claude-flow 3.53.0 → 3.54.1

package/v3/@claude-flow/cli/README.md

@@ -1,24 +1,85 @@
 <div align="center">
 
-[![Ruflo Banner](ruflo/assets/ruflo-small.jpeg)](https://cognitum.one/agentic-engineering)
+<a href="https://cognitum.one/agentic-engineering"><img src="ruflo/assets/ruflo-neon-flicker.gif" alt="Ruflo animated neon sign" width="100%"></a>
+
+**An agent meta-harness for Claude Code and Codex.**
 
 <!-- Try Ruflo — the 3 badges first-time visitors actually act on -->
 [![npm version (ruflo)](https://img.shields.io/npm/v/ruflo?label=npx%20ruflo&style=for-the-badge&logo=npm&color=cb3837)](https://www.npmjs.com/package/ruflo)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://opensource.org/licenses/MIT)
 [![Star on GitHub](https://img.shields.io/github/stars/ruvnet/claude-flow?style=for-the-badge&logo=github&color=gold)](https://github.com/ruvnet/claude-flow)
 
-<!-- Ecosystem strip (collapsed visually with flat-square) -->
-[![🕸️ RuVector Agentic DB](https://img.shields.io/badge/RuVector_Agentic-DB-06b6d4?style=flat-square&logoColor=white&logo=graphql)](https://github.com/ruvnet/ruvector)
-[![Ecosystem downloads](https://img.shields.io/badge/ecosystem%20downloads-8.1M%2B-blue?style=flat-square&logo=npm)](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.proof.json)
-[![Git clones (14d)](https://img.shields.io/badge/git%20clones%2014d-106k-blueviolet?style=flat-square&logo=github)](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.ledger.json)
-[![Claude Code](https://img.shields.io/badge/Claude%20Code-Plugin-D97757?style=flat-square&logoColor=white&logo=anthropic)](https://github.com/ruvnet/claude-flow)
-[![Codex Plugin](https://img.shields.io/badge/Codex-Plugin-412991?style=flat-square&logoColor=white&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI%2BPHBhdGggZmlsbD0id2hpdGUiIGQ9Ik0yMi4yODIgOS44MjFhNS45ODUgNS45ODUgMCAwIDAtLjUxNi00LjkxIDYuMDQ2IDYuMDQ2IDAgMCAwLTYuNTEtMi45QTYuMDY1IDYuMDY1IDAgMCAwIDQuOTgxIDQuMThhNS45ODUgNS45ODUgMCAwIDAtMy45OTggMi45IDYuMDQ2IDYuMDQ2IDAgMCAwIC43NDMgNy4wOTcgNS45OCA1Ljk4IDAgMCAwIC41MSA0LjkxMSA2LjA1MSA2LjA1MSAwIDAgMCA2LjUxNSAyLjlBNS45ODUgNS45ODUgMCAwIDAgMTMuMjYgMjRhNi4wNTYgNi4wNTYgMCAwIDAgNS43NzItNC4yMDYgNS45OSA1Ljk5IDAgMCAwIDMuOTk4LTIuOSA2LjA1NiA2LjA1NiAwIDAgMC0uNzQ3LTcuMDczek0xMy4yNiAyMi40M2E0LjQ3NiA0LjQ3NiAwIDAgMS0yLjg3Ni0xLjA0bC4xNDItLjA4IDQuNzc4LTIuNzU4YS43OTUuNzk1IDAgMCAwIC4zOTMtLjY4MXYtNi43MzdsMi4wMiAxLjE2OGEuMDcxLjA3MSAwIDAgMSAuMDM4LjA1MnY1LjU4M2E0LjUwNCA0LjUwNCAwIDAgMS00LjQ5NSA0LjQ5NHpNMy42IDE4LjMwNGE0LjQ3IDQuNDcgMCAwIDEtLjUzNS0zLjAxNGwuMTQyLjA4NSA0Ljc4MyAyLjc1OWEuNzcxLjc3MSAwIDAgMCAuNzgxIDBsNS44NDMtMy4zNjl2Mi4zMzJhLjA4LjA4IDAgMCAxLS4wMzMuMDYyTDkuNzQgMTkuOTVhNC41IDQuNSAwIDAgMS02LjE0LTEuNjQ2ek0yLjM0IDcuODk2YTQuNDg1IDQuNDg1IDAgMCAxIDIuMzY2LTEuOTczVjExLjZhLjc2Ni43NjYgMCAwIDAgLjM4OC42NzdsNS44MTUgMy4zNTQtMi4wMiAxLjE2OGEuMDc2LjA3NiAwIDAgMS0uMDcyIDBsLTQuODMtMi43ODZBNC41MDQgNC41MDQgMCAwIDEgMi4zNCA3Ljg3MnptMTYuNTk3IDMuODU1LTUuODMzLTMuMzg3IDIuMDE2LTEuMTY1YS4wNzYuMDc2IDAgMCAxIC4wNzEgMGw0LjgzIDIuNzkxYTQuNDk0IDQuNDk0IDAgMCAxLS42NzYgOC4xMDR2LTUuNjc3YS43OS43OSAwIDAgMC0uNDA3LS42Njd6bTIuMDEtMy4wMjMtLjE0MS0uMDg1LTQuNzc0LTIuNzgyYS43NzYuNzc2IDAgMCAwLS43ODUgMEw5LjQwOSA5LjIzVjYuODk3YS4wNjYuMDY2IDAgMCAxIC4wMjgtLjA2Mmw0LjgzLTIuNzg3YTQuNDk5IDQuNDk5IDAgMCAxIDYuNjggNC42NnpNOC4zMDcgMTIuODYzbC0yLjAyLTEuMTY0YS4wOC4wOCAwIDAgMS0uMDM4LS4wNTdWNi4wNzRhNC40OTkgNC40OTkgMCAwIDEgNy4zNzYtMy40NTRsLS4xNDIuMDgtNC43NzggMi43NThhLjc5NS43OTUgMCAwIDAtLjM5My42ODJ6bTEuMDk3LTIuMzY2IDIuNjAyLTEuNSAyLjYwNyAxLjV2Mi45OTlsLTIuNTk3IDEuNS0yLjYwNy0xLjVaIi8%2BPC9zdmc%2B)](https://www.npmjs.com/package/@claude-flow/codex)
