claude-flow 3.58.0 → 3.59.0

package/.claude/proven-config.json

@@ -1,5 +1,5 @@
 {
-  "adoptedAt": 1792476754804,
+  "adoptedAt": 1792503823878,
   "championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
   "manifest": {
     "schema": "ruflo.proven-config/v1",

package/README.md

@@ -118,6 +118,8 @@ User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM prov
 
 A harness is the workbench around the model: it organizes tasks, carries context between steps and helps check results. **This establishes Ruflo's lineage, not a universal first across every Claude Code tool.** [See the illustrated explainer, exact commits and earlier ecosystem context](docs/harness-origins.md).
 
+**Grok Build:** `npx ruflo init --grok` writes the project host surface (`.grok/`, the team bus, and the operator guide) and nothing outside the project; add `--dry-run` to preview. Setup, the `spawn_subagent` contract, the optional status row, and what to re-check when Grok updates: [the Grok operator guide](v3/@claude-flow/cli/templates/grok/docs/README.md).
+
 <details>
 <summary><strong>📖 Background — where the name comes from</strong></summary>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-flow",
-  "version": "3.58.0",
+  "version": "3.59.0",
   "workspaces": [
     "v3/@claude-flow/codex",
     "v3/@claude-flow/mcp",
@@ -30,6 +30,7 @@
     "!v3/@claude-flow/cli/dist/**/*.map",
     "v3/@claude-flow/cli/package.json",
     "v3/@claude-flow/cli/catalog-manifest.json",
+    "v3/@claude-flow/cli/templates/**",
     "v3/@claude-flow/shared/dist/**/*.js",
     "v3/@claude-flow/shared/dist/**/*.d.ts",
     "!v3/@claude-flow/shared/dist/**/*.map",

package/v3/@claude-flow/cli/README.md

@@ -1,90 +1,22 @@
 <div align="center">
 
-<a href="https://cognitum.one/agentic-engineering"><img src="ruflo/assets/ruflo-neon-flicker.gif" alt="Ruflo animated neon sign" width="100%"></a>
-
-**An agent meta-harness for Claude Code and Codex.**
+[![Ruflo Banner](ruflo/assets/ruflo-small.jpeg)](https://cognitum.one/agentic-engineering)
 
 <!-- Try Ruflo — the 3 badges first-time visitors actually act on -->
 [![npm version (ruflo)](https://img.shields.io/npm/v/ruflo?label=npx%20ruflo&style=for-the-badge&logo=npm&color=cb3837)](https://www.npmjs.com/package/ruflo)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://opensource.org/licenses/MIT)
 [![Star on GitHub](https://img.shields.io/github/stars/ruvnet/claude-flow?style=for-the-badge&logo=github&color=gold)](https://github.com/ruvnet/claude-flow)
 
