@claude-flow/cli 3.51.1 → 3.52.0

package/dist/src/init/helpers-generator.js

@@ -433,6 +433,75 @@ if (command && commands[command]) {
 module.exports = commands;
 `;
 }
+// Literal-word root guard mirrored in the mod and both shipped classic helpers.
+const ROOT_DELETE_CHECK_SOURCE = String.raw `function hasRootDelete(command, depth = 0) {
+  let word = '', quote = '', started = false, redirect = false
+  let inRm = false, optionsEnded = false, recursive = false, force = false, root = false
+  const isRoot = (operand) => {
+    if (!operand.startsWith('/')) return false
+    const parts = []
+    for (const part of operand.split('/')) {
+      if (!part || part === '.') continue
+      if (part === '..') parts.pop()
+      else parts.push(part)
+    }
+    return parts.length === 0 || /[*?\[]/.test(parts[0])
+  }
+  const finishWord = () => {
+    if (!started) return false
+    // Literal shell strings (e.g. sh -c 'rm -rf /') also carried the old guard.
+    // Bound rescanning to four levels; beyond that retain its conservative check.
+    if (word.includes('rm') && /[\s;&|()]/.test(word)) {
+      if (depth < 4 ? hasRootDelete(word, depth + 1) : word.includes('rm -rf /')) return true
+    }
+    if (!inRm) inRm = word === 'rm' || word.endsWith('/rm')
+    else if (!optionsEnded && word === '--') optionsEnded = true
+    else if (!optionsEnded && word.startsWith('-')) {
+      recursive = recursive || word === '--recursive' || /^-[a-z]*r[a-z]*$/.test(word)
+      force = force || word === '--force' || /^-[a-z]*f[a-z]*$/.test(word)
+    } else root = root || isRoot(word)
+    word = ''; started = false
+    return inRm && recursive && force && root
+  }
+  const finishCommand = () => {
+    const denied = inRm && recursive && force && root
+    inRm = optionsEnded = recursive = force = root = false
+    return denied
+  }
+  for (let i = 0; i < command.length; i++) {
+    const char = command[i]
+    const redirectionAmpersand = char === '&' && (redirect || command[i + 1] === '>')
+    redirect = false
+    if (quote) {
+      if (char === quote) quote = ''
+      else if (quote === '"' && char === '\\' && i + 1 < command.length &&
+        (command[i + 1] === '"' || command[i + 1] === '\\' || command[i + 1] === '$' ||
+          command.charCodeAt(i + 1) === 96 || command[i + 1] === '\n')) {
+        const next = command[++i]
+        if (next !== '\n') word += next
+      } else word += char
+      continue
+    }
+    if (char === '\\' && i + 1 < command.length) {
+      const next = command[++i]
+      if (next !== '\n') { word += next; started = true }
+    } else if (char === '"' || char === "'") {
+      quote = char; started = true
+    } else if (char === '#' && !started) {
+      while (i < command.length && command[i] !== '\n') i++
+      if (finishCommand()) return true
+    } else if (char === ' ' || char === '\t' || char === '\r' || char === '\n' ||
+      ';|&()<>'.includes(char)) {
+      if (finishWord()) return true
+      // Redirections separate words, but later operands still belong to rm.
+      redirect = char === '<' || char === '>'
+      if (!redirectionAmpersand && (char === '\n' || ';|&()'.includes(char)) && finishCommand()) return true
+    } else {
+      word += char; started = true
+    }
+  }
+  return finishWord() || finishCommand()
+}`;
 /**
  * Generate hook-handler.cjs (cross-platform hook dispatcher)
  * This is the inline fallback when file copy from the package fails.
@@ -569,13 +638,14 @@ export function generateHookHandler() {
         '    }',
         '    if (router && router.routeTask) {',
         '      const result = router.routeTask(prompt);',
+        "      const row = (text) => '| ' + text.substring(0, 60).padEnd(60) + ' |';",
         '      var output = [];',
         "      output.push('[INFO] Routing task: ' + (prompt.substring(0, 80) || '(no prompt)'));",
         "      output.push('');",
         "      output.push('+------------------- Primary Recommendation -------------------+');",
-        "      output.push('| Agent: ' + result.agent.padEnd(53) + '|');",
-        "      output.push('| Confidence: ' + (result.confidence * 100).toFixed(1) + '%' + ' '.repeat(44) + '|');",
-        "      output.push('| Reason: ' + result.reason.substring(0, 53).padEnd(53) + '|');",
+        "      output.push(row('Agent: ' + result.agent));",
+        "      output.push(row('Confidence: ' + (result.confidence * 100).toFixed(1) + '%'));",
+        "      output.push(row('Reason: ' + (result.reason || '')));",
         "      output.push('+--------------------------------------------------------------+');",
         "      console.log(output.join('\\n'));",
         '    } else {',
@@ -637,8 +707,9 @@ export function generateHookHandler() {
         "  'pre-bash': () => {",
         "    var cmd = String(hookInput.command || toolInputObj.command || prompt || '').toLowerCase();",
         "    var dangerous = ['rm -rf /', 'format c:', 'del /s /q c:\\\\', ':(){:|:&};:'];",
+        ROOT_DELETE_CHECK_SOURCE.split('\n').map((line) => '    ' + line).join('\n'),
         '    for (var i = 0; i < dangerous.length; i++) {',
-        '      if (cmd.includes(dangerous[i])) {',
+        "      if (dangerous[i] === 'rm -rf /' ? hasRootDelete(cmd) : cmd.includes(dangerous[i])) {",
         "        console.error('[BLOCKED] Dangerous command detected: ' + dangerous[i]);",
         '        // Claude Code PreToolUse: exit 2 blocks execution; exit 1 is non-blocking.',
         '        process.exit(2);',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claude-flow/cli",
-  "version": "3.51.1",
+  "version": "3.52.0",
   "type": "module",
   "description": "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/plugins/ruflo-metaharness/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruflo-metaharness",
-  "description": "MetaHarness integration for ruflo — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150's architectural constraint that MetaHarness remains an optional augmentation, never a required runtime dependency",
-  "version": "0.1.1",
+  "description": "MetaHarness integration for ruflo — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150's architectural constraint that MetaHarness remains an optional augmentation, never a required runtime dependency. As a mod (ADR-445): confirms flywheel promotion, keeps secrets out of inputs, /metaharness-mod, and a status file the console shows",
+  "version": "0.2.3",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet"
@@ -27,6 +27,22 @@
     "namespace-routing",
     "verified",
     "ci",
-    "phase-1-mvp"
-  ]
+    "phase-1-mvp",
+    "mod",
+    "function-hooks",
+    "guard"
+  ],
+  "userConfig": {
+    "guard": {
+      "type": "string",
+      "title": "Guard",
+      "description": "Refuse tool calls that are clearly harmful in this plugin's domain (see README, As a mod).",
+      "required": false,
+      "default": "on",
+      "options": [
+        "on",
+        "off"
+      ]
+    }
+  }
 }

