claude-flow 3.56.10 → 3.57.1

package/v3/@claude-flow/cli/README.md

@@ -1,22 +1,90 @@
 <div align="center">
 
-[![Ruflo Banner](ruflo/assets/ruflo-small.jpeg)](https://cognitum.one/agentic-engineering)
+<a href="https://cognitum.one/agentic-engineering"><img src="ruflo/assets/ruflo-neon-flicker.gif" alt="Ruflo animated neon sign" width="100%"></a>
+
+**An agent meta-harness for Claude Code and Codex.**
 
 <!-- Try Ruflo — the 3 badges first-time visitors actually act on -->
 [![npm version (ruflo)](https://img.shields.io/npm/v/ruflo?label=npx%20ruflo&style=for-the-badge&logo=npm&color=cb3837)](https://www.npmjs.com/package/ruflo)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://opensource.org/licenses/MIT)
 [![Star on GitHub](https://img.shields.io/github/stars/ruvnet/claude-flow?style=for-the-badge&logo=github&color=gold)](https://github.com/ruvnet/claude-flow)
 
-<!-- Ecosystem strip (collapsed visually with flat-square) -->
-[![🕸️ RuVector Agentic DB](https://img.shields.io/badge/RuVector_Agentic-DB-06b6d4?style=flat-square&logoColor=white&logo=graphql)](https://github.com/ruvnet/ruvector)
-[![Ecosystem downloads](https://img.shields.io/badge/ecosystem%20downloads-8.1M%2B-blue?style=flat-square&logo=npm)](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.proof.json)
-[![Git clones (14d)](https://img.shields.io/badge/git%20clones%2014d-106k-blueviolet?style=flat-square&logo=github)](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.ledger.json)
-[![Claude Code](https://img.shields.io/badge/Claude%20Code-Plugin-D97757?style=flat-square&logoColor=white&logo=anthropic)](https://github.com/ruvnet/claude-flow)
-[![Codex Plugin](https://img.shields.io/badge/Codex-Plugin-412991?style=flat-square&logoColor=white&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI%2BPHBhdGggZmlsbD0id2hpdGUiIGQ9Ik0yMi4yODIgOS44MjFhNS45ODUgNS45ODUgMCAwIDAtLjUxNi00LjkxIDYuMDQ2IDYuMDQ2IDAgMCAwLTYuNTEtMi45QTYuMDY1IDYuMDY1IDAgMCAwIDQuOTgxIDQuMThhNS45ODUgNS45ODUgMCAwIDAtMy45OTggMi45IDYuMDQ2IDYuMDQ2IDAgMCAwIC43NDMgNy4wOTcgNS45OCA1Ljk4IDAgMCAwIC41MSA0LjkxMSA2LjA1MSA2LjA1MSAwIDAgMCA2LjUxNSAyLjlBNS45ODUgNS45ODUgMCAwIDAgMTMuMjYgMjRhNi4wNTYgNi4wNTYgMCAwIDAgNS43NzItNC4yMDYgNS45OSA1Ljk5IDAgMCAwIDMuOTk4LTIuOSA2LjA1NiA2LjA1NiAwIDAgMC0uNzQ3LTcuMDczek0xMy4yNiAyMi40M2E0LjQ3NiA0LjQ3NiAwIDAgMS0yLjg3Ni0xLjA0bC4xNDItLjA4IDQuNzc4LTIuNzU4YS43OTUuNzk1IDAgMCAwIC4zOTMtLjY4MXYtNi43MzdsMi4wMiAxLjE2OGEuMDcxLjA3MSAwIDAgMSAuMDM4LjA1MnY1LjU4M2E0LjUwNCA0LjUwNCAwIDAgMS00LjQ5NSA0LjQ5NHpNMy42IDE4LjMwNGE0LjQ3IDQuNDcgMCAwIDEtLjUzNS0zLjAxNGwuMTQyLjA4NSA0Ljc4MyAyLjc1OWEuNzcxLjc3MSAwIDAgMCAuNzgxIDBsNS44NDMtMy4zNjl2Mi4zMzJhLjA4LjA4IDAgMCAxLS4wMzMuMDYyTDkuNzQgMTkuOTVhNC41IDQuNSAwIDAgMS02LjE0LTEuNjQ2ek0yLjM0IDcuODk2YTQuNDg1IDQuNDg1IDAgMCAxIDIuMzY2LTEuOTczVjExLjZhLjc2Ni43NjYgMCAwIDAgLjM4OC42NzdsNS44MTUgMy4zNTQtMi4wMiAxLjE2OGEuMDc2LjA3NiAwIDAgMS0uMDcyIDBsLTQuODMtMi43ODZBNC41MDQgNC41MDQgMCAwIDEgMi4zNCA3Ljg3MnptMTYuNTk3IDMuODU1LTUuODMzLTMuMzg3IDIuMDE2LTEuMTY1YS4wNzYuMDc2IDAgMCAxIC4wNzEgMGw0LjgzIDIuNzkxYTQuNDk0IDQuNDk0IDAgMCAxLS42NzYgOC4xMDR2LTUuNjc3YS43OS43OSAwIDAgMC0uNDA3LS42Njd6bTIuMDEtMy4wMjMtLjE0MS0uMDg1LTQuNzc0LTIuNzgyYS43NzYuNzc2IDAgMCAwLS43ODUgMEw5LjQwOSA5LjIzVjYuODk3YS4wNjYuMDY2IDAgMCAxIC4wMjgtLjA2Mmw0LjgzLTIuNzg3YTQuNDk5IDQuNDk5IDAgMCAxIDYuNjggNC42NnpNOC4zMDcgMTIuODYzbC0yLjAyLTEuMTY0YS4wOC4wOCAwIDAgMS0uMDM4LS4wNTdWNi4wNzRhNC40OTkgNC40OTkgMCAwIDEgNy4zNzYtMy40NTRsLS4xNDIuMDgtNC43NzggMi43NThhLjc5NS43OTUgMCAwIDAtLjM5My42ODJ6bTEuMDk3LTIuMzY2IDIuNjAyLTEuNSAyLjYwNyAxLjV2Mi45OTlsLTIuNTk3IDEuNS0yLjYwNy0xLjVaIi8%2BPC9zdmc%2B)](https://www.npmjs.com/package/@claude-flow/codex)
+<p align="center">
+<a href="docs/harness-origins.md"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/e69e4b95aa08d65ea0f7715489bbf8e62a83a0d2/docs/assets/readme/badges/first-commit.svg" width="300" height="76" alt="Claude Flow lineage: first commit June 2, 2025 by rUv; inspect the evidence"></a>
+<a href="data/npm-downloads.latest.json"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/275aff65a198af758923669acff36f03d1f41623/docs/assets/readme/badges/downloads.svg" width="300" height="76" alt="Illustrative download counter starts at 98,000,000 and adds varied amounts each second in a 30 second loop. Verified dataset: 97,022,120 download events."></a>
+<br>
+<a href="https://github.com/ruvnet/claude-flow"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/d1e80400bdefe01d3b13e70395f88fffab76bb18/docs/assets/readme/badges/claude.svg" width="300" height="76" alt="Claude Code plugin"></a>
+<a href="https://www.npmjs.com/package/@claude-flow/codex"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/d1e80400bdefe01d3b13e70395f88fffab76bb18/docs/assets/readme/badges/codex.svg" width="300" height="76" alt="Codex plugin"></a>
+</p>
+
+</div>
+
+<a id="start-here"></a>
+
+## <img src="docs/assets/readme/icons/terminal.svg" width="32" height="32" alt=""> Get started with Ruflo
+
+<img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Start in Claude Code** with core tools, the visual console and runtime mods. Requires Claude Code **2.1.287 or later**. Run inside Claude Code:
+
+```text
+/plugin marketplace add ruvnet/ruflo
+/plugin install ruflo-core@ruflo
+/plugin install ruflo-console@ruflo
+/plugin install ruflo-mods@ruflo
+/reload-plugins
+/ruflo
+```
+
+**Core** provides foundation tools. **Console** opens the agent cockpit. **Mods** add routing and policy enforcement inside Claude Code. Mods run with your account's permissions; review their code before installing.
+
+<img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Using Codex or another MCP enabled tool?** Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server. Run the setup wizard in your project terminal:
+
+```bash
+npx ruflo@latest init wizard
+```
+
+For clients that support local stdio MCP servers, configure **command** `npx` and **arguments** `["-y", "ruflo@latest", "mcp", "start"]`. The equivalent server command is:
+
+```bash
+npx -y ruflo@latest mcp start
+```
+
+MCP exposes Ruflo tools to your client. The console and mods above are Claude Code integrations; hook support depends on the client.
+
+<img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Prefer a plain terminal? Optional.** The console also runs on its own, with no Claude Code: `npx ruflo tui` (add `--plain` to print one frame for scripts). It shows Overview, Cost, Swarm, Events and Missions, plus an optional AI page. [Terminal UI guide](docs/USERGUIDE.md#terminal-ui-optional)
+
+<p align="center"><img src="docs/assets/ruflo-tui-compact.svg" width="640" alt="Looping recording of the optional ruflo terminal UI with its pictures: Overview in the Classic BBS look, the Orbital look with its moving globe, and the Swarm graph, in a sample project"></p>
+
+[Compare install paths](#quick-start) · [Open the console](#console-walkthrough) · [User guide](docs/USERGUIDE.md)
+
+<div align="center">
+
+
+### Optional: ruOS Desktop
+
+<a href="https://ruos.cognitum.one"><img src="ruflo/assets/ruos-animated.svg" alt="ruOS — A desktop that runs itself" width="100%"></a>
+
+**Connect ruOS to ChatGPT or Claude via MCP:**
+
+```text
+https://ruos.cognitum.one/mcp
+```
+
+
+
+<!-- RuVector promo -->
+<a href="https://github.com/ruvnet/ruvector"><img src="docs/assets/readme/ruvector-promo-depth.svg" width="100%" alt="RuVector: Give your agents memory. Local vector search, persistent context, graph relationships and feedback learning. Explore RuVector."></a>
+
+```bash
+npx ruvector
+```
+
+
+
 
 # Ruflo
 
-**An agent meta-harness for Claude Code and Codex.**
+[English](README.md) · [简体中文](README.zh-CN.md)
+
 