-<p align="center">
-<a href="docs/harness-origins.md"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/e69e4b95aa08d65ea0f7715489bbf8e62a83a0d2/docs/assets/readme/badges/first-commit.svg" width="300" height="76" alt="Claude Flow lineage: first commit June 2, 2025 by rUv; inspect the evidence"></a>
-<a href="data/npm-downloads.latest.json"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/275aff65a198af758923669acff36f03d1f41623/docs/assets/readme/badges/downloads.svg" width="300" height="76" alt="Illustrative download counter starts at 98,000,000 and adds varied amounts each second in a 30 second loop. Verified dataset: 97,022,120 download events."></a>
-<br>
-<a href="https://github.com/ruvnet/claude-flow"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/d1e80400bdefe01d3b13e70395f88fffab76bb18/docs/assets/readme/badges/claude.svg" width="300" height="76" alt="Claude Code plugin"></a>
-<a href="https://www.npmjs.com/package/@claude-flow/codex"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/d1e80400bdefe01d3b13e70395f88fffab76bb18/docs/assets/readme/badges/codex.svg" width="300" height="76" alt="Codex plugin"></a>
-</p>
-
-</div>
-
-<a id="start-here"></a>
-
-## <img src="docs/assets/readme/icons/terminal.svg" width="32" height="32" alt=""> Get started with Ruflo
-
-<img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Start in Claude Code** with core tools, the visual console and runtime mods. Requires Claude Code **2.1.287 or later**. Run inside Claude Code:
-
-```text
-/plugin marketplace add ruvnet/ruflo
-/plugin install ruflo-core@ruflo
-/plugin install ruflo-console@ruflo
-/plugin install ruflo-mods@ruflo
-/reload-plugins
-/ruflo
-```
-
-**Core** provides foundation tools. **Console** opens the agent cockpit. **Mods** add routing and policy enforcement inside Claude Code. Mods run with your account's permissions; review their code before installing.
-
-<img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Using Codex or another MCP enabled tool?** Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server. Run the setup wizard in your project terminal:
-
-```bash
-npx ruflo@latest init wizard
-```
-
-For clients that support local stdio MCP servers, configure **command** `npx` and **arguments** `["-y", "ruflo@latest", "mcp", "start"]`. The equivalent server command is:
-
-```bash
-npx -y ruflo@latest mcp start
-```
-
-MCP exposes Ruflo tools to your client. The console and mods above are Claude Code integrations; hook support depends on the client.
-
-<img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Prefer a plain terminal? Optional.** The console also runs on its own, with no Claude Code: `npx ruflo tui` (add `--plain` to print one frame for scripts). It shows Overview, Cost, Swarm, Events and Missions, plus an optional AI page. [Terminal UI guide](docs/USERGUIDE.md#terminal-ui-optional)
-
-<p align="center"><img src="docs/assets/ruflo-tui-compact.svg" width="640" alt="Looping recording of the optional ruflo terminal UI with its pictures: Overview in the Classic BBS look, the Orbital look with its moving globe, and the Swarm graph, in a sample project"></p>
-
-[Compare install paths](#quick-start) · [Open the console](#console-walkthrough) · [User guide](docs/USERGUIDE.md)
-
-<div align="center">
-
-
-### Optional: ruOS Desktop
-
-<a href="https://ruos.cognitum.one"><img src="ruflo/assets/ruos-animated.svg" alt="ruOS — A desktop that runs itself" width="100%"></a>
-
-**Connect ruOS to ChatGPT or Claude via MCP:**
-
-```text
-https://ruos.cognitum.one/mcp
-```
-
-
-
-<!-- RuVector promo -->
-<a href="https://github.com/ruvnet/ruvector"><img src="docs/assets/readme/ruvector-promo-depth.svg" width="100%" alt="RuVector: Give your agents memory. Local vector search, persistent context, graph relationships and feedback learning. Explore RuVector."></a>
-
-```bash
-npx ruvector
-```
-
-
-
+<!-- Ecosystem strip (collapsed visually with flat-square) -->
+[![🕸️ RuVector Agentic DB](https://img.shields.io/badge/RuVector_Agentic-DB-06b6d4?style=flat-square&logoColor=white&logo=graphql)](https://github.com/ruvnet/ruvector)
+[![Ecosystem downloads](https://img.shields.io/badge/ecosystem%20downloads-8.1M%2B-blue?style=flat-square&logo=npm)](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.proof.json)
+[![Git clones (14d)](https://img.shields.io/badge/git%20clones%2014d-106k-blueviolet?style=flat-square&logo=github)](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.ledger.json)
+[![Claude Code](https://img.shields.io/badge/Claude%20Code-Plugin-D97757?style=flat-square&logoColor=white&logo=anthropic)](https://github.com/ruvnet/claude-flow)
+[![Codex Plugin](https://img.shields.io/badge/Codex-Plugin-412991?style=flat-square&logoColor=white&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI%2BPHBhdGggZmlsbD0id2hpdGUiIGQ9Ik0yMi4yODIgOS44MjFhNS45ODUgNS45ODUgMCAwIDAtLjUxNi00LjkxIDYuMDQ2IDYuMDQ2IDAgMCAwLTYuNTEtMi45QTYuMDY1IDYuMDY1IDAgMCAwIDQuOTgxIDQuMThhNS45ODUgNS45ODUgMCAwIDAtMy45OTggMi45IDYuMDQ2IDYuMDQ2IDAgMCAwIC43NDMgNy4wOTcgNS45OCA1Ljk4IDAgMCAwIC41MSA0LjkxMSA2LjA1MSA2LjA1MSAwIDAgMCA2LjUxNSAyLjlBNS45ODUgNS45ODUgMCAwIDAgMTMuMjYgMjRhNi4wNTYgNi4wNTYgMCAwIDAgNS43NzItNC4yMDYgNS45OSA1Ljk5IDAgMCAwIDMuOTk4LTIuOSA2LjA1NiA2LjA1NiAwIDAgMC0uNzQ3LTcuMDczek0xMy4yNiAyMi40M2E0LjQ3NiA0LjQ3NiAwIDAgMS0yLjg3Ni0xLjA0bC4xNDItLjA4IDQuNzc4LTIuNzU4YS43OTUuNzk1IDAgMCAwIC4zOTMtLjY4MXYtNi43MzdsMi4wMiAxLjE2OGEuMDcxLjA3MSAwIDAgMSAuMDM4LjA1MnY1LjU4M2E0LjUwNCA0LjUwNCAwIDAgMS00LjQ5NSA0LjQ5NHpNMy42IDE4LjMwNGE0LjQ3IDQuNDcgMCAwIDEtLjUzNS0zLjAxNGwuMTQyLjA4NSA0Ljc4MyAyLjc1OWEuNzcxLjc3MSAwIDAgMCAuNzgxIDBsNS44NDMtMy4zNjl2Mi4zMzJhLjA4LjA4IDAgMCAxLS4wMzMuMDYyTDkuNzQgMTkuOTVhNC41IDQuNSAwIDAgMS02LjE0LTEuNjQ2ek0yLjM0IDcuODk2YTQuNDg1IDQuNDg1IDAgMCAxIDIuMzY2LTEuOTczVjExLjZhLjc2Ni43NjYgMCAwIDAgLjM4OC42NzdsNS44MTUgMy4zNTQtMi4wMiAxLjE2OGEuMDc2LjA3NiAwIDAgMS0uMDcyIDBsLTQuODMtMi43ODZBNC41MDQgNC41MDQgMCAwIDEgMi4zNCA3Ljg3MnptMTYuNTk3IDMuODU1LTUuODMzLTMuMzg3IDIuMDE2LTEuMTY1YS4wNzYuMDc2IDAgMCAxIC4wNzEgMGw0LjgzIDIuNzkxYTQuNDk0IDQuNDk0IDAgMCAxLS42NzYgOC4xMDR2LTUuNjc3YS43OS43OSAwIDAgMC0uNDA3LS42Njd6bTIuMDEtMy4wMjMtLjE0MS0uMDg1LTQuNzc0LTIuNzgyYS43NzYuNzc2IDAgMCAwLS43ODUgMEw5LjQwOSA5LjIzVjYuODk3YS4wNjYuMDY2IDAgMCAxIC4wMjgtLjA2Mmw0LjgzLTIuNzg3YTQuNDk5IDQuNDk5IDAgMCAxIDYuNjggNC42NnpNOC4zMDcgMTIuODYzbC0yLjAyLTEuMTY0YS4wOC4wOCAwIDAgMS0uMDM4LS4wNTdWNi4wNzRhNC40OTkgNC40OTkgMCAwIDEgNy4zNzYtMy40NTRsLS4xNDIuMDgtNC43NzggMi43NThhLjc5NS43OTUgMCAwIDAtLjM5My42ODJ6bTEuMDk3LTIuMzY2IDIuNjAyLTEuNSAyLjYwNyAxLjV2Mi45OTlsLTIuNTk3IDEuNS0yLjYwNy0xLjVaIi8%2BPC9zdmc%2B)](https://www.npmjs.com/package/@claude-flow/codex)
 
