@claude-flow/cli 3.56.8 → 3.56.10

package/plugins/ruflo-metaharness/.claude-flow/neural/stats.json

@@ -0,0 +1,6 @@
+{
+  "trajectoriesRecorded": 11,
+  "patternsLearned": 7,
+  "signalsProcessed": 0,
+  "lastAdaptation": 1791994898158
+}

package/plugins/ruflo-metaharness/.claude-flow/policy/state.json

@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "mode": "legacy",
+  "migratedFrom": "pre-ADR-324; capabilities=.swarm/memory.db",
+  "migratedAt": 1791993577790,
+  "rules": [],
+  "budgets": [],
+  "usage": [],
+  "approvals": [],
+  "receipts": []
+}

package/plugins/ruflo-metaharness/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruflo-metaharness",
   "description": "MetaHarness integration for ruflo — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150's architectural constraint that MetaHarness remains an optional augmentation, never a required runtime dependency. As a mod (ADR-445): confirms flywheel promotion, keeps secrets out of inputs, /metaharness-mod, and a status file the console shows",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet"

package/plugins/ruflo-metaharness/.swarm/ewc-fisher.json

@@ -0,0 +1,397 @@
+{
+  "version": "1.0.0",
+  "config": {
+    "lambda": 0.4,
+    "dimensions": 384,
+    "fisherDecayRate": 0.01
+  },
+  "globalFisher": [
+    8.463812856424155e-10,
+    9.548097820540842e-11,
+    4.1397428748229534e-11,
+    1.2553277923309294e-10,
+    2.333907048030797e-10,
+    3.3515962507353015e-10,
+    1.061972308258692e-10,
+    1.7051211832980827e-10,
+    1.8429463877824548e-10,
+    8.945790375064758e-11,
+    2.1508973742858283e-10,
+    1.0197643496685456e-10,
+    6.105569732954419e-11,
+    8.09536086219377e-11,
+    6.536886661521847e-11,
+    5.707628056191722e-11,
+    3.746436837333409e-10,
+    4.759128062440702e-11,
+    4.768558091351937e-10,
+    5.1711521588529e-10,
+    1.089683427852845e-9,
+    6.028509858419752e-11,
+    6.04933081010598e-11,
+    1.0780278535668812e-10,
+    1.8080401150466623e-10,
+    1.4511638609045988e-10,
+    2.2236793131134195e-10,
+    2.1264328132760175e-11,
+    7.541285384783524e-11,
+    7.935742543637523e-11,
+    1.042275956197574e-10,
+    3.6476792627308606e-10,
+    7.710260806904148e-10,
+    1.6564244372926126e-11,
+    3.259164086210842e-10,
+    2.6193062297745772e-9,
+    1.3950660272770285e-10,
+    1.5278945358888493e-10,
+    7.477322449951278e-10,
+    3.873899771270164e-10,
+    1.848719090664525e-10,
+    3.526726467775679e-11,
+    8.187963372626332e-11,
+    1.4799168575295675e-10,
+    4.087093126794211e-10,
+    8.327675151566818e-12,
+    1.2267251395656598e-10,
+    1.967401964338217e-10,
+    6.416112875776414e-11,
+    1.6970818756576163e-10,
+    1.7432793892018623e-10,
+    3.8027238475967756e-10,
+    6.083030943390243e-10,
+    1.4688838325950905e-10,
+    1.7559294398319185e-10,
+    1.8417890089899544e-10,
+    5.157646281885516e-11,
+    6.313147020489185e-11,
+    2.2815077208444668e-11,
+    1.573385438085426e-10,
+    2.7911936195816912e-11,
+    2.3186739801965751e-10,
+    8.440926228052774e-11,
+    3.216240580293192e-10,
+    6.287164724159273e-10,
+    7.049077258402888e-11,
+    1.3822717336556592e-10,
+    2.116867187363512e-10,
+    3.635723504181947e-11,
+    4.727062875732637e-11,
+    6.318583677871165e-11,
+    5.036386251809057e-11,
+    3.399584921838225e-10,
+    1.967423743005943e-10,
+    6.185694990755227e-11,
+    2.3978075277843914e-10,
+    9.405789488683936e-11,
+    1.945552960790731e-10,
+    2.3019829737696328e-10,
+    7.517329801066625e-10,
+    7.389931736417019e-10,
+    2.2876234703712587e-10,
+    4.2295347550272733e-11,
+    2.8128080608483233e-10,
+    1.4381137826274524e-10,
+    4.420637828812877e-10,
+    1.2772328818757963e-10,
+    8.758080458163483e-11,
+    3.9236568516067107e-10,
+    6.168908971785879e-11,
+    7.90680300580689e-10,
+    2.264982849842181e-10,
+    2.333854217281959e-10,
+    5.1039355501607424e-11,
+    5.0604786554319567e-11,
+    1.0451175725589437e-10,
+    8.516090935544351e-11,
+    5.960413897814787e-10,