 [![RuFlo Explained — build an AI team that plans, remembers, tests, and improves](docs/assets/ruflo-explained/ch14.jpg)](docs/ruflo-explained.md)
 
@@ -29,16 +97,27 @@ A 14-chapter guide: from the basic idea to a first useful task, then memory, age
 
 One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
 
-```
-Self-Learning / Self-Optimizing Agent Architecture
+<p align="center"><img src="docs/assets/readme/learning-cinematic-compact.svg" width="100%" alt="Ruflo trajectory learning: branching memory paths, outcome feedback, contrastive AI and local learning. No LLM required for local vector retrieval and contrastive updates; agent execution may still use an LLM."></p>
 
-User --> Ruflo (CLI/MCP) --> Router --> Swarm --> Agents --> Memory --> LLM Providers
-                          ^                           |
-                          +---- Learning Loop <-------+
-```
+<sub>Conceptual learning loop. Local vector retrieval and contrastive updates can run without an LLM; embeddings and configured learning modules are still required. See the <a href="v3/@claude-flow/cli/src/services/ruvector-training.ts">RuVector training integration</a> and <a href="v3/@claude-flow/neural/src/modes/balanced.ts">trajectory contrastive learning</a>.</sub>
+
+<details>
+<summary>Architecture in text</summary>
+
+User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM providers. Memory feeds useful experience back into routing. This is a conceptual flow, not a live execution trace.
+
+</details>
 
 > **New to Ruflo?** You don't need to learn 314 MCP tools or 26 CLI commands. After `init`, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
 
+### An origin you can inspect
+
+[![Claude Flow to Ruflo: founding idea on June 2, 2025, orchestration source on June 10, and the continuing Ruflo lineage.](docs/assets/readme/harness-origins.svg)](docs/harness-origins.md)
+
+**Built by [Reuven Cohen (rUv)](https://github.com/ruvnet), originally as Claude Flow.** The [first commit, June 2, 2025](https://github.com/ruvnet/ruflo/commit/7c1f9402d70e7af56c01a879073cbac92564dc4e), describes a code orchestration layer for recursive agent cycles: Claude writes, edits, tests and improves. The [June 10 source snapshot](https://github.com/ruvnet/ruflo/tree/dba545f012ea92a2375a26332bbf3797495e93c9) adds orchestration, task scheduling, memory and terminal modules.
+
+A harness is the workbench around the model: it organizes tasks, carries context between steps and helps check results. **This establishes Ruflo's lineage, not a universal first across every Claude Code tool.** [See the illustrated explainer, exact commits and earlier ecosystem context](docs/harness-origins.md).
+
 <details>
 <summary><strong>📖 Background — where the name comes from</strong></summary>
 
@@ -48,10 +127,52 @@ User --> Ruflo (CLI/MCP) --> Router --> Swarm --> Agents --> Memory --> LLM Prov
 
 ---
 
-![Ruflo Plugins](./ruflo-plugins.gif)
+<p align="center"><img src="docs/assets/readme/console.svg" alt="Mission control: inspect agent work" width="100%"></p>
+
+<p align="center"><a href="https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg"><img src="docs/assets/ruflo-console-theme-compact.svg" width="100%" alt="Ruflo Orbital theme: animated boot checks, block logo, menu icons, rotating globe, swarm routing, six color palettes and responsive Theme Studio"></a></p>
+
+[Open animated demo](https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg) · [Theme Studio guide](plugins/ruflo-console/README.md) · [Workflow demo](docs/assets/ruflo-console-workflows.svg)
+
+<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Your agent cockpit.** Track workflows, agents, models, tokens and cost beside Claude Code. The 38 second animation shows **Orbital and Theme Studio** through actual renderer frames, including boot checks, six palettes, customization, saved themes, JSON import and resizing. This compact 3.84 MB SVG retains all 456 frames. Native host and AI provider execution are not demonstrated.
+
+<img src="docs/assets/readme/console-icon-inspect.svg" width="28" height="28" alt=""> **Inspect any run.** Open agent logs and results, search, triage failures, replay and compare. Start with `npx ruflo init`, restart Claude Code, then `/ruflo`. [Full console tour](docs/assets/ruflo-console-walkthrough-wide.gif).
+
+<img src="docs/assets/readme/console-icon-control.svg" width="28" height="28" alt=""> **Let Claude drive. You set the limits.** Enable **Settings → Claude control** to navigate and run console actions. Choose `read`, `write`, `manage` or `full`, with `ask` or `auto` approval. The current default is **read + ask**; raising the level is your choice. Actions above your permission level are refused, and network, spending and destructive actions require confirmation even in `auto`. Review the live action log or press **Take back control** to stop Claude control. [Details](v3/docs/adr/ADR-444-claude-controls-the-console.md).
+
+<a id="console-walkthrough"></a>
+
+### One task: create a mission with Claude
+
+<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Watch the recorded console session below.** Claude creates a mission, opens the Learning and Security pages, and reports its actions in Overview.
+
+1. **Set the boundary.** Install the console using the commands below, open `/ruflo`, then choose **Settings → Claude control → write + ask**.
+2. **Give a concrete request.** Try: “Create a mission to add a dark mode toggle. Show me the mission and its status.”
+3. **Approve creation.** Claude opens Missions and sets the goal. Confirm the pending create action in the console.
+4. **Verify the result.** Check that Missions contains the goal and Overview records the action. Creating a mission does not mean the feature has been implemented.
+5. **Keep control.** **Take back control** pauses Claude's console tools. A later call should be refused until you restore control.
+
+**What the recording demonstrates:** a real Claude Haiku session with `write + auto`, mission creation, page navigation, a refused swarm stop, and control being taken back. The steps above use `ask` so you approve creation yourself. The linked workflow animation uses sample data, while the theme demo replays renderer frames. Neither is evidence of completed swarm work or memory recall.
+
+[Implementation and recorded test findings](v3/docs/adr/ADR-444-claude-controls-the-console.md) · [Reproduction script](plugins/ruflo-console/scripts/e2e-control.sh)
+
+<p align="center"><img src="docs/assets/ruflo-console-claude-control.gif" alt="Claude Code with the ruflo console beside it: Claude sets a mission goal, creates the mission and opens the Learning, Security and Overview pages through the console tools; the Claude control dashboard logs each action; swarm-stop is refused because it needs the full level; the person clicks Take back control and the next request is refused"></p>
+
+
+**Install the mods from the ruflo marketplace** (Claude Code 2.1.287 or later; mods run with your account's permissions and are not sandboxed, so read the code first):
+
+```text
+/plugin marketplace add ruvnet/ruflo
+/plugin install ruflo-console@ruflo
+/plugin install ruflo-mods@ruflo
+/reload-plugins
+```
+
+`ruflo-console` is the cockpit above, `ruflo-mods` routes prompts and enforces policy in-process, `ruflo-swarm` shows the swarm in a pane, and `ruflo-ruos` adds the ruOS status segment. Open `/plugin` to confirm they appear in the active mods line. Inside the console, `/ruflo market` is the Plugin Catalog: every ruflo plugin, mod and skill with what it ships, and buttons to install, enable, disable and update (each asks first).
 
