v3.12.2 — kernel-panic fix + cve subcommand fix + hooks hardening

Bundled fixes

#2407 — daemon proliferation → kernel panic (CRITICAL)

Atomic O_EXCL lockfile in daemon.ts + dropped the shell & in init.ts:424. Race test verified: 5 concurrent daemon start → 1 surviving daemon (was 3-5+).

One real incident accumulated 39 zombie daemons holding ~8.5 GiB and contributed to a macOS kernel panic on June 15. No longer possible.

#2403 — security cve no longer a stub

Now delegates to npm audit --json (same GitHub Advisory DB source as security scan), extracts CVE IDs from via titles/URLs, supports --check CVE-XXXX-NNNN and --severity {critical,high,medium,low} filters. Local verify on this repo: 37 affected packages surfaced.

#2397 — .claude/helpers/* hooks hardening

Community contribution from @tjaiyen — 5 grounded bug fixes including real timeout via Promise.race (not the spurious "timer cleared on sync return" pattern), signal cleanup, truncation transparency, cross-platform slug normalization. 248+/49− across 8 files.

Dependabot bumps (3/5 merged cleanly)

• @types/node 20.19.41 → 20.19.43 in /v3/@claude-flow/browser
• vitest 4.1.6 → 4.1.9 in /v3/@claude-flow/browser + /plugins/ruflo-graph-intelligence
• agent-browser 0.27.0 → 0.27.3 in /v3/@claude-flow/browser

(#2384 + #2386 had merge conflicts; dependabot will rebase.)

Install

npx ruflo@3.12.2
# or
npm i ruflo@latest

Compatibility

All 3 packages × 3 dist-tags published in lockstep:

• @claude-flow/cli@3.12.2 — latest, alpha, v3alpha
• claude-flow@3.12.2 — latest, alpha, v3alpha
• ruflo@3.12.2 — latest, alpha, v3alpha

No API breaking changes. Patch bump per CLAUDE.md publishing policy.

🤖 Generated with RuFlo