
-    description: 'Export session to file',
+    description: 'Export a saved session to a file. Usage: session export <session-id> [-o file] (or --latest)',
     options: [
         {
             name: 'output',
@@ -420,6 +488,12 @@ const exportCommand = {
             description: 'Output file path',
             type: 'string'
         },
+        {
+            name: 'latest',
+            description: 'Export the most recently saved session when no session id is given',
+            type: 'boolean',
+            default: false
+        },
         {
             name: 'format',
             short: 'f',
@@ -446,14 +520,23 @@ const exportCommand = {
         let outputPath = ctx.flags.output;
         const exportFormat = ctx.flags.format;
         const compress = ctx.flags.compress;
-        // Get current session if no ID provided
+        // #3575: like `session delete`, refuse to guess which session to act on.
+        // Exporting the most recent one is available, but only when asked for.
         if (!sessionId) {
+            if (!ctx.flags.latest) {
+                output.printError('Session ID is required. Pass a session id, or --latest to export the most recently saved session.');
+                return { success: false, exitCode: 1 };
+            }
             try {
                 const current = await callMCPTool('session_current', {});
+                if (toolError(current) || !current.sessionId) {
+                    output.printError('No saved sessions to export.');
+                    return { success: false, exitCode: 1 };
+                }
                 sessionId = current.sessionId;
             }
             catch {
-                output.printError('No active session. Provide a session ID to export.');
+                output.printError('No saved sessions to export.');
                 return { success: false, exitCode: 1 };
             }
         }
@@ -469,6 +552,12 @@ const exportCommand = {
                 sessionId,
                 includeMemory: ctx.flags['include-memory'] !== false
             });
+            const failure = toolError(result);
+            if (failure || result.data === undefined) {
+                spinner.fail('Failed to export session');
+                output.printError(failure || 'The export returned no session data');
+                return { success: false, exitCode: 1 };
+            }
             // Format output
             let content;
             if (exportFormat === 'yaml') {
@@ -484,7 +573,8 @@ const exportCommand = {
             fs.writeFileSync(absolutePath, content, 'utf-8');
             spinner.succeed('Session exported');
             output.writeln();
-            const exportStats = result.stats || {};
+            // session_export returns the whole record under `data`; its stats live there.
+            const exportStats = result.stats || result.data?.stats || {};
             output.printTable({
                 columns: [
                     { key: 'property', header: 'Property', width: 18 },
@@ -522,7 +612,7 @@ const exportCommand = {
 // Import subcommand
 const importCommand = {
     name: 'import',
-    description: 'Import session from file',
+    description: 'Import a session from a file written by session export. Usage: session import <file> [--name n] [--activate]',
     options: [
         {
             name: 'name',
@@ -555,21 +645,32 @@ const importCommand = {
         const spinner = output.createSpinner({ text: 'Importing session...' });
         spinner.start();
         try {
-            const content = fs.readFileSync(absolutePath, 'utf-8');
-            let data;
-            // Parse based on extension
+            // The YAML written by `session export --format yaml` is display-only;
+            // there is no YAML parser here, so say so instead of failing obscurely.
             if (absolutePath.endsWith('.yaml') || absolutePath.endsWith('.yml')) {
-                // Simple YAML parsing (basic implementation)
-                data = JSON.parse(content); // Would need proper YAML parser
-            }
-            else {
-                data = JSON.parse(content);
+                try {
+                    JSON.parse(fs.readFileSync(absolutePath, 'utf-8'));
+                }
+                catch {
+                    spinner.fail('Failed to import session');
+                    output.printError('YAML session import is not supported. Export with --format json and import that file.');
+                    return { success: false, exitCode: 1 };
+                }
             }
+            // #3575: session_import reads the file itself from `inputPath`. Passing a
+            // parsed `data` object used to hit its required-argument check, and the
+            // CLI then printed "Session imported" before crashing on the error result.
             const result = await callMCPTool('session_import', {
-                data,
+                inputPath: absolutePath,
                 name: sessionName,
                 activate
             });
+            const failure = toolError(result);
+            if (failure) {
+                spinner.fail('Failed to import session');
+                output.printError(failure);
+                return { success: false, exitCode: 1 };
+            }
             spinner.succeed('Session imported');
             output.writeln();
             output.printTable({
@@ -619,6 +720,11 @@ const currentCommand = {
     action: async (ctx) => {
         try {
             const result = await callMCPTool('session_current', { includeStats: true });
+            if (toolError(result)) {
+                output.printWarning('No active session');
+                output.printInfo('Save one with "claude-flow session save"');
+                return { success: true, data: { active: false } };
+            }
             if (ctx.flags.format === 'json') {
                 output.printJson(result);
                 return { success: true, data: result };
@@ -727,7 +833,8 @@ export const sessionCommand = {
         { command: 'claude-flow session save -n "checkpoint-1"', description: 'Save current session' },
         { command: 'claude-flow session restore session-123', description: 'Restore a session' },
         { command: 'claude-flow session delete session-123', description: 'Delete a session' },
-        { command: 'claude-flow session export -o backup.json', description: 'Export session to file' },
+        { command: 'claude-flow session export session-123 -o backup.json', description: 'Export a session to file' },
+        { command: 'claude-flow session export --latest -o backup.json', description: 'Export the most recently saved session' },
         { command: 'claude-flow session import backup.json', description: 'Import session from file' },
         { command: 'claude-flow session current', description: 'Show current session' }
     ],