 ## Quick Start
 
+<p align="center"><img src="docs/assets/readme/quick-start.svg" alt="Start building with Ruflo" width="100%"></p>
+
 There are **two different install paths** with very different surface areas. Pick based on what you need (#1744):
 
 | | **Claude Code Plugin** | **CLI install (`npx ruflo init`)** |
@@ -162,7 +283,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 
 </details>
 
-### CLI Install
+### <img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> CLI Install
 
 **macOS / Linux / WSL / Git-Bash:**
 
@@ -186,68 +307,50 @@ npm install -g ruflo@latest
 
 > 💡 **Windows users:** the `curl ... | bash` form needs a POSIX shell (Git-Bash, WSL, MSYS). The `npx ruflo@latest init wizard` line works natively in PowerShell and cmd. If you hit an `'bash' is not recognized` error, use the `npx` line instead — both end up running the same init flow.
 
-### MCP Server
+### <img src="docs/assets/readme/icons/network.svg" width="28" height="28" alt=""> MCP Server
 
 ```bash
 # Add Ruflo as an MCP server in Claude Code
 claude mcp add claude-flow -- npx ruflo@latest mcp start
 ```
 
-#### HTTP transport security
+---
 
-`ruflo mcp start -t http` exposes every registered tool over HTTP (`/rpc`, `/mcp`, `/ws`). The default `stdio` transport is not affected.
+## What You Get
 
-| Setting | Effect |
-|---|---|
-| `RUFLO_MCP_HTTP_TOKEN=<token>` | Require `Authorization: Bearer <token>` on every request. Failure is a bare `401`. The token is compared in constant time and is never logged. Prefer this over `--auth-token`, which is visible in `ps`. |
-| `--auth-token-file <path>` | Read the token from a file (one line). Takes precedence over the env var. |
-| `--auth-token <token>` | Same, on the command line (visible in argv; highest precedence). |
-| `RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1` | Allow an unauthenticated bind to a non-loopback `--host`. Only for a trusted network boundary or an authenticating reverse proxy. |
+<p align="center"><img src="docs/assets/readme/capabilities.svg" alt="Your agent toolkit" width="100%"></p>
 
-A token must be 16-512 printable ASCII characters (no spaces). `GET /health` stays public and returns only `{"status":"ok"}` when a token is set. Tokens are supported for `-t http` only; `-t websocket` rejects one.
+<table>
+<tr><td width="50%"><a href="plugins/ruflo-swarm/README.md"><img src="docs/assets/readme/card-swarm.svg" width="100%" alt="Agent teams"></a></td><td width="50%"><a href="plugins/ruflo-rag-memory/README.md"><img src="docs/assets/readme/card-memory.svg" width="100%" alt="Persistent memory"></a></td></tr>
+<tr><td width="50%"><a href="plugins/ruflo-intelligence/README.md"><img src="docs/assets/readme/card-learning.svg" width="100%" alt="Learning loops"></a></td><td width="50%"><a href="plugins/ruflo-security-audit/README.md"><img src="docs/assets/readme/card-security.svg" width="100%" alt="Security controls"></a></td></tr>
+<tr><td width="50%"><a href="https://ruvnet.github.io/ruflo"><img src="docs/assets/readme/card-plugins.svg" width="100%" alt="Plugin marketplace"></a></td><td width="50%"><a href="plugins/ruflo-ruvllm/README.md"><img src="docs/assets/readme/card-routing.svg" width="100%" alt="Models and routing"></a></td></tr>
+</table>
 
