* feat(learning): run the verified-outcome learning loop on classic hooks for every ruflo project (ADR-512)
Until now only the opt-in ruflo-mods plugin recorded verified turns and showed lessons. Classic hooks
(every `ruflo init` project) now do the same. They replay the session transcript (`transcript_path`)
through the mod's own record and lesson code, bundled into .claude/helpers/learning-loop.cjs:
- route: records the turns that finished, then prints the lessons that fit the new prompt
- session-end: records the rest (PreCompact leaves the open turn open). This runs before the
session-id dedup, which otherwise dropped SessionEnd after a PreCompact. It also starts a
detached `ruflo hooks verified-ingest --quiet`
- one implementation: plugins/ruflo-mods/scripts/build-learning-loop-helper.mjs bundles
hooks/loop/transcript.ts; the bundle is committed, checked in mod-guidance CI, and is a signed
critical helper that helper-refresh installs (manifest re-signed)
- never twice: with its loop on, the mod adds `learning-loop` to RUFLO_MODS_OWNS
- opt-out: .claude-flow/config.json learningLoop.enabled=false, or RUFLO_LEARNING_LOOP=0
Tests: mods-learning-loop-classic (replay matches the mod's records, offsets, the hook-handler run
as a process, end to end classic record -> real ingest -> lesson in route output) and real-binary
contract 6 (pinned claude, mock model, no plugin). ruflo-mods 0.14.0.
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(adr): ADR-512 cites PR #4604
Co-Authored-By: RuFlo <ruv@ruv.net>
* ci: sign and exclude the classic-loop helper and real-binary test where the other helpers are (ADR-512)
smoke-helper-signing-security copies the critical helpers into its fixture; it now copies
learning-loop.cjs too. The ratchet's default run skips real-binary files, which need the
claude binary (mods-real-binary runs them).
Co-Authored-By: RuFlo <ruv@ruv.net>
* test(mods): give the built-CLI tests the time their children get
vitest's 5s default timed out mods-cli-bin on a loaded CI runner and reported only
STACK_TRACE_ERROR (the timeout error carries the stack of the it() call). Each test runs the
built CLI several times with a 120s child timeout.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* fix(security): pin http_fetch connections to DNS-checked addresses (SSRF via DNS)
http_fetch refused loopback/RFC-1918/link-local hosts by looking only at the URL's hostname
text, then let fetch() resolve the name on its own. A name that resolves to (or rebinds to)
127.0.0.1, a private address or 169.254.169.254 passed the check and fetch() connected to it,
with CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE unset.
Requests now go through node:http/https with a lookup hook (http-fetch-pinned.ts): it resolves
every address of the host, refuses the host when any is private unless the opt-in is set, and
returns only the checked addresses to the socket, so the connection cannot land on an address
that was not checked (no TOCTOU between check and connect). Every redirect hop goes through the
same transport. Fresh connection per request (agent: false). IP literals are still checked by
text in validateUrl. The address check also covers ::, ::a.b.c.d, NAT64 64:ff9b::, 6to4
2002::/16, fe80::/10 and fec0::/10 in full, ff00::/8, 224.0.0.0/4 and up, 198.18.0.0/15 and
*.localhost.
Tests: a name resolving to loopback (localhost., no network) is refused and the internal server
sees no request, also as a redirect hop; the opt-in still reaches it; pinnedLookup refuses mixed
public+metadata answers, private IPv6 answers and empty answers, and passes public answers
through unchanged; address table. Redirect tests now inject the request function.
Co-Authored-By: RuFlo <ruv@ruv.net>
* ci: register CLAUDE_FLOW_HTTP_FETCH_ALLOW_PRIVATE as an operator-only trust boundary
The env read moved into http-fetch-pinned.ts, outside the function the audit's param heuristic
had credited. It must stay env-only: a flag or tool argument would let the agent driving
http_fetch turn the SSRF guard off.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* feat(learning): lessons say where the fix goes; reworded tasks learn together (ADR-511)
The §7 evaluation (#4581) showed three limits on what the verified-outcome
loop can learn:
- a lesson named an agent, nothing the model can act on;
- tasks naming different files merged into one lesson;
- the same task worded differently never learned (15 reworded verified
successes left 15 patterns at one success each, zero lessons).
Changes:
- mods: a verified turn records its screened edited source files; a lesson
names the three its passing fixes edited most and leads with them; pick()
weighs rare keywords (IDF) and drops matches far below the best.
ruflo-mods 0.13.0.
- cli: files are counted per pattern (successes only) into learned-lessons.json;
SONA takes them as pattern anchors (never keywords), so reworded tasks that
fixed the same file reinforce one pattern; tasks naming disjoint paths never
merge. Lesson building moves to verified-lessons.ts.
- eval: the harness gains --ablate, --test-index, --concurrency, --lessons,
--save-lessons, --eval-sample, --calibrate and --max-turns;
scripts/eval-learning-loop-corpus.mjs writes a validated 15+30-task corpus.
Proved offline (tests): 15 reworded prompts form 5 lessons, up from 0; the
first run's prompts form 5 lessons, up from 1; the right lesson ranks first
for 30 of 30 eval prompts, with 1.07 lessons shown per prompt.
Paid pilots (haiku, about $6.80) are directional and did not reach the gate:
- 8-turn cap: off 2/10, on 4/10, lessons without files 1/10;
- uncapped: 6/6 vs 6/6, cost within 1%.
ADR-511 §5 has the details.
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(adr): ADR-511 cites PR #4603
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
scripts/eval-learning-loop.mjs now uses ruflo's MetaHarness flywheel
sequential-evidence gate (anytime-valid McNemar e-process) as its decision
rule for #4581 §7:
- the plan prints the minimum number of tasks the loop must pass where the
baseline fails (9 for a first test at family-wise alpha 0.05), and --run
refuses an eval split that can never reach it, before any spend;
- the report carries task-level pairedOutcomes and the gate verdict, with a
cost verdict as a secondary sign check only;
- each run's claude -p JSON result is saved next to its work directory, and
--keep leaves the directories in place for later inspection;
- --help prints the whole header comment instead of a fixed line range.
Applied to the 2026-10-30 run: success e-value 1.0 (0/30 informative pairs,
threshold 32.9), cost e-value 9.7, both not significant.
Co-authored-by: r <r@x>
* feat(plugins): ADR-507 cut the per-turn plugin footprint
- scripts/measure-plugin-footprint.mjs: per-plugin skills/commands/agents,
listing characters and estimated tokens, from the tree or a git ref;
before/after reports in v3/docs/validation/.
