v3.45.0

# RuFlo 3.45.0: upgrades stop leaving a stale memory package behind

**Released 24 September 2026.** Upgrade:

```sh
npx ruflo@latest --version    # should print: ruflo v3.45.0
```

---

## The short version

- **A fix that spans two packages now reaches you together.** `npx @claude-flow/cli@latest` reuses one cache folder across versions, and npm keeps an older `@claude-flow/memory` that still fits the allowed range. So an upgrade could quietly leave you on the old memory package, with nothing reporting a problem. The CLI now asks for one exact memory version, so a stale copy can no longer pass. (#3392)
- **`ruflo doctor` tells you when it happens anyway.** A new check, `@claude-flow/memory version`, compares the memory package the CLI actually loads with the one it asks for. If they differ it warns and prints the command to clear the cache. It is a warning, not a failure, so it never changes doctor's exit code. Try it with `ruflo doctor --component memory-package`.
- **Running the test suite no longer edits your own config.** One test ran the real `init` against your home folder, adding to `~/.claude/CLAUDE.md` and `~/.codex/config.toml` and leaving a background download running. It now uses a throwaway home. This is a test-only change. (#3370)

## Checked

With memory `alpha.24` already installed, adding the old `cli@3.44.0` left it at `alpha.24`. Adding the published `cli@3.45.0` upgraded it to `alpha.25`, and the new check reports it satisfied.

## Known gaps

- The `ruflo` wrapper still allows any `@claude-flow/cli` from 3.33.0 up, so `npx ruflo@latest` can still run an older cached CLI (#3306). Use an explicit version when checking.
- The signed witness manifests were regenerated from a source-only checkout. The entries that point at build output are carried forward unchanged, not re-checked, so their "verified" count is not fresh. A regeneration on a fully built tree is the follow-up.
- `@claude-flow/mcp` on npm still ships the old shell-based `github-safe.js` helper (#3411). The fix is in review as #3412 and is not part of this release.