claude-flow 3.56.8 → 3.56.10

package/v3/@claude-flow/cli/dist/src/mcp-tools/agentdb-tools.js

@@ -80,6 +80,21 @@ async function bridgeUnavailableResult() {
         hint: 'Check Node version + try `ruflo memory init` to initialize manually.',
     };
 }
+// #4135 / #4161: graph reads (agentdb_graph-query, agentdb_graph-pathfinder) open the
+// graph_edges database; under encryption at rest that file is an RFE1 blob they cannot
+// open. A recorded edge is then unreadable even though the write reports success, so the
+// write says so instead of letting a caller assume it can read the edge back.
+async function unreadableEdgeWarning() {
+    try {
+        const { isBridgeDbEncryptedAtRest } = await getGraphEdgeWriter();
+        if (!isBridgeDbEncryptedAtRest())
+            return undefined;
+        return 'Edge recorded, but graph reads (agentdb_graph-query, agentdb_graph-pathfinder) cannot open the graph_edges database because it is encrypted at rest (RFE1), so this edge cannot be read back yet. Your data is intact (#2889, #4135).';
+    }
+    catch {
+        return undefined;
+    }
+}
 let memInitMod = null;
 async function getMemInit() {
     if (!memInitMod)
@@ -554,7 +569,9 @@ export const agentdbCausalEdge = {
                         // Also record in AgentDB bridge for compatibility
                         const bridge = await getBridge();
                         await bridge.bridgeRecordCausalEdge({ sourceId, targetId, relation, weight: typeof params.weight === 'number' ? validateScore(params.weight, 0.5) : undefined }).catch(() => { });
-                        return { ...graphResult, _graphNodeBackend: true, ...(legacyWarning && { warning: legacyWarning }) };
+                        const unreadable = await unreadableEdgeWarning();
+                        const warning = [legacyWarning, unreadable].filter(Boolean).join(' ');
+                        return { ...graphResult, _graphNodeBackend: true, ...(unreadable && { readable: false }), ...(warning && { warning }) };
                     }
                 }
             }
@@ -567,7 +584,9 @@ export const agentdbCausalEdge = {
                 weight: typeof params.weight === 'number' ? validateScore(params.weight, 0.5) : undefined,
             });
             const baseResult = result ?? { success: false, error: 'AgentDB bridge not available. Use memory_store/memory_search instead.' };
-            return legacyWarning ? { ...baseResult, warning: legacyWarning } : baseResult;
+            const unreadable = baseResult.success === false ? undefined : await unreadableEdgeWarning();
+            const warning = [legacyWarning, unreadable].filter(Boolean).join(' ');
+            return warning ? { ...baseResult, ...(unreadable && { readable: false }), warning } : baseResult;
         }
         catch (error) {
             return { success: false, error: sanitizeError(error) };
@@ -1157,6 +1176,10 @@ export const agentdbGraphQuery = {
                 catch (error) {
                     return { success: false, error: `Retained SQL graph query failed: ${sanitizeError(error)}`, mode, nodeId };
                 }
+                // #4135: name the real reason when the retained store is encrypted at rest.
+                const encryptedAtRest = await getGraphEdgeWriter().then((w) => w.isBridgeDbEncryptedAtRest()).catch(() => false);
+                if (encryptedAtRest)
+                    return { success: false, ...(await bridgeUnavailableResult()), mode, nodeId };
                 return { success: false, error: 'Retained SQL graph_edges backend is unavailable for k-hop query', mode, nodeId };
             }
             // ── semantic mode ────────────────────────────────────────────────────────

