claude-flow 3.63.0 → 3.63.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/.proven-config-version +1 -0
- package/.claude/proven-config.json +42 -0
- package/.claude-plugin/marketplace.json +3 -3
- package/README.md +1 -1
- package/package.json +1 -1
- package/v3/@claude-flow/cli/README.md +63 -179
- package/v3/@claude-flow/cli/catalog-manifest.json +5 -5
- package/v3/@claude-flow/cli/dist/src/mcp-tools/agentbbs-tools.js +7 -2
- package/v3/@claude-flow/cli/dist/src/mcp-tools/http-fetch-tools.js +36 -8
- package/v3/@claude-flow/cli/dist/src/mcp-tools/managed-agent-tools.js +3 -0
- package/v3/@claude-flow/cli/dist/src/missions/schemas.d.ts +120 -120
- package/v3/@claude-flow/cli/dist/src/mods/command-registry/schema.d.ts +193 -193
- package/v3/@claude-flow/cli/dist/src/services/flywheel-transaction.js +5 -0
- package/v3/@claude-flow/cli/package.json +1 -1
|
@@ -0,0 +1 @@
|
|
|
1
|
+
sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
{
|
|
2
|
+
"adoptedAt": 1793024118596,
|
|
3
|
+
"championId": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
|
|
4
|
+
"manifest": {
|
|
5
|
+
"schema": "ruflo.proven-config/v1",
|
|
6
|
+
"policy": {
|
|
7
|
+
"ref": "sha256:6141a8ea990c5063b77e090ae8f37f9c539d8aa8f58dcceb30f3a82f97e57319",
|
|
8
|
+
"value": {
|
|
9
|
+
"alpha": 0.3,
|
|
10
|
+
"subjectWeight": 1,
|
|
11
|
+
"mmrLambda": 0.5,
|
|
12
|
+
"bodyWeight": 1.5,
|
|
13
|
+
"typePenaltyFactor": 0.5
|
|
14
|
+
}
|
|
15
|
+
},
|
|
16
|
+
"layer": "framework/node-cli",
|
|
17
|
+
"compatibility": {
|
|
18
|
+
"ruflo": ">=3.24.0"
|
|
19
|
+
},
|
|
20
|
+
"benchmark": {
|
|
21
|
+
"corpus": "ADR-081-labelled-v1",
|
|
22
|
+
"corpusHash": "sha256:2f700b5c363e20a3bd88ce2bc9b87bbbbaa61732c6177894c6ec37890f888982"
|
|
23
|
+
},
|
|
24
|
+
"receipt": {
|
|
25
|
+
"heldOutDelta": 0.07381404928570845,
|
|
26
|
+
"redblue": "PASS",
|
|
27
|
+
"drift": 0,
|
|
28
|
+
"canary": {
|
|
29
|
+
"rollbackRate": 0,
|
|
30
|
+
"latencyP95": 244.612458000076,
|
|
31
|
+
"costPerTask": 0
|
|
32
|
+
},
|
|
33
|
+
"receiptCoverage": 1
|
|
34
|
+
},
|
|
35
|
+
"platform": [
|
|
36
|
+
"linux",
|
|
37
|
+
"macOS",
|
|
38
|
+
"windows"
|
|
39
|
+
]
|
|
40
|
+
},
|
|
41
|
+
"previous": ""
|
|
42
|
+
}
|
|
@@ -57,10 +57,10 @@
|
|
|
57
57
|
"source": "git-subdir",
|
|
58
58
|
"url": "https://github.com/proffesor-for-testing/agentic-qe.git",
|
|
59
59
|
"path": "plugins/agentic-qe-fleet",
|
|
60
|
-
"ref": "v3.15.
|
|
61
|
-
"sha": "
|
|
60
|
+
"ref": "v3.15.13",
|
|
61
|
+
"sha": "e976a8e451b331fff86fc249f2ba40f19644c9fc"
|
|
62
62
|
},
|
|
63
|
-
"description": "Agentic QE (external: maintained in proffesor-for-testing/agentic-qe, pinned to v3.15.
|
|
63
|
+
"description": "Agentic QE (external: maintained in proffesor-for-testing/agentic-qe, pinned to v3.15.13): a quality-engineering fleet with 11 QE agents, 9 skills, 9 commands, the agentic-qe MCP server pinned to the plugin version, and the aqe-mod guard that refuses destructive operations on AQE learning data"
|
|
64
64
|
},
|
|
65
65
|
{
|
|
66
66
|
"name": "ruflo-docs",
|
package/README.md
CHANGED
|
@@ -244,7 +244,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
|
|
|
244
244
|
| [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
|
|
245
245
|
| [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
|
|
246
246
|
| [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
|
|
247
|
-
| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.
