Same defect as v3/@claude-flow/cli's package.json, already fixed in
68a9c9f6a: pinned to an unpublished 3.0.0-alpha.10 instead of the real
published ^3.0.0-alpha.9. Harmless in practice (bundled via
bundleDependencies + workspace link, verified npm install works either
way) but wrong to leave uncorrected. No republish needed for this alone.
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_018ZkgSrVRWNMcXmaFiMZ7Z8
A subagent I spawned earlier (intended only to relay a status message)
went out of scope and independently ran its own full fix/verify/publish
cycle in parallel with mine on this same checkout, racing my edits. Between
its publish and a set of stale-cached `claude-flow daemon` background
processes self-healing package.json mid-write (#3005), @claude-flow/cli
was published twice in a row (3.38.17, 3.38.18) with a broken
`@claude-flow/mcp` dependency pin, and 3.38.18 additionally shipped
entirely missing the `@claude-flow/memory` dependency. claude-flow and
ruflo were published at 3.38.18 too, inheriting the same defect.
3.38.19 is the verified-correct cut: @claude-flow/mcp repinned to
^3.0.0-alpha.9 (published, has the #2990 fixes), @claude-flow/memory
present at ^3.0.0-alpha.23 (has the #2977 fix). Deprecating 3.38.17/3.38.18
on npm as a follow-up; this commit does not touch the doc/metadata files
that raced independently of the version bump.
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_018ZkgSrVRWNMcXmaFiMZ7Z8
3.38.17 was published by a concurrent session mid-race with a stale
package.json (the @claude-flow/mcp pin had been reverted to the broken
3.0.0-alpha.10 by a background helper-refresh process just before publish;
see #3005). npm forbids republishing over an existing version, so cutting
3.38.18 with the verified-correct pin instead of trying to fix 3.38.17.
Also discovered @claude-flow/memory is NOT in @claude-flow/cli's
bundleDependencies (unlike @claude-flow/mcp/codex/security/plugin-agent-federation)
-- it's resolved from the registry via a normal ^3.0.0-alpha.22 semver range,
and that exact version is what's currently published, without the #2977 fix
from 8a8500194. Bumping @claude-flow/memory to 3.0.0-alpha.23 and re-pinning
@claude-flow/cli to ^3.0.0-alpha.23 so the fix actually reaches users --
otherwise 3.38.18 would ship pointing at an unfixed memory dependency.
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_018ZkgSrVRWNMcXmaFiMZ7Z8
Fixes#2990's root cause at the publish layer: v3/@claude-flow/cli and the
claude-flow umbrella both pinned @claude-flow/mcp to 3.0.0-alpha.10, a
version that was never published (npm registry tops out at alpha.9). Since
@claude-flow/mcp is bundled (bundleDependencies) via a pnpm workspace link,
this didn't affect the monorepo build, but it broke plain `npm install`
against the published packages and left package.json/pnpm-lock.yaml
out of sync with what's actually resolvable. Repinned to ^3.0.0-alpha.9
(the real latest, which already carries the protocolVersion-string fix)
and regenerated v3/pnpm-lock.yaml accordingly.
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_018ZkgSrVRWNMcXmaFiMZ7Z8
Cuts a release train off main after the 3 dream cycles landed unversioned:
- #3062 dream(swarm): bound MessageBus retry attempts, fix unreachable
message.failed (closes#3061)
- #3057 dream(memory): hybridSearch controller reachable via explicit
opt-in — was silently null-returning despite config flag
(closes#3056)
- #3049 dream(intelligence): discounted Thompson sampling for
model-router bandit — opt-in prior decay recovers faster after
workload shift (closes#3048)
No code changes in this commit — just the version bump across all three
publishable package.jsons.
Claude-Session: https://claude.ai/code/session_0118jMsYhwHD5dx2vStENsEB
Cuts a release train off main after the following PRs landed unversioned:
- #3060 fix(cli): honor MCP tool selection when listing (closes#3055)
- #3076 fix: resolve Claude Code launches on Windows (closes#3071)
- #3077 fix(hooks): persist real session-end state (closes#3063)
- #3044 dream(security): #3043 advisory scanner for untrusted settings.json
hooks/allow-rules — CVE-2025-59536-class defense-in-depth,
advisory-only (non-blocking), hardened against 6 concrete critic
bypasses.
No code changes in this commit — just the version bump across all three
publishable package.jsons.
Claude-Session: https://claude.ai/code/session_0118jMsYhwHD5dx2vStENsEB
Root cause: bridgeStoreEntry's post-write cache set stored only a partial
entry shape — { id, key, namespace, content, embedding } — with no `tags`,
no timestamps, no metadata, no access_count. The DB row itself had the
tags JSON-serialized correctly. But any subsequent bridgeGetEntry hit the
cache first and returned `tags: cached.tags || []` = `[]`, so
`memory_store({ tags })` → `memory_retrieve()` looked like it silently
dropped tags.
