claude-flow 3.59.12 → 3.59.14

package/.claude/helpers/hook-handler.cjs

@@ -24,9 +24,10 @@ const helpersDir = __dirname;
 const helperRoot = path.resolve(helpersDir, '..', '..');
 
 // Resolve an installed @claude-flow/cli (or ruflo) bin — mirrors
-// statusline-generator.ts's resolveCliBin() candidate list. Used only to
-// spawn the detached funnel-refresh helper below; failures are silent (no
-// candidate found just means the refresh never fires this session).
+// statusline-generator.ts's resolveCliBin() candidate list, then looks for a
+// global install (resolveGlobalCliBin() below, #3368). Used only to spawn the
+// detached funnel-refresh helper below; failures are silent (no candidate
+// found just means the refresh falls back to npx).
 //
 // Verifies dist/src/index.js exists alongside bin/cli.js, not just the bin
 // itself — Claude Code's own plugin marketplace mechanism installs by
@@ -39,7 +40,17 @@ const helperRoot = path.resolve(helpersDir, '..', '..');
 // first every time and spawnDetachedFunnelRefresh() below had no fallback,
 // so the promo/disclosure row could never populate for any marketplace
 // install, on any OS.
+// session-restore asks up to three times (first-run enable, then the two
+// refreshes). The answer cannot change inside one short-lived hook process,
+// so resolve once: `undefined` means "not looked up yet", null means "no
+// local or global CLI — use npx".
+let cliBinCache;
 function resolveCliBinForHook() {
+  if (cliBinCache === undefined) cliBinCache = resolveCliBinUncached();
+  return cliBinCache;
+}
+
+function resolveCliBinUncached() {
   try {
     const home = os.homedir();
     const candidates = [
@@ -53,16 +64,219 @@ function resolveCliBinForHook() {
       path.join(helpersDir, '..', '..', 'bin', 'cli.js'),
     ];
     for (const p of candidates) {
-      try {
-        if (fs.existsSync(p) && fs.existsSync(path.join(path.dirname(p), '..', 'dist', 'src', 'index.js'))) {
-          return p;
-        }
-      } catch (e) { /* try next candidate */ }
+      if (isRunnableCli(p)) return p;
     }
+    return resolveGlobalCliBin();
   } catch (e) { /* ignore */ }
   return null;
 }
 