+<p align="center">
+<a href="data/npm-downloads.latest.json"><img src="docs/assets/readme/badges/downloads.svg?v=mobile-readable-3" width="300" alt="Ecosystem npm downloads: 12.52M over 12 months through October 4, 2026"></a>
+<br>
+<a href="https://github.com/ruvnet/claude-flow"><img src="docs/assets/readme/badges/claude.svg?v=mobile-readable-3" width="300" alt="Claude Code"></a>
+<a href="https://www.npmjs.com/package/@claude-flow/codex"><img src="docs/assets/readme/badges/codex.svg?v=mobile-readable-3" width="300" alt="Codex Plugin"></a>
+</p>
+
+</div>
+
+<a id="start-here"></a>
+
+## <img src="docs/assets/readme/icons/terminal.svg" width="32" height="32" alt=""> Get started with Ruflo
+
+<img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Start in Claude Code** with core tools, the visual console and runtime mods. Requires Claude Code **2.1.287 or later**. Run inside Claude Code:
+
+```text
+/plugin marketplace add ruvnet/ruflo
+/plugin install ruflo-core@ruflo
+/plugin install ruflo-console@ruflo
+/plugin install ruflo-mods@ruflo
+/reload-plugins
+/ruflo
+```
+
+**Core** provides foundation tools. **Console** opens the agent cockpit. **Mods** add routing and policy enforcement inside Claude Code. Mods run with your account's permissions; review their code before installing.
+
+<img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Using Codex or another MCP enabled tool?** Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server. Run the setup wizard in your project terminal:
+
+```bash
+npx ruflo@latest init wizard
+```
+
+For clients that support local stdio MCP servers, configure **command** `npx` and **arguments** `["-y", "ruflo@latest", "mcp", "start"]`. The equivalent server command is:
+
+```bash
+npx -y ruflo@latest mcp start
+```
+
+MCP exposes Ruflo tools to your client. The console and mods above are Claude Code integrations; hook support depends on the client.
+
+[Compare install paths](#quick-start) · [Open the console](#console-walkthrough) · [User guide](docs/USERGUIDE.md)
+
+<div align="center">
+
+
+### Optional: ruOS Desktop
+
+<a href="https://ruos.cognitum.one"><img src="ruflo/assets/ruos-animated.svg" alt="ruOS — A desktop that runs itself" width="100%"></a>
+
+**Connect ruOS to ChatGPT or Claude via MCP:**
+
+```text
+https://ruos.cognitum.one/mcp
+```
+
+
+
+<!-- RuVector promo -->
+<a href="https://github.com/ruvnet/ruvector"><img src="docs/assets/readme/ruvector-promo-depth.svg" width="100%" alt="RuVector: Give your agents memory. Local vector search, persistent context, graph relationships and feedback learning. Explore RuVector."></a>
+
+```bash
+npx ruvector
+```
+
+
+
 
 # Ruflo
 
 [English](README.md) · [简体中文](README.zh-CN.md)
 
-**An agent meta-harness for Claude Code and Codex.**
 
 [![RuFlo Explained — build an AI team that plans, remembers, tests, and improves](docs/assets/ruflo-explained/ch14.jpg)](docs/ruflo-explained.md)
 
@@ -31,13 +92,16 @@ A 14-chapter guide: from the basic idea to a first useful task, then memory, age
 
 One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
 
-```
-Self-Learning / Self-Optimizing Agent Architecture
+<p align="center"><img src="docs/assets/readme/learning-cinematic-compact.svg" width="100%" alt="Ruflo trajectory learning: branching memory paths, outcome feedback, contrastive AI and local learning. No LLM required for local vector retrieval and contrastive updates; agent execution may still use an LLM."></p>
 
