Starstruk Logo MarkStarstruk

v3.5.14

ruvnet/ruflov3.5.14Mar 6, 2026by ruvnet

AI Summary

This release (v3.5.14) focuses on critical security hardening and Windows cross-platform compatibility. It implements 5 security fixes (ADR-061) including replacing execSync with execFileSync, adding buffer size limits, and input validation for plugin names and IPFS CIDs. Additionally, it addresses Windows hook stability issues (ADR-062) by using `node script subcommand` patterns and adding 500ms stdin timeouts.

Key Highlights

  • Security hardening: replaced execSync with execFileSync and added 10MB MAX_BUFFER to prevent command injection and unbounded stdout
  • Added input validation for plugin names (validatePackageName()) and IPFS CID format before network requests
  • Windows compatibility fix: hook commands now use `node script subcommand` pattern with `cmd /c` prefix to prevent stdin pipe hanging
  • Fixed 7 correctness issues including CFP magic-number check, MCP partial-JSON buffering, and GCS credential loading
  • Test coverage expanded to 1600 tests across 23 suites with 10 new deep test suites

New Features

  • Security: execFileSync replaces execSync for GCS storage to prevent command injection
  • Security: 10MB MAX_BUFFER constant prevents unbounded stdout capture
  • Security: validatePackageName() sanitizes plugin names before shell use
  • Security: IPFS CID format validation before network requests
  • Security: Buffer size limits added to all execSync calls
  • Windows: Hook commands use `node script subcommand` to avoid shell quoting issues
  • Windows: `cmd /c` prefix bypasses PowerShell stdin pipe hanging
  • Windows: 500ms stdin timeout prevents hanging
  • Windows: process.exitCode = 0 guaranteed in all hook scripts
  • Fix: SubagentEnd → SubagentStop hook event name corrected
  • Restore: Valid SubagentStart hook event restored

Full Release Notes

## v3.5.14 (2026-03-06)

### Security Fixes (ADR-061)
- **S-1**: Replace `execSync` with `execFileSync` to prevent command injection in GCS storage
- **S-2**: Add `MAX_BUFFER` constant (10MB) to prevent unbounded stdout capture
- **S-3**: Add `validatePackageName()` to sanitize plugin names before shell use
- **S-4**: Add IPFS CID format validation before network requests
- **S-5**: Add buffer size limits to all `execSync` calls

### Correctness Fixes (ADR-061)
- **D-1**: Fix CFP magic-number check (use `subarray`, not `slice`)
- **D-2**: Fix unsupported format error (throw instead of silent fallback)
- **D-3**: Fix MCP partial-JSON accumulator (per-session buffering)
- **D-4**: Fix duplicate provider registration guard
- **D-5**: Fix memory namespace parameter passthrough
- **D-6**: Fix process command error handler (use `err.message`)
- **D-7**: Fix GCS credential loading (resolve path, validate fields)

### Cross-Platform Windows Hooks (ADR-062)
- Hook commands use `node script subcommand` (no shell quoting issues)
- `cmd /c` prefix on Windows bypasses PowerShell stdin pipe hanging
- StatusLine uses plain `node` (no `cmd /c`) for proper stdin forwarding
- 500ms stdin timeout prevents Windows hanging
- `process.exitCode = 0` guaranteed in all hook scripts
- Fix invalid `SubagentEnd` → `SubagentStop` hook event name
- Restore valid `SubagentStart` hook event

### Testing
- 1600 tests passed across 23 test suites
- 10 new deep test suites covering security, plugins, MCP tools, memory, CLI parsing

### Packages
| Package | Version | Install |
|---------|---------|---------|
| `@claude-flow/cli` | 3.5.14 | `npx @claude-flow/cli@latest` |
| `claude-flow` | 3.5.14 | `npx claude-flow@latest` |
| `ruflo` | 3.5.14 | `npx ruflo@latest` |

### Upgrade
```bash
npx ruflo@latest init
# or
npx claude-flow@latest init
```

This regenerates `.claude/settings.json` with cross-platform hook commands.