+function isRunnableCli(p) {
+  try {
+    return fs.existsSync(p) && fs.existsSync(path.join(path.dirname(p), '..', 'dist', 'src', 'index.js'));
+  } catch (e) { return false; }
+}
+
+// #3368: a global install — the README's `npm install -g ruflo@latest` — keeps
+// the CLI at <prefix>/lib/node_modules/ruflo/node_modules/@claude-flow/cli,
+// which none of the project-relative candidates above cover, so on those
+// machines every refresh fell back to npx: a second, separately cached copy
+// of the CLI that follows the registry's latest rather than the version the
+// user pinned (the same npx-cache skew as #3306), and that cannot start
+// offline on a cold cache.
+//
+// Three lookups, fs calls only (no child process), reached only after every
+// candidate above missed:
+//   1. npm's global prefix, resolved the way npm resolves it
+//      (npmGlobalPrefix() below). First because it does not depend on PATH:
+//      a hook inherits the host process's PATH, which need not contain the
+//      prefix's bin/ even when the user's interactive shell does (observed:
+//      the Claude Code process spawning hooks lacked ~/.npm-global/bin while
+//      a login zsh on the same machine had it).
+//   2. `ruflo`, then `claude-flow`, on PATH — the order plugins/ruflo-core/
+//      scripts/ruflo-hook.cjs uses — for globals npm did not install (yarn
+//      classic, bun). Only a symlinked bin counts, and only when it lands in
+//      a package that declares one of the three known names, so a wrapper
+//      script or a version-manager shim (Volta) is never mistaken for an
+//      install. The <dir>/node_modules/<name> layout npm uses on Windows,
+//      where ruflo.cmd sits beside node_modules\ruflo (what resolveNpmShim()
+//      in ruflo-hook.cjs maps), is only consulted on win32: on POSIX every
+//      manager symlinks, and probing it there would follow a Windows install
+//      exposed to WSL through the appended Windows PATH.
+//      Relative PATH entries (`.` or an empty entry) are skipped, so a bare
+//      `./ruflo` in the working directory is never picked up.
+//   3. ~/.npm-global, npm's documented no-sudo prefix, when 1 and 2 both
+//      missed: the prefix setting may live where this hook's node never
+//      reads it, and a wrapper script on PATH is skipped by 2.
+// `env`/`platform`/`execPath` are parameters so any layout is testable
+// from any OS.
+function resolveGlobalCliBin(env = process.env, platform = process.platform, execPath = process.execPath) {
+  const prefix = npmGlobalPrefix(env, platform, execPath);
+  if (prefix) {
+    const hit = cliUnderPrefix(prefix, platform);
+    if (hit) return hit;
+  }
+  const dirs = String(env.PATH || env.Path || '').split(platform === 'win32' ? ';' : ':');
+  const exts = platform === 'win32' ? ['.cmd', ''] : [''];
+  for (const name of ['ruflo', 'claude-flow']) {
+    for (const dir of dirs) {
+      if (!dir || !path.isAbsolute(dir)) continue;
+      for (const ext of exts) {
+        const shim = path.join(dir, name + ext);
+        if (!fs.existsSync(shim)) continue;
+        const roots = [];
+        try {
+          if (fs.lstatSync(shim).isSymbolicLink()) {
+            const root = path.dirname(path.dirname(fs.realpathSync(shim)));
+            if (isKnownPackageRoot(root)) roots.push(root);
+          }
+        } catch (e) { /* unreadable link — fall back to the layout roots */ }
+        if (platform === 'win32') {
+          roots.push(path.join(dir, 'node_modules', name));
+          if (name === 'claude-flow') roots.push(path.join(dir, 'node_modules', '@claude-flow', 'cli'));
+        }
+        for (const root of roots) {
+          const hit = cliInPackage(root);
+          if (hit) return hit;
+        }
+      }
+    }
+  }
+  // Last resort: ~/.npm-global, the prefix npm's own docs recommend for
+  // global installs without sudo ("Resolving EACCES permissions errors").
+  // The setting that points npm there can live where this hook's node never
+  // looks (another node's builtin npmrc, or a wrapper script that sets it
+  // per call), and a `ruflo` wrapper script on PATH is skipped above by
+  // design. Without this, such a machine fell back to npx @latest on every
+  // hook. Checked only after the configured prefix and PATH both miss, so it
+  // can never override either.
+  const home = env.HOME || env.USERPROFILE;
+  if (home && path.isAbsolute(home)) {
+    const hit = cliUnderPrefix(path.join(home, '.npm-global'), platform);
+    if (hit) return hit;
+  }
+  return null;
+}
+
+// The CLI of a global install under an npm prefix: <prefix>/lib/node_modules
+// on POSIX, <prefix>\node_modules on Windows, trying the three published
+// package names in order.
+function cliUnderPrefix(prefix, platform) {
+  const modules = platform === 'win32'
+    ? path.join(prefix, 'node_modules')
+    : path.join(prefix, 'lib', 'node_modules');
+  for (const pkg of ['ruflo', 'claude-flow', path.join('@claude-flow', 'cli')]) {
+    const hit = cliInPackage(path.join(modules, pkg));
+    if (hit) return hit;
+  }
+  return null;
+}
+
+// A bin on PATH only counts as an install when the package it points into
+// declares one of the three published names. This is a narrower check than
+// resolveNpmShim() in ruflo-hook.cjs, which never reads `name`: that one takes
+// the package name from the shim's own filename, then validates package.json's
+// `bin` entry and that its realpath stays inside the package. Here the bin has
+// already been resolved to a package root, so the manifest `name` is what
+// identifies it.
+function isKnownPackageRoot(root) {
+  try {
+    const name = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf-8')).name;
+    return name === 'ruflo' || name === 'claude-flow' || name === '@claude-flow/cli';
+  } catch (e) { return false; }
+}
+
+// Map an installed ruflo / claude-flow / @claude-flow/cli package root to the
+// CLI it runs: <root>/bin/cli.js (@claude-flow/cli itself),
