ruflo updates — week of 2026-08-16 (66 new commits, tip fa13ee4ad)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-08-09 · Upstream tip: fa13ee4ad

feat (4)

• fa13ee4ad feat(watermark): add browser/Deno ESM entry (@claude-flow/watermark 0.2.0) (#3041) (rUv)
• 72fb12939 feat(watermark): @claude-flow/watermark npm package (WASM bindings) (#3040) (rUv)
• f7d27c362 feat(watermark): SynthID-Text-style LLM text watermarking crate (Rust/WASM) (#3039) (rUv)
• f35c545fb feat(metaharness): pull in @metaharness/turn-credit + fix stale router/darwin pins (#2958) (rUv)

fix (38)

• 44b9dad1f fix(release): enforce CI and idle assignment safety (#3037) (rUv)
• 13cbd697d fix(release): enforce CI and idle assignment safety (ruv)
• 21f7c0adb fix(release): align bundled runtime metadata (ruv)
• 392e71912 fix(mcp): rate-limit authenticated HTTP routes (ruv)
• 3f285bfb2 fix(memory): disable unsafe native bridge on Windows (#3024) (ruv)
• 5c676fe24 fix(doctor): report missing native sqlite bindings (dajiaohuang)
• 40affb83f fix(ruvocal): keep hidden-tab streams responsive (dajiaohuang)
• 6b8f0d0b5 fix(mcp): share state across HTTP transports (dajiaohuang)
• 2dbb790a0 fix(mcp): restore HTTP protocol and CLI tools (dajiaohuang)
• fa11ee8c2 fix(cli): honor helper refresh opt-out before locking (dajiaohuang)
• 0c73bab4d fix(cli): serialize helper refreshes across processes (dajiaohuang)
• 4dcff4834 fix: correct CLAUDECODE env detection and neural-tools source label (#3028) (rUv)
• 3030924f2 fix(security): compare candidate and prefix in the same canonical form (#3011) (Dragan Spiridonov)
• c1e8e0c41 fix(security): realpath allowed prefixes so a symlinked prefix isn't rejected (#3010) (#3013) (rUv)
• 1e24bb887 fix(agent): propagate explicit provider/model config into agent execution (#2962) (#3007) (rUv)
• 57c0fcba9 fix(memory): stop misreporting bridge brute-force search as HNSW-accelerated (#3006) (rUv)
• c0c3ab071 fix(intelligence): stamp contentFingerprint in consolidate()'s graph write too (#3003) (rUv)
• 35a6ad369 fix(daemon): config.json resourceThresholds overrides were lost to stale daemon-state.json (#2935) (#3000) (rUv)
• 9039e2bb3 fix(intelligence): same-ID content edits were cached/dropped instead of refreshed (#2920) (#2999) (rUv)
• 370355015 fix(codex): close worker stdin so codex exec doesn't hang waiting for EOF (#2947) (#2997) (rUv)
• 7715eb5ea fix(security): loosen Stripe/OpenAI secret regex boundaries (#2931) (#2996) (rUv)
• 2fd63cf3d fix(github-tools): pass --repo to gh in github_issue_track (#2963) (#2995) (rUv)
• f9537a240 fix(ruflo-adr): skip .brain when walking for ADRs (#2911) (#2994) (rUv)
• d41af6e4d fix(hooks): await the ADR-130 reinforced-by graph edge write (#2961) (#2991) (rUv)
• 3d3f6e08c fix(init): read the parser's actual camelCase flag keys (#2952) (#2989) (rUv)
• 1e2178f24 fix(hooks): make hooks intelligence --train actually train (#2940) (#2988) (rUv)
• 87f4f8ab6 fix(mcp): mcp start -t http exits after false-success table + doc drift from #2985 (#2987) (rUv)
• dbd88254e fix(migrate): correct removed-agent install suggestion and add 'migrate fix --agents' restore (#2985) (#2986) (Chris Phillipson)
• b8c37da8e fix(memory): unordered LIMIT truncation in search + honest sql.js persistence status (#2983) (rUv)
• 83e536396 fix(scaffold): add dead-reference guard + deterministic CLI remap (ADR-382 Part C) (#2974) (rUv)
• 2c8f86358 fix(migrate): implement ADR-128's promised removed-agent detection (ADR-382 Part B) (#2973) (rUv)
• 8e62a8bd8 fix(plugins): pin ruflo-core MCP launch path + register 3 missing marketplace plugins (#2975) (rUv)
• 6d58837f4 fix(proxy): make the subscription plane reachable again after cloud routing (#2928) (Dragan Spiridonov)
• e1f7e4a23 fix(proxy): disclose what enabling cloud routing decides, and let users pin a tier (#2927) (Dragan Spiridonov)
• 52f4f33a0 fix: sync v3/pnpm-lock.yaml with @claude-flow/memory@^3.0.0-alpha.22 (ruv)
• d3e647a5d fix(proxy): bump pinned meta-proxy release 0.4.0 -> 0.7.3 (#2925) (Dragan Spiridonov)
• a39a1dccd fix(proxy): fall back to tar when Expand-Archive fails, and cover extraction (#2926) (Dragan Spiridonov)
• 1d365d4a6 fix: silent memory-write loss + daemon lock cwd bypass (#2887, #2878, #2877) (#2966) (rUv)

