* fix(console): accept Windows paths in the autopilot envelope
#4434 added Windows path parity across the console, but the autopilot
envelope's own path validator still rejected any `\`, and the downstream
`isProtectedPath` and `pathAllowed` guards compared with POSIX-only string
ops. The code is unreachable today because autopilot start is still gated
off on Windows (ap-windows-gate.spec.ts), but it is the next thing a
Windows user will trip on when that gate is lifted — the natural
`C:\work\app` form, and every UNC path, is refused with the opaque "is
not an absolute folder below the root with no .." error.
Four narrow fixes in `hooks/data/ap-envelope.ts`, driven by the
separator-aware helpers already in `hooks/data/paths.ts`:
- `isProtectedPath`: fold `\` to `/` on a drive-lettered or UNC path
before the protected-dir compare.
- `validateEnvelope` path check: drop the unconditional
`path.includes('\')` reject (it contradicted `isAbsolutePath` which
already accepts `C:\x` and `\srv\share`), and tighten the drive-root
regex `/^[A-Za-z]:\/?$/` → `/^[A-Za-z]:[\/]?$/` so `C:\` is still
refused explicitly (was previously caught by the backslash reject).
- `validateEnvelope` output canonicalisation: use `trimTrailing` instead
of `/\/+$/` replace, so a trailing `\` on a Windows path is stripped
the way `/` already is on POSIX.
- `pathAllowed`: use `hasParentSegment`, `samePath` and `below` from
paths.ts. A file at `C:\work\app\file.ts` is now inside envelope path
`C:\work\app` (and `c:\WORK\app\file.ts` is too), while
`C:\work\application\file.ts` still is not.
Semantics on a POSIX envelope are unchanged — the new helpers degrade
exactly to their old string ops when neither side is a Windows path.
New `tests/ap-envelope-windows-paths.spec.ts` pins what should and should
not be accepted (13 cases: backslash drive, forward-slash drive, UNC,
trailing-separator strip, `..`, bare-drive-root, protected-folder,
pathAllowed under case + separator variation, prefix-match rejection).
Verified on Windows 11: new spec 13/13, ap-core.spec.ts 31/31 (no POSIX
regression), 5 envelope-adjacent specs 64/64 combined, full console suite
3444 total · 3399 pass · 13 fail — same pre-existing baseline as #4434's
own run, zero regressions.
Follow-up to #4434 R1 (https://github.com/ruvnet/ruflo/pull/4434#issuecomment-6371423874).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix: keep the backslash reject for POSIX-rooted envelope paths
#4436 review (@ruvnet): dropping `path.includes('\')` outright also
dropped the refusal for a POSIX-rooted path with backslashes smuggled
in. `/work/app\..\..\other` passes `isAbsolutePath` (POSIX form), and
`hasParentSegment` splits POSIX-only when `isWindowsPath` says the path
is not Windows, so the `..` segments are invisible to it. On a Windows
host, that leading-`/` path then resolves to `\other`, outside the
folder the user named. Unreachable today because autopilot is still
gated off on Windows, but it is the guard that gate's removal depends
on.
Keep the backslash reject, but only for non-Windows paths (POSIX
should never have `\` in its path). The native Windows forms
`C:\work\app` and `\srv\share\app` continue to pass; the mixed
`/work/app\..\..\other` form is refused as before.
Added case to tests/ap-envelope-windows-paths.spec.ts.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: RuFlo <ruv@ruv.net>
* test(console): fixture file system accepts Windows drive paths
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): Windows project folders are project folders (ADRs, export, catalog, mission cost)
Guards that accepted only a path starting with "/" treated a Windows session
folder (C:\Users\x\proj) as "no project folder is known". Adds hooks/data/paths.ts
(pure string helpers: isAbsolutePath, joinPath, samePath, plus hasParentSegment,
normalizePath, below, trimTrailing, isWindowsPath) and uses it at the absolute-path
guards in adr, event-export, wf-file, plugin-catalog, mission-cost (and the ledger
install path), wf-worktrees, skills-lab, wf-drill-io, facts, ap-envelope and
register. Each caller keeps its own ".." refusal; POSIX paths take the same code
path as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): protected autopilot folders match ignoring case on Windows paths
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): find the home folder on Windows (sessions, plugin health, What's new)
Implements homeOf function that checks HOME → USERPROFILE → HOMEDRIVE+HOMEPATH
with comprehensive test coverage. Fixes state.home initialization on Windows
where HOME is unset.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): disk writes work on Windows through the host file API
Windows has none of uname, dd, sh, install, mkdir or cp in Claude Code's process
environment, so every console write (Events, Timeline, autopilot journal, ADRs,
exports, .gitignore) failed there. New write flavor host-fs, chosen on win32 (no
uname is run), carries the enumerated writes through $.fs.read/write/exists via
writeVia. Linux GNU and macOS/BSD argv are unchanged (pinned by test).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): autopilot kill flag can be cleared on Windows; document host-fs create window
Windows has no delete, so clearKill rewrites the KILL flag with a fixed marker and
killSeen treats exactly that content as not set (host-fs only); stopNow rewrites
the flag empty so a second stop is seen. POSIX rm/stat behaviour is unchanged.
write-via and wf-file now say host-fs creates are check-then-write (no O_EXCL).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): no Linux-only process probe on Windows; clear probe timers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): a hive started from the console shows at once
When a start's CLI run exited 0 but its verify fails (the CLI can return
before its state file lands), wait 1 s via host.after, read fresh and verify
once more before reporting the "expected ..." text. No retry when the run
failed; exactly one retry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(console): pin Windows containment, parent-segment and UNC rules in paths.ts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): workspace keys equal across drive-letter case and trailing separator
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): autopilot start is refused on Windows until atomic appends and Windows-aware path checks exist
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore(console): 0.42.2 changelog and version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(console): read home variables by literal name so the module loads
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* post-merge cleanup: finish #4036 integration
The Option B merge commit (4313013cb) landed cleanly against upstream/main
but a batch of merge-resolution edits in the working tree were not persisted
into the commit itself. This commit finishes the integration:
Path-helper consolidation (abs-path.ts → paths.ts):
- hooks/data/wf-drill-io.ts: add missing paths.ts import for below,
hasParentSegment, isAbsolutePath, samePath, trimTrailing (fixes 4
wf-drill-read.spec.ts failures that threw `ReferenceError: isAbsolutePath
is not defined` at runtime).
- hooks/adr.ts: migrate from ./data/abs-path to ./data/paths, pulling in
joinPath which is needed at lines 89/94.
- hooks/register.ts: drop the rootedPath import from the deleted
abs-path.ts; inline the equivalent isAbsolutePath+joinPath expression.
- hooks/data/event-export.ts, hooks/data/wf-file.ts: drop the duplicate
isAbsolutePath import from the deleted ./abs-path (the main-side wider
'./paths' import already covers it).
VERIFY_RETRY_MS lifecycle (ADR-450 interaction with Marius' feature):
- hooks/runner.ts: extend the retry condition — `verified === 'n/a' &&
spec.verify !== undefined` also retries, so a snapshot that hasn't
loaded yet (null, not "no verifier") gets the one-second re-check.
Tests brought in line with the new timing / platform guards:
- tests/tui-actions.spec.ts: settle(600) → settle(1200) at the point the
runner's VERIFY_RETRY_MS one-second re-check has to resolve before the
verdict is drawn.
