ruflo updates — week of 2026-07-19 (77 new commits, tip 12ede2176)

[github-actions]

ruvnet/ruflo — last 7 days

Window: since 2026-07-12 · Upstream tip: 12ede2176

feat (12)

• ca5c5cfc6 feat(proxy): default install to signed v0.4.0 (ruvnet)
• f52ab6e90 feat(proxy): integrate Cognitum auth and meta-proxy lifecycle (ruvnet)
• a0c1ac4b4 feat(doctor): add --fix-handles to kill orphaned conhost.exe on Windows (ruvnet)
• 35ceda351 feat(init): auto-register ruflo with skills.sh for cross-agent skill catalog (ruvnet)
• 3e9122a31 feat(routing): default to latest Claude 5/4.x models in tier map + init template (ruvnet)
• 74bc81f8e feat(adr-317): Phase 0 scaffold for developer revenue-share on the Cognitum funnel (#2676) (rUv)
• c89a98a4f feat(funnel,statusline): accept + open subcommands, whole-row-clickable promo, Windows flash mitigations (v3.29.0) (#2671) (rUv)
• dc015986d feat(adr): reconcile deleted ADRs — hard-delete primitive + drop-and-rebuild reindex (#2668) (rUv)
• dc625e8a9 feat(init): auto-detect OpenAI Codex CLI and configure its MCP server + skills (#2667) (rUv)
• f22088202 feat(daemon): repository supervisor, structured telemetry, budget CLI, migration warning (#2661) (#2663) (rUv)
• 9e596df5a feat(init): turn on persistent AgentDB memory by default (ruv)
• d0ac73d79 feat: Cognitum customer lifecycle funnel — ADR-301..310 + implementation (#2622) (rUv)

fix (31)

• 0a110aee9 fix(audit): register #2721's test-only hook env vars as escape hatches (ruvnet)
• bf8e76687 fix(witness): re-anchor #1862 marker + refresh manifests after #2721 (ruvnet)
• b68ad4ccb fix(plugins): make ruflo-core/ruflo-cost-tracker hooks Windows-native (#2721) (ruvnet)
• fb026a7bb fix(memory): memory_search omitted namespace no longer collapses to empty 'default' (ruvnet)
• 076ccf3fe fix(release): exclude security workspace artifacts (#2712) (rUv)
• 14c41d778 fix(auth): verify OAuth exports in security release (#2711) (rUv)
• 5c02b5cda fix(proxy): show actionable lifecycle guidance (#2710) (rUv)
• 5122b0e7d fix(release): build CLI artifacts before publishing (ruvnet)
• 3807c5c13 fix(security): ship zero-dependency defend fallback (ruvnet)
• e332689b8 fix(release): harden hooks, statusline, security, and plugin MCP integration (ruvnet)
• 9049e9578 fix(security): restore @claude-flow/aidefence optionalDep + fix swallowed output.error (Michael Perez)
• 9f6cf7d2a fix(security): statusline CVE counter reads real scan findings, not hardcoded 3 (#2694) (ruflo-loop)
• 49b36d7ac fix(cost): preserve memory JSON across Windows npx (ruvnet)
• 942de65de fix(codex): lazy-load stable adapter during init (ruvnet)
• 8f88e6af8 fix(codex): preserve annotated startup timeouts (ruvnet)
• d20f1323b fix(codex): ship stable Windows-safe Ruflo integration (ruvnet)
• 87101e28b fix(proxy): complete Windows OAuth service flow (ruvnet)
• 8306ad8fe fix(helper-refresh): also refresh ~/.claude/helpers so global statusline picks up new features (ruvnet)
• f00d78ffe fix(init): skip skills.sh re-registration if .agents/skills/ruflo already exists (ruvnet)
• 23abe26b9 fix(init): install only the canonical ruflo skill via skills.sh (not all 267) (ruvnet)
• 9dd999c93 fix(#2357): add sonnet-5 to the sampling-params rejection regex (ruvnet)
• 38d607902 fix(windows): hide console flash from detached hook-refresh spawn (ruvnet)
• 4a37e5517 fix(#2677): doctor memory — integrity + content + embedding-coverage checks (stuinfla checks 1-3) (#2681) (rUv)
• 30e41c23f fix(#2679): sync statusline-generator with committed helper (read+substitute pattern) (#2680) (rUv)
• 8161a088c fix(witness): regenerate + re-sign manifests to close out #2632 (ruv)
• b254e3215 fix(statusline): bake in the real CLI version, fixing the npx-only fallback (ruv)
• 6643d44d3 fix(statusline): pick highest local package version, not first-found (ruv)
• dbcfe15f3 fix(hooks,statusline): validate a real compiled dist before trusting a local CLI candidate (ruv)
• 87212ddbf fix(hooks): spawn funnel refresh from the inline hook-handler fallback (ruv)
• 215840536 fix(daemon): opt-in AI workers, global launch budget, cross-worktree dedup, stop --all (#2661) (#2662) (rUv)
• e803cb279 fix(statusline): remove Windows-breaking 2>/dev/null from CLI delegation (ruv)

docs (2)