|
|
247
|
+
| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.13/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
|
|
248
248
|
|
|
249
249
|
#### Security & Compliance
|
|
250
250
|
|
package/package.json
CHANGED
|
@@ -1,92 +1,22 @@
|
|
|
1
1
|
<div align="center">
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
**An agent meta-harness for Claude Code and Codex.**
|
|
3
|
+
[](https://cognitum.one/agentic-engineering)
|
|
6
4
|
|
|
7
5
|
<!-- Try Ruflo — the 3 badges first-time visitors actually act on -->
|
|
8
6
|
[](https://www.npmjs.com/package/ruflo)
|
|
9
7
|
[](https://opensource.org/licenses/MIT)
|
|
10
8
|
[](https://github.com/ruvnet/claude-flow)
|
|
11
|
-
[](https://x.com/rUv)
|
|
12
|
-
|
|
13
|
-
<p align="center">
|
|
14
|
-
<a href="docs/harness-origins.md"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/e69e4b95aa08d65ea0f7715489bbf8e62a83a0d2/docs/assets/readme/badges/first-commit.svg" width="300" height="76" alt="Claude Flow lineage: first commit June 2, 2025 by rUv; inspect the evidence"></a>
|
|
15
|
-
<a href="data/npm-downloads.latest.json"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/275aff65a198af758923669acff36f03d1f41623/docs/assets/readme/badges/downloads.svg" width="300" height="76" alt="Illustrative download counter starts at 98,000,000 and adds varied amounts each second in a 30 second loop. Verified dataset: 97,022,120 download events."></a>
|
|
16
|
-
<br>
|
|
17
|
-
<a href="https://github.com/ruvnet/claude-flow"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/d1e80400bdefe01d3b13e70395f88fffab76bb18/docs/assets/readme/badges/claude.svg" width="300" height="76" alt="Claude Code plugin"></a>
|
|
18
|
-
<a href="https://www.npmjs.com/package/@claude-flow/codex"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/d1e80400bdefe01d3b13e70395f88fffab76bb18/docs/assets/readme/badges/codex.svg" width="300" height="76" alt="Codex plugin"></a>
|
|
19
|
-
<a href="https://chatgpt.com/plugins/plugin_asdk_app_6ab674ff53c48191bb37040c343e31f3"><img src="docs/assets/readme/badges/chatgpt.svg" width="300" height="76" alt="ChatGPT plugin: RuFlo Federation"></a>
|
|
20
|
-
</p>
|
|
21
|
-
|
|
22
|
-
</div>
|
|
23
|
-
|
|
24
|
-
<a id="start-here"></a>
|
|
25
|
-
|
|
26
|
-
## <img src="docs/assets/readme/icons/terminal.svg" width="32" height="32" alt=""> Get started with Ruflo
|
|
27
|
-
|
|
28
|
-
<img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Start in Claude Code** with core tools, the visual console and runtime mods. Requires Claude Code **2.1.287 or later**. Run inside Claude Code:
|
|
29
|
-
|
|
30
|
-
```text
|
|
31
|
-
/plugin marketplace add ruvnet/ruflo
|
|
32
|
-
/plugin install ruflo-core@ruflo
|
|
33
|
-
/plugin install ruflo-console@ruflo
|
|
34
|
-
/plugin install ruflo-mods@ruflo
|
|
35
|
-
/reload-plugins
|
|
36
|
-
/ruflo
|
|
37
|
-
```
|
|
38
|
-
|
|
39
|
-
**Core** provides foundation tools. **Console** opens the agent cockpit. **Mods** add routing and policy enforcement inside Claude Code. Mods run with your account's permissions; review their code before installing.
|
|
40
|
-
|
|
41
|
-
<img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Using Codex or another MCP enabled tool?** Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server. Run the setup wizard in your project terminal:
|
|
42
|
-
|
|
43
|
-
```bash
|
|
44
|
-
npx ruflo@latest init wizard
|
|
45
|
-
```
|
|
46
|
-
|
|
47
|
-
For clients that support local stdio MCP servers, configure **command** `npx` and **arguments** `["-y", "ruflo@latest", "mcp", "start"]`. The equivalent server command is:
|
|
48
|
-
|
|
49
|
-
```bash
|
|
50
|
-
npx -y ruflo@latest mcp start
|
|
51
|
-
```
|
|
52
|
-
|
|
53
|
-
MCP exposes Ruflo tools to your client. The console and mods above are Claude Code integrations; hook support depends on the client.