package/v3/@claude-flow/cli/dist/src/mcp-tools/aidefence-known-misses.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Known-miss registry for aidefence_learn (#4147).
+ *
+ * The detector's learned patterns are written by `learnFromDetection`, but
+ * they are only created from threats the detector already found, and
+ * `detect()` never reads them back. A threat the detector MISSED (a false
+ * negative, the case feedback matters most for) therefore had nowhere to go.
+ *
+ * This registry stores a SHA-256 of the whitespace/case-normalised input so a
+ * reported miss is flagged next time the identical text is scanned. It is an
+ * exact-match list, not generalisation: the raw text is never stored.
+ */
+export interface KnownMiss {
+    hash: string;
+    threatType: string;
+    reportedAt: string;
+}
+export declare function hashInput(input: string): string;
+/** Returns true when the miss was newly recorded, false when it was already known. */
+export declare function recordKnownMiss(input: string, threatType: string, cwd?: string): boolean;
+export declare function findKnownMiss(input: string, cwd?: string): KnownMiss | undefined;
+//# sourceMappingURL=aidefence-known-misses.d.ts.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/aidefence-known-misses.js

@@ -0,0 +1,57 @@
+/**
+ * Known-miss registry for aidefence_learn (#4147).
+ *
+ * The detector's learned patterns are written by `learnFromDetection`, but
+ * they are only created from threats the detector already found, and
+ * `detect()` never reads them back. A threat the detector MISSED (a false
+ * negative, the case feedback matters most for) therefore had nowhere to go.
+ *
+ * This registry stores a SHA-256 of the whitespace/case-normalised input so a
+ * reported miss is flagged next time the identical text is scanned. It is an
+ * exact-match list, not generalisation: the raw text is never stored.
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+const MAX_ENTRIES = 500;
+function storePath(cwd) {
+    return join(cwd, '.claude-flow', 'aidefence-known-misses.json');
+}
+export function hashInput(input) {
+    const normalised = input.normalize('NFKC').toLowerCase().replace(/\s+/g, ' ').trim();
+    return createHash('sha256').update(normalised).digest('hex');
+}
+function load(cwd) {
+    try {
+        const p = storePath(cwd);
+        if (!existsSync(p))
+            return [];
+        const parsed = JSON.parse(readFileSync(p, 'utf8'));
+        return Array.isArray(parsed) ? parsed.filter((e) => e && typeof e.hash === 'string') : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Returns true when the miss was newly recorded, false when it was already known. */
+export function recordKnownMiss(input, threatType, cwd = process.cwd()) {
+    const hash = hashInput(input);
+    const entries = load(cwd);
+    if (entries.some((e) => e.hash === hash))
+        return false;
+    entries.push({ hash, threatType, reportedAt: new Date().toISOString() });
+    const dir = join(cwd, '.claude-flow');
+    mkdirSync(dir, { recursive: true });
+    const tmp = `${storePath(cwd)}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(entries.slice(-MAX_ENTRIES), null, 2), { mode: 0o600 });
+    renameSync(tmp, storePath(cwd));
+    return true;
+}
+export function findKnownMiss(input, cwd = process.cwd()) {
+    const entries = load(cwd);
+    if (entries.length === 0)
+        return undefined;
+    const hash = hashInput(input);
+    return entries.find((e) => e.hash === hash);
+}
+//# sourceMappingURL=aidefence-known-misses.js.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/analyze-tools.js

