mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-09 22:13:39 +09:00
Mario JauvinandRuFlo
43a3954350
* fix(console): accept Windows paths in the autopilot envelope #4434 added Windows path parity across the console, but the autopilot envelope's own path validator still rejected any `\`, and the downstream `isProtectedPath` and `pathAllowed` guards compared with POSIX-only string ops. The code is unreachable today because autopilot start is still gated off on Windows (ap-windows-gate.spec.ts), but it is the next thing a Windows user will trip on when that gate is lifted — the natural `C:\work\app` form, and every UNC path, is refused with the opaque "is not an absolute folder below the root with no .." error. Four narrow fixes in `hooks/data/ap-envelope.ts`, driven by the separator-aware helpers already in `hooks/data/paths.ts`: - `isProtectedPath`: fold `\` to `/` on a drive-lettered or UNC path before the protected-dir compare. - `validateEnvelope` path check: drop the unconditional `path.includes('\')` reject (it contradicted `isAbsolutePath` which already accepts `C:\x` and `\srv\share`), and tighten the drive-root regex `/^[A-Za-z]:\/?$/` → `/^[A-Za-z]:[\/]?$/` so `C:\` is still refused explicitly (was previously caught by the backslash reject). - `validateEnvelope` output canonicalisation: use `trimTrailing` instead of `/\/+$/` replace, so a trailing `\` on a Windows path is stripped the way `/` already is on POSIX. - `pathAllowed`: use `hasParentSegment`, `samePath` and `below` from paths.ts. A file at `C:\work\app\file.ts` is now inside envelope path `C:\work\app` (and `c:\WORK\app\file.ts` is too), while `C:\work\application\file.ts` still is not. Semantics on a POSIX envelope are unchanged — the new helpers degrade exactly to their old string ops when neither side is a Windows path. New `tests/ap-envelope-windows-paths.spec.ts` pins what should and should not be accepted (13 cases: backslash drive, forward-slash drive, UNC, trailing-separator strip, `..`, bare-drive-root, protected-folder, pathAllowed under case + separator variation, prefix-match rejection). Verified on Windows 11: new spec 13/13, ap-core.spec.ts 31/31 (no POSIX regression), 5 envelope-adjacent specs 64/64 combined, full console suite 3444 total · 3399 pass · 13 fail — same pre-existing baseline as #4434's own run, zero regressions. Follow-up to #4434 R1 (https://github.com/ruvnet/ruflo/pull/4434#issuecomment-6371423874). Co-Authored-By: RuFlo <ruv@ruv.net> * fix: keep the backslash reject for POSIX-rooted envelope paths #4436 review (@ruvnet): dropping `path.includes('\')` outright also dropped the refusal for a POSIX-rooted path with backslashes smuggled in. `/work/app\..\..\other` passes `isAbsolutePath` (POSIX form), and `hasParentSegment` splits POSIX-only when `isWindowsPath` says the path is not Windows, so the `..` segments are invisible to it. On a Windows host, that leading-`/` path then resolves to `\other`, outside the folder the user named. Unreachable today because autopilot is still gated off on Windows, but it is the guard that gate's removal depends on. Keep the backslash reject, but only for non-Windows paths (POSIX should never have `\` in its path). The native Windows forms `C:\work\app` and `\srv\share\app` continue to pass; the mixed `/work/app\..\..\other` form is refused as before. Added case to tests/ap-envelope-windows-paths.spec.ts. Co-Authored-By: RuFlo <ruv@ruv.net> --------- Co-authored-by: RuFlo <ruv@ruv.net>
