Ruflo

From the release notes

What changed Fixes Finding B of #3327: memory_search({ smart: true }) was reporting SmartRetrieval's internal RRF fusion score in the similarity field instead of the underlying retrieval relevance score — e.g. a raw retrieval relevance of 0.8 was showing up as 0.03252247488101534. similarity now carries the raw retrieval relevance (matches smart: false behavior) the fused SmartRetrieval ranking score is now exposed separately as rankingScore threshold behavior is unchanged (still applied pre-RRF/MMR/recency) 14 new regression tests across the SmartRetrieval package and MCP handler Fixed in #3340 (thanks @takagibit18). Finding A of #3327 (reasoningBank/vectorBackend reporting enabled:true but routing through bridge-fallback) remains open and unclaimed. Note on version history 3.42.1–3.42.3 were published to npm without matching version-bump commits on main. Verified their tags (v3.42.0, v3.42.1, v3.42.3) are all ancestors of this release, so 3.42.4 is a strict superset of everything previously shipped. Co-Authored-By: RuFlo ruv@ruv.net

From the release notes

Fixes hooks: quote-aware split for RUFLO_HOOK_CLI_OVERRIDE (#3344) — the test-only CLI-override parser in plugins/ruflo-core/scripts/ruflo-hook.cjs did a naive .split(' '), which broke process.execPath into C:\Program plus stray tokens on a standard Windows Node install (C:\Program Files\nodejs\node.exe). Found while verifying #3332's Windows argv fix on a real Windows machine rather than windows-latest CI (whose hosted Node path has no space). No production impact — RUFLO_HOOK_CLI_OVERRIDE is never set outside the test harness. release: spawn npm.cmd with shell:true on Windows (#3346, #3348) — scripts/stage-internal-runtime-bundles.mjs and scripts/prepare-root-publish.mjs both spawned npm.cmd directly without shell:true, which throws EINVAL on any current Node/Windows combo (CreateProcess can't launch a .cmd, and Node has refused to shell out to one implicitly since CVE-2024-27980). This blocked every Windows publish of @claude-flow/cli and the claude-flow umbrella package. Found live while publishing this release from a Windows machine. Verification plugins/ruflo-core/scripts/test-hooks.mjs: 32/32 (was 29/32 before #3344) v3/@claude-flow/cli/__tests__/ruflo-hook-windows-argv.test.ts, escape-cmd-arg.test.cjs, mcp-launch.test.cjs, scripts/smoke-ruflo-hook-cjs.mjs, cross-platform/env-var audits: all clean Full Windows publish pipeline (@claude-flow/cli → claude-flow → ruflo) exercised end-to-end on a real Windows machine after the fixes landed latest / alpha / v3alpha dist-tags verified aligned at 3.42.3 across all three packages 🤖 Generated with RuFlo

From the release notes

v3.42.1 — SONA env-default, review batch, and reliability fixes A patch release: one small feature (opt-in, fully backward-compatible) plus a batch of independently-reviewed bug fixes, a performance fix, and a dependency bump — all reviewed, tested, and merged in this pass. What's new for you SONA learning mode can now default from the environment RUFLO_INTELLIGENCE_MODE sets a fleet-wide default learning mode (real-time, balanced, research, edge, batch) without threading mode/sonaMode through every call site — useful for a managed deployment that wants every session to learn in a specific profile. An explicit per-call mode always wins; an unset or unrecognised value falls through to balanced, so a typo can never silently pick a profile. (Originally landed with a bug where one of the two places reading this variable only checked it once per process instead of per session — fixed before release, with new regression tests in both places.) Diagnostics and memory fixes ruflo doctor no longer guesses your memory driver from a raw table count (a heuristic that never actually correlated with which driver you're using) — it now reports only what it verifies directly. ruflo doctor now resolves the installed MetaHarness version correctly instead of reporting stale/incorrect data. memory_stats now answers from the live store instead of a snapshot that couldn't see in-flight writes — a working memory store no longer reports itself as uninitialized. Also fixes a namespace named __proto__ silently vanishing from the breakdown, and a hardcoded row cap that was truncating large stores without saying so. A database handle used during memory initialization now closes on every code path, including the failure path that used to leak it. Opening the graph database now verifies the handle is actually persistent before using it — a bad argument shape used to silently produce an in-memory-only graph that vanished on exit, with no error. Fixed a memory-key bug on Windows where a drive letter's colon wasn't sanitized consistently with how Claude Code derives the same key. Federation and security The federation gateway's untrusted-relay data is now read through the same validated envelope shape the gateway actually sends, closing a gap where some tools could miscount or silently see zero messages. WITNESS_ED25519_ROOT now actually resolves @noble/ed25519 for witness-manifest signing (this only affects the maintainer signing path — the separate node:crypto-based signature verification path was never affected). Performance AgentBBS now dedupes redundant peer-hello and watch-replay traffic, and computing the next sequence number no longer requires scanning an entire (potentially large) room log. Housekeeping swarm status/swarm stop now report a real swarm id and no longer get confused by a stale "stopped" state file shadowing a live swarm. Bumped agent-browser to 3.37.1 for recording/WebMCP improvements and a Windows headless-Chrome cleanup fix. Upgrading