- tests/windows-drive-path-sites.spec.ts: fsWithDir made separator-agnostic
via a normSeps helper, since joinPath now uses the base path's own
separator (`\` on a Windows base).
Version bump:
- .claude-plugin/plugin.json, hooks/version.ts, scripts/smoke.sh: 0.44.7
→ 0.44.8.
- CHANGELOG.md: prepend 0.44.8 entry crediting #4036 and @socrates6969.
Verified: full console suite 3400 total · 3362 pass · 15 fail · 23 skipped.
Every one of the 15 remaining fails is pre-existing on main or a
platform/env limitation (Windows chmod, fake-timer timing, codex not
installed) — zero merge-caused failures remain.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: Marius Carlsson <109006081+socrates6969@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mario Jauvin <marioja@users.noreply.github.com>
Co-authored-by: r <r@x>
* feat(ruflo-console): ruRE page in TOOLS — static reverse engineering from the console (ADR-494)
A TOOLS page for the six rure_* tools of ruflo-rure, built the way the Sandbox
page is: six Dev Tools entries (dt-re-*) drawn on a page of their own, so they
share the confirm gate, palette ids and result panel. Five rows are $0 reads;
UNPACK .ASAR writes outside the project and asks first. A new 'sample' field
takes only a project-relative path. Results are the analyzed file's own text
and pass plain() so a hostile binary cannot put an escape on the terminal; a
number that is not a measurement reads n/a. A CLI without the tools says to
update. Enter in a ruRE field runs that page's row.
Tests: rure-page.spec.ts (catalog vs real schemas, readers vs real captured CLI
output, hostile answers, page, guide, palette, Enter routing) and
rure-e2e.spec.ts (every row's argv through the built CLI on real files,
including a hostile ELF; fails with plain() removed). Console 0.44.7 -> 0.45.0;
ruflo-rure 0.4.1 -> 0.4.2 (docs only).
Co-Authored-By: RuFlo <ruv@ruv.net>
* test(ruflo-console): ruRE e2e accepts either AIDefence outcome (CI has no AIDefence)
The .NET e2e asserted a string literal was 'hidden by AIDefence', true only
where the optional package is installed. In CI the tool reports screened:false
and the page says 'not screened: AIDefence was unavailable'. Both are honest;
the test now pins that the screening state is always on screen.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-console): ruRE EVM result no longer shows a doubled ellipsis
plain() already marks a clipped value; the reader added a second one to the
event topic and the IPFS hash. Test pins it.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
Move the external agentic-qe-fleet entry from v3.15.11 (221d6de1) to
v3.15.12 (90a91fe3), the current npm latest, and update the README links,
the external-plugins test fixture and ADR-484.
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The Stop hook spawned the CLI with no cwd, so it created a stray
.swarm/memory.db in the session project instead of the MCP data root.
Pass cwd: CLAUDE_FLOW_CWD || process.cwd().
Co-authored-by: r <r@x>
Closes the findings from an independent review of ruRE 0.1.0-0.4.0:
screen every attacker-derived string and report screened/skippedFiles,
walk without following symlinks under a total-byte budget, linear EVM
file sniffing, an iteration budget for ELF/PE table walks, guarded ELF
e_entry, and single-descriptor reads. Each fix has a test that fails
without it.
Co-authored-by: r <r@x>
Adds rure_analyze_evm per ADR-0005: aligned disassembly and pattern scan
for dispatcher selectors, hazardous opcodes, embedded addresses, event
topics, EIP-1167 minimal proxies, solc metadata and embedded strings.
No interpreter, RPC or network; PUSH data is never read as opcodes;
input capped at 256 KiB; embedded strings pass the AIDefence gate.
Co-authored-by: r <r@x>
Adds rure_analyze_dotnet per ADR-0004: an original pure-TypeScript
ECMA-335 metadata reader (assembly identity and references, types,
method count, P/Invoke imports, user-string literals, entry point).
No dependency, no IL decoding, never loads or runs the assembly. Table
extents are validated against the stream before any row is read, and all
extracted text passes through the AIDefence gate.
Co-authored-by: r <r@x>
Adds rure_analyze_binary per ADR-0003: an original pure-TypeScript
container parser (format, arch, entry, sections, linked libraries,
imported/exported symbols, optional strings). No disassembler, no new
dependency, never loads or executes the target. Reads are bounds-checked,
tables and strings are capped, files over 128 MiB are refused, and all
extracted text passes through the AIDefence gate.
Co-authored-by: r <r@x>
* docs(ruflo-rure): ADR-0001 scope/dual-use policy, ADR-0002 Phase 1 architecture
Fixes#4395 (part 1 — research/planning phase)
Co-Authored-By: RuFlo <ruv@ruv.net>
* feat(ruflo-rure): Phase 1 implementation — JS/Electron static analysis
Implements the plugin scaffold (manifest, skill, command, agent, smoke
test, benchmark) and the three Phase 1 MCP tools per ADR-0001/0002:
- rure_extract_asar: resource-capped .asar extraction via @electron/asar,
checking the archive header's declared size/file count before writing
anything (decompression-bomb guard).
- rure_analyze_js_app: TypeScript-compiler-API-based static analysis —
import/export graph, Electron process-boundary detection (ipcMain/
ipcRenderer/contextBridge, require("electron"), nodeIntegration flags),
every finding evidence-sourced to file + line range.
- rure_find_feature: deterministic lexical/structural feature search,
explicitly not semantic/LLM matching.
Every extracted string is routed through the AIDefence content gate
before being returned; flagged content is redacted, never dropped
silently. Parses only — never executes analyzed code, independently
verified by scripts/smoke.mjs grepping the real source (comments
stripped first, so the doc comment describing the property can't trip
its own check).
27 new tests, all passing. Typecheck clean. Tool-description audit
(ADR-112) clean. Benchmark: ~3.6k-18k files/s on a synthetic Electron
bundle (plugins/ruflo-rure/scripts/benchmark.ts).
Trust tier: experimental. Marketplace/directory submission is a
separate, explicit decision, not part of this change (ADR-0001).
Part of #4395.
Co-Authored-By: RuFlo <ruv@ruv.net>
* feat(console): add ruflo-rure to the plugin map (devtools section)
Every plugin directory needs a line in PLUGIN_MAP or the console's own
plugin-coverage test fails. ruflo-rure lands in devtools, same section
as the other inspection/analysis plugins (ruflo-browser, ruflo-jujutsu,
ruflo-testgen).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-rure): fix CI failures — real deps, capability-brain classification
Three real bugs surfaced by PR #4396's CI, not flakes:
- typescript was only a devDependency of @claude-flow/cli, but
src/rure/ts-walk.ts needs it at runtime. Moved to dependencies.
(CI: "Cannot find package 'typescript'" in a from-source install.)
- @claude-flow/aidefence was never declared as a dependency of
@claude-flow/cli at all (only resolvable locally via monorepo
hoisting), so the AIDefence gate silently no-op'd in CI's isolated
install. Added as an optionalDependency, matching the existing
graceful-degradation code path and the browser_act precedent this
also fixes.
