claude-flow 3.5.69 → 3.5.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.5.69",
+  "version": "3.5.70",
   "description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@claude-flow/cli/dist/src/commands/autopilot.js

@@ -287,7 +287,7 @@ const predictCommand = {
             else {
                 output.writeln(`Action: ${prediction?.action || 'unknown'}`);
                 output.writeln(`Confidence: ${prediction?.confidence || 0}`);
-                if (prediction?.alternatives?.length > 0)
+                if (prediction?.alternatives && prediction.alternatives.length > 0)
                     output.writeln(`Alternatives: ${prediction.alternatives.join(', ')}`);
             }
             return { success: true };

package/v3/@claude-flow/cli/dist/src/commands/hooks.js

@@ -3763,7 +3763,7 @@ const postBashCommand = {
 // Token Optimizer command - integrates agentic-flow Agent Booster
 const tokenOptimizeCommand = {
     name: 'token-optimize',
-    description: 'Token optimization via agentic-flow Agent Booster (30-50% savings)',
+    description: 'Token optimization via agentic-flow Agent Booster integration',
     options: [
         { name: 'query', short: 'q', type: 'string', description: 'Query for compact context retrieval' },
         { name: 'agents', short: 'A', type: 'number', description: 'Agent count for optimal config', default: '6' },
@@ -3791,7 +3791,6 @@ const tokenOptimizeCommand = {
             memoriesRetrieved: 0,
         };
         let agenticFlowAvailable = false;
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         let reasoningBank = null;
         try {
             // Check if agentic-flow v3 is available
@@ -3846,10 +3845,8 @@ const tokenOptimizeCommand = {
                 output.writeln();
                 output.printInfo('ReasoningBank not available - query skipped');
             }
-            // Simulate some token savings for demo
-            stats.totalTokensSaved += 200;
-            stats.cacheHits = 2;
-            stats.cacheMisses = 1;
+            // Note: stats reflect only actual measured values from this session.
+            // No simulated/fabricated data is added.
             // Show stats
             if (showStats || showReport) {
                 output.writeln();
@@ -4413,7 +4410,7 @@ export const hooksCommand = {
             `${output.highlight('coverage-route')}  - Route tasks based on coverage gaps (ruvector)`,
             `${output.highlight('coverage-suggest')}- Suggest coverage improvements`,
             `${output.highlight('coverage-gaps')}   - List all coverage gaps with agents`,
-            `${output.highlight('token-optimize')} - Token optimization (30-50% savings)`,
+            `${output.highlight('token-optimize')} - Token optimization (agentic-flow integration)`,
             `${output.highlight('model-route')}    - Route to optimal model (haiku/sonnet/opus)`,
             `${output.highlight('model-outcome')}  - Record model routing outcome`,
             `${output.highlight('model-stats')}    - View model routing statistics`,

package/v3/@claude-flow/cli/dist/src/commands/init.js

@@ -18,7 +18,6 @@ async function initCodexAction(ctx, options) {
     const spinner = output.createSpinner({ text: 'Initializing Codex project...' });
     spinner.start();
     try {
-        // Dynamic import of the Codex initializer with lazy loading fallback
         let CodexInitializer;
         // Try multiple resolution strategies for the @claude-flow/codex package
         // Use a variable to prevent TypeScript from statically resolving the optional module

package/v3/@claude-flow/cli/dist/src/commands/neural.js

@@ -1333,6 +1333,7 @@ const benchmarkCommand = {
         const spinner = output.createSpinner({ text: 'Running benchmarks...', spinner: 'dots' });
         spinner.start();
         try {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- dynamic import of optional native WASM module with no type declarations
             const attention = await import('@ruvector/attention');
             // Manual benchmark since benchmarkAttention has a binding bug
             const benchmarkMechanism = async (name, mechanism) => {