- 27 operational skills get disable-model-invocation: true (cost-tracker
sub-reports reached by /ruflo-cost, metaharness bench/learn/evolve/mint/
oia-audit, GAIA submission + comparison, init-project, ruflo-status,
vector-setup, federation-init, agntcy-status). Each is listed in a
"User-invoked skills" table in its plugin README; the choosing rule is in
plugins/README.md.
- 20 skill descriptions over 300 characters cut to one sentence plus
"Use when".
- audit-skill-frontmatter: 300-char ceiling on skill and command
descriptions (measured unfolded) and a README check for every
user-invoked skill.
- skillTrim (§2.4) not built: the engine has no skill-listing hook.
Listing with every plugin enabled: 47,743 -> 39,402 chars
(about 11,936 -> 9,851 tokens per turn).
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(adr): ADR-507 status names PR #4588
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(plugins): ADR-507 cost-analyst points users at /ruflo-cost for user-invoked reports
The engine's refusal for a disable-model-invocation skill says not to
replicate its workflow by other means, so the agent names the subcommand
instead of running the report script. After-report now cites the pushed
commit.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(scripts): ADR-507 audit runs through symlinked paths; test the gate's wiring
The import guard compared argv[1] with import.meta.url, which Node realpaths
for the entry module. Run through a symlinked path, main() was skipped and the
audit exited 0 having checked nothing. Both scripts now compare realpaths.
audit-skill-frontmatter takes --plugins-dir so tests can run the real CLI on
a fixture: a 304-char folded description, an unlisted user-invoked skill and
a 311-char literal command description must exit 1 with those findings, and
adding the README row must clear only the user-invoked one. The repo-wide test
now also asserts skillsScanned > 100. Disabling any of the three checks, or
restoring either old guard, fails a test.
Co-Authored-By: RuFlo <ruv@ruv.net>
* chore(plugins): version bumps for ADR-507 footprint changes
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* feat(plugins): sensitive userConfig secrets, readSecret helper, plugin secrets audit (ADR-506)
- ruflo-cost-tracker, ruflo-metaharness: `openrouterApiKey`; ruflo-x-gateway:
`adminToken`. Each is type string, sensitive, optional, no default.
- readSecret(name, envFallbacks): CLAUDE_PLUGIN_OPTION_<NAME> first, then the
variables the plugin always read. Copied per plugin (x-gateway in src/, the
only folder its Docker image ships); a test keeps the copies identical.
- Consumers: openrouter.mjs key/generation, x-gateway checkAdmin (call time,
fail closed), redblue child env (OPENROUTER_API_KEY, never argv).
- scripts/audit-plugin-secrets.mjs: credential-named option without
sensitive: true, or a literal secret (the mods' COMMON_SECRETS, parsed from
screen.ts) in plugin.json/hooks.json, fails. Wired into plugin-package-audit.
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(adr): ADR-506 status points at PR #4587
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(plugins): deliver the ADR-506 secret option, harden the plugin secrets audit
Review fixes for #4587:
- Delivery: Claude Code gives a plugin option only to the plugin's own hooks
and MCP servers, never to the Bash tool that runs openrouter.mjs and the
redblue skill path. ruflo-cost-tracker and ruflo-metaharness now carry a
SessionStart hook (scripts/_secret-env.cjs) that writes the sensitive
openrouterApiKey option to CLAUDE_ENV_FILE as OPENROUTER_API_KEY, only when
that variable is unset. Live-verified with Claude Code 2.1.289 (probe plugin
and the real cost-tracker): a Bash tool command resolved the key.
- ruflo-x-gateway adminToken removed: the gateway is a deployed server that no
Claude Code process of the plugin runs, so the option could never arrive.
- Audit: a secret used as a JSON key is shown as <redacted-key> and never
printed; .mcp.json and .lsp.json are scanned; OpenRouter key shape added;
credential-named env/headers entries holding a 16+ char literal fail;
${user_config.*} in command/headersHelper/args fails.
- ADR-506 updated with the delivery trade-off and what the bridge does not
reach (the metaharness_redblue MCP tool in ruflo-core's server).
Co-Authored-By: RuFlo <ruv@ruv.net>
* test(plugins): skip the bash-only ADR-506 bridge tests on Windows; hedge env-file mode wording
Co-Authored-By: RuFlo <ruv@ruv.net>
* chore(plugins): cost-tracker 0.29.0, metaharness 0.3.0 for ADR-506
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* feat(learning-loop): gaming defences for verified outcomes (ADR-503)
The verified-outcome loop (ADR-502) trusts a verifier's exit status, but the
model chooses what that verifier checks. Four downgrade-only layers:
- mod: a verified-success record carries taints when the turn edited a test
file (edited-tests), a verifier config (edited-verifier-config), or decided
on a weakened/narrowed command (narrowed-verifier); a per-process session
token is written on every record. The outcome word never changes.
- CLI: a success with a taint not listed in .claude-flow/config.json
learningLoop.allowTaint is counted under `tainted` and never reaches SONA.
- CLI: opt-in re-verify (learningLoop.reverify, off by default) re-runs a
rotating allowlisted manifest check in a temp detached git worktree at HEAD
with a timeout; failure, timeout or error downgrades to unknown. Only an
explicit verified-ingest re-verifies; hot callers defer.
- CLI: anomaly gate holds would-be lessons that are perfect-and-tainted,
only-narrowed, or from one session, listed as `held: <id> (<reason>)`.
Adds scripts/eval-learning-loop.mjs (manual, plan-only unless --run).
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(adr): ADR-503 status names PR #4590
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(learning-loop): shell edits of tests taint; test the real re-verify runner (ADR-503)
- A Bash command that writes, moves or deletes a test file or verifier
config (rm, mv, cp, tee, truncate, sed -i/perl -i, output redirection,
git rm/checkout/restore/...) now sets edited-tests /
edited-verifier-config like an Edit of that file. Before this change,
Edit src/a.ts + `sed -i 's/it(/it.skip(/' src/a.test.ts` + `npm test`
produced an untainted verified-success. Downgrade-only: reads and test
runs earn nothing.
- gitWorktreeRunner is now tested against a throwaway git repo: pass,
fail, missing script, timeout (hung script's process verified dead),
non-repo error. After each run only the main worktree remains and no
ruflo-reverify-* dir is left. A negative control (kill only the direct
child) makes the timeout test fail.
- ADR-503 implementation notes record both, plus the interpreter-write gap.