docs (1)

• abf26ab09 docs(dream-cycle): seed LEDGER.md with backfilled history + v2 routine update (#3018) (rUv)

chore (16)

• 2ec82b0cd chore(release): prepare stable 3.38.10 train (ruv)
• 01bece31c chore(data): clone snapshot ruflo updates — week of 2026-07-12 (18 new commits, tip 7ef4d4e65) #12 — 0 clones (14d) (ruflo-bot)
• 761dfcaa6 chore(deps): bump agentic-flow in /v3/@claude-flow/browser (#2907) (dependabot[bot])
• cc5d9c5fe chore(release): bump to 3.38.9 — path-validator symlinked-prefix fix (ruv)
• 5efd5937e chore(release): bump to 3.38.8 — provider/model config propagation fix (#2962) (ruv)
• 0d9a4f7e8 chore(release): bump to 3.38.7 — HNSW status honesty fix, cache-fingerprint follow-up (ruv)
• c76bbdcb1 chore(release): bump to 3.38.6 — codex stdin fix, intelligence cache staleness fix, daemon config restore fix (ruv)
• 506264a9d chore(release): bump to 3.38.5 — .brain skip, --repo passthrough, secret regex (ruv)
• 7c738174c chore(release): bump to 3.38.4 — init flag fix + graph edge race fix (ruv)
• f14453c3b chore(release): bump to 3.38.3 — hooks intelligence --train fix (ruv)
• 8082fbc0f chore(release): bump to 3.38.2 — removed-agent restore + mcp http foreground fix (ruv)
• 711ca3f6f chore(release): bump to 3.38.1 — memory search truncation + persistence honesty fixes (ruv)
• 6b01dc5a6 chore(release): bump to 3.38.0 — ADR-382 init scaffold drift remediation (ruv)
• 6ce18b5a7 chore(release): bump to 3.37.0 — proxy fixes + new config flags (ruv)
• efd0406e7 chore: sync committed versions to already-published 3.36.0 / memory@alpha.22 (ruv)
• 4af1cfdde chore(release): bump to 3.35.0 — MetaHarness dependency-contract fix + ADR-381 sequential-evidence governance (#2957) (rUv)

test (2)

• 693385eab test(ci): keep safety guard root-compatible (ruv)
• b9a507729 test(cli): model atomic fs operations in MCP suite (ruv)

ci (2)

• f7672a104 ci: extend npm-ci-retry coverage to the OS-conditional fallback blocks (#3001) (rUv)
• 130193a37 ci: retry npm ci to absorb sharp/libvips transient download flakes (#2998) (rUv)

other (3)

• 45e65b5da release: align bundled runtime metadata for 3.38.11 (#3032) (rUv)
• 4384c0f3a release: prepare stable 3.38.10 train (#3029) (rUv)
• 0b3cfb77d MetaHarness hardening: repair the dependency contract + strict sequential promotion evidence (#2956) (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)