-| `--host` | no token | token set |
-|---|---|---|
-| `localhost`, `127.0.0.1`, `::1` | starts, **unauthenticated** | starts, token required |
-| anything else (`0.0.0.0`, `::`, a LAN IP, `127.0.0.2`, `[::1]`, `LOCALHOST`) | **refuses to start** unless `RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1` | starts, token required |
+| Capability | Description |
+|------------|-------------|
+| <img src="docs/assets/readme/icons/agents.svg" width="28" height="28" alt=""> **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture |
+| <img src="docs/assets/readme/icons/network.svg" width="28" height="28" alt=""> **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely |
+| <img src="docs/assets/readme/icons/swarm.svg" width="28" height="28" alt=""> **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
+| <img src="docs/assets/readme/icons/learning.svg" width="28" height="28" alt=""> **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
+| <img src="docs/assets/readme/icons/memory.svg" width="28" height="28" alt=""> **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
+| <img src="docs/assets/readme/icons/workers.svg" width="28" height="28" alt=""> **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
+| <img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
+| <img src="docs/assets/readme/icons/routing.svg" width="28" height="28" alt=""> **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
+| <img src="docs/assets/readme/icons/security.svg" width="28" height="28" alt=""> **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
+| <img src="docs/assets/readme/icons/federation.svg" width="28" height="28" alt=""> **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
+| <img src="docs/assets/readme/icons/audit.svg" width="28" height="28" alt=""> **[MetaHarness](docs/metaharness-user-guide.md)** | Audit your AI agent setup before you ship. Grade readiness (1-100), scan tool configs for security issues, snapshot the whole project to catch regressions over time, and find templates that match your repo. `ruflo eject` turns a ruflo project into a standalone agent toolkit with its own name. [Full guide](docs/metaharness-user-guide.md). |
 
-Without a token, a loopback server is still unauthenticated: any process on the machine, and any web page that can reach it via DNS rebinding, can call tools. Set `RUFLO_MCP_HTTP_TOKEN` whenever the HTTP transport is used.
+### <img src="docs/assets/readme/icons/learning.svg" width="28" height="28" alt=""> Learning from experience
 
-**Upgrading:** binding off loopback (for example `--host 0.0.0.0` in Docker) now needs a token or the opt-out above; otherwise the server exits with an error.
+<p align="center"><img src="docs/assets/readme/learning-flow.svg" width="100%" alt="Recall, execute, evaluate, store, adapt and reuse: an illustrative agent learning cycle."></p>
 
----
-
-## What You Get
-
-| Capability | Description |
-|------------|-------------|
-| 🤖 **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture |
-| 📡 **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely |
-| 🐝 **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
-| 🧠 **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
-| 💾 **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
-| ⚡ **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
-| 🧩 **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
-| 🔌 **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
-| 🛡️ **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
-| 🌐 **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
-| 🔬 **[MetaHarness](docs/metaharness-user-guide.md)** | Audit your AI agent setup before you ship. Grade readiness (1-100), scan tool configs for security issues, snapshot the whole project to catch regressions over time, and find templates that match your repo. `ruflo eject` turns a ruflo project into a standalone agent toolkit with its own name. [Full guide](docs/metaharness-user-guide.md). |
+Useful trajectories and task feedback can inform future work. Results depend on the configured memory, learning components and quality of feedback. [Learning plugin](plugins/ruflo-intelligence/README.md).
 
 ### Agent Federation — Slack for Agents
 
-```
-Your Agent --> [ Remove secrets ] --> [ Sign message ] --> [ Encrypted channel ]
-                 Emails, SSNs,        Proves it came       No one reads it
-                 keys stripped         from you              in transit
-                                                                |
-                                                                v
-Their Agent <-- [ Block attacks ] <-- [ Check identity ] <------+
-                 Stops prompt          Rejects forgeries
-                 injection
-
-                          Audit trail on both sides.
-                  Trust builds over time. Bad behavior = instant downgrade.
-```
+<p align="center"><img src="docs/assets/readme/federation.svg" alt="Connected intelligence across machines" width="100%"></p>
+
+<p align="center"><img src="docs/assets/readme/federation-flow.svg" width="100%" alt="Outbound agent, data filtering, signing and encryption, identity verification, input checks and receiving agent."></p>
 
 Slack gave teams channels. Federation gives agents the same thing — **shared workspaces across trust boundaries**, where agents on different machines, orgs, or cloud regions can discover each other, prove who they are, and collaborate on tasks.
 