Co-Authored-By: RuFlo <ruv@ruv.net>
* test(learning-loop): give the hung-check re-verify test an 8s budget for cold CI runners
Co-Authored-By: RuFlo <ruv@ruv.net>
* chore(ruflo-mods): 0.9.0 for ADR-503
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* test(mods): real-binary test tier with a scripted mock model (ADR-504)
Runs the real `claude` binary headless against a local mock of the
Anthropic Messages API, with ruflo-mods loaded through --plugin-dir in a
throwaway project with its own HOME. No API key, no paid model.
- mock-model.mjs: scripted Messages server (streaming and not), logs
every request; untool'd or unknown requests get a minimal answer.
- run.ts: runner with a minimal child environment, PATH recorders for
dangerous commands, and readers for events, requests and files.
- loads.test.ts (contract 1): with every option on, the heartbeat is
written, /ruflo-mods is registered and answered with no model request.
Negative control: a #4485-shaped copy (second bare session.start) is
refused silently by the real loader and fails those assertions.
- contracts.test.ts (contracts 2-5): verified-success record from a
scripted fix turn; [RUFLO_LESSONS] reaches the request (and not below
the gate); ruflo denies the root delete with its own reason and denies
a listed command the engine allows (which runs without the plugin);
the route block reaches the request (and not without the plugin).
- Excluded from the CLI, v3 and root-ratchet default runs; run with
`npm run test:real-binary`. New CI job mods-real-binary pins Claude
Code 2.1.289 and fails, naming the step, if the binary will not start.
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(adr): ADR-504 status names PR #4589
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* feat(agent): add bounded managed dynamic workflows and verified lifecycle observation
* feat(plugins): integrate managed workflows with mod policy and capability discovery
* feat(managed): unify console runs and verified advisory learning
* fix(managed): hydrate native recall receipts validated on ruOS
* docs(managed): record authenticated console host blocker
* docs(managed): qualify installed console and compatible native host
* feat(managed): integrate verified cycles and isolate native memory
* fix(managed): enforce offline native models and qualify feedback E2E
* fix(managed): independent security and correctness review findings
- gate managed_agent_interrupt through the managed_agent_control policy; terminate obeys the allowlist and deletes only its own environment when RUFLO_MANAGED_CONTROL=1
- track only events from the acknowledged message so a later poll cannot report the previous turn as finished
- require the canonical base64 verifier signature so one receipt cannot fill the ledger
- register RUFLO_MANAGED_AGENTS_BASE_URL as a trust-boundary env var (env-precedence audit) and key the credential scope marker with a per-process HMAC (CodeQL)
- best-effort local snapshot writes; report messageId when a prompt fails after it was sent
- console: rescheduling is running, budget/action-blocked sessions are active, not finished
- document the remaining known limits in ADR 0004
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs: user guide section for managed cloud agents; correct ruflo-agent README counts
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(managed): scope marker is a generation number, never a hash of the API key (CodeQL)
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
`/plugin marketplace update` compares plugin.json "version" with the installed
copy, so a fix merged without a bump never reaches existing installs (#4436
left ruflo-console at 0.45.1 until #4443 bumped it by chance).
scripts/audit-plugin-version-bump.mjs diffs <base>...HEAD and fails when a
plugin has shipped changes but its plugin.json version did not increase. New
plugins pass. Not counted as shipped: tests/, docs/, README*.md, CHANGELOG*.md,
*.spec.* and *.test.* files, and scripts/smoke*, scripts/test-*, scripts/bench*
(smoke scripts and tests that pin the version are edited together with a bump).
SKILL.md, commands/*.md and agents/*.md do count, since they ship.
.github/workflows/plugin-version-bump.yml runs it on PRs touching plugins/**.
The label skip-plugin-version-check skips the job.
Verified against history: #4436 (43a395435) fails, #4443 (7564f7cef) passes.
The workflow itself has not run on GitHub yet.
Co-authored-by: RuFlo <ruv@ruv.net>
* fix(witness): support pinned signing keys and label legacy signatures
The default witness seed is derived from the public git commit, so anyone can re-sign a modified manifest; verify.mjs still called the result cryptographically valid. Add RUFLO_WITNESS_SEED for external-key signing and RUFLO_WITNESS_PUBLIC_KEY for pinned verification (fail closed on external-key manifests without a pin), tag legacy manifests as self-attested, and stop describing the default as authorship proof.
* fix(witness): make --public-key win over the env pin
The env-var precedence audit requires a CLI flag for RUFLO_WITNESS_PUBLIC_KEY. Add --public-key, document that it takes precedence, and cover both precedence directions in the auth test.
* fix(ci): exclude witness-auth test from vitest ratchet (uses node:test)
plugins/ruflo-core/scripts/witness/__tests__/witness-auth.test.mjs imports
from node:test, not vitest, matching the same miscategorization pattern as
pod-tick.test.mjs and probe-mod-guards.test.mjs. vitest's glob picks it up
but can't parse node:test's API, so the ratchet reports "No test suite
found" even though `node --test` passes all 3 cases cleanly.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
Co-authored-by: RuFlo <ruv@ruv.net>
* feat: Grok Build host surface + host-agnostic team bus (ADR-402)
Adds `ruflo init --grok` and nine team_* MCP tools. Together they let a
lead agent on Grok Build (or Codex, or Claude) run a named agent team
without Claude's SendMessage. The team state lives in the project under
.claude-flow/teams/.
Team bus (team_create, team_spawn, team_send, team_broadcast,
team_inbox, team_plan, team_status, team_on_stop, team_shutdown)
- One implementation: templates/grok/scripts/grok-team-bus.mjs (ops,
CLI) plus grok-team-store.mjs (storage). The MCP tools import these
files, the SubagentStop hook imports them, and init --grok copies
them into a project as a CLI with no dependencies. The repo root has
no second copy.
- Mail is scoped per team: teams/<team>/mailbox/<agent>/. team_inbox
requires the team, and team_status counts only that team's mail.
- team.json updates take a cross-process lock (team.lock, an O_EXCL
file holding an owner token) and are written through a temp file and
a rename. A stale lock is broken by renaming it aside and checking
the token, never by a blind delete, and release removes only the
holder's own token. 30 concurrent spawns
from separate processes register all 30.
- team_shutdown closes the team. After it, spawn, send, plan and
on-stop refuse. team_spawn enforces maxAgents.
- A broadcast with no members is refused. priority is an integer from
0 to 999, stored as a zero-padded filename prefix. Symlinked mailbox
directories are refused. Concurrent drains claim each message by
rename, so no message is delivered twice and no drain throws ENOENT.
