v3.38.15
v3.38.15 — session-end state, Windows Claude launch, MCP tool filter, settings-risk scanner
Fixed 3
- mcp tools now honors CLAUDE_FLOW_MCP_TOOLS environment variable when listing
- Claude Code launches now resolve correctly on Windows npm installs by replacing execSync with platform-aware resolveClaudeLaunchCommand
- hooks session-end now persists real session state including session id, duration, and task/edit/command/error metrics instead of hardcoded summary
Security 3
- Added advisory scanner for untrusted .claude/settings.json hooks and permissions.allow entries in ruflo init and ruflo init --upgrade
- Fixed six concrete bypass methods for settings.json hook payload execution including intermediate-pipe-stage downloads, two-step download+exec, eval-wrapped base64, interpreter-mediated commands, absolute-path-prefixed commands, and whitespace-evasive allow rules
- Removed ANSI and control-character injection risk from advisory warning output
From ruflo
Bug-fix + security-hardening train: four PRs merged from external contributors and one dream cycle.
Fixes
- #3060 → #3055 — `mcp tools` now honors `CLAUDE_FLOW_MCP_TOOLS` when listing (previously the env var was accepted but ignored on the list path). Thanks @dajiaohuang.
- #3076 → #3071 — Claude Code launches now resolve correctly on Windows npm installs. Replaces the brittle `which claude` execSync with a platform-aware `resolveClaudeLaunchCommand` that follows the npm shim to the native `claude.exe` (or falls back to `node <cli.js>` for older JS installs). Thanks @dajiaohuang.
- #3077 → #3063 — `hooks session-end` now persists the real session state (session id, duration, task/edit/command/error metrics from the actual run) instead of a hardcoded summary + fabricated session id. Thanks @dajiaohuang.
Security (Dream Cycle 2026-08-16)
- #3044 → #3043 — Advisory scanner for untrusted `.claude/settings.json` `hooks` and `permissions.allow` entries that `ruflo init` / `ruflo init --upgrade` previously carried forward unexamined. Same trust shape as CVE-2025-59536 (settings.json hook payload achieving command execution with no review step), reached via ruflo's own merge logic. Advisory-only — the merge/write behavior itself is unchanged, findings surface as CLI warnings. Hardened after an independent adversarial-critic pass found 6 concrete bypasses (intermediate-pipe-stage downloads, two-step download+exec, eval-wrapped base64, interpreter-mediated dangerous commands, absolute-path-prefixed commands, whitespace-evasive allow rules) — all fixed and pinned as a held-out regression set. Also self-identified an ANSI/control-character injection risk in the warning output and stripped it.
Install
- `npx ruflo@latest` (or `@alpha` / `@v3alpha` — all three tags aligned)
Merged PRs
Closes #3055, #3063, #3071, #3043.
🤖 Generated with RuFlo