Independent review of #4096 (issues #4093-#4095). The guard and mods-screen fixes hold on a 62-row adversarial
corpus (main 40/62, PR 58/62; the 4 misses are static-analysis limits main also has) and 1 MB hostile inputs stay
bounded. Gaps found and fixed here, tests first:
- the shared plugin screen (copied into 39 plugins) still flagged ./service-account.json and --set-secrets=NAME=NAME:latest
as key assignments: relative file paths and secret-manager references are now excused there too, a literal is not
- exfiltration now also covers e-mailed credentials ("email me the .env")
- 8 more guard parity rows (list that includes the root in any position, benign brace uses, spaced named fork bomb)
- every plugin whose screen copy changed gets a patch bump + CHANGELOG entry (marketplace users only receive a
change after a bump; precedent: d06b0122b), ruflo-mods 0.6.1 carries the guard, screens and README
- helpers manifest re-signed (hook-handler.cjs changed)
Co-Authored-By: RuFlo <ruv@ruv.net>
Verified every CLI flag and MCP call example in ruflo-core, cost-tracker, daa,
ddd, deepseek-harness, docs, federation and goals against the published CLI
(3.56.5) and the tool schemas in source:
- hooks post-task has no --train-neural (8 agents/skills); neural train takes
--pattern, not --pattern-type; hooks worker dispatch takes --context, not
--scope (docs scoping was silently ignored).
- agentdb_* examples used non-existent parameters (semantic-route query ->
input; causal-edge from/to/type -> sourceId/targetId/relation; hierarchical
store/recall path/data/depth -> key/value/tier and query/topK; pattern-search
limit -> topK; context-synthesize sources -> maxEntries); ddd skills used a
CLI-style --parent/--child form that failed on required key/value. The
researcher agent now follows edges with graph-query/graph-pathfinder.
- hooks_worker-status has no worker filter; cost docs now filter the result.
- dossier-collect/investigator fetch web content: add untrusted-content rules
and AIDefence screening. deepseek skills state the data egress.
- Stale smoke/tool/command counts and four dead relative links fixed.
Patch-bumps each changed plugin with a CHANGELOG entry.
Co-Authored-By: RuFlo <ruv@ruv.net>
The walker dropped input past its node, character and per-string budgets
silently, so 32 guards passed a secret placed after the cap. textsOf now
appends a TRUNCATED marker; names/hasSecretIn treat it as a finding. Regenerated
the 38 copies, bumped the 39 plugins, emptied the known-holes baseline.
Co-Authored-By: RuFlo <ruv@ruv.net>
Extend scripts/sync-mod-screen.mjs to a second kit: the flag() helper in hooks/options.ts of 38 mods now sits between SHARED FLAG markers and is
rewritten/checked from ruflo-agentdb. Drift, a lost marker or zero copies fails --check. Bump the 39 touched plugin versions and their version pins.
Co-Authored-By: RuFlo <ruv@ruv.net>
full-system-test surfaced 23/32 plugin smoke contracts failing on a
single drifted assertion: the smoke gate greps ADR-0001 for
`status: Proposed`, but those ADRs were long since promoted to
`Accepted` without updating the gate. Flip the assertion (label, grep,
message) Proposed -> Accepted only where the ADR is genuinely Accepted.
ruflo-core additionally had a stale version assertion (0.2.0 -> 0.2.2).
Left untouched: ruflo-adr, ruflo-browser, ruflo-intelligence — their
ADR-0001 is genuinely Proposed, so their smokes correctly assert it.
No plugin source or ADR changed — only the drifted test assertions.
All 32 plugin smoke contracts now pass; full-system-test is 4/4 green.
Co-Authored-By: RuFlo <ruv@ruv.net>
