claude-flow 3.59.13 → 3.59.15

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1792634570394,
+  "adoptedAt": 1792652697736,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.59.13",
+  "version": "3.59.15",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/mcp",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-22T02:03:09.504Z",
-  "gitSha": "056a11ec",
+  "generatedAt": "2026-10-22T07:59:21.864Z",
+  "gitSha": "b2c74c22",
   "catalog": {
     "agents": 176,
     "tools": 432,

package/v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.d.ts

@@ -27,6 +27,28 @@
  * pre-release channel, pin deliberately rather than floating) until the fix
  * is promoted to `latest`, tracked by the same issue.
  *
+ * UPDATE (2026-10-22, #4371): `2.0.0-alpha.5`'s own `optionalDependencies`
+ * claimed `@agntcy/slim-bindings-linux-arm64-musl@2.0.0-alpha.5`, but that
+ * platform package was never published upstream (its own first version is
+ * `2.1.1-rc.2` — confirmed via `npm view @agntcy/slim-bindings-linux-arm64-musl
+ * versions`, which is also true of every other `2.0.0-alpha.*`/`2.0.0`/`2.1.0`
+ * release). npm tolerates an unresolvable optional dependency and silently
+ * skips it, so this never surfaced in this repo's own npm-based CI, but
+ * strict resolvers (`mise`'s `aube` backend, pnpm in some modes) fail the
+ * whole install. `package.json` now pins `2.1.1` — the earliest release where
+ * every platform's optional package actually exists at that exact version
+ * (verified against the live registry for all 8 platforms). Re-verified live
+ * under plain Node against the real installed `2.1.1` package: the dynamic
+ * `import()` resolves with zero errors (same module shape — a `Session`/
+ * `Channel`/`App`-class-based SDK, not the `joinGroup`/`createSlimTransport`/
+ * `publishAgentRecord` flat functions `transport.ts`/`swarm-join.ts`/
+ * `publish.ts` call. Confirmed this mismatch predates this pin change — it
+ * was equally absent from `2.0.0-alpha.5` — so it's a pre-existing gap this
+ * version bump does not introduce or worsen; tracked separately in #4376),
+ * and the full
+ * `__tests__/agntcy/agntcy-commands.test.ts` suite (19 tests, including the
+ * real-resolution "configured: true" case) passes against this version.
+ *
  * This module's existing graceful-degradation design already handled this
  * correctly without any change to its logic: `detectAgntcyRuntime()`'s
  * catch-all branch (anything other than MODULE_NOT_FOUND) reports the real

package/v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.js

@@ -27,6 +27,28 @@
  * pre-release channel, pin deliberately rather than floating) until the fix
  * is promoted to `latest`, tracked by the same issue.
  *
+ * UPDATE (2026-10-22, #4371): `2.0.0-alpha.5`'s own `optionalDependencies`
+ * claimed `@agntcy/slim-bindings-linux-arm64-musl@2.0.0-alpha.5`, but that
+ * platform package was never published upstream (its own first version is
+ * `2.1.1-rc.2` — confirmed via `npm view @agntcy/slim-bindings-linux-arm64-musl
+ * versions`, which is also true of every other `2.0.0-alpha.*`/`2.0.0`/`2.1.0`
+ * release). npm tolerates an unresolvable optional dependency and silently
+ * skips it, so this never surfaced in this repo's own npm-based CI, but
+ * strict resolvers (`mise`'s `aube` backend, pnpm in some modes) fail the
+ * whole install. `package.json` now pins `2.1.1` — the earliest release where
+ * every platform's optional package actually exists at that exact version
+ * (verified against the live registry for all 8 platforms). Re-verified live
+ * under plain Node against the real installed `2.1.1` package: the dynamic
+ * `import()` resolves with zero errors (same module shape — a `Session`/
+ * `Channel`/`App`-class-based SDK, not the `joinGroup`/`createSlimTransport`/
+ * `publishAgentRecord` flat functions `transport.ts`/`swarm-join.ts`/
+ * `publish.ts` call. Confirmed this mismatch predates this pin change — it
+ * was equally absent from `2.0.0-alpha.5` — so it's a pre-existing gap this
+ * version bump does not introduce or worsen; tracked separately in #4376),
+ * and the full
+ * `__tests__/agntcy/agntcy-commands.test.ts` suite (19 tests, including the
+ * real-resolution "configured: true" case) passes against this version.
+ *
  * This module's existing graceful-degradation design already handled this
  * correctly without any change to its logic: `detectAgntcyRuntime()`'s
  * catch-all branch (anything other than MODULE_NOT_FOUND) reports the real

