chore(deps-dev): bump ruflo from 3.5.48 to 3.11.0

[dependabot]

Bumps ruflo from 3.5.48 to 3.11.0.

Release notes

Sourced from ruflo's releases.

v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits

Merged PR #2398 (squash).

Highlights

• Router (v3/@​claude-flow/cli): ADR-148 FastGRNN router artifact lifecycle, ADR-149 per-model cost-optimal routing, Map<task_hash> dedup fixes across decisions/cost-savings/cost-projection.
• Cost-tracker plugin: forward observability stack — projection / counterfactual / burn / anomaly (MAD) / health (composite gate) / diff (PR regression) / session (per-message drill-down). Stop-hook auto-track. Snapshot git-context.
• Cache-write visibility: closed at four layers (per-message, time-series, summary, diff) — cache_creation_input_tokens was the silent cost driver.
• Fleet-wide CI: meta-smoke runner across 32 plugins (402+ structural invariants), exit-bypass antipattern lint, SKILL.md frontmatter audit (117 files), plugin.json manifest audit (34 files), per-plugin timeout/--fail-fast.

Install

npx ruflo@latest           # latest stable
npx @claude-flow/cli@latest

Legacy alpha and v3alpha dist-tags also updated to 3.11.0.

v3.10.46 — stale claude-flow@v3alpha references swept (@​dskarasev community batch)

Patch release shipping the @​dskarasev community bug batch from PR #2375 — three related runtime references to the deprecated claude-flow@v3alpha (or claude-flow@alpha) dist-tag that survived the claude-flow → ruflo rename. Each was silently routing users / workers / detection at a pre-rename build that lacks autopilot, browser, wasm-agent, and other current MCP tools.

Fixes

#2369 — legacy MCP key detection + Scenario A warning

Scenario A (the silent-failure mode): if a user's project directory already has an .mcp.json from a pre-rename install, writeMCPConfig was early-returning with a generic skipped message. The user was left with an MCP server pointed at a pre-rename build and zero indication anything was wrong — "autopilot tools missing after init" was the most common downstream symptom. Now: writeMCPConfig parses the existing file, detects stale keys, and surfaces:

.mcp.json (existing file uses deprecated key 'claude-flow@alpha' —
autopilot/browser/wasm-agent tools will be missing; delete .mcp.json
and re-run, or re-run with --force to overwrite)

Scenario B (the original report): detectExistingRufloMCP only recognised 'claude-flow' and 'ruflo' as already-registered keys, so a stale claude-flow@alpha entry in a parent directory wasn't detected. Init would walk past it and write a NEW claude-flow-keyed entry — both servers then ran simultaneously under different prefixes (mcp__claude-flow@alpha__* and mcp__claude-flow__*), producing duplicate-tool noise. Now: both legacy keys are recognised in both the top-level mcpServers and project-scoped registration paths.

#2370 — swarm.ts MCP-down hint

swarm_init failure hint changed from:

claude mcp add claude-flow npx claude-flow@v3alpha mcp start

to:

claude mcp add claude-flow -- npx -y ruflo@latest mcp start

The -- separator avoids claude-mcp flag ambiguity; the -y forces a fresh fetch so npx doesn't pick a stale local install.

... (truncated)

Commits

• 5625d56 v3.11.0 — router ADR-148/149 + cost-tracker observability + fleet audits (#2398)
• c530838 chore(release): bump claude-flow / @​claude-flow/cli / ruflo to 3.10.46
• 4cbcfc2 chore(release): bump claude-flow / @​claude-flow/cli / ruflo to 3.10.45
• 6ec7268 chore(release): bump claude-flow / @​claude-flow/cli / ruflo to 3.10.44
• 53cab89 chore(release): bump claude-flow / @​claude-flow/cli / ruflo to 3.10.43
• d1e558b docs(readme): propagate image removal to mirror READMEs
• a88b936 chore(release): bump claude-flow / @​claude-flow/cli / ruflo to 3.10.42
• 6a2964a chore(release): bump claude-flow / @​claude-flow/cli / ruflo to 3.10.41
• 4b9b3ba fix(statusline): regenerate committed artifact after #2331 generator changes
• 5c2875a docs: fix typo 'ruvflo' -> 'ruflo' in install instructions (#2328)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.