v3.38.15 — session-end state, Windows Claude launch, MCP tool filter, settings-risk scanner
Bug-fix + security-hardening train: four PRs merged from external contributors and one dream cycle.
Fixes
- #3060 → #3055 — `mcp tools` now honors `CLAUDE_FLOW_MCP_TOOLS` when listing (previously the env var was accepted but ignored on the list path). Thanks @dajiaohuang.
- #3076 → #3071 — Claude Code launches now resolve correctly on Windows npm installs. Replaces the brittle `which claude` execSync with a platform-aware `resolveClaudeLaunchCommand` that follows the npm shim to the native `claude.exe` (or falls back to `node <cli.js>` for older JS installs). Thanks @dajiaohuang.
- #3077 → #3063 — `hooks session-end` now persists the real session state (session id, duration, task/edit/command/error metrics from the actual run) instead of a hardcoded summary + fabricated session id. Thanks @dajiaohuang.
Security (Dream Cycle 2026-08-16)
- #3044 → #3043 — Advisory scanner for untrusted `.claude/settings.json` `hooks` and `permissions.allow` entries that `ruflo init` / `ruflo init --upgrade` previously carried forward unexamined. Same trust shape as CVE-2025-59536 (settings.json hook payload achieving command execution with no review step), reached via ruflo's own merge logic. Advisory-only — the merge/write behavior itself is unchanged, findings surface as CLI warnings. Hardened after an independent adversarial-critic pass found 6 concrete bypasses (intermediate-pipe-stage downloads, two-step download+exec, eval-wrapped base64, interpreter-mediated dangerous commands, absolute-path-prefixed commands, whitespace-evasive allow rules) — all fixed and pinned as a held-out regression set. Also self-identified an ANSI/control-character injection risk in the warning output and stripped it.
Install
- `npx ruflo@latest` (or `@alpha` / `@v3alpha` — all three tags aligned)
Merged PRs
Closes #3055, #3063, #3071, #3043.
🤖 Generated with RuFlo
Contributors
dajiaohuang