- The spawn description is <role>:<agent>@<team>. The SubagentStop
hook parses it to advance that team's plan. When the hook cannot
record a team subagent, or the team is ambiguous, it writes the
reason to stderr and exits 1.
init --grok
- Writes .grok/ (config, rules, four agent profiles, a skill, the
SubagentStop hook), scripts/ and docs/grok/README.md in the project,
and lists every path it wrote. --dry-run writes nothing.
- Pins the project MCP server to the running release (ruflo@<version>,
which ships team_*) instead of @latest. From a source checkout it
points at that checkout's bin/cli.js. Inserted values are escaped as
TOML strings, so Windows paths are valid.
- Writes nothing outside the project unless --grok-statusline is
passed. With the flag, it installs ~/.grok/ruflo/host-statusline.mjs
and merges [ui.status_line] into ~/.grok/config.toml using
@iarna/toml. The merge leaves an existing status row alone in any
TOML form. It writes only when the re-parsed result keeps every
other value, and otherwise prints the snippet to paste. The command
is `node "<absolute path>"`, which needs no shell and runs no
script from the repo.
- The status row expects only the agent-teams-grok skill.
Also classifies team_* in the capability brain (swarm-coordination)
and adds ADR-402.
Tests: __tests__/team-tools.test.ts, __tests__/grok-init.test.ts.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(grok-host): address round-2 review of ADR-402 team bus (#3512)
N1 (blocking): root package.json "files" listed cli/dist but not
cli/templates, so npm pack (and npx claude-flow) shipped a build that
team_create / init --grok couldn't find grok-team-bus.mjs /
grok-team-store.mjs from. Added v3/@claude-flow/cli/templates/** and
verified with a real npm pack + tar extract (files present with the fix,
absent without it).
N2: breakStaleLock renamed a stale lock without re-checking it was still
the lock it first observed. A waiter that read a stale token could have
that exact lock broken by someone else and re-acquired fresh in between,
and the rename would steal that live lock out from under its holder,
opening a window for a fourth party to grab the vacated slot — two
holders at once. Now re-verifies token + mtime immediately before
renaming and backs off (no rename at all) if either changed. Added a
direct regression test (monkeypatched fs to force the exact interleaving)
plus a concurrent-CLI-process test with a pre-seeded stale lock.
N3: LOCK_WAIT_MS (10s) was shorter than LOCK_STALE_MS (30s), so any
acquire attempted in the ~20s gap between "waiter gives up" and "lock
considered stale" failed even with nothing actually stuck — and the
SubagentStop hook's own 5s command timeout couldn't survive either value.
Lowered stale/wait to 4s/4.5s (wait >= stale, both comfortably under the
hook's 5s budget with real critical sections being sub-millisecond JSON
r-m-w). Also replaced the synchronous Atomics.wait lock-wait loop with an
async setTimeout-based poll (sleepMsAsync), so an MCP server keeps serving
other requests while a caller waits for the lock; threaded async/await
through withTeamLock/createTeam/spawnMember/runCli/main and the
SubagentStop hook and team-tools.ts's dispatcher. sleepMs (sync) stays
only for writeJsonAtomic's bounded Windows rename retry.
Minor 1: --grok-statusline replaced a symlinked ~/.grok/config.toml with
a plain file, destroying the symlink. writeFileAtomic now resolves an
existing symlink and writes through it instead.
Minor 2: a TOML integer above 2^53 in the user's config parses to a
BigInt (@iarna/toml) and crashed JSON.stringify inside the status-line
merge, which ran as the LAST step of init — leaving project files already
written. Now validated up front, before any file is touched, naming the
offending key; init fails clean with nothing written instead of half-done.
Minor 3: host-statusline.mjs matched `trusted = true` / `[mcp_servers.x]`
via substring/regex, so a commented-out trusted=true read as trusted and
an `enabled = false` server still counted as loaded. Can't add a runtime
dependency on @iarna/toml here (this script ships as a zero-dependency
copy outside any node_modules tree — project scripts/ and
~/.grok/ruflo/host-statusline.mjs). Added a small comment-aware
table/key parser instead and used it for grok, and for codex's
mcp_servers check too (same bug class).
Minor 4: team_create --force reopened a team but left the old
incarnation's mailboxes on disk. Now clears mailbox/ when recreating.
Minor 5: priority accepted "1e2" and "0x10" (Number() coerces both).
Now requires a plain base-10 integer literal string.
Minor (stray changes): reverted an incidental .helpers-version bump and
a router.js mode change (644->755) picked up from a concurrent session's
helper auto-refresh — not part of this PR.
Verified: cli build + tsc --noEmit clean; grok-init.test.ts and
team-tools.test.ts (41 tests, including 8 new ones) and
guidance-brain.test.ts pass; full `npm test` for @claude-flow/cli is
green except 20 pre-existing failures across 16 files, all from
@claude-flow/memory / @claude-flow/mcp / @claude-flow/codex not being
built in this environment (none touch grok/team/statusline code).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(grok-host): address round-3 review nits on the team lock and status line (#3512)
A lock whose holder pid is still alive is no longer broken after 4s, so a stalled writer does not lose an update. An existing [ui.status_line] no longer fails init when another value is a BigInt. Quoted trusted-folder keys may contain ].
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(grok-host): keep the TOML parser out of the MCP tool import path (#3512)
grokTemplatesRoot moves to init/grok-templates.ts, which has no
dependencies. The team_* tools import it from there, so loading the MCP
tool table no longer pulls in grok-generator and @iarna/toml. On current
main, analyze-json-output.test.ts runs the analyze command from a copied
source tree with only cli-core and security beside it, and failed 20 of
20 with "Cannot find package '@iarna/toml'" before this change.
grok-generator re-exports grokTemplatesRoot, so its callers are unchanged.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: RuFlo <ruv@ruv.net>
Two bugs, both from agentic-flow/agent-booster's actual exports not
matching what this file assumed:
1. initialize() picked `ab.AgentBooster` (the un-instantiated class) when
`ab.agentBooster` was undefined, instead of calling the package's real
`getAgentBooster()` factory. Calling `.apply()` on that un-instantiated
class resolves to `Function.prototype.apply`, not the booster's own
prototype method.
2. optimizedEdit() called `this.agentBooster.editCode(...)`, which has
never existed on this class — the real method is
`apply({ code, edit, language, filePath? })`, returning
`{ output, success, latency, strategy, ... }`, not
`{ method, speedupFactor, executionTimeMs }`.
Moved token-optimizer.test.ts out of ci-test-baseline.txt — all 23 tests
in that file (75 across the package) now pass with the real dependency
loaded, not mocked.
