claude-flow 3.5.23 → 3.5.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.5.23",
+  "version": "3.5.25",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/daemon.js

@@ -19,6 +19,8 @@ const startCommand = {
         { name: 'foreground', short: 'f', type: 'boolean', description: 'Run daemon in foreground (blocks terminal)' },
         { name: 'headless', type: 'boolean', description: 'Enable headless worker execution (E2B sandbox)' },
         { name: 'sandbox', type: 'string', description: 'Default sandbox mode for headless workers', choices: ['strict', 'permissive', 'disabled'] },
+        { name: 'max-cpu-load', type: 'string', description: 'Override maxCpuLoad resource threshold (e.g. 4.0)' },
+        { name: 'min-free-memory', type: 'string', description: 'Override minFreeMemoryPercent resource threshold (e.g. 15)' },
     ],
     examples: [
         { command: 'claude-flow daemon start', description: 'Start daemon in background (default)' },
@@ -31,6 +33,37 @@ const startCommand = {
         const foreground = ctx.flags.foreground;
         const projectRoot = process.cwd();
         const isDaemonProcess = process.env.CLAUDE_FLOW_DAEMON === '1';
+        // Parse resource threshold overrides from CLI flags
+        const config = {};
+        const rawMaxCpu = ctx.flags['max-cpu-load'];
+        const rawMinMem = ctx.flags['min-free-memory'];
+        // Strict numeric pattern to prevent command injection when forwarding to subprocess (S1)
+        const NUMERIC_RE = /^\d+(\.\d+)?$/;
+        const sanitize = (s) => s.replace(/[\x00-\x1f\x7f-\x9f]/g, '');
+        if (rawMaxCpu || rawMinMem) {
+            const thresholds = {};
+            if (rawMaxCpu) {
+                const val = parseFloat(rawMaxCpu);
+                if (NUMERIC_RE.test(rawMaxCpu) && isFinite(val) && val > 0 && val <= 1000) {
+                    thresholds.maxCpuLoad = val;
+                }
+                else if (!quiet) {
+                    output.printWarning(`Ignoring invalid --max-cpu-load value: ${sanitize(rawMaxCpu)}`);
+                }
+            }
+            if (rawMinMem) {
+                const val = parseFloat(rawMinMem);
+                if (NUMERIC_RE.test(rawMinMem) && isFinite(val) && val >= 0 && val <= 100) {
+                    thresholds.minFreeMemoryPercent = val;
+                }
+                else if (!quiet) {
+                    output.printWarning(`Ignoring invalid --min-free-memory value: ${sanitize(rawMinMem)}`);
+                }
+            }
+            if (thresholds.maxCpuLoad !== undefined || thresholds.minFreeMemoryPercent !== undefined) {
+                config.resourceThresholds = thresholds;
+            }
+        }
         // Check if background daemon already running (skip if we ARE the daemon process)
         if (!isDaemonProcess) {
             const bgPid = getBackgroundDaemonPid(projectRoot);
@@ -43,7 +76,7 @@ const startCommand = {
         }
         // Background mode (default): fork a detached process
         if (!foreground) {
-            return startBackgroundDaemon(projectRoot, quiet);
+            return startBackgroundDaemon(projectRoot, quiet, rawMaxCpu, rawMinMem);
         }
         // Foreground mode: run in current process (blocks terminal)
         try {
@@ -74,7 +107,7 @@ const startCommand = {
             if (!quiet) {
                 const spinner = output.createSpinner({ text: 'Starting worker daemon...', spinner: 'dots' });
