mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-10-23 03:47:00 +09:00
* feat(marketplace): list Agentic QE (agentic-qe-fleet) as an external, pinned plugin The ruflo marketplace now lists agentic-qe-fleet by a git-subdir source pinned to agentic-qe v3.15.0 (1363bc7d), so `/plugin install agentic-qe-fleet@ruflo` installs the plugin from its own repository: 11 QE agents, 9 skills, 9 commands, the agentic-qe MCP server pinned to 3.15.0, and the aqe-mod guard. Tooling that assumed every entry is a local ./plugins folder now handles an external one: - validate-marketplace.yml checks an external entry (git-subdir, https url, path without .., full sha, description) instead of failing on it - smoke-all-plugins checks out each external entry at its sha and runs its own scripts/smoke.sh (--skip-external to omit); the workflow also runs when marketplace.json changes - ruflo-console 0.40.9: plugin-map line (Dev Tools), the coverage test requires a line for every external entry, and the Plugin Catalog reads an external plugin from its install path in installed_plugins.json (EXT badge) - README and plugins/README rows; ADR-484 records the decision and evidence * docs(adr-484): record what Claude Code before 2.1.69 does with the external entry, and main's existing floor * fix(ci): fence the external-plugin smoke: github-only sources, realpath containment, scrubbed env and cwd, read-only token Review findings 1 and 2 on #3950: - scripts/external-plugins.mjs: sources must be https://github.com/<owner>/<repo>(.git); the plugin folder, its manifest and smoke.sh must stay inside the checkout after realpath; the external smoke.sh runs with only PATH, LANG, TERM and CI kept (no GITHUB_TOKEN, ACTIONS_*, *_TOKEN, *_KEY, *SECRET*), a temporary HOME, and its checkout (in a temp folder outside the workspace) as cwd; git fetch runs with the same env - validate-marketplace.yml applies the same github-only allowlist and path rule - all-plugins-smoke.yml: permissions contents: read, persist-credentials: false, runs tests/external-plugins.test.mjs - tests/external-plugins.test.mjs: non-github host and lookalikes refused by both validators, symlink escapes refused, child env has no GITHUB_TOKEN and cwd is outside the workspace * ci(all-plugins-smoke): raise the smoke-all timeout from 10 to 15 minutes Review finding 4 on #3950: green runs on main take 9m40-9m50s, so the job sat on the 10-minute cap and was cancelled at 10m16s on this PR. * test(console): an external plugin's description, version, source line and docs are stripped of escapes and bidi controls Review finding 3 on #3950: the catalog reader already passes every external manifest string through plain() (ESC/CSI/OSC sequences, C0/C1 controls, U+202A-202E and U+2066-2069 removed); this test holds it to that. * ci(test-ratchet): tests/external-plugins.test.mjs runs under node --test, not the root vitest all-plugins-smoke.yml runs it with node --test; vitest reported "No test suite found". * feat(marketplace): move the agentic-qe-fleet pin to v3.15.1 (4f0f8412) agentic-qe v3.15.1 changes only the aqe-mod guard (#920: hardened, still tighten-only, same engine API and events as 3.15.0) and pins agentic-qe@3.15.1 in .mcp.json. * docs(adr-484): install evidence re-run at the v3.15.1 pin * feat(marketplace): move the agentic-qe-fleet pin to v3.15.2 (9db36edf) agentic-qe v3.15.2: aqe-mod reports its real version, keeps guard totals and the last refusal across sessions (additive totals/lastRefusal in status.json), and never reads or writes its status file through a symlink (adds $.fs.read and $.fs.stat); guard judging unchanged. .mcp.json pins agentic-qe@3.15.2. ADR-484 evidence re-run at this pin. * fix(marketplace): plain-name paths for external plugins, pin-review note, one marketplace for agentic-qe-fleet - both validators (scripts/external-plugins.mjs, validate-marketplace.yml) require the plugin path to match ^[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*$ with no . or .. segment: %2e%2e, a\..