@claude-flow/cli 3.41.2 → 3.41.3

package/.claude/helpers/helpers.manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": "3.41.2",
+    "version": "3.41.3",
     "files": {
       "auto-memory-hook.mjs": "85fe05c757421c52137c0bc8545a0896bab6b4714538c2a11d1d0835bfcc8c1c",
       "hook-handler.cjs": "209d9fafe10e17d1be0866727f6f9cf9ac66f9a0793f1c793a4f58319e8e4583",
@@ -8,6 +8,6 @@
       "statusline.cjs": "4a48353b4f1566fa4379b00fd0321b6676a22b6cc91fbbd8380ac5183d619468"
     }
   },
-  "signature": "cmz1Yt39LkaWY+8JH1BOtqD27A3TYoFbpHnMGTpKZDzpuhgq1RQCF9P90z1yrnnStOSX0e01meDsHeRoGQgtAA==",
+  "signature": "YKF5dYIr74cL7hG0bQ8z6ygCZF4Atdhj79kRLOoCKLSO+o0pbUvs+4u9qQHN9Jig99FufZYKwvciYrE/85XaBA==",
   "algorithm": "ed25519"
 }

package/catalog-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "generation": 6,
-  "generatedAt": "2026-09-10T19:46:29.600Z",
-  "gitSha": "df87b0db",
+  "generatedAt": "2026-09-14T17:14:45.365Z",
+  "gitSha": "8008bc35",
   "catalog": {
     "agents": 167,
     "tools": 418,

package/dist/src/mcp-tools/x-federation-channels.js

@@ -88,13 +88,18 @@ function publishEvent(ws, nt, sk, tags, content) {
         ws.send(JSON.stringify(['EVENT', ev]));
     });
 }
-function reqEvents(ws, filter) {
+function reqEvents(ws, nt, filter) {
     const out = [];
     return new Promise((resolve) => {
         const t = setTimeout(() => resolve(out), 12000);
         ws.on('message', (d) => {
             const m = JSON.parse(d.toString());
-            if (m[0] === 'EVENT')
+            // Only a signature-verified event can be trusted as evidence of who sent
+            // it. Without this check an unverified EVENT frame — relay bug, MITM, or
+            // a compromised relay — would reach callers that treat .pubkey/.id as
+            // authenticated (channel_accept's NIP-44 conversation-key derivation,
+            // channel_read's returned identity).
+            if (m[0] === 'EVENT' && nt.verifyEvent(m[2]))
                 out.push(m[2]);
             else if (m[0] === 'EOSE') {
                 clearTimeout(t);
@@ -168,7 +173,7 @@ export const xFederationChannelTools = [
                 return degraded();
             const { sk, pubkey } = loadOrCreateKey(t.nt, KEY_FILE());
             const relay = RELAY_WS(i.relayWs);
-            const evs = await relayCall(relay, sk, t.nt, (ws) => reqEvents(ws, {
+            const evs = await relayCall(relay, sk, t.nt, (ws) => reqEvents(ws, t.nt, {
                 kinds: [1], '#t': ['ruflo-swarm'], '#k': ['ChannelGrant'], '#p': [pubkey],
                 since: Math.floor(Date.now() / 1000) - (i.sinceSeconds ?? 7 * 86400), limit: 200,
             }));
@@ -256,7 +261,7 @@ export const xFederationChannelTools = [
             if (!t)
                 return degraded();
             const { sk } = loadOrCreateKey(t.nt, KEY_FILE());
-            const evs = await relayCall(RELAY_WS(i.relayWs), sk, t.nt, (ws) => reqEvents(ws, {
+            const evs = await relayCall(RELAY_WS(i.relayWs), sk, t.nt, (ws) => reqEvents(ws, t.nt, {
                 kinds: [1], '#t': ['ruflo-swarm'], '#c': [i.channel],
                 since: Math.floor(Date.now() / 1000) - (i.sinceSeconds ?? 3600), limit: i.limit ?? 100,
             }));
@@ -266,9 +271,12 @@ export const xFederationChannelTools = [
                 const ev = e;
                 const k = ev.tags.find((x) => x[0] === 'k')?.[1];
                 const base = { id: ev.id, pubkey: ev.pubkey, created_at: ev.created_at };
+                // base's verified id/pubkey/created_at must win over the parsed/decrypted
+                // body — spread body first so a stray id/pubkey/created_at key in the
+                // publisher's own content can't override the authenticated identity.
                 if (k !== 'enc') {
                     try {
-                        return { ...base, ...JSON.parse(ev.content) };
+                        return { ...JSON.parse(ev.content), ...base };
                     }
                     catch {
                         return { ...base, raw: ev.content };
@@ -277,7 +285,7 @@ export const xFederationChannelTools = [
                 if (!key)
                     return { ...base, encrypted: true, reason: 'no channel key held' };
                 try {
-                    return { ...base, ...JSON.parse(t.nip44.v2.decrypt(ev.content, key)) };
+                    return { ...JSON.parse(t.nip44.v2.decrypt(ev.content, key)), ...base };
                 }
                 catch {
                     return { ...base, encrypted: true, reason: 'held key does not open this message' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.41.2",
+  "version": "3.41.3",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",