                 spinner.start();
-                const daemon = await startDaemon(projectRoot);
+                const daemon = await startDaemon(projectRoot, config);
                 const status = daemon.getStatus();
                 spinner.succeed('Worker daemon started (foreground mode)');
                 output.writeln();
@@ -83,6 +116,8 @@ const startCommand = {
                     `Started: ${status.startedAt?.toISOString()}`,
                     `Workers: ${status.config.workers.filter(w => w.enabled).length} enabled`,
                     `Max Concurrent: ${status.config.maxConcurrent}`,
+                    `Max CPU Load: ${status.config.resourceThresholds.maxCpuLoad}`,
+                    `Min Free Memory: ${status.config.resourceThresholds.minFreeMemoryPercent}%`,
                 ].join('\n'), 'Daemon Status');
                 output.writeln();
                 output.writeln(output.bold('Scheduled Workers'));
@@ -120,7 +155,7 @@ const startCommand = {
                 await new Promise(() => { }); // Never resolves - daemon runs until killed
             }
             else {
-                await startDaemon(projectRoot);
+                await startDaemon(projectRoot, config);
                 await new Promise(() => { }); // Keep alive
             }
             return { success: true };
@@ -157,7 +192,7 @@ function validatePath(path, label) {
 /**
  * Start daemon as a detached background process
  */
-async function startBackgroundDaemon(projectRoot, quiet) {
+async function startBackgroundDaemon(projectRoot, quiet, maxCpuLoad, minFreeMemory) {
     // Validate and resolve project root
     const resolvedRoot = resolve(projectRoot);
     validatePath(resolvedRoot, 'Project root');
@@ -199,10 +234,20 @@ async function startBackgroundDaemon(projectRoot, quiet) {
     };
     // Use spawn with explicit arguments instead of shell string interpolation
     // This prevents command injection via paths
-    const child = spawn(process.execPath, [
+    const spawnArgs = [
         cliPath,
-        'daemon', 'start', '--foreground', '--quiet'
-    ], spawnOpts);
+        'daemon', 'start', '--foreground', '--quiet',
+    ];
+    // Forward resource threshold flags to the foreground child process
+    // Validate with strict numeric pattern to prevent shell injection on Windows (S1)
+    const SPAWN_NUMERIC_RE = /^\d+(\.\d+)?$/;
+    if (maxCpuLoad && SPAWN_NUMERIC_RE.test(maxCpuLoad)) {
+        spawnArgs.push('--max-cpu-load', maxCpuLoad);
+    }
+    if (minFreeMemory && SPAWN_NUMERIC_RE.test(minFreeMemory)) {
+        spawnArgs.push('--min-free-memory', minFreeMemory);
+    }
+    const child = spawn(process.execPath, spawnArgs, spawnOpts);
     // Get PID from spawned process directly (no shell echo needed)
     const pid = child.pid;
     if (!pid || pid <= 0) {
@@ -371,6 +416,8 @@ const statusCommand = {
                 status.startedAt ? `Started: ${status.startedAt.toISOString()}` : '',
                 `Workers Enabled: ${status.config.workers.filter(w => w.enabled).length}`,
                 `Max Concurrent: ${status.config.maxConcurrent}`,
+                `Max CPU Load: ${status.config.resourceThresholds.maxCpuLoad}`,
+                `Min Free Memory: ${status.config.resourceThresholds.minFreeMemoryPercent}%`,
             ].filter(Boolean).join('\n'), 'RuFlo Daemon');
             output.writeln();
             output.writeln(output.bold('Worker Status'));