- capability-brain.ts classified every registered MCP tool into a
domain by prefix; the three new rure_* tools had no domain, so
guidance-brain.test.ts's "classifies every live registered tool"
assertion failed. Added a 'reverse-engineering' domain (experimental
maturity, matching ADR-0001's trust tier) and its package-owner
lookup entry.
All 35 rure + guidance-brain tests pass; typecheck clean;
audit-tool-descriptions and audit-cli-mcp-tools clean.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-rure): revert @claude-flow/aidefence optionalDependency, mock it in tests instead
Reverts the optionalDependency added in 2570cf39d — it's on the #2561
forbidden-heavy-optionalDependencies list (CI's "Enforce CLI + ruflo
optionalDependencies budget" guard caught it): adding it back to
@claude-flow/cli regresses the cold `npx -y @claude-flow/cli@alpha
--version` startup time that #2561 fixed.
gateWithAIDefence's dynamic import was always meant to be speculative
— present only if something else in the install graph happens to pull
it in, same as the existing (unexported) copy in
browser-intent-tools.ts, which never declares it as a dependency
either. The real fix for "my tests need deterministic flagging
behavior" is mocking the module boundary, not forcing the real
optional package to be installed. Both rure-aidefence-gate.test.ts and
rure-tools.test.ts now vi.mock('@claude-flow/aidefence', ...), matching
the precedent in issue-2670-security-defend.test.ts. Added one more
test asserting graceful pass-through (not a thrown error) when the
module genuinely isn't resolvable.
36/36 rure + guidance-brain tests pass; typecheck clean; CLI
optionalDependencies back to 12 (budget 13), no forbidden entries.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-rure): alias typescript/@electron/asar in the isolated analyze-command test
analyze-json-output.test.ts runs analyzeCommand in a fully isolated temp
directory (scrubbed PATH/HOME/TMPDIR, no real node_modules reachable),
resolving only the handful of packages it explicitly aliases to this
package's own resolved paths (vitest, semver, bcryptjs, zod, plus the
cli-core/security source trees). The capability-brain / mcp-tools
registry analyzeCommand transitively loads now reaches rure-tools.ts,
so the same treatment is needed for its two real dependencies:
typescript (compiler API, src/rure/ts-walk.ts) and @electron/asar
(src/rure/extract-asar.ts) — both aliased to requireHere.resolve(...),
matching the existing zod/semver/bcryptjs pattern exactly. This is the
sanctioned mechanism this test already uses for a dependency it
genuinely needs to execute; it's unrelated to the heavy-package
absence assertions earlier in the same file (ruvector, agentic-flow,
@huggingface/transformers, etc.), which stay untouched.
20/20 analyze-json-output tests pass; full rure + guidance-brain suite
(56 tests) passes alongside it in the same run.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-rure): memoize the aidefence module resolution, make gateAll sequential
CI's "Test V3 Packages" job reproducibly failed exactly one test —
gateAll's "preserves order and length across mixed benign/flagged
input" — twice, while every other mock-dependent test in the same file
passed both times. gateAll was the only caller that resolves
@claude-flow/aidefence via several concurrent gateWithAIDefence calls
(Promise.all over the input array); every other test calls it once.
In CI, @claude-flow/aidefence is genuinely absent from node_modules
(confirmed by this job's own "@claude-flow/aidefence not loadable"
log line elsewhere in the same run) — unlike this dev environment,
where it's pnpm-hoisted and physically present, just mocked over.
Fix: memoize the dynamic import behind a single shared promise, so
concurrent callers all await the same resolution attempt instead of
each firing their own against a module vi.mock has to intercept
without a real file backing it. Also made gateAll sequential as
defense in depth — gating is cheap, and there's no reason multiple
calls need to race the first-ever resolution attempt at all.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-rure): add @electron/asar to the root package.json for CI's Test Suite job
Root CI's "Test Suite" job never installs v3/'s own pnpm workspace —
it runs `npm ci` at repo root only, then runs vitest from repo root
against v3/@claude-flow/cli/__tests__/*. Module resolution for those
test files walks up from v3/@claude-flow/cli (no node_modules there in
this job) through v3/ (also none) to the repo root's node_modules,
which is why `typescript` already resolved (already a root
devDependency, for an unrelated reason) while `@electron/asar` did
not (never referenced anywhere in the root tree before this).
Added @electron/asar to the root dependencies, matching how zod/ws
are already placed there for the same reason, and regenerated
package-lock.json. The regen also synced two pieces of real,
pre-existing lockfile staleness this surfaced: the recorded root
version (3.58.0, several releases behind the actual 3.59.17) and a
leftover `toml` dependency entry (removed from package.json before
this PR, but never swept from the lockfile until this install).
Verified against CI's actual invocation shape: `node
node_modules/vitest/vitest.mjs run v3/@claude-flow/cli/__tests__/rure-*`
from repo root, not just the v3-workspace-scoped `npx vitest run` I'd
been using to verify until now.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-rure): lazy-load the TypeScript compiler instead of a top-level import
ts-walk.ts statically imported `typescript` at module scope. Since
rure-tools.ts is registered into mcp-client.ts's shared tool list, every
CLI invocation loaded the full TypeScript compiler into memory at
startup, not just commands that use ruRE — the same failure shape as the
#2561 cold-start regression (@claude-flow/aidefence).
This also explains three straight CI failures on the exact same file
(mods-cli-bin.test.ts, which exec's the built CLI's `init` through
execFileSync): the heavier startup made it the most likely victim of the
repo's known tinypool worker-crash flake under CI's resource limits.
Fix: import type-only `typescript` for AST types, and lazy-load the real
module (memoized) inside analyzeModuleSource, matching the pattern
already used by aidefence-gate.ts and extract-asar.ts. This makes
analyzeModuleSource/analyzeJsApp/findFeature async; updated their two
call sites in rure-tools.ts and the benchmark script, plus the test
files's call sites.
Verified: `node bin/cli.js --version` succeeds with node_modules/typescript
physically removed (previously would have crashed), confirming the
compiler is no longer loaded on every invocation.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
ruflo's federation layer already supports pointing at a self-hosted
gateway/relay instead of x.ruv.io — RUFLO_X_GATEWAY_URL,
RUFLO_X_RELAY_WS and RUFLO_X_RELAY_HTTP are already read by
v3/@claude-flow/cli/src/mcp-tools/x-federation-{tools,join,channels}.ts
before falling back to the x.ruv.io/relay.ruv.io defaults. The gap was
discoverability, not capability: nothing told a user this override
exists, and the console's x.ruv.io board never mentioned it.
- plugins/ruflo-x-gateway/README.md: new "Self-hosting a custom
federation gateway" section explaining both layers (client-side env
vars for the CLI's own tool calls; server-side deploy vars for
running your own gateway instance) and what deliberately stays
fixed (the Claude plugin directory submission's .mcp.json, guarded
by test/claude-directory.test.mjs — that one endpoint is reviewed
and vetted by Anthropic, so it can't be templated).
- plugins/ruflo-console/hooks/xruv.ts: a one-line comment pointing at
the README from the RELAY constant. The constant itself is
unchanged — this file is documented "Pure: entries and parsers
only, no $", so it can't read process.env to show a self-hoster's
actual configured relay; the honest fix is pointing at the real
override, not guessing at a value this file can't observe.
- plugins/ruflo-console/hooks/help-topics-more.ts: the "Use the
x.ruv.io board" help topic now has a tip naming the three env vars
and pointing at the README.