|
|
54
|
-
|
|
55
|
-
<img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Prefer a plain terminal? Optional.** The console also runs on its own, with no Claude Code: `npx ruflo tui` (add `--plain` to print one frame for scripts). It shows Overview, Cost, Swarm, Events and Missions, plus an optional AI page. [Terminal UI guide](docs/USERGUIDE.md#terminal-ui-optional)
|
|
56
|
-
|
|
57
|
-
<p align="center"><img src="docs/assets/ruflo-tui-compact.svg" width="640" alt="Looping recording of the optional ruflo terminal UI with its pictures: Overview in the Classic BBS look, the Orbital look with its moving globe, and the Swarm graph, in a sample project"></p>
|
|
58
|
-
|
|
59
|
-
[Compare install paths](#quick-start) · [Open the console](#console-walkthrough) · [User guide](docs/USERGUIDE.md)
|
|
60
|
-
|
|
61
|
-
<div align="center">
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
### Optional: ruOS Desktop
|
|
65
|
-
|
|
66
|
-
<a href="https://ruos.cognitum.one"><img src="ruflo/assets/ruos-animated.svg" alt="ruOS — A desktop that runs itself" width="100%"></a>
|
|
67
|
-
|
|
68
|
-
**Connect ruOS to ChatGPT or Claude via MCP:**
|
|
69
|
-
|
|
70
|
-
```text
|
|
71
|
-
https://ruos.cognitum.one/mcp
|
|
72
|
-
```
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
<!-- RuVector promo -->
|
|
77
|
-
<a href="https://github.com/ruvnet/ruvector"><img src="docs/assets/readme/ruvector-promo-depth.svg" width="100%" alt="RuVector: Give your agents memory. Local vector search, persistent context, graph relationships and feedback learning. Explore RuVector."></a>
|
|
78
|
-
|
|
79
|
-
```bash
|
|
80
|
-
npx ruvector
|
|
81
|
-
```
|
|
82
|
-
|
|
83
|
-
|
|
84
9
|
|
|
10
|
+
<!-- Ecosystem strip (collapsed visually with flat-square) -->
|
|
11
|
+
[](https://github.com/ruvnet/ruvector)
|
|
12
|
+
[](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.proof.json)
|
|
13
|
+
[](https://github.com/ruvnet/ruflo/blob/main/data/clone-data.ledger.json)
|
|
14
|
+
[](https://github.com/ruvnet/claude-flow)
|
|
15
|
+
[](https://www.npmjs.com/package/@claude-flow/codex)
|
|
85
16
|
|
|
86
17
|
# Ruflo
|
|
87
18
|
|
|
88
|
-
|
|
89
|
-
|
|
19
|
+
**An agent meta-harness for Claude Code and Codex.**
|
|
90
20
|
|
|
91
21
|
[](docs/ruflo-explained.md)
|
|
92
22
|
|
|
@@ -99,29 +29,16 @@ A 14-chapter guide: from the basic idea to a first useful task, then memory, age
|
|
|
99
29
|
|
|
100
30
|
One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination.
|
|
101
31
|
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
<sub>Conceptual learning loop. Local vector retrieval and contrastive updates can run without an LLM; embeddings and configured learning modules are still required. See the <a href="v3/@claude-flow/cli/src/services/ruvector-training.ts">RuVector training integration</a> and <a href="v3/@claude-flow/neural/src/modes/balanced.ts">trajectory contrastive learning</a>.</sub>
|
|
105
|
-
|
|
106
|
-
<details>
|
|
107
|
-
<summary>Architecture in text</summary>
|
|
108
|
-
|
|
109
|
-
User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM providers. Memory feeds useful experience back into routing. This is a conceptual flow, not a live execution trace.
|
|
32
|
+
```
|
|
33
|
+
Self-Learning / Self-Optimizing Agent Architecture
|
|
110
34
|
|
|
111
|
-
|
|
35
|
+
User --> Ruflo (CLI/MCP) --> Router --> Swarm --> Agents --> Memory --> LLM Providers
|
|
36
|
+
^ |
|
|
37
|
+
+---- Learning Loop <-------+
|
|
38
|
+
```
|
|
112
39
|
|
|
113
40
|
> **New to Ruflo?** You don't need to learn 314 MCP tools or 26 CLI commands. After `init`, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
|
|
114
41
|
|
|
115
|
-
### An origin you can inspect
|
|
116
|
-
|
|
117
|
-
[](docs/harness-origins.md)
|
|
118
|
-
|
|
119
|
-
**Built by [Reuven Cohen (rUv)](https://github.com/ruvnet), originally as Claude Flow.** The [first commit, June 2, 2025](https://github.com/ruvnet/ruflo/commit/7c1f9402d70e7af56c01a879073cbac92564dc4e), describes a code orchestration layer for recursive agent cycles: Claude writes, edits, tests and improves. The [June 10 source snapshot](https://github.com/ruvnet/ruflo/tree/dba545f012ea92a2375a26332bbf3797495e93c9) adds orchestration, task scheduling, memory and terminal modules.
|
|
120
|
-
|
|
121
|
-
A harness is the workbench around the model: it organizes tasks, carries context between steps and helps check results. **This establishes Ruflo's lineage, not a universal first across every Claude Code tool.** [See the illustrated explainer, exact commits and earlier ecosystem context](docs/harness-origins.md).
|
|
122
|
-
|
|
123
|
-
**Grok Build:** `npx ruflo init --grok` writes the project host surface (`.grok/`, the team bus, and the operator guide) and nothing outside the project; add `--dry-run` to preview. Setup, the `spawn_subagent` contract, the optional status row, and what to re-check when Grok updates: [the Grok operator guide](v3/@claude-flow/cli/templates/grok/docs/README.md).
