- Sessions list starts folded; jumping from the queue opens it.
- First reads past a pass's byte budget wait for the next pass ("not read yet").
- A Codex sub-agent rollout's trailing parent session_meta is lineage, not a second identity.
- ADR/CHANGELOG/README say discovery spawns nothing; the only write is the four-count summary.
Co-Authored-By: RuFlo <ruv@ruv.net>
Needs-you queue (approvals, questions, failures, finished-unread) across Claude Code, Codex and Ruflo
sessions, a browser grouped by repository and worktree, and a preview of the selected session. Local,
read-only discovery (no model call, no process); ambiguous identity goes to an unassigned bucket;
finished work clears only after its preview was drawn; transcript text never reaches a model, the
state, the disk or a text answer. ruflo-mods gains an optional counts-only attention row.
Co-Authored-By: RuFlo <ruv@ruv.net>
- adr-scope: each `*` became a stacked `[^/]*`, so an ADR scope entry with
many stars hung the console (10 stars: 8-15 s, ~6x per star) during verify
and goal suggestions. A segment-wise glob matcher with the same semantics.
- ADR-481: a title over 120 is refused with the count at the proposal itself
(page field, adr-propose palette, console_run); a mission-objective draft
title that is shortened says so on the confirm card; cuts and counts are in
code points (no lone surrogates; 120 emoji read back whole).
- ruflo-swarm: .claude-flow/console/adr-digest.json (committable by a cloned
repo) was appended to every subagent prompt unframed. The reader now accepts
only the console's shape (statuses, file identity, washed text, no
duplicates), quotes each record's text with marker words neutralised, and
frames the block as project data. A model-level mitigation, not a boundary.
- What's new: plugin-name maps are null-prototype with own-key lookups;
__proto__/constructor/prototype never enter seen, toasted, pinned or
dismissed records.
Co-Authored-By: Ruflo & AQE
Claude-Session: https://claude.ai/code/session_01CGoza3gyxBjpaiMPhGHcHs
The console wrote every file through GNU-only argv: dd oflag=append
iflag=fullblock, dd conv=excl, install -D and cp --no-clobber. BSD dd,
install and cp (macOS) refuse all of them, so on a Mac events never
persisted ("345 waiting to write · write failed: the write exited 1"), ADR
initialise/propose never created a file (and blamed a race), exports and
first-time state files failed, the autopilot journal was never appended or
rotated, and its cross-session kill switch was never written.
- data/write-flavor.ts detects the platform once (uname -s, own 3 s
deadline, process.platform fallback) before the controller exists; every
flavor-dependent write awaits it and its builder requires the flavor.
- Linux keeps the GNU argv byte for byte.
- macOS/BSD use a frozen set of seven constant sh scripts with the path as
"$1" (and "$2" for the copy source), never interpolated: each sets its
umask, refuses a link or a non-regular target, uses noclobber for
exclusive creates and creates missing folders. smoke.sh enforces the set.
- adr.ts reports the real write failure; worktree /proc specs skip off Linux.
Co-Authored-By: Ruflo & AQE
Claude-Session: https://claude.ai/code/session_01CGoza3gyxBjpaiMPhGHcHs
- AgentDB mod panel read updatedMs through countOf, whose 1e12 cap (added
in 44b157b52) clamps every epoch-ms time to 2001-09-09: "written 9161d ago
(an earlier session)" for a file written minutes before. Times are read as
times; implausible ones (before 2000, more than a day ahead) read n/a.
- Overview/Swarm/Workflows/status bar/topology credited a swarm with the whole
agent store ("running · max 3 · 259 agents" for a swarm with 0 agents) and
disagreed on its status (running vs finished). One helper
(data/swarm-status.ts) gives each page the swarm's own listed/found count
and its age; "stale" only on evidence (old record, no busy member, no
recent member). An empty fresh swarm is still its own Workflows run; the
roster of unlisted agents keeps the run id saved views and pins used.
- mission-goal's label said "(nothing is written)" but it is a write action;
perf-bottleneck/optimize were gated as delete (needs full) because their
note said the probe file is "removed". Labels and notes now match the gate.
Co-Authored-By: Ruflo & AQE
Claude-Session: https://claude.ai/code/session_01CGoza3gyxBjpaiMPhGHcHs
security defend / scan / channel-scan / scan-plan and the metaharness alert
scripts exit non-zero to say "found something" while printing a valid JSON
verdict. The runner treated every non-zero exit as a failure, so exactly when
a safety check caught something, Claude (console_run / console_state) was told
it failed and got no verdict. Failure reasons took the first stderr line, which
on many installs is "[WARN] Skipped helper auto-refresh", hiding the [ERROR].