package/plugins/ruflo-metaharness/README.md

@@ -70,3 +70,15 @@ This means:
 - [Research dossier](https://gist.github.com/ruvnet/19d166ff9acf368c9da4172d91ac9113) — full graded-evidence sourcing
 - [Upstream](https://github.com/ruvnet/agent-harness-generator) — `metaharness` source
 - ADR-148/149 — `@metaharness/router` cost-optimal routing (sibling integration)
+
+## As a mod
+
+This plugin ships a function-hook mod (ADR-445, `hooks/register.ts`). It makes no network call, spawns no process and makes no model call.
+
+- **Guard** (tighten-only, on by default): Refuses any `metaharness_*` input that holds a key, token or password (MetaHarness writes its inputs to audit memory), and `metaharness_flywheel` `promote` / `evidence-reset` unless the call carries `confirm: true`. A refusal never echoes the secret.
+- **`/metaharness-mod`**: `status`, `recent`, `tools` (which of this plugin's tools are connected) and `scan <text>` (would the guard refuse it). Answered locally.
+- **Status file**: `.claude-flow/metaharness-mod/status.json` (`{version: 1, updatedMs, guard, calls, total, blocked, recent}`, counters only, never tool input), written at session start and after every call to this plugin's tools.
+
+Options (`userConfig`): `guard` (on).
+
+Test it: `claude plugin validate plugins/ruflo-metaharness`, `claude plugin test plugins/ruflo-metaharness`, `bash plugins/ruflo-metaharness/scripts/smoke.sh`.

