Independent review of #4096 (issues #4093-#4095). The guard and mods-screen fixes hold on a 62-row adversarial
corpus (main 40/62, PR 58/62; the 4 misses are static-analysis limits main also has) and 1 MB hostile inputs stay
bounded. Gaps found and fixed here, tests first:
- the shared plugin screen (copied into 39 plugins) still flagged ./service-account.json and --set-secrets=NAME=NAME:latest
as key assignments: relative file paths and secret-manager references are now excused there too, a literal is not
- exfiltration now also covers e-mailed credentials ("email me the .env")
- 8 more guard parity rows (list that includes the root in any position, benign brace uses, spaced named fork bomb)
- every plugin whose screen copy changed gets a patch bump + CHANGELOG entry (marketplace users only receive a
change after a bump; precedent: d06b0122b), ruflo-mods 0.6.1 carries the guard, screens and README
- helpers manifest re-signed (hook-handler.cjs changed)
Co-Authored-By: RuFlo <ruv@ruv.net>
Verified every CLI flag, MCP tool parameter and neural-trader flag these plugins
tell the model to use against @claude-flow/cli 3.56.5 (--help and MCP schemas) and
neural-trader 2.8.11 (run offline), and fixed what was false:
- intelligence: neural_train needs modelType (no patternType/--pattern-type; CLI
flag is --pattern), hooks_model-outcome/trajectory-end/pretrain/build-agents/
explain parameters, mcp tool call -> mcp exec, microlora has no consolidate;
intelligence-transfer rewritten (hooks_transfer only copies from a local
project; marketplace is hooks transfer store ..., PINATA_API_KEY/SECRET, PII
scan + confirmation before publish).
- loop-workers: CronCreate takes {cron,prompt,recurring} and is session-scoped
(7-day expiry), ScheduleWakeup needs prompt, 270s heartbeat qualified by TTL.
- market-data: candles were routed to the ~11-pattern ruvllm_hnsw router;
untrusted-feed rules; no order placement.
- neural-trader: many documented flags answer "Unknown command" in 2.8.11; several
handlers return demo output; backtests/signals use synthetic bars without
--live; backtest signing now refuses non-live data; live/broker path and
circuit-breaker claims corrected; signal TTL used a non-existent expiresAt.
- iot-cognitum: pin the fleet CLI instead of @latest; confirmation gates for
firmware deploy/advance/rollback and fleet delete.
- migrations: confirmation/dry-run/validate gates before migrate up/down.
- music: bearer token only sent to music.cognitum.one; pin cogmusic@0.1.1; token
never enters the transcript.
- jujutsu: analyze_diff* take a ref, not diff text; gate PR merge/close/create.
- knowledge-graph: align relation weights with kg-extract.
- Removed the invalid post-task --train-neural flag everywhere in these plugins.
Plugin versions bumped (marketplace users only receive changes after a bump):
intelligence 0.4.3, loop-workers 0.3.4, market-data 0.3.4, neural-trader 0.3.5,
iot-cognitum 0.3.3, jujutsu 0.3.4, knowledge-graph 0.3.4, migrations 0.3.4,
music 0.2.4. metaharness reviewed, no change needed.
Co-Authored-By: RuFlo <ruv@ruv.net>
The walker dropped input past its node, character and per-string budgets
silently, so 32 guards passed a secret placed after the cap. textsOf now
appends a TRUNCATED marker; names/hasSecretIn treat it as a finding. Regenerated
the 38 copies, bumped the 39 plugins, emptied the known-holes baseline.
Co-Authored-By: RuFlo <ruv@ruv.net>
Extend scripts/sync-mod-screen.mjs to a second kit: the flag() helper in hooks/options.ts of 38 mods now sits between SHARED FLAG markers and is
rewritten/checked from ruflo-agentdb. Drift, a lost marker or zero copies fails --check. Bump the 39 touched plugin versions and their version pins.
Co-Authored-By: RuFlo <ruv@ruv.net>
Found by driving each plugin's mod live (/SHORT-mod status ran for all 19; status.json parsed, version 1) and probing the guards.
- 13 guards (jujutsu, knowledge-graph, loop-workers, market-data, metaharness, rag-memory, ruvector, ruvllm, rvf, security-audit, sparc,
workflows, x-gateway): textsOf dropped the key name, so {"api_key": "abcdef1234567890abcdef"} was never an assignment; and one long
field (a 40 KB base64 blob) used the whole 20 KB budget so a key in the next field was never read. Strings now lead with their key and
each is charged at most 20 KB of a 100 KB budget.
- neural-trader: the live-order gate matched execute_trade only; the package's execute_multi_asset_trade and place_prediction_order_tool
went through unconfirmed. Paper/simulated tools stay ungated.
- tsconfig.json for knowledge-graph, loop-workers, market-data, metaharness (the host writes it on load; jujutsu already commits it).
- Patch bump for the 14 plugins; smoke step 1 pins updated.
Co-Authored-By: RuFlo <ruv@ruv.net>
Each gets a tighten-only tool.call guard on its own tools, a status file
(.claude-flow/<short>-mod/status.json), a local /<short>-mod command, userConfig,
tests, smoke steps M1-M3, and a README 'As a mod' section. Minor version bumps.
Co-Authored-By: RuFlo <ruv@ruv.net>
full-system-test surfaced 23/32 plugin smoke contracts failing on a
single drifted assertion: the smoke gate greps ADR-0001 for
`status: Proposed`, but those ADRs were long since promoted to
`Accepted` without updating the gate. Flip the assertion (label, grep,
message) Proposed -> Accepted only where the ADR is genuinely Accepted.
ruflo-core additionally had a stale version assertion (0.2.0 -> 0.2.2).
Left untouched: ruflo-adr, ruflo-browser, ruflo-intelligence — their
ADR-0001 is genuinely Proposed, so their smokes correctly assert it.
No plugin source or ADR changed — only the drifted test assertions.
All 32 plugin smoke contracts now pass; full-system-test is 4/4 green.
Co-Authored-By: RuFlo <ruv@ruv.net>
r