 # Ruflo
 
-[English](README.md) · [简体中文](README.zh-CN.md)
-
+**An agent meta-harness for Claude Code and Codex.**
 
 [![RuFlo Explained — build an AI team that plans, remembers, tests, and improves](docs/assets/ruflo-explained/ch14.jpg)](docs/ruflo-explained.md)
 
@@ -97,27 +29,16 @@ A 14-chapter guide: from the basic idea to a first useful task, then memory, age
 
 One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
 
-<p align="center"><img src="docs/assets/readme/learning-cinematic-compact.svg" width="100%" alt="Ruflo trajectory learning: branching memory paths, outcome feedback, contrastive AI and local learning. No LLM required for local vector retrieval and contrastive updates; agent execution may still use an LLM."></p>
-
-<sub>Conceptual learning loop. Local vector retrieval and contrastive updates can run without an LLM; embeddings and configured learning modules are still required. See the <a href="v3/@claude-flow/cli/src/services/ruvector-training.ts">RuVector training integration</a> and <a href="v3/@claude-flow/neural/src/modes/balanced.ts">trajectory contrastive learning</a>.</sub>
-
-<details>
-<summary>Architecture in text</summary>
-
-User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM providers. Memory feeds useful experience back into routing. This is a conceptual flow, not a live execution trace.
+```
+Self-Learning / Self-Optimizing Agent Architecture
 
-</details>
+User --> Ruflo (CLI/MCP) --> Router --> Swarm --> Agents --> Memory --> LLM Providers
+                          ^                           |
+                          +---- Learning Loop <-------+
+```
 
 > **New to Ruflo?** You don't need to learn 314 MCP tools or 26 CLI commands. After `init`, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
 
-### An origin you can inspect
-
-[![Claude Flow to Ruflo: founding idea on June 2, 2025, orchestration source on June 10, and the continuing Ruflo lineage.](docs/assets/readme/harness-origins.svg)](docs/harness-origins.md)
-
-**Built by [Reuven Cohen (rUv)](https://github.com/ruvnet), originally as Claude Flow.** The [first commit, June 2, 2025](https://github.com/ruvnet/ruflo/commit/7c1f9402d70e7af56c01a879073cbac92564dc4e), describes a code orchestration layer for recursive agent cycles: Claude writes, edits, tests and improves. The [June 10 source snapshot](https://github.com/ruvnet/ruflo/tree/dba545f012ea92a2375a26332bbf3797495e93c9) adds orchestration, task scheduling, memory and terminal modules.
-
-A harness is the workbench around the model: it organizes tasks, carries context between steps and helps check results. **This establishes Ruflo's lineage, not a universal first across every Claude Code tool.** [See the illustrated explainer, exact commits and earlier ecosystem context](docs/harness-origins.md).
-
 <details>
 <summary><strong>📖 Background — where the name comes from</strong></summary>
 
