Starstruk Logo MarkStarstruk

v3.12.2

ruvnet/ruflov3.12.2Jun 17, 2026by ruvnet

AI Summary

A critical hotfix resolves a daemon proliferation issue causing kernel panics, while also fixing the `security cve` subcommand and hardening helper hooks.

Key Highlights

  • Critical fix: Resolved daemon proliferation causing macOS kernel panics by implementing atomic O_EXCL locks.
  • Security command: `security cve` now delegates to `npm audit` with filtering capabilities.
  • Hooks hardening: Improved `.claude/helpers/*` scripts with better timeout handling and cross-platform support.
  • Dependency updates: Updated Node.js and Vitest types and versions.

New Features

  • `security cve` subcommand with npm audit integration

Full Release Notes

## Bundled fixes

### #2407 — daemon proliferation → kernel panic (CRITICAL)
Atomic O_EXCL lockfile in `daemon.ts` + dropped the shell `&` in `init.ts:424`. Race test verified: 5 concurrent `daemon start` → 1 surviving daemon (was 3-5+).

One real incident accumulated **39 zombie daemons holding ~8.5 GiB** and contributed to a macOS kernel panic on June 15. No longer possible.

### #2403 — `security cve` no longer a stub
Now delegates to `npm audit --json` (same GitHub Advisory DB source as `security scan`), extracts CVE IDs from `via` titles/URLs, supports `--check CVE-XXXX-NNNN` and `--severity {critical,high,medium,low}` filters. Local verify on this repo: 37 affected packages surfaced.

### #2397 — `.claude/helpers/*` hooks hardening
Community contribution from @tjaiyen — 5 grounded bug fixes including real timeout via `Promise.race` (not the spurious "timer cleared on sync return" pattern), signal cleanup, truncation transparency, cross-platform slug normalization. 248+/49− across 8 files.

### Dependabot bumps (3/5 merged cleanly)
- `@types/node` 20.19.41 → 20.19.43 in `/v3/@claude-flow/browser`
- `vitest` 4.1.6 → 4.1.9 in `/v3/@claude-flow/browser` + `/plugins/ruflo-graph-intelligence`
- `agent-browser` 0.27.0 → 0.27.3 in `/v3/@claude-flow/browser`

(#2384 + #2386 had merge conflicts; dependabot will rebase.)

## Install

```bash
npx ruflo@3.12.2
# or
npm i ruflo@latest
```

## Compatibility

All 3 packages × 3 dist-tags published in lockstep:
- `@claude-flow/cli@3.12.2` — latest, alpha, v3alpha
- `claude-flow@3.12.2` — latest, alpha, v3alpha
- `ruflo@3.12.2` — latest, alpha, v3alpha

No API breaking changes. Patch bump per CLAUDE.md publishing policy.

🤖 Generated with [RuFlo](https://github.com/ruvnet/ruflo)