@@ -3,14 +3,14 @@
  * Provides diff analysis and classification via MCP protocol
  */
 import { validateGitRef, validatePath } from './validate-input.js';
-import { analyzeDiff, assessFileRisk, assessOverallRisk, classifyDiff, suggestReviewers, getGitDiffNumstat, } from '../ruvector/diff-classifier.js';
+import { analyzeDiff, assessFileRisk, assessOverallRisk, suggestReviewers, getGitDiffNumstat, } from '../ruvector/diff-classifier.js';
 /**
  * Diff Analysis Tool
  * Analyzes git diffs for change risk assessment and classification
  */
 export const analyzeDiffTool = {
     name: 'analyze_diff',
-    description: 'Analyze git diff for change risk assessment and classification Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Heuristically analyze git diff paths, changed lines, and one-commit subjects for risk and classification. Use when preparing a review that needs a quick evidence-based summary; inspect the diff for final judgment.',
     category: 'analyze',
     tags: ['diff', 'risk', 'classification', 'git'],
     inputSchema: {
@@ -85,7 +85,7 @@ export const analyzeDiffTool = {
  */
 export const diffRiskTool = {
     name: 'analyze_diff-risk',
-    description: 'Quick risk assessment for git diff Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Heuristically assess git diff risk from changed file paths, sizes, and status. Use when triaging which files merit closer human review; this is not a security guarantee.',
     category: 'analyze',
     tags: ['diff', 'risk', 'git'],
     inputSchema: {
@@ -130,7 +130,7 @@ export const diffRiskTool = {
  */
 export const diffClassifyTool = {
     name: 'analyze_diff-classify',
-    description: 'Classify git diff change type Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Heuristically classify a git diff from changed lines, file paths, and a single-commit subject when available. Use when you need a coarse change category; inspect the diff to confirm.',
     category: 'analyze',
     tags: ['diff', 'classification', 'git'],
     inputSchema: {
@@ -151,12 +151,11 @@ export const diffClassifyTool = {
         }
         const ref = params.ref || 'HEAD';
         try {
-            const files = getGitDiffNumstat(ref);
-            const classification = classifyDiff(files);
+            const result = await analyzeDiff({ ref });
             return {
                 ref,
-                classification,
-                files: files.length,
+                classification: result.classification,
+                files: result.files.length,
             };
         }
         catch (error) {
@@ -174,7 +173,7 @@ export const diffClassifyTool = {
  */
 export const diffReviewersTool = {
     name: 'analyze_diff-reviewers',
-    description: 'Suggest reviewers for git diff changes Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Suggest reviewer roles from git diff paths and risk; does not identify people or read CODEOWNERS. Use when triaging expertise for a change, then consult CODEOWNERS to assign people.',
     category: 'analyze',
     tags: ['diff', 'reviewers', 'git'],
     inputSchema: {
@@ -225,7 +224,7 @@ export const diffReviewersTool = {
  */
 export const fileRiskTool = {
     name: 'analyze_file-risk',
-    description: 'Assess risk for a specific file change Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Heuristically assess risk for a file path and optional change metadata. Use when triaging a changed file for focused review; inspect the source for final judgment.',
     category: 'analyze',
     tags: ['file', 'risk'],
     inputSchema: {
@@ -280,7 +279,7 @@ export const fileRiskTool = {
  */
 export const diffStatsTool = {
     name: 'analyze_diff-stats',
-    description: 'Get quick statistics for git diff Use when native `git diff` / `grep` / static analysis is wrong because you want LLM-graded change classification, reviewer recommendations, or risk scoring. For literal-text inspection, native tools are fine.',
+    description: 'Count changed files, additions, and deletions in a git diff. Use when you need a quick size summary before inspecting the full patch.',
     category: 'analyze',
     tags: ['diff', 'stats', 'git'],
     inputSchema: {

package/v3/@claude-flow/cli/dist/src/mcp-tools/autopilot-tools.js

@@ -8,7 +8,7 @@
  * @module @claude-flow/cli/mcp-tools/autopilot
  */
 import { validateText } from './validate-input.js';
-import { loadState, saveState, appendLog, loadLog, discoverTasks, isTerminal, tryLoadLearning, validateNumber, validateConfiguredTaskSources, VALID_TASK_SOURCES, } from '../autopilot-state.js';
+import { loadState, saveState, appendLog, loadLog, discoverTasks, isTerminal, tryLoadLearning, getLearningLoadError, validateNumber, validateConfiguredTaskSources, VALID_TASK_SOURCES, } from '../autopilot-state.js';
 function ok(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
 }
@@ -175,7 +175,7 @@ const autopilotLearn = {
             ]);
             return ok({ metrics, patterns });
         }
-        return ok({ available: false, reason: 'AgentDB/AutopilotLearning not initialized', patterns: [] });
+        return ok({ available: false, reason: getLearningLoadError() ?? 'AgentDB/AutopilotLearning not initialized', patterns: [] });
     },
 };
 const autopilotHistory = {