\b, a//b and a trailing slash are refused; tests cover both validators - ADR-484: every pin bump needs a review of the pinned scripts/smoke.sh - READMEs: install agentic-qe-fleet from the agentic-qe or the ruflo marketplace, not both * feat(marketplace): move the agentic-qe-fleet pin to v3.15.3 (d7e5ffa7) The plugin at v3.15.3 differs from v3.15.2 only in its version and its MCP pin (agentic-qe@3.15.3). ADR-484's evidence records the install re-run at the new pin. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(plugins): pin agentic-qe to v3.15.4 (bec02b13) The plugin at v3.15.4 differs from v3.15.3 only in its version and its MCP pin (agentic-qe@3.15.4). ADR-484's evidence records the install re-run at the new pin. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(plugins): pin agentic-qe to v3.15.5 (d65ede14) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(console): leave the console version bump to the maintainer at merge The console version and CHANGELOG entry collided with every console release on main (four rebases on 2026-10-12, each only plugins/ruflo-console/CHANGELOG.md). plugin.json, hooks/version.ts, scripts/smoke.sh and CHANGELOG.md now match main; ADR-484 and its index row say 'next console release'. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(plugins): pin agentic-qe to v3.15.6 (0fa34d24) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(plugins): pin agentic-qe to v3.15.7 (7f2d091d) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(plugins): pin agentic-qe to v3.15.8 (d9ce98f7) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(plugins): pin agentic-qe to v3.15.9 (d1c33d2b) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(plugins): pin agentic-qe to v3.15.10 (e5814a2f) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: rUv <ruv@ruv.net>
252 lines
12 KiB
JSON
252 lines
12 KiB
JSON
{
|
|
"name": "ruflo",
|
|
"description": "RuFlo Marketplace: Claude Code native agents, swarms, workers, and MCP tools for continuous software engineering",
|
|
"owner": {
|
|
"name": "ruvnet",
|
|
"url": "https://github.com/ruvnet"
|
|
},
|
|
"plugins": [
|
|
{
|
|
"name": "ruflo-core",
|
|
"source": "./plugins/ruflo-core",
|
|
"description": "Core Ruflo MCP tools, commands, and Claude Code orchestration patterns"
|
|
},
|
|
{
|
|
"name": "ruflo-ai-team",
|
|
"source": "./plugins/ruflo-ai-team/directory",
|
|
"description": "Tenant-isolated AI teams that plan work, coordinate tasks, recall approved context, and return evidence-backed results"
|
|
},
|
|
{
|
|
"name": "ruflo-x-gateway",
|
|
"source": "./plugins/ruflo-x-gateway/directory",
|
|
"description": "Remote RuFlo Federation MCP connector for signed channels, work claims, evidence, and cross-agent coordination"
|
|
},
|
|
{
|
|
"name": "ruflo-deepseek-harness",
|
|
"source": "./plugins/ruflo-deepseek-harness",
|
|
"description": "DeepSeek model harness with focused agents, commands, and skills for swarm-backed reasoning workflows"
|
|
},
|
|
{
|
|
"name": "ruflo-swarm",
|
|