package/plugins/ruflo-metaharness/hooks/guard.ts

@@ -0,0 +1,27 @@
+import { hasSecret } from './screen'
+import type { ModOptions } from './options'
+import { textsOf } from './screen'
+export { textsOf }
+
+/** `mcp__<server>__<tool>` into its tool half; tool names never hold a double underscore. */
+export function shortName(name: string): string {
+  const at = name.lastIndexOf('__')
+  return name.startsWith('mcp__') && at > 5 ? name.slice(at + 2) : name
+}
+
+const field = (input: unknown, key: string): unknown => (typeof input === 'object' && input !== null ? (input as Record<string, unknown>)[key] : undefined)
+
+
+/** The tools this plugin owns: every `metaharness_*` tool. */
+export const isOwn = (name: string, _input?: unknown): boolean => name.startsWith('metaharness_')
+
+/** The reason a call is refused, or undefined when it may go. Never names or echoes a secret. */
+export function verdict(name: string, input: unknown, _opts: ModOptions, _calls: Record<string, number>): string | undefined {
+  if (textsOf(input).some(hasSecret)) {
+    return 'ruflo-metaharness: this input holds what looks like a secret (a key, token or password). MetaHarness records its inputs in audit memory; pass a path or a reference instead.'
+  }
+  if (name === 'metaharness_flywheel' && ['promote', 'evidence-reset'].includes(String(field(input, 'operation'))) && field(input, 'confirm') !== true) {
+    return 'ruflo-metaharness: promoting a receipt or resetting evidence changes the active harness. Ask the user, then retry with confirm: true.'
+  }
+  return undefined
+}

package/plugins/ruflo-metaharness/hooks/hooks.json

@@ -0,0 +1,4 @@
+{
+  "description": "MetaHarness as a mod (ADR-445): a tighten-only guard on the metaharness tools (promotion needs an explicit confirm, no secrets in inputs), a status file the console reads, and /metaharness-mod.",
+  "modules": ["./register.ts"]
+}

package/plugins/ruflo-metaharness/hooks/options.ts

@@ -0,0 +1,14 @@
+import type { PluginOptions } from 'claude-code'
+
+/** The plugin's `userConfig`, validated: a bad value is the default (guard on). */
+export type ModOptions = { readonly guard: boolean; readonly extra: Readonly<Record<string, unknown>> }
+
+// BEGIN SHARED FLAG (generated by scripts/sync-mod-screen.mjs; edit plugins/ruflo-agentdb/hooks/options.ts)
+export const flag = (value: unknown, fallback: boolean) =>
+  value === true || value === 'true' || value === 'on' ? true : value === false || value === 'false' || value === 'off' ? false : fallback
+// END SHARED FLAG
+
+export function readOptions(options: PluginOptions | undefined): ModOptions {
+  const o = options ?? {}
+  return { guard: flag(o.guard, true), extra: {} }
+}