No behavior change — x.ruv.io/relay.ruv.io remain the defaults
everywhere they already were.
Co-authored-by: r <r@x>
annotation-review.md's readOnly/destructive/idempotent/openWorld classification
table only listed 12 of the 14 live MCP tools. team_board (added at 0.2.0) and
run_complete (added at 0.2.1) were never added to the table, even though the
doc claims "the server tests compare the live tool list with this
classification" — nothing actually enforced that until now.
Both tools' real annotations (read from src/server.mjs) fit the existing rows
exactly: team_board uses READ(...) like the other read-only tools, and
run_complete uses WRITE(..., true) like the other idempotent upserts.
scripts/smoke.mjs now asserts the doc's documented tool set matches the live
server tool set exactly, so this can't silently drift again. Verified by
reverting the doc fix alone and confirming smoke failed with the exact
"documents every live tool" check, then restoring it.
Co-authored-by: r <r@x>
Move the external agentic-qe-fleet entry from v3.15.10 (e5814a2f) to
v3.15.11 (221d6de15c73bb385961e4e649d8fcc1f5dc2dea). The plugin folder
changed only its version and its MCP pin (agentic-qe@3.15.11). Updates
the README links, the external-plugins test fixture and ADR-484.
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(cost-tracker): match Claude Code project slug for all non-alphanumerics
The #1927 fix replaced only /, \\\\ and :, but Claude Code replaces every non-alphanumeric character in a project path with '-'. Paths containing '_' or '.' (for example C:\\Users\\john_doe\\my.project) therefore resolved to a directory that never exists, and the Stop hook silently persisted nothing (#4366).\n\nMove the encoder into a shared _encode-project-path.mjs, use it from track.mjs and the two test harnesses that were duplicating the old regex, and add unit coverage plus an end-to-end smoke case for an underscore/dot Windows path. The regression is visible in the unit test and in the 'looked under' diagnostic: the old code leaves 'my_project.v2' literal; the new code matches Claude Code's 'my-project-v2'.
* chore(witness): repoint #1927 marker to _encode-project-path.mjs (#4366)
#4366 moved encodeProjectPath out of track.mjs into a new shared
_encode-project-path.mjs, taking the #1927 marker comment with it in
different wording. Re-point all three OS manifests' #1927 entry at the
new file/marker text and regenerate so witness-marker-drift-smoke and
witness-verify-precondition-smoke pass again.
Co-authored-by: 马建彤 <majiantong666@qq.com>
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(witness): don't append a history snapshot from an unbuilt checkout
regen.mjs's --history flag records the current verification state as a
new history entry. My prior regen ran in a source-only worktree (no
pnpm build), so it recorded ~99 dist-dependent fixes as "missing" that
CI's built-tree verify never saw as missing -- history.mjs then read
that back as a mass regression against prior (post-build) snapshots.
The actual fix (#1927 marker repointed to _encode-project-path.mjs) only
needed the manifest's marker/file/sha256 corrected and re-signed, not a
new history entry. Revert history.jsonl to its pre-regen state in all
three OS directories; manifest.md.json is unchanged by this commit.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: 马建彤 <majiantong666@qq.com>
Co-authored-by: r <r@x>
`writeFileSync(victim, 'precious', { mode: 0o644 })` is still subject
to the process umask, so on a host with a restrictive umask (0077)
the file actually lands at 0600. The test then asserted the touch
script's symlink guard had left victim untouched at 0644 — true, but
victim was never at 0644 to begin with on such a host, so the
assertion failed independent of the guard's real behavior (verified
manually: the guard correctly refuses and leaves the target
unmodified).
Force the mode with chmodSync right after the write so the assertion
reflects the guard's actual behavior rather than this host's umask.
Co-authored-by: r <r@x>
* fix(ruflo-adr): find ADRs on Windows and report POSIX paths (#2413)
findAdrs matched literal /docs/adr/ substrings, so join()'s backslashes on Windows silently produced 0 ADRs. Match either separator and report the file field relative to the scan root with forward slashes so bySource and stored records are stable across platforms.
* fix(ruflo-adr): spawn npm npx-cli.js on Windows (#2413)
spawnSync cannot launch npx.cmd without a shell, so the no-installed-CLI fallback returned ENOENT and every store failed on Windows. Resolve npm's npx-cli.js (npm_execpath, PATH shims, or Node's bundled npm) and run it with process.execPath so argv stays shell-safe.
---------
Co-authored-by: rUv <ruv@ruv.net>
Three sites hardcoded `base.startsWith('/')` / `root.startsWith('/')`
as their "is the project folder known" guard. On Windows `state.cwd`
is a drive path (`C:\Users\...`), which never starts with `/`, so
each one refused regardless of settings:
- adr.ts discover() — the ADRs page never found a project's folder
- event-export.ts resolveTarget() — Events/Timeline export
- wf-file.ts resolveExportPath() — the Workflows page's saved-view
write path, and (transitively) the AI terminal's transcript save
All three now use the existing isAbsolutePath() helper (#4175 already
fixed the same bug class in register.ts). Two follow-on fixes were
needed once the guard was fixed:
- resolveTarget()/resolveExportPath() both forced a POSIX-style
leading `/` onto the reconstructed path after splitting on `/`,
discarding a Windows drive or UNC prefix. Now the leading `/` is
only added back when the original absolute path was POSIX-style.
- wf-file.ts's own containment filter (`inside`) had the identical
startsWith('/') bug, independently excluding every Windows root.
- wf-convo-live.ts's saveTranscript() pre-joined state.cwd into the
string passed to resolveExportPath(), which refuses any backslash
in its input — so a Windows cwd tripped that guard even after the
above fixes. It now passes the relative file name only, matching
resolveTarget()'s cleaner two-argument contract.
Fixes#4356 (reported by @marioja, with exact file/line citations and
a correct root-cause diagnosis for the ADRs page; this also fixes the
two related sites the report flagged as worth checking).
Validated: new windows-drive-path-sites.spec.ts (7/7), the full
plugin unit suite (219 files / 3340 tests), and the ADRs + export-
adjacent UI harness suites (adrs, labs, missions, watch — 27/27).
Co-authored-by: r <r@x>
* fix(witness): support pinned signing keys and label legacy signatures
The default witness seed is derived from the public git commit, so anyone can re-sign a modified manifest; verify.mjs still called the result cryptographically valid. Add RUFLO_WITNESS_SEED for external-key signing and RUFLO_WITNESS_PUBLIC_KEY for pinned verification (fail closed on external-key manifests without a pin), tag legacy manifests as self-attested, and stop describing the default as authorship proof.
* fix(witness): make --public-key win over the env pin
The env-var precedence audit requires a CLI flag for RUFLO_WITNESS_PUBLIC_KEY. Add --public-key, document that it takes precedence, and cover both precedence directions in the auth test.
* fix(ci): exclude witness-auth test from vitest ratchet (uses node:test)
plugins/ruflo-core/scripts/witness/__tests__/witness-auth.test.mjs imports
from node:test, not vitest, matching the same miscategorization pattern as
pod-tick.test.mjs and probe-mod-guards.test.mjs. vitest's glob picks it up
but can't parse node:test's API, so the ratchet reports "No test suite
found" even though `node --test` passes all 3 cases cleanly.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
Co-authored-by: RuFlo <ruv@ruv.net>
Reconciling the shipped similarity code against docs/metaharness-user-guide.md
turned up three divergences between what ADR-152 specifies, what the code does,
and what the docs promise.
