ruflo 3.42.1 → 3.42.3

package/bin/ruflo.js

@@ -1,77 +1,77 @@
-#!/usr/bin/env node
-// Ruflo CLI - thin wrapper around @claude-flow/cli with ruflo branding
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { dirname, resolve, join } from 'node:path';
-import { existsSync, readFileSync } from 'node:fs';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-// #2256 fast path: --version / -V must NOT trigger heavy imports (the
-// downstream @claude-flow/cli dist eagerly loads ruvector + a 23 MB ONNX
-// model on cold cache, blocking 60+ s and causing SIGTERM under common
-// timeout windows: npx default, MCP stdio 30s window). Resolve version
-// from this wrapper's own package.json and exit before any heavy import.
-// (bin/cli.js has the same guard for the direct path; needed here too
-// because the wrapper imports dist/src/index.js, bypassing bin/cli.js.)
-{
-  const _argv = process.argv.slice(2);
-  if (_argv.length === 1 && (_argv[0] === '--version' || _argv[0] === '-V')) {
-    try {
-      const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
-      process.stdout.write(`ruflo v${pkg.version || '0.0.0'}\n`);
-    } catch {
-      process.stdout.write('ruflo v0.0.0\n');
-    }
-    process.exit(0);
-  }
-}
-
-// Walk up from ruflo/bin/ to find @claude-flow/cli in node_modules
-function findCliPath() {
-  let dir = resolve(__dirname, '..');
-  for (let i = 0; i < 10; i++) {
-    const candidate = join(dir, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js');
-    if (existsSync(candidate)) return dir;
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
-// Convert path to file:// URL for cross-platform ESM import (Windows requires this)
-function toImportURL(filePath) {
-  return pathToFileURL(filePath).href;
-}
-
-const pkgDir = findCliPath();
-const cliBase = pkgDir
-  ? join(pkgDir, 'node_modules', '@claude-flow', 'cli')
-  : resolve(__dirname, '../../v3/@claude-flow/cli');
-
-// MCP mode: delegate to cli.js directly (branding irrelevant for JSON-RPC)
-const cliArgs = process.argv.slice(2);
-const isExplicitMCP = cliArgs.length >= 1 && cliArgs[0] === 'mcp' && (cliArgs.length === 1 || cliArgs[1] === 'start');
-const isMCPMode = !process.stdin.isTTY && (process.argv.length === 2 || isExplicitMCP);
-
-if (isMCPMode) {
-  await import(toImportURL(join(cliBase, 'bin', 'cli.js')));
-} else {
-  // CLI mode: use ruflo branding
-  const { CLI } = await import(toImportURL(join(cliBase, 'dist', 'src', 'index.js')));
-  const cli = new CLI({
-    name: 'ruflo',
-    description: 'Ruflo - AI Agent Orchestration Platform',
-  });
-  cli.run()
-    .then(() => {
-      // #1641/#1653: Exit cleanly after one-shot commands.
-      // HNSW VectorDb, sql.js WASM, and ONNX worker threads keep the
-      // event loop alive after the command handler returns.
-      process.exit(0);
-    })
-    .catch((error) => {
-      console.error('Fatal error:', error.message);
-      process.exit(1);
-    });
-}
+#!/usr/bin/env node
+// Ruflo CLI - thin wrapper around @claude-flow/cli with ruflo branding
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { dirname, resolve, join } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// #2256 fast path: --version / -V must NOT trigger heavy imports (the
+// downstream @claude-flow/cli dist eagerly loads ruvector + a 23 MB ONNX
+// model on cold cache, blocking 60+ s and causing SIGTERM under common
+// timeout windows: npx default, MCP stdio 30s window). Resolve version
+// from this wrapper's own package.json and exit before any heavy import.
+// (bin/cli.js has the same guard for the direct path; needed here too
+// because the wrapper imports dist/src/index.js, bypassing bin/cli.js.)