package/v3/@claude-flow/cli/dist/src/mcp-tools/browser-intent-tools.js

@@ -85,9 +85,13 @@
  * @module @claude-flow/cli/mcp-tools/browser-intent
  */
 import { createRequire } from 'node:module';
-import { createServer } from 'node:http';
 import { readFileSync, existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+// Lazy, CommonJS-style load of node:http: an ESM `import … from 'node:http'`
+// materialises every export of the builtin, which trips http's lazy undici
+// getters (~2.5 MB heap / ~6 MB RSS) at MCP startup even when no server is
+// ever started. require() of the builtin does not touch those getters.
+const loadHttp = () => createRequire(import.meta.url)('node:http');
 import { validateText, validateIdentifier } from './validate-input.js';
 import { execBrowserCommand } from './browser-tools.js';
 import { storeEntry } from '../memory/memory-initializer.js';
@@ -175,7 +179,7 @@ export function resolvePageAgentLLMConfig(env = process.env) {
 export const PLACEHOLDER_API_KEY = 'ruflo-proxied-key';
 export function startLocalLLMProxy(real) {
     return new Promise((resolve, reject) => {
-        const server = createServer((req, res) => {
+        const server = loadHttp().createServer((req, res) => {
             const target = `${real.baseURL.replace(/\/+$/, '')}${req.url ?? ''}`;
             const chunks = [];
             req.on('data', (c) => chunks.push(c));

package/v3/@claude-flow/cli/dist/src/mcp-tools/embeddings-tools.js

@@ -93,16 +93,28 @@ function toPoincare(euclidean, curvature) {
     const factor = Math.tanh(sqrtC * norm / 2) / (sqrtC * norm + 1e-15);
     return euclidean.map(x => x * factor);
 }
-// Poincaré distance
+// #4159: a point is usable only strictly inside the ball of radius 1/sqrt(c).
+function insidePoincareBall(p, curvature) {
+    const c = Math.abs(curvature);
+    return c * p.reduce((sum, x) => sum + x * x, 0) < 1;
+}
+// Poincaré distance, d_c(a,b) = acosh(1 + 2c|a-b|^2 / ((1-c|a|^2)(1-c|b|^2))) / sqrt(c).
+// Returns NaN for a point on or outside the ball (the formula is undefined there);
+// callers must check Number.isFinite before reporting it.
 function poincareDistance(a, b, curvature) {
     const c = Math.abs(curvature);
+    if (a.length !== b.length || !insidePoincareBall(a, curvature) || !insidePoincareBall(b, curvature)) {
+        return NaN;
+    }
     const diffSq = a.reduce((sum, _, i) => sum + (a[i] - b[i]) ** 2, 0);
     const normASq = a.reduce((sum, x) => sum + x * x, 0);
     const normBSq = b.reduce((sum, x) => sum + x * x, 0);
-    const denom = (1 - normASq) * (1 - normBSq);
-    const delta = 2 * diffSq / (denom + 1e-15);
+    const denom = (1 - c * normASq) * (1 - c * normBSq);
+    const delta = (2 * c * diffSq) / denom;
     return (1 / Math.sqrt(c)) * Math.acosh(1 + delta);
 }
+const HYPERBOLIC_RADIUS_NOTE = 'convert is an exponential map at the origin: it preserves the input norm ordering, so unit-norm text embeddings all land at the same radius. ' +