package/v3/@claude-flow/cli/dist/src/encryption/vault.d.ts

@@ -41,6 +41,15 @@ export declare function isEncryptionEnabled(): boolean;
  * encryption is enabled but no key resolves, this throws with a clear
  * message rather than silently falling back to plaintext (fail-closed).
  *
+ * The optional `context` selects which missing-key message to throw:
+ *   - `'encrypt'` (default): the caller is about to encrypt because
+ *     `CLAUDE_FLOW_ENCRYPT_AT_REST` is set, so the original message is
+ *     accurate.
+ *   - `'decrypt'`: the caller hit an RFE1-encrypted blob on read (e.g. a
+ *     store restored from another machine) while the enable flag may be
+ *     unset (issue #3212). The message echoes the flag's actual value and
+ *     the on-disk state instead of asserting the flag is set.
+ *
  * Accepted encodings (auto-detected by length):
  *   - 64-char hex (32 bytes)
  *   - 44-char base64 (32 bytes + padding)
@@ -49,7 +58,7 @@ export declare function isEncryptionEnabled(): boolean;
  * Anything else is rejected — we'd rather fail loudly than encrypt with a
  * truncated key.
  */
-export declare function getKey(): Buffer;
+export declare function getKey(context?: 'encrypt' | 'decrypt'): Buffer;
 /**
  * Decode a key string. Exposed for testing and for the future passphrase
  * resolver, which will scrypt-derive a Buffer and hand it back through here

package/v3/@claude-flow/cli/dist/src/encryption/vault.js

@@ -58,6 +58,15 @@ export function isEncryptionEnabled() {
  * encryption is enabled but no key resolves, this throws with a clear
  * message rather than silently falling back to plaintext (fail-closed).
  *
+ * The optional `context` selects which missing-key message to throw:
+ *   - `'encrypt'` (default): the caller is about to encrypt because
+ *     `CLAUDE_FLOW_ENCRYPT_AT_REST` is set, so the original message is
+ *     accurate.
+ *   - `'decrypt'`: the caller hit an RFE1-encrypted blob on read (e.g. a
+ *     store restored from another machine) while the enable flag may be
+ *     unset (issue #3212). The message echoes the flag's actual value and
+ *     the on-disk state instead of asserting the flag is set.
+ *
  * Accepted encodings (auto-detected by length):
  *   - 64-char hex (32 bytes)
  *   - 44-char base64 (32 bytes + padding)
@@ -66,9 +75,16 @@ export function isEncryptionEnabled() {
  * Anything else is rejected — we'd rather fail loudly than encrypt with a
  * truncated key.
  */
-export function getKey() {
+export function getKey(context = 'encrypt') {
     const raw = process.env[ENV_KEY_VAR];
     if (!raw) {
+        if (context === 'decrypt') {
+            const flag = process.env[ENV_ENABLE_FLAG] ?? 'unset';
+            throw new Error(`${ENV_KEY_VAR} is required but not set ` +
+                `(${ENV_ENABLE_FLAG}=${flag}; the store on disk is RFE1-encrypted). ` +
+                `Supply the key this store was encrypted with — a newly generated key will not decrypt it. ` +
+                `Provide a 32-byte key as 64-char hex or 44-char base64.`);
+        }
         throw new Error(`${ENV_ENABLE_FLAG} is set but ${ENV_KEY_VAR} is not. ` +
             `Provide a 32-byte key as 64-char hex or 44-char base64. ` +
             `See ADR-096 for keychain/passphrase support (coming in a follow-up).`);

package/v3/@claude-flow/cli/dist/src/fs-secure.js

@@ -172,7 +172,9 @@ export function readFileMaybeEncrypted(path, encoding = 'utf-8') {
     const raw = readFileSync(path);
     let plain;
     if (isEncryptedBlob(raw)) {
-        plain = decryptBuffer(raw, getKey());
+        // 'decrypt': the blob on disk is RFE1-encrypted but the enable flag may
+        // be unset (e.g. store restored from another machine) — see #3212.
+        plain = decryptBuffer(raw, getKey('decrypt'));
     }
     else {
         plain = raw;