package/v3/@claude-flow/cli/dist/src/commands/providers.js

@@ -6,6 +6,91 @@
  */
 import { output } from '../output.js';
 import { configManager } from '../services/config-file-manager.js';
+const PROVIDER_CATALOG = [
+    { name: 'Anthropic', type: 'LLM', models: 'claude-3.5-sonnet, opus', envVar: 'ANTHROPIC_API_KEY', configName: 'anthropic' },
+    { name: 'OpenAI', type: 'LLM', models: 'gpt-4o, gpt-4-turbo', envVar: 'OPENAI_API_KEY', configName: 'openai' },
+    { name: 'OpenAI', type: 'Embedding', models: 'text-embedding-3-small/large', envVar: 'OPENAI_API_KEY', configName: 'openai' },
+    { name: 'Google', type: 'LLM', models: 'gemini-pro, gemini-ultra', envVar: 'GOOGLE_API_KEY', configName: 'google' },
+    { name: 'Transformers.js', type: 'Embedding', models: 'Xenova/all-MiniLM-L6-v2' },
+    { name: 'Agentic Flow', type: 'Embedding', models: 'ONNX optimized' },
+    { name: 'Mock', type: 'All', models: 'mock-*' },
+];
+/**
+ * Resolve the API key for a provider by checking the config file first,
+ * then falling back to well-known environment variables.
+ */
+function resolveApiKey(providerName, configuredProviders) {
+    // Check config file entry
+    const entry = configuredProviders.find((p) => typeof p.name === 'string' && p.name.toLowerCase() === providerName.toLowerCase());
+    if (entry?.apiKey && typeof entry.apiKey === 'string') {
+        return entry.apiKey;
+    }
+    // Check environment variable
+    const envMapping = {
+        anthropic: 'ANTHROPIC_API_KEY',
+        openai: 'OPENAI_API_KEY',
+        google: 'GOOGLE_API_KEY',
+    };
+    const envVar = envMapping[providerName.toLowerCase()];
+    if (envVar && process.env[envVar]) {
+        return process.env[envVar];
+    }
+    return undefined;
+}
+/**
+ * Make a lightweight HTTP request to verify provider API key validity.
+ * Uses a 5-second timeout. Returns { ok, reason }.
+ */
+async function testProviderConnectivity(providerName, apiKey) {
+    const endpoints = {
+        anthropic: {
+            url: 'https://api.anthropic.com/v1/models',
+            headers: {
+                'x-api-key': apiKey,
+                'anthropic-version': '2023-06-01',
+            },
+        },
+        openai: {
+            url: 'https://api.openai.com/v1/models',
+            headers: {
+                'Authorization': `Bearer ${apiKey}`,
+            },
+        },
+        google: {
+            url: `https://generativelanguage.googleapis.com/v1beta/models?key=${apiKey}`,
+            headers: {},
+        },
+    };
+    const endpointConfig = endpoints[providerName.toLowerCase()];
+    if (!endpointConfig) {
+        return { ok: false, reason: 'No test endpoint available for this provider' };
+    }
+    try {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 5000);
+        const res = await fetch(endpointConfig.url, {
+            method: 'GET',
+            headers: endpointConfig.headers,
+            signal: controller.signal,
+        });
+        clearTimeout(timeout);
+        if (res.ok || res.status === 200) {
+            return { ok: true, reason: 'Connected successfully' };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { ok: false, reason: `Authentication failed (HTTP ${res.status})` };
+        }
+        // A non-auth error but the server responded — key format may be fine
+        return { ok: false, reason: `Unexpected response (HTTP ${res.status})` };
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'AbortError') {
+            return { ok: false, reason: 'Connection timed out (5s)' };
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        return { ok: false, reason: `Connection failed: ${msg}` };
+    }
+}
 // List subcommand
 const listCommand = {
     name: 'list',
@@ -20,26 +105,88 @@ const listCommand = {
     ],
     action: async (ctx) => {
         const type = ctx.flags.type || 'all';
-        // Note: Static provider catalog — does not reflect user's configured providers
+        const activeOnly = ctx.flags.active;
+        // Load user configuration
+        const cwd = process.cwd();
+        const config = configManager.getConfig(cwd);
+        const agents = (config.agents ?? {});
+        const configuredProviders = (agents.providers ?? []);
+        // Build table rows from the catalog, enriched with configuration status
+        const rows = [];
+        for (const entry of PROVIDER_CATALOG) {
+            // Apply type filter
+            if (type !== 'all' && entry.type.toLowerCase() !== type.toLowerCase()) {
+                continue;
+            }
+            let status;
+            let keySource = '';
+            if (entry.configName) {
+                const apiKey = resolveApiKey(entry.configName, configuredProviders);
+                if (apiKey) {
+                    // Determine the source for the key
+                    const configEntry = configuredProviders.find((p) => typeof p.name === 'string' && p.name.toLowerCase() === entry.configName.toLowerCase());
+                    if (configEntry?.apiKey && typeof configEntry.apiKey === 'string') {
+                        keySource = 'config';
+                    }
+                    else {
+                        keySource = 'env';
+                    }
+                    status = output.success(`Configured (${keySource})`);
+                }
+                else {
+                    status = output.warning('Not configured');
+                }
+            }
+            else if (entry.name === 'Mock') {
+                status = output.dim('Dev only');
+            }
+            else {
+                // Local-only providers (Transformers.js, Agentic Flow) — always available
+                status = output.success('Available (local)');
+            }
+            if (activeOnly && !status.includes('Configured') && !status.includes('Available')) {
+                continue;
