Skip to content

v3.66.1 — federation trust thresholds enforced; locked memory stores say so

Choose a tag to compare

View all tags
@ruvnet ruvnet released this 31 Oct 15:18
· 26 commits to main since this release
v3.66.1
49adc54
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release: @claude-flow/cli, claude-flow, ruflo 3.66.1, plus standalone @claude-flow/memory 3.2.0 and @claude-flow/plugin-agent-federation 1.0.4.

Security

  • Federation trust thresholds are now enforced (#4618, #4619). SecurityPolicy.minTrustLevelForWrite, minTrustLevelForMemory and minTrustLevelForSpawn were declared and accepted as overrides but never checked.
    • Before: memory-query and memory-response passed at ATTESTED, below the default policy's own TRUSTED minimum.
    • Now: PolicyEngine.evaluateMessage() checks the configured minimum for write, memory and spawn messages. The check adds to the built-in capability gates; a looser policy cannot bypass them.

Fixed

  • A memory store locked by another process now says so (#4622). Separate stdio MCP servers opening one store contend for its native vector store.
    • Before: AgentDB fell back to a backend that rejected the locked file as the wrong format, and only that error was reported. The registry was still treated as available, and memory operations then failed with an unrelated sql.js WAL refusal.
    • Now: ControllerRegistry.getAgentDBInitError() (@claude-flow/memory 3.2.0) keeps the first backend's failure, such as Database already open. Cannot acquire lock. It names the fix: run one owner with ruflo mcp start --transport http and point every client at it. The CLI bridge records that reason and adds it to the fallback's refusal. isBridgeAvailable() returns false when AgentDB did not open.
    • memory_list reports a failed query as success: false with its error, not as an empty inventory.
Assets 2
Loading