Summary

ruvector hooks security-scan <files...> always fails with {"success":false,"error":"Worker pool not initialized"}, with or without --json, so the documented "parallel security vulnerability scan" never runs.

Versions

ruvector 0.3.3 (global npm), Node 24.21.0, Linux (WSL2). ruvector doctor: all checks passed (native binding, gnn, attention, graph-node installed).

Repro

cat > vuln.ts <<'X'
import { execSync } from 'node:child_process';
export function run(b: string) { return execSync(`git checkout ${b}`).toString(); }
export function ev(c: string) { return eval(c); }
X
ruvector hooks security-scan vuln.ts
# {"success":false,"error":"Worker pool not initialized"}
ruvector hooks security-scan --json some/real/file.mjs
# {"success":false,"error":"Worker pool not initialized"}

Reproduced on 3 different files, inside a git repo.

Expected

Findings for the files given (or a clear error naming what must be initialized first). ruvector native run security works on the same machine (it scans the cwd), so the scanner exists. The hooks security-scan path just never creates its worker pool.

Related observation

On a 1,751-file TypeScript monorepo, native run security reported 181 findings, 171 of them template-injection: Template literal detected - verify no injection on ordinary template literals (e.g. test error messages). At that ratio the useful findings (no-exec, sql-injection-template) are hard to find. Consider limiting that rule to template literals passed to exec/query/eval sinks.