+// <root>/v3/@claude-flow/cli/bin/cli.js (the claude-flow umbrella bundles
+// it), or @claude-flow/cli in the node_modules npm nests inside <root> —
+// or, for the flat layout yarn classic and bun use, in the node_modules
+// folder that holds <root> itself. That is the dependency edge
+// ruflo/bin/ruflo.js's findCliPath() follows. The search stops at that one
+// enclosing node_modules: walking further up would reach unrelated trees,
+// such as a stray ~/node_modules left by an `npm i` in a home directory.
+// Every hit must still pass isRunnableCli().
+function cliInPackage(root) {
+  if (!fs.existsSync(root)) return null;
+  const candidates = [
+    path.join(root, 'bin', 'cli.js'),
+    path.join(root, 'v3', '@claude-flow', 'cli', 'bin', 'cli.js'),
+    path.join(root, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js'),
+  ];
+  for (let dir = path.dirname(root), i = 0; i < 4 && dir !== path.dirname(dir); i++, dir = path.dirname(dir)) {
+    if (path.basename(dir) === 'node_modules') {
+      candidates.push(path.join(dir, '@claude-flow', 'cli', 'bin', 'cli.js'));
+      break;
+    }
+  }
+  return candidates.find(isRunnableCli) || null;
+}
+
+// npm's global prefix without spawning npm (`npm prefix -g` measured 70-80 ms
+// per call, paid on every SessionStart that gets this far). Same precedence
+// npm applies:
+//   1. npm_config_prefix in the environment (npm accepts either case);
+//   2. `prefix=` in the user npmrc ($npm_config_userconfig, else ~/.npmrc),
+//      where `npm config set prefix ~/.npm-global` (the npm docs' fix for
+//      EACCES on global installs) writes it;
+//   3. `prefix=` in npm's builtin npmrc (<npm package>/npmrc), found through
+//      the `npm` link beside node: Homebrew writes `prefix = /opt/homebrew`
+//      there (its process.execPath is the Cellar path, so step 4 alone would
+//      be wrong), and the Node.js Windows installer ships
+//      `prefix=${APPDATA}\npm`;
+//   4. npm's default: $PREFIX, else the directory above node's bin/ (POSIX)
+//      or node.exe's own directory (Windows).
+// Values follow npm's ini handling for the cases that decide a path: a
+// quoted value is taken literally, an unquoted `;`/`#` starts a comment,
+// keys below a `[section]` header are ignored, `${VAR}` expands when the
+// variable is set (and `${VAR?}` to empty when it is not) but otherwise
+// stays literal like npm — which leaves the value relative, so the
+// isAbsolute() check below rejects it instead of pointing at the drive root.
+// Not emulated: escaped characters and npm's other ini corner cases; each of
+// those produces a miss, never a wrong CLI. The npmrc is read into memory,
+// but only the value of its last top-level `prefix =` line is kept: no other
+// line (an `_authToken`, say) is returned, stored or logged.
+function npmGlobalPrefix(env = process.env, platform = process.platform, execPath = process.execPath) {
+  const home = (platform === 'win32' ? env.USERPROFILE : env.HOME) || os.homedir();
+  const readPrefix = (file) => {
+    let value = null;
+    try {
+      for (const line of fs.readFileSync(file, 'utf-8').split(/\r?\n/)) {
+        if (/^\s*\[/.test(line)) break; // only the top-level section applies
+        const m = /^\s*prefix\s*=\s*(.*?)\s*$/.exec(line);
+        if (m) value = m[1]; // last one wins, as in npm's ini parser
+      }
+    } catch (e) { /* no such npmrc */ }
+    return value;
+  };
+  const nodeDir = path.dirname(execPath);
+  // npm's builtin npmrc sits in npm's own package dir. On Windows that is
+  // node_modules\npm beside node.exe; elsewhere follow the `npm` link beside
+  // node (<npm>/bin/npm-cli.js) — on Homebrew it points out of the node keg
+  // to /opt/homebrew/lib/node_modules/npm.
+  let builtinRc = path.join(nodeDir, 'node_modules', 'npm', 'npmrc');
+  if (platform !== 'win32') {
+    try {
+      builtinRc = path.join(path.dirname(path.dirname(fs.realpathSync(path.join(nodeDir, 'npm')))), 'npmrc');
+    } catch (e) { /* no npm beside node */ }
+  }
+  const raw = env.npm_config_prefix || env.NPM_CONFIG_PREFIX
+    || readPrefix(env.npm_config_userconfig || env.NPM_CONFIG_USERCONFIG || path.join(home, '.npmrc'))
+    || readPrefix(builtinRc)
+    || env.PREFIX
+    || (platform === 'win32' ? nodeDir : path.dirname(nodeDir));
+  let value = String(raw).trim();
+  const quoted = /^(["'])([\s\S]*)\1$/.exec(value);
+  if (quoted) value = quoted[2];
+  else value = value.replace(/(^|[^\\])[;#].*$/, '$1').trim();
+  value = value
+    .replace(/\$\{([^}?]+)(\?)?\}/g, (whole, name, optional) => (
+      env[name] !== undefined ? env[name] : (optional ? '' : whole)
+    ))
+    .replace(/^~(?=$|[\\/])/, home);
+  return path.isAbsolute(value) ? path.resolve(value) : null;
+}
+
 // Fire-and-forget doesn't work when the CALLER is itself a short-lived
 // subprocess (confirmed live: two consecutive statusline renders 5s apart
 // both saw an empty funnel-messages-cache, because the async HTTPS fetch
@@ -74,8 +288,8 @@ function resolveCliBinForHook() {
 // chance to write the cache. Never awaited here — must not add to
 // SessionStart's own timeout budget.
 //
-// No usable local candidate (resolveCliBinForHook() returned null) falls
-// back to npx: this call is detached/unref'd, so a slower npx cold-start
+// No usable local or global candidate (resolveCliBinForHook() returned null)
+// falls back to npx: this call is detached/unref'd, so a slower npx cold-start
 // costs nothing perceptible — unlike the statusline's own synchronous
 // render path, where local-first exists purely for per-render latency.
 // `--prefer-offline` avoids a registry round trip for the tarball when
@@ -1060,4 +1274,7 @@ if (require.main === module) {
 // Which sibling helpers loaded (all CommonJS, shipped as .cjs — #3555).
 const loadedHelpers = { router: !!router, session: !!session, memory: !!memory, intelligence: !!intelligence };
 
