Starstruk Logo MarkStarstruk

v3.38.23

ruvnet/ruflov3.38.23Sep 7, 2026by ruvnet

AI Summary

This patch release addresses a security vulnerability in the routing tier, bounds ReDoS-prone patterns for improved performance, and introduces real cold-start measurement capabilities.

Key Highlights

  • Fixed a security issue in `EnhancedModelRouter` where forwarded identity metadata was not gated correctly, potentially allowing sensitive tasks to run on weaker models.
  • Bounded two ReDoS-prone patterns and optimized the confidence pass to run in O(P) time.
  • Wired embedding-cosine into `SmartRetrieval`'s Maximum Marginal Relevance (MMR) step.
  • Switched to real cold-start measurement and removed a fabricated V2-vs-V3 benchmark.
  • Resolved stale main-tree test suite failures and fixed npm workspace resolution issues.

New Features

  • Wired embedding-cosine into `SmartRetrieval`'s MMR step
  • Added `v3/@claude-flow/mcp` to the root npm workspaces for better dependency resolution

Full Release Notes

Patch release covering everything landed since 3.38.21.

### Fixes
- **#3221** — `EnhancedModelRouter` could escalate a task to a stronger tier while forwarding a stale `modelId` chosen for the cheaper tier, and first-call dispatch treated that identity as authoritative — so a security-sensitive task classified for a strong model could still execute against a weaker one. Forwarded identity metadata is now gated on the base model matching the escalated model.
- **#3177** — bounded two ReDoS-prone patterns, made PII regexes stateless, and made the confidence pass O(P).
- **#3169** — wired embedding-cosine into `SmartRetrieval`'s MMR step.
- **#3184** — wired real cold-start measurement and removed a fabricated V2-vs-V3 benchmark.
- **#3204** — fixed two stale main-tree Test Suite failures (embedding width; hook-handler exports).
- **#3203** — added `v3/@claude-flow/mcp` to the root npm workspaces so `npm ci` resolves the unpublished alpha.10 pin.

### Note on the version number
3.38.22 is skipped. `@claude-flow/cli`'s publish for that version stuck in npm's "staged" state — the umbrella packages went live while the CLI itself 404'd, and the registry then refused to republish over the staged entry even after unpublishing it. All three packages moved to 3.38.23 together rather than leave the release train out of lockstep.

### Install
```
npx ruflo@latest
```
All three packages (`@claude-flow/cli`, `claude-flow`, `ruflo`) are at 3.38.23 on `latest`, `alpha`, and `v3alpha`.

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)

https://claude.ai/code/session_01Ff2xRKvYrqXJhefvcapfE1