package/plugins/ruflo-metaharness/hooks/register.ts

@@ -0,0 +1,108 @@
+import type { Hook, Register } from 'claude-code'
+
+import { isOwn, shortName, verdict } from './guard'
+import { readOptions, type ModOptions } from './options'
+import { scan } from './screen'
+
+const COMMAND = 'metaharness-mod'
+const STATUS_PATH = '.claude-flow/metaharness-mod/status.json'
+const RECENT = 5
+
+type Dollar = Parameters<Hook<'session.start'>>[0]
+
+/** Everything one session of the mod keeps: its settings, per-tool counters, what was refused and the project root. */
+type Session = {
+  readonly opts: ModOptions
+  readonly calls: Record<string, number>
+  blocked: number
+  readonly recent: string[]
+  root?: string
+}
+
+const total = (s: Session) => Object.values(s.calls).reduce((a, b) => a + b, 0)
+
+function note(s: Session, line: string): void {
+  s.recent.push(line)
+  if (s.recent.length > RECENT) s.recent.splice(0, s.recent.length - RECENT)
+}
+
+/** The status file the console reads; `version` lets it refuse a shape it does not know. Counters only, never tool input. */
+async function flush($: Dollar, s: Session): Promise<void> {
+  if (s.root === undefined) return
+  const body = { version: 1, updatedMs: await $.clock.now(), guard: s.opts.guard, ...s.opts.extra, calls: s.calls, total: total(s), blocked: s.blocked, recent: s.recent }
+  try {
+    await $.fs.write(`${s.root}/${STATUS_PATH}`, `${JSON.stringify(body, null, 2)}\n`)
+  } catch {
+    /* the status file is a courtesy */
+  }
+}
+
+/** The connected tools this plugin owns, by short name. */
+async function connected($: Dollar): Promise<string[]> {
+  const tools = await $.tool.list()
+  return tools.filter(t => t.mcp && isOwn(shortName(t.name))).map(t => shortName(t.name))
+}
+
+const HELP = ['/metaharness-mod status', '/metaharness-mod scan <text>', '/metaharness-mod recent', '/metaharness-mod tools'].join('\n')
+
+async function answer($: Dollar, s: Session, args: string): Promise<string> {
+  const [verb = '', ...rest] = args.trim().split(/\s+/)
+  const arg = rest.join(' ')
+  if (verb === '' || verb === 'help') return HELP
+  if (verb === 'status') {
+    const per = Object.entries(s.calls).map(([k, v]) => `${k} ${v}`).join(' · ')
+    return [`guard ${s.opts.guard ? 'on' : 'off'}${Object.entries(s.opts.extra).map(([k, v]) => ` · ${k} ${String(v)}`).join('')}`, `${total(s)} call${total(s) === 1 ? '' : 's'}${per ? ` (${per})` : ''} · refused ${s.blocked}`].join('\n')
+  }
+  if (verb === 'recent') return s.recent.length ? s.recent.map(r => `- ${r}`).join('\n') : 'Nothing has gone through this session.'
+  if (verb === 'tools') {
+    const names = await connected($)
+    return names.length ? names.join('\n') : 'None of this plugin\'s tools are connected. Connect the ruflo MCP server and try again.'
+  }
+  if (verb === 'scan') {
+    if (arg === '') return 'usage: /metaharness-mod scan <text>'
+    const found = scan(arg)
+    return found.secrets.length ? `The guard would refuse that (${found.secrets.join(', ')}).` : 'Nothing found: the guard would let that through.'
+  }
+  return `Unknown: ${verb}\n${HELP}`
+}
+
+/**
+ * MetaHarness as a mod (ADR-445): a tighten-only guard on this plugin's own tools, a status file the console reads, and `/metaharness-mod`.
+ * No network, no process, no model call.
+ */
+export const register: Register = (on, options) => {
+  const s: Session = { opts: readOptions(options), calls: {}, blocked: 0, recent: [] }
+
+  on('session.start', async ($, e, next) => {
+    const result = await next(e)
+    s.root = (await $.session.root()) as string | undefined
+    try {
+      await $.command.register({ name: COMMAND, description: 'MetaHarness mod: status, scan <text>, recent, tools' })
+    } catch {
+      /* a name taken by another plugin must not stop the mod */
+    }
+    await flush($, s)
+    return result
+  })
+
+  on('tool.call', async ($, e, next) => {
+    const name = shortName(e.tool)
+    if (!isOwn(name, e)) return next(e)
+    if (s.opts.guard) {
+      const reason = verdict(name, e, s.opts, s.calls)
+      if (reason !== undefined) {
+        s.blocked++
+        note(s, `refused ${name}`)
+        await flush($, s)
+        return { deny: reason }
+      }
+    }
+    s.calls[name] = (s.calls[name] ?? 0) + 1
+    note(s, name)
+    await flush($, s)
+    return next(e)
+  })
+
+  /** `/metaharness-mod`: the plugin's own commands are prompt commands, which no hook can answer. */
+  on('command.run', { command: COMMAND }, async ($, e) => ({ text: await answer($, s, typeof e.args === 'string' ? e.args : '') }))
+}