-module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS, resolveCliBinForHook, cliSpawnArgs, helperRoot, scanSessionStartSettingsForRisk, srFormatRiskFindingsForAutomaticBoot, srScanSettingsForRisk, srScanCommandStringForRisk, srScanAllowRuleForRisk, SR_DANGEROUS_COMMAND_WORDS, SR_SHELL_EXEC_WORDS, SR_DOWNLOADER_WORDS, SR_STANDALONE_RISK_PATTERNS };
+// resolveGlobalCliBin/npmGlobalPrefix are exported for
+// hook-handler-global-cli.test.ts; resolveCliBinForHook for anyone checking
+// what a given machine resolves to without running a hook (#3368).
+module.exports = { runWithTimeout, INTELLIGENCE_TIMEOUT_MS, loadedHelpers, ownedByMod, MOD_OWNABLE_EVENTS, resolveCliBinForHook, resolveGlobalCliBin, npmGlobalPrefix, cliSpawnArgs, helperRoot, scanSessionStartSettingsForRisk, srFormatRiskFindingsForAutomaticBoot, srScanSettingsForRisk, srScanCommandStringForRisk, srScanAllowRuleForRisk, SR_DANGEROUS_COMMAND_WORDS, SR_SHELL_EXEC_WORDS, SR_DOWNLOADER_WORDS, SR_STANDALONE_RISK_PATTERNS };

