ruflo 3.71.2 → 3.71.4

package/README.md

@@ -36,6 +36,8 @@
 /ruflo
 ```
 
+From a terminal on Claude Code 2.1.292 or later, one command adds the marketplace and installs a plugin: `claude plugin install ruflo-core@ruflo --marketplace ruvnet/ruflo`.
+
 **Core** provides foundation tools. **Console** opens the agent cockpit. **Mods** add routing and policy enforcement inside Claude Code. Mods run with your account's permissions; review their code before installing.
 
 <img src="docs/assets/readme/icons/terminal.svg" width="28" height="28" alt=""> **Using Codex or another MCP enabled tool?** Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server. Run the setup wizard in your project terminal:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruflo",
-  "version": "3.71.2",
+  "version": "3.71.4",
   "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "bin/ruflo.js",
   "type": "module",
@@ -40,7 +40,7 @@
     "package:rvf": "bash src/scripts/package-rvf.sh"
   },
   "dependencies": {
-    "@claude-flow/cli": "3.71.2"
+    "@claude-flow/cli": "3.71.4"
   },
   "optionalDependencies": {},
   "overrides": {

package/src/mcp-bridge/test-local-browser-guard.mjs

@@ -11,6 +11,8 @@
  *   G6. an Origin listed in MCP_CORS_ORIGIN is still accepted
  *   G7. with MCP_AUTH_TOKEN set the guard is off and bearer auth decides
  *
+ * Runs against both bridges (src/mcp-bridge and src/ruvocal/mcp-bridge).
+ *
  *   node test-local-browser-guard.mjs
  */
 import { spawn } from "node:child_process";
@@ -19,7 +21,13 @@ import path from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 
-const ENTRY = path.join(path.dirname(fileURLToPath(import.meta.url)), "index.js");
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+// Both bridges carry the same guard; ruvocal's copy missed #4226 until it was ported.
+const ENTRIES = [
+  { label: "src/mcp-bridge", entry: path.join(HERE, "index.js") },
+  { label: "src/ruvocal/mcp-bridge", entry: path.join(HERE, "..", "ruvocal", "mcp-bridge", "index.js") },
+];
+let ENTRY = ENTRIES[0].entry;
 const QUIET = {
   MCP_GROUP_INTELLIGENCE: "false",
   MCP_GROUP_AGENTS: "false",
@@ -64,6 +72,9 @@ function request(port, { method = "POST", path: p = "/mcp", headers = {}, body }
 const initialize = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} });
 const json = { "Content-Type": "application/json" };
 
+for (const { label, entry } of ENTRIES) {
+ENTRY = entry;
+console.log(`\n[${label}]`);
 console.log("local-only mode (no MCP_AUTH_TOKEN)");
 await withBridge({ MCP_CORS_ORIGIN: "" }, async (port) => {
   check((await request(port, { headers: json, body: initialize })).status === 200, "G1 native client reaches /mcp");
@@ -82,6 +93,7 @@ await withBridge({ MCP_AUTH_TOKEN: "t0ken" }, async (port) => {
   const res = await request(port, { headers: { ...json, Origin: "https://example.com", Authorization: "Bearer t0ken" }, body: initialize });
   check(res.status === 200, "G7 bearer token decides when set");
 });
+}
 
 console.log(failed ? `\n${failed} check(s) failed` : "\nall checks passed");
 process.exit(failed ? 1 : 0);

package/src/ruvocal/mcp-bridge/index.js

@@ -1069,6 +1069,7 @@ app.use((req, res, next) => {
 const CORS_ALLOWLIST = (process.env.MCP_CORS_ORIGIN || "*")
   .split(",").map(s => s.trim()).filter(Boolean);
 const CORS_WILDCARD = CORS_ALLOWLIST.length === 1 && CORS_ALLOWLIST[0] === "*";
+app.use((req, res, next) => localBrowserGuard(req, res, next));
 app.use((req, res, next) => {
   const origin = req.get("origin") || "";
   if (CORS_WILDCARD) {
@@ -1087,6 +1088,43 @@ app.use((req, res, next) => {
 // ---------- Auth middleware ----------
 // No-op in local-only mode (MCP_AUTH_TOKEN unset). Enforces 401 when token is set.
 const MCP_TOKEN = process.env.MCP_AUTH_TOKEN || "";
+
+// ---------- Local-only browser guard (#4226; same guard as ruflo/src/mcp-bridge) ----------
+// Binding to loopback does not keep web pages out: any page the user opens
+// can send requests to 127.0.0.1, and a DNS-rebinding page can even make the
+// request look same-origin. CORS only decides whether the page may READ the
+// reply; a "simple" cross-origin POST runs without a preflight. So when there
+// is no MCP_AUTH_TOKEN, refuse requests that a browser sent on behalf of a
+// foreign page:
+//   - the Host header must name a loopback address (stops DNS rebinding);
+//   - a request carrying an Origin header must come from a loopback origin or
+//     from an origin listed explicitly in MCP_CORS_ORIGIN.