@@ -349,6 +452,8 @@ User --> Claude Code / CLI
 
 ## Documentation
 
+<p align="center"><img src="docs/assets/readme/documentation.svg" alt="Guides, architecture and verification" width="100%"></p>
+
 Four docs for four audiences:
 
 | Doc | When to read it |
@@ -379,6 +484,8 @@ User Guide section index:
 
 ## Support
 
+<p align="center"><img src="docs/assets/readme/support.svg" alt="Build with the Ruflo community" width="100%"></p>
+
 | Resource | Link |
 |----------|------|
 | Documentation | [User Guide](docs/USERGUIDE.md) |
@@ -387,6 +494,10 @@ User Guide section index:
 | Community | [Agentics Foundation Discord](https://discord.com/invite/dfxmpwkG2D) |
 | Powered by | [Cognitum.one](https://cognitum.one) |
 
+<p align="center"><img src="docs/assets/readme/signal-divider.svg" alt="Ruflo" width="100%"></p>
+
 ## License
 
 MIT - [RuvNet](https://github.com/ruvnet)
+
+<a href="https://cognitum.one"><img src="docs/assets/readme/cognitum-banner-v2.svg" width="100%" alt="Cognitum One: Ambient Intelligence at the edge of the Physical World. Explore cognitum.one."></a>

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
-  "generation": 6,
-  "generatedAt": "2026-09-17T21:28:47.530Z",
-  "gitSha": "702d1461",
+  "generation": 7,
+  "generatedAt": "2026-10-19T16:47:16.220Z",
+  "gitSha": "aedd3d53",
   "catalog": {
-    "agents": 167,
-    "tools": 418,
+    "agents": 176,
+    "tools": 423,
     "skills": 34
   },
   "benchmark": null

package/v3/@claude-flow/cli/dist/src/commands/daemon.js

@@ -1247,12 +1247,18 @@ const statusCommand = {
             // its real consent state into daemon-state.json — prefer that when it
             // is the one running.
             let aiWorkersEnabled = status.config.aiWorkersEnabled;
+            // #4238: same for the TTL — a daemon started with `--ttl 0` must not be
+            // reported with this process's 12h default.
+            let ttlMs = status.config.ttlMs;
             if (bgRunning) {
                 try {
                     const st = JSON.parse(fs.readFileSync(join(projectRoot, '.claude-flow', 'daemon-state.json'), 'utf-8'));
                     if (typeof st?.config?.aiWorkersEnabled === 'boolean') {
                         aiWorkersEnabled = st.config.aiWorkersEnabled;
                     }
+                    if (typeof st?.config?.ttlMs === 'number' && Number.isFinite(st.config.ttlMs)) {
+                        ttlMs = st.config.ttlMs;
+                    }
                 }
                 catch { /* no/partial state — fall back to in-process config */ }
             }
@@ -1265,8 +1271,8 @@ const statusCommand = {
                 `Status: ${statusIcon} ${statusText}${mode}`,
                 `PID: ${displayPid}`,
                 status.startedAt ? `Started: ${status.startedAt.toISOString()}` : '',
-                status.config.ttlMs > 0
-                    ? `TTL: ${Math.round(status.config.ttlMs / 3600000)}h (self-shutdown)`
+                ttlMs > 0
+                    ? `TTL: ${Math.round(ttlMs / 3600000)}h (self-shutdown)`
                     : `TTL: ${output.dim('off (runs until stopped)')}`,
                 // #2661: surface the AI-consent gate so "why is audit local-only?"
                 // is answerable from `daemon status` alone.