package/plugins/ruflo-metaharness/hooks/screen.ts

@@ -0,0 +1,260 @@
+/**
+ * Pure text screening for the AgentDB mod (ADR-445). Two jobs: find secrets (so none is stored) and find prompt-injection phrasing (so
+ * retrieved memory cannot instruct the model). Findings are NAMES only: the matched text is never returned, logged or counted by value.
+ */
+
+// BEGIN SHARED SCREEN (generated from plugins/ruflo-agentdb/hooks/screen.ts by scripts/sync-mod-screen.mjs; do not edit in a copy)
+export type Rules = readonly (readonly [string, RegExp])[]
+
+/** The secret shapes every mod screens for. A plugin adds its own after these, outside the markers. */
+export const COMMON_SECRETS: Rules = [
+  ['private key', /-----BEGIN [A-Z ]*PRIVATE KEY-----/],
+  ['aws access key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],
+  ['github token', /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{40,})\b/],
+  ['slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,}/],
+  ['slack webhook', /\bhooks\.slack\.com\/services\/T[A-Z0-9]{6,}\/B[A-Z0-9]{6,}\/[A-Za-z0-9]{16,}/],
+  ['google api key', /\bAIza[0-9A-Za-z_-]{35}\b/],
+  ['anthropic or openai key', /\bsk-(?:(?:ant|proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|(?=[A-Za-z]{0,40}\d)[A-Za-z0-9]{32,})/],
+  ['stripe key', /\b[rs]k_live_[A-Za-z0-9]{16,}/],
+  ['npm token', /\bnpm_[A-Za-z0-9]{36}\b/],
+  ['huggingface token', /\bhf_[A-Za-z0-9]{30,}\b/],
+  ['sendgrid key', /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/],
+  ['twilio key', /\bSK[0-9a-f]{32}\b/],
+  ['jwt', /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/],
+  ['bearer token', /\bBearer\s+([A-Za-z0-9._~+/=-]{24,})/],
+  ['database url with credentials', /\b[a-z][a-z0-9+.-]{1,20}:\/\/[^\s:@/]+:[^\s@/]{3,}@[^\s/]+/i],
+]
+
+export const INJECTION: Rules = [
+  ['override instructions', /\b(?:ignore|disregard|forget|override)\b[^.\n]{0,40}\b(?:previous|prior|above|earlier|all|any|system)\b[^.\n]{0,30}\b(?:instructions?|rules?|prompts?|guidelines?)\b/i],
+  ['role reassignment', /\byou are (?:now|no longer)\b|\bact as (?:an? )?(?:unrestricted|jailbroken)\b/i],
+  ['new instructions', /\b(?:new|updated|real) (?:system )?instructions?\s*:/i],
+  ['fake role tags', /<\/?\s*(?:system|assistant|developer|instructions?)\s*>|^\s*(?:system|assistant)\s*:/im],
+  ['concealment', /\bdo not (?:tell|inform|mention|reveal)[^.\n]{0,30}\b(?:user|human|operator)\b/i],
+  ['exfiltration', /\b(?:exfiltrate|send|post|upload)\b[^.\n]{0,50}\b(?:secrets?|credentials?|tokens?|api keys?|\.env)\b/i],
+  ['shell pipe', /\b(?:curl|wget)\b[^|\n]{0,200}\|\s*(?:sudo\s+)?(?:ba|z)?sh\b/i],
+]
+
+// C0/C1 controls (keeping tab and newline), DEL, soft hyphen, combining grapheme joiner, Arabic letter mark, Hangul and Mongolian fillers/separators,
+// zero-width, bidi (overrides and isolates) and invisible-format characters, variation selectors; built with escapes, never raw.
+const INVISIBLE = new RegExp(
+  '[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f\\u00ad\\u034f\\u061c\\u115f\\u1160\\u17b4\\u17b5\\u180b-\\u180e\\u200b-\\u200f\\u2028-\\u202e\\u2060-\\u206f\\u3164\\ufe00-\\ufe0f\\ufeff\\uffa0\\ufff9-\\ufffb]',
+  'g',
+)
+
+/** Longest input scanned in one pass; a longer one keeps its head and tail halves. One regex pass per rule, so cost stays linear. */
+const MAX_SCAN = 200_000
+
+/** Input bounded to MAX_SCAN characters with invisible characters removed, so none can hide a secret or a phrase. */
+export const bare = (text: string) =>
+  (text.length > MAX_SCAN ? text.slice(0, MAX_SCAN / 2) + '\n' + text.slice(-MAX_SCAN / 2) : text).replace(INVISIBLE, '')
+
+// A value is a secret CANDIDATE only when it is not a reference (env var, call, identifier path, placeholder, secret-manager path) and its
+// shape is random enough: at least two character classes, one of them a digit or symbol, and Shannon entropy of at least 2.5 bits per character.
+const PLACEHOLDER = /placeholder|your[-_ ]|example|changeme|change[-_]?me|redacted|dummy|replace[-_]?me|insert[-_]|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i
+const REFERENCE =
+  /^(?:\$(?:\{[^}]*\}|\(|[A-Za-z_]\w*$)|%[^%]*%$|<[^>]*>$|\{\{|process\.env|os\.environ|env[.[]|import\.meta|System\.getenv|secrets?\.|vault:|op:\/\/|ref\+|arn:|projects\/[^/]+\/secrets\/|gcp:|kms:|aws:|file:)/i
+const CALL = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(|^[A-Za-z_$][\w$]*\[/
+const IDENT_PATH = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/
+const UUID = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i
+const NAME_LIKE = /^[a-z][a-z0-9]*(?:[-_./][a-z0-9]+){2,}$/
+
+function entropy(v: string): number {
+  const counts = new Map<string, number>()
+  for (const ch of v) counts.set(ch, (counts.get(ch) ?? 0) + 1)
