Starstruk Logo MarkStarstruk

v3.39.3

ruvnet/ruflov3.39.3Sep 9, 2026by ruvnet

AI Summary

A patch release fixing CLI detection issues for federation tools and hardening probe shell logic. It fixes tools incorrectly reporting as degraded and updates test dependencies.

Key Highlights

  • Fixed `federation_bbs_*` tools (register, publish, watch, human_join) that were incorrectly reporting as degraded due to an unresolvable import.
  • Hardened probe shell by gating shell execution to Windows (win32) to prevent potential command injection on POSIX systems.
  • Removed externalization of `@noble/ed25519` in tests to fix dynamic-import resolution under Vite's SSR transform.
  • Enabled Phase 1 local room/envelope surface functionality when agentbbs is genuinely installed.

New Features

  • Restored functionality for local room/envelope surface handling when agentbbs is installed.

Full Release Notes

Patch release shipping [#3250](https://github.com/ruvnet/ruflo/pull/3250).

### Fixed
- **`federation_bbs_*` tools were unconditionally degraded.** All four tools (`register` / `publish` / `watch` / `human_join`) gated on `await import('agentbbs')`. The published `agentbbs` package is a CLI-only launcher ā€” its tarball contains only `bin/agentbbs.js`, `package.json` and `README.md`, with no `main`, no `exports`, and no root `index.js` for Node to fall back to. That import could never resolve, so the tools reported `degraded: true` no matter whether agentbbs was installed and working. Replaced with a subprocess presence probe.
- **Probe shell gated to win32.** The follow-up hardening: `shell: true` was unconditional while the probed binary comes from `AGENTBBS_BIN`, and under a shell that argument is command-interpreted ā€” a crafted value ran a trailing command (verified locally). POSIX now spawns without a shell; Windows keeps cmd.exe so the `agentbbs.cmd` shim still resolves via PATHEXT. Matches the existing convention in `browser-tools.ts`, `commands/init.ts` and `init/helpers-generator.ts`.
- **`@noble/ed25519` no longer externalized in tests.** It is a hard dependency of `@claude-flow/cli`, not an optional one, and externalizing it broke dynamic-import resolution under Vite's SSR transform.

### Scope
This makes the Phase 1 local room/envelope surface functional when agentbbs is genuinely installed. It does not implement cross-host federation ā€” that remains Phase 2+.

### Install
```
npx ruflo@latest
```
All three packages (`@claude-flow/cli`, `claude-flow`, `ruflo`) are at 3.39.3 on `latest`, `alpha`, and `v3alpha`.

šŸ¤– Generated with [RuFlo](https://github.com/ruvnet/ruflo)

https://claude.ai/code/session_013u4pmL9ZUAXb6usVQgNo67