1. Cost normalization (vector index 8) was inert below $0.999.
ADR-152 Table 1 specified `log10(usd + 0.001) / log10(10)` clamped to [0,1].
`Math.log10(10)` is 1, so the division was a no-op and the expression reduced
to `clamp(log10(usd + 0.001), 0, 1)`. Because log10 is negative for every
usd < 0.999, the clamp flattened that entire range to a constant 0 — including
the $0.048 baseline the plugin README records. Two harnesses differing only in
cost scored `cosine === 1`; the documented 9-dim vector was effectively 8-dim.
Replaced with an explicit log band: $0.001 -> 0, $10 -> 1, log-interpolated
between, monotonic and non-finite-safe. Exported as `normalizeCost()` with the
band in `COST_BAND_USD`.
2. The verdict bands had two encodings, and they disagreed.
`audit-trend.mjs` inlined the bands with a 0.80 `minor-drift` floor while the
user guide documented 0.85; `drift-from-history` prints that verdict, so the
two diverged in the 0.80-0.85 band. The bands now live once as
`VERDICT_THRESHOLDS` + `verdictFor()` in `_similarity.mjs`, `audit-trend.mjs`
imports them, and `similarity()` returns `verdict` beside `overall`. The
documented 0.85 floor is canonical.
Deliberate user-visible change: structural similarity in [0.80, 0.85) now
reports `moderate-drift` instead of `minor-drift`. `--threshold` comparison is
unaffected (it tests `overall`), but consumers branching on the verdict string
should be re-checked.
3. The user guide's weight table said 0.4/0.3/0.3; ADR-152 and the code both say
0.6/0.25/0.15. Corrected the guide, which was the outlier.
The ADR gains a dated Revision section recording both fixes and the behaviour
change. The §Spike-result figures are unchanged (the LEGAL/SUPPORT fixtures are
near-identical on the cost axis), so test-similarity.mjs Phase 8 keeps pinning
the original anchors; new Phase 7b/7c/7d coverage pins the corrected semantics.
Note this does NOT address the coarse-cosine limitation ADR-152 itself flags
("numerical cosine alone is too coarse"): uniform quality degradation still
reads as high similarity. Drift gates that must catch absolute loss should pair
structural similarity with the absolute gates rather than rely on --threshold.
Verification:
node plugins/ruflo-metaharness/scripts/test-similarity.mjs -> 128 passed, 0 failed (was 102)
node plugins/ruflo-metaharness/scripts/_spike-similarity.mjs -> both invariants hold
Co-authored-by: longxinjun-ai <longxinjun-ai@users.noreply.github.com>
Co-authored-by: rUv <ruv@ruv.net>
* fix(memory): build the RaBitQ index on demand and use it on the vector path (#4203)
shouldRebuildRabitq() had no callers and the index was only ever populated by the explicit embeddings_rabitq_build tool, so searchRabitq() always returned null and the sql.js pre-filter was dead.
ensureRabitqIndex() drives the existing thresholds from the search entry points (60s throttle, 10-vector floor, 20% drift, disabled after a missing-WASM failure, bound to the source dbPath and dimensions).
The bridge cosine path now scans RaBitQ candidates and reranks them with the same exact cosine, falling back to the unchanged exhaustive scan on any error.
* test(memory): cover RaBitQ auto-build, exact rerank and top-k recall (#4203)
Six tests against a real sqlite store: build on demand, bridge uses the index and reranks with exact cosine, no rebuild per search, below-floor negative control, exhaustive-vs-indexed parity when the corpus fits the candidate window, and recall plus exact-rerank on a 60-row corpus larger than the window (>=80% top-5 recall).
The compact nav (ADR 424) ran its groups together with a gap. A dim bar now sits between the menu, each group and the search on the first row, and between the pages on each row below. The width check counts the bars, so the search still moves to its own row when it does not fit. Presentation only: groups, pages, hotkeys and search are unchanged.
Co-authored-by: r <r@x>
* chore(release): 3.58.0 version bumps and changelog
Minor release: new memory peek command, Codex activity viewer, configurable
MCP rate limits, plus the #4303 install-breaking fix and a round of
correctness fixes merged since 3.57.2. Also bumps ruflo-console 0.44.4 ->
0.44.5 for the #4305 TUI fix, which shipped to main without a plugin version
bump (the same gap already documented as a past mistake in the console's own
changelog for 0.44.3/0.44.4).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ruflo-console): update smoke.sh's hardcoded version check to 0.44.5
The plugin.json version bump to 0.44.5 (for the #4305 TUI fix) broke the
smoke contract's own hardcoded expectation of 0.44.4 in step 1. Update the
step name and grep pattern to match.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): sync the smoke-workflow regression test to the real 15-minute timeout
#3950 bumped .github/workflows/all-plugins-smoke.yml's smoke-all job from
timeout-minutes 10 to 15 (the job now also checks out and smokes the first
external git-subdir marketplace entry, agentic-qe-fleet) but never updated
this test's hardcoded expectation of 10, breaking the Test Suite job on
every PR since.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(memory): resolve sql.js's wasm dist path directly, not via package.json
fts5.test.ts located sql-wasm.wasm via require.resolve('sql.js/package.json')
then string-replaced the suffix. sql.js 1.14 tightened its exports map to
"." and "./dist/*" only, so that package.json subpath resolve throws
ERR_PACKAGE_PATH_NOT_EXPORTED even though the wasm file is present on disk —
caught by the existing try/catch and misreported as "sql.js isn't installed",
failing all 4 SqlJsBackend FTS5 tests with "sql.js/dist/sql-wasm.wasm not
found". Resolve 'sql.js/dist/sql-wasm.wasm' directly instead, which the
"./dist/*" export already permits.
Verified: 6/6 passing locally (was 4 failed before the fix).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): move pod-tick.test.mjs to the node:test exclusion list
Same fix as #4308: this file imports test() from node:test (not vitest)
and documents itself as "Run with: node --test" in its own header, but
was miscategorized into ci-test-baseline.txt. Running it under vitest's
shared worker process correlates strongly with the ERR_IPC_CHANNEL_CLOSED
crash hit 4/6 times on this PR's own CI (#4307). Applying here directly so
this release doesn't wait on #4308 to merge first.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): cap the ratchet's vitest worker count to 2
#4307: Test Suite (ubuntu-latest) intermittently crashes with tinypool's
ERR_IPC_CHANNEL_CLOSED at three different, unrelated points across 7 runs
on this PR, after ruling out any specific file as the cause (one
candidate, pod-tick.test.mjs, was fixed separately for an unrelated
reason and the crash still recurred at a different file). The pattern
(crash location varies, happens ~60-90s into a ~9500-test run) is more
consistent with cumulative memory pressure across the default fork
pool (one fork per CPU, ~4 on a standard runner) than a single bad
test. Capping workers at 2 trades some wall-clock time for headroom
while the real cause is still open in #4307.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(graph-intelligence): build the optional cli import specifier from parts
#4307 investigation, round 8: once the worker-cap fix (3739f3a9) stopped
the random tinypool crash, Test Suite started failing deterministically
on plugins/ruflo-graph-intelligence/tests/phase4-adapters.spec.ts —
"./src/memory/graph-edge-writer.js" is not exported, even though that
spec file's own tests never execute the real GraphEdgesSource.listEdges()
(they all use inline fake listEdges() test doubles). The spec file does
statically import knowledge-graph-adapter.ts at module level, though, so
vitest's module-graph crawl sees the string literal and (CI-only, not
reproduced locally in 2/2 attempts) appears to eagerly resolve it outside
this method's own try/catch during collection.