+            }
+            rows.push({
+                provider: entry.name,
+                type: entry.type,
+                models: entry.models,
+                status,
+            });
+        }
+        // Also show any providers in config that are not in the static catalog
+        for (const cp of configuredProviders) {
+            const cpName = cp.name || '';
+            const alreadyListed = PROVIDER_CATALOG.some((e) => e.configName?.toLowerCase() === cpName.toLowerCase() || e.name.toLowerCase() === cpName.toLowerCase());
+            if (!alreadyListed && cpName) {
+                const hasKey = !!(cp.apiKey || resolveApiKey(cpName, configuredProviders));
+                rows.push({
+                    provider: cpName,
+                    type: cp.type || 'Custom',
+                    models: cp.model || output.dim('(not specified)'),
+                    status: hasKey ? output.success('Configured (config)') : output.warning('Not configured'),
+                });
+            }
+        }
         output.writeln();
-        output.writeln(output.bold('Available Providers'));
+        output.writeln(output.bold('Providers'));
         output.writeln(output.dim('─'.repeat(60)));
-        output.printTable({
-            columns: [
-                { key: 'provider', header: 'Provider', width: 18 },
-                { key: 'type', header: 'Type', width: 12 },
-                { key: 'models', header: 'Models', width: 25 },
-                { key: 'status', header: 'Status', width: 12 },
-            ],
-            data: [
-                { provider: 'Anthropic', type: 'LLM', models: 'claude-3.5-sonnet, opus', status: output.success('Active') },
-                { provider: 'OpenAI', type: 'LLM', models: 'gpt-4o, gpt-4-turbo', status: output.success('Active') },
-                { provider: 'OpenAI', type: 'Embedding', models: 'text-embedding-3-small/large', status: output.success('Active') },
-                { provider: 'Transformers.js', type: 'Embedding', models: 'Xenova/all-MiniLM-L6-v2', status: output.success('Active') },
-                { provider: 'Agentic Flow', type: 'Embedding', models: 'ONNX optimized', status: output.success('Active') },
-                { provider: 'Mock', type: 'All', models: 'mock-*', status: output.dim('Dev only') },
-            ],
-        });
+        if (rows.length === 0) {
+            output.writeln(output.dim('  No providers match the current filter.'));
+        }
+        else {
+            output.printTable({
+                columns: [
+                    { key: 'provider', header: 'Provider', width: 18 },
+                    { key: 'type', header: 'Type', width: 12 },
+                    { key: 'models', header: 'Models', width: 25 },
+                    { key: 'status', header: 'Status', width: 20 },
+                ],
+                data: rows,
+            });
+        }
+        output.writeln();
+        output.writeln(output.dim('Tip: Use "providers configure -p <name> -k <key>" to set API keys.'));
         return { success: true };
     },
 };
@@ -133,98 +280,83 @@ const testCommand = {
             const config = configManager.getConfig(cwd);
             const agents = (config.agents ?? {});
             const configuredProviders = (agents.providers ?? []);
-            const getConfigApiKey = (name) => {
-                const entry = configuredProviders.find((p) => typeof p.name === 'string' && p.name.toLowerCase() === name.toLowerCase());
-                return entry?.apiKey;
-            };
-            const knownChecks = [
-                {
-                    name: 'Anthropic',
-                    test: async () => {
-                        const key = process.env.ANTHROPIC_API_KEY || getConfigApiKey('anthropic');
-                        if (key)
-                            return { pass: true, reason: 'API key found' };
-                        return { pass: false, reason: 'ANTHROPIC_API_KEY not set and no apiKey in config' };
-                    },
-                },
-                {
-                    name: 'OpenAI',
-                    test: async () => {
-                        const key = process.env.OPENAI_API_KEY || getConfigApiKey('openai');
-                        if (key)
-                            return { pass: true, reason: 'API key found' };
-                        return { pass: false, reason: 'OPENAI_API_KEY not set and no apiKey in config' };
-                    },
-                },
-                {
-                    name: 'Google',
-                    test: async () => {
-                        const key = process.env.GOOGLE_API_KEY || getConfigApiKey('google');
-                        if (key)
-                            return { pass: true, reason: 'API key found' };
-                        return { pass: false, reason: 'GOOGLE_API_KEY not set and no apiKey in config' };
-                    },
-                },
-                {
-                    name: 'Ollama',
-                    test: async () => {
-                        const entry = configuredProviders.find((p) => typeof p.name === 'string' && p.name.toLowerCase() === 'ollama');
-                        const baseUrl = entry?.baseUrl || 'http://localhost:11434';
-                        try {
-                            const controller = new AbortController();
-                            const timeout = setTimeout(() => controller.abort(), 3000);
-                            const res = await fetch(baseUrl, { signal: controller.signal });
-                            clearTimeout(timeout);
-                            if (res.ok)
-                                return { pass: true, reason: `Reachable at ${baseUrl}` };
-                            return { pass: false, reason: `HTTP ${res.status} from ${baseUrl}` };
-                        }
-                        catch {