package/v3/@claude-flow/cli/dist/src/commands/doctor.js

@@ -2515,6 +2515,12 @@ export const doctorCommand = {
     name: 'doctor',
     description: 'System diagnostics and health checks',
     options: [
+        {
+            name: 'json',
+            description: 'Emit versioned JSON health checks (cannot be combined with repair flags)',
+            type: 'boolean',
+            default: false
+        },
         {
             name: 'fix',
             short: 'f',
@@ -2561,6 +2567,7 @@ export const doctorCommand = {
         }
     ],
     examples: [
+        { command: 'claude-flow doctor --json -c node', description: 'Emit machine-readable health checks' },
         { command: 'claude-flow doctor', description: 'Run full health check' },
         { command: 'claude-flow doctor --fix', description: 'Print suggested fix commands (does not auto-apply)' },
         { command: 'claude-flow doctor --install', description: 'Auto-install missing dependencies' },
@@ -2575,6 +2582,21 @@ export const doctorCommand = {
         const verbose = ctx.flags.verbose;
         // Parser camelCases kebab-case flag names — read via `fixHandles`, not `['fix-handles']`.
         const fixHandles = ctx.flags.fixHandles;
+        const json = ctx.flags.json;
+        const reportError = (message) => {
+            if (json)
+                output.writeln(JSON.stringify({ schemaVersion: 1, checks: [], error: message }));
+            else
+                output.printError(message);
+            return { success: false, exitCode: 1, message };
+        };
+        if (json && (showFix || autoInstall || fixHandles)) {
+            return reportError('--json cannot be combined with --fix, --install, or --fix-handles');
+        }
+        // Reuse the same callable for anonymous checks so their IDs do not depend
+        // on display names or on whether the full or component suite was selected.
+        const helperCheck = () => checkHelperIntegrity();
+        const nativeAddonCheck = () => checkNativeAddonHeaders();
         // #2677: `--component memory` now runs the whole memory-health suite,
         // not just the existence check. Values can be a single check or an
         // array — expanded at execution time. Stuinfla's report showed the
@@ -2592,7 +2614,7 @@ export const doctorCommand = {
             'browser': checkAgentBrowserVersion,
             'config': checkConfigFile,
             'stale-settings': checkStaleSettingsNpx, // #2448
-            'helpers': () => checkHelperIntegrity(), // #3565
+            'helpers': helperCheck, // #3565
             'daemon': checkDaemonStatus,
             get memory() {
                 return [
@@ -2608,7 +2630,7 @@ export const doctorCommand = {
                 ];
             },
             'memory-package': checkMemoryPackageVersion, // #3392
-            'native-addon': () => checkNativeAddonHeaders(), // #4055
+            'native-addon': nativeAddonCheck, // #4055
             'learning': checkLearningBridge, // #2545
             'learning-bridge': checkLearningBridge, // #2545
             'api': checkApiKeys,
@@ -2634,8 +2656,7 @@ export const doctorCommand = {
         };
         if (component !== undefined && !Object.hasOwn(componentMap, component)) {
             const message = `Unknown doctor component: ${JSON.stringify(component)}. Valid components: ${Object.keys(componentMap).join(', ')}`;
-            output.printError(message);
-            return { success: false, exitCode: 1, message };
+            return reportError(message);
         }
         // Early-return short-circuit: `--fix-handles` is a targeted mitigation, not
         // part of the health-check flow. Runs, reports, exits.
@@ -2699,12 +2720,15 @@ export const doctorCommand = {
             output.writeln(output.dim('Upstream tracking: https://github.com/anthropics/claude-code/issues/67888'));
             return { success: true };
         }
-        output.writeln();
-        output.writeln(output.bold('RuFlo Doctor'));
-        output.writeln(output.dim('System diagnostics and health check'));
-        output.writeln(output.dim('─'.repeat(50)));
-        output.writeln();
-        const nativeAgentDbChecks = (await existingNativeAgentDbPaths())
+        if (!json) {
+            output.writeln();
+            output.writeln(output.bold('RuFlo Doctor'));
+            output.writeln(output.dim('System diagnostics and health check'));
+            output.writeln(output.dim('─'.repeat(50)));
+            output.writeln();
+        }
+        const nativeAgentDbPaths = await existingNativeAgentDbPaths();
+        const nativeAgentDbChecks = nativeAgentDbPaths
             .map((dbPath) => () => checkNativeAgentDbStructuralIntegrity(dbPath));
         const allChecks = [
             checkVersionFreshness,
@@ -2716,7 +2740,7 @@ export const doctorCommand = {
             checkGitRepo,
             checkConfigFile,
             checkStaleSettingsNpx, // #2448/#2677 — runaway `npx @latest` in settings
-            () => checkHelperIntegrity(), // #3565 — installed signed helpers vs manifest
+            helperCheck, // #3565 — installed signed helpers vs manifest
             checkDaemonStatus,
             checkMemoryDatabase,
             checkMemoryStructuralIntegrity, // #2737 — bounded, native quick_check on every default run
@@ -2724,7 +2748,7 @@ export const doctorCommand = {
             checkMemoryPersistenceDriver, // #2968/#3321 — read-only native capability probe
             checkLearningBridge, // #2545 — can the auto-memory hook actually load @claude-flow/memory?
             checkMemoryPackageVersion, // #3392 — loaded @claude-flow/memory must satisfy the CLI's declared range
-            () => checkNativeAddonHeaders(), // #4055 — better-sqlite3 built against Node 24.19+ headers on 24.19-24.21