|
|
124
|
-
|
|
125
42
|
<details>
|
|
126
43
|
<summary><strong>📖 Background — where the name comes from</strong></summary>
|
|
127
44
|
|
|
@@ -131,52 +48,10 @@ A harness is the workbench around the model: it organizes tasks, carries context
|
|
|
131
48
|
|
|
132
49
|
---
|
|
133
50
|
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
<p align="center"><a href="https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg"><img src="docs/assets/ruflo-console-theme-compact.svg" width="100%" alt="Ruflo Orbital theme: animated boot checks, block logo, menu icons, rotating globe, swarm routing, six color palettes and responsive Theme Studio"></a></p>
|
|
137
|
-
|
|
138
|
-
[Open animated demo](https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg) · [Theme Studio guide](plugins/ruflo-console/README.md) · [Workflow demo](docs/assets/ruflo-console-workflows.svg)
|
|
139
|
-
|
|
140
|
-
<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Your agent cockpit.** Track workflows, agents, models, tokens and cost beside Claude Code. The 38 second animation shows **Orbital and Theme Studio** through actual renderer frames, including boot checks, six palettes, customization, saved themes, JSON import and resizing. This compact 3.84 MB SVG retains all 456 frames. Native host and AI provider execution are not demonstrated.
|
|
141
|
-
|
|
142
|
-
<img src="docs/assets/readme/console-icon-inspect.svg" width="28" height="28" alt=""> **Inspect any run.** Open agent logs and results, search, triage failures, replay and compare. Start with `npx ruflo init`, restart Claude Code, then `/ruflo`. [Full console tour](docs/assets/ruflo-console-walkthrough-wide.gif).
|
|
143
|
-
|
|
144
|
-
<img src="docs/assets/readme/console-icon-control.svg" width="28" height="28" alt=""> **Let Claude drive. You set the limits.** Enable **Settings → Claude control** to navigate and run console actions. Choose `read`, `write`, `manage` or `full`, with `ask` or `auto` approval. The current default is **read + ask**; raising the level is your choice. Actions above your permission level are refused, and network, spending and destructive actions require confirmation even in `auto`. Review the live action log or press **Take back control** to stop Claude control. [Details](v3/docs/adr/ADR-444-claude-controls-the-console.md).
|
|
145
|
-
|
|
146
|
-
<a id="console-walkthrough"></a>
|
|
147
|
-
|
|
148
|
-
### One task: create a mission with Claude
|
|
149
|
-
|
|
150
|
-
<img src="docs/assets/readme/console-icon-workflows.svg" width="28" height="28" alt=""> **Watch the recorded console session below.** Claude creates a mission, opens the Learning and Security pages, and reports its actions in Overview.
|
|
151
|
-
|
|
152
|
-
1. **Set the boundary.** Install the console using the commands below, open `/ruflo`, then choose **Settings → Claude control → write + ask**.
|
|
153
|
-
2. **Give a concrete request.** Try: “Create a mission to add a dark mode toggle. Show me the mission and its status.”
|
|
154
|
-
3. **Approve creation.** Claude opens Missions and sets the goal. Confirm the pending create action in the console.
|
|
155
|
-
4. **Verify the result.** Check that Missions contains the goal and Overview records the action. Creating a mission does not mean the feature has been implemented.
|
|
156
|
-
5. **Keep control.** **Take back control** pauses Claude's console tools. A later call should be refused until you restore control.
|
|
157
|
-
|
|
158
|
-
**What the recording demonstrates:** a real Claude Haiku session with `write + auto`, mission creation, page navigation, a refused swarm stop, and control being taken back. The steps above use `ask` so you approve creation yourself. The linked workflow animation uses sample data, while the theme demo replays renderer frames. Neither is evidence of completed swarm work or memory recall.
|
|
159
|
-
|
|
160
|
-
[Implementation and recorded test findings](v3/docs/adr/ADR-444-claude-controls-the-console.md) · [Reproduction script](plugins/ruflo-console/scripts/e2e-control.sh)
|
|
161
|
-
|
|
162
|
-
<p align="center"><img src="docs/assets/ruflo-console-claude-control.gif" alt="Claude Code with the ruflo console beside it: Claude sets a mission goal, creates the mission and opens the Learning, Security and Overview pages through the console tools; the Claude control dashboard logs each action; swarm-stop is refused because it needs the full level; the person clicks Take back control and the next request is refused"></p>
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
**Install the mods from the ruflo marketplace** (Claude Code 2.1.287 or later; mods run with your account's permissions and are not sandboxed, so read the code first):
|
|
166
|
-
|
|
167
|
-
```text
|
|
168
|
-
/plugin marketplace add ruvnet/ruflo
|
|
169
|
-
/plugin install ruflo-console@ruflo
|
|
170
|
-
/plugin install ruflo-mods@ruflo
|
|
171
|
-
/reload-plugins
|
|
172
|
-
```
|
|
173
|
-
|
|
174
|
-
`ruflo-console` is the cockpit above, `ruflo-mods` routes prompts and enforces policy in-process, `ruflo-swarm` shows the swarm in a pane, and `ruflo-ruos` adds the ruOS status segment. Open `/plugin` to confirm they appear in the active mods line. Inside the console, `/ruflo market` is the Plugin Catalog: every ruflo plugin, mod and skill with what it ships, and buttons to install, enable, disable and update (each asks first).