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1792615534268,
+  "adoptedAt": 1792643533692,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.59.12",
+  "version": "3.59.14",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/mcp",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-21T20:45:54.432Z",
-  "gitSha": "c7646541",
+  "generatedAt": "2026-10-22T04:32:33.371Z",
+  "gitSha": "88bdc9a6",
   "catalog": {
     "agents": 176,
     "tools": 432,

package/v3/@claude-flow/cli/dist/src/mcp-tools/claims-tools.d.ts

@@ -6,7 +6,7 @@
  *
  * @module @claude-flow/cli/mcp-tools/claims
  */
-import type { MCPTool } from './types.js';
+import { type MCPTool } from './types.js';
 export declare const claimsTools: MCPTool[];
 export default claimsTools;
 //# sourceMappingURL=claims-tools.d.ts.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/claims-tools.js

@@ -6,19 +6,20 @@
  *
  * @module @claude-flow/cli/mcp-tools/claims
  */
+import { getProjectCwd } from './types.js';
 import { readClaimsStore } from '../services/claims-store.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 // File-based persistence
 import { existsSync, writeFileSync, mkdirSync } from 'fs';
-import { join, resolve } from 'path';
+import { resolve } from 'path';
 const CLAIMS_DIR = '.claude-flow/claims';
 const CLAIMS_FILE = 'claims.json';
 const DEFAULT_MAX_CLAIMS = 5;
 function getClaimsPath() {
-    return resolve(join(CLAIMS_DIR, CLAIMS_FILE));
+    return resolve(getProjectCwd(), CLAIMS_DIR, CLAIMS_FILE);
 }
 function ensureClaimsDir() {
-    const dir = resolve(CLAIMS_DIR);
+    const dir = resolve(getProjectCwd(), CLAIMS_DIR);
     if (!existsSync(dir)) {
         mkdirSync(dir, { recursive: true });
     }