+{
+  const _argv = process.argv.slice(2);
+  if (_argv.length === 1 && (_argv[0] === '--version' || _argv[0] === '-V')) {
+    try {
+      const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
+      process.stdout.write(`ruflo v${pkg.version || '0.0.0'}\n`);
+    } catch {
+      process.stdout.write('ruflo v0.0.0\n');
+    }
+    process.exit(0);
+  }
+}
+
+// Walk up from ruflo/bin/ to find @claude-flow/cli in node_modules
+function findCliPath() {
+  let dir = resolve(__dirname, '..');
+  for (let i = 0; i < 10; i++) {
+    const candidate = join(dir, 'node_modules', '@claude-flow', 'cli', 'bin', 'cli.js');
+    if (existsSync(candidate)) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+// Convert path to file:// URL for cross-platform ESM import (Windows requires this)
+function toImportURL(filePath) {
+  return pathToFileURL(filePath).href;
+}
+
+const pkgDir = findCliPath();
+const cliBase = pkgDir
+  ? join(pkgDir, 'node_modules', '@claude-flow', 'cli')
+  : resolve(__dirname, '../../v3/@claude-flow/cli');
+
+// MCP mode: delegate to cli.js directly (branding irrelevant for JSON-RPC)
+const cliArgs = process.argv.slice(2);
+const isExplicitMCP = cliArgs.length >= 1 && cliArgs[0] === 'mcp' && (cliArgs.length === 1 || cliArgs[1] === 'start');
+const isMCPMode = !process.stdin.isTTY && (process.argv.length === 2 || isExplicitMCP);
+
+if (isMCPMode) {
+  await import(toImportURL(join(cliBase, 'bin', 'cli.js')));
+} else {
+  // CLI mode: use ruflo branding
+  const { CLI } = await import(toImportURL(join(cliBase, 'dist', 'src', 'index.js')));
+  const cli = new CLI({
+    name: 'ruflo',
+    description: 'Ruflo - AI Agent Orchestration Platform',
+  });
+  cli.run()
+    .then(() => {
+      // #1641/#1653: Exit cleanly after one-shot commands.
+      // HNSW VectorDb, sql.js WASM, and ONNX worker threads keep the
+      // event loop alive after the command handler returns.
+      process.exit(0);
+    })
+    .catch((error) => {
+      console.error('Fatal error:', error.message);
+      process.exit(1);
+    });
+}

package/package.json

@@ -1,117 +1,117 @@
-{
-  "name": "ruflo",
-  "version": "3.42.1",
-  "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
-  "main": "bin/ruflo.js",
-  "type": "module",
-  "bin": {
-    "ruflo": "bin/ruflo.js"
-  },
-  "homepage": "https://github.com/ruvnet/claude-flow#readme",
-  "bugs": {
-    "url": "https://github.com/ruvnet/claude-flow/issues",
-    "email": "support@ruv.io"
-  },
-  "funding": {
-    "type": "github",
-    "url": "https://github.com/sponsors/ruvnet"
-  },
-  "files": [
-    "bin/**",
-    "src/**",
-    "dist/**",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "prepublishOnly": "node scripts/prepare-publish.mjs",
-    "dev": "node src/mcp-bridge/index.js",
-    "dev:bridge": "node --watch src/mcp-bridge/index.js",
-    "dev:test": "node src/mcp-bridge/test-harness.js",
-    "start": "node src/mcp-bridge/index.js",
-    "docker:up": "docker compose up -d",
-    "docker:down": "docker compose down",
-    "docker:build": "docker compose build",
-    "docker:logs": "docker compose logs -f",
-    "install:bridge": "cd src/mcp-bridge && npm install",
-    "generate:config": "node src/scripts/generate-config.js",
-    "generate:welcome": "node src/scripts/generate-welcome.js",
-    "deploy": "bash src/scripts/deploy.sh",
-    "package:rvf": "bash src/scripts/package-rvf.sh"
