ruflo 3.57.1 → 3.58.0

package/README.md

@@ -240,6 +240,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
 | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
 | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
+| [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.10/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
 
 #### Security & Compliance
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruflo",
-  "version": "3.57.1",
+  "version": "3.58.0",
   "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "bin/ruflo.js",
   "type": "module",
@@ -40,13 +40,14 @@
     "package:rvf": "bash src/scripts/package-rvf.sh"
   },
   "dependencies": {
-    "@claude-flow/cli": "3.57.1"
+    "@claude-flow/cli": "3.58.0"
   },
   "optionalDependencies": {},
   "overrides": {
     "ruvector": "^0.2.27",
     "better-sqlite3": "12.9.0",
     "@ruvector/rvf-wasm": "0.1.5",
+    "@ruvector/rvf": "0.3.4",
     "@hono/node-server": ">=1.19.10",
     "flatted": ">=3.4.0",
     "tar": ">=7.5.11",

package/src/ruvocal/src/lib/server/textGeneration/mcp/mergeServers.spec.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from "vitest";
+import { mergeMcpServers } from "./mergeServers";
+
+const base = [
+	{
+		name: "GitHub",
+		url: "https://api.githubcopilot.com/mcp/readonly",
+		headers: { Authorization: "Bearer server-token" },
+	},
+	{ name: "Docs", url: "https://docs.example/mcp" },
+];
+
+describe("mergeMcpServers", () => {
+	it("keeps a base server's credentials when the browser echoes it back without headers", () => {
+		const merged = mergeMcpServers(base, [
+			{ name: "GitHub", url: "https://api.githubcopilot.com/mcp/readonly" },
+		]);
+		expect(merged.find((s) => s.name === "GitHub")?.headers).toEqual({
+			Authorization: "Bearer server-token",
+		});
+	});
+
+	it("treats an empty headers object like no headers", () => {
+		const merged = mergeMcpServers(base, [
+			{ name: "GitHub", url: "https://api.githubcopilot.com/mcp/readonly", headers: {} },
+		]);
+		expect(merged.find((s) => s.name === "GitHub")?.headers?.Authorization).toBe(
+			"Bearer server-token"
+		);
+	});
+
+	it("lets request-supplied headers win", () => {
+		const merged = mergeMcpServers(base, [
+			{
+				name: "GitHub",
+				url: "https://api.githubcopilot.com/mcp/readonly",
+				headers: { Authorization: "Bearer user-token" },
+			},
+		]);
+		expect(merged.find((s) => s.name === "GitHub")?.headers).toEqual({
+			Authorization: "Bearer user-token",
+		});
+	});
+
+	it("never sends a base server's credentials to a different URL", () => {
+		const merged = mergeMcpServers(base, [{ name: "GitHub", url: "https://evil.example/mcp" }]);
+		expect(merged.find((s) => s.name === "GitHub")?.headers).toBeUndefined();
+	});
+
+	it("adds new request-only servers and keeps unrelated base servers", () => {
+		const merged = mergeMcpServers(base, [{ name: "Mine", url: "https://mine.example/mcp" }]);
+		expect(merged.map((s) => s.name)).toEqual(["GitHub", "Docs", "Mine"]);
+	});
+});

package/src/ruvocal/src/lib/server/textGeneration/mcp/mergeServers.ts

@@ -0,0 +1,31 @@
+export type McpServerEntry = { name: string; url: string; headers?: Record<string, string> };
+
+/**
+ * Merge request-provided MCP servers over the env-configured base servers, by name.
+ *
+ * The request wins, but `/api/mcp/servers` deliberately withholds base-server headers
+ * from the browser, so the copy the client echoes back has none. Replacing the base
+ * entry wholesale would drop its server-side credentials (e.g. `Authorization`), and
+ * every tool listing from the chat UI would then fail with 401 (#2901).
+ *
+ * So a request entry that carries no headers of its own keeps the base entry's
+ * headers, but only when it points at the same URL: a request must not be able to
+ * redirect a server-side token to another host by reusing a base server's name.
+ */
+export function mergeMcpServers(
+	base: McpServerEntry[],
+	custom: McpServerEntry[]
+): McpServerEntry[] {
+	const byName = new Map<string, McpServerEntry>();
+	for (const s of base) byName.set(s.name, s);
+	for (const s of custom) {
+		const existing = byName.get(s.name);
+		const hasOwnHeaders = !!s.headers && Object.keys(s.headers).length > 0;
+		if (!hasOwnHeaders && existing?.headers && existing.url === s.url) {
+			byName.set(s.name, { ...s, headers: existing.headers });
+		} else {
+			byName.set(s.name, s);
+		}
+	}
+	return [...byName.values()];
+}

package/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts

@@ -1,4 +1,5 @@
 import { config } from "$lib/server/config";
+import { mergeMcpServers } from "./mergeServers";
 import { MessageUpdateType, type MessageUpdate } from "$lib/types/MessageUpdate";
 import { getMcpServers } from "$lib/server/mcp/registry";
 import { isValidUrl } from "$lib/server/urlSafety";
@@ -98,13 +99,7 @@ export async function* runMcpFlow({
 			// Invalidate cached tool list when the set of servers changes at request-time
 			resetMcpToolsCache();
 			// Deduplicate by server name (request takes precedence)
-			const byName = new Map<
-				string,
-				{ name: string; url: string; headers?: Record<string, string> }
-			>();
-			for (const s of servers) byName.set(s.name, s);
-			for (const s of custom) byName.set(s.name, s);
-			servers = [...byName.values()];
+			servers = mergeMcpServers(servers, custom);
 			try {
 				logger.debug(
 					{