Build both the primary and fallback specifiers from joined array parts
instead of literals, so no bundler's static import-specifier scan can
find and pre-resolve them — the actual resolution still only happens at
the real `await import(...)` call site, same as before.
Verified: full plugin suite green, 104/104 (was 8/8 on the one affected
file already — this closes the only CI-only gap).
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix(ci): baseline token-optimizer.test.ts — real, pre-existing, unrelated bug
v3/@claude-flow/integration/src/token-optimizer.ts calls
this.agentBooster.editCode(...), but the real agentic-flow/agent-booster
module's AgentBooster/EnhancedAgentBooster class has no editCode method
at all (its real API is apply/applyBatch/prefetch/...). Confirmed by
enumerating the class prototype directly. Not a version-pin issue, not
caused by anything in this release — @claude-flow/integration isn't even
part of the release train. Filed as #4311 with the real-fix suggestion
(rewrite optimizedEdit() against the actual API) for whoever owns that
integration layer; baselining here so the Test Suite ratchet reflects
reality instead of blocking an unrelated release on pre-existing debt.
Co-Authored-By: RuFlo <ruv@ruv.net>
* docs(changelog): record the CI-reliability fixes found validating 3.58.0
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* fix(x-gateway): fail fast on relay errors; never crash on malformed relay frames
The relay fetch helpers parsed relay frames without a guard and ignored relay
CLOSED/NOTICE and post-auth socket close/error.
- A malformed frame ('not json{', 'null', an EVENT without an event object, or
an EVENT for an unknown sub in fetchManyOn) threw inside the WebSocket
listener, an uncaught exception that killed the whole gateway process and
every in-flight request with it.
- A relay CLOSED or a dropped socket made reads wait the full 12 s and then
return [] as if the relay had nothing (live: channel_list {limit:-1} 12.2 s).
- limit/sinceSeconds were unvalidated (negative, fractional, huge).
Fix: fetchRecent/fetchManyOn/fetchChannel share one relayRound helper that
settles exactly once, skips junk frames, rejects on CLOSED (for a pending sub)
or close/error before EOSE with a sanitized reason, and marks timed-out reads
partial (non-enumerable; tools add partial/relayNotice in the fenced data and a
gateway note outside it; partial reads are not cached). publish/publishTagged
skip junk frames too. Tool args: integer limit 1..1000, sinceSeconds 1..30 days
(rejected, not clamped).
Tests: 101/101 (17 new in test/relay-robustness.test.mjs; the new tests fail
against the old code). Merges with #3690 with two one-line conflicts in
nostr-federation.mjs and two blocks in server.mjs (resolutions in the PR).
Co-Authored-By: claude-flow <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01EwK8N12XfJiMbebRbWeoob
* fix(ci): baseline the new relay-robustness test like its node:test siblings
plugins/ruflo-x-gateway/test/relay-robustness.test.mjs imports nostr-tools/pure,
same as its siblings (gateway/oauth/registration/claude-directory/github), which
the root bare vitest run cannot resolve (own plugin-local deps, not in the root
npm workspace). The sibling files are already baselined for exactly this reason;
this new file was missing from the list, so the root "Test Suite" CI job failed
with "CI test ratchet: FAILED ... Cannot find package 'nostr-tools/pure'".
Not a real regression: confirmed the test passes under its real runner
(`npm test` in plugins/ruflo-x-gateway — 125/125 passing).
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
Three reported symptoms in `npx ruflo tui` (ADR-489), all in the standalone terminal's
input/footer loop (plugins/ruflo-console/tui/run.ts) rather than missing features:
- "clicking does nothing": --mouse is opt-in by design (SGR mouse reporting fights a
terminal's native text selection, a real compatibility tradeoff — not changed here),
but nothing on screen said so. The first frame now carries a one-line notice when
mouse is off, naming --mouse, and clears on any key (including on the AI page, which
otherwise consumes every key before the normal notice-clear runs).
- "the main menu is missing": `0` already opened it, but the footer key line dropped
every mention of "0 menu" below 80 columns (and at exactly 80 with a scroll-position
suffix) — a common tmux/editor-pane width. Added an intermediate tier that keeps
"0 menu" down to 62 columns, trading away the go prompt and Back there instead.
- latent: with --mouse on, a press+release pair delivered in one `data` chunk (observed
from tmux) was silently dropped — onMouse anchored its regex to the whole chunk, so a
terminal that coalesces reports never matched. Now scans the chunk for every report.
Also strengthened the existing "click opens Cost" assertion: it only checked that the
word "Cost" appeared on screen, which is always true (it's in the page bar regardless of
the active page) — not that the click actually switched pages. Verified against the
reverse-video page marker instead, the pattern the other nav tests already use.
Verified: the published `@claude-flow/cli@3.57.2` / `ruflo@latest` tarball already
bundles ADR-489 phase 5/6 (menu, go prompt, opt-in mouse) — this is not a stale-release
issue. Out of scope per ADR-489 §4.6: clickable buttons inside a page (~30 views are
`partial` in tui/parity.ts for exactly that reason).
Tests: 3 new failing-first tests (menu tier, mouse notice, coalesced click) all now
pass; full plugins/ruflo-console/ suite green (3331 passed, unrelated pre-existing
`claude-code/testing` module failures in 30 files untouched by this change); tui bundle
builds clean via scripts/build-tui.mjs; v3/@claude-flow/cli tui-command tests pass.
Co-authored-by: r <r@x>
* feat(marketplace): list Agentic QE (agentic-qe-fleet) as an external, pinned plugin
The ruflo marketplace now lists agentic-qe-fleet by a git-subdir source pinned
to agentic-qe v3.15.0 (1363bc7d), so `/plugin install agentic-qe-fleet@ruflo`
installs the plugin from its own repository: 11 QE agents, 9 skills, 9 commands,
the agentic-qe MCP server pinned to 3.15.0, and the aqe-mod guard.