-User --> Ruflo (CLI/MCP) --> Router --> Swarm --> Agents --> Memory --> LLM Providers
-                          ^                           |
-                          +---- Learning Loop <-------+
-```
+<sub>Conceptual learning loop. Local vector retrieval and contrastive updates can run without an LLM; embeddings and configured learning modules are still required. See the <a href="v3/@claude-flow/cli/src/services/ruvector-training.ts">RuVector training integration</a> and <a href="v3/@claude-flow/neural/src/modes/balanced.ts">trajectory contrastive learning</a>.</sub>
+
+<details>
+<summary>Architecture in text</summary>
+
+User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM providers. Memory feeds useful experience back into routing. This is a conceptual flow, not a live execution trace.
+
+</details>
 
 > **New to Ruflo?** You don't need to learn 314 MCP tools or 26 CLI commands. After `init`, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
 
@@ -50,15 +114,34 @@ User --> Ruflo (CLI/MCP) --> Router --> Swarm --> Agents --> Memory --> LLM Prov
 
 ---
 
-<p align="center"><img src="docs/assets/ruflo-console-walkthrough.gif" alt="A walkthrough of the ruflo console inside Claude Code in a near-square frame: the whole boot (the neon sign in its border, the ruvector constellation, every area checked), the main menu entering and its cards folding, then twenty-odd pages one after another (Swarm, Federation, Sandbox, Cost, Memory, Dev Tools and more), the command palette, ruHelp, settings and refresh"></p>
+<p align="center"><img src="docs/assets/readme/console.svg" alt="Mission control: inspect agent work" width="100%"></p>
+
+<p align="center"><img src="docs/assets/ruflo-console-workflows.svg" width="952" height="964" alt="An animated recording of the ruflo console inside Claude Code: the boot (the neon sign and every area checked), then the Workflows page on a sample run: phases and agents with model, tokens and time; drilling from a run into one agent's activity, log and result; search; failure triage; cost; replay and compare; the control tab with a confirm card; and the mission autopilot panel"></p>
+
+<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Your agent cockpit.** Track workflows, agents, models, tokens and cost beside Claude Code. The animation shows startup checks and a **sample workflow**, not a live session.
+
+<img src="docs/assets/readme/console-icon-inspect.svg" width="28" height="28" alt=""> **Inspect any run.** Open agent logs and results, search, triage failures, replay and compare. Start with `npx ruflo init`, restart Claude Code, then `/ruflo`. [Full console tour](docs/assets/ruflo-console-walkthrough-wide.gif).
 
-<sub>The <code>/ruflo</code> console running in Claude Code, shown in a compact, near-square frame (the cockpit docked beside Claude, cropped to the cockpit) so it reads on a phone as well as a desktop: the whole boot (the neon sign in its border, the ruvector constellation lit by what is really installed, every area checked, an easter egg), the main menu entering and its cards folding, the grouped nav, a quick tour of twenty-odd pages (the Swarm topology, the Federation map, the Sandbox page for tmux, RVF and RVM, Cost, Memory, Dev Tools and more), the command palette (a tag on every entry for what it does), <b>ruHelp</b> (built-in help: ask a question, get steps with buttons; a guide for every capability), settings and refresh. A <a href="docs/assets/ruflo-console-walkthrough-wide.gif">wide-display walkthrough</a> shows the same console with room for every label. <code>npx ruflo init</code>, restart Claude Code, then <code>/ruflo</code>.</sub>
+<img src="docs/assets/readme/console-icon-control.svg" width="28" height="28" alt=""> **Let Claude drive. You set the limits.** Enable **Settings → Claude control** to navigate and run console actions. Choose `read`, `write`, `manage` or `full`, with `ask` or `auto` approval. The current default is **read + ask**; raising the level is your choice. Actions above your permission level are refused, and network, spending and destructive actions require confirmation even in `auto`. Review the live action log or press **Take back control** to stop Claude control. [Details](v3/docs/adr/ADR-444-claude-controls-the-console.md).
 
-**Let Claude drive the console.** The console can also be driven *by* Claude: with control turned on (Settings → Claude control), Claude gets four tools (`console_state`, `console_open`, `console_set`, `console_run`) and sets up a mission, opens the Learning Lab or Security page, or runs a palette entry, while the cockpit shows it happening. How far it may go is your setting (`read`, `write`, `manage`, `full`: an action above the level is refused and nothing runs) and whether it waits for your Yes (`ask`) or confirms itself (`auto`). Overview shows a live log of every action and a **Take back control** button that stops all of it at once. It is off by default. See [ADR-444](v3/docs/adr/ADR-444-claude-controls-the-console.md).
+<a id="console-walkthrough"></a>
+
+### One task: create a mission with Claude
+
+<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Watch the recorded console session below.** Claude creates a mission, opens the Learning and Security pages, and reports its actions in Overview.
+
+1. **Set the boundary.** Install the console using the commands below, open `/ruflo`, then choose **Settings → Claude control → write + ask**.
+2. **Give a concrete request.** Try: “Create a mission to add a dark mode toggle. Show me the mission and its status.”
+3. **Approve creation.** Claude opens Missions and sets the goal. Confirm the pending create action in the console.
+4. **Verify the result.** Check that Missions contains the goal and Overview records the action. Creating a mission does not mean the feature has been implemented.
+5. **Keep control.** **Take back control** pauses Claude's console tools. A later call should be refused until you restore control.
+
+**What the recording demonstrates:** a real Claude Haiku session with `write + auto`, mission creation, page navigation, a refused swarm stop, and control being taken back. The steps above use `ask` so you approve creation yourself. The separate workflow animation uses sample data; neither is evidence of completed swarm work or memory recall.
+
+[Implementation and recorded test findings](v3/docs/adr/ADR-444-claude-controls-the-console.md) · [Reproduction script](plugins/ruflo-console/scripts/e2e-control.sh)
 