Co-authored-by: r <r@x>
Added in 7de1657db without an entry in either list. The vitest-based CI
ratchet intermittently reports "No test suite found in file" for it
(confirmed passing 10/10 via its own documented runner, node --test —
its header says so explicitly). Excluding it stops that nondeterministic
failure from surfacing on unrelated PRs.
Co-authored-by: r <r@x>
* chore(release): 3.58.0 version bumps and changelog
Minor release: new memory peek command, Codex activity viewer, configurable
MCP rate limits, plus the #4303 install-breaking fix and a round of
correctness fixes merged since 3.57.2. Also bumps ruflo-console 0.44.4 ->
0.44.5 for the #4305 TUI fix, which shipped to main without a plugin version
bump (the same gap already documented as a past mistake in the console's own
changelog for 0.44.3/0.44.4).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-console): update smoke.sh's hardcoded version check to 0.44.5
The plugin.json version bump to 0.44.5 (for the #4305 TUI fix) broke the
smoke contract's own hardcoded expectation of 0.44.4 in step 1. Update the
step name and grep pattern to match.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): sync the smoke-workflow regression test to the real 15-minute timeout
#3950 bumped .github/workflows/all-plugins-smoke.yml's smoke-all job from
timeout-minutes 10 to 15 (the job now also checks out and smokes the first
external git-subdir marketplace entry, agentic-qe-fleet) but never updated
this test's hardcoded expectation of 10, breaking the Test Suite job on
every PR since.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(memory): resolve sql.js's wasm dist path directly, not via package.json
fts5.test.ts located sql-wasm.wasm via require.resolve('sql.js/package.json')
then string-replaced the suffix. sql.js 1.14 tightened its exports map to
"." and "./dist/*" only, so that package.json subpath resolve throws
ERR_PACKAGE_PATH_NOT_EXPORTED even though the wasm file is present on disk —
caught by the existing try/catch and misreported as "sql.js isn't installed",
failing all 4 SqlJsBackend FTS5 tests with "sql.js/dist/sql-wasm.wasm not
found". Resolve 'sql.js/dist/sql-wasm.wasm' directly instead, which the
"./dist/*" export already permits.
Verified: 6/6 passing locally (was 4 failed before the fix).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): move pod-tick.test.mjs to the node:test exclusion list
Same fix as #4308: this file imports test() from node:test (not vitest)
and documents itself as "Run with: node --test" in its own header, but
was miscategorized into ci-test-baseline.txt. Running it under vitest's
shared worker process correlates strongly with the ERR_IPC_CHANNEL_CLOSED
crash hit 4/6 times on this PR's own CI (#4307). Applying here directly so
this release doesn't wait on #4308 to merge first.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): cap the ratchet's vitest worker count to 2
#4307: Test Suite (ubuntu-latest) intermittently crashes with tinypool's
ERR_IPC_CHANNEL_CLOSED at three different, unrelated points across 7 runs
on this PR, after ruling out any specific file as the cause (one
candidate, pod-tick.test.mjs, was fixed separately for an unrelated
reason and the crash still recurred at a different file). The pattern
(crash location varies, happens ~60-90s into a ~9500-test run) is more
consistent with cumulative memory pressure across the default fork
pool (one fork per CPU, ~4 on a standard runner) than a single bad
test. Capping workers at 2 trades some wall-clock time for headroom
while the real cause is still open in #4307.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(graph-intelligence): build the optional cli import specifier from parts
#4307 investigation, round 8: once the worker-cap fix (3739f3a9) stopped
the random tinypool crash, Test Suite started failing deterministically
on plugins/ruflo-graph-intelligence/tests/phase4-adapters.spec.ts —
"./src/memory/graph-edge-writer.js" is not exported, even though that
spec file's own tests never execute the real GraphEdgesSource.listEdges()
(they all use inline fake listEdges() test doubles). The spec file does
statically import knowledge-graph-adapter.ts at module level, though, so
vitest's module-graph crawl sees the string literal and (CI-only, not
reproduced locally in 2/2 attempts) appears to eagerly resolve it outside
this method's own try/catch during collection.
Build both the primary and fallback specifiers from joined array parts
instead of literals, so no bundler's static import-specifier scan can
find and pre-resolve them — the actual resolution still only happens at
the real `await import(...)` call site, same as before.
Verified: full plugin suite green, 104/104 (was 8/8 on the one affected
file already — this closes the only CI-only gap).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): baseline token-optimizer.test.ts — real, pre-existing, unrelated bug
v3/@claude-flow/integration/src/token-optimizer.ts calls
this.agentBooster.editCode(...), but the real agentic-flow/agent-booster
module's AgentBooster/EnhancedAgentBooster class has no editCode method
at all (its real API is apply/applyBatch/prefetch/...). Confirmed by
enumerating the class prototype directly. Not a version-pin issue, not
caused by anything in this release — @claude-flow/integration isn't even
part of the release train. Filed as #4311 with the real-fix suggestion
(rewrite optimizedEdit() against the actual API) for whoever owns that
integration layer; baselining here so the Test Suite ratchet reflects
reality instead of blocking an unrelated release on pre-existing debt.
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(changelog): record the CI-reliability fixes found validating 3.58.0
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* fix(x-gateway): fail fast on relay errors; never crash on malformed relay frames
The relay fetch helpers parsed relay frames without a guard and ignored relay
CLOSED/NOTICE and post-auth socket close/error.
- A malformed frame ('not json{', 'null', an EVENT without an event object, or
an EVENT for an unknown sub in fetchManyOn) threw inside the WebSocket
listener, an uncaught exception that killed the whole gateway process and
every in-flight request with it.
- A relay CLOSED or a dropped socket made reads wait the full 12 s and then
return [] as if the relay had nothing (live: channel_list {limit:-1} 12.2 s).
- limit/sinceSeconds were unvalidated (negative, fractional, huge).
Fix: fetchRecent/fetchManyOn/fetchChannel share one relayRound helper that
settles exactly once, skips junk frames, rejects on CLOSED (for a pending sub)
or close/error before EOSE with a sanitized reason, and marks timed-out reads
partial (non-enumerable; tools add partial/relayNotice in the fenced data and a
gateway note outside it; partial reads are not cached). publish/publishTagged
skip junk frames too. Tool args: integer limit 1..1000, sinceSeconds 1..30 days
(rejected, not clamped).
Tests: 101/101 (17 new in test/relay-robustness.test.mjs; the new tests fail
against the old code). Merges with #3690 with two one-line conflicts in
nostr-federation.mjs and two blocks in server.mjs (resolutions in the PR).
