Skip to content

claude-flow

v3.32.9 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agentic-ai agentic-framework agentic-workflow agents ai-agents ai-assistant
+14 more
ai-coding ai-skills autonomous-agents claude-code codex harness mcp-server multi-agent multi-agent-systems npm skills swarm swarm-intelligence typescript

Affected surfaces

deps breaking_upgrade

Summary

AI summary

Updates Statusline, Test plan, and Also fixed during validation across a mixed release.

Full changelog

Summary

Patch release — statusline accuracy + memory/SQLite integrity fixes.

Statusline

  • #2733hooks statusline CLI subcommand hardcoded the model name to 'Opus 4.6 (1M context)' regardless of the actual active model. Now reads it from stdin (matching the generated helper's own behavior), falling back to "Claude Code" — not a fake model name — when stdin has no model field.
  • #2742getPkgVersion() in the generated statusline.cjs missed the project install when CWD is a linked git worktree (no local node_modules), silently falling back to a stale baked-in version. Now walks up from CWD to find the worktree's .git file, resolves the main repo root from its gitdir: pointer, and probes that root's install too.

Memory / SQLite data integrity

  • #2736agentdb's better-sqlite3 floor (^11.8.1) bundled vulnerable SQLite 3.49.2 (documented WAL-reset bug), coexisting with this repo's own patched 12.9.0 copy in a mixed-engine tree. Deduplicated to a single patched build (12.9.0, SQLite 3.53.0) tree-wide via overrides across all four package.json files, with regenerated lockfiles.
  • #2735 — Memory CRUD's sql.js fallback path silently degraded to a whole-image rename()-over-the-live-file write, which can corrupt a WAL database under a concurrent native writer. Now refuses that unsafe path (success: false, typed error) when -wal/-shm sidecar files indicate a live native connection, and logs sql.js-fallback demotions instead of failing silently.
  • #2737 — The default doctor run never executed its memory integrity checks — a corrupt database still reported "All checks passed! System is healthy." Wired the real structural/integrity checks into the default run.

Also fixed during validation

  • A WAL-checkpoint-on-close timing race in graph-edge-writer.ts, made newly reproducible on Linux CI by the better-sqlite3 dedup (forcing a single exact build made a previously-masked best-effort checkpoint's timing sensitivity visible). Now forces a blocking wal_checkpoint(TRUNCATE) before close.
  • An npm EOVERRIDE conflict in @claude-flow/cli/package.json between a new direct better-sqlite3 dependency and a self-referential override with a mismatched version spec.

Test plan

  • [x] v3-ci.yml green on main post-merge (all four PRs individually green, plus the merged result)
  • [x] New regression tests: issue-2733-statusline-model-name.test.ts, issue-2742-statusline-worktree-version.test.ts, issue-2735-memory-wal-sidecar-guard.test.ts, doctor-2737-memory-structural.test.ts
  • [x] npm view @claude-flow/cli@latest / claude-flow@latest / ruflo@latest all report 3.32.9, with latest === alpha === v3alpha on all three packages

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track claude-flow

Get notified when new releases ship.

Sign up free

About claude-flow

Deploy multi-agent swarms with coordinated workflows.

All releases →

Related context

Beta — feedback welcome: [email protected]