+  let h = 0
+  for (const n of counts.values()) h -= (n / v.length) * Math.log2(n / v.length)
+  return h
+}
+
+/** True when `v` is a name, call, path or placeholder rather than a literal credential. */
+function isReference(v: string): boolean {
+  if (PLACEHOLDER.test(v) || REFERENCE.test(v) || CALL.test(v) || IDENT_PATH.test(v) || URL_NO_CREDS.test(v)) return true
+  return NAME_LIKE.test(v) && v.replace(/\D/g, '').length / v.length < 0.15
+}
+
+export function plausibleSecret(v: string): boolean {
+  if (v.length < 8 || v.length > 256 || /\s/.test(v) || UUID.test(v) || isReference(v)) return false
+  const symbol = /[^A-Za-z0-9]/.test(v)
+  const digit = /\d/.test(v)
+  const classes = [/[a-z]/.test(v), /[A-Z]/.test(v), digit, symbol].filter(Boolean).length
+  return classes >= 2 && (digit || symbol) && entropy(v) >= 2.5
+}
+
+/** Under a secret-named key a literal this long is a secret even with one character class or a UUID shape, unless it is a clear reference. */
+const KEYED_MIN = 20
+const PLACEHOLDER_WORD = /(?:^|[^a-z])(?:your|placeholder|changeme|change[-_]?me|example|redacted|dummy|replace[-_]?me|insert)(?:[^a-z]|$)|\*{3,}|x{5,}|\.{3}|^(?:none|null|undefined|true|false)$/i
+const URL_NO_CREDS = /^[a-z][a-z0-9+.-]{1,20}:\/\/[^\s@]*$/i
+
+/** Three or more lowercase hyphen-separated words (no hex or digit-only run of 8+, few digits), such as my-k8s-secret-name-for-database. */
+function hyphenName(v: string): boolean {
+  const parts = v.split('-')
+  return parts.length >= 3 && parts.every(p => /^[a-z0-9]{2,}$/.test(p) && !/^[0-9a-f]{8,}$/.test(p)) && v.replace(/\D/g, '').length / v.length < 0.15
+}
+
+function keyedSecret(v: string): boolean {
+  if (v.length < KEYED_MIN || v.length > 256 || /\s/.test(v)) return false
+  return !(PLACEHOLDER_WORD.test(v) || REFERENCE.test(v) || CALL.test(v) || IDENT_PATH.test(v) || URL_NO_CREDS.test(v) || (!UUID.test(v) && hyphenName(v)))
+}
+
+const KEY_NAME = /(?:api[_-]?key|secret|token|passw(?:or)?d|passwd|pwd|credential|private[_-]?key|auth(?!or))s?[A-Za-z0-9_-]{0,40}["']?\s*[:=]\s*/gi
+const QUOTED = /(["'\x60])((?:(?!\1)[^\n]){1,256})\1/y
+const BARE_VALUE = /[^\s"'\x60,;]{1,256}/y
+const QUERY_VALUE = /[^\s"'\x60,;&]{1,256}/y
+
+/** A secret-named key assigned a literal value: env style, JSON, YAML, code. Values that are calls, references or placeholders do not count. */
+function assignmentSecret(text: string): boolean {
+  let valueEnd = 0
+  for (const m of text.matchAll(KEY_NAME)) {
+    if (m.index < valueEnd) continue // a key-looking word inside the previous value, such as secretsmanager in an ARN
+    const at = m.index + m[0].length
+    let back = m.index
+    while (back > 0 && m.index - back < 64 && /[A-Za-z0-9_.-]/.test(text.charAt(back - 1))) back--
+    const re = /["'\x60]/.test(text.charAt(at)) ? QUOTED : /[?&]/.test(text.charAt(back - 1)) ? QUERY_VALUE : BARE_VALUE
+    re.lastIndex = at
+    const hit = re.exec(text)
+    const v = hit && (hit[2] ?? hit[0])
+    valueEnd = hit ? at + hit[0].length : at
+    if (v && (plausibleSecret(v) || keyedSecret(v))) return true
+  }
+  return false
+}
+
+/** A password in a URL's userinfo that is not a placeholder such as user:password or ${DB_PASSWORD}. */
+function urlCredential(url: string): boolean {
+  const pass = /^[^:]+:\/\/[^\s:@/]+:([^\s@/]+)@/.exec(url)?.[1]
+  if (!pass || /\$\{|\{\{|%\(|%s/.test(pass)) return false
+  return !/^(?:password|passwd|pass|pwd|secret|changeme|dbpassword|db_password|\$\w*|<.*>|\{.*\}|\*+|x+)$/i.test(pass) && !PLACEHOLDER.test(pass)
+}
+
+const CHECKS: Readonly<Record<string, (m: RegExpMatchArray) => boolean>> = {
+  'bearer token': m => !isReference(m[1] ?? ''),
+  'database url with credentials': m => urlCredential(m[0]),
+  'database url with password': m => urlCredential(m[0]),
+}
+const globals = new WeakMap<RegExp, RegExp>()
+
+function matches(name: string, re: RegExp, text: string): boolean {
+  if (name === 'key assignment') return assignmentSecret(text)
+  const check = CHECKS[name]
+  if (!check) return re.test(text)
+  let g = globals.get(re)
+  if (!g) globals.set(re, (g = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g')))
+  for (const m of text.matchAll(g)) if (check(m)) return true
+  return false
+}
+
+/**
+ * The text textsOf appends when it had to drop input (a node, character or per-string budget ran out). It is never matched against a rule:
+ * `names` reports it as a finding of its own, so every guard that asks "is there a secret in these texts" refuses what it could not read in full.
+ */
+export const TRUNCATED = 'ruflo-screen: input exceeded the screening budget'
+export const TRUNCATED_NAME = 'input too large to screen'
+