+    8.420459859258385e-11,
+    4.6263519198668465e-10,
+    1.3921539150098968e-11,
+    6.352201653006208e-11,
+    2.055793478882911e-10,
+    6.194635831128613e-11,
+    5.764850228453085e-11,
+    8.253541302593542e-11,
+    1.0417945742701099e-10,
+    1.3198802408385352e-10,
+    3.533693007116156e-10,
+    5.910495328528661e-11,
+    1.3546975235522525e-10,
+    3.894322574329328e-11,
+    1.5088060095569768e-10,
+    1.4231338315368928e-9,
+    6.624660669701507e-10,
+    4.5848455395044483e-10,
+    7.581157663851622e-11,
+    9.487659763371825e-11,
+    1.3005903144569952e-9,
+    1.6453842243433394e-10,
+    1.1532415447568628e-11,
+    1.896802393362768e-10,
+    2.281397450188664e-10,
+    5.664830573848598e-11,
+    2.6923479094606797e-10,
+    9.00498567522812e-11,
+    5.082107450987716e-10,
+    2.0176967613290968e-73,
+    1.6193863547085486e-10,
+    2.736657879031165e-10,
+    5.084766431288647e-10,
+    2.4590660435530066e-10,
+    2.86741889309926e-10,
+    2.4999181832683233e-10,
+    5.513095382791879e-11,
+    3.301848535144532e-10,
+    2.847461889826871e-10,
+    1.0186454442834939e-10,
+    5.857124298968389e-10,
+    6.836023695256932e-11,
+    3.426725909867397e-11,
+    4.0754404014417497e-10,
+    1.6540649420829962e-10,
+    1.0843137577560637e-9,
+    1.71541708100212e-10,
+    1.9738629347899993e-10,
+    4.8520495053638196e-11,
+    6.693416634707066e-11,
+    1.6872272104854284e-10,
+    3.1796318234787313e-10,
+    4.6553260764139394e-10,
+    3.618013838390404e-10,
+    1.2733169145817065e-10,
+    4.2468924159292764e-11,
+    2.0215777533559714e-10,
+    6.348565641410699e-11,
+    4.7982347321089655e-11,
+    1.060675513183844e-10,
+    1.8627421283999607e-10,
+    3.2428390101656425e-11,
+    2.2678710281452058e-10,
+    1.689918506866153e-10,
+    9.309426755444176e-10,
+    1.1770082057856008e-10,
+    4.287204111381301e-11,
+    8.837946450072438e-11,
+    1.1258764696416824e-9,
+    8.416341662265804e-11,
+    8.744979850655715e-11,
+    8.482254779180218e-11,
+    9.92802630665311e-11,
+    6.49341410424748e-11,
+    5.533504875668432e-11,
+    1.330424060116942e-10,
+    1.3796940705774105e-10,
+    1.2883752387504549e-10,
+    5.081080781939192e-10,
+    1.5797677087926566e-10,
+    8.840935205828194e-11,
+    3.628359947603853e-11,
+    4.0436263823093215e-10,
+    8.679823010669733e-10,
+    1.5793940726736718e-11,
+    1.058785714393053e-10,
+    1.7762610423123406e-10,
+    2.211256650058006e-11,
+    5.0373166398075566e-11,
+    3.9791380503735416e-11,
+    4.369202915142563e-10,
+    8.308627326128349e-11,
+    1.5417260611914817e-10,
+    2.4504318602544008e-11,
+    7.688511673783039e-10,
+    1.6095593240008396e-10,
+    1.830273926185042e-10,
+    2.501503266152815e-10,
+    7.793661615904924e-11,
+    9.57106829228683e-11,
+    1.177644422901547e-10,
+    3.724733006977766e-11,
+    9.28385668757396e-11,
+    1.2333974643416927e-10,
+    5.106009752460252e-10,
+    3.8101198098099546e-11,
+    3.458093855108944e-11,
+    5.4612865752793e-11,
+    1.056332759892924e-9,
+    3.148353541087352e-10,
+    2.056830835589048e-10,
+    7.179712535431788e-10,
+    8.538488445669985e-11,
+    6.163569191589335e-10,
+    3.3188421837802246e-10,
+    4.3020662187063126e-10,
+    1.1732819639261695e-10,
+    2.228572394496103e-10,
+    1.2496016550813034e-10,
+    2.3629686337583174e-10,
+    1.070683498515528e-10,
+    1.7649367832184144e-10,
+    1.1595483668200674e-10,
+    2.4602019056011694e-10,
+    4.319039888508741e-10,
+    3.588859638007977e-74,
+    6.29615969733303e-11,
+    1.9979580080278233e-10,
+    1.623343330227536e-10,
+    1.8569231172602785e-10,
+    1.926935398669878e-10,
+    4.2711394034132746e-11,
+    1.1045973208454083e-10,
+    1.875476034313371e-10,
+    4.101338447903749e-10,
+    4.260828564207118e-10,
+    2.3434128387138817e-11,
+    2.1379846014338363e-10,
+    8.249050795469401e-11,
+    5.3289991687417584e-11,
+    1.935838052697111e-10,
+    6.078293391384011e-11,
+    3.4050781302194153e-10,
+    5.3681561346837644e-11,
+    1.1530122904886368e-10,
