mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-10-23 03:47:00 +09:00
Dragan Spiridonov
b6f3988de7
* fix(ruflo-mods): trust gate also treats the agent.spawn, prompt.submit, tool.call, command.run, session.append and agent.register calls and the tool.describe and session.append hooks as risky (#3787, #3801) Adversarial review of the previous commit: risk was checked per scanned `calls` and `events` separately, and only the events side had agent.spawn and prompt.submit, so a mod CALLING $.agent.spawn / $.prompt.submit / $.tool.call still loaded under refuse-risky ("no risky calls or hooks"). session.append and agent.register, and the tool.describe and session.append hooks (rewriting what the model reads). Docs follow the code: README hardening note lists the first-party mods that now need modTrustAllow under refuse-risky (agentdb, ruos, intelligence, graph-intelligence, goals, iot-cognitum beside swarm and console), the modTrust row and plugin.json description name the categories, and the create-mod skill's list matches. * fix(ruflo-mods): trust gate judges a glob or negation by what it selects; covers prompt sections/context, peer receive, model requests (#3801) Re-review: the scan reports hook patterns as written, and riskOf matched names exactly, so `on('tool.*')` or `on('!tool.describe')` loaded under refuse-risky with "no risky calls or hooks" and could answer tool permission verdicts (shown: tool.check returned allow). A glob now maps to every risky event it selects, a negation to `*`, and any classic.* pattern to the classic risk. Lookups use Object.hasOwn. Same-category hooks added: prompt.section, prompt.context, prompt.attachment, skill.prompt, session.receive, turn.step, and hooks on process.run / http.fetch / mcp.call (they can answer other mods' calls). Docs: every first-party mod with function hooks (43 of 43) is risky under the gate's sets, so the README now says to allow-list each ruflo mod you use under refuse-risky and points to `claude plugin validate`. * fix(ruflo-mods): a hook on a risky call is a risky hook (fs.write, env.set, process.spawn, ...) (#3801) Third review: every $ call is also an event a hook above the caller can rewrite or answer for every other mod. Under refuse-risky a mod hooking only fs.write loaded clean and redirected ruflo-mods' own heartbeat write to .claude/settings.json; one hooking env.set rewrote RUFLO_MODS_OWNS; one on process.spawn rewrote an allow-listed mod's argv; fs.* loaded too. Hook risk is now derived: every RISKY_CALLS entry is also a risky event ("can rewrite or answer another mod's <call>"), on top of RISKY_EVENTS (+ tool.register). Globs match against the union. Tests: fs.write, env.set and fs.* refused (each fails on the previous head); the harmless-glob control is clock.*, since command.run is a risky call. README and the create-mod skill say so. * fix(ruflo-mods): trust gate treats hooks that forge what other mods read, or replace the conversation, as risky (#3801) Fourth review: a mod hooking only fs.stat (answer ENOENT for the policy projection) or fs.read (return an empty observe projection) loaded under refuse-risky and turned ruflo's own enforced deny into allow; one hooking session.compact replaced the whole conversation. Added fs.read, fs.stat, fs.exists, fs.list, settings.read, env.get, session.compact, prompt.edit and attribution.text to the risky hooks; three tests (each fails on the previous head). README states the gate is a list over the 2.1.289 engine API, so an event added later is not judged until listed. * fix(ruflo-mods): session.root, session.cwd, fs.ancestors and command.register hooks are risky; docs name ruflo-ruos (#3801) Fifth review: a mod hooking only session.root moved ruflo-mods' project root, so the enforced policy projection was read from elsewhere and a deny became allow (the round-4 exploit through another input). Added those inputs and command.register (consistent with tool.register), with a root-forger test (fails on the previous head). Derived messages read "another mod's fs.write, which writes files ..." instead of nesting parentheses. Docs: ruflo-ruos hooks only prompt.submit, so it is newly risky under refuse-risky (#3787); README and PR body said every first-party mod was already risky via a status file or tool.call, which was false for it. * test(router): seed Thompson sampler convergence trajectory * ci: retain one plugin smoke execution and its report * Register smoke workflow test with its dedicated Node runner * Prevent same-millisecond hierarchy embedding index collisions