Skip to content

v3.49.0: eleven reported issues fixed (Martin Vladimirov), Nick Ruest and drakeo338 contributions

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 01 Oct 00:12
· 275 commits to main since this release
v3.49.0
0bd8e31
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ruflo 3.49.0

Install: npx ruflo@latest (also @claude-flow/cli@3.49.0, claude-flow@3.49.0). @claude-flow/security@3.0.1 is bundled and published standalone.

This release fixes eleven issues reported by Martin Vladimirov (@martinvlad). Each report included measurements and a reproduction, and that is what made fixing them quick. It also includes two PRs from Nick Ruest (@nicholas-ruest) and one from @drakeo338.

Fixes

  • #3555: helpers load in "type":"module" projects. router, session and memory now ship as .cjs, so ESM projects no longer get "Router not available" (#3583).
  • #3565: post-install helper tampering is detected and healed. An integrity re-check runs even when the version stamp matches, contributed by Nick Ruest (#3576). doctor now reports it as well (#3583).
  • #3567: hooks_route no longer reports high confidence on no match. It used to report 70% when nothing matched; it now returns 30% with matched:false / no-match-default. Whitespace-only tasks are rejected (#3581).
  • #3568: policy ledger truncation is now detectable. The ledger records its head anchor and length; this change is in @claude-flow/security 3.0.1 (#3579).
  • #3557: plugin install trust policy. Install scripts are gated (#3580).
  • #3556: ai-team discovery uses a CORS allowlist. 0.1.6 is live on team.ruv.io (#3577).
  • #3566: sibling-namespace disclosure. Partial matches are disclosed, and import reports real vector counts (#3582).
  • #3570: memory key and namespace validation. One shared validator covers the CLI and MCP; contributed by @drakeo338 (#3571).
  • #3572: swarm status progress. It reports null instead of invented numbers (#3578).
  • #3573, #3575: session import and memory fixes (#3584).
  • doctor native-driver detection. The better-sqlite3 loader is now injectable; contributed by Nick Ruest (#3569).

Verified on the published packages

Fresh npm i ruflo@3.49.0 in a "type":"module" project: helpers install as .cjs and routing works; no-match routes report 30%; swarm status progress is null; a tampered router.cjs is detected and restored. Witness manifests verify 117/117 on linux, macos and windows, and the signed helper manifest verifies.

Thanks to Martin, Nick and drakeo338.

Gist: https://gist.github.com/ruvnet/75fea5568fc33a4ba55c04104a28a779

Contributors

martinvlad, nicholas-ruest, and drakeo338
Assets 2
Loading