-  },
-  "dependencies": {
-    "@claude-flow/cli": "^3.33.0"
-  },
-  "optionalDependencies": {},
-  "overrides": {
-    "ruvector": "^0.2.27",
-    "better-sqlite3": "12.9.0",
-    "@ruvector/rvf-wasm": "0.1.5",
-    "@hono/node-server": ">=1.19.10",
-    "flatted": ">=3.4.0",
-    "tar": ">=7.5.11",
-    "picomatch": ">=4.0.3",
-    "path-to-regexp": ">=8.2.1",
-    "undici": ">=7.18.0",
-    "minimatch": ">=10.0.0",
-    "@isaacs/brace-expansion": ">=5.0.1",
-    "cacache": ">=20.0.0",
-    "make-fetch-happen": ">=15.0.0",
-    "express-rate-limit": ">=8.4.1",
-    "protobufjs": ">=7.5.6",
-    "uuid": ">=14.0.0",
-    "@opentelemetry/core": ">=2.8.0",
-    "@opentelemetry/resources": ">=2.8.0",
-    "@opentelemetry/sdk-trace-base": ">=2.8.0",
-    "@opentelemetry/sdk-node": ">=0.220.0",
-    "@opentelemetry/auto-instrumentations-node": ">=0.75.0",
-    "@opentelemetry/exporter-prometheus": ">=0.220.0",
-    "@opentelemetry/exporter-trace-otlp-grpc": ">=0.220.0",
-    "@opentelemetry/exporter-trace-otlp-http": ">=0.220.0",
-    "@opentelemetry/exporter-trace-otlp-proto": ">=0.220.0",
-    "@opentelemetry/otlp-exporter-base": ">=0.220.0",
-    "@opentelemetry/otlp-grpc-exporter-base": ">=0.220.0",
-    "@opentelemetry/otlp-transformer": ">=0.220.0",
-    "agentdb": ">=3.0.0-alpha.17",
-    "agentic-flow": ">=2.0.14",
-    "@ruvector/ruvllm": ">=2.6.0",
-    "fast-uri": ">=3.1.6"
-  },
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/ruvnet/claude-flow.git",
-    "directory": "ruflo"
-  },
-  "keywords": [
-    "ruflo",
-    "claude-flow",
-    "claude",
-    "claude-code",
-    "anthropic",
-    "ai",
-    "ai-agents",
-    "multi-agent",
-    "agent-orchestration",
-    "swarm-intelligence",
-    "swarm",
-    "mcp",
-    "model-context-protocol",
-    "cli",
-    "developer-tools",
-    "enterprise",
-    "self-learning"
-  ],
-  "author": {
-    "name": "RuvNet",
-    "email": "ruv@ruv.io",
-    "url": "https://ruv.io"
-  },
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public",
-    "tag": "latest"
-  }
-}
+{
+  "name": "ruflo",
+  "version": "3.42.3",
+  "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
+  "main": "bin/ruflo.js",
+  "type": "module",
+  "bin": {
+    "ruflo": "bin/ruflo.js"
+  },
+  "homepage": "https://github.com/ruvnet/claude-flow#readme",
+  "bugs": {
+    "url": "https://github.com/ruvnet/claude-flow/issues",
+    "email": "support@ruv.io"
+  },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/ruvnet"
+  },
+  "files": [
+    "bin/**",
+    "src/**",
+    "dist/**",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "prepublishOnly": "node scripts/prepare-publish.mjs",
+    "dev": "node src/mcp-bridge/index.js",
+    "dev:bridge": "node --watch src/mcp-bridge/index.js",
+    "dev:test": "node src/mcp-bridge/test-harness.js",
+    "start": "node src/mcp-bridge/index.js",
+    "docker:up": "docker compose up -d",
+    "docker:down": "docker compose down",
+    "docker:build": "docker compose build",
+    "docker:logs": "docker compose logs -f",
+    "install:bridge": "cd src/mcp-bridge && npm install",
+    "generate:config": "node src/scripts/generate-config.js",
+    "generate:welcome": "node src/scripts/generate-welcome.js",
+    "deploy": "bash src/scripts/deploy.sh",
+    "package:rvf": "bash src/scripts/package-rvf.sh"
+  },
+  "dependencies": {
+    "@claude-flow/cli": "^3.33.0"
+  },