Tooling that assumed every entry is a local ./plugins folder now handles an
external one:
- validate-marketplace.yml checks an external entry (git-subdir, https url,
path without .., full sha, description) instead of failing on it
- smoke-all-plugins checks out each external entry at its sha and runs its own
scripts/smoke.sh (--skip-external to omit); the workflow also runs when
marketplace.json changes
- ruflo-console 0.40.9: plugin-map line (Dev Tools), the coverage test requires
a line for every external entry, and the Plugin Catalog reads an external
plugin from its install path in installed_plugins.json (EXT badge)
- README and plugins/README rows; ADR-484 records the decision and evidence
* docs(adr-484): record what Claude Code before 2.1.69 does with the external entry, and main's existing floor
* fix(ci): fence the external-plugin smoke: github-only sources, realpath containment, scrubbed env and cwd, read-only token
Review findings 1 and 2 on #3950:
- scripts/external-plugins.mjs: sources must be https://github.com/<owner>/<repo>(.git);
the plugin folder, its manifest and smoke.sh must stay inside the checkout after realpath;
the external smoke.sh runs with only PATH, LANG, TERM and CI kept (no GITHUB_TOKEN,
ACTIONS_*, *_TOKEN, *_KEY, *SECRET*), a temporary HOME, and its checkout (in a temp
folder outside the workspace) as cwd; git fetch runs with the same env
- validate-marketplace.yml applies the same github-only allowlist and path rule
- all-plugins-smoke.yml: permissions contents: read, persist-credentials: false,
runs tests/external-plugins.test.mjs
- tests/external-plugins.test.mjs: non-github host and lookalikes refused by both
validators, symlink escapes refused, child env has no GITHUB_TOKEN and cwd is outside
the workspace
* ci(all-plugins-smoke): raise the smoke-all timeout from 10 to 15 minutes
Review finding 4 on #3950: green runs on main take 9m40-9m50s, so the job sat on the
10-minute cap and was cancelled at 10m16s on this PR.
* test(console): an external plugin's description, version, source line and docs are stripped of escapes and bidi controls
Review finding 3 on #3950: the catalog reader already passes every external manifest
string through plain() (ESC/CSI/OSC sequences, C0/C1 controls, U+202A-202E and
U+2066-2069 removed); this test holds it to that.
* ci(test-ratchet): tests/external-plugins.test.mjs runs under node --test, not the root vitest
all-plugins-smoke.yml runs it with node --test; vitest reported "No test suite found".
* feat(marketplace): move the agentic-qe-fleet pin to v3.15.1 (4f0f8412)
agentic-qe v3.15.1 changes only the aqe-mod guard (#920: hardened, still tighten-only,
same engine API and events as 3.15.0) and pins agentic-qe@3.15.1 in .mcp.json.
* docs(adr-484): install evidence re-run at the v3.15.1 pin
* feat(marketplace): move the agentic-qe-fleet pin to v3.15.2 (9db36edf)
agentic-qe v3.15.2: aqe-mod reports its real version, keeps guard totals and the last
refusal across sessions (additive totals/lastRefusal in status.json), and never reads or
writes its status file through a symlink (adds $.fs.read and $.fs.stat); guard judging
unchanged. .mcp.json pins agentic-qe@3.15.2. ADR-484 evidence re-run at this pin.
* fix(marketplace): plain-name paths for external plugins, pin-review note, one marketplace for agentic-qe-fleet
- both validators (scripts/external-plugins.mjs, validate-marketplace.yml) require the
plugin path to match ^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$ with no . or .. segment:
%2e%2e, a\..\b, a//b and a trailing slash are refused; tests cover both validators
- ADR-484: every pin bump needs a review of the pinned scripts/smoke.sh
- READMEs: install agentic-qe-fleet from the agentic-qe or the ruflo marketplace, not both
* feat(marketplace): move the agentic-qe-fleet pin to v3.15.3 (d7e5ffa7)
The plugin at v3.15.3 differs from v3.15.2 only in its version and its MCP
pin (agentic-qe@3.15.3). ADR-484's evidence records the install re-run at
the new pin.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.4 (bec02b13)
The plugin at v3.15.4 differs from v3.15.3 only in its version and its MCP
pin (agentic-qe@3.15.4). ADR-484's evidence records the install re-run at
the new pin.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.5 (d65ede14)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(console): leave the console version bump to the maintainer at merge
The console version and CHANGELOG entry collided with every console release on
main (four rebases on 2026-10-12, each only plugins/ruflo-console/CHANGELOG.md).
plugin.json, hooks/version.ts, scripts/smoke.sh and CHANGELOG.md now match
main; ADR-484 and its index row say 'next console release'.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.6 (0fa34d24)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.7 (7f2d091d)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.8 (d9ce98f7)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.9 (d1c33d2b)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(plugins): pin agentic-qe to v3.15.10 (e5814a2f)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: rUv <ruv@ruv.net>
* fix(ruflo-mods): trust gate also treats the agent.spawn, prompt.submit, tool.call, command.run, session.append and agent.register calls and the tool.describe and session.append hooks as risky (#3787, #3801)
Adversarial review of the previous commit: risk was checked per scanned
`calls` and `events` separately, and only the events side had agent.spawn
and prompt.submit, so a mod CALLING $.agent.spawn / $.prompt.submit /
$.tool.call still loaded under refuse-risky ("no risky calls or hooks").
session.append and agent.register, and the tool.describe and
session.append hooks (rewriting what the model reads).
Docs follow the code: README hardening note lists the first-party mods that
now need modTrustAllow under refuse-risky (agentdb, ruos, intelligence,
graph-intelligence, goals, iot-cognitum beside swarm and console), the
modTrust row and plugin.json description name the categories, and the
create-mod skill's list matches.
* fix(ruflo-mods): trust gate judges a glob or negation by what it selects; covers prompt sections/context, peer receive, model requests (#3801)
Re-review: the scan reports hook patterns as written, and riskOf matched
names exactly, so `on('tool.*')` or `on('!tool.describe')` loaded under
refuse-risky with "no risky calls or hooks" and could answer tool
permission verdicts (shown: tool.check returned allow). A glob now maps to
every risky event it selects, a negation to `*`, and any classic.* pattern
to the classic risk. Lookups use Object.hasOwn.
Same-category hooks added: prompt.section, prompt.context,
prompt.attachment, skill.prompt, session.receive, turn.step, and hooks on
process.run / http.fetch / mcp.call (they can answer other mods' calls).
Docs: every first-party mod with function hooks (43 of 43) is risky under
the gate's sets, so the README now says to allow-list each ruflo mod you
use under refuse-risky and points to `claude plugin validate`.
* fix(ruflo-mods): a hook on a risky call is a risky hook (fs.write, env.set, process.spawn, ...) (#3801)
Third review: every $ call is also an event a hook above the caller can
rewrite or answer for every other mod. Under refuse-risky a mod hooking only
fs.write loaded clean and redirected ruflo-mods' own heartbeat write to
.claude/settings.json; one hooking env.set rewrote RUFLO_MODS_OWNS; one on
process.spawn rewrote an allow-listed mod's argv; fs.* loaded too.
Hook risk is now derived: every RISKY_CALLS entry is also a risky event
("can rewrite or answer another mod's <call>"), on top of RISKY_EVENTS
(+ tool.register). Globs match against the union. Tests: fs.write, env.set
and fs.* refused (each fails on the previous head); the harmless-glob
control is clock.*, since command.run is a risky call. README and the
create-mod skill say so.
* fix(ruflo-mods): trust gate treats hooks that forge what other mods read, or replace the conversation, as risky (#3801)
Fourth review: a mod hooking only fs.stat (answer ENOENT for the policy
projection) or fs.read (return an empty observe projection) loaded under
refuse-risky and turned ruflo's own enforced deny into allow; one hooking
session.compact replaced the whole conversation. Added fs.read, fs.stat,
fs.exists, fs.list, settings.read, env.get, session.compact, prompt.edit
and attribution.text to the risky hooks; three tests (each fails on the
previous head). README states the gate is a list over the 2.1.289 engine
API, so an event added later is not judged until listed.