+    'It does not encode hierarchy; depth/tree structure has to come from the hierarchy itself (for example depth chosen as the radius, or embeddings trained on the tree edges).';
 // Cosine similarity
 function cosineSimilarity(a, b) {
     const dot = a.reduce((sum, _, i) => sum + a[i] * b[i], 0);
@@ -339,6 +351,9 @@ export const embeddingsTools = [
                     const poinc1 = toPoincare(emb1, config.hyperbolic.curvature);
                     const poinc2 = toPoincare(emb2, config.hyperbolic.curvature);
                     distance = poincareDistance(poinc1, poinc2, config.hyperbolic.curvature);
+                    if (!Number.isFinite(distance)) {
+                        return { success: false, error: 'Hyperbolic distance is undefined for these inputs (a converted point reached the ball boundary).' };
+                    }
                     similarity = 1 / (1 + distance);
                     break;
                 case 'euclidean':
@@ -739,6 +754,7 @@ export const embeddingsTools = [
                         poincare,
                         curvature,
                         poincareNorm: Math.sqrt(poincare.reduce((sum, x) => sum + x * x, 0)),
+                        note: HYPERBOLIC_RADIUS_NOTE,
                     };
                 case 'distance':
                     const emb1 = input.embedding1;
@@ -747,6 +763,13 @@ export const embeddingsTools = [
                         return { success: false, error: 'embedding1 and embedding2 required for distance action' };
                     }
                     const dist = poincareDistance(emb1, emb2, curvature);
+                    if (!Number.isFinite(dist)) {
+                        return {
+                            success: false,
+                            error: 'Poincaré distance needs two points of equal length strictly inside the ball (|x| < 1/sqrt(c)); got a point on or outside it, or mismatched lengths. Run convert on Euclidean vectors first.',
+                            curvature,
+                        };
+                    }
                     return {
                         success: true,
                         action: 'distance',
@@ -780,11 +803,10 @@ export const embeddingsTools = [
                             epsilon: config.hyperbolic.epsilon,
                             maxNorm: config.hyperbolic.maxNorm,
                         },
+                        note: HYPERBOLIC_RADIUS_NOTE,
                         benefits: [
-                            'Better hierarchical data representation',
-                            'Exponential capacity in low dimensions',
-                            'Preserves tree-like structures',
-                            'Natural for taxonomy embeddings',
+                            'Exponential capacity in low dimensions when the points are placed by hierarchy (for example by depth)',
+                            'Natural geometry for taxonomy embeddings that are trained or constructed for it',
                         ],
                     };
             }