-                            return { pass: false, reason: `Unreachable at ${baseUrl}` };
-                        }
-                    },
-                },
+            const knownTargets = [
+                { name: 'Anthropic', configName: 'anthropic' },
+                { name: 'OpenAI', configName: 'openai' },
+                { name: 'Google', configName: 'google' },
             ];
-            // Filter to requested provider or test all
-            let checksToRun;
+            // Add Ollama as a special case (endpoint-based, no API key)
+            const ollamaEntry = configuredProviders.find((p) => typeof p.name === 'string' && p.name.toLowerCase() === 'ollama');
+            let targets;
             if (testAll || !provider) {
-                checksToRun = knownChecks;
+                targets = [...knownTargets];
             }
             else {
-                const match = knownChecks.find((c) => c.name.toLowerCase() === provider.toLowerCase());
-                if (match) {
-                    checksToRun = [match];
+                const match = knownTargets.find((t) => t.name.toLowerCase() === provider.toLowerCase() || t.configName === provider.toLowerCase());
+                targets = match ? [match] : [{ name: provider, configName: provider.toLowerCase() }];
+            }
+            const results = [];
+            // Test API-key-based providers with real connectivity checks
+            for (const target of targets) {
+                const apiKey = resolveApiKey(target.configName, configuredProviders);
+                if (!apiKey) {
+                    results.push({ name: target.name, pass: false, reason: 'Not configured (no API key found)' });
+                    continue;
                 }
-                else {
-                    // Unknown provider -- check if it has a config entry with an apiKey
-                    checksToRun = [
-                        {
-                            name: provider,
-                            test: async () => {
-                                const key = getConfigApiKey(provider);
-                                if (key)
-                                    return { pass: true, reason: 'API key found in config' };
-                                return { pass: false, reason: 'No API key in environment or config' };
-                            },
-                        },
-                    ];
+                output.writeln(output.dim(`  Testing ${target.name}...`));
+                const result = await testProviderConnectivity(target.name, apiKey);
+                results.push({ name: target.name, pass: result.ok, reason: result.reason });
+            }
+            // Test Ollama separately (endpoint-based, no API key needed)
+            if (testAll || !provider || provider.toLowerCase() === 'ollama') {
+                const baseUrl = ollamaEntry?.baseUrl || 'http://localhost:11434';
+                output.writeln(output.dim(`  Testing Ollama at ${baseUrl}...`));
+                try {
+                    const controller = new AbortController();
+                    const timeout = setTimeout(() => controller.abort(), 5000);
+                    const res = await fetch(baseUrl, { signal: controller.signal });
+                    clearTimeout(timeout);
+                    if (res.ok) {
+                        results.push({ name: 'Ollama', pass: true, reason: `Connected at ${baseUrl}` });
+                    }
+                    else {
+                        results.push({ name: 'Ollama', pass: false, reason: `HTTP ${res.status} from ${baseUrl}` });
+                    }
+                }
+                catch {
+                    results.push({ name: 'Ollama', pass: false, reason: `Unreachable at ${baseUrl}` });
                 }
             }
-            let anyPassed = false;
-            const results = [];
-            for (const check of checksToRun) {
-                const result = await check.test();
-                results.push({ name: check.name, ...result });
-                if (result.pass)
-                    anyPassed = true;
+            // Also test any custom providers from config that were not in the known list
+            if (testAll || !provider) {
+                for (const cp of configuredProviders) {
+                    const cpName = cp.name || '';
+                    const alreadyTested = results.some((r) => r.name.toLowerCase() === cpName.toLowerCase());
+                    if (alreadyTested || !cpName)
+                        continue;
+                    const apiKey = resolveApiKey(cpName, configuredProviders);
+                    if (!apiKey) {
+                        results.push({ name: cpName, pass: false, reason: 'No API key found' });
+                    }
+                    else {
+                        // For custom providers we can only verify the key exists
+                        results.push({ name: cpName, pass: true, reason: 'API key found (no test endpoint available)' });
+                    }
+                }
             }
+            let anyPassed = false;
             output.writeln();
             for (const r of results) {
                 const icon = r.pass ? output.success('PASS') : output.error('FAIL');
                 output.writeln(`  ${icon}  ${r.name}: ${r.reason}`);
+                if (r.pass)
+                    anyPassed = true;
             }
             output.writeln();
-            if (anyPassed) {
+            if (results.length === 0) {
+                output.writeln(output.warning('No providers to test. Use "providers configure" to add providers.'));
+            }
+            else if (anyPassed) {
                 output.writeln(output.success(`${results.filter((r) => r.pass).length}/${results.length} provider(s) passed.`));
             }
             else {