 <p align="center"><img src="docs/assets/ruflo-console-claude-control.gif" alt="Claude Code with the ruflo console beside it: Claude sets a mission goal, creates the mission and opens the Learning, Security and Overview pages through the console tools; the Claude control dashboard logs each action; swarm-stop is refused because it needs the full level; the person clicks Take back control and the next request is refused"></p>
 
-<sub>A real recording (Claude Haiku, a few cents): control set to <code>write</code> with auto-confirm. Setting a goal and creating the mission is within that level; stopping a swarm needs <code>full</code>, so it is refused; after <b>Take back control</b> every call is refused.</sub>
 
 **Install the mods from the ruflo marketplace** (Claude Code 2.1.287 or later; mods run with your account's permissions and are not sandboxed, so read the code first):
 
@@ -73,6 +156,8 @@ User --> Ruflo (CLI/MCP) --> Router --> Swarm --> Agents --> Memory --> LLM Prov
 
 ## Quick Start
 
+<p align="center"><img src="docs/assets/readme/quick-start.svg" alt="Start building with Ruflo" width="100%"></p>
+
 There are **two different install paths** with very different surface areas. Pick based on what you need (#1744):
 
 | | **Claude Code Plugin** | **CLI install (`npx ruflo init`)** |
@@ -183,7 +268,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 
 </details>
 
-### CLI Install
+### <img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> CLI Install
 
 **macOS / Linux / WSL / Git-Bash:**
 
@@ -207,7 +292,7 @@ npm install -g ruflo@latest
 
 > 💡 **Windows users:** the `curl ... | bash` form needs a POSIX shell (Git-Bash, WSL, MSYS). The `npx ruflo@latest init wizard` line works natively in PowerShell and cmd. If you hit an `'bash' is not recognized` error, use the `npx` line instead — both end up running the same init flow.
 