package/v3/@claude-flow/cli/dist/src/commands/index.js

@@ -61,6 +61,8 @@ const commandLoaders = {
     guidance: () => import('./guidance.js'),
     // RVFA Appliance Management
     appliance: () => import('./appliance.js'),
+    'appliance-advanced': () => import('./appliance-advanced.js'),
+    'transfer-store': () => import('./transfer-store.js'),
 };
 // Cache for loaded commands
 const loadedCommands = new Map();

package/v3/@claude-flow/cli/dist/src/init/executor.js

@@ -430,7 +430,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 ddd: { progress: 0, modules: 0, totalFiles: 0, totalLines: 0 },
                 swarm: { activeAgents: 0, maxAgents: 15, topology: 'hierarchical-mesh' },
                 learning: { status: 'READY', patternsLearned: 0, sessionsCompleted: 0 },
-                _note: 'Metrics will update as you use Claude Flow'
+                _note: 'Metrics will update as you use Ruflo'
             };
             fs.writeFileSync(progressPath, JSON.stringify(progress, null, 2), 'utf-8');
             result.created.push('.claude-flow/metrics/v3-progress.json');
@@ -462,7 +462,7 @@ export async function executeUpgrade(targetDir, upgradeSettings = false) {
                 routing: { accuracy: 0, decisions: 0 },
                 patterns: { shortTerm: 0, longTerm: 0, quality: 0 },
                 sessions: { total: 0, current: null },
-                _note: 'Intelligence grows as you use Claude Flow'
+                _note: 'Intelligence grows as you use Ruflo'
             };
             fs.writeFileSync(learningPath, JSON.stringify(learning, null, 2), 'utf-8');
             result.created.push('.claude-flow/metrics/learning.json');
@@ -1129,7 +1129,7 @@ async function writeInitialMetrics(targetDir, options, result) {
                 patternsLearned: 0,
                 sessionsCompleted: 0
             },
-            _note: 'Metrics will update as you use Claude Flow. Run: npx @claude-flow/cli@latest daemon start'
+            _note: 'Metrics will update as you use Ruflo. Run: npx ruflo@latest daemon start'
         };
         fs.writeFileSync(progressPath, JSON.stringify(progress, null, 2), 'utf-8');
         result.created.files.push('.claude-flow/metrics/v3-progress.json');
@@ -1176,7 +1176,7 @@ async function writeInitialMetrics(targetDir, options, result) {
                 total: 0,
                 current: null
             },
-            _note: 'Intelligence grows as you use Claude Flow'
+            _note: 'Intelligence grows as you use Ruflo'
         };
         fs.writeFileSync(learningPath, JSON.stringify(learning, null, 2), 'utf-8');
         result.created.files.push('.claude-flow/metrics/learning.json');
@@ -1197,7 +1197,7 @@ async function writeInitialMetrics(targetDir, options, result) {
     }
 }
 /**
- * Write CAPABILITIES.md - comprehensive overview of all Claude Flow features
+ * Write CAPABILITIES.md - comprehensive overview of all Ruflo features
  */
 async function writeCapabilitiesDoc(targetDir, options, result) {
     const capabilitiesPath = path.join(targetDir, '.claude-flow', 'CAPABILITIES.md');
@@ -1556,8 +1556,8 @@ npx @claude-flow/cli@latest hive-mind consensus --propose "task"
 
 ### MCP Server Setup
 \`\`\`bash
-# Add Claude Flow MCP
-claude mcp add claude-flow -- npx -y @claude-flow/cli@latest
+# Add Ruflo MCP
+claude mcp add ruflo -- npx -y ruflo@latest
 
 # Optional servers
 claude mcp add ruv-swarm -- npx -y ruv-swarm mcp start
@@ -1571,24 +1571,24 @@ claude mcp add flow-nexus -- npx -y flow-nexus@latest mcp start
 ### Essential Commands
 \`\`\`bash
 # Setup
-npx @claude-flow/cli@latest init --wizard
-npx @claude-flow/cli@latest daemon start
-npx @claude-flow/cli@latest doctor --fix
+npx ruflo@latest init --wizard
+npx ruflo@latest daemon start
+npx ruflo@latest doctor --fix
 
 # Swarm
-npx @claude-flow/cli@latest swarm init --topology hierarchical --max-agents 8
-npx @claude-flow/cli@latest swarm status
+npx ruflo@latest swarm init --topology hierarchical --max-agents 8
+npx ruflo@latest swarm status
 
 # Agents
-npx @claude-flow/cli@latest agent spawn -t coder
-npx @claude-flow/cli@latest agent list
+npx ruflo@latest agent spawn -t coder
+npx ruflo@latest agent list
 
 # Memory
-npx @claude-flow/cli@latest memory search --query "patterns"
+npx ruflo@latest memory search --query "patterns"
 