+// Native MCP clients (CLI, IDE, curl) send no Origin and a loopback Host.
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function hostnameOf(value) {
+  try {
+    return new URL(value.includes("://") ? value : `http://${value}`).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function isLoopbackHostname(hostname) {
+  return LOOPBACK_HOSTNAMES.has(hostname) || hostname.endsWith(".localhost");
+}
+function localBrowserGuard(req, res, next) {
+  if (MCP_TOKEN) return next();
+  if (!isLoopbackHostname(hostnameOf(req.get("host") || ""))) {
+    return res.status(403).json({ error: "forbidden host" });
+  }
+  const origin = req.get("origin");
+  if (origin !== undefined) {
+    const explicitlyAllowed = !CORS_WILDCARD && CORS_ALLOWLIST.includes(origin);
+    if (!explicitlyAllowed && !isLoopbackHostname(hostnameOf(origin))) {
+      return res.status(403).json({ error: "forbidden origin" });
+    }
+  }
+  next();
+}
 function requireAuth(req, res, next) {
   if (req.path === "/health") return next();
   if (!MCP_TOKEN) return next();

package/src/ruvocal/src/lib/server/mcp/serverTrust.ts

@@ -0,0 +1,25 @@
+import { isValidUrl, ssrfSafeFetch } from "$lib/server/urlSafety";
+import { getMcpServers } from "./registry";
+
+/**
+ * An MCP server URL the operator configured (MCP_SERVERS). Only these may use
+ * loopback, Docker-internal or other private addresses; a URL supplied in a
+ * request — including by an anonymous chat session — must be public.
+ */
+export function isConfiguredMcpUrl(url: string): boolean {
+	return getMcpServers().some((s) => s.url === url);
+}
+
+/** Whether an MCP server URL may be contacted at all. */
+export function isAllowedMcpUrl(url: string): boolean {
+	return isValidUrl(url, { allowPrivate: isConfiguredMcpUrl(url) });
+}
+
+/**
+ * The fetch an MCP transport should use: the default for operator-configured
+ * servers, and one pinned to public addresses at connect time for everything
+ * else, so a public hostname that resolves to a private address is refused.
+ */
+export function mcpFetchFor(url: string): typeof fetch | undefined {
+	return isConfiguredMcpUrl(url) ? undefined : ssrfSafeFetch;
+}

package/src/ruvocal/src/lib/server/mcp/tools.ts

@@ -2,6 +2,7 @@ import { Client } from "@modelcontextprotocol/sdk/client";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import type { McpServerConfig } from "./httpClient";
+import { mcpFetchFor } from "./serverTrust";
 import { logger } from "$lib/server/logger";
 // use console.* for lightweight diagnostics in production logs
 
@@ -71,11 +72,13 @@ async function listServerTools(
 		try {
 			const transport = new StreamableHTTPClientTransport(url, {
 				requestInit: { headers: server.headers, signal: opts.signal },
+				fetch: mcpFetchFor(server.url),
 			});
 			await client.connect(transport);
 		} catch {
 			const transport = new SSEClientTransport(url, {
 				requestInit: { headers: server.headers, signal: opts.signal },
+				fetch: mcpFetchFor(server.url),
 			});
 			await client.connect(transport);
 		}

package/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts

@@ -2,7 +2,7 @@ import { config } from "$lib/server/config";
 import { mergeMcpServers } from "./mergeServers";
 import { MessageUpdateType, type MessageUpdate } from "$lib/types/MessageUpdate";
 import { getMcpServers } from "$lib/server/mcp/registry";
-import { isValidUrl } from "$lib/server/urlSafety";
+import { isAllowedMcpUrl } from "$lib/server/mcp/serverTrust";
 import { resetMcpToolsCache } from "$lib/server/mcp/tools";
 import { getOpenAiToolsForMcp } from "$lib/server/mcp/tools";
 import type {
@@ -144,7 +144,7 @@ export async function* runMcpFlow({
 		const before = servers.slice();
 		servers = servers.filter((s) => {
 			try {
-				return isValidUrl(s.url);
+				return isAllowedMcpUrl(s.url);
 			} catch {
 				return false;
 			}

package/src/ruvocal/src/lib/server/urlSafety.spec.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import { isValidUrl } from "./urlSafety";
+
+// URLs from a request (custom MCP servers, fetch-url) must be public HTTPS.
+// The local-development allowances apply only to operator-configured URLs.
