claude-flow

v3.28.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 13d AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agentic-ai agentic-framework agentic-workflow agents ai-agents ai-assistant

+14 more

ai-coding ai-skills autonomous-agents claude-code codex harness mcp-server multi-agent multi-agent-systems npm skills swarm swarm-intelligence typescript

Affected surfaces

auth rbac

Summary

AI summary

Repository-level supervisor election, per-launch token telemetry, and budget control commands are added.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds repository-level supervisor and worktree lease system. Adds repository-level supervisor and worktree lease system. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Adds structured per-launch token telemetry via `claude --print --output-format json`. Adds structured per-launch token telemetry via `claude --print --output-format json`. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Medium	Adds `ruflo daemon budget show\|pause\|resume` commands for scriptable budget control. Adds `ruflo daemon budget show\|pause\|resume` commands for scriptable budget control. Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Low	Enhances `daemon status --all` with a "Repository Supervisors" panel. Enhances `daemon status --all` with a "Repository Supervisors" panel. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Removes transitive dependency on `semver` in `statusline-generator.ts`, using an inline resolver instead. Removes transitive dependency on `semver` in `statusline-generator.ts`, using an inline resolver instead. Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

Highlights

Closes the four remaining root-fix gaps from #2661 (PR #2663):

Repository-level supervisor + worktree leases (workspace-lease.ts, repo-supervisor.ts) — exactly one daemon per repository is elected supervisor and owns the recurring AI-worker schedule; every other worktree stays a lease-only participant (15-min TTL heartbeat) running cheap local-only workers. An explicit daemon trigger --headless still bypasses the gate (one-off user action, still budget/dedup-governed).
Structured per-launch token telemetry — claude --print --output-format json, parsed leniently via parseClaudePrintJsonEnvelope(), receipted through GlobalAiBudget.recordUsage(). Any schema mismatch degrades to "no usage captured," never breaks existing analysis-output parsing.
ruflo daemon budget show|pause|resume — independently scriptable budget control surface.
One-time upgrade migration warning — a pre-existing multi-daemon fleet with AI workers already enabled warns exactly once ever.

daemon status --all gains a "Repository Supervisors" panel.

Also fixes a real transitive-dependency fragility: statusline-generator.ts no longer pulls in the semver package just to resolve the CLI's own version — inlined a minimal, dependency-free version resolver instead.

Test plan

54 new tests across workspace-lease, repo-supervisor, claude-print-envelope, global-ai-budget, daemon-migration-warning-2661
636 relevant tests passing locally (services + daemon + commands-deep)
Full CI green on PR #2663 (one flaky, unrelated timing test in @claude-flow/hooks's trajectory-graph smoke passed on rerun)

Packages

| Package | Version |
|---|---|
| @claude-flow/cli | 3.28.0 |
| claude-flow | 3.28.0 |
| ruflo | 3.28.0 |

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track claude-flow

Get notified when new releases ship.

About claude-flow

Deploy multi-agent swarms with coordinated workflows.

All releases →