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01EwK8N12XfJiMbebRbWeoob
* fix(ci): baseline the new relay-robustness test like its node:test siblings
plugins/ruflo-x-gateway/test/relay-robustness.test.mjs imports nostr-tools/pure,
same as its siblings (gateway/oauth/registration/claude-directory/github), which
the root bare vitest run cannot resolve (own plugin-local deps, not in the root
npm workspace). The sibling files are already baselined for exactly this reason;
this new file was missing from the list, so the root "Test Suite" CI job failed
with "CI test ratchet: FAILED ... Cannot find package 'nostr-tools/pure'".
Not a real regression: confirmed the test passes under its real runner
(`npm test` in plugins/ruflo-x-gateway — 125/125 passing).
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* feat(marketplace): list Agentic QE (agentic-qe-fleet) as an external, pinned plugin
The ruflo marketplace now lists agentic-qe-fleet by a git-subdir source pinned
to agentic-qe v3.15.0 (1363bc7d), so `/plugin install agentic-qe-fleet@ruflo`
installs the plugin from its own repository: 11 QE agents, 9 skills, 9 commands,
the agentic-qe MCP server pinned to 3.15.0, and the aqe-mod guard.
Tooling that assumed every entry is a local ./plugins folder now handles an
external one:
- validate-marketplace.yml checks an external entry (git-subdir, https url,
path without .., full sha, description) instead of failing on it
- smoke-all-plugins checks out each external entry at its sha and runs its own
scripts/smoke.sh (--skip-external to omit); the workflow also runs when
marketplace.json changes
- ruflo-console 0.40.9: plugin-map line (Dev Tools), the coverage test requires
a line for every external entry, and the Plugin Catalog reads an external
plugin from its install path in installed_plugins.json (EXT badge)
- README and plugins/README rows; ADR-484 records the decision and evidence
* docs(adr-484): record what Claude Code before 2.1.69 does with the external entry, and main's existing floor
* fix(ci): fence the external-plugin smoke: github-only sources, realpath containment, scrubbed env and cwd, read-only token
Review findings 1 and 2 on #3950:
- scripts/external-plugins.mjs: sources must be https://github.com/<owner>/<repo>(.git);
the plugin folder, its manifest and smoke.sh must stay inside the checkout after realpath;
the external smoke.sh runs with only PATH, LANG, TERM and CI kept (no GITHUB_TOKEN,
ACTIONS_*, *_TOKEN, *_KEY, *SECRET*), a temporary HOME, and its checkout (in a temp
folder outside the workspace) as cwd; git fetch runs with the same env
- validate-marketplace.yml applies the same github-only allowlist and path rule
- all-plugins-smoke.yml: permissions contents: read, persist-credentials: false,
runs tests/external-plugins.test.mjs
- tests/external-plugins.test.mjs: non-github host and lookalikes refused by both
validators, symlink escapes refused, child env has no GITHUB_TOKEN and cwd is outside
the workspace
* ci(all-plugins-smoke): raise the smoke-all timeout from 10 to 15 minutes
Review finding 4 on #3950: green runs on main take 9m40-9m50s, so the job sat on the
10-minute cap and was cancelled at 10m16s on this PR.
* test(console): an external plugin's description, version, source line and docs are stripped of escapes and bidi controls
Review finding 3 on #3950: the catalog reader already passes every external manifest
string through plain() (ESC/CSI/OSC sequences, C0/C1 controls, U+202A-202E and
U+2066-2069 removed); this test holds it to that.
* ci(test-ratchet): tests/external-plugins.test.mjs runs under node --test, not the root vitest
all-plugins-smoke.yml runs it with node --test; vitest reported "No test suite found".
* feat(marketplace): move the agentic-qe-fleet pin to v3.15.1 (4f0f8412)
agentic-qe v3.15.1 changes only the aqe-mod guard (#920: hardened, still tighten-only,
same engine API and events as 3.15.0) and pins agentic-qe@3.15.1 in .mcp.json.
* docs(adr-484): install evidence re-run at the v3.15.1 pin
* feat(marketplace): move the agentic-qe-fleet pin to v3.15.2 (9db36edf)
agentic-qe v3.15.2: aqe-mod reports its real version, keeps guard totals and the last
refusal across sessions (additive totals/lastRefusal in status.json), and never reads or
writes its status file through a symlink (adds $.fs.read and $.fs.stat); guard judging
unchanged. .mcp.json pins agentic-qe@3.15.2. ADR-484 evidence re-run at this pin.
* fix(marketplace): plain-name paths for external plugins, pin-review note, one marketplace for agentic-qe-fleet
- both validators (scripts/external-plugins.mjs, validate-marketplace.yml) require the
plugin path to match ^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$ with no . or .. segment:
%2e%2e, a\..\b, a//b and a trailing slash are refused; tests cover both validators
- ADR-484: every pin bump needs a review of the pinned scripts/smoke.sh
- READMEs: install agentic-qe-fleet from the agentic-qe or the ruflo marketplace, not both
* feat(marketplace): move the agentic-qe-fleet pin to v3.15.3 (d7e5ffa7)
The plugin at v3.15.3 differs from v3.15.2 only in its version and its MCP
pin (agentic-qe@3.15.3). ADR-484's evidence records the install re-run at
the new pin.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.4 (bec02b13)
The plugin at v3.15.4 differs from v3.15.3 only in its version and its MCP
pin (agentic-qe@3.15.4). ADR-484's evidence records the install re-run at
the new pin.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.5 (d65ede14)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(console): leave the console version bump to the maintainer at merge
The console version and CHANGELOG entry collided with every console release on
main (four rebases on 2026-10-12, each only plugins/ruflo-console/CHANGELOG.md).
plugin.json, hooks/version.ts, scripts/smoke.sh and CHANGELOG.md now match
main; ADR-484 and its index row say 'next console release'.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.6 (0fa34d24)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.7 (7f2d091d)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.8 (d9ce98f7)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.9 (d1c33d2b)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.10 (e5814a2f)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: rUv <ruv@ruv.net>
* fix(ci): add live-registry audit for unpublished leaf pins (#4303)
audit-wrapper-dep-ranges.mjs and audit-leaf-package-publish.mjs only check
that a non-bundled @claude-flow/* leaf's CLI pin agrees with the workspace's
own version. Neither asks npm whether that version was ever published.
