claude-flow 3.59.14 → 3.59.15

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1792643533692,
+  "adoptedAt": 1792652697736,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.59.14",
+  "version": "3.59.15",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/mcp",

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-22T04:32:33.371Z",
-  "gitSha": "88bdc9a6",
+  "generatedAt": "2026-10-22T07:59:21.864Z",
+  "gitSha": "b2c74c22",
   "catalog": {
     "agents": 176,
     "tools": 432,

package/v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.d.ts

@@ -27,6 +27,28 @@
  * pre-release channel, pin deliberately rather than floating) until the fix
  * is promoted to `latest`, tracked by the same issue.
  *
+ * UPDATE (2026-10-22, #4371): `2.0.0-alpha.5`'s own `optionalDependencies`
+ * claimed `@agntcy/slim-bindings-linux-arm64-musl@2.0.0-alpha.5`, but that
+ * platform package was never published upstream (its own first version is
+ * `2.1.1-rc.2` — confirmed via `npm view @agntcy/slim-bindings-linux-arm64-musl
+ * versions`, which is also true of every other `2.0.0-alpha.*`/`2.0.0`/`2.1.0`
+ * release). npm tolerates an unresolvable optional dependency and silently
+ * skips it, so this never surfaced in this repo's own npm-based CI, but
+ * strict resolvers (`mise`'s `aube` backend, pnpm in some modes) fail the
+ * whole install. `package.json` now pins `2.1.1` — the earliest release where
+ * every platform's optional package actually exists at that exact version
+ * (verified against the live registry for all 8 platforms). Re-verified live
+ * under plain Node against the real installed `2.1.1` package: the dynamic
+ * `import()` resolves with zero errors (same module shape — a `Session`/
+ * `Channel`/`App`-class-based SDK, not the `joinGroup`/`createSlimTransport`/
+ * `publishAgentRecord` flat functions `transport.ts`/`swarm-join.ts`/
+ * `publish.ts` call. Confirmed this mismatch predates this pin change — it
+ * was equally absent from `2.0.0-alpha.5` — so it's a pre-existing gap this
+ * version bump does not introduce or worsen; tracked separately in #4376),
+ * and the full
+ * `__tests__/agntcy/agntcy-commands.test.ts` suite (19 tests, including the
+ * real-resolution "configured: true" case) passes against this version.
+ *
  * This module's existing graceful-degradation design already handled this
  * correctly without any change to its logic: `detectAgntcyRuntime()`'s
  * catch-all branch (anything other than MODULE_NOT_FOUND) reports the real

package/v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.js

@@ -27,6 +27,28 @@
  * pre-release channel, pin deliberately rather than floating) until the fix
  * is promoted to `latest`, tracked by the same issue.
  *
+ * UPDATE (2026-10-22, #4371): `2.0.0-alpha.5`'s own `optionalDependencies`
+ * claimed `@agntcy/slim-bindings-linux-arm64-musl@2.0.0-alpha.5`, but that
+ * platform package was never published upstream (its own first version is
+ * `2.1.1-rc.2` — confirmed via `npm view @agntcy/slim-bindings-linux-arm64-musl
+ * versions`, which is also true of every other `2.0.0-alpha.*`/`2.0.0`/`2.1.0`
+ * release). npm tolerates an unresolvable optional dependency and silently
+ * skips it, so this never surfaced in this repo's own npm-based CI, but
+ * strict resolvers (`mise`'s `aube` backend, pnpm in some modes) fail the
+ * whole install. `package.json` now pins `2.1.1` — the earliest release where
+ * every platform's optional package actually exists at that exact version
+ * (verified against the live registry for all 8 platforms). Re-verified live
+ * under plain Node against the real installed `2.1.1` package: the dynamic
+ * `import()` resolves with zero errors (same module shape — a `Session`/
+ * `Channel`/`App`-class-based SDK, not the `joinGroup`/`createSlimTransport`/
+ * `publishAgentRecord` flat functions `transport.ts`/`swarm-join.ts`/
+ * `publish.ts` call. Confirmed this mismatch predates this pin change — it
+ * was equally absent from `2.0.0-alpha.5` — so it's a pre-existing gap this
+ * version bump does not introduce or worsen; tracked separately in #4376),
+ * and the full
+ * `__tests__/agntcy/agntcy-commands.test.ts` suite (19 tests, including the
+ * real-resolution "configured: true" case) passes against this version.
+ *
  * This module's existing graceful-degradation design already handled this
  * correctly without any change to its logic: `detectAgntcyRuntime()`'s
  * catch-all branch (anything other than MODULE_NOT_FOUND) reports the real

package/v3/@claude-flow/cli/dist/src/encryption/vault.d.ts

@@ -41,6 +41,15 @@ export declare function isEncryptionEnabled(): boolean;
  * encryption is enabled but no key resolves, this throws with a clear
  * message rather than silently falling back to plaintext (fail-closed).
  *
+ * The optional `context` selects which missing-key message to throw:
+ *   - `'encrypt'` (default): the caller is about to encrypt because
+ *     `CLAUDE_FLOW_ENCRYPT_AT_REST` is set, so the original message is
+ *     accurate.
+ *   - `'decrypt'`: the caller hit an RFE1-encrypted blob on read (e.g. a
+ *     store restored from another machine) while the enable flag may be
+ *     unset (issue #3212). The message echoes the flag's actual value and
+ *     the on-disk state instead of asserting the flag is set.
+ *
  * Accepted encodings (auto-detected by length):
  *   - 64-char hex (32 bytes)
  *   - 44-char base64 (32 bytes + padding)
@@ -49,7 +58,7 @@ export declare function isEncryptionEnabled(): boolean;
  * Anything else is rejected — we'd rather fail loudly than encrypt with a
  * truncated key.
  */
-export declare function getKey(): Buffer;
+export declare function getKey(context?: 'encrypt' | 'decrypt'): Buffer;
 /**
  * Decode a key string. Exposed for testing and for the future passphrase
  * resolver, which will scrypt-derive a Buffer and hand it back through here