+            nativeAddonCheck, // #4055 — better-sqlite3 built against Node 24.19+ headers on 24.19-24.21
             checkApiKeys,
             checkMcpServers,
             checkMcpSchemaOverhead, // #2726 — fixed tools/list prompt cost
@@ -2747,21 +2771,59 @@ export const doctorCommand = {
             const entry = componentMap[component];
             checksToRun = Array.isArray(entry) ? entry : [entry];
         }
+        // These are API identifiers: keep them stable even when user-facing names
+        // change. Grouped components have a distinct ID for each individual check.
+        const checkIds = new Map([
+            [checkVersionFreshness, 'version'], [checkNodeVersion, 'node'],
+            [checkNpmVersion, 'npm'], [checkClaudeCode, 'claude'],
+            [checkAgentBrowserVersion, 'browser'], [checkGit, 'git'],
+            [checkGitRepo, 'git-repo'], [checkConfigFile, 'config'],
+            [checkStaleSettingsNpx, 'stale-settings'], [helperCheck, 'helpers'],
+            [checkDaemonStatus, 'daemon'], [checkMemoryDatabase, 'memory-presence'],
+            [checkMemoryStructuralIntegrity, 'memory-structural'],
+            [checkMemoryIntegrity, 'memory-integrity'],
+            [checkMemoryPersistenceDriver, 'memory-driver'],
+            [checkMemoryPackageVersion, 'memory-package'],
+            [checkMemoryContent, 'memory-content'],
+            [checkMemoryEmbeddingCoverage, 'memory-embeddings'],
+            [checkMemoryReflexionCoverage, 'memory-reflexion'],
+            [checkMemoryCritiqueCoverage, 'memory-critique'],
+            [checkLearningBridge, 'learning'], [nativeAddonCheck, 'native-addon'],
+            [checkApiKeys, 'api'], [checkMcpServers, 'mcp'],
+            [checkMcpSchemaOverhead, 'mcp-overhead'], [checkAIDefence, 'aidefence'],
+            [checkDiskSpace, 'disk'], [checkBuildTools, 'typescript'],
+            [checkAgenticFlow, 'agentic-flow'], [checkEncryptionAtRest, 'encryption'],
+            [checkFederationBreaker, 'federation'], [checkMetaharness, 'metaharness'],
+            [checkMetaharnessDeclaredPackages, 'metaharness-packages'],
+            [checkMetaharnessIntegration, 'metaharness-integration'],
+            [checkFunnel, 'funnel'], [checkProxySponsoredConsent, 'proxy-consent'],
+            [checkProxyBinary, 'proxy-binary'], [checkProxyProcess, 'proxy-process'],
+            [checkProxyBindAddress, 'proxy-bind'], [checkAuth, 'auth'],
+            [checkTypesafeRouter, 'typesafe'], [checkMods, 'mods'],
+        ]);
+        nativeAgentDbChecks.forEach((check, index) => {
+            // The path distinguishes simultaneous authority files; normalize separators.
+            checkIds.set(check, `memory-native:${nativeAgentDbPaths[index].replace(/\\/g, '/')}`);
+        });
+        if (json && checksToRun.some(check => !checkIds.has(check))) {
+            return reportError('Doctor check is missing a stable JSON ID');
+        }
         const results = [];
         const fixes = [];
         // OPTIMIZATION: Run all checks in parallel for 3-5x faster execution
-        const spinner = output.createSpinner({ text: 'Running health checks in parallel...', spinner: 'dots' });
-        spinner.start();
+        const spinner = json ? undefined : output.createSpinner({ text: 'Running health checks in parallel...', spinner: 'dots' });
+        spinner?.start();
         try {
             // Execute all checks concurrently
             const checkResults = await Promise.allSettled(checksToRun.map(check => check()));
-            spinner.stop();
+            spinner?.stop();
             // Process results in order
             for (const settledResult of checkResults) {
                 if (settledResult.status === 'fulfilled') {
                     const result = settledResult.value;
                     results.push(result);
-                    output.writeln(formatCheck(result));
+                    if (!json)
+                        output.writeln(formatCheck(result));
                     if (result.fix && (result.status === 'fail' || result.status === 'warn')) {
                         fixes.push(`${result.name}: ${result.fix}`);
                     }
@@ -2773,12 +2835,15 @@ export const doctorCommand = {
                         message: settledResult.reason?.message || 'Unknown error'
                     };
                     results.push(errorResult);
-                    output.writeln(formatCheck(errorResult));
+                    if (!json)
+                        output.writeln(formatCheck(errorResult));
                 }
             }
         }
         catch (error) {
-            spinner.stop();
+            spinner?.stop();
+            if (json)
+                return reportError(`Failed to run health checks: ${error instanceof Error ? error.message : String(error)}`);
             output.writeln(output.error('Failed to run health checks'));
         }
         // #2545: --fix / --install can actually repair the Learning Bridge by
@@ -2827,6 +2892,18 @@ export const doctorCommand = {
         const passed = results.filter(r => r.status === 'pass').length;
         const warnings = results.filter(r => r.status === 'warn').length;
         const failed = results.filter(r => r.status === 'fail').length;
+        if (json) {
+            const checks = results.map((result, index) => ({
+                id: checkIds.get(checksToRun[index]),
+                status: result.status,
+                name: result.name,
+                detail: result.message,
+                ...(result.fix ? { fix: result.fix } : {}),
+            }));
+            const data = { schemaVersion: 1, checks };
+            output.writeln(JSON.stringify(data));
+            return { success: failed === 0, exitCode: failed > 0 ? 1 : 0, data };
+        }
         output.writeln();
         output.writeln(output.dim('─'.repeat(50)));
         output.writeln();