package/v3/@claude-flow/cli/dist/src/mcp-tools/hooks-tools.js

@@ -3253,6 +3253,8 @@ export const hooksTrajectoryEnd = {
                         learned: result.learned,
                         patternKey: result.patternKey,
                         confidence: result.confidence,
+                        reinforcedNeighbour: result.reinforcedNeighbour,
+                        routingGate: result.routingGate,
                     };
                 }
                 catch {
@@ -3416,6 +3418,8 @@ export const hooksTrajectoryEnd = {
                 sonaUpdate: sonaResult.learned,
                 sonaPatternKey: sonaResult.patternKey || undefined,
                 sonaConfidence: sonaResult.confidence || undefined,
+                sonaReinforcedNeighbour: sonaResult.reinforcedNeighbour || undefined,
+                sonaRoutingGate: sonaResult.routingGate,
                 ewcConsolidation: ewcResult.consolidated,
                 ewcPenalty: ewcResult.penalty || undefined,
                 patternsExtracted,

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -14,6 +14,7 @@ import { homedir } from 'os';
 import { join, resolve } from 'path';
 import { createHash } from 'crypto';
 import { validateIdentifier } from './validate-input.js';
+import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.js';
 // #1604: Align with memory-initializer.ts — single source of truth is .swarm/memory.db
 const MEMORY_DIR = '.swarm';
 const LEGACY_MEMORY_FILE = 'store.json';
@@ -231,6 +232,19 @@ async function getMemoryFunctions() {
         checkMemoryInitialization,
     };
 }
+/**
+ * Path of the CLI's own store (.swarm/memory.db or CLAUDE_FLOW_DB_PATH), or
+ * undefined when the memory module cannot say (#4148). Never throws.
+ */
+async function resolveCliStorePath() {
+    try {
+        const mod = await import('../memory/memory-initializer.js');
+        return typeof mod.resolveDbPath === 'function' ? mod.resolveDbPath() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * #2922: every `backend:` field in this file's tool responses used to be the
  * hardcoded literal `'sql.js + HNSW'` regardless of which search path was
@@ -538,7 +552,7 @@ export const memoryTools = [
                 query: { type: 'string', description: 'Search query (semantic similarity)' },
                 namespace: { type: 'string', description: 'Namespace to search (default: all namespaces — omit to search across every namespace)' },
                 limit: { type: 'number', description: 'Maximum results (default: 10)' },
-                threshold: { type: 'number', description: 'Minimum raw retrieval relevance 0-1 for candidate admission, applied per query before SmartRetrieval ranking; not a floor on rankingScore (default: 0.3)' },
+                threshold: { type: 'number', description: 'Minimum raw retrieval relevance 0-1 for candidate admission, applied per query before SmartRetrieval ranking; not a floor on rankingScore (default: 0.2; calibrated for the bundled embedding model, pass 0 to see every match)' },
                 smart: { type: 'boolean', description: 'Enable SmartRetrieval — query expansion, RRF fusion, recency boost, MMR diversity; preserves raw similarity and adds rankingScore (default: false)' },
                 provenance_filter: {
                     type: 'array',
@@ -567,7 +581,8 @@ export const memoryTools = [
             // in the search layer actually fires.
             const namespace = input.namespace;
             const limit = input.limit ?? 10;
-            const threshold = input.threshold ?? 0.3;
+            const threshold = input.threshold ?? DEFAULT_SEARCH_THRESHOLD;
+            const thresholdWasDefault = input.threshold === undefined || input.threshold === null;
             validateMemoryInput(undefined, undefined, query, namespace);
             const startTime = performance.now();
             try {
@@ -638,10 +653,14 @@ export const memoryTools = [
                                 provenanceType: r.provenanceType,
                             };
                         });
+                        const smartNearMisses = results.length === 0 && thresholdWasDefault
+                            ? await nearMisses(searchEntries, { query, namespace, provenanceFilter })
+                            : undefined;
                         return {
                             query,
                             results,
                             total: results.length,
+                            ...(smartNearMisses ?? {}),
                             searchTime: `${duration.toFixed(2)}ms`,
                             backend: 'SmartRetrieval (RRF + MMR + Recency)',
                             stats: smartResult.stats,
@@ -685,10 +704,14 @@ export const memoryTools = [
                         provenanceType: r.provenanceType,
                     };
                 });