@@ -127,52 +48,10 @@ A harness is the workbench around the model: it organizes tasks, carries context
 
 ---
 
-<p align="center"><img src="docs/assets/readme/console.svg" alt="Mission control: inspect agent work" width="100%"></p>
-
-<p align="center"><a href="https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg"><img src="docs/assets/ruflo-console-theme-compact.svg" width="100%" alt="Ruflo Orbital theme: animated boot checks, block logo, menu icons, rotating globe, swarm routing, six color palettes and responsive Theme Studio"></a></p>
-
-[Open animated demo](https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg) · [Theme Studio guide](plugins/ruflo-console/README.md) · [Workflow demo](docs/assets/ruflo-console-workflows.svg)
-
-<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Your agent cockpit.** Track workflows, agents, models, tokens and cost beside Claude Code. The 38 second animation shows **Orbital and Theme Studio** through actual renderer frames, including boot checks, six palettes, customization, saved themes, JSON import and resizing. This compact 3.84 MB SVG retains all 456 frames. Native host and AI provider execution are not demonstrated.
-
-<img src="docs/assets/readme/console-icon-inspect.svg" width="28" height="28" alt=""> **Inspect any run.** Open agent logs and results, search, triage failures, replay and compare. Start with `npx ruflo init`, restart Claude Code, then `/ruflo`. [Full console tour](docs/assets/ruflo-console-walkthrough-wide.gif).
-
-<img src="docs/assets/readme/console-icon-control.svg" width="28" height="28" alt=""> **Let Claude drive. You set the limits.** Enable **Settings → Claude control** to navigate and run console actions. Choose `read`, `write`, `manage` or `full`, with `ask` or `auto` approval. The current default is **read + ask**; raising the level is your choice. Actions above your permission level are refused, and network, spending and destructive actions require confirmation even in `auto`. Review the live action log or press **Take back control** to stop Claude control. [Details](v3/docs/adr/ADR-444-claude-controls-the-console.md).
-
-<a id="console-walkthrough"></a>
-
-### One task: create a mission with Claude
-
-<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Watch the recorded console session below.** Claude creates a mission, opens the Learning and Security pages, and reports its actions in Overview.
-
-1. **Set the boundary.** Install the console using the commands below, open `/ruflo`, then choose **Settings → Claude control → write + ask**.
-2. **Give a concrete request.** Try: “Create a mission to add a dark mode toggle. Show me the mission and its status.”
-3. **Approve creation.** Claude opens Missions and sets the goal. Confirm the pending create action in the console.
-4. **Verify the result.** Check that Missions contains the goal and Overview records the action. Creating a mission does not mean the feature has been implemented.
-5. **Keep control.** **Take back control** pauses Claude's console tools. A later call should be refused until you restore control.
-
-**What the recording demonstrates:** a real Claude Haiku session with `write + auto`, mission creation, page navigation, a refused swarm stop, and control being taken back. The steps above use `ask` so you approve creation yourself. The linked workflow animation uses sample data, while the theme demo replays renderer frames. Neither is evidence of completed swarm work or memory recall.
-
-[Implementation and recorded test findings](v3/docs/adr/ADR-444-claude-controls-the-console.md) · [Reproduction script](plugins/ruflo-console/scripts/e2e-control.sh)
-
-<p align="center"><img src="docs/assets/ruflo-console-claude-control.gif" alt="Claude Code with the ruflo console beside it: Claude sets a mission goal, creates the mission and opens the Learning, Security and Overview pages through the console tools; the Claude control dashboard logs each action; swarm-stop is refused because it needs the full level; the person clicks Take back control and the next request is refused"></p>
-
-
-**Install the mods from the ruflo marketplace** (Claude Code 2.1.287 or later; mods run with your account's permissions and are not sandboxed, so read the code first):
-
-```text
-/plugin marketplace add ruvnet/ruflo
-/plugin install ruflo-console@ruflo
-/plugin install ruflo-mods@ruflo
-/reload-plugins
-```
-
-`ruflo-console` is the cockpit above, `ruflo-mods` routes prompts and enforces policy in-process, `ruflo-swarm` shows the swarm in a pane, and `ruflo-ruos` adds the ruOS status segment. Open `/plugin` to confirm they appear in the active mods line. Inside the console, `/ruflo market` is the Plugin Catalog: every ruflo plugin, mod and skill with what it ships, and buttons to install, enable, disable and update (each asks first).
+![Ruflo Plugins](./ruflo-plugins.gif)
 
