v3.10.46

Patch release shipping the @dskarasev community bug batch from PR #2375 — three related runtime references to the deprecated `claude-flow@v3alpha` (or `claude-flow@alpha`) dist-tag that survived the `claude-flow` → `ruflo` rename. Each was silently routing users / workers / detection at a pre-rename build that lacks autopilot, browser, wasm-agent, and other current MCP tools.

## Fixes

### #2369 — legacy MCP key detection + Scenario A warning
**Scenario A** (the silent-failure mode): if a user's project directory already has an `.mcp.json` from a pre-rename install, `writeMCPConfig` was early-returning with a generic `skipped` message. The user was left with an MCP server pointed at a pre-rename build and zero indication anything was wrong — "autopilot tools missing after init" was the most common downstream symptom. **Now**: `writeMCPConfig` parses the existing file, detects stale keys, and surfaces:

```
.mcp.json (existing file uses deprecated key 'claude-flow@alpha' —
autopilot/browser/wasm-agent tools will be missing; delete .mcp.json
and re-run, or re-run with --force to overwrite)
```

**Scenario B** (the original report): `detectExistingRufloMCP` only recognised `'claude-flow'` and `'ruflo'` as already-registered keys, so a stale `claude-flow@alpha` entry in a parent directory wasn't detected. Init would walk past it and write a NEW `claude-flow`-keyed entry — both servers then ran simultaneously under different prefixes (`mcp__claude-flow@alpha__*` and `mcp__claude-flow__*`), producing duplicate-tool noise. **Now**: both legacy keys are recognised in both the top-level `mcpServers` and project-scoped registration paths.

### #2370 — swarm.ts MCP-down hint
`swarm_init` failure hint changed from:

```
claude mcp add claude-flow npx claude-flow@v3alpha mcp start
```

to:

```
claude mcp add claude-flow -- npx -y ruflo@latest mcp start
```

The `--` separator avoids claude-mcp flag ambiguity; the `-y` forces a fresh fetch so npx doesn't pick a stale local install.

### #2371 — ContainerWorkerPool worker spawn
`buildWorkerCommand()` was returning `['npx', 'claude-flow@v3alpha', 'daemon', 'trigger', ...]`. Two problems: the deprecated dist-tag, and the missing `-y` meaning npx could silently fall back to any locally-installed `claude-flow` (e.g. 2.7.35) without fetching the published version. Container workers were running pre-rename builds without knowing. **Now**: `['npx', '-y', 'ruflo@latest', 'daemon', 'trigger', ...]`.

## Tests

`v3/@claude-flow/cli/__tests__/stale-mcp-key-2369.test.ts` — 10 tests pin all three runtime contracts plus a comment-stripped sanity sweep over the entire `cli/src/` tree (legitimate legacy-key recognition lists excepted) so a future grep-and-replace can't silently re-introduce the deprecated dist-tag.

All 11 existing `init-wizard-bugs` tests still pass — no regression in the surrounding init paths.

## Still open from today's triage

- **#2373** (HIGH `agentic-flow/transport/loader` missing from `@latest`) — in-repo half already in v3.10.44 (PR #2364 capped the federation plugin peer). Remaining fix is upstream `ruvnet/agentic-flow#153`. Commented on the issue.
- **#2372** — user question about the project, not a code bug.

## Install / upgrade

```bash
npx ruflo@latest init        # 3.10.46
npx @claude-flow/cli@latest  # 3.10.46
```

All three packages (`@claude-flow/cli`, `claude-flow`, `ruflo`) and all three dist-tags (`latest`, `alpha`, `v3alpha`) verified at 3.10.46.

## Diff

main…v3.10.45 — PR #2375 plus the release bump.

Thanks @dskarasev for the rigorous per-bug write-up with proposed fixes!

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)