+  "optionalDependencies": {},
+  "overrides": {
+    "ruvector": "^0.2.27",
+    "better-sqlite3": "12.9.0",
+    "@ruvector/rvf-wasm": "0.1.5",
+    "@hono/node-server": ">=1.19.10",
+    "flatted": ">=3.4.0",
+    "tar": ">=7.5.11",
+    "picomatch": ">=4.0.3",
+    "path-to-regexp": ">=8.2.1",
+    "undici": ">=7.18.0",
+    "minimatch": ">=10.0.0",
+    "@isaacs/brace-expansion": ">=5.0.1",
+    "cacache": ">=20.0.0",
+    "make-fetch-happen": ">=15.0.0",
+    "express-rate-limit": ">=8.4.1",
+    "protobufjs": ">=7.5.6",
+    "uuid": ">=14.0.0",
+    "@opentelemetry/core": ">=2.8.0",
+    "@opentelemetry/resources": ">=2.8.0",
+    "@opentelemetry/sdk-trace-base": ">=2.8.0",
+    "@opentelemetry/sdk-node": ">=0.220.0",
+    "@opentelemetry/auto-instrumentations-node": ">=0.75.0",
+    "@opentelemetry/exporter-prometheus": ">=0.220.0",
+    "@opentelemetry/exporter-trace-otlp-grpc": ">=0.220.0",
+    "@opentelemetry/exporter-trace-otlp-http": ">=0.220.0",
+    "@opentelemetry/exporter-trace-otlp-proto": ">=0.220.0",
+    "@opentelemetry/otlp-exporter-base": ">=0.220.0",
+    "@opentelemetry/otlp-grpc-exporter-base": ">=0.220.0",
+    "@opentelemetry/otlp-transformer": ">=0.220.0",
+    "agentdb": ">=3.0.0-alpha.17",
+    "agentic-flow": ">=2.0.14",
+    "@ruvector/ruvllm": ">=2.6.0",
+    "fast-uri": ">=3.1.6"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ruvnet/claude-flow.git",
+    "directory": "ruflo"
+  },
+  "keywords": [
+    "ruflo",
+    "claude-flow",
+    "claude",
+    "claude-code",
+    "anthropic",
+    "ai",
+    "ai-agents",
+    "multi-agent",
+    "agent-orchestration",
+    "swarm-intelligence",
+    "swarm",
+    "mcp",
+    "model-context-protocol",
+    "cli",
+    "developer-tools",
+    "enterprise",
+    "self-learning"
+  ],
+  "author": {
+    "name": "RuvNet",
+    "email": "ruv@ruv.io",
+    "url": "https://ruv.io"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  }
+}

package/src/chat-ui/Dockerfile

@@ -1,25 +1,25 @@
-FROM ghcr.io/huggingface/chat-ui-db:latest
-
-# Switch to root for patching and file operations
-USER root
-
-# Bake .env.local with MODELS config (too large for Cloud Run env vars)
-COPY dotenv-local.txt /app/.env.local
-
-# RVF Security Patch — allow private Docker network MCP connections.
-# HF Chat UI enforces HTTPS for MCP URLs (SSRF protection).
-# In containerized deployments, MCP bridge runs on private Docker network.
-# This patch allows HTTP for admin-configured MCP_SERVERS only.
-COPY patch-mcp-url-safety.sh /tmp/patch-mcp-url-safety.sh
-RUN sh /tmp/patch-mcp-url-safety.sh && rm /tmp/patch-mcp-url-safety.sh
-
-# Copy branded welcome GIF into the SvelteKit static asset directory.
-COPY static/chatui/omni-welcome.gif /app/build/client/chatui/omni-welcome.gif
-COPY static/chatui/omni-welcome.gif /app/static/chatui/omni-welcome.gif
-
-# Copy PWA icon (fixes 404 for /chat/chatui/icon-144x144.png)
-COPY static/chatui/icon-144x144.png /app/build/client/chatui/icon-144x144.png
-COPY static/chatui/icon-144x144.png /app/static/chatui/icon-144x144.png
-
-# Switch back to non-root user
-USER 1000
+FROM ghcr.io/huggingface/chat-ui-db:latest
+
+# Switch to root for patching and file operations
+USER root
+
+# Bake .env.local with MODELS config (too large for Cloud Run env vars)
+COPY dotenv-local.txt /app/.env.local
+
+# RVF Security Patch — allow private Docker network MCP connections.