-### MCP Server
+### <img src="docs/assets/readme/icons/network.svg" width="28" height="28" alt=""> MCP Server
 
 ```bash
 # Add Ruflo as an MCP server in Claude Code
@@ -218,35 +303,39 @@ claude mcp add claude-flow -- npx ruflo@latest mcp start
 
 ## What You Get
 
+<p align="center"><img src="docs/assets/readme/capabilities.svg" alt="Your agent toolkit" width="100%"></p>
+
+<table>
+<tr><td width="50%"><a href="plugins/ruflo-swarm/README.md"><img src="docs/assets/readme/card-swarm.svg" width="100%" alt="Agent teams"></a></td><td width="50%"><a href="plugins/ruflo-rag-memory/README.md"><img src="docs/assets/readme/card-memory.svg" width="100%" alt="Persistent memory"></a></td></tr>
+<tr><td width="50%"><a href="plugins/ruflo-intelligence/README.md"><img src="docs/assets/readme/card-learning.svg" width="100%" alt="Learning loops"></a></td><td width="50%"><a href="plugins/ruflo-security-audit/README.md"><img src="docs/assets/readme/card-security.svg" width="100%" alt="Security controls"></a></td></tr>
+<tr><td width="50%"><a href="https://ruvnet.github.io/ruflo"><img src="docs/assets/readme/card-plugins.svg" width="100%" alt="Plugin marketplace"></a></td><td width="50%"><a href="plugins/ruflo-ruvllm/README.md"><img src="docs/assets/readme/card-routing.svg" width="100%" alt="Models and routing"></a></td></tr>
+</table>
+
 | Capability | Description |
 |------------|-------------|
-| 🤖 **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture |
-| 📡 **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely |
-| 🐝 **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
-| 🧠 **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
-| 💾 **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
-| ⚡ **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
-| 🧩 **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
-| 🔌 **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
-| 🛡️ **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
-| 🌐 **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
-| 🔬 **[MetaHarness](docs/metaharness-user-guide.md)** | Audit your AI agent setup before you ship. Grade readiness (1-100), scan tool configs for security issues, snapshot the whole project to catch regressions over time, and find templates that match your repo. `ruflo eject` turns a ruflo project into a standalone agent toolkit with its own name. [Full guide](docs/metaharness-user-guide.md). |
+| <img src="docs/assets/readme/icons/agents.svg" width="28" height="28" alt=""> **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture |
+| <img src="docs/assets/readme/icons/network.svg" width="28" height="28" alt=""> **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely |
+| <img src="docs/assets/readme/icons/swarm.svg" width="28" height="28" alt=""> **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
+| <img src="docs/assets/readme/icons/learning.svg" width="28" height="28" alt=""> **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
+| <img src="docs/assets/readme/icons/memory.svg" width="28" height="28" alt=""> **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
+| <img src="docs/assets/readme/icons/workers.svg" width="28" height="28" alt=""> **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
+| <img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
+| <img src="docs/assets/readme/icons/routing.svg" width="28" height="28" alt=""> **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
+| <img src="docs/assets/readme/icons/security.svg" width="28" height="28" alt=""> **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
+| <img src="docs/assets/readme/icons/federation.svg" width="28" height="28" alt=""> **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
+| <img src="docs/assets/readme/icons/audit.svg" width="28" height="28" alt=""> **[MetaHarness](docs/metaharness-user-guide.md)** | Audit your AI agent setup before you ship. Grade readiness (1-100), scan tool configs for security issues, snapshot the whole project to catch regressions over time, and find templates that match your repo. `ruflo eject` turns a ruflo project into a standalone agent toolkit with its own name. [Full guide](docs/metaharness-user-guide.md). |
+
+### <img src="docs/assets/readme/icons/learning.svg" width="28" height="28" alt=""> Learning from experience
+
+<p align="center"><img src="docs/assets/readme/learning-flow.svg" width="100%" alt="Recall, execute, evaluate, store, adapt and reuse: an illustrative agent learning cycle."></p>
+
+Useful trajectories and task feedback can inform future work. Results depend on the configured memory, learning components and quality of feedback. [Learning plugin](plugins/ruflo-intelligence/README.md).
 
 ### Agent Federation — Slack for Agents
 
-```
-Your Agent --> [ Remove secrets ] --> [ Sign message ] --> [ Encrypted channel ]
-                 Emails, SSNs,        Proves it came       No one reads it
-                 keys stripped         from you              in transit
-                                                                |
-                                                                v
-Their Agent <-- [ Block attacks ] <-- [ Check identity ] <------+
-                 Stops prompt          Rejects forgeries
-                 injection
-
-                          Audit trail on both sides.
-                  Trust builds over time. Bad behavior = instant downgrade.
-```
+<p align="center"><img src="docs/assets/readme/federation.svg" alt="Connected intelligence across machines" width="100%"></p>
+
+<p align="center"><img src="docs/assets/readme/federation-flow.svg" width="100%" alt="Outbound agent, data filtering, signing and encryption, identity verification, input checks and receiving agent."></p>
 
