ruflo v3.32.38

Ruflo v3.32.38: Daemons Start Only for Ruflo Projects

Ruflo v3.32.38 fixes a background-process leak discovered during the post-release audit: a read-only command in a directory containing only a Claude Code .claude/ folder could start a detached Ruflo daemon.

The trigger was subtle. Signed-champion startup migration created a .claude-flow/ state directory, and daemon auto-start then mistook that startup-created directory for prior user initialization. Repeated commands in unrelated Claude projects could therefore accumulate one daemon per directory.

Install or upgrade

npm install --global ruflo@3.32.38
ruflo --version

What changed

Daemon auto-start now requires a durable Ruflo project marker:

• a Ruflo runtime config under .claude-flow/;
• a legacy claude-flow.config.json;
• an initialized .swarm/memory.db;
• a Ruflo-specific Claude settings section; or
• a Ruflo/Claude Flow MCP server entry.

A generic .claude/ directory, an empty .claude-flow/ directory, or policy state created during the current startup no longer authorizes a detached process. Explicit ruflo daemon start remains available everywhere, and initialized Ruflo projects retain automatic background workers.

Validation

• The exact issue reproduction was run against 3.32.37 and produced a daemon.
• The same reproduction against the patched build produced no process and no daemon PID file, even though signed-champion and policy state were applied.
• Daemon auto-start regression suite: 13/13.
• CLI TypeScript build passes.
• The stable release pipeline builds immutable archives, smoke-installs all three public packages, publishes those same bytes, and verifies a fresh registry installation.

This release resolves #2852.