+                const nearMissInfo = results.length === 0 && thresholdWasDefault
+                    ? await nearMisses(searchEntries, { query, namespace, provenanceFilter })
+                    : undefined;
                 return {
                     query,
                     results,
                     total: results.length,
+                    ...(nearMissInfo ?? {}),
                     searchTime: `${duration.toFixed(2)}ms`,
                     backend: 'HNSW + sql.js',
                     ...(smartFallbackReason ? { smartFallback: smartFallbackReason } : {}),
@@ -1497,25 +1520,50 @@ export const memoryTools = [
                 if (!v.valid)
                     throw new Error(v.error);
             }
-            // #2073: pass includeContent so the value field carries the actual
-            // entry body. Without this, `value` is always null because listEntries
-            // strips content by default (callers pay for the JSON parse only when
-            // they need it).
-            // A successful export must cover the whole reported store. Read all
-            // pages before touching an existing snapshot, including on read failure.
-            const entries = [];
-            let total;
-            do {
-                const page = await listEntries({ limit: 10000, offset: entries.length, namespace, includeContent: true });
-                if (!page.success)
-                    return { error: page.error || 'Could not read memory for export' };
-                total ??= page.total;
-                if (page.entries.length === 0 && entries.length < total) {
-                    return { error: `Incomplete memory export: read ${entries.length} of ${total} entries` };
+            const readStore = async (dbPath) => {
+                const out = [];
+                let total;
+                do {
+                    const page = await listEntries({ limit: 10000, offset: out.length, namespace, includeContent: true, ...(dbPath ? { dbPath } : {}) });
+                    if (!page.success)
+                        return { error: page.error || 'Could not read memory for export' };
+                    total ??= page.total;
+                    if (page.entries.length === 0 && out.length < total) {
+                        return { error: `Incomplete memory export: read ${out.length} of ${total} entries` };
+                    }
+                    out.push(...page.entries);
+                } while (out.length < total);
+                return { entries: out };
+            };
+            const primary = await readStore();
+            if ('error' in primary)
+                return { error: primary.error };
+            // #4148: the default reader is the AgentDB bridge, but the CLI's own store
+            // (.swarm/memory.db, possibly encrypted) can hold rows the bridge never
+            // sees, so an export silently covered one store and reported success. Read
+            // the CLI store too and merge, newest copy of a (namespace, key) winning.
+            const warnings = [];
+            const stores = [{ store: 'default', entries: primary.entries.length }];
+            const merged = new Map();
+            const keep = (e) => {
+                const id = `${e.namespace}\u0000${e.key}`;
+                const have = merged.get(id);
+                if (!have || String(e.updatedAt) > String(have.updatedAt))
+                    merged.set(id, e);
+            };
+            primary.entries.forEach(keep);
+            const cliStore = await resolveCliStorePath();
+            if (cliStore && existsSync(cliStore)) {
+                const secondary = await readStore(cliStore);
+                if ('error' in secondary) {
+                    warnings.push(`Could not read the CLI store ${cliStore} (${secondary.error}); the export covers the AgentDB store only.`);
+                }
+                else {
+                    stores.push({ store: cliStore, entries: secondary.entries.length });
+                    secondary.entries.forEach(keep);
                 }
-                entries.push(...page.entries);
-            } while (entries.length < total);
-            const all = { entries };
+            }
+            const all = { entries: [...merged.values()] };
             const payload = {
                 schema: 'ruflo-memory-export/v1',
                 exportedAt: new Date().toISOString(),
@@ -1542,6 +1590,8 @@ export const memoryTools = [
                 outputPath,
                 format: input.format || 'json',
                 exported: { entries: all.entries.length, vectors: vectorsWithEmb, patterns: 0 },
+                stores,
+                ...(warnings.length ? { warnings } : {}),
                 fileSize: `${Buffer.byteLength(JSON.stringify(payload))}B`,
                 note: input.format === 'csv' ? 'CSV not implemented yet — wrote JSON' : undefined,
             };