• c316ce2f0 docs(claude.md): capture v3.29.0 publish-flow learnings — signing-key leak avoidance + Windows prepublishOnly hazard (ruvnet)
• 5ca9ce1bd docs: document helpers-signing key location + concurrent-session corruption risk (ruv)

chore (16)

• fb2f92bb2 chore(release): bump @claude-flow/cli, claude-flow, ruflo to 3.32.8 (ruvnet)
• 92744fd5f chore: regenerate v3/pnpm-lock.yaml for @claude-flow/security@alpha.12 (ruvnet)
• 099b8df13 chore(release): publish ruflo 3.32.3 (ruvnet)
• 1f7be650a chore(witness): keep partial builds out of temporal history (ruvnet)
• 0f6edf172 chore(witness): attest stable hook fallback (ruvnet)
• 72875da93 chore(release): prepare stable Ruflo 3.32.1 (ruvnet)
• 5fb503480 chore(release): bump claude-flow / @claude-flow/cli / ruflo to 3.30.2 (ruvnet)
• 5fa2a3ce6 chore(release): bump claude-flow / @claude-flow/cli / ruflo to 3.30.1 (ruvnet)
• fea1d9e95 chore(release): bump claude-flow / @claude-flow/cli / ruflo to 3.30.0 (ruvnet)
• 73914bd2b chore(data): clone snapshot ruflo updates — week of 2026-06-21 (180 new commits, tip 9c28fe038) #9 — 0 clones (14d) (ruflo-bot)
• 901a10d20 chore(release): bump claude-flow + ruflo to 3.28.0 (ruv)
• ca6f09bf2 chore(release): bump @claude-flow/cli to 3.28.0 (ruv)
• dcfd621d1 chore(release): bump claude-flow + ruflo to 3.27.4 (ruv)
• 700678557 chore(release): bump claude-flow + ruflo to 3.27.0 (ruv)
• 5dc991379 chore(release): bump @claude-flow/cli to 3.27.0 (ruv)
• eabf95304 chore(release): bump to 3.26.1 across cli/umbrella/wrapper (Windows statusline hotfix) (ruv)

test (5)

• a4a7d99c2 test(statusline): document hook-only identity setting (ruvnet)
• 1fb874005 test(plugins): preserve standalone MCP catalog assertions (ruvnet)
• 5e66f065e test(plugins): align namespace and stable hook shims (ruvnet)
• 25b16cfdf test(cost): confirm npx installs in fixtures (ruvnet)
• 6d685574b test(agentbbs): allow lazy runtime loading (ruvnet)

other (11)

• 12ede2176 Merge pull request #2725 from ruvnet/fix/2721-plugin-hooks-windows (rUv)
• 2a4db2672 Merge pull request #2723 from ruvnet/release/v3.32.8 (rUv)
• 030c8e5c1 Merge pull request #2722 from ruvnet/fix/memory-search-namespace-default (rUv)
• 59f5c7f9d Merge pull request #2720 from ruvnet/fix/pnpm-lockfile-drift (rUv)
• 4dd861b20 Merge pull request #2709 from ruvnet/hotfix/ruflo-cli-dist-3.32.4 (rUv)
• f9e0dcff4 Merge pull request #2708 from ruvnet/release/ruflo-3.32.3 (rUv)
• a3f692e72 Merge pull request #2707 from ruvnet/feat/meta-proxy-v0.4-default (rUv)
• 7541bf962 Merge pull request #2697 from ruvnet/feat/meta-proxy-integration (rUv)
• 61047df48 Merge pull request #2700 from ruvnet/fix/stable-issues-v3.32.2 (rUv)
• 81447ce79 Merge pull request #2698 from ruvnet/fix/codex-integration-stable (rUv)
• 0052b1b06 security: rotate helpers-signing key (RUFLO_HELPERS_PUBKEY v2) (#2673) (rUv)

---

Inspect a commit: git fetch upstream && git show <sha>
Diff a path: git diff upstream/main -- path/to/file
Port a commit: git cherry-pick <sha> (expect conflicts — no shared history)