* fix(ruflo-mods): session.root, session.cwd, fs.ancestors and command.register hooks are risky; docs name ruflo-ruos (#3801)
Fifth review: a mod hooking only session.root moved ruflo-mods' project
root, so the enforced policy projection was read from elsewhere and a deny
became allow (the round-4 exploit through another input). Added those
inputs and command.register (consistent with tool.register), with a
root-forger test (fails on the previous head). Derived messages read
"another mod's fs.write, which writes files ..." instead of nesting
parentheses.
Docs: ruflo-ruos hooks only prompt.submit, so it is newly risky under
refuse-risky (#3787); README and PR body said every first-party mod was
already risky via a status file or tool.call, which was false for it.
* test(router): seed Thompson sampler convergence trajectory
* ci: retain one plugin smoke execution and its report
* Register smoke workflow test with its dedicated Node runner
* Prevent same-millisecond hierarchy embedding index collisions
x.ruv.io/mcp forced a full browser authorization_code+PKCE re-auth every time
its short-lived access token expired (every few hours). The gateway only ever
advertised swarm:read/swarm:publish in its RFC 9728 protected-resource
metadata (scopes_supported). auth.cognitum.one's own discovery doc confirms
it supports the refresh_token grant and the offline_access scope, but only
issues a refresh_token when a client actually requests it — and a spec-
compliant client only requests scopes the resource says it supports.
Add offline_access to scopes_supported and the informational scope hints in
the root/mcp info docs and the Claude directory submission manifest, so a
compliant OAuth client requests it, gets a refresh_token, and can renew the
access token silently instead of bothering the user with a new browser
consent screen every few hours. Access tokens themselves stay short-lived;
only the refresh credential is long-lived, per OAuth best practice.
Co-Authored-By: RuFlo <ruv@ruv.net>
Review of #4276:
- The offer listed every mission behind one "adopt them here" button, and
the old key mixes missions from several projects, so the natural click
took other projects' missions and removed their offers. Each offered
mission now has its own adopt / not here; "none of these" dismisses all.
Dismissals are saved per mission id (`legacyDismissed: string[]`; the
earlier `true` still covers what was offered then).
- A failed project-key write still pruned the shared key. writeLedger now
returns the ids it saved (null on failure), and loadLedger's claim and
adoptLegacy prune only ids that were saved.
- An offer held only in the project's own key (a 0.44.3 copy) vanished on
the next save. Such offers are written back under `offered` until adopted.
- Adopting a mission older than the 20 the project keeps now returns
'full' instead of pruning it from the shared key and dropping it.
- Moving to another directory also clears goal, plan, guidance and screen.
Co-Authored-By: RuFlo <ruv@ruv.net>
#4242 keyed the mission ledger by project, but a project with no ledger of
its own still took in every mission from the old shared key that had no cwd
(all of them, since cwd was only recorded from #4237 on), and the first save
copied them into the project's own key.
- Missions with no project are offered in Mission Control (adopt here / not
this project) instead of taken in; until adopted they are not picked,
handed to Claude or put in the prompt.
- Adopt stamps the project's cwd and removes them from the shared key;
dismiss is remembered per project.
- A shared-key mission recorded for this project is taken in and pruned.
- A 0.44.3 copy with no project in a project key is offered the same way.
- loadLedger clears missions and active when the State's cwd changes
(session.start reuses the State).
- Ledger storage moves to hooks/mission-ledger.ts (mission-control.ts would
pass 500 lines); mission-control.ts re-exports it unchanged.
- Console 0.44.4: #4242 shipped under 0.44.3, so plugin update never
offered it.
Co-Authored-By: RuFlo <ruv@ruv.net>
The ledger was stored under one machine-wide key, so the active mission
of one project was shown, and injected into the prompt, in every other
project, and sessions in different projects overwrote each other's
ledger. Store it under mission-ledger:<cwd> like the UI view, record cwd
on new missions, and read the old shared key only as a fallback without
adopting its active mission or missions recorded for another project.
0.40.2 and 0.43.7 wrapped Approvals, a mission's objective and the Plan tab's
own prose; some mission text still ended in "…" at 80 columns (tmux):
- launch steps: a detail that does not fit beside its label (Claude's
guidance note, the screen verdict, the next task) wraps on rows under
the step; "Create the mission and its tasks" no longer runs into its detail
- record: the expanded mission's state/plan/evidence/executor/blocked lines,
the stale and attention notes, the legend and the observation note wrap
- Mission options: the "not offered by this session" hint wraps
Tests first: tests/narrow-width.spec.ts (2 new cases fail without the change).
Co-authored-by: korjavin <148765+korjavin@users.noreply.github.com>
* fix: bump @metaharness/darwin pin from ~0.10.2 to ~0.12.0 (#3219)
npm published 0.11.0 and 0.12.0 after the last pin bump, leaving the
optionalDependencies range, MH_DARWIN_PIN, and the plugin helper's
DARWIN_PIN_VERSION all stale. scripts/check-metaharness-pins.mjs now
reports clean (was: STALE), and the metaharness-pin-drift CI gate,
which runs on every PR touching these files, was failing repo-wide
as a result.
Verified: check-metaharness-pins.mjs exits 0; plugin test-pin-alignment.mjs
(12/12) and test-no-tool-time-npx.mjs (26/26) pass against the new pin.
Co-Authored-By: RuFlo <ruv@ruv.net>
* fix: update v3/pnpm-lock.yaml for the @metaharness/darwin ~0.12.0 bump
Minimal surgical patch (specifier/version + the resolution block's
version/integrity), not a full pnpm regen — a full `pnpm install
--no-frozen-lockfile` here also drags in unrelated transitive bumps
(ruvector 0.2.27->0.2.41, vite 7.3.0->8.3.4, etc.) that don't belong
in a pin-drift fix. Verified with `pnpm install --frozen-lockfile`.
Co-Authored-By: RuFlo <ruv@ruv.net>
---------
Co-authored-by: r <r@x>
* fix(ruflo-agentdb): stop the secret screen treating a hyphen-named memory key as a credential field
assignmentSecret() ran the KEY_NAME key-assignment check on every match, so
any entry whose name starts with auth (auth-flow-notes) plus up to 40 name
characters looked like a config field, and keyedSecret()/plausibleSecret()
then judged the entry's value as a credential: a write of
{ key: 'auth-flow-notes', value: 'getUser-not-getSession' } was refused
(#4202). A key that is itself a multi-word hyphenated name is an entry's
name, not a field, so the keyed check now skips it; the secret shapes still
screen the whole text, and single-word credential keys (auth, api_key,
token) keep blocking keyed literals.
Synced to the 39 plugin copies with scripts/sync-mod-screen.mjs.
Fixes#4202
Assisted-by: AI (automated contributor session, disclosed on the issue)
* chore(ci): exclude plugins/ruflo-agentdb/tests/guard-keys.test.ts from the root vitest run
The new test imports claude-code/testing like its six siblings, so the root
ratchet run (scripts/ci-test-ratchet.mjs) cannot collect it outside Claude
Code; list it in scripts/ci-test-excluded.txt per the documented convention
so ci.yml stays green until 'claude plugin test plugins/ruflo-agentdb' runs
it in all-plugins-smoke.
Follow-up to #4202
Assisted-by: AI (automated contributor session, disclosed on the issue)