|
|
51
|
+
|
|
175
52
|
|
|
176
53
|
## Quick Start
|
|
177
54
|
|
|
178
|
-
<p align="center"><img src="docs/assets/readme/quick-start.svg" alt="Start building with Ruflo" width="100%"></p>
|
|
179
|
-
|
|
180
55
|
There are **two different install paths** with very different surface areas. Pick based on what you need (#1744):
|
|
181
56
|
|
|
182
57
|
| | **Claude Code Plugin** | **CLI install (`npx ruflo init`)** |
|
|
@@ -244,7 +119,6 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
|
|
|
244
119
|
| [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
|
|
245
120
|
| [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
|
|
246
121
|
| [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
|
|
247
|
-
| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.12/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
|
|
248
122
|
|
|
249
123
|
#### Security & Compliance
|
|
250
124
|
|
|
@@ -275,7 +149,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
|
|
|
275
149
|
|
|
276
150
|
| Plugin | What it does |
|
|
277
151
|
|--------|-------------|
|
|
278
|
-
| [**ruflo-agent**](plugins/ruflo-agent/README.md) | Run agents — local WASM sandbox (rvagent) + Anthropic Claude Managed Agents (cloud)
|
|
152
|
+
| [**ruflo-agent**](plugins/ruflo-agent/README.md) | Run agents — local WASM sandbox (rvagent) + Anthropic Claude Managed Agents (cloud) |
|
|
279
153
|
| [**ruflo-plugin-creator**](plugins/ruflo-plugin-creator/README.md) | Scaffold, validate, and publish your own plugins |
|
|
280
154
|
|
|
281
155
|
#### Domain-Specific
|
|
@@ -288,7 +162,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
|
|
|
288
162
|
|
|
289
163
|
</details>
|
|
290
164
|
|
|
291
|
-
###
|
|
165
|
+
### CLI Install
|
|
292
166
|
|
|
293
167
|
**macOS / Linux / WSL / Git-Bash:**
|
|
294
168
|
|
|
@@ -312,50 +186,68 @@ npm install -g ruflo@latest
|
|
|
312
186
|
|
|
313
187
|
> 💡 **Windows users:** the `curl ... | bash` form needs a POSIX shell (Git-Bash, WSL, MSYS). The `npx ruflo@latest init wizard` line works natively in PowerShell and cmd. If you hit an `'bash' is not recognized` error, use the `npx` line instead — both end up running the same init flow.
|
|
314
188
|
|
|
315
|
-
###
|
|
189
|
+
### MCP Server
|
|
316
190
|
|
|
317
191
|
```bash
|
|
318
192
|
# Add Ruflo as an MCP server in Claude Code
|
|
319
193
|
claude mcp add claude-flow -- npx ruflo@latest mcp start
|
|
320
194
|
```
|
|
321
195
|
|
|
322
|
-
|
|
196
|
+
#### HTTP transport security
|
|
323
197
|
|
|
324
|
-
|
|
198
|
+
`ruflo mcp start -t http` exposes every registered tool over HTTP (`/rpc`, `/mcp`, `/ws`). The default `stdio` transport is not affected.
|
|
325
199
|
|
|
326
|
-
|
|
200
|
+
| Setting | Effect |
|
|
201
|
+
|---|---|
|
|
202
|
+
| `RUFLO_MCP_HTTP_TOKEN=<token>` | Require `Authorization: Bearer <token>` on every request. Failure is a bare `401`. The token is compared in constant time and is never logged. Prefer this over `--auth-token`, which is visible in `ps`. |
|
|
203
|
+
| `--auth-token-file <path>` | Read the token from a file (one line). Takes precedence over the env var. |
|
|
204
|
+
| `--auth-token <token>` | Same, on the command line (visible in argv; highest precedence). |
|
|
205
|
+
| `RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1` | Allow an unauthenticated bind to a non-loopback `--host`. Only for a trusted network boundary or an authenticating reverse proxy. |
|
|
327
206
|
|
|
328
|
-
|
|
329
|
-
<tr><td width="50%"><a href="plugins/ruflo-swarm/README.md"><img src="docs/assets/readme/card-swarm.svg" width="100%" alt="Agent teams"></a></td><td width="50%"><a href="plugins/ruflo-rag-memory/README.md"><img src="docs/assets/readme/card-memory.svg" width="100%" alt="Persistent memory"></a></td></tr>
|
|
330
|
-
<tr><td width="50%"><a href="plugins/ruflo-intelligence/README.md"><img src="docs/assets/readme/card-learning.svg" width="100%" alt="Learning loops"></a></td><td width="50%"><a href="plugins/ruflo-security-audit/README.md"><img src="docs/assets/readme/card-security.svg" width="100%" alt="Security controls"></a></td></tr>
|
|
331
|
-
<tr><td width="50%"><a href="https://ruvnet.github.io/ruflo"><img src="docs/assets/readme/card-plugins.svg" width="100%" alt="Plugin marketplace"></a></td><td width="50%"><a href="plugins/ruflo-ruvllm/README.md"><img src="docs/assets/readme/card-routing.svg" width="100%" alt="Models and routing"></a></td></tr>
|
|
332
|
-
</table>
|
|
207
|
+
A token must be 16-512 printable ASCII characters (no spaces). `GET /health` stays public and returns only `{"status":"ok"}` when a token is set. Tokens are supported for `-t http` only; `-t websocket` rejects one.
