ruflo 3.16.3 → 3.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruflo",
-  "version": "3.16.3",
+  "version": "3.17.0",
   "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "bin/ruflo.js",
   "type": "module",
@@ -40,14 +40,14 @@
     "package:rvf": "bash src/scripts/package-rvf.sh"
   },
   "dependencies": {
-    "@claude-flow/cli": "^3.10.3"
+    "@claude-flow/cli": "^3.17.0"
   },
   "optionalDependencies": {
-    "metaharness": "~0.2.6",
+    "metaharness": "~0.2.8",
     "@metaharness/router": "~0.3.2",
-    "@metaharness/kernel": "~0.1.0",
-    "@metaharness/darwin": "~0.3.1",
-    "@metaharness/redblue": "~0.1.1"
+    "@metaharness/kernel": "~0.1.2",
+    "@metaharness/darwin": "~0.8.0",
+    "@metaharness/redblue": "~0.1.4"
   },
   "overrides": {
     "ruvector": "^0.2.27",

package/src/mcp-bridge/index.js

@@ -882,6 +882,19 @@ const GROUP_DISPLAY_NAMES = {
 const app = express();
 app.use(express.json({ limit: "10mb" }));
 
+// ---------- MCP Streamable HTTP session (#2425 djimit) ----------
+// Streamable-HTTP clients (Codex/RMCP) send `DELETE /mcp` with an
+// `Mcp-Session-Id` header at shutdown. We echo a stable session id back
+// on every /mcp* response so those clients can attach it to the DELETE
+// and to `notifications/initialized` handshakes.
+const MCP_SESSION_ID = randomUUID();
+app.use((req, res, next) => {
+  if (req.path.startsWith("/mcp")) {
+    res.setHeader("Mcp-Session-Id", MCP_SESSION_ID);
+  }
+  next();
+});
+
 // ---------- CORS middleware (ADR-166 §6 Phase 3b) ----------
 const CORS_ALLOWLIST = (process.env.MCP_CORS_ORIGIN || "*")
   .split(",").map(s => s.trim()).filter(Boolean);
@@ -894,8 +907,8 @@ app.use((req, res, next) => {
     res.setHeader("Access-Control-Allow-Origin", origin);
     res.setHeader("Vary", "Origin");
   }
-  res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id");
   if (req.method === "OPTIONS") return res.sendStatus(204);
   next();
 });
@@ -944,7 +957,9 @@ function createMcpHandler(groupName) {
           return res.json({ jsonrpc: "2.0", id, result: mcpResult });
         }
         case "notifications/initialized":
-          return res.json({ jsonrpc: "2.0", id, result: {} });
+          // MCP streamable-HTTP spec: notifications must return 202 Accepted
+          // with an empty body (no jsonrpc envelope).
+          return res.status(202).end();
         default:
           return res.json({ jsonrpc: "2.0", id, error: { code: -32601, message: `Method not found: ${method}` } });
       }
@@ -968,6 +983,8 @@ function createMcpSseHandler(groupName) {
 for (const groupName of Object.keys(TOOL_GROUPS)) {
   app.post(`/mcp/${groupName}`, createMcpHandler(groupName));
   app.get(`/mcp/${groupName}`, createMcpSseHandler(groupName));
+  // #2425 djimit — streamable-HTTP session cleanup
+  app.delete(`/mcp/${groupName}`, (_, res) => res.sendStatus(204));
 }
 
 // ---------- Catch-all /mcp — serves ALL enabled tools (backwards-compatible) ----------
@@ -998,7 +1015,7 @@ app.post("/mcp", async (req, res) => {
         return res.json({ jsonrpc: "2.0", id, result: mcpResult });
       }
       case "notifications/initialized":
-        return res.json({ jsonrpc: "2.0", id, result: {} });
+        return res.status(202).end();
       default:
         return res.json({ jsonrpc: "2.0", id, error: { code: -32601, message: `Method not found: ${method}` } });
     }
@@ -1015,6 +1032,9 @@ app.get("/mcp", (req, res) => {
   res.write(`data: ${JSON.stringify({ type: "endpoint", url: "/mcp" })}\n\n`);
 });
 
+// #2425 djimit — streamable-HTTP session cleanup on the catch-all route.
+app.delete("/mcp", (_, res) => res.sendStatus(204));
+
 // ---------- GET /mcp-servers — returns MCP_SERVERS JSON for Chat UI config ----------
 app.get("/mcp-servers", (_, res) => {
   const servers = [];