"source": "./plugins/ruflo-swarm",
|
|
"description": "Agent teams, swarm coordination, Monitor streams, and worktree isolation"
|
|
},
|
|
{
|
|
"name": "ruflo-loop-workers",
|
|
"source": "./plugins/ruflo-loop-workers",
|
|
"description": "Cache-aware /loop workers and CronCreate background automation"
|
|
},
|
|
{
|
|
"name": "ruflo-security-audit",
|
|
"source": "./plugins/ruflo-security-audit",
|
|
"description": "Security review, dependency scanning, policy gates, and CVE monitoring"
|
|
},
|
|
{
|
|
"name": "ruflo-rag-memory",
|
|
"source": "./plugins/ruflo-rag-memory",
|
|
"description": "RuVector memory with HNSW search, AgentDB, and semantic retrieval"
|
|
},
|
|
{
|
|
"name": "ruflo-testgen",
|
|
"source": "./plugins/ruflo-testgen",
|
|
"description": "Test gap detection, coverage analysis, and automated test generation"
|
|
},
|
|
{
|
|
"name": "agentic-qe-fleet",
|
|
"source": {
|
|
"source": "git-subdir",
|
|
"url": "https://github.com/proffesor-for-testing/agentic-qe.git",
|
|
"path": "plugins/agentic-qe-fleet",
|
|
"ref": "v3.15.10",
|
|
"sha": "e5814a2f4f3d7995b87ebda9ad30e8a3d92cd555"
|
|
},
|
|
"description": "Agentic QE (external: maintained in proffesor-for-testing/agentic-qe, pinned to v3.15.10): a quality-engineering fleet with 11 QE agents, 9 skills, 9 commands, the agentic-qe MCP server pinned to the plugin version, and the aqe-mod guard that refuses destructive operations on AQE learning data"
|
|
},
|
|
{
|
|
"name": "ruflo-docs",
|
|
"source": "./plugins/ruflo-docs",
|
|
"description": "Documentation generation, drift detection, and API docs automation"
|
|
},
|
|
{
|
|
"name": "ruflo-autopilot",
|
|
"source": "./plugins/ruflo-autopilot",
|
|
"description": "Autonomous /loop-driven task completion with learning, prediction, and progress tracking"
|
|
},
|
|
{
|
|
"name": "ruflo-intelligence",
|
|
"source": "./plugins/ruflo-intelligence",
|
|
"description": "Self-learning neural intelligence with SONA patterns, trajectory learning, and model routing"
|
|
},
|
|
{
|
|
"name": "ruflo-agentdb",
|
|
"source": "./plugins/ruflo-agentdb",
|
|
"description": "AgentDB memory controllers with HNSW vector search, RuVector embeddings, and causal graphs"
|
|
},
|
|
{
|
|
"name": "ruflo-aidefence",
|
|
"source": "./plugins/ruflo-aidefence",
|
|
"description": "AI safety scanning, PII detection, prompt injection defense, and adaptive threat learning"
|
|
},
|
|
{
|
|
"name": "ruflo-protector",
|
|
"source": "./plugins/ruflo-protector",
|
|
"description": "Project Anatole: an optional, learning watchdog for unattended agents (OWASP-mapped rules, a per-project baseline, learn / notify / enforce modes). Default off."
|
|
},
|
|
{
|
|
"name": "ruflo-browser",
|
|
"source": "./plugins/ruflo-browser",
|
|
"description": "Agentic browser automation with Playwright for testing, scraping, and UI interaction"
|
|
},
|
|
{
|
|
"name": "ruflo-jujutsu",
|
|
"source": "./plugins/ruflo-jujutsu",
|
|
"description": "Advanced git workflows with diff analysis, risk scoring, and reviewer recommendations"
|
|
},
|
|
{
|
|
"name": "ruflo-agent",
|
|
"source": "./plugins/ruflo-agent",
|
|
"description": "Agent runtimes \u2014 local WASM-sandboxed agents (rvagent) + Anthropic Claude Managed Agents (cloud); one interface, local-vs-cloud backends"
|
|
},
|
|
{
|
|
"name": "ruflo-workflows",
|
|
"source": "./plugins/ruflo-workflows",
|
|
"description": "Visual workflow automation with templates, orchestration, and lifecycle management"
|
|
},
|
|
{
|
|