 # Hooks
-npx @claude-flow/cli@latest hooks pre-task --description "task"
-npx @claude-flow/cli@latest hooks worker dispatch --trigger optimize
+npx ruflo@latest hooks pre-task --description "task"
+npx ruflo@latest hooks worker dispatch --trigger optimize
 \`\`\`
 
 ### File Structure

package/v3/@claude-flow/cli/dist/src/init/helpers-generator.js

@@ -8,12 +8,12 @@ import { generateStatuslineScript, generateStatuslineHook } from './statusline-g
  */
 export function generatePreCommitHook() {
     return `#!/bin/bash
-# Claude Flow Pre-Commit Hook
+# Ruflo Pre-Commit Hook
 # Validates code quality before commit
 
 set -e
 
-echo "🔍 Running Claude Flow pre-commit checks..."
+echo "🔍 Running Ruflo pre-commit checks..."
 
 # Get staged files
 STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
@@ -40,7 +40,7 @@ echo "✅ Pre-commit checks complete"
  */
 export function generatePostCommitHook() {
     return `#!/bin/bash
-# Claude Flow Post-Commit Hook
+# Ruflo Post-Commit Hook
 # Records commit metrics and trains patterns
 
 COMMIT_HASH=$(git rev-parse HEAD)
@@ -48,8 +48,8 @@ COMMIT_MSG=$(git log -1 --pretty=%B)
 
 echo "📊 Recording commit metrics..."
 
-# Notify claude-flow of commit
-npx @claude-flow/cli hooks notify \\
+# Notify ruflo of commit
+npx ruflo@latest hooks notify \\
   --message "Commit: $COMMIT_MSG" \\
   --level info \\
   --metadata '{"hash": "'$COMMIT_HASH'"}' 2>/dev/null || true
@@ -63,7 +63,7 @@ echo "✅ Commit recorded"
 export function generateSessionManager() {
     return `#!/usr/bin/env node
 /**
- * Claude Flow Session Manager
+ * Ruflo Session Manager
  * Handles session lifecycle: start, restore, end
  */
 
@@ -196,7 +196,7 @@ module.exports = commands;
 export function generateAgentRouter() {
     return `#!/usr/bin/env node
 /**
- * Claude Flow Agent Router
+ * Ruflo Agent Router
  * Routes tasks to optimal agents based on learned patterns
  */
 
@@ -268,7 +268,7 @@ module.exports = { routeTask, AGENT_CAPABILITIES, TASK_PATTERNS };
 export function generateMemoryHelper() {
     return `#!/usr/bin/env node
 /**
- * Claude Flow Memory Helper
+ * Ruflo Memory Helper
  * Simple key-value memory for cross-session context
  */
 
@@ -361,7 +361,7 @@ export function generateHookHandler() {
     const lines = [
         '#!/usr/bin/env node',
         '/**',
-        ' * Claude Flow Hook Handler (Cross-Platform)',
+        ' * Ruflo Hook Handler (Cross-Platform)',
         ' * Dispatches hook events to the appropriate helper modules.',
         ' */',
         '',
@@ -1026,7 +1026,7 @@ PowerShell -ExecutionPolicy Bypass -File "%~dp0daemon-manager.ps1" %*
 export function generateCrossPlatformSessionManager() {
     return `#!/usr/bin/env node
 /**
- * Claude Flow Cross-Platform Session Manager
+ * Ruflo Cross-Platform Session Manager
  * Works on Windows, macOS, and Linux
  */
 

package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-tools.js

@@ -10,10 +10,10 @@ const browserSessions = new Map();
  * Execute agent-browser CLI command
  */
 async function execBrowserCommand(args, session = 'default') {
-    const { execSync } = await import('child_process');
+    const { execFileSync } = await import('child_process');
     try {
         const fullArgs = ['--session', session, '--json', ...args];
-        const result = execSync(`agent-browser ${fullArgs.join(' ')}`, {
+        const result = execFileSync('agent-browser', fullArgs, {
             encoding: 'utf-8',
             timeout: 30000,
         });