Ruflo Plugins
32 Claude Code plugins for agent-powered development workflows. Load with --plugin-dir.
Quick Start
# Load specific plugins
claude --plugin-dir plugins/ruflo-core --plugin-dir plugins/ruflo-swarm
# Load all plugins
claude $(ls -d plugins/ruflo-*/ | sed 's|^|--plugin-dir |' | tr '\n' ' ')
Plugin Catalog
Core & Coordination
| Plugin | Description |
|---|---|
| ruflo-core | MCP server, status, doctor, coder/researcher/reviewer agents |
| ruflo-swarm | Swarm topologies (hierarchical, mesh), Monitor streaming |
| ruflo-autopilot | Autonomous /loop task completion with prediction |
| ruflo-loop-workers | 12 background workers via /loop or CronCreate |
| ruflo-workflows | Workflow templates, parallel execution, branching |
Memory & Intelligence
| Plugin | Description |
|---|---|
| ruflo-agentdb | AgentDB with HNSW vector search (150x-12,500x faster) |
| ruflo-rag-memory | SOTA RAG — hybrid search, Graph RAG, MMR diversity, memory bridge |
| ruflo-rvf | Portable RVF memory format, session persistence |
| ruflo-ruvector | ruvector — FlashAttention-3, Graph RAG, hybrid search, 103 MCP tools, Brain AGI |
| ruflo-knowledge-graph | Entity extraction, relation mapping, pathfinder traversal |
| ruflo-intelligence | SONA neural patterns, trajectory learning, model routing |
| ruflo-daa | Dynamic Agentic Architecture, cognitive patterns |
Architecture & Methodology
| Plugin | Description |
|---|---|
| ruflo-adr | ADR lifecycle — create, index, supersede, compliance checking |
| ruflo-ddd | DDD scaffolding — bounded contexts, aggregates, domain events |
| ruflo-sparc | SPARC methodology with 5 phases and quality gates |
Quality & Security
| Plugin | Description |
|---|---|
| ruflo-security-audit | CVE scanning, dependency vulnerability checks |
| ruflo-aidefence | Prompt injection detection, PII scanning |
| ruflo-protector | Project Anatole: optional learning watchdog for unattended agents (default off) |
| ruflo-testgen | Test gap detection, TDD London School workflow |
| ruflo-browser | Playwright browser automation and testing |
| agentic-qe-fleet | External (Agentic QE, pinned in the marketplace): QE agents, coverage, chaos, TDD skills, agentic-qe MCP server. Install with /plugin install agentic-qe-fleet@ruflo; not in this folder, so --plugin-dir does not load it. Install it from one marketplace only (agentic-qe or ruflo), not both: enabled from both, its mod and commands load twice |
Development Tools
| Plugin | Description |
|---|---|
| ruflo-jujutsu | Diff analysis, risk scoring, reviewer recommendations |
| ruflo-docs | Doc generation, drift detection, API docs |
| ruflo-ruvllm | Local LLM inference, MicroLoRA, chat formatting |
| ruflo-agent | WASM agent sandboxing and gallery |
| ruflo-plugin-creator | Scaffold and validate new plugins |
| ruflo-migrations | Database schema migration management |
| ruflo-observability | Structured logging, tracing, metrics correlation |
| ruflo-cost-tracker | Token usage tracking, budget alerts, cost optimization |
Domain-Specific
| Plugin | Description |
|---|---|
| ruflo-goals | GOAP planning, deep research, horizon tracking |
| ruflo-federation | Zero-trust cross-installation agent federation |
| ruflo-iot-cognitum | Cognitum Seed IoT — trust scoring, anomaly detection, fleet management |
| ruflo-neural-trader | neural-trader — 4 agents, LSTM/Transformer, Rust/NAPI backtesting, 112+ MCP tools |
| ruflo-market-data | Market data ingestion, OHLCV vectorization, pattern matching |
Recommended Stacks
| Use Case | Plugins |
|---|---|
| Feature development | ruflo-core + ruflo-swarm + ruflo-testgen + ruflo-ddd |
| Security audit | ruflo-core + ruflo-security-audit + ruflo-aidefence |
| Architecture work | ruflo-core + ruflo-adr + ruflo-ddd + ruflo-sparc |
| Deep research | ruflo-core + ruflo-goals + ruflo-rag-memory + ruflo-intelligence |
| Vector search | ruflo-core + ruflo-ruvector + ruflo-rag-memory + ruflo-knowledge-graph |
| IoT development | ruflo-core + ruflo-iot-cognitum + ruflo-agentdb |
| Trading systems | ruflo-core + ruflo-neural-trader + ruflo-market-data + ruflo-ruvector |
| Full stack | All 32 plugins |
npm Package Integration
Several plugins wrap standalone npm packages for deeper functionality:
| Plugin | npm Package | What It Adds |
|---|---|---|
ruflo-neural-trader |
neural-trader |
112+ MCP tools, Rust/NAPI engine, LSTM/Transformer models |
ruflo-ruvector |
ruvector |
103 MCP tools, FlashAttention-3, Graph RAG, Brain AGI |
# Install backing packages
npm install neural-trader ruvector
# Add as MCP servers (optional, for direct tool access)
claude mcp add neural-trader -- npx neural-trader mcp start
claude mcp add ruvector -- npx ruvector mcp start
Plugin Structure
Each plugin follows the Claude Code plugin specification:
ruflo-<name>/
.claude-plugin/plugin.json # Plugin manifest
agents/<name>.md # Agent definitions (frontmatter: name, description, model)
commands/<name>.md # CLI command mappings
skills/<name>/SKILL.md # Interactive skills (frontmatter: name, description, argument-hint, allowed-tools)
README.md # Plugin documentation
Creating a Plugin
claude --plugin-dir plugins/ruflo-plugin-creator
# Then: /create-plugin my-new-plugin
Or manually: copy any existing plugin directory and modify.
Validation
claude plugin validate plugins/ruflo-<name>
Verification & Discoverability
Every MCP tool description across the 32 plugins must answer "use this over native (Bash/Read/Grep/Glob/Task/TodoWrite) when?" per ADR-112. The rule is enforced by CI:
# Run the audit (scans all MCPTool definitions across all plugins)
node scripts/audit-tool-descriptions.mjs
# Gates: every description must include "Use when …" guidance,
# be ≥ 80 chars, and be unique. Baseline at verification/mcp-tool-baseline.json
# is monotone-decreasing — CI fails on any regression.
Combined with verification/ (Ed25519-signed witness manifest, 103+ documented fixes attested), the plugin surface is regression-protected at three layers: install smoke (npm i), behavioral smoke (paired-tool round-trips), and presence attestation (every load-bearing line of every documented fix). See verification/README.md for the full stack.
License
MIT