RuFlo Files

Fixes

• hooks: quote-aware split for RUFLO_HOOK_CLI_OVERRIDE (#3344) — the test-only CLI-override parser in plugins/ruflo-core/scripts/ruflo-hook.cjs did a naive .split(' '), which broke process.execPath into C:\Program plus stray tokens on a standard Windows Node install (C:\Program Files\nodejs\node.exe). Found while verifying [#3332]'s Windows argv fix on a real Windows machine rather than windows-latest CI (whose hosted Node path has no space). No production impact — RUFLO_HOOK_CLI_OVERRIDE is never set outside the test harness.
• release: spawn npm.cmd with shell:true on Windows (#3346, [#3348]) — scripts/stage-internal-runtime-bundles.mjs and scripts/prepare-root-publish.mjs both spawned npm.cmd directly without shell:true, which throws EINVAL on any current Node/Windows combo (CreateProcess can't launch a .cmd, and Node has refused to shell out to one implicitly since CVE-2024-27980). This blocked every Windows publish of @claude-flow/cli and the claude-flow umbrella package. Found live while publishing this release from a Windows machine.

Verification

• plugins/ruflo-core/scripts/test-hooks.mjs: 32/32 (was 29/32 before [#3344])
• v3/@claude-flow/cli/__tests__/ruflo-hook-windows-argv.test.ts, escape-cmd-arg.test.cjs, mcp-launch.test.cjs, scripts/smoke-ruflo-hook-cjs.mjs, cross-platform/env-var audits: all clean
• Full Windows publish pipeline (@claude-flow/cli → claude-flow → ruflo) exercised end-to-end on a real Windows machine after the fixes landed
• latest / alpha / v3alpha dist-tags verified aligned at 3.42.3 across all three packages

🤖 Generated with RuFlo