#4279 bumped @claude-flow/memory to 3.0.6 in the workspace and pinned the CLI
to match; both existing audits were green since workspace and pin agreed with
each other, but the standalone `npm publish` for memory was never run. 3.57.2
shipped depending on a version of memory that did not exist, breaking every
fresh install with ETARGET.
Add audit-leaf-versions-published.mjs, which queries the live npm registry
for each non-bundled leaf and fails if the version the CLI's pin resolves to
was never published. Wired into the plugin-package-audit CI job (same gate as
the two existing leaf audits) and documented as a required pre-tag step in
CLAUDE.md's publishing rules.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix: use encodeURIComponent instead of a first-occurrence .replace for the registry URL
CodeQL flagged name.replace('@', '%40') as incomplete string escaping —
String.replace with a string pattern only touches the first match. It
happened to be harmless for npm scope names (exactly one leading @), but
it's the wrong tool for escaping a URL path segment. encodeURIComponent
also correctly escapes the scope separator (%2F), verified against the
live registry (200 OK for @claude-flow/memory).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): baseline the new audit test file like its plain-script sibling
scripts/__tests__/audit-leaf-versions-published.test.mjs is a bare Node
script (console.log + node:assert/strict), the same shape as the
already-baselined scripts/__tests__/audit-supply-chain.test.mjs — it has
no vitest-discoverable describe/it block, so the root vitest ratchet
reports "No test suite found in file" and fails CI's Test Suite job.
This is not a real regression: the file was never runnable by vitest in
the first place (same category as its sibling, which IS correctly listed
here already). The test itself passes fine when run directly via
`node scripts/__tests__/audit-leaf-versions-published.test.mjs` (6/6, see
the PR description).
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* fix(ruflo-mods): trust gate also treats the agent.spawn, prompt.submit, tool.call, command.run, session.append and agent.register calls and the tool.describe and session.append hooks as risky (#3787, #3801)
Adversarial review of the previous commit: risk was checked per scanned
`calls` and `events` separately, and only the events side had agent.spawn
and prompt.submit, so a mod CALLING $.agent.spawn / $.prompt.submit /
$.tool.call still loaded under refuse-risky ("no risky calls or hooks").
session.append and agent.register, and the tool.describe and
session.append hooks (rewriting what the model reads).
Docs follow the code: README hardening note lists the first-party mods that
now need modTrustAllow under refuse-risky (agentdb, ruos, intelligence,
graph-intelligence, goals, iot-cognitum beside swarm and console), the
modTrust row and plugin.json description name the categories, and the
create-mod skill's list matches.
* fix(ruflo-mods): trust gate judges a glob or negation by what it selects; covers prompt sections/context, peer receive, model requests (#3801)
Re-review: the scan reports hook patterns as written, and riskOf matched
names exactly, so `on('tool.*')` or `on('!tool.describe')` loaded under
refuse-risky with "no risky calls or hooks" and could answer tool
permission verdicts (shown: tool.check returned allow). A glob now maps to
every risky event it selects, a negation to `*`, and any classic.* pattern
to the classic risk. Lookups use Object.hasOwn.
Same-category hooks added: prompt.section, prompt.context,
prompt.attachment, skill.prompt, session.receive, turn.step, and hooks on
process.run / http.fetch / mcp.call (they can answer other mods' calls).
Docs: every first-party mod with function hooks (43 of 43) is risky under
the gate's sets, so the README now says to allow-list each ruflo mod you
use under refuse-risky and points to `claude plugin validate`.
* fix(ruflo-mods): a hook on a risky call is a risky hook (fs.write, env.set, process.spawn, ...) (#3801)
Third review: every $ call is also an event a hook above the caller can
rewrite or answer for every other mod. Under refuse-risky a mod hooking only
fs.write loaded clean and redirected ruflo-mods' own heartbeat write to
.claude/settings.json; one hooking env.set rewrote RUFLO_MODS_OWNS; one on
process.spawn rewrote an allow-listed mod's argv; fs.* loaded too.
Hook risk is now derived: every RISKY_CALLS entry is also a risky event
("can rewrite or answer another mod's <call>"), on top of RISKY_EVENTS
(+ tool.register). Globs match against the union. Tests: fs.write, env.set
and fs.* refused (each fails on the previous head); the harmless-glob
control is clock.*, since command.run is a risky call. README and the
create-mod skill say so.
* fix(ruflo-mods): trust gate treats hooks that forge what other mods read, or replace the conversation, as risky (#3801)
Fourth review: a mod hooking only fs.stat (answer ENOENT for the policy
projection) or fs.read (return an empty observe projection) loaded under
refuse-risky and turned ruflo's own enforced deny into allow; one hooking
session.compact replaced the whole conversation. Added fs.read, fs.stat,
fs.exists, fs.list, settings.read, env.get, session.compact, prompt.edit
and attribution.text to the risky hooks; three tests (each fails on the
previous head). README states the gate is a list over the 2.1.289 engine
API, so an event added later is not judged until listed.
* fix(ruflo-mods): session.root, session.cwd, fs.ancestors and command.register hooks are risky; docs name ruflo-ruos (#3801)
Fifth review: a mod hooking only session.root moved ruflo-mods' project
root, so the enforced policy projection was read from elsewhere and a deny
became allow (the round-4 exploit through another input). Added those
inputs and command.register (consistent with tool.register), with a
root-forger test (fails on the previous head). Derived messages read
"another mod's fs.write, which writes files ..." instead of nesting
parentheses.
Docs: ruflo-ruos hooks only prompt.submit, so it is newly risky under
refuse-risky (#3787); README and PR body said every first-party mod was
already risky via a status file or tool.call, which was false for it.
* test(router): seed Thompson sampler convergence trajectory
* ci: retain one plugin smoke execution and its report
* Register smoke workflow test with its dedicated Node runner
* Prevent same-millisecond hierarchy embedding index collisions
mergeServers.spec.ts fails under the root vitest run with the exact
same TSCONFIG_ERROR (vite:oxc, "Tsconfig not found") as every other
ruvocal spec file already listed here — reproduced on an unrelated,
long-committed sibling (isURLLocal.spec.ts) to confirm this is a
pre-existing environmental gap in how root-level vitest resolves
ruvocal's tsconfig, not something introduced by this PR's new file.
Co-Authored-By: RuFlo <ruv@ruv.net>
#4277 fixed the bundle drift and made the build start on Windows by
running `npx esbuild` with `shell: true` when process.platform is
win32. That branch ignores ESBUILD, so a Windows --check doesn't use
the esbuild version CI pins, and it hands the file paths to cmd.exe
unquoted.
