Bug fixes
- #3045 statusline.cjs: getGitInfo() runs the 5-command git chain per render;
on large repos with concurrent Claude Code sessions this queued subprocesses
faster than they finished (reporter observed hundreds of orphan children +
load-avg in the hundreds). Added a per-cwd tmp file cache with 5s TTL —
dirty status still feels live, pileup is bounded.
- #3064 hooks post-task: the narrow ad-hoc regex /^[a-zA-Z0-9_-]+$/ silently
dropped every colon-namespaced plugin agent (ruflo-core:reviewer,
feature-dev:code-explorer, ...) — i.e. every Claude Code plugin agent. The
canonical validateIdentifier() upstream already allows ':' and '.', so the
redundant regex is removed. Regression test locks in 4 agent-shape cases,
proven to catch the bug: 2 pass / 2 fail on revert, 4 pass with fix.
- #3065 harness-gepa SKILL.md: unquoted colon in `description` broke YAML
parsing in `npx skills add`. Quoted the description; rephrased the bare
"(default:" to avoid the leading colon.
New plugin: ruflo-deepseek-harness
- plugins/ruflo-deepseek-harness/: sibling to ruflo-metaharness (ADR-150
shape). Two skills: `deepseek-chat` (non-reasoning) and `deepseek-reason`
(surfaces reasoning_content separately). Reads DEEPSEEK_API_KEY from env;
degrades gracefully (exit 0 with `{status: 'degraded', reason, hint}`)
when the key is missing or the API is unreachable. `--alert-on-error`
flag opts into hard exit 1 for CI gates. Smoke-tested locally.
Release
- Bump @claude-flow/cli, claude-flow, ruflo: 3.38.12 → 3.38.13 (PATCH:
bug fixes; the new plugin is scaffolding under plugins/ and not part of
the npm-published CLI packages).
Not fixed
- #3051 memory_store tags: current source's memory_store handler passes
tags straight through to storeEntry; a maintainer already verified live
round-trip works on fa13ee4ad. Reporter has not yet supplied the
ruflo/@claude-flow/cli version that hosted the affected MCP server,
so the affected release path is unknown. Left as-is pending that reply.
Claude-Session: https://claude.ai/code/session_0118jMsYhwHD5dx2vStENsEB
Ships #2989 (init --all-agents/--skip-claude/--only-claude/--cloud-mcp
were dead kebab-case flag reads) and #2991 (CLI hooks post-task
dropped the ADR-130 reinforced-by graph edge due to an unawaited
fire-and-forget write racing process.exit(0)).
Co-Authored-By: RuFlo <ruv@ruv.net>
Ships #2988: `hooks intelligence --train` now actually distills
(#2940) instead of printing a canned success message with no state
change behind it.
Co-Authored-By: RuFlo <ruv@ruv.net>
Publishes #2986 (fix(migrate): correct removed-agent install suggestion
and add `migrate fix --agents` restore, #2985) and #2987 (fix(mcp): mcp
start -t http exits after false-success table + doc drift, #2984). Pure
bug fixes, no breaking changes -> PATCH per repo semver policy.
@claude-flow/cli, claude-flow, ruflo published in lockstep at 3.38.2,
all three dist-tags (latest/alpha/v3alpha) verified against the live
registry, published tarball pulled and confirmed to contain both fixes.
Co-Authored-By: RuFlo <ruv@ruv.net>
Publishes the #2983 fixes (#2982/#2976 unordered LIMIT truncation in
memory search, #2968 sql.js persistence honesty). Pure bug fixes, no
API/behavior additions -> PATCH per repo semver policy.
Also corrects package-lock.json's top-level version field, which had
drifted to a stale 3.35.0 independent of this bump.
@claude-flow/cli, claude-flow, ruflo published in lockstep at 3.38.1,
all three dist-tags (latest/alpha/v3alpha) verified against the live
registry.
Co-Authored-By: RuFlo <ruv@ruv.net>
Parts A/B/C: pinned ruflo-core's marketplace-plugin MCP launch path
(local-bin-first resolver, mirroring hook-handler.cjs), registered 3
plugins missing from marketplace.json, implemented ADR-128's promised
`ruflo migrate` removed-agent detection, and shipped a warn-only CI
guard (scripts/smoke-init-scaffold-references.mjs) plus a deterministic
remap of 701 dead `npx claude-flow` references across 142 scaffold files.