- ActionSpec.findings = { exits, isAnswer, found } per entry, taken from the
CLI source: such an exit is an answer only when stdout holds a complete
answer of that command's shape, judged on its top-level keys (a hostile span
quoting "[ERROR]" or a nested failure cannot flip it), the answer says it
found something, and nothing outside it (trailing stdout, stderr) reports a
failure. A banner object before the verdict is skipped.
- The one-line outcome carries the verdict ("answered: UNSAFE · 2 threats").
- data/failure.ts: one failure-reason helper (wrapped MCP isError, top-level
error, [ERROR] line, error-naming line; [WARN]/[INFO]/Parameters skipped),
used by the runner, CLI probes and mission verify notes.
Co-Authored-By: Ruflo & AQE
Claude-Session: https://claude.ai/code/session_01CGoza3gyxBjpaiMPhGHcHs
task_update stored any string as a task's status, so an agent writing
"complete" left a finished task every reader misread: the ruflo-console
Automation kanban listed it under PENDING (offering assign/cancel), and
Mission Control derived it as ready, so nextTask() would hand finished work
to Claude again as a new billed turn.
CLI (mcp-tools/task-tools.ts)
- statusOf(): trimmed, case-insensitive, aliases complete/done/canceled/
running/in-progress; anything else (incl. "" and prototype keys) is
refused with the allowed list and the task is left unchanged.
- No schema enum on purpose: the HTTP/WebSocket registry validates enums
before the handler, which would refuse aliases there but not over stdio.
- Completing through task_update now finishes the task as task_complete
does (progress 100, completedAt, worker idle and counted once per
hand-out); cancelling frees workers as failing already did. Worker
effects run after the task store is saved.
Console
- taskStatusOf() reads the spellings older CLIs already stored; used by the
kanban lanes and verbs, Mission Control derive (no re-dispatch), mission
cancel, workflow links and the workflow guide.
Co-Authored-By: Ruflo & AQE
Claude-Session: https://claude.ai/code/session_01CGoza3gyxBjpaiMPhGHcHs
A refused mod or a permission deny has no action, so it held 'n to approve' up
with nothing to press. The band, menu badge, change notices and the Approvals
header now count waitingApprovalsOf(); notices stay listed, named apart.
Co-Authored-By: RuFlo <ruv@ruv.net>
- A Yes runs only the card it was pressed on: every pending card has an id,
the Yes / Always allow / Always accept buttons carry it, runner.confirm(seen)
runs nothing (and says so) when another card took its place. A card Claude
raised is re-checked against the level and Stop when it lands and when the
Yes arrives.
- Everything returned to the model goes through modelLine (escapes, then
control and invisible characters removed, cut, withheld whole when it holds
a secret shape or an invite code) and every answer leaves through
modelLines; a version such as v2.1.0-beta.3 is not an invite.
- ESCAPES is linear: an unterminated OSC ends at the next introducer or the
end of the text (7.7 s on the old pattern became milliseconds on 1 MB).
- Mission state/status, hive role, audit severity and Settings plugin names
that are Object.prototype keys read as unknown (own()).
- Approvals and a mission objective wrap at 80 columns instead of being cut
with an ellipsis (#3899).
Specs ported from #3820, #3821 and #3822, adapted to main.
Co-authored-by: Dragan Spiridonov <spiridonovdragan@gmail.com>
Co-Authored-By: RuFlo <ruv@ruv.net>
With the ruflo CLI option on npx, a confirmed action ran a cold online npx under the 90 s default and aborted with 'still running after 90000ms'. Resolve ruflo on PATH, a project-local bin or the cached npx copy first; give a cold download a 300 s limit and a first-run label; turn a timeout or ENOTCACHED into an error naming the fix. Console 0.40.1; ADR-407 update.
Co-Authored-By: RuFlo <ruv@ruv.net>
Default-off Settings rows: a read-only claude -p consult (asked first, exact argv, turn budget, mission spend cap) before a plan locks, when the same check fails twice in a row, and before done; a third failure pauses the mission. Honest about not being the in-session advisor tool. Console 0.40.0.
Co-Authored-By: RuFlo <ruv@ruv.net>
The mission goal was cut at 500 characters and drawn on one clipped line; the host Input is one line and hides the rest. A live mirror
under every field shows all lines, views draw text in full with an explicit marker, limits are checked before sending with the exact
count, and every silent slice/plain cap on typed text is removed or made a counted refusal. console 0.39.1.
Co-Authored-By: RuFlo <ruv@ruv.net>
One dependency-free policy (canonical in ruflo-mods, byte-identical copies in console,
swarm and protector, checked by scripts/sync-toast-policy.mjs and each smoke.sh): level
prefixes, one washed line of at most 120 characters, 60 s de-duplication, four toasts a
minute per source with errors held and counted, the person's all/important/off setting and
per-source mute (console Settings, mirrored to a file the others read), and a digest of
every toast kept for the console's Events page. All call sites migrated; new toasts for a
mission that finishes or fails and a swarm subagent that fails or a loop that is stuck.