 ## Quick Start
 
-<p align="center"><img src="docs/assets/readme/quick-start.svg" alt="Start building with Ruflo" width="100%"></p>
-
 There are **two different install paths** with very different surface areas. Pick based on what you need (#1744):
 
 | | **Claude Code Plugin** | **CLI install (`npx ruflo init`)** |
@@ -240,7 +119,6 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
 | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
 | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
-| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.10/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
 
 #### Security & Compliance
 
@@ -284,7 +162,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 
 </details>
 
-### <img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> CLI Install
+### CLI Install
 
 **macOS / Linux / WSL / Git-Bash:**
 
@@ -308,50 +186,68 @@ npm install -g ruflo@latest
 
 > 💡 **Windows users:** the `curl ... | bash` form needs a POSIX shell (Git-Bash, WSL, MSYS). The `npx ruflo@latest init wizard` line works natively in PowerShell and cmd. If you hit an `'bash' is not recognized` error, use the `npx` line instead — both end up running the same init flow.
 
-### <img src="docs/assets/readme/icons/network.svg" width="28" height="28" alt=""> MCP Server
+### MCP Server
 
 ```bash
 # Add Ruflo as an MCP server in Claude Code
 claude mcp add claude-flow -- npx ruflo@latest mcp start
 ```
 
----
+#### HTTP transport security
 
-## What You Get
+`ruflo mcp start -t http` exposes every registered tool over HTTP (`/rpc`, `/mcp`, `/ws`). The default `stdio` transport is not affected.
 
-<p align="center"><img src="docs/assets/readme/capabilities.svg" alt="Your agent toolkit" width="100%"></p>
+| Setting | Effect |
+|---|---|
+| `RUFLO_MCP_HTTP_TOKEN=<token>` | Require `Authorization: Bearer <token>` on every request. Failure is a bare `401`. The token is compared in constant time and is never logged. Prefer this over `--auth-token`, which is visible in `ps`. |
+| `--auth-token-file <path>` | Read the token from a file (one line). Takes precedence over the env var. |
+| `--auth-token <token>` | Same, on the command line (visible in argv; highest precedence). |
+| `RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1` | Allow an unauthenticated bind to a non-loopback `--host`. Only for a trusted network boundary or an authenticating reverse proxy. |
 
-<table>
-<tr><td width="50%"><a href="plugins/ruflo-swarm/README.md"><img src="docs/assets/readme/card-swarm.svg" width="100%" alt="Agent teams"></a></td><td width="50%"><a href="plugins/ruflo-rag-memory/README.md"><img src="docs/assets/readme/card-memory.svg" width="100%" alt="Persistent memory"></a></td></tr>
-<tr><td width="50%"><a href="plugins/ruflo-intelligence/README.md"><img src="docs/assets/readme/card-learning.svg" width="100%" alt="Learning loops"></a></td><td width="50%"><a href="plugins/ruflo-security-audit/README.md"><img src="docs/assets/readme/card-security.svg" width="100%" alt="Security controls"></a></td></tr>
-<tr><td width="50%"><a href="https://ruvnet.github.io/ruflo"><img src="docs/assets/readme/card-plugins.svg" width="100%" alt="Plugin marketplace"></a></td><td width="50%"><a href="plugins/ruflo-ruvllm/README.md"><img src="docs/assets/readme/card-routing.svg" width="100%" alt="Models and routing"></a></td></tr>
-</table>
+A token must be 16-512 printable ASCII characters (no spaces). `GET /health` stays public and returns only `{"status":"ok"}` when a token is set. Tokens are supported for `-t http` only; `-t websocket` rejects one.
 
-| Capability | Description |
-|------------|-------------|
-| <img src="docs/assets/readme/icons/agents.svg" width="28" height="28" alt=""> **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture |
-| <img src="docs/assets/readme/icons/network.svg" width="28" height="28" alt=""> **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely |
-| <img src="docs/assets/readme/icons/swarm.svg" width="28" height="28" alt=""> **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
-| <img src="docs/assets/readme/icons/learning.svg" width="28" height="28" alt=""> **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
-| <img src="docs/assets/readme/icons/memory.svg" width="28" height="28" alt=""> **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
-| <img src="docs/assets/readme/icons/workers.svg" width="28" height="28" alt=""> **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
-| <img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
-| <img src="docs/assets/readme/icons/routing.svg" width="28" height="28" alt=""> **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
-| <img src="docs/assets/readme/icons/security.svg" width="28" height="28" alt=""> **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
-| <img src="docs/assets/readme/icons/federation.svg" width="28" height="28" alt=""> **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
-| <img src="docs/assets/readme/icons/audit.svg" width="28" height="28" alt=""> **[MetaHarness](docs/metaharness-user-guide.md)** | Audit your AI agent setup before you ship. Grade readiness (1-100), scan tool configs for security issues, snapshot the whole project to catch regressions over time, and find templates that match your repo. `ruflo eject` turns a ruflo project into a standalone agent toolkit with its own name. [Full guide](docs/metaharness-user-guide.md). |
+| `--host` | no token | token set |
+|---|---|---|
+| `localhost`, `127.0.0.1`, `::1` | starts, **unauthenticated** | starts, token required |
+| anything else (`0.0.0.0`, `::`, a LAN IP, `127.0.0.2`, `[::1]`, `LOCALHOST`) | **refuses to start** unless `RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1` | starts, token required |
 
-### <img src="docs/assets/readme/icons/learning.svg" width="28" height="28" alt=""> Learning from experience
+Without a token, a loopback server is still unauthenticated: any process on the machine, and any web page that can reach it via DNS rebinding, can call tools. Set `RUFLO_MCP_HTTP_TOKEN` whenever the HTTP transport is used.
 