"name": "ruflo-daa",
|
|
"source": "./plugins/ruflo-daa",
|
|
"description": "Dynamic Agentic Architecture with cognitive patterns, knowledge sharing, and adaptive agents"
|
|
},
|
|
{
|
|
"name": "ruflo-ruvllm",
|
|
"source": "./plugins/ruflo-ruvllm",
|
|
"description": "RuVLLM local inference with chat formatting, MicroLoRA fine-tuning, and SONA adaptation"
|
|
},
|
|
{
|
|
"name": "ruflo-rvf",
|
|
"source": "./plugins/ruflo-rvf",
|
|
"description": "RVF format for portable agent memory, session persistence, and cross-platform transfer"
|
|
},
|
|
{
|
|
"name": "ruflo-plugin-creator",
|
|
"source": "./plugins/ruflo-plugin-creator",
|
|
"description": "Scaffold, validate, and publish new Claude Code plugins with proper structure"
|
|
},
|
|
{
|
|
"name": "ruflo-goals",
|
|
"source": "./plugins/ruflo-goals",
|
|
"description": "Long-horizon goal planning, deep research orchestration, and adaptive replanning using GOAP"
|
|
},
|
|
{
|
|
"name": "ruflo-adr",
|
|
"source": "./plugins/ruflo-adr",
|
|
"description": "ADR lifecycle management \u2014 create, index, supersede, and link Architecture Decision Records to code"
|
|
},
|
|
{
|
|
"name": "ruflo-cost-tracker",
|
|
"source": "./plugins/ruflo-cost-tracker",
|
|
"description": "Token usage tracking, model cost attribution per agent, budget alerts, and optimization recommendations"
|
|
},
|
|
{
|
|
"name": "ruflo-ddd",
|
|
"source": "./plugins/ruflo-ddd",
|
|
"description": "Domain-Driven Design scaffolding \u2014 bounded contexts, aggregate roots, domain events, and anti-corruption layers"
|
|
},
|
|
{
|
|
"name": "ruflo-federation",
|
|
"source": "./plugins/ruflo-federation",
|
|
"description": "Cross-installation agent federation with zero-trust security, PII-gated data flow, and compliance-grade audit trails"
|
|
},
|
|
{
|
|
"name": "ruflo-graph-intelligence",
|
|
"source": "./plugins/ruflo-graph-intelligence",
|
|
"description": "Real-time graph intelligence \u2014 personalized PageRank, streaming delta updates, witness-signed reasoning, and federation-distributable vectors"
|
|
},
|
|
{
|
|
"name": "ruflo-iot-cognitum",
|
|
"source": "./plugins/ruflo-iot-cognitum",
|
|
"description": "IoT device lifecycle, telemetry anomaly detection, fleet management, and witness chain verification for Cognitum Seed hardware"
|
|
},
|
|
{
|
|
"name": "ruflo-knowledge-graph",
|
|
"source": "./plugins/ruflo-knowledge-graph",
|
|
"description": "Knowledge graph construction \u2014 entity extraction, relation mapping, and pathfinder graph traversal"
|
|
},
|
|
{
|
|
"name": "ruflo-market-data",
|
|
"source": "./plugins/ruflo-market-data",
|
|
"description": "Market data ingestion \u2014 feed normalization, OHLCV vectorization, and HNSW-indexed pattern matching"
|
|
},
|
|
{
|
|
"name": "ruflo-migrations",
|
|
"source": "./plugins/ruflo-migrations",
|
|
"description": "Schema migration management \u2014 generate, validate, dry-run, and rollback database migrations"
|
|
},
|
|
{
|
|
"name": "ruflo-neural-trader",
|
|
"source": "./plugins/ruflo-neural-trader",
|
|
"description": "Neural trading strategies \u2014 self-learning LSTM/Transformer/N-BEATS models with Rust/NAPI backtesting"
|
|
},
|
|
{
|
|
"name": "ruflo-observability",
|
|
"source": "./plugins/ruflo-observability",
|
|
"description": "Structured logging, distributed tracing, and metrics \u2014 correlate agent swarm activity with application telemetry"
|
|
},
|
|
{
|
|
"name": "ruflo-ruvector",
|
|
"source": "./plugins/ruflo-ruvector",
|
|