package/v3/@claude-flow/cli/dist/src/mcp-tools/config-tools.js

@@ -30,7 +30,7 @@ function getConfigPath() {
 function ensureConfigDir() {
     const dir = getConfigDir();
     if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
     }
 }
 function loadConfigStore() {
@@ -80,7 +80,16 @@ function filterDangerousKeys(obj) {
     return filtered;
 }
 function setNestedValue(obj, key, value) {
+    const MAX_NESTING_DEPTH = 10;
     const parts = key.split('.');
+    if (parts.length > MAX_NESTING_DEPTH) {
+        throw new Error(`Key exceeds maximum nesting depth of ${MAX_NESTING_DEPTH}`);
+    }
+    for (const part of parts) {
+        if (DANGEROUS_KEYS.has(part)) {
+            throw new Error(`Dangerous key segment rejected: ${part}`);
+        }
+    }
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -3,7 +3,7 @@
  * Provides intelligent hooks functionality via MCP protocol
  */
 import { mkdirSync, writeFileSync, existsSync, readFileSync, statSync } from 'fs';
-import { join, resolve } from 'path';
+import { dirname, join, resolve } from 'path';
 // Real vector search functions - lazy loaded to avoid circular imports
 let searchEntriesFn = null;
 async function getRealSearchFunction() {
@@ -121,7 +121,88 @@ function generateSimpleEmbedding(text, dimension = 384) {
     }
     return embedding;
 }
-// Task patterns used by both native and pure-JS routers
+// ── Runtime routing outcome persistence ──────────────────────────────
+// Closes the learning loop: post-task records outcomes → route loads them.
+const ROUTING_OUTCOMES_PATH = join(resolve('.'), '.claude-flow/routing-outcomes.json');
+const ROUTING_STOPWORDS = new Set([
+    'the', 'a', 'an', 'is', 'are', 'was', 'were', 'be', 'been', 'being', 'have', 'has', 'had',
+    'do', 'does', 'did', 'will', 'would', 'could', 'should', 'may', 'might', 'shall', 'can',
+    'to', 'of', 'in', 'for', 'on', 'with', 'at', 'by', 'from', 'as', 'into', 'through', 'during',
+    'before', 'after', 'above', 'below', 'between', 'under', 'again', 'further', 'then', 'once',
+    'it', 'its', 'this', 'that', 'these', 'those', 'i', 'me', 'my', 'we', 'our', 'you', 'your',
+    'he', 'she', 'they', 'them', 'and', 'but', 'or', 'nor', 'not', 'no', 'so', 'if', 'when', 'than',
+    'very', 'just', 'also', 'only', 'both', 'each', 'all', 'any', 'few', 'more', 'most', 'other',
+    'some', 'such', 'same', 'new', 'now', 'here', 'there', 'where', 'how', 'what', 'which', 'who',
+]);
+function extractKeywords(text) {
+    if (!text)
+        return [];
+    return text.toLowerCase()
+        .replace(/[^a-z0-9\s-]/g, ' ')
+        .split(/\s+/)
+        .filter(w => w.length > 2 && !ROUTING_STOPWORDS.has(w));
+}
+function loadRoutingOutcomes() {
+    try {
+        if (existsSync(ROUTING_OUTCOMES_PATH)) {
+            const data = JSON.parse(readFileSync(ROUTING_OUTCOMES_PATH, 'utf-8'));
+            return data.outcomes || [];
+        }
+    }
+    catch { /* corrupt file, start fresh */ }
+    return [];
+}
+function saveRoutingOutcomes(outcomes) {
+    try {
+        const dir = dirname(ROUTING_OUTCOMES_PATH);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        // Cap at 500 entries to bound file size
+        const capped = outcomes.slice(-500);
+        writeFileSync(ROUTING_OUTCOMES_PATH, JSON.stringify({ outcomes: capped }, null, 2));
+    }
+    catch { /* non-critical */ }
+}
+/**
+ * Build learned routing patterns from successful task outcomes.
+ * Returns patterns in the same shape as TASK_PATTERNS so they can be
+ * merged into both the native HNSW and pure-JS semantic routers.
+ */
+function loadLearnedPatterns() {
+    const outcomes = loadRoutingOutcomes();
+    const byAgent = {};
+    for (const o of outcomes) {
+        if (!o.success || !o.agent || !o.keywords?.length)
+            continue;
+        if (!byAgent[o.agent])
+            byAgent[o.agent] = new Set();
+        for (const kw of o.keywords)
+            byAgent[o.agent].add(kw);
+    }
+    const patterns = {};
+    for (const [agent, kwSet] of Object.entries(byAgent)) {
+        patterns[`learned-${agent}`] = {