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -21,6 +21,17 @@ import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.
 const MEMORY_DIR = '.swarm';
 const LEGACY_MEMORY_FILE = 'store.json';
 const LEGACY_MEMORY_DIR = '.claude-flow/memory';
+/**
+ * #3196: allow an MCP caller to select the same explicit store the CLI accepts
+ * via `--path`. No path means the existing MCP default is unchanged; this is
+ * deliberately not an implicit `CLAUDE_FLOW_DB_PATH` override because the
+ * native/encrypted CLI store and the AgentDB sibling are separate backends.
+ */
+function resolveDbPathOption(inputDbPath) {
+    return typeof inputDbPath === 'string' && inputDbPath.trim().length > 0
+        ? resolve(inputDbPath)
+        : undefined;
+}
 const MIGRATION_MARKER = '.migrated-to-sqlite';
 function getMemoryDir() {
     return resolve(MEMORY_DIR);
@@ -439,6 +450,7 @@ export const memoryTools = [
                     enum: ['user_claim', 'agent_output', 'system_observation', 'tool_result', 'unknown'],
                     description: 'ADR-323: who/what produced this value, so shared-namespace retrieval can filter by trust level instead of conflating a user\'s stated claim with an agent\'s own output. Default: "unknown".',
                 },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
             required: ['key', 'value'],
         },
@@ -447,7 +459,9 @@ export const memoryTools = [
             if (missingKey) {
                 return { success: false, key: input.key, stored: false, hasEmbedding: false, ...missingKey };
             }
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { storeEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
@@ -486,6 +500,7 @@ export const memoryTools = [
                     ttl,
                     upsert,
                     provenanceType,
+                    dbPath,
                 });
                 const duration = performance.now() - startTime;
                 return {
@@ -522,6 +537,7 @@ export const memoryTools = [
             properties: {
                 key: { type: 'string', description: 'Memory key' },
                 namespace: { type: 'string', description: 'Namespace (default: "default")' },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
             required: ['key'],
         },
@@ -530,13 +546,15 @@ export const memoryTools = [
             if (missingKey) {
                 return { key: input.key, namespace: input.namespace, value: null, found: false, ...missingKey };
             }
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { getEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
             validateMemoryInput(key, undefined, undefined, namespace);
             try {
-                const result = await getEntry({ key, namespace });
+                const result = await getEntry({ key, namespace, dbPath });
                 if (result.found && result.entry) {
                     // Try to parse JSON value
                     let value = result.entry.content;
@@ -594,6 +612,7 @@ export const memoryTools = [
                     items: { type: 'string', enum: ['user_claim', 'agent_output', 'system_observation', 'tool_result', 'unknown'] },
                     description: 'ADR-323: restrict results to these provenance types (e.g. exclude user_claim when fact-checking). Omit for no filtering. Enforced for standard and SmartRetrieval searches.',
                 },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
             required: ['query'],
         },
@@ -602,7 +621,9 @@ export const memoryTools = [
             if (missingQuery) {
                 return { query: input.query, results: [], total: 0, ...missingQuery };
             }
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { searchEntries } = await getMemoryFunctions();
             const query = input.query;
             const provenanceFilter = input.provenance_filter;
@@ -649,6 +670,7 @@ export const memoryTools = [
                                 limit: req.limit || limit * 3,
                                 threshold: req.threshold ?? threshold,
                                 provenanceFilter,
+                                dbPath,
                             });
                             return {
                                 results: r.results.map(e => ({
@@ -693,7 +715,7 @@ export const memoryTools = [
                             };
                         });
                         const smartNearMisses = results.length === 0 && thresholdWasDefault
-                            ? await nearMisses(searchEntries, { query, namespace, provenanceFilter })
+                            ? await nearMisses(searchEntries, { query, namespace, provenanceFilter, dbPath })
                             : undefined;
                         return {
                             query,
@@ -721,6 +743,7 @@ export const memoryTools = [
                     limit,
                     threshold,
                     provenanceFilter,
+                    dbPath,
                 });
                 if (!result.success) {
                     return { query, results: [], total: 0, error: result.error };
@@ -744,7 +767,7 @@ export const memoryTools = [
                     };
                 });
                 const nearMissInfo = results.length === 0 && thresholdWasDefault
-                    ? await nearMisses(searchEntries, { query, namespace, provenanceFilter })
+                    ? await nearMisses(searchEntries, { query, namespace, provenanceFilter, dbPath })
                     : undefined;
                 return {
                     query,
@@ -775,6 +798,7 @@ export const memoryTools = [
             properties: {
                 key: { type: 'string', description: 'Memory key' },
                 namespace: { type: 'string', description: 'Namespace (default: "default")' },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
             required: ['key'],
         },
@@ -783,13 +807,15 @@ export const memoryTools = [
             if (missingKey) {
                 return { success: false, key: input.key, namespace: input.namespace, deleted: false, ...missingKey };
             }
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { deleteEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
             validateMemoryInput(key, undefined, undefined, namespace);
             try {
-                const result = await deleteEntry({ key, namespace });
+                const result = await deleteEntry({ key, namespace, dbPath });
                 return {
                     success: result.deleted,
                     key,
@@ -825,10 +851,13 @@ export const memoryTools = [
                 },
                 limit: { type: 'number', description: 'Maximum results (default: 50)' },
                 offset: { type: 'number', description: 'Offset for pagination (default: 0)' },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
         },
         handler: async (input) => {
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { listEntries } = await getMemoryFunctions();
             const namespace = input.namespace;
             const tags = Array.isArray(input.tags)
@@ -847,6 +876,7 @@ export const memoryTools = [
                     tags,
                     limit,
                     offset,
+                    dbPath,
                 });
                 const entries = result.entries.map(e => ({
                     key: e.key,
@@ -884,14 +914,14 @@ export const memoryTools = [
         inputSchema: {
             type: 'object',
             properties: {
-                dbPath: { type: 'string', description: 'Database file to inspect; omitted uses the MCP store default' },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
         },
         handler: async (input) => {
             if (input.dbPath !== undefined && (typeof input.dbPath !== 'string' || !input.dbPath.trim())) {
                 return memoryStatsUnavailable('dbPath must be a non-empty string');
             }
-            const dbPath = typeof input.dbPath === 'string' ? resolve(input.dbPath) : undefined;
+            const dbPath = resolveDbPathOption(input.dbPath);
             // An explicit read must not initialize or migrate the unrelated default store.
             if (!dbPath)
                 await ensureInitialized();

package/v3/@claude-flow/cli/dist/src/mcp-tools/workflow-tools.js

@@ -583,7 +583,8 @@ export const workflowTools = [
             }
             // Sort by creation date (newest first)
             workflows.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
-            // Apply limit
+            // Count the matches before the limit cuts the page down
+            const total = workflows.length;
             const limit = input.limit || 20;
             workflows = workflows.slice(0, limit);
             return {
@@ -595,7 +596,7 @@ export const workflowTools = [
                     createdAt: w.createdAt,
                     completedAt: w.completedAt,
                 })),
-                total: workflows.length,
+                total,
                 filters: { status: input.status },
             };
         },

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.59.12",
+  "version": "3.59.14",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",