mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-10-23 03:47:00 +09:00
akushonkamen
87d8687f3f
* fix(ruflo-agentdb): stop the secret screen treating a hyphen-named memory key as a credential field
assignmentSecret() ran the KEY_NAME key-assignment check on every match, so
any entry whose name starts with auth (auth-flow-notes) plus up to 40 name
characters looked like a config field, and keyedSecret()/plausibleSecret()
then judged the entry's value as a credential: a write of
{ key: 'auth-flow-notes', value: 'getUser-not-getSession' } was refused
(#4202). A key that is itself a multi-word hyphenated name is an entry's
name, not a field, so the keyed check now skips it; the secret shapes still
screen the whole text, and single-word credential keys (auth, api_key,
token) keep blocking keyed literals.
Synced to the 39 plugin copies with scripts/sync-mod-screen.mjs.
Fixes #4202
Assisted-by: AI (automated contributor session, disclosed on the issue)
* chore(ci): exclude plugins/ruflo-agentdb/tests/guard-keys.test.ts from the root vitest run
The new test imports claude-code/testing like its six siblings, so the root
ratchet run (scripts/ci-test-ratchet.mjs) cannot collect it outside Claude
Code; list it in scripts/ci-test-excluded.txt per the documented convention
so ci.yml stays green until 'claude plugin test plugins/ruflo-agentdb' runs
it in all-plugins-smoke.
Follow-up to #4202
Assisted-by: AI (automated contributor session, disclosed on the issue)
ruflo-security-audit
Security review, dependency scanning, policy gates, and CVE monitoring.
Install
/plugin marketplace add ruvnet/ruflo
/plugin install ruflo-security-audit@ruflo
What's Included
- Security Scanning: Deep scan with
security scan --depth deep(valid: quick, standard, deep) - CVE Monitoring: Automated CVE detection and remediation guidance
- Input Validation: Zod-based validation at system boundaries via
@claude-flow/security - Path Security: Traversal prevention and safe executor for command injection protection
- Policy Gates: Configurable security policies for CI/CD pipelines
- Threat Modeling: Automated threat analysis and risk assessment
Patterns to scan for (audit_1776853149979 follow-up)
The 3.6.25 release closed a class of shell-injection bugs. When auditing downstream code, the scanner should flag these patterns:
execSync(string)with template-literal args — replace withexecFileSync(cmd, argv, { shell: false }). Closed sites:github-safe.js,statusline.js/cjs(git calls),mcp-tools/github-tools.ts(gh pr/issue/run),update/executor.ts(npm install).- Numeric MCP inputs cast as
number— TypeScript casts don't run at runtime. AprNumber: "1; rm -rf /"slips through. Mitigate viatoPositiveInt(value)(seesrc/mcp-tools/github-tools.ts). - Untrusted package specs flowing into
npm install— gate viaisSafePackageSpec(pkg, version)regex check (seesrc/update/executor.ts). Defense-in-depth even withexecFileSync. - Loader-hijack env vars (
LD_PRELOAD,NODE_OPTIONS,DYLD_*) flowing into a child process env — gate viavalidateEnv()(seesrc/mcp-tools/validate-input.ts). - Plaintext secrets at rest in
.claude-flow/sessions/,.claude-flow/terminals/store.json,.swarm/memory.db— paired with ADR-096 opt-in encryption (CLAUDE_FLOW_ENCRYPT_AT_REST=1). Confirm gate state viaruflo doctor -c encryption. - MCP stdin DoS — un-newlined input piped into the MCP server. The host caps the buffer at 10MB by default; downstream MCP wrappers should enforce equivalent limits.
A ruflo verify round-trip confirms 55 witnesses (27 regression-fix + 28 per-source-file capability) match the signed manifest byte-for-byte.
Requires
ruflo-coreplugin (provides MCP server)
Compatibility
- CLI: pinned to
@claude-flow/cliv3.6 major+minor. - Verification:
bash plugins/ruflo-security-audit/scripts/smoke.shis the contract.
AIDefence integration
This plugin's static scanning (CVE / dependency / shell-injection patterns) complements the runtime gates owned by ruflo-aidefence ADR-0001:
| Layer | Owner | What it catches |
|---|---|---|
| Static analysis (this plugin) | ruflo-security-audit |
Shell-injection patterns, dependency CVEs, plaintext secrets at rest, loader-hijack env vars |
| Runtime gates (3-gate pattern) | ruflo-aidefence ADR-0001 |
PII pre-storage gate, sanitization gate, prompt-injection gate |
The two layers are complementary: static analysis finds the patterns; the 3-gate runtime catches what slipped through.
Namespace coordination
This plugin owns the security-findings AgentDB namespace (kebab-case, follows the convention from ruflo-agentdb ADR-0001 §"Namespace convention"). Reserved namespaces (pattern, claude-memories, default) MUST NOT be shadowed.
security-findings indexes scan results by file + commit + severity. Accessed via memory_* (namespace-routed).
Verification
bash plugins/ruflo-security-audit/scripts/smoke.sh
# Expected: "10 passed, 0 failed"
Architecture Decisions
As a mod
This plugin also loads as a function-hook mod (ADR-445 pattern, hooks/hooks.json → register.ts). No network, no process spawn, no model call.
- Guard (default on, tighten-only). It refuses to store an audit finding that quotes a live secret in a
security*,audit*,cve*,vuln*,findings*orsecaudit*memory namespace (memory_store,agentdb_hierarchical-store,agentdb_pattern-store). The refusal never repeats the secret. - Status file.
.claude-flow/secaudit-mod/status.json({version: 1, updatedMs, guard, checked, blocked, seen}), written at session start and when a counter changes. /secaudit-modanswers locally:status,scan <text>,namespaces. (The plugin's own commands are prompt commands, which a hook cannot answer, so the mod has its own name.)- Option.
guard(on|off, defaulton) in the plugin'suserConfig.
Test it: claude plugin validate plugins/ruflo-security-audit, claude plugin test plugins/ruflo-security-audit, bash plugins/ruflo-security-audit/scripts/smoke.sh.