package/v3/@claude-flow/cli/dist/src/commands/swarm.js

@@ -196,17 +196,14 @@ function getSwarmStatus(swarmId) {
             // Ignore
         }
     }
-    // Calculate dynamic progress based on actual state
-    // If no swarm state, show 0%. Otherwise calculate from completed tasks
+    // Progress is completed / total tasks. With no tasks there is nothing to be
+    // a fraction of, so it is `null` with a reason — never an invented number
+    // (#3572: a hard-coded 5% was shown for a swarm with no tasks, forever).
     const totalTasks = completedTasks + inProgressTasks + pendingTasks;
-    let progress = 0;
-    if (totalTasks > 0) {
-        progress = Math.round((completedTasks / totalTasks) * 100);
-    }
-    else if (swarmState) {
-        // Swarm initialized but no tasks yet
-        progress = 5;
-    }
+    const progress = totalTasks > 0
+        ? Math.round((completedTasks / totalTasks) * 100)
+        : null;
+    const progressReason = totalTasks > 0 ? null : 'no tasks';
     // Determine status
     let status = 'idle';
     if (inProgressTasks > 0 || activeAgents > 0) {
@@ -243,6 +240,7 @@ function getSwarmStatus(swarmId) {
             completed: 0
         },
         progress,
+        progressReason,
         tasks: {
             total: totalTasks,
             completed: completedTasks,
@@ -738,7 +736,9 @@ const statusCommand = {
         output.writeln(output.bold(`Swarm Status: ${status.id ?? output.dim('unknown id')}`));
         output.writeln();
         // Progress bar
-        output.writeln(`Overall Progress: ${output.progressBar(status.progress, 100, 40)}`);
+        output.writeln(status.progress === null
+            ? `Overall Progress: ${output.dim(`n/a (${status.progressReason})`)}`
+            : `Overall Progress: ${output.progressBar(status.progress, 100, 40)}`);
         output.writeln();
         // Agent status
         output.writeln(output.bold('Agents'));

package/v3/@claude-flow/cli/dist/src/commands/task.js

@@ -154,7 +154,7 @@ const createCommand = {
                 type: taskType,
                 description,
                 priority: priority || 'normal',
-                assignedTo: ctx.flags.assign ? [ctx.flags.assign] : undefined,
+                assignTo: ctx.flags.assign ? String(ctx.flags.assign).split(',').map(id => id.trim()).filter(Boolean) : undefined,
                 parentId: ctx.flags.parent,
                 dependencies,
                 tags,
@@ -245,14 +245,15 @@ const listCommand = {
         }
     ],
     action: async (ctx) => {
-        const status = ctx.flags.all ? 'all' : ctx.flags.status || 'pending,running';
+        const requestedStatus = ctx.flags.all ? 'all' : ctx.flags.status || 'pending,in_progress';
+        const status = requestedStatus === 'all' ? undefined : requestedStatus.replace(/\brunning\b/g, 'in_progress');
         const limit = ctx.flags.limit;
         try {
             const result = await callMCPTool('task_list', {
                 status,
                 type: ctx.flags.type,
                 priority: ctx.flags.priority,
-                agentId: ctx.flags.agent,
+                assignedTo: ctx.flags.agent,
                 limit,
                 offset: 0
             });
@@ -277,7 +278,7 @@ const listCommand = {
                     { key: 'progress', header: 'Progress', width: 10 }
                 ],
                 data: result.tasks.map(t => ({
-                    id: t.id,
+                    id: t.taskId,
                     type: t.type,
                     description: t.description.length > 27
                         ? t.description.slice(0, 27) + '...'

package/v3/@claude-flow/cli/dist/src/index.js

@@ -155,10 +155,19 @@ export class CLI {
                         // loudly (not silent) — the existing project helpers were left intact.
                         this.output.printWarning(`Skipped helper auto-refresh — ${r.blocked}. Reinstall @claude-flow/cli from a trusted source.`);
                     }
+                    else if (r.healed) {
+                        // #3565: a critical helper's stamp matched but its on-disk content
+                        // didn't hash-match the signed manifest — restored, but always
+                        // surfaced (not verbose-gated like a routine version-bump refresh).
+                        this.output.printWarning(`Detected tampered critical helper(s) in .claude/helpers (${(r.tampered || []).join(', ')}) — restored verified content from the installed package. If this wasn't expected, find out what modified them.`);
+                    }
                     else if (r.refreshed && this.output.isVerbose()) {
                         this.output.printDebug(`Refreshed .claude/helpers (${r.from} → ${r.to})`);
                     }
-                    if (r.global?.refreshed && this.output.isVerbose()) {
+                    if (r.global?.healed) {
+                        this.output.printWarning(`Detected tampered critical helper(s) in ~/.claude/helpers (${(r.global.tampered || []).join(', ')}) — restored verified content.`);
+                    }
+                    else if (r.global?.refreshed && this.output.isVerbose()) {
                         this.output.printDebug(`Refreshed ~/.claude/helpers (${r.global.from} → ${r.global.to})`);
                     }
                     else if (r.global?.blocked && r.global.blocked !== r.blocked) {