+/** Names of the rules that match `text` (already bare'd). A rule named 'key assignment' is judged by assignmentSecret, whatever its regex. */
+export const names = (rules: Rules, text: string) => text === TRUNCATED ? [TRUNCATED_NAME] : rules.filter(([name, re]) => matches(name, re, text)).map(([name]) => name)
+
+export type Findings = { readonly secrets: readonly string[]; readonly injection: readonly string[] }
+
+/** Names of every secret shape in `secrets` and every injection phrase found in `text`. Cost is linear in the capped input. */
+export function screenWith(secrets: Rules, text: string): Findings {
+  const bounded = bare(text)
+  return { secrets: names(secrets, bounded), injection: names(INJECTION, bounded) }
+}
+
+export const hasSecretIn = (secrets: Rules, text: string) => names(secrets, bare(text)).length > 0
+
+/** Makes stored text safe to show: no control or bidi characters, whitespace collapsed, at most `max` characters. */
+export function tidy(text: string, max: number): string {
+  const flat = text.replace(INVISIBLE, '').replace(/\s+/g, ' ').trim()
+  return flat.length > max ? `${flat.slice(0, Math.max(0, max - 1))}…` : flat
+}
+/** Bounds for textsOf: nodes visited, characters returned, the longest string read in full, the size of one returned chunk, chunk overlap. */
+export type TextLimits = { readonly nodes?: number; readonly chars?: number; readonly perString?: number }
+const NODES = 20_000
+const CHARS = 2_000_000
+const PER_STRING = 1_500_000
+const OVERLAP = 2_048
+const BARE_KEY_MIN = 8
+
+/** A string as texts the screen can read whole: one text up to MAX_SCAN, else overlapping MAX_SCAN windows so a secret anywhere is inside one. */
+function windows(text: string, out: string[]): void {
+  if (text.length <= MAX_SCAN) {
+    out.push(text)
+    return
+  }
+  for (let at = 0; ; at += MAX_SCAN - OVERLAP) {
+    out.push(text.slice(at, at + MAX_SCAN))
+    if (at + MAX_SCAN >= text.length) return
+  }
+}
+
+/**
+ * Every string in a tool input, for the screen to read: iterative (no recursion, so nesting 5000 deep cannot overflow the stack) and
+ * breadth-first (siblings before depth, so a long list cannot hide a nested value). A string under an object key comes back as `key=value`,
+ * so a secret-named key is judged with its value; a key whose value is not a string is returned bare. Strings longer than the screen window
+ * come back as overlapping windows; one over `perString` keeps its head and tail. Work is bounded by `nodes` slots and `chars` characters.
+ * Anything dropped (slots or characters ran out, or a string lost its middle) is reported by a final TRUNCATED text, which `names` and
+ * `hasSecretIn` count as a finding, so the screen fails closed instead of passing what it did not read.
+ */
+export function textsOf(input: unknown, limits: TextLimits = {}): string[] {
+  const out: string[] = []
+  let slots = limits.nodes ?? NODES
+  let chars = limits.chars ?? CHARS
+  const perString = limits.perString ?? PER_STRING
+  let truncated = false
+  const take = (text: string): void => {
+    if (chars <= 0) {
+      truncated = true
+      return
+    }
+    if (text.length <= Math.min(perString, chars)) {
+      chars -= text.length
+      windows(text, out)
+      return
+    }
+    truncated = true
+    const half = Math.floor(Math.min(perString, chars) / 2)
+    chars -= 2 * half
+    windows(text.slice(0, half), out)
+    windows(text.slice(-half), out)
+  }
+  const queue: unknown[] = [input]
+  let head = 0
+  for (; head < queue.length && chars > 0; head++) {
+    const node = queue[head]
+    if (typeof node === 'string') take(node)
+    else if (Array.isArray(node)) {
+      let i = 0
+      for (; i < node.length && slots > 0; i++, slots--) if (i in node) queue.push(node[i])
+      if (i < node.length) truncated = true
+    } else if (typeof node === 'object' && node !== null) {
+      for (const k in node) {
+        if (slots-- <= 0) {
+          truncated = true
+          break
+        }
+        if (!Object.prototype.hasOwnProperty.call(node, k)) continue
+        const v = (node as Record<string, unknown>)[k]
+        if (typeof v === 'string') queue.push(k + '=' + v)
+        else {
+          if (k.length >= BARE_KEY_MIN) take(k)
+          queue.push(v)
+        }
+      }
+    }
+  }
+  if (queue.length > head) truncated = true
+  if (truncated) out.push(TRUNCATED)
+  return out
+}
+// END SHARED SCREEN
+
+const SECRETS: Rules = [
+  ...COMMON_SECRETS,
+  ['key assignment', /\b(?:api[_-]?key|secret|token|passw(?:or)?d|credential)s?["']?\s*[:=]\s*["']?[A-Za-z0-9/+=_.-]{16,}/i],
+]
+
+export const scan = (text: string): Findings => screenWith(SECRETS, text)
+
+export const hasSecret = (text: string) => hasSecretIn(SECRETS, text)

