One dependency-free policy (canonical in ruflo-mods, byte-identical copies in console,
swarm and protector, checked by scripts/sync-toast-policy.mjs and each smoke.sh): level
prefixes, one washed line of at most 120 characters, 60 s de-duplication, four toasts a
minute per source with errors held and counted, the person's all/important/off setting and
per-source mute (console Settings, mirrored to a file the others read), and a digest of
every toast kept for the console's Events page. All call sites migrated; new toasts for a
mission that finishes or fails and a swarm subagent that fails or a loop that is stuck.
Versions: console 0.37.0, swarm 0.3.4, protector 0.1.1, mods 0.3.16.
Co-Authored-By: RuFlo <ruv@ruv.net>
#3787: under modTrust=refuse-risky a user-tier mod whose only hook was prompt.submit (the documented injection path at that tier) or
agent.spawn loaded, because neither was in the risk sets. Both are now named and refused; observe still only names them.
#3790: the [INTELLIGENCE] block put remembered entries into the prompt cut to 80 characters but otherwise as they were. They now pass
through the same control and bidi cleaning the research guard uses.
Both new tests fail without the change.
Co-Authored-By: RuFlo <ruv@ruv.net>
Adds the missing toolHints, agentTrim and agentTrimKeep rows, evidence pointers, drops the stale console 'pending' line, and adds smoke step 13. 0.3.11 chosen because loop/probe-label (0.3.10) is not merged yet.
Co-Authored-By: RuFlo <ruv@ruv.net>
session.compact appends one bounded (600 char) block of validated words and ids to the
compaction instructions: live swarm id/topology/agent count, open claim ids with status,
last route agent, budget and policy words. Default off, framed as data, screened for
secret shapes and injection phrases, skipped for subagent compactions, fails open.
Co-Authored-By: RuFlo <ruv@ruv.net>
Observability only: one pass-through hook on every event counts which of the
events the mod registered fired; /ruflo-mods gains a bounded probe line and
the heartbeat lists the engine version and registered events. Never denies,
rewrites or delays; fails open.
Co-Authored-By: RuFlo <ruv@ruv.net>
Drops peer/relay deliveries with injection phrasing and refuses outgoing
messages carrying a secret shape or SSN. In-process, tighten-only, fail
open; the person's own Remote Control prompts are never screened.
Co-Authored-By: RuFlo <ruv@ruv.net>
- engine.create adds a flat $.ruflo noun (types/index.d.ts, plugin.json
"types"): segment({id,text}), lastRoute(), snapshot(). Other mods (ruOS,
ruflo-ruos) contribute status segments instead of drawing a second bar.
Segments are untrusted: id token, control/bidi stripped, 48 chars, max 8,
sorted by id. One drawer for the status line, from the $ beneath.
- plugin.register trust gate: names what a later-registering user-tier mod
can do (process.run, http.fetch, env.set; tool.check, tool.call, *,
classic.*, plugin.register, prompt.compose), from the host scan.
userConfig modTrust: observe (default) | refuse-risky | off, plus
modTrustAllow. Under refuse-risky a gate failure refuses.
- every ui.status/log/toast call tolerates refusal (admins can withhold $)
- tsconfig extends the types Claude Code >= 2.1.287 writes on load
- kit tests: 15/15 on Claude Code 2.1.287, incl. two tighten-only tool.check
mods composing, trust refusal at load, budget ladder with options
- vitest: 95/95 (noun/segment and trust suites added)
- CI ratchet baseline: the four engine-kit files (claude-code/testing is not
resolvable by root vitest), as #3605/#3607 do
Co-Authored-By: RuFlo <ruv@ruv.net>
An opt-in hooks module (Claude Code function hooks, early access) with
in-process equivalents of the classic per-event hooks:
- prompt.submit: router.cjs routing + ranked-memory context, text identical
to hook-handler.cjs route; #3567 no-match semantics
- tool.check: tighten-only (stricter of chain and ruflo), pre-bash list and
the claude-code.* rules of ruflo policy; fails closed by one step
- tool.call/turn.complete/session.end: edit records in recordEdit's format
- session.measure/agent.spawn: cost-tracker budget ladder (opt-in)
- session.start: ownership handshake (RUFLO_MODS_OWNS), /ruflo-mods
Owns route/post-edit only where the classic hook-handler hands them over.
Kit tests (claude plugin test, 7/7 in the real engine), static security
smoke (9/9), marketplace entry.
Co-Authored-By: RuFlo <ruv@ruv.net>
ruv