 Slack gave teams channels. Federation gives agents the same thing — **shared workspaces across trust boundaries**, where agents on different machines, orgs, or cloud regions can discover each other, prove who they are, and collaborate on tasks.
 
@@ -348,6 +437,8 @@ User --> Claude Code / CLI
 
 ## Documentation
 
+<p align="center"><img src="docs/assets/readme/documentation.svg" alt="Guides, architecture and verification" width="100%"></p>
+
 Four docs for four audiences:
 
 | Doc | When to read it |
@@ -378,6 +469,8 @@ User Guide section index:
 
 ## Support
 
+<p align="center"><img src="docs/assets/readme/support.svg" alt="Build with the Ruflo community" width="100%"></p>
+
 | Resource | Link |
 |----------|------|
 | Documentation | [User Guide](docs/USERGUIDE.md) |
@@ -386,6 +479,10 @@ User Guide section index:
 | Community | [Agentics Foundation Discord](https://discord.com/invite/dfxmpwkG2D) |
 | Powered by | [Cognitum.one](https://cognitum.one) |
 
+<p align="center"><img src="docs/assets/readme/signal-divider.svg" alt="Ruflo" width="100%"></p>
+
 ## License
 
 MIT - [RuvNet](https://github.com/ruvnet)
+
+<a href="https://cognitum.one"><img src="docs/assets/readme/cognitum-banner-v2.svg" width="100%" alt="Cognitum One: Ambient Intelligence at the edge of the Physical World. Explore cognitum.one."></a>

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-06T06:48:49.886Z",
-  "gitSha": "b862efab",
+  "generatedAt": "2026-10-07T07:34:48.002Z",
+  "gitSha": "b9ce891c",
   "catalog": {
     "agents": 176,
     "tools": 423,

package/v3/@claude-flow/cli/dist/src/blocking-stdio.d.ts

@@ -0,0 +1,11 @@
+/**
+ * #3851: stdout/stderr writes to a pipe are asynchronous on POSIX, so the
+ * `process.exit()` calls that follow a command (bin wrappers, CLI.run error
+ * paths, commands that exit themselves) discard whatever the consumer has not
+ * read yet, i.e. everything past the pipe buffer (64 KiB). Switching the pipe
+ * handles to blocking mode makes every write complete before it returns, so
+ * every exit path is safe. Same technique as the MCP stdio server.
+ * Files and TTYs are already synchronous and are left alone.
+ */
+export declare function ensureBlockingStdio(): void;
+//# sourceMappingURL=blocking-stdio.d.ts.map

package/v3/@claude-flow/cli/dist/src/blocking-stdio.js

@@ -0,0 +1,23 @@
+/**
+ * #3851: stdout/stderr writes to a pipe are asynchronous on POSIX, so the
+ * `process.exit()` calls that follow a command (bin wrappers, CLI.run error
+ * paths, commands that exit themselves) discard whatever the consumer has not
+ * read yet, i.e. everything past the pipe buffer (64 KiB). Switching the pipe
+ * handles to blocking mode makes every write complete before it returns, so
+ * every exit path is safe. Same technique as the MCP stdio server.
+ * Files and TTYs are already synchronous and are left alone.
+ */
+export function ensureBlockingStdio() {
+    for (const stream of [process.stdout, process.stderr]) {
+        const s = stream;
+        if (s.isTTY)
+            continue;
+        try {
+            s._handle?.setBlocking?.(true);
+        }
+        catch {
+            // best effort: never fail the CLI because stdio could not be switched
+        }
+    }
+}
+//# sourceMappingURL=blocking-stdio.js.map

package/v3/@claude-flow/cli/dist/src/commands/memory.js

@@ -9,6 +9,7 @@ import { distillCommand } from './memory-distill.js';
 import { backupCommand } from './memory-backup.js';
 import { countSiblingStoreRows } from '../memory/sibling-store.js';
 import { resolveDbPath } from '../memory/memory-initializer.js';
+import { MAX_LIST_EMBEDDINGS } from '../memory/embedding-q8.js';
 import { existsSync } from 'node:fs';
 import { siblingAgentDbPath } from '../memory/memory-bridge.js';
 import { validateIdentifier } from '../mcp-tools/validate-input.js';
@@ -778,16 +779,23 @@ const listCommand = {
             type: 'number',
             default: 20
         },
+        {
+            name: 'embeddings',
+            description: `ADR-472: with --format json, add each entry's stored embedding as int8+scale (embeddingQ8: {dims, scale, b64}); read-only, at most ${MAX_LIST_EMBEDDINGS} entries per call`,
+            type: 'boolean',
+            default: false
+        },
         DB_PATH_OPTION
     ],
     action: async (ctx) => {
         const namespace = ctx.flags.namespace;
         const limit = ctx.flags.limit;
+        const includeEmbedding = ctx.flags.embeddings === true && ctx.flags.format === 'json';
         // Use sql.js directly for consistent data access
         try {
             const { listEntries, resolveDbPath: _rdbList } = await import('../memory/memory-initializer.js');
             const dbPathList = _rdbList(ctx.flags.path);
-            const listResult = await listEntries({ namespace, limit, offset: 0, dbPath: dbPathList });
+            const listResult = await listEntries({ namespace, limit, offset: 0, dbPath: dbPathList, ...(includeEmbedding && { includeEmbedding: true }) });
             if (!listResult.success) {
                 output.printError(`Failed to list: ${listResult.error}`);
                 return { success: false, exitCode: 1 };

package/v3/@claude-flow/cli/dist/src/commands/session.js

@@ -7,6 +7,8 @@ import { confirm, input, select } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
 import * as fs from 'fs';
 import * as path from 'path';
+import { stringify as stringifyYaml } from 'yaml';
+import { gzipSync, gunzipSync } from 'node:zlib';
 // Format date for display
 function formatDate(dateStr) {
     if (!dateStr)
@@ -561,7 +563,7 @@ const exportCommand = {
             // Format output
             let content;
