ruflo 3.57.0 → 3.57.2

package/README.md

@@ -10,10 +10,11 @@
 [![Star on GitHub](https://img.shields.io/github/stars/ruvnet/claude-flow?style=for-the-badge&logo=github&color=gold)](https://github.com/ruvnet/claude-flow)
 
 <p align="center">
-<a href="data/npm-downloads.latest.json"><img src="docs/assets/readme/badges/downloads.svg?v=mobile-readable-3" width="300" alt="Ecosystem npm downloads: 12.52M over 12 months through October 4, 2026"></a>
+<a href="docs/harness-origins.md"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/e69e4b95aa08d65ea0f7715489bbf8e62a83a0d2/docs/assets/readme/badges/first-commit.svg" width="300" height="76" alt="Claude Flow lineage: first commit June 2, 2025 by rUv; inspect the evidence"></a>
+<a href="data/npm-downloads.latest.json"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/275aff65a198af758923669acff36f03d1f41623/docs/assets/readme/badges/downloads.svg" width="300" height="76" alt="Illustrative download counter starts at 98,000,000 and adds varied amounts each second in a 30 second loop. Verified dataset: 97,022,120 download events."></a>
 <br>
-<a href="https://github.com/ruvnet/claude-flow"><img src="docs/assets/readme/badges/claude.svg?v=mobile-readable-3" width="300" alt="Claude Code"></a>
-<a href="https://www.npmjs.com/package/@claude-flow/codex"><img src="docs/assets/readme/badges/codex.svg?v=mobile-readable-3" width="300" alt="Codex Plugin"></a>
+<a href="https://github.com/ruvnet/claude-flow"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/d1e80400bdefe01d3b13e70395f88fffab76bb18/docs/assets/readme/badges/claude.svg" width="300" height="76" alt="Claude Code plugin"></a>
+<a href="https://www.npmjs.com/package/@claude-flow/codex"><img src="https://raw.githubusercontent.com/ruvnet/ruflo/d1e80400bdefe01d3b13e70395f88fffab76bb18/docs/assets/readme/badges/codex.svg" width="300" height="76" alt="Codex plugin"></a>
 </p>
 
 </div>
@@ -109,6 +110,14 @@ User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM prov
 
 > **New to Ruflo?** You don't need to learn 314 MCP tools or 26 CLI commands. After `init`, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
 
+### An origin you can inspect
+
+[![Claude Flow to Ruflo: founding idea on June 2, 2025, orchestration source on June 10, and the continuing Ruflo lineage.](docs/assets/readme/harness-origins.svg)](docs/harness-origins.md)
+
+**Built by [Reuven Cohen (rUv)](https://github.com/ruvnet), originally as Claude Flow.** The [first commit, June 2, 2025](https://github.com/ruvnet/ruflo/commit/7c1f9402d70e7af56c01a879073cbac92564dc4e), describes a code orchestration layer for recursive agent cycles: Claude writes, edits, tests and improves. The [June 10 source snapshot](https://github.com/ruvnet/ruflo/tree/dba545f012ea92a2375a26332bbf3797495e93c9) adds orchestration, task scheduling, memory and terminal modules.
+
+A harness is the workbench around the model: it organizes tasks, carries context between steps and helps check results. **This establishes Ruflo's lineage, not a universal first across every Claude Code tool.** [See the illustrated explainer, exact commits and earlier ecosystem context](docs/harness-origins.md).
+
 <details>
 <summary><strong>📖 Background — where the name comes from</strong></summary>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruflo",
-  "version": "3.57.0",
+  "version": "3.57.2",
   "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "bin/ruflo.js",
   "type": "module",
@@ -40,13 +40,14 @@
     "package:rvf": "bash src/scripts/package-rvf.sh"
   },
   "dependencies": {
-    "@claude-flow/cli": "3.57.0"
+    "@claude-flow/cli": "3.57.2"
   },
   "optionalDependencies": {},
   "overrides": {
     "ruvector": "^0.2.27",
     "better-sqlite3": "12.9.0",
     "@ruvector/rvf-wasm": "0.1.5",
+    "@ruvector/rvf": "0.3.4",
     "@hono/node-server": ">=1.19.10",
     "flatted": ">=3.4.0",
     "tar": ">=7.5.11",