From the release notes

v3.42.0 — Swarm, Memory & Security Reliability Batch This release lands 14 fixes produced by Ruflo's own nightly "Dream Cycle" research pipeline — each one found a real bug or gap in the codebase, built a fix, proved it with before/after tests, and (in several cases) survived an independent adversarial review before merging. Nothing here is speculative: every change below has a passing regression test that failed before the fix and passes after it. What's new for you 🐝 Swarm consensus actually uses trust weights now When multiple agents vote on a decision, Ruflo has long computed a "trust weight" for each voter — but that number was silently discarded before it ever reached the vote count. Every strategy (Raft, Byzantine, gossip) was voting as if every agent were equally trustworthy. Now the weight is actually used, so a vote from an agent with a strong track record counts for more than a vote from an untested one. 🔍 Vector search is faster and more accurate HNSW product-quantization (a memory-compression technique for embeddings) was built and tested but never actually wired into the search path — searches were running on meaningless data. It's now dispatched correctly, more than doubling search accuracy (recall) in our benchmark. MMR re-ranking (used to diversify search results so you don't get 10 near-duplicate hits) was re-tokenizing every candidate on every pass, even when it didn't need to. It's now ~6x faster with byte-identical results. Memory deduplication used to only catch exact byte-for-byte duplicates. It now also catches near-duplicates (paraphrases, reformatted text) using the embeddings Ruflo already computes — no extra cost, same-quality matching. Fixed a bug where a memory pattern's retrieval score (how well it matched your query) was overwriting its learned reliability (how trustworthy that pattern has proven to be over time) — which meant the "only trust high-confidence patterns" safety check was silently checking the wrong number. 🔐 Security hardening MCP tool governance is now enforceable. Ruflo has shipped a governance policy file (audit logging, per-session call limits) for a while, but nothing in the running server ever actually read it. It's now wired in as an opt-in flag (RUFLO_MCP_ENFORCE_POLICY=1) — off by default, so nothing changes unless you turn it on. The call-limit for that policy now resets properly. It used to be a lifetime cap that, once hit, locked a session out permanently until restart. It's now a rolling time window, matching how every other rate limiter (Cloudflare's, etc.) does it. Hive-mind voting can no longer be Sybil-attacked. Previously, any caller could cast a vote under a made-up agent name and it would count toward quorum — meaning one caller could out-vote everyone else with fabricated identities. Votes are now checked against the actual roster of agents that joined the hive. Joining or leaving a hive-mind now requires proof you're allowed to. This closes the gap the vote-fix abov

From the release notes

Fix agentdb_pattern-store/agentdb_pattern-search now surface degraded: true whenever the response comes from anything other than a healthy reasoningBank controller (the bridge-fallback and memory-store-fallback paths alike), instead of only in a note string a caller has no structural reason to check. Fixes #3288. Includes a follow-up correction (b9ca64f80) after review caught that the initial fix only handled the case where the controller registry is entirely absent, missing the more common case where the registry exists but ReasoningBank itself is unusable (controller: 'bridge-fallback') — the degraded flag is now applied at the result.controller === 'reasoningBank' boundary in both handlers rather than per fallback-label, so it can't be reopened by a future fallback label. See #3323 for the full discussion. This does not address why vectorBackend/reasoningBank fail to activate in a given deployment — that's tracked separately in #1228 (ADR-053) and #2296.

From the release notes

Security fix Federation event identity: fetchRecent/fetchManyOn/fetchChannel now apply the signature-verified id/pubkey/created_at after the publisher's own message content, instead of before — a publisher could otherwise put those keys in their own content and overwrite their verified identity downstream, which the swarm claims ledger (reduceClaims) trusts for release/handoff authorization. Same fix applied to x_federation_channel_read in @claude-flow/cli, which additionally now verifies event signatures at all (reqEvents() previously trusted unverified events). The live ruflo-x-gateway production service was redeployed with this fix ahead of this release. Windows hook argument escaping: ruflo-hook.cjs's Windows shell:true npm-shim invocation path now escapes every argument (cmd.exe metacharacter neutralization), so a hook-derived value can no longer be reinterpreted as a separate command or redirection. See #3322 for the full technical writeup and test coverage.