+describe("isValidUrl", () => {
+	it("accepts public HTTPS URLs", () => {
+		expect(isValidUrl("https://mcp.example.com/mcp")).toBe(true);
+		expect(isValidUrl("https://8.8.8.8/")).toBe(true);
+	});
+
+	it("refuses loopback, Docker-internal, dotless and private targets by default", () => {
+		for (const url of [
+			"http://localhost:3001/mcp",
+			"https://localhost/mcp",
+			"http://127.0.0.1:3001/mcp",
+			"https://[::1]/",
+			"http://host.docker.internal:3001/mcp",
+			"http://mongodb:27017/",
+			"http://metadata/computeMetadata/v1/",
+			"https://metadata/",
+			"https://10.0.0.5/",
+			"https://192.168.1.10/",
+			"https://169.254.169.254/latest/meta-data/",
+			"https://[fd00::1]/",
+			"https://bridge.localhost/",
+			"https://metadata.google.internal/",
+			"http://mcp.example.com/mcp",
+		]) {
+			expect(isValidUrl(url), url).toBe(false);
+		}
+	});
+
+	it("keeps the local allowances for operator-configured URLs", () => {
+		expect(isValidUrl("http://localhost:3001/mcp", { allowPrivate: true })).toBe(true);
+		expect(isValidUrl("http://mcp-bridge:3001/mcp", { allowPrivate: true })).toBe(true);
+		expect(isValidUrl("https://10.0.0.5/", { allowPrivate: true })).toBe(true);
+	});
+});

package/src/ruvocal/src/lib/server/urlSafety.ts

@@ -1,8 +1,11 @@
 import { Address4, Address6 } from "ip-address";
 import { isIP } from "node:net";
+import dns from "node:dns";
+import { Agent, fetch as undiciFetch } from "undici";
 
 const UNSAFE_IPV4_SUBNETS = [
 	"0.0.0.0/8",
+	"10.0.0.0/8",
 	"100.64.0.0/10",
 	"127.0.0.0/8",
 	"169.254.0.0/16",
@@ -25,30 +28,41 @@ function isUnsafeIp(address: string): boolean {
 			const v4 = addr.to4();
 			return UNSAFE_IPV4_SUBNETS.some((subnet) => v4.isInSubnet(subnet));
 		}
-		return addr.isLoopback() || addr.isLinkLocal();
+		// Unique-local (fc00::/7) is private address space, like 10/8 for IPv4.
+		const ula = addr.isInSubnet(new Address6("fc00::/7"));
+		return addr.isLoopback() || addr.isLinkLocal() || ula || cleanIsUnspecified(address);
 	}
 
 	return true; // Unknown format → block
 }
 
+function cleanIsUnspecified(address: string): boolean {
+	return /^(::|0:0:0:0:0:0:0:0)$/.test(address);
+}
+
 /**
  * Synchronous URL validation: checks protocol and hostname string.
+ *
+ * By default only public HTTPS URLs pass: no loopback or Docker-internal
+ * names, no dotless hosts, no private IP literals. `allowPrivate` restores the
+ * local-development allowances and is only for URLs the operator configured
+ * (MCP_SERVERS), never for URLs taken from a request.
  */
-export function isValidUrl(urlString: string): boolean {
+export function isValidUrl(urlString: string, opts: { allowPrivate?: boolean } = {}): boolean {
 	try {
 		const url = new URL(urlString.trim());
 		const hostname = url.hostname.toLowerCase();
 		// Allow HTTP for localhost/loopback/Docker-internal (dev & local MCP bridge)
-		if (
+		if (opts.allowPrivate && (
 			hostname === "localhost" ||
 			hostname === "127.0.0.1" ||
 			hostname === "::1" ||
 			hostname === "host.docker.internal"
-		) {
+		)) {
 			return url.protocol === "http:" || url.protocol === "https:";
 		}
 		// Allow HTTP for Docker-internal service names (no dots = private network)
-		if (!hostname.includes(".") && url.protocol === "http:") {
+		if (opts.allowPrivate && !hostname.includes(".") && url.protocol === "http:") {
 			return true;
 		}
 		if (url.protocol !== "https:") {
@@ -57,7 +71,10 @@ export function isValidUrl(urlString: string): boolean {
 		// If the hostname is a raw IP literal, validate it
 		const cleanHostname = hostname.replace(/^\[|]$/g, "");
 		if (isIP(cleanHostname)) {
-			return !isUnsafeIp(cleanHostname);
+			return opts.allowPrivate || !isUnsafeIp(cleanHostname);
+		}
+		if (!opts.allowPrivate && (!hostname.includes(".") || hostname.endsWith(".localhost") || hostname.endsWith(".internal") || hostname.endsWith(".local"))) {
+			return false;
 		}
 		return true;
 	} catch {
@@ -75,3 +92,37 @@ export function assertSafeIp(address: string, hostname: string): void {
 		throw new Error(`Resolved IP for ${hostname} is internal (${address})`);
 	}
 }
+
+/**
+ * Undici dispatcher that validates resolved IPs at connection time,
+ * preventing TOCTOU DNS rebinding attacks.