             if (exportFormat === 'yaml') {
-                content = toSimpleYaml(result.data);
+                content = stringifyYaml(result.data);
             }
             else {
                 content = JSON.stringify(result.data, null, 2);
@@ -570,7 +572,8 @@ const exportCommand = {
             const absolutePath = path.isAbsolute(outputPath)
                 ? outputPath
                 : path.join(ctx.cwd, outputPath);
-            fs.writeFileSync(absolutePath, content, 'utf-8');
+            const bytes = compress ? gzipSync(content) : Buffer.from(content, 'utf-8');
+            fs.writeFileSync(absolutePath, bytes);
             spinner.succeed('Session exported');
             output.writeln();
             // session_export returns the whole record under `data`; its stats live there.
@@ -587,14 +590,14 @@ const exportCommand = {
                     { property: 'Agents', value: exportStats.agentCount ?? exportStats.agents ?? 0 },
                     { property: 'Tasks', value: exportStats.taskCount ?? exportStats.tasks ?? 0 },
                     { property: 'Memory Entries', value: exportStats.memoryEntries ?? 0 },
-                    { property: 'File Size', value: formatSize(content.length) }
+                    { property: 'File Size', value: formatSize(bytes.length) }
                 ]
             });
             output.writeln();
             output.printSuccess(`Session exported to ${outputPath}`);
             return {
                 success: true,
-                data: { sessionId, outputPath, format: exportFormat, size: content.length }
+                data: { sessionId, outputPath, format: exportFormat, size: bytes.length }
             };
         }
         catch (error) {
@@ -647,9 +650,11 @@ const importCommand = {
         try {
             // The YAML written by `session export --format yaml` is display-only;
             // there is no YAML parser here, so say so instead of failing obscurely.
-            if (absolutePath.endsWith('.yaml') || absolutePath.endsWith('.yml')) {
+            if (/\.ya?ml(?:\.gz)?$/i.test(absolutePath)) {
                 try {
-                    JSON.parse(fs.readFileSync(absolutePath, 'utf-8'));
+                    const bytes = fs.readFileSync(absolutePath);
+                    const content = bytes[0] === 0x1f && bytes[1] === 0x8b ? gunzipSync(bytes) : bytes;
+                    JSON.parse(content.toString('utf-8'));
                 }
                 catch {
                     spinner.fail('Failed to import session');
@@ -783,37 +788,6 @@ function formatDuration(ms) {
     }
     return `${seconds}s`;
 }
-function toSimpleYaml(obj, indent = 0) {
-    // Simple YAML serializer (for basic types)
-    if (obj === null)
-        return 'null';
-    if (typeof obj === 'boolean')
-        return String(obj);
-    if (typeof obj === 'number')
-        return String(obj);
-    if (typeof obj === 'string')
-        return obj.includes(':') ? `"${obj}"` : obj;
-    const spaces = '  '.repeat(indent);
-    let result = '';
-    if (Array.isArray(obj)) {
-        for (const item of obj) {
-            result += `${spaces}- ${toSimpleYaml(item, indent + 1).trim()}\n`;
-        }
-        return result;
-    }
-    if (typeof obj === 'object') {
-        for (const [key, value] of Object.entries(obj)) {
-            if (typeof value === 'object' && value !== null) {
-                result += `${spaces}${key}:\n${toSimpleYaml(value, indent + 1)}`;
-            }
-            else {
-                result += `${spaces}${key}: ${toSimpleYaml(value, indent)}\n`;
-            }
-        }
-        return result;
-    }
-    return String(obj);
-}
 // Main session command
 export const sessionCommand = {
     name: 'session',

package/v3/@claude-flow/cli/dist/src/index.js

@@ -19,6 +19,7 @@ import { output } from './output.js';
 import { commands, getCommandsByCategory, getCommand, getCommandAsync, getCommandNames, getLazyCommandNames, hasCommand } from './commands/index.js';
 import { suggestCommand } from './suggest.js';
 import { runStartupUpdateCheck } from './update/index.js';
+import { ensureBlockingStdio } from './blocking-stdio.js';
 // Read version from package.json at runtime
 function getPackageVersion() {
     try {
@@ -66,6 +67,8 @@ export class CLI {
      * Run the CLI with given arguments
      */
     async run(args = process.argv.slice(2)) {
+        // #3851: keep piped output intact across the process.exit() calls below
+        ensureBlockingStdio();
         try {
             // #1791.2 — If the user invoked a lazy command (e.g. `hive-mind task`),
             // pre-load it BEFORE parsing so the parser can build scoped flag

package/v3/@claude-flow/cli/dist/src/init/executor.js

@@ -1464,6 +1464,7 @@ data/
 logs/
 sessions/
 neural/
+console/
 *.log
 *.tmp
 `;

package/v3/@claude-flow/cli/dist/src/init/helpers-generator.js

@@ -436,6 +436,7 @@ module.exports = commands;
 // Literal-word root guard mirrored in the mod and both shipped classic helpers.
 const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, depth = 0) {
   let word = '', quote = '', started = false, redirect = false
+  let ansiNul = false // a NUL inside $'...' ends that string, as in bash
   let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
   const isRoot = (operand) => {
     if (!operand.startsWith('/')) return false
@@ -447,22 +448,55 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     }
     return parts.length === 0 || /[*?\[]/.test(parts[0])
   }
+  // One backslash escape inside $'...', from the character after the backslash.
+  // Returns the text it stands for and the index of its last character. An unknown escape keeps its backslash.