+            keywords: [...kwSet].slice(0, 50),
+            agents: [agent],
+        };
+    }
+    return patterns;
+}
+/**
+ * Merge static TASK_PATTERNS with runtime-learned patterns.
+ * Static patterns take precedence (learned patterns won't overwrite them).
+ */
+function getMergedTaskPatterns() {
+    const merged = { ...TASK_PATTERNS };
+    const learned = loadLearnedPatterns();
+    for (const [key, pattern] of Object.entries(learned)) {
+        if (!merged[key]) {
+            merged[key] = pattern;
+        }
+    }
+    return merged;
+}
+// ── Static task patterns (used by both native and pure-JS routers) ───
 const TASK_PATTERNS = {
     'security-task': {
         keywords: ['authentication', 'security', 'auth', 'password', 'encryption', 'vulnerability', 'cve', 'audit'],
@@ -198,8 +279,8 @@ async function getSemanticRouter() {
                 hnswEfConstruction: 200,
                 hnswEfSearch: 100,
             });
-            // Initialize with task patterns
-            for (const [patternName, { keywords }] of Object.entries(TASK_PATTERNS)) {
+            // Initialize with static + runtime-learned task patterns
+            for (const [patternName, { keywords }] of Object.entries(getMergedTaskPatterns())) {
                 for (const keyword of keywords) {
                     const embedding = generateSimpleEmbedding(keyword);
                     db.insert(`${patternName}:${keyword}`, embedding);
@@ -220,7 +301,7 @@ async function getSemanticRouter() {
     try {
         const { SemanticRouter } = await import('../ruvector/semantic-router.js');
         semanticRouter = new SemanticRouter({ dimension: 384 });
-        for (const [patternName, { keywords, agents }] of Object.entries(TASK_PATTERNS)) {
+        for (const [patternName, { keywords, agents }] of Object.entries(getMergedTaskPatterns())) {
             const embeddings = keywords.map(kw => generateSimpleEmbedding(kw));
             semanticRouter.addIntentWithEmbeddings(patternName, embeddings, { agents, keywords });
             // Cache embeddings for keywords
@@ -414,11 +495,32 @@ function suggestAgentsForFile(filePath) {
 }
 function suggestAgentsForTask(task) {
     const taskLower = task.toLowerCase();
+    // Check static keyword patterns first
     for (const [pattern, result] of Object.entries(KEYWORD_PATTERNS)) {
         if (taskLower.includes(pattern)) {
             return result;
         }
     }
+    // Check runtime-learned patterns from successful task outcomes
+    const taskKeywords = extractKeywords(task);
+    if (taskKeywords.length > 0) {
+        const outcomes = loadRoutingOutcomes();
+        let bestAgent = '';
+        let bestOverlap = 0;
+        for (const outcome of outcomes) {
+            if (!outcome.success || !outcome.agent || !outcome.keywords?.length)
+                continue;
+            const overlap = taskKeywords.filter(kw => outcome.keywords.includes(kw)).length;
+            if (overlap > bestOverlap) {
+                bestOverlap = overlap;
+                bestAgent = outcome.agent;
+            }
+        }
+        // Require at least 2 keyword overlap to prevent false positives
+        if (bestAgent && bestOverlap >= 2) {
+            return { agents: [bestAgent], confidence: Math.min(0.6 + bestOverlap * 0.05, 0.85) };
+        }
+    }
     // Default fallback
     return { agents: ['coder', 'researcher', 'tester'], confidence: 0.7 };
 }
@@ -674,13 +776,16 @@ export const hooksRoute = {
                 routingMethod = 'semantic-native';
                 backendInfo = 'native VectorDb (HNSW)';
                 // Convert results to semantic format
+                const mergedPatterns = getMergedTaskPatterns();
                 semanticResult = results.map((r) => {
                     const [patternName] = r.id.split(':');
-                    const pattern = TASK_PATTERNS[patternName];
+                    const pattern = mergedPatterns[patternName];
                     return {
                         intent: patternName,