Fix: replace the partial write-through with cache invalidation. The next
read then re-fetches the row via the DB reader (which correctly parses
the tags JSON column) and repopulates the cache from the full shape.
Cleaner than expanding the write-through payload — future entry-shape
fields don't need to remember to update the cache-write signature.
Regression test verifies: store {tags:[a,b,c]} → get returns {tags:[a,b,c]}.
Proven to catch the bug: pre-fix the test fails (tags: [] returned);
post-fix it passes.
The same defect would have caused reads to see access_count stuck at 0
and drifted createdAt/updatedAt timestamps from the moment the cache
was first populated until eviction; cache invalidation fixes those too.
Release
- Bumps @claude-flow/cli, claude-flow, ruflo: 3.38.13 → 3.38.14 (PATCH).
Claude-Session: https://claude.ai/code/session_0118jMsYhwHD5dx2vStENsEB
Bug fixes
- #3045 statusline.cjs: getGitInfo() runs the 5-command git chain per render;
on large repos with concurrent Claude Code sessions this queued subprocesses
faster than they finished (reporter observed hundreds of orphan children +
load-avg in the hundreds). Added a per-cwd tmp file cache with 5s TTL —
dirty status still feels live, pileup is bounded.
- #3064 hooks post-task: the narrow ad-hoc regex /^[a-zA-Z0-9_-]+$/ silently
dropped every colon-namespaced plugin agent (ruflo-core:reviewer,
feature-dev:code-explorer, ...) — i.e. every Claude Code plugin agent. The
canonical validateIdentifier() upstream already allows ':' and '.', so the
redundant regex is removed. Regression test locks in 4 agent-shape cases,
proven to catch the bug: 2 pass / 2 fail on revert, 4 pass with fix.
- #3065 harness-gepa SKILL.md: unquoted colon in `description` broke YAML
parsing in `npx skills add`. Quoted the description; rephrased the bare
"(default:" to avoid the leading colon.
New plugin: ruflo-deepseek-harness
- plugins/ruflo-deepseek-harness/: sibling to ruflo-metaharness (ADR-150
shape). Two skills: `deepseek-chat` (non-reasoning) and `deepseek-reason`
(surfaces reasoning_content separately). Reads DEEPSEEK_API_KEY from env;
degrades gracefully (exit 0 with `{status: 'degraded', reason, hint}`)
when the key is missing or the API is unreachable. `--alert-on-error`
flag opts into hard exit 1 for CI gates. Smoke-tested locally.
Release
- Bump @claude-flow/cli, claude-flow, ruflo: 3.38.12 → 3.38.13 (PATCH:
bug fixes; the new plugin is scaffolding under plugins/ and not part of
the npm-published CLI packages).
Not fixed
- #3051 memory_store tags: current source's memory_store handler passes
tags straight through to storeEntry; a maintainer already verified live
round-trip works on fa13ee4ad. Reporter has not yet supplied the
ruflo/@claude-flow/cli version that hosted the affected MCP server,
so the affected release path is unknown. Left as-is pending that reply.
Claude-Session: https://claude.ai/code/session_0118jMsYhwHD5dx2vStENsEB
Ships #2989 (init --all-agents/--skip-claude/--only-claude/--cloud-mcp
were dead kebab-case flag reads) and #2991 (CLI hooks post-task
dropped the ADR-130 reinforced-by graph edge due to an unawaited
fire-and-forget write racing process.exit(0)).
Co-Authored-By: RuFlo <ruv@ruv.net>
Ships #2988: `hooks intelligence --train` now actually distills
(#2940) instead of printing a canned success message with no state
change behind it.
Co-Authored-By: RuFlo <ruv@ruv.net>
Publishes #2986 (fix(migrate): correct removed-agent install suggestion
and add `migrate fix --agents` restore, #2985) and #2987 (fix(mcp): mcp
start -t http exits after false-success table + doc drift, #2984). Pure
bug fixes, no breaking changes -> PATCH per repo semver policy.
@claude-flow/cli, claude-flow, ruflo published in lockstep at 3.38.2,
all three dist-tags (latest/alpha/v3alpha) verified against the live
registry, published tarball pulled and confirmed to contain both fixes.
Co-Authored-By: RuFlo <ruv@ruv.net>
Publishes the #2983 fixes (#2982/#2976 unordered LIMIT truncation in
memory search, #2968 sql.js persistence honesty). Pure bug fixes, no
API/behavior additions -> PATCH per repo semver policy.
Also corrects package-lock.json's top-level version field, which had
drifted to a stale 3.35.0 independent of this bump.
@claude-flow/cli, claude-flow, ruflo published in lockstep at 3.38.1,
all three dist-tags (latest/alpha/v3alpha) verified against the live
registry.
