v3.39.2 — fast-uri CVE (supersedes incomplete 3.39.1), gated-bridge backend honesty, AgentPool dead-agent detection

⚠️ Upgrade from 3.39.1 — its CVE fix was incomplete

3.39.1 shipped a fast-uri bump that never reached users. The root package.json was updated, but @claude-flow/cli carried its own hard pin "fast-uri": "3.1.5" — and that is the package that actually ships. A fresh npm install ruflo@3.39.1 still resolved fast-uri@3.1.5, squarely inside the advisory range.

This was caught by post-publish validation (fresh-installing the published tarball, not reading the lockfile) and is fixed here. If you are on 3.39.1, upgrade.

ruflo@3.39.1
└─┬ @claude-flow/cli@3.39.1
  ├─┬ ajv@8.20.0
  │ └── fast-uri@3.1.5 deduped
  └── fast-uri@3.1.5      ← the hard pin the root bump did not override

Verified on 3.39.2 by fresh install: resolved fast-uri@3.1.7 ✅

---

Security — GHSA-5jgf-p345-68v8 (high, CVSS 7.5) — #3222

fast-uri host confusion via skipped IDN canonicalization on scheme-relative references. Advisory range >=3.1.3 <3.1.6; we were pinned at exactly 3.1.5.

• @claude-flow/cli: fast-uri 3.1.5 → ^3.1.6 (the shipping dependency)
• ruflo: added "fast-uri": ">=3.1.6" override so the wrapper cannot regress independently
• Also clears the ajv high that inherited it

Credit to @aeonframework (#3222) for the original report and patch.

Memory — a gated native bridge was reported as the active backend — #3228

On Windows the #3024 kill-switch makes getRegistry() return null, so memory reads/writes silently fall back to the sql.js store (memory.db) instead of the AgentDB corpus (agentdb-memory.db).

The failure mode is why this matters: a canary store/retrieve round-trip succeeds — both halves use the same unintended file — while an existing live-store key returns found: false against 31,673 real rows. A normal smoke test cannot detect it.

The status surface hid the substitution. getHNSWStatus() gated its bridge branch on whether the bridge module was loaded — which it is, even when the registry is gated off — so describeBackend() printed sqlite (bridge, brute-force cosine) for a store the bridge never touched.

Now gates on whether the bridge is permitted to be the active path, and the backend label names the gate and its reason.

Deliberately out of scope: the opt-in allocation abort (#2948, 0xC0000409 on a ~4.4 GB allocation) and rerouting the fallback to the AgentDB corpus. Both need Windows validation. This release makes the silent case loud, which is what the report asked for first.

Thanks to @seo-yas for an unusually thorough report — line-numbered root cause across three files, a three-arm controlled reproduction, and file-level before/after hashes.

Swarm — AgentPool could never detect a dead agent — #3242 / #3243

AgentPool.performHealthChecks() stamped lastHeartbeat = now on every "still healthy" tick, and updateAgentHeartbeat() — the only other way to advance that field — has zero call sites anywhere in v3/.

So the health check's own tick was the sole thing keeping every pooled agent's heartbeat fresh: timeSinceLastActivity could never exceed one interval, the interval × 3 threshold could never be crossed, and replaceUnhealthyAgent() could never fire — for any agent, in any pool, ever. The check refreshed the very field it was checking.

Fixed by removing the self-stamping side effect (one line), matching the correct sibling pattern in UnifiedSwarmCoordinator.checkHeartbeats(). Adds agent-pool.test.ts (3 tests; baseline fails 2 of 3, candidate passes 3 of 3 under stash isolation).

Scope: @claude-flow/swarm is not currently reachable from the shipped CLI, so this is a package-internal correctness fix rather than a user-facing hot-path change. Disclosed by the evaluating run's own adversarial critic.

Known issues

• clean-install / pin-drift CI checks fail — @metaharness/darwin is pinned ~0.9.0 while npm latest is 0.10.2 (#3219). Pre-existing and unrelated; deliberately not bundled here, since 0.9 → 0.10 on a 0.x package is semver-breaking and does not belong in a security patch.
• 8 remaining high-severity advisories come from the transformers/onnxruntime/adm-zip chain inside upstream agentdb/agentic-flow and are not pinnable from this repo.

Install

npx ruflo@latest --version   # 3.39.2

All three packages published at 3.39.2 with latest, alpha, and v3alpha aligned: @claude-flow/cli, claude-flow, ruflo.

Full changelog: v3.39.0...v3.39.2