claude-flow 3.59.7 → 3.59.9

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1792565467884,
+  "adoptedAt": 1792600179143,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",

package/node_modules/@claude-flow/codex/package.json

@@ -106,7 +106,6 @@
         "chalk": "^5.3.0",
         "inquirer": "^9.2.0",
         "yaml": "^2.4.0",
-        "toml": "^3.0.0",
         "@iarna/toml": "^2.2.5",
         "@claude-flow/security": "^3.0.0"
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.59.7",
+  "version": "3.59.9",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/mcp",
@@ -91,7 +91,6 @@
     "helmet": "^7.2.0",
     "inquirer": "^9.2.0",
     "semver": "7.7.3",
-    "toml": "^3.0.0",
     "ws": ">=8.21.0",
     "yaml": "^2.8.0",
     "zod": "3.25.76"

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 7,
-  "generatedAt": "2026-10-21T06:52:34.888Z",
-  "gitSha": "51d42418",
+  "generatedAt": "2026-10-21T16:30:19.068Z",
+  "gitSha": "588ef6b3",
   "catalog": {
     "agents": 176,
     "tools": 432,

package/v3/@claude-flow/cli/dist/src/mcp-tools/config-tools.js

@@ -339,10 +339,12 @@ export const configTools = [
                 merged.set(key, { value, source: 'stored' });
             }
             // Always include keys from every scope so they're discoverable; the
-            // scope filter only narrows which set is used as the *winner*.
+            // scope filter only narrows which set is used as the *winner*. The
+            // default scope has no scope of its own, so stored values win there,
+            // as in config_get and config_export.
             for (const [scopeName, scopeValues] of Object.entries(store.scopes)) {
                 for (const [key, value] of Object.entries(scopeValues)) {
-                    if (scope === scopeName || scope === 'default') {
+                    if (scope === scopeName) {
                         merged.set(key, { value, source: `scope:${scopeName}` });
                     }
                     else if (!merged.has(key)) {

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.js

@@ -1659,12 +1659,29 @@ export async function bridgeDeleteEntry(options) {
         if (!guardResult.allowed) {
             return { success: false, deleted: false, key, namespace, remainingEntries: 0, error: `MutationGuard rejected: ${guardResult.reason}` };
         }
-        // Soft delete using parameterized query
+        // #3785: secure_delete zeroes the old cells while the payload columns are
+        // scrubbed; otherwise SQLite can leave the deleted text in free pages.
+        try {
+            ctx.db.pragma('secure_delete = ON');
+        }
+        catch { /* non-fatal: the logical scrub below still hides the row */ }
+        // Soft delete using parameterized query. The tombstone must keep only
+        // what later upserts/audits need: the payload columns are scrubbed here,
+        // not merely hidden by the status filter. `content` is NOT NULL in the
+        // schema, so "scrubbed" is the empty string rather than SQL NULL; that
+        // still removes the deleted value from disk and from any raw SQLite read.
         let changes = 0;
         try {
             const result = ctx.db.prepare(`
         UPDATE memory_entries
-        SET status = 'deleted', updated_at = ?
+        SET status = 'deleted',
+            content = '',
+            embedding = NULL,
+            embedding_model = NULL,
+            embedding_dimensions = NULL,
+            tags = NULL,
+            metadata = NULL,
+            updated_at = ?
         WHERE key = ? AND namespace = ? AND ${ACTIVE_MEMORY_ROW_SQL}
       `).run(Date.now(), key, namespace);
             changes = result?.changes ?? 0;
@@ -1737,6 +1754,12 @@ export async function bridgePurgeNamespace(options) {
         }
         let deletedCount = 0;
         try {
+            // #3785: a hard DELETE without secure_delete leaves the purged payload
+            // in free pages; purge claims to be irreversible.
+            try {
+                ctx.db.pragma('secure_delete = ON');
+            }
+            catch { /* non-fatal: the rows are still removed below */ }
             const result = ctx.db.prepare(`DELETE FROM memory_entries WHERE namespace = ?`).run(namespace);
             deletedCount = result?.changes ?? 0;
         }

package/v3/@claude-flow/cli/dist/src/memory/memory-initializer.js

@@ -3338,6 +3338,10 @@ export async function deleteEntry(options) {
             const SQL = await initSqlJs();
             const fileBuffer = readFileMaybeEncrypted(dbPath, null);
             const db = new SQL.Database(fileBuffer);
+            // #3785: zero the old cells as well as the live row. Without
+            // secure_delete, UPDATE leaves the previous text in SQLite free pages,
+            // so the "deleted" value is still recoverable from the file image.
+            db.run('PRAGMA secure_delete = ON');
             // Check if entry exists first
             const checkStmt = db.prepare(`
         SELECT id FROM memory_entries
@@ -3367,12 +3371,19 @@ export async function deleteEntry(options) {
                     error: `Key '${key}' not found in namespace '${namespace}'`
                 };
             }
-            // Delete the entry (soft delete by setting status to 'deleted')
-            // Also null out the embedding to clean up vector data from SQLite
+            // Soft delete by setting status to 'deleted'. Scrub the payload, not
+            // only the vector: a tombstone that keeps `content` on disk still
+            // exposes deleted data to anyone who opens the SQLite file. `content`
+            // is NOT NULL, so use the empty string rather than SQL NULL.
             db.run(`
         UPDATE memory_entries
         SET status = 'deleted',
+            content = '',
             embedding = NULL,
+            embedding_model = NULL,
+            embedding_dimensions = NULL,
+            tags = NULL,
+            metadata = NULL,
             updated_at = strftime('%s', 'now') * 1000
         WHERE key = ?
           AND namespace = ?
@@ -3547,6 +3558,8 @@ export async function purgeNamespace(options) {
             const SQL = await initSqlJs();
             const fileBuffer = readFileMaybeEncrypted(dbPath, null);
             const db = new SQL.Database(fileBuffer);
+            // #3785: purge is advertised as irreversible; zero free pages too.
+            db.run('PRAGMA secure_delete = ON');
             const beforeResult = db.exec(`SELECT COUNT(*) FROM memory_entries WHERE namespace = ?`, [namespace]);
             const deletedCount = beforeResult[0]?.values?.[0]?.[0] || 0;
             db.run(`DELETE FROM memory_entries WHERE namespace = ?`, [namespace]);

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.59.7",
+  "version": "3.59.9",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -123,7 +123,6 @@
     "inquirer": "^9.2.0",
     "semver": "7.7.3",
     "sql.js": "^1.13.0",
-    "toml": "^3.0.0",
     "ws": "^8.21.0",
     "yaml": "^2.8.0",
     "zod": "^3.22.0",