-<p align="center"><img src="docs/assets/readme/learning-flow.svg" width="100%" alt="Recall, execute, evaluate, store, adapt and reuse: an illustrative agent learning cycle."></p>
+**Upgrading:** binding off loopback (for example `--host 0.0.0.0` in Docker) now needs a token or the opt-out above; otherwise the server exits with an error.
 
-Useful trajectories and task feedback can inform future work. Results depend on the configured memory, learning components and quality of feedback. [Learning plugin](plugins/ruflo-intelligence/README.md).
+---
 
-### Agent Federation — Slack for Agents
+## What You Get
 
-<p align="center"><img src="docs/assets/readme/federation.svg" alt="Connected intelligence across machines" width="100%"></p>
+| Capability | Description |
+|------------|-------------|
+| 🤖 **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture |
+| 📡 **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely |
+| 🐝 **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
+| 🧠 **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
+| 💾 **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
+| ⚡ **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
+| 🧩 **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
+| 🔌 **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
+| 🛡️ **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
+| 🌐 **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
+| 🔬 **[MetaHarness](docs/metaharness-user-guide.md)** | Audit your AI agent setup before you ship. Grade readiness (1-100), scan tool configs for security issues, snapshot the whole project to catch regressions over time, and find templates that match your repo. `ruflo eject` turns a ruflo project into a standalone agent toolkit with its own name. [Full guide](docs/metaharness-user-guide.md). |
 
-<p align="center"><img src="docs/assets/readme/federation-flow.svg" width="100%" alt="Outbound agent, data filtering, signing and encryption, identity verification, input checks and receiving agent."></p>
+### Agent Federation — Slack for Agents
+
+```
+Your Agent --> [ Remove secrets ] --> [ Sign message ] --> [ Encrypted channel ]
+                 Emails, SSNs,        Proves it came       No one reads it
+                 keys stripped         from you              in transit
+                                                                |
+                                                                v
+Their Agent <-- [ Block attacks ] <-- [ Check identity ] <------+
+                 Stops prompt          Rejects forgeries
+                 injection
+
+                          Audit trail on both sides.
+                  Trust builds over time. Bad behavior = instant downgrade.
+```
 
 Slack gave teams channels. Federation gives agents the same thing — **shared workspaces across trust boundaries**, where agents on different machines, orgs, or cloud regions can discover each other, prove who they are, and collaborate on tasks.
 
@@ -453,8 +349,6 @@ User --> Claude Code / CLI
 
 ## Documentation
 
-<p align="center"><img src="docs/assets/readme/documentation.svg" alt="Guides, architecture and verification" width="100%"></p>
-
 Four docs for four audiences:
 
 | Doc | When to read it |
@@ -485,8 +379,6 @@ User Guide section index:
 
 ## Support
 
-<p align="center"><img src="docs/assets/readme/support.svg" alt="Build with the Ruflo community" width="100%"></p>
-
 | Resource | Link |
 |----------|------|
 | Documentation | [User Guide](docs/USERGUIDE.md) |
@@ -495,10 +387,6 @@ User Guide section index:
 | Community | [Agentics Foundation Discord](https://discord.com/invite/dfxmpwkG2D) |
 | Powered by | [Cognitum.one](https://cognitum.one) |
 
-<p align="center"><img src="docs/assets/readme/signal-divider.svg" alt="Ruflo" width="100%"></p>
-
 ## License
 
 MIT - [RuvNet](https://github.com/ruvnet)
-
-<a href="https://cognitum.one"><img src="docs/assets/readme/cognitum-banner-v2.svg" width="100%" alt="Cognitum One: Ambient Intelligence at the edge of the Physical World. Explore cognitum.one."></a>

package/v3/@claude-flow/cli/bin/cli.js

@@ -161,7 +161,25 @@ const isMCPMode = !process.stdin.isTTY
   && !explicitNonStdioTransport
   && (process.argv.length === 2 || isExplicitMCP);
 
