Patch release covering everything landed since 3.38.21.
Fixes
- #3221 —
EnhancedModelRoutercould escalate a task to a stronger tier while forwarding a stalemodelIdchosen for the cheaper tier, and first-call dispatch treated that identity as authoritative — so a security-sensitive task classified for a strong model could still execute against a weaker one. Forwarded identity metadata is now gated on the base model matching the escalated model. - #3177 — bounded two ReDoS-prone patterns, made PII regexes stateless, and made the confidence pass O(P).
- #3169 — wired embedding-cosine into
SmartRetrieval's MMR step. - #3184 — wired real cold-start measurement and removed a fabricated V2-vs-V3 benchmark.
- #3204 — fixed two stale main-tree Test Suite failures (embedding width; hook-handler exports).
- #3203 — added
v3/@claude-flow/mcpto the root npm workspaces sonpm ciresolves the unpublished alpha.10 pin.
Note on the version number
3.38.22 is skipped. @claude-flow/cli's publish for that version stuck in npm's "staged" state — the umbrella packages went live while the CLI itself 404'd, and the registry then refused to republish over the staged entry even after unpublishing it. All three packages moved to 3.38.23 together rather than leave the release train out of lockstep.
Install
npx ruflo@latest
All three packages (@claude-flow/cli, claude-flow, ruflo) are at 3.38.23 on latest, alpha, and v3alpha.
🤖 Generated with RuFlo