claude-flow 3.56.2 → 3.56.4

package/v3/@claude-flow/cli/dist/src/ruvector/graph-analyzer.js

@@ -494,6 +494,17 @@ function fallbackLouvain(nodes, edges) {
     let improved = true;
     const maxIterations = 10;
     let iteration = 0;
+    // Community total weighted degree. Maintained incrementally (±nodeDegree on
+    // each accepted move) rather than rebuilt from a full scan of `community`
+    // inside the per-node loop below — the rebuild was O(n) per node (O(n^2) per
+    // pass), matching neither the reference Louvain implementations (networkx's
+    // `Stot`, python-louvain's `status.degrees`, both updated in O(1) per move)
+    // nor the algorithm's own linear-on-sparse-data design intent.
+    const communityTotal = new Map();
+    for (const node of nodes) {
+        const c = community.get(node);
+        communityTotal.set(c, (communityTotal.get(c) || 0) + (degree.get(node) || 0));
+    }
     while (improved && iteration < maxIterations) {
         improved = false;
         iteration++;
@@ -507,17 +518,16 @@ function fallbackLouvain(nodes, edges) {
                 const neighborCommunity = community.get(neighbor);
                 communityWeights.set(neighborCommunity, (communityWeights.get(neighborCommunity) || 0) + weight);
             }
-            // Calculate community totals
-            const communityTotal = new Map();
-            for (const [n, c] of Array.from(community.entries())) {
-                communityTotal.set(c, (communityTotal.get(c) || 0) + (degree.get(n) || 0));
-            }
             let bestCommunity = currentCommunity;
             let bestGain = 0;
             for (const [targetCommunity, edgeWeight] of Array.from(communityWeights.entries())) {
                 if (targetCommunity === currentCommunity)
                     continue;
-                // Calculate modularity gain
+                // Calculate modularity gain. `currentTotal` still includes this
+                // node's own degree (not yet removed) — the `+ nodeDegree` term
+                // below backs it out, so `communityTotal` must stay un-patched for
+                // `node` until after the move decision, matching the pre-existing
+                // formula this complexity fix leaves unchanged.
                 const currentTotal = communityTotal.get(currentCommunity) || 0;
                 const targetTotal = communityTotal.get(targetCommunity) || 0;
                 const currentEdges = communityWeights.get(currentCommunity) || 0;
@@ -530,6 +540,8 @@ function fallbackLouvain(nodes, edges) {
             }
             if (bestCommunity !== currentCommunity) {
                 community.set(node, bestCommunity);
+                communityTotal.set(currentCommunity, (communityTotal.get(currentCommunity) || 0) - nodeDegree);
+                communityTotal.set(bestCommunity, (communityTotal.get(bestCommunity) || 0) + nodeDegree);
                 improved = true;
             }
         }

package/v3/@claude-flow/cli/dist/src/transfer/ipfs/client.js

@@ -264,7 +264,9 @@ export async function verifyEd25519Signature(message, signature, publicKey) {
         const ed = await import('@noble/ed25519');
         // Handle prefixed public key (e.g., "ed25519:abc123...")
         const pubKeyHex = publicKey.replace(/^ed25519:/, '');
-        const isValid = await ed.verifyAsync(Buffer.from(signature, 'hex'), new TextEncoder().encode(message), Buffer.from(pubKeyHex, 'hex'));
+        // RFC 8032 strict mode: rejects small-order public keys, against which
+        // signatures can be forged under the library's default ZIP-215 rules.
+        const isValid = await ed.verifyAsync(Buffer.from(signature, 'hex'), new TextEncoder().encode(message), Buffer.from(pubKeyHex, 'hex'), { zip215: false });
         return isValid;
     }
     catch (error) {

package/v3/@claude-flow/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.56.2",
+  "version": "3.56.4",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",
@@ -100,10 +100,10 @@
   "dependencies": {
     "@claude-flow/cli-core": "3.7.0",
     "@claude-flow/codex": "3.0.3",
-    "@claude-flow/mcp": "3.1.0",
+    "@claude-flow/mcp": "3.1.1",
     "@claude-flow/neural": "3.0.0",
     "@claude-flow/plugin-agent-federation": "1.0.1",
-    "@claude-flow/security": "3.0.3",
+    "@claude-flow/security": "3.0.4",
     "@claude-flow/shared": "3.0.2",
     "@iarna/toml": "^2.2.5",
     "@noble/ed25519": "2.3.0",
@@ -125,17 +125,17 @@
     "ws": "^8.21.0",
     "yaml": "^2.8.0",
     "zod": "^3.22.0",
-    "@claude-flow/memory": "3.0.2"
+    "@claude-flow/memory": "3.0.4"
   },
   "optionalDependencies": {
     "@agntcy/slim-bindings": "2.0.0-alpha.5",
-    "@claude-flow/memory": "3.0.2",
+    "@claude-flow/memory": "3.0.4",
     "@metaharness/darwin": "~0.10.2",
     "@metaharness/flywheel": "~0.1.10",
     "@metaharness/radio": "~0.1.0",
     "@metaharness/turn-credit": "~0.1.0",
     "@napi-rs/keyring": "1.3.0",
-    "agentdb": "^3.0.0-alpha.17",
+    "agentdb": "^3.0.0-alpha.20",
     "agentic-flow": "^3.0.0-alpha.1",
     "better-sqlite3": "^12.9.0",
     "ruvector": "^0.2.27",