                         score: 1 - r.score, // Native uses distance (lower is better), convert to similarity
-                        metadata: { agents: pattern?.agents || ['coder'] },
+                        metadata: {
+                            agents: pattern?.agents || (patternName.startsWith('learned-') ? [patternName.slice(8)] : ['coder']),
+                        },
                     };
                 });
             }
@@ -941,6 +1046,8 @@ export const hooksPostTask = {
             success: { type: 'boolean', description: 'Whether task was successful' },
             agent: { type: 'string', description: 'Agent that completed the task' },
             quality: { type: 'number', description: 'Quality score (0-1)' },
+            task: { type: 'string', description: 'Task description text (used for learning keyword extraction)' },
+            storeDecisions: { type: 'boolean', description: 'Also store routing decision in memory DB' },
         },
         required: ['taskId'],
     },
@@ -979,6 +1086,41 @@ export const hooksPostTask = {
         catch {
             // Non-fatal
         }
+        // Persist routing outcome for runtime learning (file-based, always reliable)
+        const taskText = params.task || '';
+        const outcomeKeywords = extractKeywords(taskText);
+        let outcomePersisted = false;
+        if (taskText && agent && agent.length <= 100 && /^[a-zA-Z0-9_-]+$/.test(agent)) {
+            try {
+                const outcomes = loadRoutingOutcomes();
+                outcomes.push({
+                    task: taskText,
+                    agent,
+                    success,
+                    quality,
+                    keywords: outcomeKeywords,
+                    timestamp: new Date().toISOString(),
+                });
+                saveRoutingOutcomes(outcomes);
+                outcomePersisted = true;
+            }
+            catch { /* non-critical */ }
+        }
+        // Optionally store in memory DB for cross-session vector retrieval
+        if (params.storeDecisions && taskText && agent) {
+            try {
+                const storeFn = await getRealStoreFunction();
+                if (storeFn) {
+                    await storeFn({
+                        key: `routing-decision:${taskId}`,
+                        namespace: 'patterns',
+                        value: JSON.stringify({ task: taskText, agent, success, quality, keywords: outcomeKeywords }),
+                        tags: ['routing-decision'],
+                    });
+                }
+            }
+            catch { /* non-critical */ }
+        }
         const duration = Date.now() - startTime;
         return {
             taskId,
@@ -989,6 +1131,7 @@ export const hooksPostTask = {
                 newPatterns: success ? 1 : 0,
                 trajectoryId: `traj-${Date.now()}`,
                 controller: feedbackResult?.controller || 'none',
+                outcomePersisted,
             },
             quality,
             feedback: feedbackResult ? {

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -213,6 +213,7 @@ export const memoryTools = [
             const { getEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
+            validateMemoryInput(key);
             try {
                 const result = await getEntry({ key, namespace });
                 if (result.found && result.entry) {
@@ -337,6 +338,7 @@ export const memoryTools = [
             const { deleteEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
+            validateMemoryInput(key);
             try {
                 const result = await deleteEntry({ key, namespace });
                 return {

package/v3/@claude-flow/cli/dist/src/mcp-tools/swarm-tools.d.ts

@@ -1,7 +1,8 @@
 /**
  * Swarm MCP Tools for CLI
  *
- * Tool definitions for swarm coordination.
+ * Tool definitions for swarm coordination with file-based state persistence.
+ * Replaces previous stub implementations with real state tracking.
  */
 import type { MCPTool } from './types.js';
 export declare const swarmTools: MCPTool[];