Co-Authored-By: RuFlo <ruv@ruv.net>
Parts A/B/C: pinned ruflo-core's marketplace-plugin MCP launch path
(local-bin-first resolver, mirroring hook-handler.cjs), registered 3
plugins missing from marketplace.json, implemented ADR-128's promised
`ruflo migrate` removed-agent detection, and shipped a warn-only CI
guard (scripts/smoke-init-scaffold-references.mjs) plus a deterministic
remap of 701 dead `npx claude-flow` references across 142 scaffold files.
Ref: #2971, ADR-382
Minor bump (not patch) because #2927/#2928 add backward-compatible CLI
flags (--routing-mode, --passthrough), not just bug fixes:
- fix(proxy): bump pinned meta-proxy release 0.4.0 -> 0.7.3 (#2925)
- fix(proxy): fall back to tar when Expand-Archive fails on Windows (#2926)
- fix(proxy): disclose what enabling cloud routing decides, --routing-mode (#2927)
- fix(proxy): make the passthrough plane reachable again after cloud routing (#2928)
Co-Authored-By: RuFlo <ruv@ruv.net>
@claude-flow/cli, claude-flow, and ruflo were published at 3.36.0 (and
@claude-flow/memory at 3.0.0-alpha.22, carrying the #2887 durability fix)
without the version bump landing back in git — this just reconciles the
committed package.json versions with what's actually live on npm, and bumps
the cli's @claude-flow/memory floor to the version that has the fix.
No code changes.
Co-Authored-By: RuFlo <ruv@ruv.net>
Minor bump: this release folds in PR #2956 (MetaHarness hardening — repair
the dependency contract, strict sequential promotion evidence, ADR-381) plus
a follow-up commit on that PR fixing 3 concurrency/epoch-boundary bugs found
during review that could silently violate the <=5% family-wise
false-promotion guarantee. All backward-compatible additions (new
optionalDependencies, new doctor checks, new CLI/MCP surface) — no breaking
changes, hence minor not major.
Also fixes a stale test assertion in distill-oracle.test.ts: the darwin
bench-run command now embeds the pinned @metaharness/darwin version
(MH_DARWIN_PIN) per the #2561 cold-npx regression guard, so the test's bare
'darwin bench run' substring check no longer matched the intentional pinned
output ('darwin@0.8.3 bench run').
Three-package lockstep bump (@claude-flow/cli, claude-flow, ruflo) per
CLAUDE.md's Publishing Rules, backed by scripts/audit-umbrella-version-lockstep.mjs.
CHANGELOG.md documents ADR-378/379/380 (AGNTCY runtime, npm Trusted
Publishing workflow, statusline segments) and the SLIM alpha-pin fix,
carried in main since the 3.33.0 release.
Co-Authored-By: RuFlo <ruv@ruv.net>
Adds the live Ruflo capability brain, governed federation and Cognitum product planes, source-bound concurrent harness contracts, ADRs 325-329, and the v3.32.28 guarded release train.
* fix(metaharness): pin @metaharness/darwin + add pin-drift guard (ruflo analog of #142/#149)
Upstream agent-harness-generator #142 (darwin caret-locked to 0.2.x, 3 majors
behind) and #149 (META_PROXY_VERSION pinned with no watcher) are both silent
pin-drift failures. Ruflo had the same latent gap on its own metaharness deps:
- distill-oracle.ts invoked `npx --yes @metaharness/darwin` with NO version pin,
so the Tier-1 mechanical oracle floated to whatever npm `latest` was — a
breaking darwin release could change eval behavior mid-run. Pinned via a new
`MH_DARWIN_PIN = '0.8.0'` constant used by all three npx call sites.
- Declared `@metaharness/darwin: ^0.8.0` in optionalDependencies (subprocess-
invoked, kept optional per ADR-150/321) so the pin has a single source of truth
and installs cache-warm.
- Fixed a stale `@metaharness/darwin@~0.3.1` doc comment (darwin is 0.8.0).
New guard (the #149 analog ruflo lacked):
- scripts/check-metaharness-pins.mjs — diffs each declared range (metaharness,
@metaharness/router, @metaharness/darwin) against npm `latest`, plus a
lock-step check that MH_DARWIN_PIN satisfies the declared darwin range. Exit 1
on drift; network flakes surface as a warning, never a false positive.
- .github/workflows/metaharness-pin-drift.yml — runs the guard weekly + on PRs
touching the pins; opens/updates a tracking issue when a pin falls behind,
and hard-fails PRs that introduce drift.
All pins are current (guard exits 0); router API-surface compat 9/9; CLI builds
clean. Lockfile reconciled for the new optionalDep (frozen-lockfile verified).
Refs: ruvnet/agent-harness-generator#142, #149; ADR-150, ADR-321.
Co-Authored-By: RuFlo <ruv@ruv.net>
* chore(release): bump to 3.32.25 (metaharness pin-drift guard)
Co-Authored-By: RuFlo <ruv@ruv.net>
ruv