package/plugins/ruflo-metaharness/scripts/bench-parse-mcp-scan.mjs

@@ -18,7 +18,8 @@
 //   node scripts/bench-parse-mcp-scan.mjs                  # default 100k iters
 //   node scripts/bench-parse-mcp-scan.mjs --iters 1000000
 //   node scripts/bench-parse-mcp-scan.mjs --format json
-//   node scripts/bench-parse-mcp-scan.mjs --max-mean-us 5  # CI gate
+//   node scripts/bench-parse-mcp-scan.mjs --max-mean-us 5  # CI gate (on the mean)
+//   node scripts/bench-parse-mcp-scan.mjs --max-mean-us 5 --gate-stat p50  # same ceiling on the median: robust to a loaded runner
 //
 // EXIT CODES
 //   0  ok (or threshold satisfied)
@@ -33,15 +34,21 @@ guardCliArgs(import.meta.url, {
   '--iters': 'value',
   '--format': 'value',
   '--max-mean-us': 'value',
+  '--gate-stat': 'value',
 });
 
 const ARGS = (() => {
-  const a = { iters: 100_000, format: 'table', maxMeanUs: null };
+  const a = { iters: 100_000, format: 'table', maxMeanUs: null, gateStat: 'mean' };
   for (let i = 2; i < process.argv.length; i++) {
     const v = process.argv[i];
     if (v === '--iters') a.iters = parseInt(process.argv[++i], 10);
     else if (v === '--format') a.format = process.argv[++i];
     else if (v === '--max-mean-us') a.maxMeanUs = parseFloat(process.argv[++i]);
+    else if (v === '--gate-stat') a.gateStat = process.argv[++i];
+  }
+  if (a.gateStat !== 'mean' && a.gateStat !== 'p50') {
+    console.error(`bench-parse-mcp-scan: --gate-stat must be mean or p50; got ${a.gateStat}`);
+    process.exit(2);
   }
   return a;
 })();
@@ -113,9 +120,11 @@ const results = [
 let gate = { triggered: false, reasons: [] };
 if (ARGS.maxMeanUs != null) {
   for (const r of results) {
-    if (r.meanUs > ARGS.maxMeanUs) {
+    // p50 is the typical-call cost: one scheduler pause on a loaded CI runner moves the mean (iter 86 gate flaked on it) but not the median.
+    const value = ARGS.gateStat === 'p50' ? r.p50Ms * 1000 : r.meanUs;
+    if (value > ARGS.maxMeanUs) {
       gate.triggered = true;
-      gate.reasons.push(`${r.label}: mean ${r.meanUs.toFixed(3)}μs > ceiling ${ARGS.maxMeanUs}μs`);
+      gate.reasons.push(`${r.label}: ${ARGS.gateStat} ${value.toFixed(3)}μs > ceiling ${ARGS.maxMeanUs}μs`);
     }
   }
 }