+    2.1531147355883781e-10,
+    1.0093805666841892e-10,
+    3.3095899555302316e-10,
+    2.1975826287316481e-10,
+    2.6568445419473797e-10,
+    2.058002173565591e-11,
+    1.407532267247042e-10,
+    7.185908939485006e-11,
+    1.3751935919907544e-10,
+    2.9689036315765947e-10,
+    3.1352201642536615e-10,
+    1.342061063816266e-10,
+    2.571089791707985e-10,
+    1.2668429437414235e-10,
+    2.44390543456684e-10,
+    1.3335448348904507e-10,
+    1.9926473703583158e-10,
+    3.2142459821573754e-10,
+    6.599492359741129e-10,
+    2.2366734705387393e-11,
+    1.9464138375807501e-10,
+    2.0220460345891956e-10,
+    1.203756881850747e-10,
+    6.838053089884313e-11,
+    4.194518718024703e-11,
+    2.957914176658098e-11,
+    2.0241293521742367e-10,
+    7.359334149174957e-11,
+    3.3406553441340485e-10,
+    1.9655552479182564e-10,
+    6.16130965966282e-11,
+    1.9118953053996364e-10,
+    1.5979423501774958e-11,
+    1.7372559089556178e-10,
+    3.3839530556099065e-10,
+    2.0401455043397137e-10,
+    8.006318393117121e-11,
+    2.371757865818961e-10,
+    8.845270775226495e-11,
+    2.2508822860355237e-10,
+    2.1576747702138513e-10,
+    3.1466496451259175e-10,
+    5.453179247479678e-10,
+    4.9843394045018943e-11,
+    7.218299090144482e-10,
+    1.4481532734049243e-10,
+    4.0176580283220283e-10,
+    6.542237526532299e-11,
+    2.915672226913591e-10,
+    2.9851349490621725e-10,
+    1.1207119546218841e-10,
+    2.0375980484548192e-10,
+    2.6478164836147975e-10,
+    4.770360091528449e-11,
+    4.2373028752207805e-10,
+    2.8214476105945337e-10,
+    4.8831095252245535e-11,
+    4.9645956014069233e-11,
+    1.0261763120948274e-9,
+    3.965723546377014e-11,
+    8.51753259857448e-11,
+    5.163224392578287e-10,
+    4.962465728336031e-11,
+    9.36953910530645e-11,
+    4.363495213505825e-11,
+    6.105107908823906e-11,
+    7.28160326728442e-11,
+    4.66226058811831e-10,
+    2.7527282698270617e-10,
+    6.488375172912533e-11,
+    2.95770547770409e-11,
+    7.054103879812078e-11,
+    2.3146700806566442e-10,
+    2.6501135148468054e-10,
+    3.85065539313303e-10,
+    1.0567052947277447e-10,
+    1.5689876179535164e-23,
+    8.212522396930227e-11,
+    1.6744767914172087e-10,
+    1.53697775665718e-10,
+    1.8861207983035244e-10,
+    2.2030044783807981e-10,
+    1.1041389013894251e-9,
+    1.1783104728012336e-10,
+    2.2408506262921032e-10,
+    2.5901394279374843e-10,
+    1.448618522861696e-10,
+    1.0938740070029716e-10,
+    2.1874169734896845e-10,
+    6.778962326150732e-11,
+    2.377152704291113e-10,
+    2.7228354764410934e-10,
+    1.9378084920260708e-10,
+    3.5478372063176514e-11,
+    2.5859350822752825e-10,
+    9.166532480719568e-11,
+    5.35947803098293e-10,
+    4.4625902892176024e-11,
+    8.254518048707894e-11,
+    1.8244038462200827e-10,
+    8.714893252532775e-11,
+    7.859863293274777e-10,
+    6.165017634166833e-10,
+    8.212721766888223e-11,
+    4.3044183436646746e-10,
+    4.20932036342107e-11,
+    3.3755297687107374e-11,
+    8.74902799038862e-11,
+    8.466694865812817e-11,
+    3.9418127868557257e-10,
+    1.577105910324074e-10,
+    4.628643223061931e-10,
+    2.9647218965162694e-10,
+    8.614720224742055e-11,
+    1.7376646205374797e-10,
+    3.3282541124020865e-10,
+    1.9927688855341198e-10,
+    7.514220332861749e-11,
+    1.7730322247443614e-10,
+    4.3343209730334416e-11,
+    3.875471427330933e-11,
+    3.839812956201701e-10,
+    5.2825893728396624e-11,
+    8.728407967376904e-11,
+    1.1715501097367943e-10,
+    1.931843182321213e-10,
+    4.775915726375856e-11,
+    1.743093911522625e-10,
+    9.564509819585112e-11,
+    1.9404332494970774e-10,
+    7.03741543809158e-11,
+    2.89183584466594e-10,
+    6.205001125514767e-10,
+    1.4342810517271384e-10,
+    2.3264285337120296e-10,
+    3.2602316209223196e-10,
+    4.75962072203179e-11,
+    4.954937221392049e-10,
+    1.4368905192772292e-10,
+    4.715329409047088e-10,
+    2.989065214532984e-11
+  ],
+  "patterns": [],
+  "consolidationHistory": [],
+  "savedAt": 1791994718151
+}