package/v3/@claude-flow/cli/dist/src/commands/security.js

@@ -53,7 +53,7 @@ const scanCommand = {
                         }
                         catch (auditErr) {
                             // npm audit exits non-zero when vulnerabilities found — stdout still has JSON
-                            auditResult = auditErr.stdout || '{}';
+                            auditResult = (auditErr instanceof Error && 'stdout' in auditErr ? auditErr.stdout : undefined) || '{}';
                         }
                         try {
                             const audit = JSON.parse(auditResult);

package/v3/@claude-flow/cli/dist/src/mcp-tools/config-tools.js

@@ -6,6 +6,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const CONFIG_FILE = 'config.json';
@@ -115,6 +116,15 @@ export const configTools = [
             required: ['key'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vKey = validateText(input.key, 'key', 256);
+            if (!vKey.valid)
+                return { success: false, error: vKey.error };
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const key = input.key;
             const scope = input.scope || 'default';
@@ -152,6 +162,15 @@ export const configTools = [
             required: ['key', 'value'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vKey = validateText(input.key, 'key', 256);
+            if (!vKey.valid)
+                return { success: false, error: vKey.error };
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const key = input.key;
             const value = input.value;
@@ -190,6 +209,17 @@ export const configTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.prefix) {
+                const v = validateText(input.prefix, 'prefix', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const scope = input.scope || 'default';
             const prefix = input.prefix;
@@ -236,6 +266,17 @@ export const configTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.key) {
+                const v = validateText(input.key, 'key', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const scope = input.scope || 'default';
             const key = input.key;
@@ -286,6 +327,12 @@ export const configTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const scope = input.scope || 'default';
             const includeDefaults = input.includeDefaults !== false;
@@ -320,6 +367,12 @@ export const configTools = [
             required: ['config'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.scope) {
+                const v = validateIdentifier(input.scope, 'scope');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadConfigStore();
             const config = filterDangerousKeys(input.config);
             const scope = input.scope || 'default';