+  // The command arrives lowercased, so an uppercase-U escape reads as a lowercase one: eight digits starting 0000 are one code point.
+  const ansiEscape = (s, at) => {
+    const c = s[at]
+    const simple = { a: '\x07', b: '\b', e: '\x1b', f: '\f', n: '\n', r: '\r', t: '\t', v: '\v', '\\': '\\', "'": "'", '"': '"', '?': '?' }
+    if (simple[c] !== undefined) return [simple[c], at]
+    const digits = (from, max, pattern) => pattern.exec(s.slice(from, from + max))?.[0]
+    const octal = digits(at, 3, /^[0-7]+/)
+    if (octal) return [String.fromCharCode(parseInt(octal, 8) & 255), at + octal.length - 1]
+    const hex = c === 'x' ? digits(at + 1, 2, /^[0-9a-f]+/) : undefined
+    if (hex) return [String.fromCharCode(parseInt(hex, 16)), at + hex.length]
+    const wide = c === 'u' ? (digits(at + 1, 8, /^0000[0-9a-f]{4}$/) ?? digits(at + 1, 4, /^[0-9a-f]+/)) : undefined
+    if (wide) return [String.fromCodePoint(parseInt(wide, 16)), at + wide.length]
+    if (c === 'c' && at + 1 < s.length) return [String.fromCharCode(s.charCodeAt(at + 1) & 31), at + 1]
+    return ['\\' + c, at]
+  }
   const finishWord = () => {
     if (!started) return false
     // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
     // Bound rescanning to four levels; beyond that retain its conservative check.
-    if (word.includes('rm') && /[\s;&|()]/.test(word)) {
+    if (/[\s;&|()\x60]/.test(word)) {
       if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
     }
     if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
     else if (!optionsEnded && word === '--') optionsEnded = true
     else if (!optionsEnded && word.startsWith('-')) {
-      recursive = recursive || word === '--recursive' || /^-[a-z]*r[a-z]*$/.test(word)
-      force = force || word === '--force' || /^-[a-z]*f[a-z]*$/.test(word)
+      // GNU getopt accepts any unambiguous long-option prefix: --r, --recur, --forc.
+      recursive = recursive || (word.length > 2 && '--recursive'.startsWith(word)) || /^-[a-z]*r[a-z]*$/.test(word)
+      force = force || (word.length > 2 && '--force'.startsWith(word)) || /^-[a-z]*f[a-z]*$/.test(word)
     } else root = root || isRoot(word)
     word = ''; started = false
     return inRm && recursive && force && root
   }
+  // A command substitution's body, from just after its opening backtick. Bash removes a
+  // backslash only before $, a backtick or a backslash (and " inside double quotes) and
+  // drops backslash-newline; any other backslash stays for the nested scan.
+  const substitution = (from, inDouble) => {
+    let body = '', j = from
+    for (; j < command.length && command[j] !== '\x60'; j++) {
+      const next = command[j + 1]
+      if (command[j] === '\\' && j + 1 < command.length) {
+        if (next === '\n') { j++; continue }
+        if (next === '$' || next === '\x60' || next === '\\' || (inDouble && next === '"')) { body += next; j++; continue }
+      }
+      body += command[j]
+    }
+    return [j, depth < 4 ? hasRootDelete(body, depth + 1) : body.includes('rm -rf /')]
+  }
   const finishCommand = () => {
     const denied = inRm && recursive && force && root
     inRm = optionsEnded = recursive = force = root = false
@@ -473,7 +507,25 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     const redirectionAmpersand = char === '&' && (redirect || command[i + 1] === '>')
     redirect = false
     if (quote) {
+      if (quote === "$'") {
+        if (char === "'") { quote = ''; ansiNul = false }
+        else if (char === '\\' && i + 1 < command.length) {
+          const [text, last] = ansiEscape(command, i + 1)
+          i = last
+          if (!ansiNul) { const nul = text.indexOf('\0'); if (nul < 0) word += text; else { word += text.slice(0, nul); ansiNul = true } }
+        } else if (!ansiNul) word += char
+        continue
+      }
       if (char === quote) quote = ''
+      else if (quote === '"' && char === '\x60' && command.indexOf('\x60', i + 1) > i) {
+        const [end, denied] = substitution(i + 1, true)
+        if (denied) return true
+        // The substitution is gone from the word, as bash's empty output is (a quoted empty substitution glued to -rf leaves -rf).
+        // A # right after it is still inside the word: a placeholder keeps a rescan (sh -c "...")
+        // from reading it as the start of a comment.
+        if (command[end + 1] === '#') word += '\u0001'
+        i = end
+      }
       else if (quote === '"' && char === '\\' && i + 1 < command.length &&
         (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
           command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
@@ -485,6 +537,16 @@ const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, dep
     if (char === '\\' && i + 1 < command.length) {
       const next = command[++i]
       if (next !== '\n') { word += next; started = true }
+    } else if (char === '\x60' && command.indexOf('\x60', i + 1) > i) {
+      // Command substitution: scan the body as its own command; the substitution
+      // stays inside the enclosing word, so the rm being parsed keeps its state,
+      // and the word has started (a # right after it is not a comment).
+      const [end, denied] = substitution(i + 1, false)
+      if (denied) return true
+      i = end; started = true
+    } else if (char === '$' && (command[i + 1] === "'" || command[i + 1] === '"')) {
+      // ANSI-C ($'...': escapes decoded) and locale ($"...") quoting: the $ is not part of the word.
+      quote = command[i + 1] === "'" ? "$'" : '"'; started = true; i++
     } else if (char === '"' || char === "'") {
       quote = char; started = true
     } else if (char === '#' && !started) {