package/src/mcp-bridge/test-runtime-security.mjs

@@ -135,6 +135,37 @@ async function testBridge(label, entry) {
       } catch (e) {
         assert(false, `R4. terminal_execute threw: ${e.message}`);
       }
+
+      // R6 — #2425 djimit streamable-HTTP session cleanup: DELETE /mcp → 204
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "DELETE",
+          headers: {
+            "Authorization": `Bearer ${TOKEN}`,
+            "Mcp-Session-Id": "test-cleanup",
+          },
+        });
+        assert(r.status === 204, `R6. DELETE /mcp → 204 (got ${r.status})`);
+        assert(!!r.headers.get("Mcp-Session-Id"), "R6b. Mcp-Session-Id header echoed on /mcp*");
+      } catch (e) {
+        assert(false, `R6. DELETE /mcp threw: ${e.message}`);
+      }
+
+      // R7 — #2425 notifications/initialized returns 202 Accepted with empty body
+      try {
+        const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${TOKEN}`,
+          },
+          body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+        });
+        assert(r.status === 202, `R7. notifications/initialized → 202 (got ${r.status})`);
+        assert((await r.text()) === "", "R7b. notifications/initialized has empty body");
+      } catch (e) {
+        assert(false, `R7. notifications/initialized threw: ${e.message}`);
+      }
     }
     await killAndWait(b.child);
   }

package/src/mcp-bridge/test-security-lock.js

@@ -58,6 +58,16 @@ const CHECKS = [
     rx: /MCP_CORS_ORIGIN[\s\S]*?CORS_ALLOWLIST/,
     hint: "CORS must respect MCP_CORS_ORIGIN allowlist (Phase 3b)",
   },
+  {
+    id: "7. streamable-http-delete-handler (#2425)",
+    rx: /app\.delete\(\s*["']\/mcp["']\s*,/,
+    hint: "DELETE /mcp must be handled for streamable-HTTP session cleanup (#2425)",
+  },
+  {
+    id: "8. mcp-session-id-header (#2425)",
+    rx: /Mcp-Session-Id/,
+    hint: "Mcp-Session-Id header must be echoed on /mcp* responses (#2425)",
+  },
 ];
 
 let hardFail = false;

package/src/ruvocal/mcp-bridge/index.js

@@ -1057,6 +1057,19 @@ const GROUP_DISPLAY_NAMES = {
 const app = express();
 app.use(express.json({ limit: "10mb" }));
 
+// ---------- MCP Streamable HTTP session (#2425 djimit) ----------
+// Streamable-HTTP clients (Codex/RMCP) send `DELETE /mcp` with an
+// `Mcp-Session-Id` header at shutdown. We echo a stable session id back
+// on every /mcp* response so those clients can attach it to the DELETE
+// and to `notifications/initialized` handshakes.
+const MCP_SESSION_ID = randomUUID();
+app.use((req, res, next) => {
+  if (req.path.startsWith("/mcp")) {
+    res.setHeader("Mcp-Session-Id", MCP_SESSION_ID);
+  }
+  next();
+});
+
 // ---------- CORS middleware (ADR-166 §6 Phase 3b) ----------
 // MCP_CORS_ORIGIN: comma-separated allowlist (e.g. "https://a.example,https://b.example").
 //   unset → "*" for back-compat (loopback default is same-origin anyway)
@@ -1074,8 +1087,8 @@ app.use((req, res, next) => {
     res.setHeader("Vary", "Origin");
   }
   // If no match, do NOT set the header — browser will block the request.
-  res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id");
   if (req.method === "OPTIONS") return res.sendStatus(204);
   next();
 });
@@ -1125,7 +1138,9 @@ function createMcpHandler(groupName) {
           });
         }
         case "notifications/initialized":
-          return res.json({ jsonrpc: "2.0", id, result: {} });
+          // MCP streamable-HTTP spec: notifications must return 202 Accepted
+          // with an empty body (no jsonrpc envelope).
+          return res.status(202).end();
         default:
           return res.json({ jsonrpc: "2.0", id, error: { code: -32601, message: `Method not found: ${method}` } });
       }
@@ -1149,6 +1164,8 @@ function createMcpSseHandler(groupName) {
 for (const groupName of Object.keys(TOOL_GROUPS)) {
   app.post(`/mcp/${groupName}`, createMcpHandler(groupName));
   app.get(`/mcp/${groupName}`, createMcpSseHandler(groupName));
+  // #2425 djimit — streamable-HTTP session cleanup
+  app.delete(`/mcp/${groupName}`, (_, res) => res.sendStatus(204));
 }
 
 // ---------- Catch-all /mcp — serves ALL enabled tools (backwards-compatible) ----------
@@ -1180,7 +1197,7 @@ app.post("/mcp", async (req, res) => {
         });
       }
       case "notifications/initialized":
-        return res.json({ jsonrpc: "2.0", id, result: {} });
+        return res.status(202).end();
       default:
         return res.json({ jsonrpc: "2.0", id, error: { code: -32601, message: `Method not found: ${method}` } });
     }
@@ -1197,6 +1214,9 @@ app.get("/mcp", (req, res) => {
   res.write(`data: ${JSON.stringify({ type: "endpoint", url: "/mcp" })}\n\n`);
 });
 
+// #2425 djimit — streamable-HTTP session cleanup on the catch-all route.
+app.delete("/mcp", (_, res) => res.sendStatus(204));
+
 // ---------- GET /mcp-servers — returns MCP_SERVERS JSON for Chat UI config ----------
 app.get("/mcp-servers", (_, res) => {
   const servers = [];