package/v3/@claude-flow/cli/dist/src/mcp-tools/memory-tools.js

@@ -21,6 +21,17 @@ import { DEFAULT_SEARCH_THRESHOLD, nearMisses } from '../memory/search-defaults.
 const MEMORY_DIR = '.swarm';
 const LEGACY_MEMORY_FILE = 'store.json';
 const LEGACY_MEMORY_DIR = '.claude-flow/memory';
+/**
+ * #3196: allow an MCP caller to select the same explicit store the CLI accepts
+ * via `--path`. No path means the existing MCP default is unchanged; this is
+ * deliberately not an implicit `CLAUDE_FLOW_DB_PATH` override because the
+ * native/encrypted CLI store and the AgentDB sibling are separate backends.
+ */
+function resolveDbPathOption(inputDbPath) {
+    return typeof inputDbPath === 'string' && inputDbPath.trim().length > 0
+        ? resolve(inputDbPath)
+        : undefined;
+}
 const MIGRATION_MARKER = '.migrated-to-sqlite';
 function getMemoryDir() {
     return resolve(MEMORY_DIR);
@@ -439,6 +450,7 @@ export const memoryTools = [
                     enum: ['user_claim', 'agent_output', 'system_observation', 'tool_result', 'unknown'],
                     description: 'ADR-323: who/what produced this value, so shared-namespace retrieval can filter by trust level instead of conflating a user\'s stated claim with an agent\'s own output. Default: "unknown".',
                 },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
             required: ['key', 'value'],
         },
@@ -447,7 +459,9 @@ export const memoryTools = [
             if (missingKey) {
                 return { success: false, key: input.key, stored: false, hasEmbedding: false, ...missingKey };
             }
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { storeEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
@@ -486,6 +500,7 @@ export const memoryTools = [
                     ttl,
                     upsert,
                     provenanceType,
+                    dbPath,
                 });
                 const duration = performance.now() - startTime;
                 return {
@@ -522,6 +537,7 @@ export const memoryTools = [
             properties: {
                 key: { type: 'string', description: 'Memory key' },
                 namespace: { type: 'string', description: 'Namespace (default: "default")' },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
             required: ['key'],
         },
@@ -530,13 +546,15 @@ export const memoryTools = [
             if (missingKey) {
                 return { key: input.key, namespace: input.namespace, value: null, found: false, ...missingKey };
             }
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { getEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
             validateMemoryInput(key, undefined, undefined, namespace);
             try {
-                const result = await getEntry({ key, namespace });
+                const result = await getEntry({ key, namespace, dbPath });
                 if (result.found && result.entry) {
                     // Try to parse JSON value
                     let value = result.entry.content;
@@ -594,6 +612,7 @@ export const memoryTools = [
                     items: { type: 'string', enum: ['user_claim', 'agent_output', 'system_observation', 'tool_result', 'unknown'] },
                     description: 'ADR-323: restrict results to these provenance types (e.g. exclude user_claim when fact-checking). Omit for no filtering. Enforced for standard and SmartRetrieval searches.',
                 },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
             required: ['query'],
         },
@@ -602,7 +621,9 @@ export const memoryTools = [
             if (missingQuery) {
                 return { query: input.query, results: [], total: 0, ...missingQuery };
             }
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { searchEntries } = await getMemoryFunctions();
             const query = input.query;
             const provenanceFilter = input.provenance_filter;
@@ -649,6 +670,7 @@ export const memoryTools = [
                                 limit: req.limit || limit * 3,
                                 threshold: req.threshold ?? threshold,
                                 provenanceFilter,
+                                dbPath,
                             });
                             return {
                                 results: r.results.map(e => ({
@@ -693,7 +715,7 @@ export const memoryTools = [
                             };
                         });
                         const smartNearMisses = results.length === 0 && thresholdWasDefault
-                            ? await nearMisses(searchEntries, { query, namespace, provenanceFilter })
+                            ? await nearMisses(searchEntries, { query, namespace, provenanceFilter, dbPath })
                             : undefined;
                         return {
                             query,
@@ -721,6 +743,7 @@ export const memoryTools = [
                     limit,
                     threshold,
                     provenanceFilter,
+                    dbPath,
                 });
                 if (!result.success) {
                     return { query, results: [], total: 0, error: result.error };
@@ -744,7 +767,7 @@ export const memoryTools = [
                     };
                 });
                 const nearMissInfo = results.length === 0 && thresholdWasDefault
-                    ? await nearMisses(searchEntries, { query, namespace, provenanceFilter })
+                    ? await nearMisses(searchEntries, { query, namespace, provenanceFilter, dbPath })
                     : undefined;
                 return {
                     query,
@@ -775,6 +798,7 @@ export const memoryTools = [
             properties: {
                 key: { type: 'string', description: 'Memory key' },
                 namespace: { type: 'string', description: 'Namespace (default: "default")' },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
             required: ['key'],
         },
@@ -783,13 +807,15 @@ export const memoryTools = [
             if (missingKey) {
                 return { success: false, key: input.key, namespace: input.namespace, deleted: false, ...missingKey };
             }
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { deleteEntry } = await getMemoryFunctions();
             const key = input.key;
             const namespace = input.namespace || 'default';
             validateMemoryInput(key, undefined, undefined, namespace);
             try {
-                const result = await deleteEntry({ key, namespace });
+                const result = await deleteEntry({ key, namespace, dbPath });
                 return {
                     success: result.deleted,
                     key,
@@ -825,10 +851,13 @@ export const memoryTools = [
                 },
                 limit: { type: 'number', description: 'Maximum results (default: 50)' },
                 offset: { type: 'number', description: 'Offset for pagination (default: 0)' },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
         },
         handler: async (input) => {
-            await ensureInitialized();
+            const dbPath = resolveDbPathOption(input.dbPath);
+            if (!dbPath)
+                await ensureInitialized();
             const { listEntries } = await getMemoryFunctions();
             const namespace = input.namespace;
             const tags = Array.isArray(input.tags)
@@ -847,6 +876,7 @@ export const memoryTools = [
                     tags,
                     limit,
                     offset,
+                    dbPath,
                 });
                 const entries = result.entries.map(e => ({
                     key: e.key,
@@ -884,14 +914,14 @@ export const memoryTools = [
         inputSchema: {
             type: 'object',
             properties: {
-                dbPath: { type: 'string', description: 'Database file to inspect; omitted uses the MCP store default' },
+                dbPath: { type: 'string', description: 'Explicit SQLite store to read/write; omit to use the MCP default (the native/AgentDB sibling).' },
             },
         },
         handler: async (input) => {
             if (input.dbPath !== undefined && (typeof input.dbPath !== 'string' || !input.dbPath.trim())) {
                 return memoryStatsUnavailable('dbPath must be a non-empty string');
             }
-            const dbPath = typeof input.dbPath === 'string' ? resolve(input.dbPath) : undefined;
+            const dbPath = resolveDbPathOption(input.dbPath);
             // An explicit read must not initialize or migrate the unrelated default store.
             if (!dbPath)
                 await ensureInitialized();

