v3.5.78

## Ruflo v3.5.78

**The most stable Ruflo release yet.** This release eliminates an entire class of ESM module crashes, hardens security across 6 packages, introduces native intelligence backends, and resolves 10 user-reported critical issues.

34 commits, 145 files changed, ~8,000 lines of improvements since v3.5.59.

### Install / Upgrade

```bash
npx ruflo@3.5.78 --version        # one-shot
npx @claude-flow/cli@3.5.78 doctor # health check
```

All three packages updated on npm (`alpha`, `latest`, `v3alpha`):
- [`@claude-flow/cli@3.5.78`](https://www.npmjs.com/package/@claude-flow/cli)
- [`claude-flow@3.5.78`](https://www.npmjs.com/package/claude-flow)
- [`ruflo@3.5.78`](https://www.npmjs.com/package/ruflo)

---

### Critical Bug Fixes

#### ESM Module Crash Elimination
The entire codebase has been audited and purged of bare `require()` calls that crash in ESM mode (`"type": "module"`). **29 total `require()` calls fixed** across two rounds:

| Round | PR / Commit | Files Fixed | Calls Fixed |
|-------|-------------|-------------|-------------|
| 1 | #1564 (v3.5.77) | `autopilot-state.ts`, `autopilot.ts`, `claims.ts` | 12 |
| 2 | v3.5.78 | `diff-classifier.ts`, `coverage-router.ts`, `performance-tools.ts`, `mcp-server.ts`, `checker.ts`, `security.ts` | 17 |

**Before:** `ruflo autopilot status`, `ruflo claims list`, diff analysis, coverage routing, performance profiling, security scanning, and update checking all crashed with `ReferenceError: require is not defined`.

**After:** Every runtime code path uses proper ESM `import` statements or the `createRequire` pattern for native modules.

Closes #1559, #1560, #1561, #1563.

#### `cleanup --force` No Longer Destroys User Config (#1557)
Previously, `cleanup --force` deleted the entire `.claude/` directory — wiping agents, skills, commands, settings, memory databases, and worktrees that belong to Claude Code, not Ruflo.

**Now:** Only Ruflo-owned paths are cleaned (`.claude/helpers/`), and `settings.json` is surgically edited to remove only `hooks` and `claudeFlow` keys while preserving all user configuration.

#### CLI One-Shot Commands No Longer Hang (#1552, #1550)
`memory store`, `memory retrieve`, `config list`, and other one-shot commands hung indefinitely due to open handles (MCP listeners, timers, SQLite connections) keeping the event loop alive. Fixed with `process.exit(0)` after `cli.run()` resolves.

#### Daemon Zombie Prevention (#1551)
`daemon stop` now scans running processes via `ps` and kills stale daemon instances — not just the PID stored in the PID file. `daemon start` also cleans up zombies before launching and shows a clear error if a daemon is already running.

#### Memory Bridge Respects `CLAUDE_FLOW_CWD` (#1562)
MCP memory tools under Claude Desktop were reading/writing to the wrong directory because `auto-memory-bridge.ts` hardcoded `process.cwd()`. Now respects the `CLAUDE_FLOW_CWD` environment variable.

---

### Security Hardening (PR #1558)

Comprehensive security and performance fixes across 6 packages:

- **SQL injection prevention** — All sql.js queries converted to parameterized `db.prepare` / `bind` statements
- **Command injection prevention** — Replaced `execSync` with `execFileSync` (no shell interpretation) throughout
- **Prototype pollution prevention** — JSON reviver strips `__proto__`, `constructor`, `prototype` keys
- **HNSW hash collision safety** — Added dual-hash (djb2 + sdbm) and 1,000-probe cap with explicit error on exhaustion
- **BoundedSet FIFO eviction** — Uses `Map` insertion order for correct FIFO behavior
- **Resilient bulk operations** — `Promise.allSettled` for operations that shouldn't fail atomically
- **PID validation** — `Number.isInteger` guard before process operations

---

### New Features

#### Native RuVLLM + Graph-Node Intelligence Backends (ADR-086, ADR-087)
New native intelligence backends for the RuVector system:
- **RuVLLM backend** — Direct integration with local LLM inference
- **Graph-Node backend** — Graph-based intelligence routing for complex reasoning chains

#### DiskANN Vector Search Backend (ADR-077)
Research-grade vector search with:
- **8,000x faster insert** than HNSW for large datasets
- **Perfect recall** on benchmark suites
- SSD-optimized for datasets that exceed RAM

#### Claude Code ↔ AgentDB Memory Bridge (ADR-076)
Phase 2 MCP tools for bridging Claude Code's auto-memory with AgentDB:
- `memory_import_claude` — Import Claude Code memories with 384-dim ONNX embeddings
- `memory_bridge_status` — Bridge health monitoring
- `memory_search_unified` — Semantic search across all namespaces

#### Self-Learning Pipeline (ADR-075)
End-to-end wiring of the self-learning pipeline:
- Pattern recording from successful task completions
- Neural training on discovered patterns
- Cross-session knowledge transfer

#### saveCheckpoint Resilience (v3.5.75)
Checkpoint save now verifies file existence and falls through to JS fallback on native module failures.

---

### Quality & Honesty

- **README honesty audit** — Removed fabricated metrics and inflated claims; all stats now reference real benchmarks
- **Stub elimination** — 9 remaining stub implementations replaced with real scanning, metrics, and health checks
- **Comprehensive #1425 remediation** — Real quantization, honest performance stubs, input validation at system boundaries
- **Statusline accuracy** — Replaced all fake heuristics with real data sources from hook activity and AgentDB stats

---

### Issues Closed (10)

| Issue | Title |
|-------|-------|
| #1559 | Bare `require()` in ESM modules — autopilot/claims crash |
| #1560 | ESM/CJS regression (dup of #1559) |
| #1561 | Autopilot `require is not defined` (dup of #1559) |
| #1563 | Autopilot/claims fail on fresh install (dup of #1559) |
| #1557 | `cleanup --force` deletes entire `.claude/` directory |
| #1552 | CLI one-shot commands hang indefinitely |
| #1551 | Daemon processes accumulate as zombies |
| #1550 | Memory subcommands hang (same root cause as #1552) |
| #1562 | Memory commands ignore `CLAUDE_FLOW_CWD` |
| #1558 | Security & performance fixes across 6 packages |

---

### Stats

```
34 commits
145 files changed
7,966 insertions(+), 2,333 deletions(-)
29 bare require() calls eliminated
6 packages security-hardened
10 issues resolved
3 npm packages published (alpha, latest, v3alpha)
```

---

**Full Changelog**: https://github.com/ruvnet/ruflo/compare/v3.5.59...v3.5.78