package/v3/@claude-flow/cli/dist/src/encryption/vault.js

@@ -58,6 +58,15 @@ export function isEncryptionEnabled() {
  * encryption is enabled but no key resolves, this throws with a clear
  * message rather than silently falling back to plaintext (fail-closed).
  *
+ * The optional `context` selects which missing-key message to throw:
+ *   - `'encrypt'` (default): the caller is about to encrypt because
+ *     `CLAUDE_FLOW_ENCRYPT_AT_REST` is set, so the original message is
+ *     accurate.
+ *   - `'decrypt'`: the caller hit an RFE1-encrypted blob on read (e.g. a
+ *     store restored from another machine) while the enable flag may be
+ *     unset (issue #3212). The message echoes the flag's actual value and
+ *     the on-disk state instead of asserting the flag is set.
+ *
  * Accepted encodings (auto-detected by length):
  *   - 64-char hex (32 bytes)
  *   - 44-char base64 (32 bytes + padding)
@@ -66,9 +75,16 @@ export function isEncryptionEnabled() {
  * Anything else is rejected — we'd rather fail loudly than encrypt with a
  * truncated key.
  */
-export function getKey() {
+export function getKey(context = 'encrypt') {
     const raw = process.env[ENV_KEY_VAR];
     if (!raw) {
+        if (context === 'decrypt') {
+            const flag = process.env[ENV_ENABLE_FLAG] ?? 'unset';
+            throw new Error(`${ENV_KEY_VAR} is required but not set ` +
+                `(${ENV_ENABLE_FLAG}=${flag}; the store on disk is RFE1-encrypted). ` +
+                `Supply the key this store was encrypted with — a newly generated key will not decrypt it. ` +
+                `Provide a 32-byte key as 64-char hex or 44-char base64.`);
+        }
         throw new Error(`${ENV_ENABLE_FLAG} is set but ${ENV_KEY_VAR} is not. ` +
             `Provide a 32-byte key as 64-char hex or 44-char base64. ` +
             `See ADR-096 for keychain/passphrase support (coming in a follow-up).`);

package/v3/@claude-flow/cli/dist/src/fs-secure.js

@@ -172,7 +172,9 @@ export function readFileMaybeEncrypted(path, encoding = 'utf-8') {
     const raw = readFileSync(path);
     let plain;
     if (isEncryptedBlob(raw)) {
-        plain = decryptBuffer(raw, getKey());
+        // 'decrypt': the blob on disk is RFE1-encrypted but the enable flag may
+        // be unset (e.g. store restored from another machine) — see #3212.
+        plain = decryptBuffer(raw, getKey('decrypt'));
     }
     else {
         plain = raw;

package/v3/@claude-flow/cli/dist/src/mcp-tools/terminal-tools.js

@@ -304,10 +304,10 @@ export const terminalTools = [
             // Return combined history from all sessions
             const allHistory = Object.values(store.sessions)
                 .flatMap(s => s.history.map(h => ({ ...h, sessionId: s.id })))
-                .sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime())
-                .slice(offset, offset + limit);
+                .sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
             return {
-                history: allHistory,
+                history: allHistory.slice(offset, offset + limit),
+                // Every stored entry, like the single-session branch, not just this page.
                 total: allHistory.length,
             };
         },

package/v3/@claude-flow/cli/dist/src/services/worker-daemon.js

@@ -404,14 +404,22 @@ export class WorkerDaemon extends EventEmitter {
             return {};
         }
         try {
-            // The CLI writes nested objects; legacy files use dotted keys. Scoped
+            // The CLI writes nested objects; legacy files use dotted keys. Each
+            // key resolves independently through scopes.project -> values -> root
+            // — `values` is the envelope config_set writes for its default scope
+            // (#3192 — without this, config_set daemon.idleSecs 0 has no effect
+            // on the running daemon even though it succeeds and updates
+            // config.json) — rather than picking one whole object as "cfg", since
+            // a config.json can legitimately have some keys written under
+            // scopes.project (project-scoped config_set calls) and others under
+            // values (default-scope config_set calls) at the same time. Scoped
             // values retain precedence, including explicit false and zero.
             const read = (obj, key) => {
                 if (!obj)
                     return undefined;
                 return obj[key] ?? key.split('.').reduce((value, part) => value && typeof value === 'object' && Object.hasOwn(value, part) ? value[part] : undefined, obj);
             };
-            const get = (key) => read(raw?.scopes?.project, key) ?? read(raw, key);
+            const get = (key) => read(raw?.scopes?.project, key) ?? read(raw?.values, key) ?? read(raw, key);
             const rawAutoStart = get('daemon.autoStart');
             const rawCpuLoad = get('daemon.resourceThresholds.maxCpuLoad');
             const rawMinMem = get('daemon.resourceThresholds.minFreeMemoryPercent');

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.59.14",
+  "version": "3.59.15",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -129,7 +129,7 @@
     "@claude-flow/memory": "3.0.8"
   },
   "optionalDependencies": {
-    "@agntcy/slim-bindings": "2.0.0-alpha.5",
+    "@agntcy/slim-bindings": "2.1.1",
     "@claude-flow/memory": "3.0.8",
     "@metaharness/darwin": "~0.12.0",
     "@metaharness/flywheel": "~0.1.10",