package/v3/@claude-flow/cli/dist/src/mcp-tools/terminal-tools.js

@@ -304,10 +304,10 @@ export const terminalTools = [
             // Return combined history from all sessions
             const allHistory = Object.values(store.sessions)
                 .flatMap(s => s.history.map(h => ({ ...h, sessionId: s.id })))
-                .sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime())
-                .slice(offset, offset + limit);
+                .sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
             return {
-                history: allHistory,
+                history: allHistory.slice(offset, offset + limit),
+                // Every stored entry, like the single-session branch, not just this page.
                 total: allHistory.length,
             };
         },

package/v3/@claude-flow/cli/dist/src/mcp-tools/workflow-tools.js

@@ -583,7 +583,8 @@ export const workflowTools = [
             }
             // Sort by creation date (newest first)
             workflows.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
-            // Apply limit
+            // Count the matches before the limit cuts the page down
+            const total = workflows.length;
             const limit = input.limit || 20;
             workflows = workflows.slice(0, limit);
             return {
@@ -595,7 +596,7 @@ export const workflowTools = [
                     createdAt: w.createdAt,
                     completedAt: w.completedAt,
                 })),
-                total: workflows.length,
+                total,
                 filters: { status: input.status },
             };
         },

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js

@@ -404,14 +404,22 @@ export class WorkerDaemon extends EventEmitter {
             return {};
         }
         try {
-            // The CLI writes nested objects; legacy files use dotted keys. Scoped
+            // The CLI writes nested objects; legacy files use dotted keys. Each
+            // key resolves independently through scopes.project -> values -> root
+            // — `values` is the envelope config_set writes for its default scope
+            // (#3192 — without this, config_set daemon.idleSecs 0 has no effect
+            // on the running daemon even though it succeeds and updates
+            // config.json) — rather than picking one whole object as "cfg", since
+            // a config.json can legitimately have some keys written under
+            // scopes.project (project-scoped config_set calls) and others under
+            // values (default-scope config_set calls) at the same time. Scoped
             // values retain precedence, including explicit false and zero.
             const read = (obj, key) => {
                 if (!obj)
                     return undefined;
                 return obj[key] ?? key.split('.').reduce((value, part) => value && typeof value === 'object' && Object.hasOwn(value, part) ? value[part] : undefined, obj);
             };
-            const get = (key) => read(raw?.scopes?.project, key) ?? read(raw, key);
+            const get = (key) => read(raw?.scopes?.project, key) ?? read(raw?.values, key) ?? read(raw, key);
             const rawAutoStart = get('daemon.autoStart');
             const rawCpuLoad = get('daemon.resourceThresholds.maxCpuLoad');
             const rawMinMem = get('daemon.resourceThresholds.minFreeMemoryPercent');

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.59.13",
+  "version": "3.59.15",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -129,7 +129,7 @@
     "@claude-flow/memory": "3.0.8"
   },
   "optionalDependencies": {
-    "@agntcy/slim-bindings": "2.0.0-alpha.5",
+    "@agntcy/slim-bindings": "2.1.1",
     "@claude-flow/memory": "3.0.8",
     "@metaharness/darwin": "~0.12.0",
     "@metaharness/flywheel": "~0.1.10",