akushonkamen
87d8687f3f
* fix(ruflo-agentdb): stop the secret screen treating a hyphen-named memory key as a credential field
assignmentSecret() ran the KEY_NAME key-assignment check on every match, so
any entry whose name starts with auth (auth-flow-notes) plus up to 40 name
characters looked like a config field, and keyedSecret()/plausibleSecret()
then judged the entry's value as a credential: a write of
{ key: 'auth-flow-notes', value: 'getUser-not-getSession' } was refused
(#4202). A key that is itself a multi-word hyphenated name is an entry's
name, not a field, so the keyed check now skips it; the secret shapes still
screen the whole text, and single-word credential keys (auth, api_key,
token) keep blocking keyed literals.
Synced to the 39 plugin copies with scripts/sync-mod-screen.mjs.
Fixes #4202
Assisted-by: AI (automated contributor session, disclosed on the issue)
* chore(ci): exclude plugins/ruflo-agentdb/tests/guard-keys.test.ts from the root vitest run
The new test imports claude-code/testing like its six siblings, so the root
ratchet run (scripts/ci-test-ratchet.mjs) cannot collect it outside Claude
Code; list it in scripts/ci-test-excluded.txt per the documented convention
so ci.yml stays green until 'claude plugin test plugins/ruflo-agentdb' runs
it in all-plugins-smoke.
Follow-up to #4202
Assisted-by: AI (automated contributor session, disclosed on the issue)
ruflo-aidefence
AI safety scanning, PII detection, prompt injection defense, and adaptive threat learning.
Install
/plugin marketplace add ruvnet/ruflo
/plugin install ruflo-aidefence@ruflo
Features
- Safety scanning: Detect prompt injection, jailbreak attempts, and adversarial content
- PII detection: Flag emails, SSNs, API keys, and other sensitive data
- Adaptive learning: Train defenses on confirmed threats to improve detection
- Threat classification: Categorize threats with confidence scores
Defense-in-depth pairing (ruflo 3.6.25+)
This plugin pairs with three runtime hardening features that ship in the host (ADR-095 / ADR-096 / audit_1776853149979):
- Loader-hijack denylist —
validateEnv()rejectsLD_PRELOAD,LD_LIBRARY_PATH,LD_AUDIT,DYLD_INSERT_LIBRARIES,DYLD_LIBRARY_PATH,DYLD_FALLBACK_LIBRARY_PATH,DYLD_FORCE_FLAT_NAMESPACE,NODE_OPTIONS,NODE_PATHat theterminal_createMCP boundary. Adding any of these to a child process is functionally RCE; threat scoring should treat a denylist-enforcing host as substantially less exposed. - File mode 0600 / dir mode 0700 on session, terminal, and memory stores via
fs-secure.writeFileRestricted— cross-user-on-host reads blocked at the OS layer. - Encryption at rest (opt-in via
CLAUDE_FLOW_ENCRYPT_AT_REST=1) — AES-256-GCM with magic-byte (RFE1) backward-compat sniff. Reports involving memory.db / sessions / terminal-history exfiltration should account for the gate state (ruflo doctor -c encryption).
Commands
/aidefence-- Detection stats and threat analysis dashboard
Skills
safety-scan-- Scan inputs for prompt injection and unsafe contentpii-detect-- Detect PII in text, code, and configurations
Compatibility
- CLI: pinned to
@claude-flow/cliv3.6 major+minor. - MCP surface: 6
aidefence_*tools (scan,analyze,stats,learn,is_safe,has_pii) plustransfer_detect-piifor categorized findings. - Verification:
bash plugins/ruflo-aidefence/scripts/smoke.shis the contract.
The 3-gate pattern (canonical)
Every consumer plugin handling untrusted content should apply these three gates in order:
| # | Gate | Tool | When |
|---|---|---|---|
| 1 | Pre-storage PII | aidefence_has_pii |
Before any AgentDB / memory_store write — redact or quarantine before persistence. |
| 2 | Sanitization | aidefence_scan |
For cookies, tokens, high-entropy blobs — vault behind an opaque handle rather than embed raw values. |
| 3 | Prompt-injection | aidefence_is_safe |
Before any extracted text re-enters an LLM prompt — quarantine to findings.md if flagged. |
This is the pattern ruflo-browser ADR-0001 §4 codified and ruflo-aidefence ADR-0001 canonicalizes. Reference these gates by name in any new plugin that handles user-supplied content.
What the gates catch (after ADR-118)
The upstream aidefence@2.3.0 / aimds-*@0.1.1 release (shipped 2026-05-14) widens the detection net without changing the MCP-tool surface. Gate 3 (aidefence_is_safe) now flags:
| Category | Sample input |
|---|---|
| Prompt injection (0..4 modifier-word window) | ignore all previous instructions, forget every rule above, disregard the system prompt |
| Role hijack | you are now …, act as …, pretend to be … |
| Jailbreak markers | DAN mode, developer mode, god mode, root mode |
aidefence_stats now also reports accurate total_mitigations and successful_mitigations (previously hardcoded 0 — an unclosed TODO that's now backed by AtomicU64 counters).
Namespace coordination
This plugin owns the security-patterns AgentDB namespace (kebab-case, follows the convention from ruflo-agentdb ADR-0001 §"Namespace convention"). Reserved namespaces (pattern, claude-memories, default) MUST NOT be shadowed.
Verification
bash plugins/ruflo-aidefence/scripts/smoke.sh
# Expected: "10 passed, 0 failed"
Architecture Decisions
As a mod
AIDefence also ships as a function-hook mod (ADR-445 pattern; hooks in hooks/, loaded with the plugin). No network, no process, no model call.
- Guard (default on): refuses an
aidefence_learnsample that holds a key, token or password (learned patterns are stored and replayed). It only tightens: it never allows anything the session would deny, and the refusal never repeats the secret. Turn it off with theguardoption. /aidefence-mod: answered locally./aidefence-mod status,/aidefence-mod scan <text>.- Status file:
.claude-flow/aidefence-mod/status.json(version,updatedMs, counters), written at session start and whenever a call is refused; the console reads it. - Options (
userConfig):guard(onby default).
Test: claude plugin validate plugins/ruflo-aidefence, claude plugin test plugins/ruflo-aidefence, and bash plugins/ruflo-aidefence/scripts/smoke.sh.