From the release notes

Patch release. Three fixes from the issue backlog, each confirmed in source before any change and each with a regression test proven to fail without the fix. A curate can no longer destroy a user's memory index (#3224) AutoMemoryBridge.curateIndex() rebuilt MEMORY.md from its own topic files and overwrote whatever was there. The #1556 guard only skipped the write when nothing matched — but the bridge writes the first topic file itself, so the guard protected exactly one sync and then stopped applying. The reporter measured a hand-curated index of 75 lines and 49 links reduced to a 6-line stub. A curate may now grow or reorder the index and never shrink it. When the generated view is smaller, the existing file is left untouched, the generated view is written beside it as MEMORY.generated.md, and the bridge emits index:preserved. The old failure was silent; a silent refusal would only be a quieter version of the same problem. autoStart: false is honoured (#3278) Two mismatches were stacked: what init writes what the check read file .claude/settings.json claude-flow.config.json key claudeFlow.daemon.autoStart daemon.autostart A different file and a different capital S, so the setting a fresh project ships was never consulted — under a comment reading "Opt-in only — prevents unintended token consumption (#1427, #1330)". Both files and both spellings are now read. Reads disclose the store they did not search (#3228, in part) 3.41.1 shipped the sibling-store disclosure in memory list alone. retrieve, search and an empty list kept returning a clean negative while the rows sat in the file they do not read — on the reported Windows install, 31,673 rows answering found:false. Still not fixed: the Windows 0xC0000409 abort on a ~4.4 GB allocation with the native bridge enabled. That is #2948 and this release does not touch it. On Windows the split is now visible, not healed. Install npx ruflo@3.41.2 Merge commit df87b0db338a.

From the release notes

Patch release. Two fixes, both reported by people hitting them rather than found in-house. Memory path identity (#3196) An explicit database path now selects that database. The bridge cached one registry globally, so the first caller to touch it decided the file for the whole process and every later caller's --path or CLAUDE_FLOW_DB_PATH was accepted and then silently ignored. A CLI write and an MCP write landed in two files, both reporting success, and neither interface could see the other's rows. memory list also stopped printing a confident total for one store while rows sat unread in its sibling — it now names the store it did not read. Reported downstream by pacphi/agentic-kit#213. Not done deliberately: merging the two database files. #2786 gave AgentDB its own plaintext file so native better-sqlite3 never opens an encrypted memory.db. Unifying them would re-break encryption at rest. Seraphina truncation (#3267) Seraphina no longer passes a truncated reasoning dump off as coordination guidance. The routed model spent its whole token budget reasoning and never emitted its JSON, and the resulting empty proposal list read as the swarm needs nothing — the one conclusion a coordinator must never reach by accident. Install npx ruflo@3.41.1 Merge commit cda8b04f6ae1.

From the release notes

RuFlo 3.41.0 — Join the open swarm in four commands Any machine running RuFlo can now join a shared, signed, invite-gated swarm at x.ruv.io with a key only it holds. No Tailscale, no VPN, no account. Step-by-step guide with troubleshooting: https://gist.github.com/ruvnet/6d3202cc7030e32169e8d5ac73b4e870 Illustrated explainer: The Swarm Wall (Cognitum Media plates) Try it npx ruflo@latest federation join --code v2.… # 1 · get in with your own key (code comes to you privately) npx ruflo@latest federation roster # 2 · you are listed npx ruflo@latest federation claims # 3 · who owns what npx ruflo@latest federation sync # 4 · read what the swarm posted Then in Claude Code: claude mcp add --transport http --scope user x-ruv-io https://x.ruv.io/mcp What's new ruflo federation command (#3256): join, sync, roster, claims, registry, plus admin-gated invite, admit, publish. Self-service join generates ~/.ruflo/nostr.key (0600), redeems the invite with a NIP-98 signature, and proves membership with NIP-42. Public and private swarm channels (#3261, ADR-386): ruflo federation channel --action create|grant|accept|publish|read|list. Private channels are NIP-44 encrypted with keys the gateway never sees. x.ruv.io gateway plugin (#3255): MCP at https://x.ruv.io/mcp, WebSocket proxy, ruv://federation/registry, ruv://swarm/roster, ruv://claims/board, ruv://swarm/channels. Admin writes are token-gated and fail closed. Seraphina (#3256): swarm coordinator via the cognitum meta-llm. seraphina_guidance { goal } returns guidance, proposals and risks. Advisory only. Canonical relay wss://relay.ruv.io. Sign the NIP-42 relay tag with this exact address; the old *.run.app host still works as legacyRelay. 15 federation MCP tools ship in the RuFlo MCP server. CI: @metaharness/darwin pinned to 0.10.2 so the pin-drift and clean-install gates are green again (#3262); skills and gateway docs cover channels (#3263). Validated before this release 67 CLI tests and 12 gateway tests green; all 23 workflows green on main. Fresh npm install ruflo@latest on a clean cache: federation join with a new key, registry, roster, sync, and a public-channel publish/read round trip against the live relay. Relay E2E on three paths: direct wss://relay.ruv.io, the legacy host, and proxied through wss://x.ruv.io. Private-channel E2E from a second, independent key: plaintext for members, ciphertext only for non-members. Known ruflo verify reports the same one stale witness marker (#1697 rvf-wasm overrides) as 3.40.0; manifest refresh is tracked separately. Packages @claude-flow/cli, claude-flow, ruflo → 3.41.0 (latest, alpha, v3alpha).