-if (isMCPMode) {
+// `harness` observes the running system (it is the SessionStart hook), so it
+// skips normal CLI startup entirely: no daemon autostart, update check, policy
+// migration or config adoption, and no heavy imports. With --hook it fails
+// silently (no stack on stderr) so a missing dist/ can't disturb a session.
+const isHarness = cliArgs[0] === 'harness' && !cliArgs.includes('--help') && !cliArgs.includes('-h');
+
+if (isHarness) {
+  const hook = cliArgs.includes('--hook');
+  try {
+    const { runHarnessCli } = await import('../dist/src/commands/harness.js');
+    process.exitCode = runHarnessCli(cliArgs.slice(1));
+  } catch (error) {
+    if (!hook) {
+      const missing = error && error.code === 'ERR_MODULE_NOT_FOUND';
+      console.error(`ruflo harness: ${missing ? 'the CLI is not built (dist/ is missing)' : (error && error.message) || error}`);
+    }
+    process.exitCode = hook ? 0 : 1;
+  }
+} else if (isMCPMode) {
   // Run MCP server mode
   const { listMCPTools, callMCPTool, hasTool } = await import('../dist/src/mcp-client.js');
   const { isPolicyEnforcementEnabled, loadMcpPolicy, evaluateToolCall } =

package/v3/@claude-flow/cli/catalog-manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": 1,
-  "generation": 7,
-  "generatedAt": "2026-10-20T06:14:05.915Z",
-  "gitSha": "d529a38a",
+  "generation": 6,
+  "generatedAt": "2026-09-17T21:28:47.530Z",
+  "gitSha": "702d1461",
   "catalog": {
-    "agents": 176,
-    "tools": 423,
+    "agents": 167,
+    "tools": 418,
     "skills": 34
   },
   "benchmark": null

package/v3/@claude-flow/cli/dist/src/commands/harness.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Live harness status.
+ *
+ * This is not `doctor` and not `status`. Those describe install health or
+ * call tool handlers inside this process. `harness` reports what is already
+ * running for this working tree: the host session, a live daemon pid, ruflo
+ * MCP servers whose cwd is this tree, processes holding the memory databases
+ * open, and teams that are still active.
+ *
+ *   ruflo harness
+ *   ruflo harness --json
+ *   ruflo harness --hook               # SessionStart payload for Codex (and Claude)
+ *   ruflo harness --print-codex-hook   # opt-in .codex/hooks.json for this install
+ *
+ * `harness` is observe-only: bin/cli.js runs it through `runHarnessCli`
+ * before the normal CLI starts, so no daemon autostart, update check, policy
+ * migration or config adoption runs, and nothing is written to disk. The CLI
+ * class also exempts it from those side effects (see OBSERVE_ONLY_COMMANDS).
+ */
+import type { Command } from '../types.js';
+import { type LiveHarness } from '../services/live-harness.js';
+export type { LiveHarness } from '../services/live-harness.js';
+export { collectLiveHarness } from '../services/live-harness.js';
+/** This install's bin/cli.js, from dist/src/commands/harness.js (or src/commands). */
+export declare function installedCliPath(moduleUrl?: string): string;
+/**
+ * A .codex/hooks.json that runs this install's harness on SessionStart. The
+ * path is absolute, so the hook does not depend on the session's git root.
+ * Autostart and the update check are off, and failures stay silent.
+ */
+export declare function codexHookConfig(cliPath?: string): string;
+/**
+ * Entry used by bin/cli.js before the CLI class loads. Returns the exit code.
+ * With --hook it never fails: on any error it prints nothing and returns 0,
+ * so a SessionStart hook can't break a session.
+ */
+export declare function runHarnessCli(argv: string[], write?: (text: string) => void, collect?: () => LiveHarness): number;
+export declare const harnessCommand: Command;
+export default harnessCommand;
+//# sourceMappingURL=harness.d.ts.map