package/src/ruvocal/src/lib/server/textGeneration/mcp/mergeServers.spec.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from "vitest";
+import { mergeMcpServers } from "./mergeServers";
+
+const base = [
+	{
+		name: "GitHub",
+		url: "https://api.githubcopilot.com/mcp/readonly",
+		headers: { Authorization: "Bearer server-token" },
+	},
+	{ name: "Docs", url: "https://docs.example/mcp" },
+];
+
+describe("mergeMcpServers", () => {
+	it("keeps a base server's credentials when the browser echoes it back without headers", () => {
+		const merged = mergeMcpServers(base, [
+			{ name: "GitHub", url: "https://api.githubcopilot.com/mcp/readonly" },
+		]);
+		expect(merged.find((s) => s.name === "GitHub")?.headers).toEqual({
+			Authorization: "Bearer server-token",
+		});
+	});
+
+	it("treats an empty headers object like no headers", () => {
+		const merged = mergeMcpServers(base, [
+			{ name: "GitHub", url: "https://api.githubcopilot.com/mcp/readonly", headers: {} },
+		]);
+		expect(merged.find((s) => s.name === "GitHub")?.headers?.Authorization).toBe(
+			"Bearer server-token"
+		);
+	});
+
+	it("lets request-supplied headers win", () => {
+		const merged = mergeMcpServers(base, [
+			{
+				name: "GitHub",
+				url: "https://api.githubcopilot.com/mcp/readonly",
+				headers: { Authorization: "Bearer user-token" },
+			},
+		]);
+		expect(merged.find((s) => s.name === "GitHub")?.headers).toEqual({
+			Authorization: "Bearer user-token",
+		});
+	});
+
+	it("never sends a base server's credentials to a different URL", () => {
+		const merged = mergeMcpServers(base, [{ name: "GitHub", url: "https://evil.example/mcp" }]);
+		expect(merged.find((s) => s.name === "GitHub")?.headers).toBeUndefined();
+	});
+
+	it("adds new request-only servers and keeps unrelated base servers", () => {
+		const merged = mergeMcpServers(base, [{ name: "Mine", url: "https://mine.example/mcp" }]);
+		expect(merged.map((s) => s.name)).toEqual(["GitHub", "Docs", "Mine"]);
+	});
+});

package/src/ruvocal/src/lib/server/textGeneration/mcp/mergeServers.ts

@@ -0,0 +1,31 @@
+export type McpServerEntry = { name: string; url: string; headers?: Record<string, string> };
+
+/**
+ * Merge request-provided MCP servers over the env-configured base servers, by name.
+ *
+ * The request wins, but `/api/mcp/servers` deliberately withholds base-server headers
+ * from the browser, so the copy the client echoes back has none. Replacing the base
+ * entry wholesale would drop its server-side credentials (e.g. `Authorization`), and
+ * every tool listing from the chat UI would then fail with 401 (#2901).
+ *
+ * So a request entry that carries no headers of its own keeps the base entry's
+ * headers, but only when it points at the same URL: a request must not be able to
+ * redirect a server-side token to another host by reusing a base server's name.
+ */
+export function mergeMcpServers(
+	base: McpServerEntry[],
+	custom: McpServerEntry[]
+): McpServerEntry[] {
+	const byName = new Map<string, McpServerEntry>();
+	for (const s of base) byName.set(s.name, s);
+	for (const s of custom) {
+		const existing = byName.get(s.name);
+		const hasOwnHeaders = !!s.headers && Object.keys(s.headers).length > 0;
+		if (!hasOwnHeaders && existing?.headers && existing.url === s.url) {
+			byName.set(s.name, { ...s, headers: existing.headers });
+		} else {
+			byName.set(s.name, s);
+		}
+	}
+	return [...byName.values()];
+}

package/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts

@@ -1,4 +1,5 @@
 import { config } from "$lib/server/config";
+import { mergeMcpServers } from "./mergeServers";
 import { MessageUpdateType, type MessageUpdate } from "$lib/types/MessageUpdate";
 import { getMcpServers } from "$lib/server/mcp/registry";
 import { isValidUrl } from "$lib/server/urlSafety";
@@ -98,13 +99,7 @@ export async function* runMcpFlow({
 			// Invalidate cached tool list when the set of servers changes at request-time
 			resetMcpToolsCache();
 			// Deduplicate by server name (request takes precedence)
-			const byName = new Map<
-				string,
-				{ name: string; url: string; headers?: Record<string, string> }
-			>();
-			for (const s of servers) byName.set(s.name, s);
-			for (const s of custom) byName.set(s.name, s);
-			servers = [...byName.values()];
+			servers = mergeMcpServers(servers, custom);
 			try {
 				logger.debug(
 					{