ruflo v3.57.0 发布：收紧 Codex 默认权限并修复 MCP 桥与策略账本安全问题

Official release notes (https://github.com/ruvnet/ruflo/releases/tag/v3.57.0) Minor release: `@claude-flow/cli`, `claude-flow`, `ruflo` 3.57.0. A batch of community and dream-cycle fixes (#4210-#4252) plus a policy-ledger integrity fix (#3892). No standalone leaf republish needed this round. ### Security - `ruflo init` / `init --dual` / `@claude-flow/codex init` no longer write a permissive `.codex/config.toml` by default. The generated file now uses `sandbox_mode = "workspace-write"`, `approval_policy = "on-request"` and `web_search = "cached"` (**standard** trust); the old `danger-full-access` / `never` / `live` file needs an explicit `--codex-trust full` (or `RUFLO_CODEX_TRUST=full`). `init` prints which level was written, an existing `.codex/config.toml` is never rewritten (not even with `--force`), and a kept permissive file is flagged with how to tighten it. Found by the three-host e2e run (ADR-490). `@claude-flow/codex` 3.0.4 (bundled, ships with the next train). - The MCP bridge on loopback no longer accepts tool-call requests from an arbitrary web page: local-only mode now requires the `Host` to be loopback (blocks DNS rebinding) and the `Origin` to be loopback-or-allowlisted when no `MCP_AUTH_TOKEN` is set (#4226, #4243, @kevin9327). - The policy ledger now authenticates a retained/pruned ledger against its independent on-disk archive anchor instead of trusting the mutable `state.json` alone, and streams full audits through fenced writers. Fixes `policy-ledger-verification-failed` on any install whose ledger has already been pruned (#3892, #4216, @proffesor-for-testing). ### Added - `ruflo doctor` reports `better-sqlite3` copies compiled against Node 24.19+ headers when running Node 24.19–24.21, where they can abort the process (`Assertion failed: (env) != nullptr`, nodejs/node#65446), with the documented workarounds. `doctor --component native-addon` runs it alone (#4055, reported by @ronmikailov). - `ruflo doctor` reports health checks as versioned JSON output (#4228, @bryanbans). ### Fixed - `@metaharness/darwin` pin bumped from `~0.10.2` to `~0.12.0`, unblocking the `metaharness-pin-drift` CI gate repo-wide (#3219, #4252). - Swarm: subscriber delivery is cancelled cleanly at shutdown, acknowledgements are tracked per recipient, urgent messages survive queue overflow, and failed/cancelled task workers release their slot (#4233, #4234, #4235, #4236, @rudycelekli). Coordinator cancellation stays terminal (#4244, @rudycelekli); domain pools stop creating unregistered agents and release agents after terminal tasks (#4246, #4247, @Tong-bit-art); shared worker reservations are honored across agent pools, fixing a case where that bookkeeping change would have silently defeated the domain-pool-release fix above (#4245, @rudycelekli). - Learning stats read-merge-write transactions are serialized across processes, fixing lost concurrent increments (#4217, #4240, @rudycelekli). - Claude memories refresh across project and worktree roots (#4210, @rudycelekli); the secret screen no longer treats a hyphen-named memory key as a credential field (#4202, #4211, @akushonkamen). - Hook lifecycle events are distinguished during deduplication, fixing the Stop hook claiming the session-end de-dup key so later hooks never ran (#4206, #4212, @dajiaohuang); `init` omits unimplemented generated hooks (#4200, #4213, @dajiaohuang) and stops granting blanket execution of project helpers (#4221, @xiajiahang). - Intelligence: trajectories are forwarded using the ruvllm contract (#4222, @xiajiahang); neural quantization reports unchanged persisted storage instead of a false delta (#4224, @dajiaohuang). - Console: Mission Control's prose wraps at 80 columns (#3899, #4225, console 0.44.3, @korjavin); the mission ledger is keyed per project instead of leaking one project's active mission into every other (#4237, #4242, @kevin9327). - `daemon status` reports the running daemon's actual TTL instead of a stale `--ttl 0` default (#4238, #4241, @kevin9327). - CLI: `--no-color` is honored for help and version output, and `--no-update` is honored before the startup update check runs (#4248, #4251, @shuaiyafei). - `dream(performance)`: `RaftConsensus.awaitConsensus()` is event-driven instead of busy-polling (#4214, #4215). - Docs: 25 user guide links repaired to v3 packages (#4223, @ketpatil77); ABP-governed SGit memory checkpoints and Ruflo CLI recovery validation documented (#4239, @mondweep). Not included: #4220 (helper-execution-permission fix) touches a signed helper manifest and needs a re-sign with the private key before merge, held for a follow-up release. #4216's own large diff (ledger integrity) was reviewed in depth separately before merging, given it gates MCP tool-call authorization. Repository README (current repository documentation, not release changes) **An agent meta-harness for Claude Code and Codex.