From the release notes

🕸️ Cross-Host Federation + Claims Coordinate agents across machines with signed, verifiable messages and work claims. Two coordinators — use either alone or together: Local mesh (agentbbs): HTTP pull, Ed25519-signed, pinned keys. Works over Tailscale, LAN, VPN, or loopback — no Tailscale required. Slack: coordinate in a channel thread with structured messages. Zero infrastructure. Install npx ruflo@latest --version # 3.40.0 Quick start — join the mesh (run on each host) 1. federation_bbs_identity {} → your nodeId + publicKey 2. federation_bbs_peer_add { nodeId, publicKey, url } → pin every other node 3. federation_bbs_serve { bindHost:"<your routable IP>", port:7777 } 4. federation_bbs_register { roomLabel:"#coordination" } 5. federation_bbs_sync { roomId:"<from step 4>" } → on a 15–30s timer Unsigned, misattributed, oversize, or over-hop messages are dropped and counted — a hostile or looping peer can't corrupt the log. Claims — coordinate who owns what Runtime tools: claims_claim, claims_release, claims_handoff, claims_status. Cross-host, publish claim events: { "type":"ClaimIssued", "from":"nodeA", "resourceId":"deploy-api", "ttlSeconds":3600 } One owner per resource. Claim → wait for the coordinator's ClaimAck → then do the work. Security Every mesh message is Ed25519-verified against a pinned key. Registry-anchored pinning refuses any endpoint presenting a different key for a known node (identity-hijack / MITM protection). Private keys never leave the host. Don't put secrets in message payloads. What's also in 3.40.0 Restored memory search recall (a real regression: the default threshold made keyword recall impossible) — #3252 Full CLI test suite green (69 → 0 failures) 📖 Full step-by-step guide, protocol reference, GCP-secret bootstrap, and troubleshooting: https://gist.github.com/ruvnet/2fbad4d0e3bc02cc7d47b4f6fdd2c205 🤖 Generated with RuFlo

From the release notes

Patch release shipping #3250. Fixed federation_bbs_* tools were unconditionally degraded. All four tools (register / publish / watch / human_join) gated on await import('agentbbs'). The published agentbbs package is a CLI-only launcher — its tarball contains only bin/agentbbs.js, package.json and README.md, with no main, no exports, and no root index.js for Node to fall back to. That import could never resolve, so the tools reported degraded: true no matter whether agentbbs was installed and working. Replaced with a subprocess presence probe. Probe shell gated to win32. The follow-up hardening: shell: true was unconditional while the probed binary comes from AGENTBBS_BIN, and under a shell that argument is command-interpreted — a crafted value ran a trailing command (verified locally). POSIX now spawns without a shell; Windows keeps cmd.exe so the agentbbs.cmd shim still resolves via PATHEXT. Matches the existing convention in browser-tools.ts, commands/init.ts and init/helpers-generator.ts. @noble/ed25519 no longer externalized in tests. It is a hard dependency of @claude-flow/cli, not an optional one, and externalizing it broke dynamic-import resolution under Vite's SSR transform. Scope This makes the Phase 1 local room/envelope surface functional when agentbbs is genuinely installed. It does not implement cross-host federation — that remains Phase 2+. Install npx ruflo@latest All three packages (@claude-flow/cli, claude-flow, ruflo) are at 3.39.3 on latest, alpha, and v3alpha. 🤖 Generated with RuFlo https://claude.ai/code/session_013u4pmL9ZUAXb6usVQgNo67