"description": "Self-learning vector database \u2014 HNSW, FlashAttention-3, Graph RAG, hybrid search, DiskANN, and Brain AGI"
|
|
},
|
|
{
|
|
"name": "ruflo-sparc",
|
|
"source": "./plugins/ruflo-sparc",
|
|
"description": "SPARC methodology \u2014 Specification, Pseudocode, Architecture, Refinement, Completion phases with quality gates"
|
|
},
|
|
{
|
|
"name": "ruflo-metaharness",
|
|
"source": "./plugins/ruflo-metaharness",
|
|
"description": "MetaHarness integration \u2014 surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150 optional-augmentation constraint"
|
|
},
|
|
{
|
|
"name": "ruflo-arena",
|
|
"source": "./plugins/ruflo-arena",
|
|
"description": "Competitive ruliology for ruflo swarms \u2014 arenas, tournaments, and adaptive co-evolution of program strategies (ADR-147/148); strategies-as-programs compete under payoff games"
|
|
},
|
|
{
|
|
"name": "ruflo-agntcy",
|
|
"source": "./plugins/ruflo-agntcy",
|
|
"description": "AGNTCY/Outshift Internet-of-Cognition runtime integration \u2014 SLIM secure transport, CASA intent-scoped tool authorization, and AGNTCY identity/observability spans (ADR-380); optional, removable augmentation per ADR-150"
|
|
},
|
|
{
|
|
"name": "ruflo-bbs-federation",
|
|
"source": "./plugins/ruflo-bbs-federation",
|
|
"description": "AgentBBS cross-host agent federation (ADR-164). Phase 1: register/publish/watch/human-join room coordination. Phase 2 (v3.40.0): signed cross-host federation \u2014 identity, peer_add (pin by nodeId+Ed25519 key), peers, serve (read-only pull), sync (pull + union-merge what verifies). Registry-anchored pinning; works on any network (no tailnet required); coordinates work claims (ClaimIssued/Released/Handoff/Ack). Degrades gracefully when agentbbs is absent."
|
|
},
|
|
{
|
|
"name": "ruflo-business-pods",
|
|
"source": "./plugins/ruflo-business-pods",
|
|
"description": "Business-domain pod templates for the federated business autopilot (ADR-164 Phase 2) \u2014 pod templates plus a dry-run-by-default single-tick runner that validates, reserves budget, and resolves agent roles before posting to the BBS room"
|
|
},
|
|
{
|
|
"name": "ruflo-music",
|
|
"source": "./plugins/ruflo-music",
|
|
"description": "AI music generation via Cognitum Music (cogmusic MCP) \u2014 compose lyrics/prompts, generate tracks, separate stems, extract MIDI, and master through your own music.cognitum.one account"
|
|
},
|
|
{
|
|
"name": "ruflo-mods",
|
|
"source": "./plugins/ruflo-mods",
|
|
"description": "Early access (ADR-404): ruflo as a Claude Code mod (function hooks) \u2014 in-process routing, edit learning signals, tighten-only tool checks from ruflo policy, and the cost budget ladder. Opt-in via `ruflo mods install`; classic hooks stay the fallback"
|
|
},
|
|
{
|
|
"name": "ruflo-ruos",
|
|
"source": "./plugins/ruflo-ruos",
|
|
"description": "Run ruflo swarm agents on your own ruOS cloud desktops via the tenant-authenticated fleet MCP or per-tenant SSH; optional, removable"
|
|
},
|
|
{
|
|
"name": "ruflo-console",
|
|
"source": "./plugins/ruflo-console",
|
|
"description": "Early access: ruflo's cockpit as a Claude Code mod (function hooks) and the one /ruflo command for every ruflo mod \u2014 overview with health alerts, swarm topology, claims flow, federation map, plugin health, learning pipeline, MetaHarness radar, memory, cost gauge, agent timeline, approvals and events; a command palette for confirm-gated actions through the ruflo CLI; auto-opens where it docks; no network by default"
|
|
}
|
|
]
|
|
}
|