|
|
333
208
|
|
|
334
|
-
|
|
|
335
|
-
|
|
336
|
-
|
|
|
337
|
-
|
|
|
338
|
-
| <img src="docs/assets/readme/icons/swarm.svg" width="28" height="28" alt=""> **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
|
|
339
|
-
| <img src="docs/assets/readme/icons/learning.svg" width="28" height="28" alt=""> **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
|
|
340
|
-
| <img src="docs/assets/readme/icons/memory.svg" width="28" height="28" alt=""> **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
|
|
341
|
-
| <img src="docs/assets/readme/icons/workers.svg" width="28" height="28" alt=""> **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
|
|
342
|
-
| <img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
|
|
343
|
-
| <img src="docs/assets/readme/icons/routing.svg" width="28" height="28" alt=""> **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
|
|
344
|
-
| <img src="docs/assets/readme/icons/security.svg" width="28" height="28" alt=""> **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
|
|
345
|
-
| <img src="docs/assets/readme/icons/federation.svg" width="28" height="28" alt=""> **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
|
|
346
|
-
| <img src="docs/assets/readme/icons/audit.svg" width="28" height="28" alt=""> **[MetaHarness](docs/metaharness-user-guide.md)** | Audit your AI agent setup before you ship. Grade readiness (1-100), scan tool configs for security issues, snapshot the whole project to catch regressions over time, and find templates that match your repo. `ruflo eject` turns a ruflo project into a standalone agent toolkit with its own name. [Full guide](docs/metaharness-user-guide.md). |
|
|
209
|
+
| `--host` | no token | token set |
|
|
210
|
+
|---|---|---|
|
|
211
|
+
| `localhost`, `127.0.0.1`, `::1` | starts, **unauthenticated** | starts, token required |
|
|
212
|
+
| anything else (`0.0.0.0`, `::`, a LAN IP, `127.0.0.2`, `[::1]`, `LOCALHOST`) | **refuses to start** unless `RUFLO_MCP_ALLOW_UNAUTHENTICATED_HTTP=1` | starts, token required |
|
|
347
213
|
|
|
348
|
-
|
|
214
|
+
Without a token, a loopback server is still unauthenticated: any process on the machine, and any web page that can reach it via DNS rebinding, can call tools. Set `RUFLO_MCP_HTTP_TOKEN` whenever the HTTP transport is used.
|
|
349
215
|
|
|
350
|
-
|
|
216
|
+
**Upgrading:** binding off loopback (for example `--host 0.0.0.0` in Docker) now needs a token or the opt-out above; otherwise the server exits with an error.
|
|
351
217
|
|
|
352
|
-
|
|
218
|
+
---
|
|
353
219
|
|
|
354
|
-
|
|
220
|
+
## What You Get
|
|
355
221
|
|
|
356
|
-
|
|
222
|
+
| Capability | Description |
|
|
223
|
+
|------------|-------------|
|
|
224
|
+
| 🤖 **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture |
|
|
225
|
+
| 📡 **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely |
|
|
226
|
+
| 🐝 **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus |
|
|
227
|
+
| 🧠 **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
|
|
228
|
+
| 💾 **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
|
|
229
|
+
| ⚡ **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
|
|
230
|
+
| 🧩 **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
|
|
231
|
+
| 🔌 **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
|
|
232
|
+
| 🛡️ **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
|
|
233
|
+
| 🌐 **Agent Federation** | Cross-installation agent collaboration with zero-trust security |
|
|
234
|
+
| 🔬 **[MetaHarness](docs/metaharness-user-guide.md)** | Audit your AI agent setup before you ship. Grade readiness (1-100), scan tool configs for security issues, snapshot the whole project to catch regressions over time, and find templates that match your repo. `ruflo eject` turns a ruflo project into a standalone agent toolkit with its own name. [Full guide](docs/metaharness-user-guide.md). |
|
|
357
235
|
|
|
358
|
-
|
|
236
|
+
### Agent Federation — Slack for Agents
|
|
237
|
+
|
|
238
|
+
```
|
|
239
|
+
Your Agent --> [ Remove secrets ] --> [ Sign message ] --> [ Encrypted channel ]
|
|
240
|
+
Emails, SSNs, Proves it came No one reads it
|
|
241
|
+
keys stripped from you in transit
|
|
242
|
+
|
|
|
243
|
+
v
|
|
244
|
+
Their Agent <-- [ Block attacks ] <-- [ Check identity ] <------+
|
|
245
|
+
Stops prompt Rejects forgeries
|
|
246
|
+
injection
|
|
247
|
+
|
|
248
|
+
Audit trail on both sides.
