Starstruk Logo MarkStarstruk

v3.5.48

ruvnet/ruflov3.5.48Mar 26, 2026by ruvnet

AI Summary

This release (v3.5.48) delivers significant security hardening with prototype pollution prevention, NaN/Infinity bypass protection, and task source allowlisting. It also addresses token drain issues by reducing background workers and changing defaults to opt-in, while fixing critical P1 bugs including HNSW ghost entries and orphan processes. The release exposes new RuVector WASM CLI commands and includes an audit/improvement plan (ADR-067).

Key Highlights

  • Security hardening: prototype pollution prevention via safeJsonParse(), NaN/Infinity bypass protection, task source allowlist, and atomic file writes
  • Token drain prevention: daemon autoStart and session hook startDaemon now default to false (opt-in), background workers reduced from 10 to 3
  • P1 bug fixes: HNSW index invalidation on delete (#1122), worker timeout increased from 5min to 16min for orphan processes (#1117)
  • RuVector WASM CLI exposure: 4 new commands (wasm-status, wasm-create, wasm-prompt, wasm-gallery) per ADR-067
  • All 1725 tests pass across 28 test files

Breaking Changes

  • Daemon autoStart now defaults to false (was likely true by default) — requires explicit opt-in
  • Session hook startDaemon now defaults to false — requires explicit opt-in
  • Background workers reduced from 10 to 3 — may impact performance for heavy workloads
  • Worker timeout increased from 5min to 16min — longer wait for stale worker cleanup

New Features

  • safeJsonParse() strips __proto__, constructor, prototype to prevent prototype pollution
  • validateNumber() includes NaN/Infinity bypass protection
  • VALID_TASK_SOURCES allowlist prevents task source injection
  • Atomic file writes (tmp + rename) for state persistence
  • Shared autopilot-state.ts module eliminates 140 lines of code duplication
  • HNSW index invalidation on bridge delete to fix ghost entries
  • 4 new CLI commands: agent wasm-status, agent wasm-create, agent wasm-prompt, agent wasm-gallery
  • ADR-067: RuVector WASM utilization audit and improvement plan

Full Release Notes

## What's New

### Security Hardening (v3.5.45)
- Prototype pollution prevention via `safeJsonParse()` — strips `__proto__`, `constructor`, `prototype`
- NaN/Infinity bypass protection in `validateNumber()`
- Task source allowlist (`VALID_TASK_SOURCES`) prevents injection
- Atomic file writes (tmp + rename) for state persistence
- Shared `autopilot-state.ts` module eliminates 140 lines of duplication

### Token Drain Prevention (v3.5.46) — #1427, #1330
- Daemon `autoStart` defaults to `false` (opt-in only)
- Session hook `startDaemon` defaults to `false`
- Background workers reduced 10 → 3, schedules relaxed (audit 4h, optimize 2h)

### P1 Bug Fixes (v3.5.47)
- **#1122**: HNSW ghost entries — bridge delete path now invalidates HNSW index
- **#1117**: Orphan processes — worker timeout raised 5min → 16min
- **#1111**: Headless stdin pipe hang — already fixed (closed)
- **#1109**: classifyHandoffIfNeeded — Claude Code platform issue (closed)

### RuVector WASM CLI Exposure (v3.5.48)
- **ADR-067**: RuVector WASM utilization audit and improvement plan
- 4 new CLI commands: `agent wasm-status`, `agent wasm-create`, `agent wasm-prompt`, `agent wasm-gallery`
- Fixed 16 pre-existing ruvllm-wasm test failures (mock constructors)

## Test Results
- 28/28 test files pass
- 1725/1725 tests pass, 0 failures

## Install
```bash
npx @claude-flow/cli@latest
npx claude-flow@latest
npx ruflo@latest
```