package/v3/@claude-flow/cli/dist/src/commands/harness.js

@@ -0,0 +1,142 @@
+/**
+ * Live harness status.
+ *
+ * This is not `doctor` and not `status`. Those describe install health or
+ * call tool handlers inside this process. `harness` reports what is already
+ * running for this working tree: the host session, a live daemon pid, ruflo
+ * MCP servers whose cwd is this tree, processes holding the memory databases
+ * open, and teams that are still active.
+ *
+ *   ruflo harness
+ *   ruflo harness --json
+ *   ruflo harness --hook               # SessionStart payload for Codex (and Claude)
+ *   ruflo harness --print-codex-hook   # opt-in .codex/hooks.json for this install
+ *
+ * `harness` is observe-only: bin/cli.js runs it through `runHarnessCli`
+ * before the normal CLI starts, so no daemon autostart, update check, policy
+ * migration or config adoption runs, and nothing is written to disk. The CLI
+ * class also exempts it from those side effects (see OBSERVE_ONLY_COMMANDS).
+ */
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { collectLiveHarness } from '../services/live-harness.js';
+export { collectLiveHarness } from '../services/live-harness.js';
+function renderText(report) {
+    const out = [report.line];
+    if (Object.keys(report.session).length) {
+        out.push(`session ${Object.entries(report.session).map(([k, v]) => `${k}=${v}`).join(' ')}`);
+    }
+    for (const server of report.mcp.servers)
+        out.push(`mcp ${server.pid} ${server.command}`);
+    if (report.memory.openPids?.length)
+        out.push(`memory held by ${report.memory.openPids.join(',')}`);
+    for (const team of report.teams)
+        out.push(`team ${team.name} ${team.status} members=${team.members}`);
+    if (report.staleTeams.length)
+        out.push(`stale teams (no activity, not shut down) ${report.staleTeams.join(',')}`);
+    return out.join('\n') + '\n';
+}
+function renderHook(report) {
+    return JSON.stringify({
+        hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: report.line },
+    }) + '\n';
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** This install's bin/cli.js, from dist/src/commands/harness.js (or src/commands). */
+export function installedCliPath(moduleUrl = import.meta.url) {
+    return join(dirname(fileURLToPath(moduleUrl)), '..', '..', '..', 'bin', 'cli.js');
+}
+/**
+ * A .codex/hooks.json that runs this install's harness on SessionStart. The
+ * path is absolute, so the hook does not depend on the session's git root.
+ * Autostart and the update check are off, and failures stay silent.
+ */
+export function codexHookConfig(cliPath = installedCliPath()) {
+    const command = `RUFLO_DAEMON_AUTOSTART=0 node ${shellQuote(cliPath)} harness --hook --no-update 2>/dev/null || true`;
+    return JSON.stringify({
+        hooks: {
+            SessionStart: [
+                {
+                    matcher: 'startup|resume|clear|compact|fork',
+                    hooks: [{ type: 'command', command, timeout: 8 }],
+                },
+            ],
+        },
+    }, null, 2) + '\n';
+}
+function render(mode, collect) {
+    if (mode === 'codex-hook')
+        return { text: codexHookConfig() };
+    const report = collect();
+    if (mode === 'hook')
+        return { text: renderHook(report), report };
+    if (mode === 'json')
+        return { text: JSON.stringify(report, null, 2) + '\n', report };
+    return { text: renderText(report), report };
+}
+function modeOf(flags) {
+    if (flags.printCodexHook)
+        return 'codex-hook';
+    if (flags.hook)
+        return 'hook';
+    if (flags.json)
+        return 'json';
+    return 'text';
+}
+/**
+ * Entry used by bin/cli.js before the CLI class loads. Returns the exit code.
+ * With --hook it never fails: on any error it prints nothing and returns 0,
+ * so a SessionStart hook can't break a session.
+ */
+export function runHarnessCli(argv, write = (text) => { process.stdout.write(text); }, collect = () => collectLiveHarness()) {
+    const mode = modeOf({
+        hook: argv.includes('--hook'),
+        json: argv.includes('--json'),
+        printCodexHook: argv.includes('--print-codex-hook'),
+    });
+    try {
+        write(render(mode, collect).text);
+        return 0;
+    }
+    catch (error) {
+        if (mode === 'hook')
+            return 0;
+        process.stderr.write(`ruflo harness: ${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}
+export const harnessCommand = {
+    name: 'harness',
+    description: 'Show the running harness for this tree (live pids and open state, not install config)',
+    options: [
+        { name: 'json', description: 'Print the live report as JSON', type: 'boolean', default: false },
+        {
+            name: 'hook',
+            description: 'Print a SessionStart additionalContext payload for Codex or Claude',
+            type: 'boolean',
+            default: false,
+        },
+        {
+            name: 'print-codex-hook',
+            description: 'Print an opt-in .codex/hooks.json that runs this install on SessionStart',
+            type: 'boolean',
+            default: false,
+        },
+    ],
+    examples: [
+        { command: 'ruflo harness', description: 'One line plus any live mcp, memory holders, and teams' },
+        { command: 'ruflo harness --json', description: 'Machine-readable live report' },
+        { command: 'ruflo harness --hook', description: 'SessionStart payload' },
+        { command: 'ruflo harness --print-codex-hook > .codex/hooks.json', description: 'Opt in to the Codex SessionStart hook' },
+    ],
+    action: async (ctx) => {
+        const mode = modeOf(ctx.flags);
+        const { text, report } = render(mode, () => collectLiveHarness());
+        process.stdout.write(text);
+        return { success: true, data: report };
+    },
+};
+export default harnessCommand;
+//# sourceMappingURL=harness.js.map

package/v3/@claude-flow/cli/dist/src/commands/index.js

@@ -45,6 +45,7 @@ const commandLoaders = {
     // P0 Commands
     completions: () => import('./completions.js'),
     doctor: () => import('./doctor.js'),
+    harness: () => import('./harness.js'),
     // Verification (ADR-095, signed witness manifest)
     verify: () => import('./verify.js'),
     // Analysis Commands