package/v3/@claude-flow/cli/dist/src/mcp-tools/session-tools.js

@@ -6,6 +6,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const SESSION_DIR = 'sessions';
@@ -105,6 +106,15 @@ export const sessionTools = [
             required: ['name'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vName = validateText(input.name, 'name', 256);
+            if (!vName.valid)
+                return { success: false, error: vName.error };
+            if (input.description) {
+                const v = validateText(input.description, 'description');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const sessionId = `session-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             // Load related data based on options
             const data = loadRelatedStores({
@@ -152,6 +162,17 @@ export const sessionTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.sessionId) {
+                const v = validateIdentifier(input.sessionId, 'sessionId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.name) {
+                const v = validateText(input.name, 'name', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             let session = null;
             // Try to find by sessionId first
             if (input.sessionId) {
@@ -279,6 +300,10 @@ export const sessionTools = [
             required: ['sessionId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.sessionId, 'sessionId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const sessionId = input.sessionId;
             const path = getSessionPath(sessionId);
             if (existsSync(path)) {
@@ -308,6 +333,10 @@ export const sessionTools = [
             required: ['sessionId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.sessionId, 'sessionId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const sessionId = input.sessionId;
             const session = loadSession(sessionId);
             if (session) {

package/v3/@claude-flow/cli/dist/src/mcp-tools/swarm-tools.js

@@ -7,6 +7,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier } from './validate-input.js';
 // Swarm state persistence
 const SWARM_DIR = '.claude-flow/swarm';
 const SWARM_STATE_FILE = 'swarm-state.json';
@@ -55,6 +56,17 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.topology) {
+                const v = validateIdentifier(input.topology, 'topology');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.strategy) {
+                const v = validateIdentifier(input.strategy, 'strategy');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const topology = input.topology || 'hierarchical-mesh';
             const maxAgents = Math.min(Math.max(input.maxAgents || 15, 1), 50);
             const strategy = input.strategy || 'specialized';
@@ -111,6 +123,12 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.swarmId) {
+                const v = validateIdentifier(input.swarmId, 'swarmId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadSwarmStore();
             const swarmId = input.swarmId;
             if (swarmId && store.swarms[swarmId]) {
@@ -165,6 +183,12 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.swarmId) {
+                const v = validateIdentifier(input.swarmId, 'swarmId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadSwarmStore();
             const swarmId = input.swarmId;
             // Find the swarm
@@ -216,6 +240,12 @@ export const swarmTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.swarmId) {
+                const v = validateIdentifier(input.swarmId, 'swarmId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadSwarmStore();
             const swarmId = input.swarmId;
             // Find the swarm

package/v3/@claude-flow/cli/dist/src/mcp-tools/task-tools.js

@@ -6,6 +6,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const TASK_DIR = 'tasks';
@@ -56,6 +57,13 @@ export const taskTools = [
             required: ['type', 'description'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vType = validateIdentifier(input.type, 'type');
+            if (!vType.valid)
+                return { success: false, error: vType.error };
+            const vDesc = validateText(input.description, 'description');
+            if (!vDesc.valid)
+                return { success: false, error: vDesc.error };
             const store = loadTaskStore();
             const taskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const task = {
@@ -97,6 +105,10 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
@@ -194,6 +206,10 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
@@ -254,6 +270,10 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
@@ -301,6 +321,10 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];
@@ -380,6 +404,15 @@ export const taskTools = [
             required: ['taskId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.taskId, 'taskId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
+            if (input.reason) {
+                const v = validateText(input.reason, 'reason');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadTaskStore();
             const taskId = input.taskId;
             const task = store.tasks[taskId];