package/plugins/ruflo-metaharness/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 Newest first. One `## <version> — <date>` heading per version, then `feat:`, `fix:`, `breaking:` and `chore:` bullets (ADR-478). Built from git history; this is the whole history.
 
+## 0.2.6 — 2026-10-12
+- fix: the shared text screen now catches `.env` and e-mailed credentials, no longer flags a model's token talk (`--max-tokens`, `/oauth/token`, "token usage"), and no longer flags values that only name where a secret lives (`./service-account.json`, `--set-secrets=NAME=NAME:latest`); every rule stays linear (#4094, thanks @proffesor-for-testing)
+
 ## 0.2.5 — 2026-10-09
 - fix: seven harness-* skill descriptions no longer carry angle-bracket placeholders (claude.ai strips them as XML tags)
 

package/plugins/ruflo-metaharness/hooks/screen.ts

@@ -31,7 +31,10 @@ export const INJECTION: Rules = [
   ['new instructions', /\b(?:new|updated|real) (?:system )?instructions?\s*:/i],
   ['fake role tags', /<\/?\s*(?:system|assistant|developer|instructions?)\s*>|^\s*(?:system|assistant)\s*:/im],
   ['concealment', /\bdo not (?:tell|inform|mention|reveal)[^.\n]{0,30}\b(?:user|human|operator)\b/i],
-  ['exfiltration', /\b(?:exfiltrate|send|post|upload)\b[^.\n]{0,50}\b(?:secrets?|credentials?|tokens?|api keys?|\.env)\b/i],
+  // `.env` has no word start before its dot, so it is matched on its own ("upload the .env file", "send ./config.env",
+  // ".envrc"); a dot inside a word does not end the phrase. A model's token counts are not credentials: --max-tokens,
+  // /oauth/token and "token usage/count/limit/budget/window" are left out (a file named token, /run/token, is not).
+  ['exfiltration', /\b(?:exfiltrate|send|post|upload|e-?mail)\b(?:[^.\n]|\.(?=\S)){0,50}(?:\b(?:secrets?|credentials?|api keys?)\b|(?:(?<!max[_-]?)\btokens\b|(?<!oauth\/)\btoken\b)(?![\s_-]*(?:usage|counts?|limits?|budgets?|window)\b)|\.env(?:rc)?\b)/i],
   ['shell pipe', /\b(?:curl|wget)\b[^|\n]{0,200}\|\s*(?:sudo\s+)?(?:ba|z)?sh\b/i],
 ]
 