+ */
+export const ssrfSafeAgent = new Agent({
+	connect: {
+		lookup: (hostname, options, callback) => {
+			dns.lookup(hostname, options, (err, address, family) => {
+				if (err) return callback(err, "", 4);
+				if (typeof address === "string") {
+					try {
+						assertSafeIp(address, hostname);
+					} catch (e) {
+						return callback(e as Error, "", 4);
+					}
+				} else if (Array.isArray(address)) {
+					for (const entry of address) {
+						try {
+							assertSafeIp(entry.address, hostname);
+						} catch (e) {
+							return callback(e as Error, "", 4);
+						}
+					}
+				}
+				return callback(null, address, family);
+			});
+		},
+	},
+});
+
+/** fetch() whose connections may only reach public addresses (see ssrfSafeAgent). */
+export const ssrfSafeFetch = ((input: string | URL, init?: RequestInit) =>
+	undiciFetch(input, { ...(init as object), dispatcher: ssrfSafeAgent } as Parameters<typeof undiciFetch>[1])) as unknown as typeof fetch;

package/src/ruvocal/src/routes/api/fetch-url/+server.ts

@@ -1,8 +1,7 @@
 import { error } from "@sveltejs/kit";
 import { logger } from "$lib/server/logger.js";
-import { Agent, fetch } from "undici";
-import { isValidUrl, assertSafeIp } from "$lib/server/urlSafety";
-import dns from "node:dns";
+import { fetch } from "undici";
+import { isValidUrl, ssrfSafeAgent } from "$lib/server/urlSafety";
 
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
 const FETCH_TIMEOUT = 30000; // 30 seconds
@@ -16,36 +15,6 @@ const SECURITY_HEADERS: HeadersInit = {
 	"Referrer-Policy": "no-referrer",
 };
 
-/**
- * Undici dispatcher that validates resolved IPs at connection time,
- * preventing TOCTOU DNS rebinding attacks.
- */
-const ssrfSafeAgent = new Agent({
-	connect: {
-		lookup: (hostname, options, callback) => {
-			dns.lookup(hostname, options, (err, address, family) => {
-				if (err) return callback(err, "", 4);
-				if (typeof address === "string") {
-					try {
-						assertSafeIp(address, hostname);
-					} catch (e) {
-						return callback(e as Error, "", 4);
-					}
-				} else if (Array.isArray(address)) {
-					for (const entry of address) {
-						try {
-							assertSafeIp(entry.address, hostname);
-						} catch (e) {
-							return callback(e as Error, "", 4);
-						}
-					}
-				}
-				return callback(null, address, family);
-			});
-		},
-	},
-});
-
 export async function GET({ url }) {
 	const targetUrl = url.searchParams.get("url");
 

package/src/ruvocal/src/routes/api/mcp/health/+server.ts

@@ -5,7 +5,7 @@ import type { KeyValuePair } from "$lib/types/Tool";
 import { config } from "$lib/server/config";
 import { logger } from "$lib/server/logger";
 import type { RequestHandler } from "./$types";
-import { isValidUrl } from "$lib/server/urlSafety";
+import { isAllowedMcpUrl, mcpFetchFor } from "$lib/server/mcp/serverTrust";
 import { isStrictHfMcpLogin, hasNonEmptyToken, isExaMcpServer } from "$lib/server/mcp/hf";
 
 interface HealthCheckRequest {
@@ -40,7 +40,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 
 		// URL validation handled above
 
-		if (!isValidUrl(url)) {
+		if (!isAllowedMcpUrl(url)) {
 			return new Response(
 				JSON.stringify({
 					ready: false,
@@ -111,7 +111,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 				version: "1.0.0",
 			});
 
-			const transport = new StreamableHTTPClientTransport(baseUrl, { requestInit });
+			const transport = new StreamableHTTPClientTransport(baseUrl, { requestInit, fetch: mcpFetchFor(url) });
 			logger.info({}, `[MCP Health] Connecting to ${url}...`);
 			await client.connect(transport);
 			logger.info({}, `[MCP Health] Connected successfully via HTTP`);
@@ -174,7 +174,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 					version: "1.0.0",
 				});
 
-				const sseTransport = new SSEClientTransport(baseUrl, { requestInit });
+				const sseTransport = new SSEClientTransport(baseUrl, { requestInit, fetch: mcpFetchFor(url) });
 				logger.info({}, `[MCP Health] Connecting via SSE...`);
 				await client.connect(sseTransport);
 				logger.info({}, `[MCP Health] Connected successfully via SSE`);