** [](https://www.npmjs.com/package/ruflo) [](https://opensource.org/licenses/MIT) [](https://github.com/ruvnet/claude-flow) ## Get started with Ruflo **Start in Claude Code** with core tools, the visual console and runtime mods. Requires Claude Code **2.1.287 or later**. Run inside Claude Code: ```text /plugin marketplace add ruvnet/ruflo /plugin install ruflo-core@ruflo /plugin install ruflo-console@ruflo /plugin install ruflo-mods@ruflo /reload-plugins /ruflo ``` **Core** provides foundation tools. **Console** opens the agent cockpit. **Mods** add routing and policy enforcement inside Claude Code. Mods run with your account's permissions; review their code before installing. **Using Codex or another MCP enabled tool?** Use NPX for Ruflo project setup and connect your client to the Ruflo MCP server. Run the setup wizard in your project terminal: ```bash npx ruflo@latest init wizard ``` For clients that support local stdio MCP servers, configure **command** `npx` and **arguments** `["-y", "ruflo@latest", "mcp", "start"]`. The equivalent server command is: ```bash npx -y ruflo@latest mcp start ``` MCP exposes Ruflo tools to your client. The console and mods above are Claude Code integrations; hook support depends on the client. **Prefer a plain terminal? Optional.** The console also runs on its own, with no Claude Code: `npx ruflo tui` (add `--plain` to print one frame for scripts). It shows Overview, Cost, Swarm, Events and Missions, plus an optional AI page. [Terminal UI guide](docs/USERGUIDE.md#terminal-ui-optional) [Compare install paths](#quick-start) · [Open the console](#console-walkthrough) · [User guide](docs/USERGUIDE.md) ### Optional: ruOS Desktop **Connect ruOS to ChatGPT or Claude via MCP:** ```text https://ruos.cognitum.one/mcp ``` ```bash npx ruvector ``` # Ruflo [English](README.md) · [简体中文](README.zh-CN.md) [](docs/ruflo-explained.md) **[📖 RuFlo Explained — Build an AI Team That Plans, Remembers, Tests, and Improves](docs/ruflo-explained.md)** A 14-chapter guide: from the basic idea to a first useful task, then memory, agent teams, plugins, cost and verification. > **Agent = Model + Harness.** The model writes; the harness gives it tools, memory, loops, sandboxes, and controls so it can actually work. **Ruflo is the harness** — the execution layer around Claude Code and Codex that adds 100+ specialized agents, coordinated swarms, self-learning memory, federated comms across machines, and enterprise security guardrails. So agents don't just run, they collaborate. One `npx ruflo init` gives Claude Code a nervous system: agents self-organize into swarms, learn from every task, remember across sessions, and — with federation — securely talk to agents on other machines without leaking data. You keep writing code. Ruflo handles the coordination. Conceptual learning loop. Local vector retrieval and contrastive updates can run without an LLM; embeddings and configured learning modules are still required. See the RuVector training integration and trajectory contrastive learning. Architecture in text User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM providers. Memory feeds useful experience back into routing. This is a conceptual flow, not a live execution trace. > **New to Ruflo?** You don't need to learn 314 MCP tools or 26 CLI commands. After `init`, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background. ### An origin you can inspect [](docs/harness-origins.md) **Built by [Reuven Cohen (rUv)](https://github.com/ruvnet), originally as Claude Flow.** The [first commit, June 2, 2025](https://github.com/ruvnet/ruflo/commit/7c1f9402d70e7af56c01a879073cbac92564dc4e), describes a code orchestration layer for recursive agent cycles: Claude writes, edits, tests and improves. The [June 10 source snapshot](https://github.com/ruvnet/ruflo/tree/dba545f012ea92a2375a26332bbf3797495e93c9) adds orchestration, task scheduling, memory and terminal modules. A harness is the workbench around the model: it organizes tasks, carries context between steps and helps check results. **This establishes Ruflo's lineage, not a universal first across every Claude Code tool.** [See the illustrated explainer, exact commits and earlier ecosystem context](docs/harness-origins.md). 