@@ -58,6 +61,10 @@ const CALL = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\(|^[A-Za-z_$][\w$]*\[/
 const IDENT_PATH = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/
 const UUID = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i
 const NAME_LIKE = /^[a-z][a-z0-9]*(?:[-_./][a-z0-9]+){2,}$/
+/** A ./ ../ or ~/ path to a file with an extension names where a secret lives; it is not one. */
+const RELATIVE_FILE = /^(?:\.{1,2}|~)\/[A-Za-z0-9_./-]*\.[A-Za-z0-9]{1,8}$/
+/** A secret-manager reference: NAME:latest, or name-with-separators:3, optionally as NAME=ref (--set-secrets=NAME=ref:latest). A bare literal:3 is not excused. */
+const SECRET_REF = /^(?:[A-Za-z][A-Za-z0-9_-]*=)?(?:[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)*:latest|[A-Za-z][A-Za-z0-9]*(?:[_-][A-Za-z0-9]+)+:\d{1,4})$/
 
 function entropy(v: string): number {
   const counts = new Map<string, number>()
@@ -69,7 +76,7 @@ function entropy(v: string): number {
 
 /** True when `v` is a name, call, path or placeholder rather than a literal credential. */
 function isReference(v: string): boolean {
-  if (PLACEHOLDER.test(v) || REFERENCE.test(v) || CALL.test(v) || IDENT_PATH.test(v) || URL_NO_CREDS.test(v)) return true
+  if (PLACEHOLDER.test(v) || REFERENCE.test(v) || CALL.test(v) || IDENT_PATH.test(v) || URL_NO_CREDS.test(v) || RELATIVE_FILE.test(v) || SECRET_REF.test(v)) return true
   return NAME_LIKE.test(v) && v.replace(/\D/g, '').length / v.length < 0.15
 }
 
@@ -94,7 +101,7 @@ function hyphenName(v: string): boolean {
 
 function keyedSecret(v: string): boolean {
   if (v.length < KEYED_MIN || v.length > 256 || /\s/.test(v)) return false
-  return !(PLACEHOLDER_WORD.test(v) || REFERENCE.test(v) || CALL.test(v) || IDENT_PATH.test(v) || URL_NO_CREDS.test(v) || (!UUID.test(v) && hyphenName(v)))
+  return !(PLACEHOLDER_WORD.test(v) || REFERENCE.test(v) || CALL.test(v) || IDENT_PATH.test(v) || URL_NO_CREDS.test(v) || RELATIVE_FILE.test(v) || SECRET_REF.test(v) || (!UUID.test(v) && hyphenName(v)))
 }
 
 const KEY_NAME = /(?:api[_-]?key|secret|token|passw(?:or)?d|passwd|pwd|credential|private[_-]?key|auth(?!or))s?[A-Za-z0-9_-]{0,40}["']?\s*[:=]\s*/gi

package/plugins/ruflo-metaharness/scripts/smoke.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Structural smoke test for ruflo-metaharness v0.2.5 (ADR-150 Phase 1).
+# Structural smoke test for ruflo-metaharness v0.2.6 (ADR-150 Phase 1).
 set -u
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 PASS=0
@@ -32,10 +32,10 @@ else
   bad "extraction-regex-rot: EXPECTED_TOOLS=$EXPECTED_TOOLS EXPECTED_SUBS=$EXPECTED_SUBS"
 fi
 
-step "1. plugin.json declares 0.2.5 with adr-150 keywords"
+step "1. plugin.json declares 0.2.6 with adr-150 keywords"
 v=$(grep -E '"version"' "$ROOT/.claude-plugin/plugin.json" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-if [[ "$v" != "0.2.5" ]]; then
-  bad "expected 0.2.5, got '$v'"
+if [[ "$v" != "0.2.6" ]]; then
+  bad "expected 0.2.6, got '$v'"
 else
   miss=""
   for k in ruflo metaharness harness scorecard genome mcp-scan threat-model router adr-150 adr-148 adr-149 optional-dependency graceful-degradation subprocess phase-1-mvp; do