This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+14 more
ReleasePort's take
Light signalVersion v3.30.2 adds three functional checks to the "ruflo doctor --component memory" command and fixes CI env‑audit allowlist false positives for four environment variables.
Why it matters: The added health checks improve reliability of the memory component, while correcting CI pipeline false‑positive alerts that could block merges; both changes affect developers and SREs monitoring pipelines.
Summary
AI summaryUpdates Related, Deferred, and https://github.com/ruvnet/ruflo/issues/2677 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Adds three functional checks to "ruflo doctor --component memory". Adds three functional checks to "ruflo doctor --component memory". Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Low |
Fixes CI env-audit allowlist false positives for four environment variables. Fixes CI env-audit allowlist false positives for four environment variables. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
What
Ships @stuinfla's proposed doctor memory checks 1–3 from #2677. Bug fix release — no new user-facing surface, no breaking changes.
Doctor memory functional checks
Before v3.30.2: `ruflo doctor --component memory` was `existsSync` + `statSync` — could not fail on any file that exists. Reported PASS on a 99.97%-empty and even a SQLite-malformed DB per @stuinfla's 81-store fleet report.
After: existence check still runs (unchanged), plus three new checks that layer functional assertions:
- Memory Integrity — opens via sql.js + `PRAGMA integrity_check`
- Memory Content — >=95% of `memory_entries` rows have non-empty content
- Memory Embedding Coverage — >=95% of populated rows have a vector
Each check prints the exact measurement in the message ("content 3/11133 (0.03%)"), fails with a fix-suggestion, and handles the encrypted-DB case as WARN not PASS (per @stuinfla's "UNKNOWN is never PASS" rule).
Also fixed
CI env-audit allowlist entries for four escape hatches that were flagging on every PR:
- `RUFLO_AI_BUDGET_DIR` × 3 sites (#2663 repo-supervisor)
- `RUFLO_AI_BUDGET_DISABLE` (#2663 AI-cost fuse)
- `RUFLO_METAHARNESS_SKIP_LOCAL` (metaharness invoke shim)
- `RUFLO_HELPERS_LOCKED` (v3.30.0 .LOCKED marker escape hatch)
Deferred
- Check 4 (recall probe) — needs write+search+delete round-trip through the CLI's memory pipeline; its own PR
- Checks 5–8 (distillation, reflexion, skills, continuity) + the underlying distill→reflexion write-path fix — @stuinfla's own PR proposal
Related
Install
```bash
npx ruflo@latest doctor --component memory
or
npm install -g @claude-flow/[email protected]
```
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]