Versions: console 0.37.0, swarm 0.3.4, protector 0.1.1, mods 0.3.16.
Co-Authored-By: RuFlo <ruv@ruv.net>
- plugin.json declares eventsPersist (default true); version 0.36.0 in plugin.json, version.ts, smoke.sh
- data/append-argv.ts: one dd argv (bs=1M iflag=fullblock) shared by the Events store and the autopilot journal; real-dd 8-writer test fails on the old argv
- history decoders and Events/Timeline displays use #3874's timeOf/countOf/isoOf, so a hostile time or count cannot throw
- cli init: .claude-flow/.gitignore template lists console/
- ADR-474 updated to the reviewed behaviour and the open low items
Co-Authored-By: RuFlo <ruv@ruv.net>
Conflict in views/manage.ts: #3874 (isoOf) edited eventsView, which the Events work moved to views/events.ts; the move wins and the isoOf clamp is applied at every Events/Timeline site instead.
Co-Authored-By: RuFlo <ruv@ruv.net>
- RUFLO_CONSOLE_CONTROL is kept as session state and applied on every load and save of the AI prefs; only the person's own level is stored (#3814)
- A Claude call to an entry flagged read-only that spends, writes or reaches the network is queued for the level/budget/confirm gate; deferred asks keep their origin and are awaited; Claude's ask never replaces a waiting card; mission-auto parses on/off (#3815)
- One strip set for plain() and termText(); guidance errors and perf readers cleaned; console_state withholds secret-looking lines and invite codes (#3816)
- Times clamped to Date's range, counts and ratios bounded, unique Room ids, links never read as docs, own-property cli option, objectIn closes at the JSON end (#3817)
- A failed task_update sends no prompt, hand-outs are limited, the cap needs a fresh reading and is read off-page, cap 0 is refused (#3818)
Co-Authored-By: RuFlo <ruv@ruv.net>
A transcript that grew is parsed from where its last parse ended, not from its
first line: checked resume (head + anchor), unfinished last line taken back,
bounded ring and id set, LRU memo, tail windows by unique anchor. Reference
parsers untouched and used as the oracle by a seeded property test plus
mutation checks. Refresh warms the parse memo for the search (400k chars a tick).
scripts/kit-seq.sh runs the 25 kit tests one file at a time in a temp copy;
scripts/typecheck.sh makes tsc find the ambient types in a fresh worktree; the
specs' type errors are fixed (sources of other lanes listed in the report).
Co-Authored-By: RuFlo <ruv@ruv.net>
- list editor for folders, repos, hosts, secret names and verify commands, every edit checked by the loader's own validator, shown as a diff against the approved envelope
- bounded parallel hand-over up to min(envelope concurrency, adaptation) through a narrow startable() beside nextTask; a park no longer holds the other tasks back
- spend: windows never start before Start, Claude Code only, unpriced models and old trackers say why the reading is unknown
- the band segment is drawn through registerBarSource
- ruflo autopilot_* tools: probed, not used (ADR-470 section 2.5)
- live run in a scratch repo found and fixed: dead 8/9 hotkeys, Start unreachable without a run, an input-less permission probe that parked every task, a failed record for a step that finished after Stop, a lost step retried without a question, a false "allow every class"
Co-Authored-By: RuFlo <ruv@ruv.net>
Replaces every "unverified" label with what Claude Code 2.1.289 actually answered:
- Stop a run: TaskStop takes the Workflow TASK id (read from the session transcript, last launch wins); the wf_ run id and a workflow agent's id are "No task found", so Stop-one-agent is removed and shows the engine's refusal.
- Message: delivered mid-task to a running workflow agent; to a named Agent-tool agent it arrives when its turn ends (161-165 s measured).
- $.tool.call opens the engine's real dialog for ask-class tools; deny resolves {deny}; never bypassed.
- Codex "tokens used" is a total (tokensTotal), stdout trimmed; federation argv checked against the helper's parser; stub OpenAI endpoint receives the card's exact bytes; the engine does not block link-local, so isBaseUrl is the only SSRF gate.
- Real answers are fixtures (tests/fixtures/control-real.ts); new wf-send-stub spec uses a real HTTP server.
Mutation check: 13 mutations (first-launch task id, run id passed to TaskStop, deny ignored, tool_use_error kept, stop-agent spec, codex total as output, untrimmed error, link-local allowed, plain http, transcript path unchecked, huge transcript unread, task id never re-read, usage field on every endpoint) each killed.
Co-Authored-By: RuFlo <ruv@ruv.net>