package/v3/@claude-flow/cli/dist/src/commands/policy.js

@@ -30,6 +30,7 @@ export const policyCommand = {
         { name: 'mode', type: 'string', description: 'Policy mode: legacy | observe | enforce' },
         { name: 'project-root', type: 'string', description: 'Project root containing .claude-flow/policy' },
         { name: 'establish-anchor', type: 'boolean', description: 'verify: explicitly anchor a ledger that has receipts but no anchor (interactive, logged with user and time)' },
+        { name: 'full', type: 'boolean', description: 'verify: additionally replay the archived receipts (receipts.ledger.jsonl) to verify the complete historical chain, not just the retained hot tail' },
     ],
     async action(context) {
         const args = context.args ?? [];
@@ -93,9 +94,13 @@ export const policyCommand = {
             }
             if (operation === 'verify') {
                 const establishAnchor = flags['establish-anchor'] === true || flags.establishAnchor === true;
+                const full = flags.full === true;
                 if (establishAnchor)
                     requireInteractiveAdministrator();
-                const ledger = await verifyPolicyLedger(root, { establishAnchor });
+                const ledger = await verifyPolicyLedger(root, { establishAnchor, full });
+                if (ledger.error === 'receipt-key-id-mismatch') {
+                    output.printError('Restore the original CLAUDE_FLOW_POLICY_KEY_ID for this ledger; do not rewrite or re-sign historical receipts.');
+                }
                 const result = print({ ...ledger, anchors: anchorPosture(root), scope: LEDGER_TRUST_SCOPE });
                 return ledger.valid ? result : { ...result, success: false, exitCode: 1 };
             }