package/v3/@claude-flow/cli/dist/src/mcp-tools/terminal-tools.js

@@ -5,6 +5,7 @@
  */
 import { getProjectCwd } from './types.js';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { validateIdentifier, validatePath, validateText } from './validate-input.js';
 import { join } from 'node:path';
 import { execSync } from 'node:child_process';
 // Storage paths
@@ -53,6 +54,17 @@ export const terminalTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.name) {
+                const v = validateText(input.name, 'name', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.workingDir) {
+                const v = validatePath(input.workingDir, 'workingDir');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadTerminalStore();
             const id = `term-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const session = {
@@ -92,6 +104,15 @@ export const terminalTools = [
             required: ['command'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vCmd = validateText(input.command, 'command', 10_000);
+            if (!vCmd.valid)
+                return { success: false, error: vCmd.error };
+            if (input.sessionId) {
+                const v = validateIdentifier(input.sessionId, 'sessionId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const command = input.command;
@@ -201,6 +222,10 @@ export const terminalTools = [
             required: ['sessionId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.sessionId, 'sessionId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const session = store.sessions[sessionId];
@@ -229,6 +254,12 @@ export const terminalTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.sessionId) {
+                const v = validateIdentifier(input.sessionId, 'sessionId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadTerminalStore();
             const sessionId = input.sessionId;
             const limit = input.limit || 50;

package/v3/@claude-flow/cli/dist/src/mcp-tools/workflow-tools.js

@@ -6,6 +6,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getProjectCwd } from './types.js';
+import { validateIdentifier, validatePath, validateText } from './validate-input.js';
 // Storage paths
 const STORAGE_DIR = '.claude-flow';
 const WORKFLOW_DIR = 'workflows';
@@ -63,6 +64,22 @@ export const workflowTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.template) {
+                const v = validateIdentifier(input.template, 'template');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.file) {
+                const v = validatePath(input.file, 'file');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.task) {
+                const v = validateText(input.task, 'task');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadWorkflowStore();
             const template = input.template;
             const task = input.task;
@@ -157,6 +174,15 @@ export const workflowTools = [
             required: ['name'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vName = validateText(input.name, 'name', 256);
+            if (!vName.valid)
+                return { success: false, error: vName.error };
+            if (input.description) {
+                const v = validateText(input.description, 'description');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadWorkflowStore();
             const workflowId = `workflow-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
             const steps = (input.steps || []).map((s, i) => ({
@@ -201,6 +227,10 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.workflowId, 'workflowId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadWorkflowStore();
             const workflowId = input.workflowId;
             const workflow = store.workflows[workflowId];
@@ -252,6 +282,10 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.workflowId, 'workflowId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadWorkflowStore();
             const workflowId = input.workflowId;
             const workflow = store.workflows[workflowId];
@@ -303,6 +337,12 @@ export const workflowTools = [
             },
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.status) {
+                const v = validateIdentifier(input.status, 'status');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadWorkflowStore();
             let workflows = Object.values(store.workflows);
             // Apply filters
@@ -340,6 +380,10 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.workflowId, 'workflowId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadWorkflowStore();
             const workflowId = input.workflowId;
             const workflow = store.workflows[workflowId];
@@ -371,6 +415,10 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.workflowId, 'workflowId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadWorkflowStore();
             const workflowId = input.workflowId;
             const workflow = store.workflows[workflowId];
@@ -413,6 +461,15 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.workflowId, 'workflowId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
+            if (input.reason) {
+                const v = validateText(input.reason, 'reason');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadWorkflowStore();
             const workflowId = input.workflowId;
             const workflow = store.workflows[workflowId];
@@ -451,6 +508,10 @@ export const workflowTools = [
             required: ['workflowId'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            const vId = validateIdentifier(input.workflowId, 'workflowId');
+            if (!vId.valid)
+                return { success: false, error: vId.error };
             const store = loadWorkflowStore();
             const workflowId = input.workflowId;
             if (!store.workflows[workflowId]) {
@@ -485,6 +546,27 @@ export const workflowTools = [
             required: ['action'],
         },
         handler: async (input) => {
+            // Validate user-provided input (#1425)
+            if (input.workflowId) {
+                const v = validateIdentifier(input.workflowId, 'workflowId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.templateId) {
+                const v = validateIdentifier(input.templateId, 'templateId');
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.templateName) {
+                const v = validateText(input.templateName, 'templateName', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
+            if (input.newName) {
+                const v = validateText(input.newName, 'newName', 256);
+                if (!v.valid)
+                    return { success: false, error: v.error };
+            }
             const store = loadWorkflowStore();
             const action = input.action;
             if (action === 'save') {

