Starstruk Logo MarkStarstruk

v3.5.3

ruvnet/ruflov3.5.3Mar 5, 2026by ruvnet

AI Summary

Patch release v3.5.3 addressing 11 issues including critical supply-chain security fix (removed obfuscated preinstall script), RVF ObjectId cross-package matching, and complete branding migration from Claude Flow to RuFlo. Also includes AgentDB runtime activation and MCP schema compliance fixes.

Key Highlights

  • Critical security fix: removed obfuscated preinstall script (#1261) eliminating supply-chain risk
  • Complete branding overhaul: Claude Flow V3 → RuFlo V3 across CLI, statusline, README, and 20+ command files
  • RVF ObjectId cross-package matching fixed for correct conversation data retrieval
  • AgentDB ControllerRegistry wired: ReasoningBank, SkillLibrary, ExplainableRecall now active at runtime
  • MCP schema compliance: 13 schemas fixed with proper `items` field across 7 tool files

New Features

  • Branding migration from Claude Flow to RuFlo across all UI surfaces
  • Hooks path resolution now uses `git rev-parse --show-toplevel` for absolute paths
  • MCP version string now reads from package.json at runtime
  • Empty web_search query validation prevents 400 errors
  • Settings deduplication on startup removes duplicate entries
  • Removed superseded packages: docs/ruvector-postgres and packages/coflow

Full Release Notes

## RuFlo v3.5.3

Patch release addressing 11 issues from ADR-059 bug triage, branding updates, and stale code cleanup.

### Bug Fixes

#### P0 — Critical
- **Removed obfuscated preinstall script** (#1261) — supply-chain security risk eliminated
- **RVF ObjectId cross-package matching** (#1297) — conversation lookups now return correct data

#### P1 — High
- **Hooks path resolution** (#1259, #1284) — all hook commands use `git rev-parse --show-toplevel` for absolute paths
- **AgentDB ControllerRegistry wiring** (#1264) — ReasoningBank, SkillLibrary, ExplainableRecall now active at runtime
- **MCP array schema compliance** (#1294) — 13 schemas fixed with `items` field across 7 tool files

#### P2 — Medium
- **MCP version string** (#1253) — reads from `package.json` at runtime instead of hardcoded `3.0.0-alpha`
- **MCP branding** (#1280) — identifies as `ruflo` instead of `claude-flow`
- **Statusline branding** (#1254) — `Claude Flow V3` → `RuFlo V3`
- **Chat UI web_search** — empty query validation prevents 400 errors
- **Chat UI settings dedup** — removes duplicate settings entries on startup

### Branding
- Statusline: `Claude Flow V3` → `RuFlo V3` (single-line and multi-line modes)
- 20+ CLI command files updated: `Claude Flow V3` → `RuFlo V3`
- README title updated to `RuFlo v3.5`
- Settings version: `3.0.0` → `3.5.2`

### Cleanup
- Removed `docs/ruvector-postgres/` (superseded by AgentDB)
- Removed `packages/coflow/` (superseded by `@claude-flow/cli`)

### npm Packages

| Package | Version | Install |
|---------|---------|---------|
| `@claude-flow/cli` | 3.5.3 | `npx @claude-flow/cli@latest` |
| `claude-flow` | 3.5.3 | `npx claude-flow@latest` |
| `ruflo` | 3.5.3 | `npx ruflo@latest` |

### Validation

All fixes verified via Docker regression testing:
- ✅ TypeScript compilation clean
- ✅ Docker build succeeds
- ✅ Conversation isolation (distinct IDs return distinct data)
- ✅ MCP bridge healthy
- ✅ Empty web_search handled gracefully
- ✅ All static assets return 200

**Full Changelog**: https://github.com/ruvnet/ruflo/compare/v3.5.2...v3.5.3