|
|
249
|
+
Trust builds over time. Bad behavior = instant downgrade.
|
|
250
|
+
```
|
|
359
251
|
|
|
360
252
|
Slack gave teams channels. Federation gives agents the same thing — **shared workspaces across trust boundaries**, where agents on different machines, orgs, or cloud regions can discover each other, prove who they are, and collaborate on tasks.
|
|
361
253
|
|
|
@@ -457,8 +349,6 @@ User --> Claude Code / CLI
|
|
|
457
349
|
|
|
458
350
|
## Documentation
|
|
459
351
|
|
|
460
|
-
<p align="center"><img src="docs/assets/readme/documentation.svg" alt="Guides, architecture and verification" width="100%"></p>
|
|
461
|
-
|
|
462
352
|
Four docs for four audiences:
|
|
463
353
|
|
|
464
354
|
| Doc | When to read it |
|
|
@@ -489,8 +379,6 @@ User Guide section index:
|
|
|
489
379
|
|
|
490
380
|
## Support
|
|
491
381
|
|
|
492
|
-
<p align="center"><img src="docs/assets/readme/support.svg" alt="Build with the Ruflo community" width="100%"></p>
|
|
493
|
-
|
|
494
382
|
| Resource | Link |
|
|
495
383
|
|----------|------|
|
|
496
384
|
| Documentation | [User Guide](docs/USERGUIDE.md) |
|
|
@@ -499,10 +387,6 @@ User Guide section index:
|
|
|
499
387
|
| Community | [Agentics Foundation Discord](https://discord.com/invite/dfxmpwkG2D) |
|
|
500
388
|
| Powered by | [Cognitum.one](https://cognitum.one) |
|
|
501
389
|
|
|
502
|
-
<p align="center"><img src="docs/assets/readme/signal-divider.svg" alt="Ruflo" width="100%"></p>
|
|
503
|
-
|
|
504
390
|
## License
|
|
505
391
|
|
|
506
392
|
MIT - [RuvNet](https://github.com/ruvnet)
|
|
507
|
-
|
|
508
|
-
<a href="https://cognitum.one"><img src="docs/assets/readme/cognitum-banner-v2.svg" width="100%" alt="Cognitum One: Ambient Intelligence at the edge of the Physical World. Explore cognitum.one."></a>
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
|
-
"generation":
|
|
4
|
-
"generatedAt": "2026-
|
|
5
|
-
"gitSha": "
|
|
3
|
+
"generation": 6,
|
|
4
|
+
"generatedAt": "2026-09-17T21:28:47.530Z",
|
|
5
|
+
"gitSha": "702d1461",
|
|
6
6
|
"catalog": {
|
|
7
|
-
"agents":
|
|
8
|
-
"tools":
|
|
7
|
+
"agents": 167,
|
|
8
|
+
"tools": 418,
|
|
9
9
|
"skills": 34
|
|
10
10
|
},
|
|
11
11
|
"benchmark": null
|
|
@@ -441,14 +441,19 @@ export const agentbbsTools = [
|
|
|
441
441
|
const logPath = roomLogPath(basePath, roomId);
|
|
442
442
|
const all = readEnvelopes(logPath);
|
|
443
443
|
let slice = all;
|
|
444
|
+
let resuming = false;
|
|
444
445
|
if (sinceEnvelopeId) {
|
|
445
446
|
const idx = all.findIndex(e => e.envelopeId === sinceEnvelopeId);
|
|
446
|
-
|
|
447
|
+
resuming = idx >= 0;
|
|
448
|
+
slice = resuming ? all.slice(idx + 1) : all;
|
|
447
449
|
}
|
|
448
450
|
// Dedup by envelopeId before applying the limit — a relay replay or a
|
|
449
451
|
// double-append must not surface the same envelope twice to a watcher.
|
|
450
452
|
const deduped = dedupEnvelopes(slice);
|
|
451
|
-
|
|
453
|
+
// A watcher resuming after sinceEnvelopeId gets the oldest envelopes
|
|
454
|
+
// first, so passing the last returned id pages through the rest when
|
|
455
|
+
// hasMore is set. Without a cursor, it gets the most recent window.