package/v3/@claude-flow/cli/dist/src/memory/intelligence.d.ts

@@ -157,7 +157,9 @@ declare class LocalReasoningBank {
         persistence?: boolean;
     });
     /**
-     * Load patterns from disk
+     * Load patterns from disk, deduplicating by content.
+     * When multiple patterns share identical content, keeps the one with
+     * highest confidence (ties broken by most recent lastUsedAt).
      */
     private loadFromDisk;
     /**
@@ -170,6 +172,9 @@ declare class LocalReasoningBank {
     flushToDisk(): void;
     /**
      * Store a pattern - O(1)
+     * Deduplicates by content: if a pattern with the same content already
+     * exists, the existing entry is updated (bumped usageCount, higher
+     * confidence wins, refreshed lastUsedAt) instead of adding a duplicate.
      */
     store(pattern: Omit<StoredPattern, 'usageCount' | 'createdAt' | 'lastUsedAt'> & Partial<StoredPattern>): void;
     /**

package/v3/@claude-flow/cli/dist/src/memory/intelligence.js

@@ -327,7 +327,9 @@ class LocalReasoningBank {
         }
     }
     /**
-     * Load patterns from disk
+     * Load patterns from disk, deduplicating by content.
+     * When multiple patterns share identical content, keeps the one with
+     * highest confidence (ties broken by most recent lastUsedAt).
      */
     loadFromDisk() {
         try {
@@ -335,10 +337,41 @@ class LocalReasoningBank {
             if (existsSync(path)) {
                 const data = JSON.parse(readFileSync(path, 'utf-8'));
                 if (Array.isArray(data)) {
+                    const totalLoaded = data.length;
+                    // Group by content to deduplicate
+                    const byContent = new Map();
                     for (const pattern of data) {
+                        const key = pattern.content;
+                        const existing = byContent.get(key);
+                        if (!existing) {
+                            byContent.set(key, pattern);
+                        }
+                        else {
+                            // Keep the one with higher confidence; break ties by lastUsedAt
+                            if (pattern.confidence > existing.confidence ||
+                                (pattern.confidence === existing.confidence &&
+                                    (pattern.lastUsedAt ?? 0) > (existing.lastUsedAt ?? 0))) {
+                                // Merge: adopt the higher usageCount sum
+                                pattern.usageCount = (pattern.usageCount ?? 0) + (existing.usageCount ?? 0);
+                                byContent.set(key, pattern);
+                            }
+                            else {
+                                existing.usageCount = (existing.usageCount ?? 0) + (pattern.usageCount ?? 0);
+                            }
+                        }
+                    }
+                    // Populate the bank from deduplicated entries
+                    for (const pattern of byContent.values()) {
                         this.patterns.set(pattern.id, pattern);
                         this.patternList.push(pattern);
                     }
+                    const removed = totalLoaded - byContent.size;
+                    if (removed > 0) {
+                        console.log(`Deduplicated ${removed} patterns (${byContent.size} unique)`);
+                        // Persist the compacted set immediately so the file shrinks on disk
+                        this.dirty = true;
+                        this.flushToDisk();
+                    }
                 }
             }
         }
@@ -380,6 +413,9 @@ class LocalReasoningBank {
     }
     /**
      * Store a pattern - O(1)
+     * Deduplicates by content: if a pattern with the same content already
+     * exists, the existing entry is updated (bumped usageCount, higher
+     * confidence wins, refreshed lastUsedAt) instead of adding a duplicate.
      */
     store(pattern) {
         const now = Date.now();
@@ -401,6 +437,20 @@ class LocalReasoningBank {
             }
         }
         else {
+            // Check for content-duplicate before inserting a new entry
+            const contentDupe = this.patternList.find(p => p.content === pattern.content);
+            if (contentDupe) {
+                // Merge into the existing pattern instead of adding a duplicate
+                contentDupe.usageCount++;
+                contentDupe.lastUsedAt = now;
+                if (stored.confidence > contentDupe.confidence) {
+                    contentDupe.confidence = stored.confidence;
+                }
+                // Keep the Map in sync with the mutated object
+                this.patterns.set(contentDupe.id, contentDupe);
+                this.saveToDisk();
+                return;
+            }
             // Evict oldest if at capacity
             if (this.patterns.size >= this.maxSize) {
                 const oldest = this.patternList.shift();

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.5.69",
+  "version": "3.5.70",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",