cleanup --force deletes entire .claude/ directory including user-owned Claude Code config (agents, skills, commands, settings.local.json, memory.db, worktrees)

[dr-snob]

Summary

npx ruflo@latest cleanup --force deletes the entire .claude/ directory wholesale, including files that were never created by ruflo. This destroys user-curated Claude Code config (settings.local.json allow rules, custom agents/, skills/, commands/) along with the legitimate ruflo artifacts.

The dry-run output is misleading: it shows .claude/ as a single line item (Claude settings, helpers, agents), implying the whole directory belongs to ruflo. In practice, .claude/ is shared territory between Claude Code's native subsystems (agents, skills, slash commands, settings, worktrees, memory.db) and ruflo's own helpers/hooks. The cleanup tool cannot tell them apart.

Reproduction

1. Project has been used for a while with both Claude Code and ruflo:

   .claude/
   ├── agents/              ← Claude Code native (custom user agents)
   ├── skills/              ← Claude Code native (custom user skills)
   ├── commands/            ← Claude Code native (slash commands)
   ├── settings.json        ← contains BOTH ruflo hooks AND user permissions
   ├── settings.local.json  ← user's Bash allowlist (Claude Code native)
   ├── helpers/             ← ruflo hook scripts
   ├── memory.db            ← Claude Code native
   ├── launch.json          ← Claude Code native
   └── worktrees/           ← git worktrees from `git worktree add`
   

2. Run npx ruflo@latest cleanup (dry-run):

   Artifacts found:
     [would remove] dir   .claude  (549.1 MB) - Claude settings, helpers, agents
     [would remove] dir   .claude-flow  (233.5 MB)
     [would remove] dir   .swarm  (193.0 KB)
   

3. Running --force deletes the entire .claude/ directory, taking everything with it.

Impact

A user who installed ruflo for evaluation and decides to uninstall loses:

• All custom Claude Code agents/skills/commands they created
• Their settings.local.json Bash allowlist (which can take hours to curate)
• Their memory.db (Claude Code's local SQLite memory)
• Active git worktrees/ (which on a multi-GB monorepo can contain in-progress work)
• Their settings.json permissions block (rebuilt from scratch)

This is referenced by user JustSuperHuman in #1159: "pretty lame the cleanup deletes the .claude folder alltogether...."

Suggested fix (pick one)

Option A — Surgical cleanup: Only delete the specific subpaths ruflo created:

.claude/helpers/        (always — ruflo creates this)
.claude/settings.json   ← edit to remove `hooks` field + `claudeFlow` block,
                          NEVER delete the file
.claude-flow/           (always — ruflo's runtime data dir)
.swarm/                 (always)
.hive-mind/             (always)
data/                   (always, but check it's the ruflo `data/` not user code)
coordination/           (always)

Leave all other paths under .claude/ alone.

Option B — Manifest-based cleanup: When ruflo init runs, write a manifest of every file/folder it creates to .claude-flow/manifest.json. The cleanup command reads the manifest and deletes only what's in it. Anything ruflo didn't create is preserved.

Option C — Interactive prompt: Before deleting .claude/, the cleanup tool should enumerate the actual contents and ask: "These items in .claude/ were not created by ruflo: agents/, skills/, commands/, settings.local.json. Keep them? [Y/n]". The current --force flag should still be allowed to bypass this, but the default should be to preserve user files.

Option D — Document the destruction loudly: At minimum, the README and CLI help text for cleanup --force should warn explicitly: "This deletes your ENTIRE .claude/ directory, including custom agents, skills, slash commands, and Claude Code's settings.local.json. If you have any files in .claude/ that you did not create via ruflo, back them up first."

My vote: Option B (manifest) is the only correct solution long-term. Option A is the minimum acceptable fix today.

Workaround (for users facing this now)

Don't use cleanup --force. Do it manually:

# Edit settings.json to remove the hooks field and claudeFlow block (preserve everything else)
python3 -c "
import json
with open('.claude/settings.json') as f: d = json.load(f)
d['hooks'] = {}
d.pop('claudeFlow', None)
with open('.claude/settings.json', 'w') as f: json.dump(d, f, indent=2)
"

# Then surgically remove only ruflo-owned paths
rm -rf .claude/helpers .claude-flow .swarm .hive-mind coordination

# npm side
npm uninstall @claude-flow/cli agentic-flow      # in projects
npm uninstall -g ruflo claude-flow @claude-flow/cli   # global
rm -rf ~/.npm/_npx

This preserves .claude/agents/, .claude/skills/, .claude/commands/, .claude/settings.local.json, .claude/memory.db, .claude/launch.json, .claude/worktrees/, and everything else under .claude/ that ruflo didn't put there.

Environment

• Tested with: ruflo@3.5.75
• npm: v11.12.1
• macOS Darwin 25.1.0 (Apple Silicon)
• Claude Code: v2.1.94

[mgatof91]

can confirm issue

[ruvnet]

Valid report. cleanup --force should not delete the entire .claude/ directory — it's shared with Claude Code's native config.

Agreed fix (Option A, immediate): Only delete ruflo-owned paths:

• .claude/helpers/ (ruflo hook scripts)
• .claude-flow/ (ruflo runtime data)
• .swarm/, .hive-mind/, coordination/ (ruflo state dirs)
• Edit .claude/settings.json to remove hooks and claudeFlow blocks only

Everything else in .claude/ (agents, skills, commands, settings.local.json, memory.db, worktrees) must be preserved.

Option B (manifest) is the correct long-term fix but Option A unblocks users immediately.

Marking as critical — data loss on cleanup.

[mgatof91]

cleanup is rarely used, I suggest taking the time for the longterm correct fix - option b

[ruvnet]

Fixed in v3.5.77 (PR #1564).

What changed:

• Removed .claude from the artifact directory list — cleanup --force no longer touches the .claude/ directory
• Only claude-flow-owned subdirs (.claude/helpers/) are cleaned
• Settings.json is surgically cleaned: only hooks and claudeFlow keys are removed, all user-owned config preserved
• --keep-config still works for additional protection

Update:

npx @claude-flow/cli@3.5.77