package/v3/@claude-flow/cli/dist/src/mcp-tools/neural-tools.js

@@ -452,8 +452,24 @@ export const neuralTools = [
                     patternsStored++;
                 }
             }
+            // #4156: nothing stored means nothing was trained. Reporting success and "ready" made
+            // callers (the neural-train skill) believe the pattern store had been filled.
+            if (patternsStored === 0) {
+                model.status = 'untrained';
+                model.accuracy = 0;
+                saveNeuralStore(store);
+                return {
+                    success: false,
+                    status: 'empty',
+                    modelId,
+                    type: modelType,
+                    patternsStored: 0,
+                    totalPatterns: Object.keys(store.patterns).length,
+                    error: 'neural_train stored nothing: pass `data` (an array of strings or {text, label} entries). It does not read trajectories, SONA or the ReasoningBank: those (hooks_intelligence_*) are a separate store that neural_predict and neural_patterns do not see.',
+                };
+            }
             model.status = 'ready';
-            model.accuracy = patternsStored > 0 ? 1.0 : 0; // accuracy = data stored, not simulated
+            model.accuracy = 1.0; // accuracy = data stored, not simulated
             model.trainedAt = new Date().toISOString();
             saveNeuralStore(store);
             return {
@@ -484,6 +500,7 @@ export const neuralTools = [
                 modelId: { type: 'string', description: 'Model ID to use' },
                 input: { type: 'string', description: 'Input text or data' },
                 topK: { type: 'number', description: 'Number of top predictions' },
+                minSimilarity: { type: 'number', description: 'Minimum cosine similarity for a stored pattern to count as a match (default 0.5). A softmax over a single candidate is always 1.0, so without a floor any input matched the only stored pattern with confidence 1' },
             },
             required: ['input'],
         },
@@ -502,6 +519,7 @@ export const neuralTools = [
             const modelId = input.modelId;
             const inputText = input.input;
             const topK = input.topK || 3;
+            const minSimilarity = typeof input.minSimilarity === 'number' ? input.minSimilarity : 0.5;
             // Find model or use default
             const model = modelId ? store.models[modelId] : Object.values(store.models).find(m => m.status === 'ready');
             if (model && model.status !== 'ready') {
@@ -519,9 +537,10 @@ export const neuralTools = [
             // to 1, and we surface enough metadata to trust the result.
             const storedPatterns = Object.values(store.patterns);
             let predictions;
+            let bestSimilarity = null;
             if (storedPatterns.length > 0) {
                 // Step 1: k-NN with cosine
-                const scored = storedPatterns
+                let scored = storedPatterns
                     .map(p => {
                     const sim = cosineSimilarity(embedding, p.embedding);
                     return {
@@ -530,8 +549,10 @@ export const neuralTools = [
                         cosineSimilarity: sim,
                     };
                 })
-                    .sort((a, b) => b.cosineSimilarity - a.cosineSimilarity)
-                    .slice(0, topK);
+                    .sort((a, b) => b.cosineSimilarity - a.cosineSimilarity);
+                bestSimilarity = scored[0]?.cosineSimilarity ?? null;
+                // #4156: only patterns that reach the similarity floor are candidates.
+                scored = scored.filter((c) => c.cosineSimilarity >= minSimilarity).slice(0, topK);
                 // Step 2: temperature-softmax over the top-K so confidence sums to 1.
                 // Temperature 0.1 sharpens differences between similar candidates.
                 const tau = 0.1;
@@ -569,8 +590,11 @@ export const neuralTools = [
                 embedding: embedding.slice(0, 8), // Preview of embedding
                 embeddingDims: embedding.length,
                 latency,
+                ...(bestSimilarity !== null ? { bestSimilarity: Number(bestSimilarity.toFixed(4)), minSimilarity } : {}),
                 ...(storedPatterns.length === 0 ? {
                     _note: 'No patterns stored. Train with neural_train(modelType, trainingData) before predicting.',
+                } : predictions.length === 0 ? {
+                    _note: `No stored pattern reached the similarity floor (best ${bestSimilarity === null ? 'n/a' : bestSimilarity.toFixed(3)}, floor ${minSimilarity}); pass minSimilarity to lower it.`,
                 } : {}),
             };
         },

package/v3/@claude-flow/cli/dist/src/mcp-tools/ruvllm-tools.js

@@ -43,7 +43,13 @@ export const ruvllmWasmTools = [
                     nativeBackend = {
                         available: iStats._ruvllmBackend === 'active',
                         coordinator: iStats._ruvllmBackend || 'unavailable',
+                        // `trajectories` is the in-process SonaCoordinator buffer — it is
+                        // 0 in any process that did not itself record (e.g. this MCP
+                        // server while the daemon / hook processes do the recording).
                         trajectories: iStats._ruvllmTrajectories || 0,
+                        // Project-persisted total across all processes
+                        // (.claude-flow/neural/stats.json).
+                        trajectoriesRecorded: iStats.trajectoriesRecorded || 0,
                         contrastiveTrainer: sStats._contrastiveTrainer !== 'unavailable' ? 'active' : 'unavailable',
                         trainingBackend: iStats._trainingBackend || 'unknown',
                     };