From 1a6a58fc74553a011bb2ab1f5722681511fb4788 Mon Sep 17 00:00:00 2001 From: rUv Date: Tue, 20 Oct 2026 04:29:18 -0400 Subject: [PATCH] release: 3.58.1 (#4317) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Patch release covering the CWE-22 path-containment fix (#4313), the CLI parser repeated-marker fix (#4314), and a CI test-categorization fix (#4316). Also includes the already-merged console nav bar separators (#3664). Published to npm: @claude-flow/cli@3.58.1, claude-flow@3.58.1, ruflo@3.58.1, and standalone @claude-flow/integration@3.0.2 (#4315's fix — not part of the 3-package train but published separately per its own leaf's npm presence). Co-authored-by: r --- CHANGELOG.md | 15 +++++++++++++++ package.json | 2 +- ruflo/package.json | 4 ++-- v3/@claude-flow/cli/package.json | 2 +- 4 files changed, 19 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 70e2b053ad..3324617486 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,21 @@ All notable changes to the Ruflo project (formerly Claude Flow) are documented h The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [3.58.1] - 2026-10-20 + +Patch release: `@claude-flow/cli`, `claude-flow`, `ruflo` 3.58.1. Bug fixes only. + +### Fixed + +- **Security**: `hooks_codemod`'s `resolveTargets()` path-containment check used an unanchored `abs.startsWith(cwd)` string-prefix comparison — a sibling directory merely starting with the project directory's name (e.g. `cwd`-staging) passed containment, letting this live, CLAUDE.md-recommended tool read **and write** outside the project root (CWE-22). Anchored both call sites at a path-separator boundary, matching the already-correct `isWithinPrefix()` pattern used elsewhere in this codebase (#4312/#4313). +- `CommandParser.parse()` flipped `parsingFlags = false` on every literal `--` token it saw, not just the first — a later `--` supplied as an ordinary operand (e.g. a search query of exactly `--`) was silently swallowed instead of being kept as a positional (#4310/#4314). +- `TokenOptimizer.optimizedEdit()` called `agentBooster.editCode()`, a method that has never existed on `agentic-flow/agent-booster`'s real exports; a separate bug in the same file's `initialize()` picked the un-instantiated `AgentBooster` class instead of calling the package's `getAgentBooster()` factory. Published standalone as `@claude-flow/integration@3.0.2` (#4311/#4315). +- CI reliability: `scripts/__tests__/probe-mod-guards.test.mjs` (a `node:test` file) was never categorized into either the vitest-baseline or vitest-excluded list, causing an intermittent, unrelated "no test suite found" failure on PRs that don't touch it (#4316). + +### Added + +- `ruflo-console` 0.44.6: the compact nav's menu, groups, search and page tabs are now separated by a dim `│` bar instead of just a gap (#3664). + ## [3.58.0] - 2026-10-20 Minor release: `@claude-flow/cli`, `claude-flow`, `ruflo` 3.58.0. Backward-compatible additions (new `memory peek` command, a Codex session activity viewer, configurable MCP rate limits) plus a critical install-breaking fix and a round of correctness fixes. diff --git a/package.json b/package.json index 43a58392d1..63c4565167 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "claude-flow", - "version": "3.58.0", + "version": "3.58.1", "workspaces": [ "v3/@claude-flow/codex", "v3/@claude-flow/mcp", diff --git a/ruflo/package.json b/ruflo/package.json index cc516c5244..c0768ae58f 100644 --- a/ruflo/package.json +++ b/ruflo/package.json @@ -1,6 +1,6 @@ { "name": "ruflo", - "version": "3.58.0", + "version": "3.58.1", "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration", "main": "bin/ruflo.js", "type": "module", @@ -40,7 +40,7 @@ "package:rvf": "bash src/scripts/package-rvf.sh" }, "dependencies": { - "@claude-flow/cli": "3.58.0" + "@claude-flow/cli": "3.58.1" }, "optionalDependencies": {}, "overrides": { diff --git a/v3/@claude-flow/cli/package.json b/v3/@claude-flow/cli/package.json index e505d2425e..56bfb8fc6a 100644 --- a/v3/@claude-flow/cli/package.json +++ b/v3/@claude-flow/cli/package.json @@ -1,6 +1,6 @@ { "name": "@claude-flow/cli", - "version": "3.58.0", + "version": "3.58.1", "type": "module", "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code", "main": "dist/src/index.js",