+# HF Chat UI enforces HTTPS for MCP URLs (SSRF protection).
+# In containerized deployments, MCP bridge runs on private Docker network.
+# This patch allows HTTP for admin-configured MCP_SERVERS only.
+COPY patch-mcp-url-safety.sh /tmp/patch-mcp-url-safety.sh
+RUN sh /tmp/patch-mcp-url-safety.sh && rm /tmp/patch-mcp-url-safety.sh
+
+# Copy branded welcome GIF into the SvelteKit static asset directory.
+COPY static/chatui/omni-welcome.gif /app/build/client/chatui/omni-welcome.gif
+COPY static/chatui/omni-welcome.gif /app/static/chatui/omni-welcome.gif
+
+# Copy PWA icon (fixes 404 for /chat/chatui/icon-144x144.png)
+COPY static/chatui/icon-144x144.png /app/build/client/chatui/icon-144x144.png
+COPY static/chatui/icon-144x144.png /app/static/chatui/icon-144x144.png
+
+# Switch back to non-root user
+USER 1000

package/src/chat-ui/patch-mcp-url-safety.sh

@@ -1,28 +1,28 @@
-#!/bin/sh
-# RVF Security Patch — Allow private network MCP connections
-#
-# HF Chat UI enforces HTTPS-only for MCP server URLs to prevent SSRF.
-# In containerized deployments, MCP servers run on the private Docker
-# network (not exposed to the internet). This patch allows HTTP for
-# admin-configured MCP_SERVERS URLs while maintaining SSRF protection
-# for user-provided URLs.
-#
-# Security model:
-#   - MCP_SERVERS is set by the deployment admin (env var / .env.local)
-#   - Private Docker network is not accessible from the internet
-#   - The patch only relaxes protocol check, not IP safety checks
-
-URLSAFETY_FILE=$(find /app/build/server -name "urlSafety-*.js" | head -1)
-
-if [ -z "$URLSAFETY_FILE" ]; then
-  echo "[rvf-patch] urlSafety file not found, skipping"
-  exit 0
-fi
-
-# Allow http: protocol in addition to https:
-sed -i 's/if (url\.protocol !== "https:")/if (url.protocol !== "https:" \&\& url.protocol !== "http:")/' "$URLSAFETY_FILE"
-
-# Allow localhost for container-internal MCP servers
-sed -i 's/if (hostname === "localhost")/if (false \&\& hostname === "localhost")/' "$URLSAFETY_FILE"
-
-echo "[rvf-patch] Patched $URLSAFETY_FILE for private network MCP"
+#!/bin/sh
+# RVF Security Patch — Allow private network MCP connections
+#
+# HF Chat UI enforces HTTPS-only for MCP server URLs to prevent SSRF.
+# In containerized deployments, MCP servers run on the private Docker
+# network (not exposed to the internet). This patch allows HTTP for
+# admin-configured MCP_SERVERS URLs while maintaining SSRF protection
+# for user-provided URLs.
+#
+# Security model:
+#   - MCP_SERVERS is set by the deployment admin (env var / .env.local)
+#   - Private Docker network is not accessible from the internet
+#   - The patch only relaxes protocol check, not IP safety checks
+
+URLSAFETY_FILE=$(find /app/build/server -name "urlSafety-*.js" | head -1)
+
+if [ -z "$URLSAFETY_FILE" ]; then
+  echo "[rvf-patch] urlSafety file not found, skipping"
+  exit 0
+fi
+
+# Allow http: protocol in addition to https:
+sed -i 's/if (url\.protocol !== "https:")/if (url.protocol !== "https:" \&\& url.protocol !== "http:")/' "$URLSAFETY_FILE"
+
+# Allow localhost for container-internal MCP servers
+sed -i 's/if (hostname === "localhost")/if (false \&\& hostname === "localhost")/' "$URLSAFETY_FILE"
+
+echo "[rvf-patch] Patched $URLSAFETY_FILE for private network MCP"