Replace the branch with one path for every OS: ESBUILD, when set, is
still run directly as an executable (CI, the plugin READMEs and
codex-mod-hooks.test.mjs rely on it); without it the repo's own
esbuild is loaded through its JS API (buildSync), as
plugins/ruflo-console/scripts/build-tui.mjs already does. No shell,
no .bin shim. Bundles are unchanged.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-agentdb): stop the secret screen treating a hyphen-named memory key as a credential field
assignmentSecret() ran the KEY_NAME key-assignment check on every match, so
any entry whose name starts with auth (auth-flow-notes) plus up to 40 name
characters looked like a config field, and keyedSecret()/plausibleSecret()
then judged the entry's value as a credential: a write of
{ key: 'auth-flow-notes', value: 'getUser-not-getSession' } was refused
(#4202). A key that is itself a multi-word hyphenated name is an entry's
name, not a field, so the keyed check now skips it; the secret shapes still
screen the whole text, and single-word credential keys (auth, api_key,
token) keep blocking keyed literals.
Synced to the 39 plugin copies with scripts/sync-mod-screen.mjs.
Fixes#4202
Assisted-by: AI (automated contributor session, disclosed on the issue)
* chore(ci): exclude plugins/ruflo-agentdb/tests/guard-keys.test.ts from the root vitest run
The new test imports claude-code/testing like its six siblings, so the root
ratchet run (scripts/ci-test-ratchet.mjs) cannot collect it outside Claude
Code; list it in scripts/ci-test-excluded.txt per the documented convention
so ci.yml stays green until 'claude plugin test plugins/ruflo-agentdb' runs
it in all-plugins-smoke.
Follow-up to #4202
Assisted-by: AI (automated contributor session, disclosed on the issue)
- #4127: PostToolUseFailure registered for Bash and Write|Edit|MultiEdit and forwarded with -s false and the real exit code (builds on #4170 by @rudycelekli; payload shape verified against Claude Code 2.1.289)
- #4176: the hook shim starts the CLI from CLAUDE_PROJECT_DIR; the CLI only adopts a proven config in a directory that carries ruflo init's markers, not a bare .claude/ that Claude Code created
- #4128: the shim starts the CLI detached and returns at once (about 25 ms instead of 0.2-4 s per hook), bounded to 4 concurrent telemetry CLIs per project, Stop never dropped, RUFLO_HOOK_SYNC=1 for the old path
- ruflo-core 0.2.9
Co-Authored-By: RuFlo <ruv@ruv.net>
On Claude Code Desktop every picture was missing: no banner, no title
art, no topology, map, gauge or chart, and not even the text lines meant
to stand in for them. The host completes every resolved table with every
element name, and on the desktop its Raster draws an empty fragment, so
`kit.Raster !== undefined` always held and the console drew empty boxes.
- kitForSurface(): the terminal gets its Raster and no Svg; every other
surface (desktop, vscode, mobile) gets Svg and no Raster. Applied to the
Pane and the band. On the terminal nothing changes: the same Rasters,
keys, text and fallbacks.
- gfx/svg.ts: the same Grid as one SVG document. Every Block Elements
glyph (U+2580 to U+259F) and every braille glyph is drawn as
rectangles; other glyphs are placed cell by cell (a control character,
a value past Unicode or a character XML cannot hold is a blank cell);
colours are kept, the default background stays transparent, text is
escaped. A picture that would pass the host's 131,072-character Svg
limit is not sent, so one large picture cannot invalidate the whole
tree; it then falls back as on a surface with no pictures (its text line
where it has one).
- A surface that draws Svg gets still frames, since nothing blits an Svg:
nothing strikes in and the motion stops, as with fps 0, and the
decorative light (the header's sweep, the title's shimmer, the palette's
sweep) is off instead of caught mid-way. The boot keeps its real time so
its progress shows, and a picture of data is drawn as of the render. The
terminal keeps its moving light, with fps 0 too.
- art(): one helper for every picture site (header, title art, boot,
Orbital art, picture(), learning, memmap, palette). An Svg's alt is the
picture's fallback line without "needs a terminal".
- The frame loop runs while the view has pictures, as before, so the
menu entry and the Learning pulse still move on the desktop; it only
rebuilds and blits when a Raster is mounted, so the desktop no longer
rebuilds every picture per frame and blits keys that were never mounted.
The band's mark animates on the terminal only.
- tests: svg-pictures.spec.ts (vitest) for the writer, the kit, the still
frames (on every page in every look: header, title and palette the same
at any moment, every other picture equal to fps 0's) and the frame loop
by surface; surface-pictures.test.ts mounts the 33 main views and the
agent drill-down of a fixture agent in the bbs, plain and orbital looks
on terminal and desktop (7 tests, all fail on the parent commit). It
imports claude-code/testing, so it is listed in
scripts/ci-test-excluded.txt with the console's other kit tests. The old desktop test only asserted "no Raster",
which held while every picture was gone; it now asserts the Svgs arrive.
Fixes#4111
Co-Authored-By: Ruflo & AQE
README gets a short optional pointer (npx ruflo tui, --plain) and one small animated SVG. docs/USERGUIDE.md gets a
Terminal UI (optional) section: requirements, commands, keys, exit codes, what each page shows, the AI page's ask-first
card and its Codex/OpenRouter rules, the honest limits and a pointer to the Orbital theme. Both SVGs are built from real
frames of ruflo-tui 3.56.7 in a throwaway sample project; scripts/render-tui-svg.mjs rebuilds them (CSS animation only,
no scripts or external references, prefers-reduced-motion shows the first frame).
Co-Authored-By: RuFlo <ruv@ruv.net>
Carries #4031 (rudycelekli) and #4091 (proffesor-for-testing); oversized-tail and permission-safe
recovery per rUv's review and martinvlad's fresh-consumer finding. Adds scripts/smoke-shared-fresh-consumer.mjs
(packed tarball, plain Node) and a CI step for it.
Co-Authored-By: RuFlo <ruv@ruv.net>
Page 6. Reuses harness.send and the conversation bridge's sendTo, not a second harness. Host.spawn runs only the pinned Codex 0.162.0
release (never current or PATH), read-only, from a fixed argument allow-list; Host.httpSend sends only https POST to openrouter.ai or a
convoTargets host, never follows a redirect, and a key is read by variable name and never drawn. Enter shows a card of exactly what would be
sent; a lone y answers it only while it was drawn in full (#3983); spend cap from the provider-reported cost. e2e host matrix gets a tui leg
(keyless in CI, live gated). Not in this PR: the workspace-write toggle.
Co-Authored-By: RuFlo <ruv@ruv.net>