|
|
456
|
+
const envelopes = resuming ? deduped.slice(0, limit) : deduped.slice(-limit);
|
|
452
457
|
return {
|
|
453
458
|
success: true,
|
|
454
459
|
roomId,
|
|
@@ -61,11 +61,33 @@ export function validateUrl(rawUrl) {
|
|
|
61
61
|
function isPrivateOrLoopback(host) {
|
|
62
62
|
if (host === 'localhost' || host === 'localhost.localdomain')
|
|
63
63
|
return true;
|
|
64
|
-
// IPv6
|
|
65
|
-
|
|
66
|
-
|
|
64
|
+
// Node's URL parser keeps brackets in `.hostname` for every IPv6 literal
|
|
65
|
+
// (e.g. "[::1]", "[fc00::1]", "[::ffff:7f00:1]"). Strip them once so every
|
|
66
|
+
// check below operates on the bare address — without this, the fc00::/7
|
|
67
|
+
// and fe80::/10 checks further down never match anything (they test
|
|
68
|
+
// `startsWith('fc'/'fe80:')` against a string starting with "["), and an
|
|
69
|
+
// IPv4-mapped-IPv6 literal (`::ffff:a.b.c.d`, which Node normalizes to a
|
|
70
|
+
// canonical `::ffff:xxxx:yyyy` hex form) sails through both the IPv4 and
|
|
71
|
+
// IPv6 branches untested — a live SSRF bypass (e.g. `::ffff:127.0.0.1` or
|
|
72
|
+
// `::ffff:169.254.169.254` reaching loopback / cloud-metadata targets).
|
|
73
|
+
const bare = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
|
|
74
|
+
if (bare === '::1')
|
|
75
|
+
return true; // IPv6 loopback
|
|
76
|
+
// IPv4-mapped IPv6 — decode back to dotted-decimal and recurse into the
|
|
77
|
+
// IPv4 check below so it inherits every existing private/loopback/
|
|
78
|
+
// link-local/CGNAT rule instead of needing its own copy.
|
|
79
|
+
const mappedHex = bare.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
|
|
80
|
+
if (mappedHex) {
|
|
81
|
+
const hi = parseInt(mappedHex[1], 16);
|
|
82
|
+
const lo = parseInt(mappedHex[2], 16);
|
|
83
|
+
const decoded = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
|
|
84
|
+
return isPrivateOrLoopback(decoded);
|
|
85
|
+
}
|
|
86
|
+
const mappedDecimal = bare.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
|
|
87
|
+
if (mappedDecimal)
|
|
88
|
+
return isPrivateOrLoopback(mappedDecimal[1]);
|
|
67
89
|
// IPv4 numeric checks
|
|
68
|
-
const m =
|
|
90
|
+
const m = bare.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
|
|
69
91
|
if (m) {
|
|
70
92
|
const a = Number(m[1]);
|
|
71
93
|
const b = Number(m[2]);
|
|
@@ -85,12 +107,18 @@ function isPrivateOrLoopback(host) {
|
|
|
85
107
|
return true; // CGNAT
|
|
86
108
|
return false;
|
|
87
109
|
}
|
|
88
|
-
// IPv6
|
|
89
|
-
//
|
|
90
|
-
if (
|
|
110
|
+
// IPv6 special forms — be conservative and accept only public-looking
|
|
111
|
+
// literals. Reject obvious private/local forms.
|
|
112
|
+
if (bare.startsWith('fc') || bare.startsWith('fd'))
|
|
91
113
|
return true; // fc00::/7 ULA
|
|
92
|
-
if (
|
|
114
|
+
if (bare.startsWith('fe80:'))
|
|
93
115
|
return true; // link-local
|
|
116
|
+
// KNOWN LIMITATION (pre-existing, not introduced by the bracket-stripping /
|
|
117
|
+
// IPv4-mapped-IPv6 fix above; flagged by an independent adversarial review):
|
|
118
|
+
// `::` (IPv6 unspecified/"any", the analog of 0.0.0.0, which the IPv4 branch
|
|
119
|
+
// above does block), IPv6 multicast (ff00::/8), and NAT64 (64:ff9b::/96) are
|
|
120
|
+
// not covered. Left as a follow-up hardening item rather than scope-creeping
|
|
121
|
+
// this patch.
|
|
94
122
|
return false;
|
|
95
123
|
}
|
|
96
124
|
export function validateHeaders(headers) {
|
|
@@ -54,6 +54,9 @@ async function maRequest(method, path, body, timeoutMs = 30_000) {
|
|
|
54
54
|
const key = apiKey();
|
|
55
55
|
if (!key)
|
|
56
56
|
return { ok: false, status: 0, error: NEEDS_KEY.error };
|
|
57
|
+
// encodeURIComponent leaves '.' and '..' alone, so an id of '..' would walk up the API path (/v1/sessions/.. is /v1/).
|
|
58
|
+
if (path.split('?')[0].split('/').some(segment => segment === '.' || segment === '..'))
|
|
59
|
+
return { ok: false, status: 0, error: 'Invalid managed resource id' };
|
|
57
60
|
try {
|
|
58
61
|
const res = await fetch(`${apiBase()}/v1${path}`, {
|
|
59
62
|
method, headers: headers(key), redirect: 'error',
|