Ref: #2971, ADR-382
Minor bump (not patch) because #2927/#2928 add backward-compatible CLI
flags (--routing-mode, --passthrough), not just bug fixes:
- fix(proxy): bump pinned meta-proxy release 0.4.0 -> 0.7.3 (#2925)
- fix(proxy): fall back to tar when Expand-Archive fails on Windows (#2926)
- fix(proxy): disclose what enabling cloud routing decides, --routing-mode (#2927)
- fix(proxy): make the passthrough plane reachable again after cloud routing (#2928)
Co-Authored-By: RuFlo <ruv@ruv.net>
@claude-flow/cli, claude-flow, and ruflo were published at 3.36.0 (and
@claude-flow/memory at 3.0.0-alpha.22, carrying the #2887 durability fix)
without the version bump landing back in git — this just reconciles the
committed package.json versions with what's actually live on npm, and bumps
the cli's @claude-flow/memory floor to the version that has the fix.
No code changes.
Co-Authored-By: RuFlo <ruv@ruv.net>
Minor bump: this release folds in PR #2956 (MetaHarness hardening — repair
the dependency contract, strict sequential promotion evidence, ADR-381) plus
a follow-up commit on that PR fixing 3 concurrency/epoch-boundary bugs found
during review that could silently violate the <=5% family-wise
false-promotion guarantee. All backward-compatible additions (new
optionalDependencies, new doctor checks, new CLI/MCP surface) — no breaking
changes, hence minor not major.
Also fixes a stale test assertion in distill-oracle.test.ts: the darwin
bench-run command now embeds the pinned @metaharness/darwin version
(MH_DARWIN_PIN) per the #2561 cold-npx regression guard, so the test's bare
'darwin bench run' substring check no longer matched the intentional pinned
output ('darwin@0.8.3 bench run').
Three-package lockstep bump (@claude-flow/cli, claude-flow, ruflo) per
CLAUDE.md's Publishing Rules, backed by scripts/audit-umbrella-version-lockstep.mjs.
CHANGELOG.md documents ADR-378/379/380 (AGNTCY runtime, npm Trusted
Publishing workflow, statusline segments) and the SLIM alpha-pin fix,
carried in main since the 3.33.0 release.
Co-Authored-By: RuFlo <ruv@ruv.net>
Adds the live Ruflo capability brain, governed federation and Cognitum product planes, source-bound concurrent harness contracts, ADRs 325-329, and the v3.32.28 guarded release train.
* fix(metaharness): pin @metaharness/darwin + add pin-drift guard (ruflo analog of #142/#149)
Upstream agent-harness-generator #142 (darwin caret-locked to 0.2.x, 3 majors
behind) and #149 (META_PROXY_VERSION pinned with no watcher) are both silent
pin-drift failures. Ruflo had the same latent gap on its own metaharness deps:
- distill-oracle.ts invoked `npx --yes @metaharness/darwin` with NO version pin,
so the Tier-1 mechanical oracle floated to whatever npm `latest` was — a
breaking darwin release could change eval behavior mid-run. Pinned via a new
`MH_DARWIN_PIN = '0.8.0'` constant used by all three npx call sites.
- Declared `@metaharness/darwin: ^0.8.0` in optionalDependencies (subprocess-
invoked, kept optional per ADR-150/321) so the pin has a single source of truth
and installs cache-warm.
- Fixed a stale `@metaharness/darwin@~0.3.1` doc comment (darwin is 0.8.0).
New guard (the #149 analog ruflo lacked):
- scripts/check-metaharness-pins.mjs — diffs each declared range (metaharness,
@metaharness/router, @metaharness/darwin) against npm `latest`, plus a
lock-step check that MH_DARWIN_PIN satisfies the declared darwin range. Exit 1
on drift; network flakes surface as a warning, never a false positive.
- .github/workflows/metaharness-pin-drift.yml — runs the guard weekly + on PRs
touching the pins; opens/updates a tracking issue when a pin falls behind,
and hard-fails PRs that introduce drift.
All pins are current (guard exits 0); router API-surface compat 9/9; CLI builds
clean. Lockfile reconciled for the new optionalDep (frozen-lockfile verified).
Refs: ruvnet/agent-harness-generator#142, #149; ADR-150, ADR-321.
Co-Authored-By: RuFlo <ruv@ruv.net>
* chore(release): bump to 3.32.25 (metaharness pin-drift guard)
Co-Authored-By: RuFlo <ruv@ruv.net>
Patch release covering the statusline/memory-integrity fix batch
merged in #2746, #2747, #2748, #2749 (issues #2733, #2735, #2736,
#2737, #2742).
Also fixes an npm EOVERRIDE conflict this batch introduced:
v3/@claude-flow/cli/package.json had gained both a direct
optionalDependency on better-sqlite3 (^12.9.0, from #2748) and a
self-referential override pinned to an exact "12.9.0" (from #2736)
for the same package — npm publish rejects an override that doesn't
match its own direct dependency's spec string. Aligned the override
to the same "^12.9.0" range so the dedup guarantee holds without the
conflict.
Co-Authored-By: RuFlo <ruv@ruv.net>
rUv