📖 Background — where the name comes from > Claude Flow is now Ruflo — named by [`rUv`](https://ruv.io), who loves Rust, flow states, and building things that feel inevitable. The "Ru" is the rUv. The "flo" is working until 3am. Underneath, powered by [`Cognitum.One`](https://cognitum.one/?RuFlo) agentic architecture, running a supercharged Rust-based AI engine, embeddings, memory, and plugin system. --- [Open animated demo](https://raw.githubusercontent.com/ruvnet/ruflo/main/docs/assets/ruflo-console-theme-compact.svg) · [Theme Studio guide](plugins/ruflo-console/README.md) · [Workflow demo](docs/assets/ruflo-console-workflows.svg) **Your agent cockpit.** Track workflows, agents, models, tokens and cost beside Claude Code. The 38 second animation shows **Orbital and Theme Studio** through actual renderer frames, including boot checks, six palettes, customization, saved themes, JSON import and resizing. This compact 3.84 MB SVG retains all 456 frames. Native host and AI provider execution are not demonstrated. **Inspect any run.** Open agent logs and results, search, triage failures, replay and compare. Start with `npx ruflo init`, restart Claude Code, then `/ruflo`. [Full console tour](docs/assets/ruflo-console-walkthrough-wide.gif). **Let Claude drive. You set the limits.** Enable **Settings → Claude control** to navigate and run console actions. Choose `read`, `write`, `manage` or `full`, with `ask` or `auto` approval. The current default is **read + ask**; raising the level is your choice. Actions above your permission level are refused, and network, spending and destructive actions require confirmation even in `auto`. Review the live action log or press **Take back control** to stop Claude control. [Details](v3/docs/adr/ADR-444-claude-controls-the-console.md). ### One task: create a mission with Claude **Watch the recorded console session below.** Claude creates a mission, opens the Learning and Security pages, and reports its actions in Overview. 1. **Set the boundary.** Install the console using the commands below, open `/ruflo`, then choose **Settings → Claude control → write + ask**. 2. **Give a concrete request.** Try: “Create a mission to add a dark mode toggle. Show me the mission and its status.” 3. **Approve creation.** Claude opens Missions and sets the goal. Confirm the pending create action in the console. 4. **Verify the result.** Check that Missions contains the goal and Overview records the action. Creating a mission does not mean the feature has been implemented. 5. **Keep control.** **Take back control** pauses Claude's console tools. A later call should be refused until you restore control. **What the recording demonstrates:** a real Claude Haiku session with `write + auto`, mission creation, page navigation, a refused swarm stop, and control being taken back. The steps above use `ask` so you approve creation yourself. The linked workflow animation uses sample data, while the theme demo replays renderer frames. Neither is evidence of completed swarm work or memory recall. [Implementation and recorded test findings](v3/docs/adr/ADR-444-claude-controls-the-console.md) · [Reproduction script](plugins/ruflo-console/scripts/e2e-control.sh) **Install the mods from the ruflo marketplace** (Claude Code 2.1.287 or later; mods run with your account's permissions and are not sandboxed, so read the code first): ```text /plugin marketplace add ruvnet/ruflo /plugin install ruflo-console@ruflo /plugin install ruflo-mods@ruflo /reload-plugins ``` `ruflo-console` is the cockpit above, `ruflo-mods` routes prompts and enforces policy in-process, `ruflo-swarm` shows the swarm in a pane, and `ruflo-ruos` adds the ruOS status segment. Open `/plugin` to confirm they appear in the active mods line. Inside the console, `/ruflo market` is the Plugin Catalog: every ruflo plugin, mod and skill with what it ships, and buttons to install, enable, disable and update (each asks first). ## Quick Start There are **two different install paths** with very different surface areas. Pick based on what you need (#1744): | | **Claude Code Plugin** | **CLI install (`npx ruflo init`)** | |---|---|---| | What it gives you | Slash commands + a few skills + agent definitions per-plugin | Full Ruflo loop — 98 agents, 60+ commands, 30 skills, MCP server, hooks, daemon | | Files in your workspace | **Zero** | `.claude/`, `.claude-flow/`, `CLAUDE.md`, helpers, settings | | MCP server registered | Only if `ruflo-core` is installed (it ships its own `.mcp.json`) — most other plugins don't | Yes | | Hooks installed | No | Yes | | Best for | Try a single plugin's commands without committing to the full install | Production use — everything works as documented | ### Path A — Claude Code Plugins (lite, slash commands only) ```bash # Add the marketplace /plugin marketplace add ruvnet/ruflo # Install core + any plugins you need /plugin install ruflo-core@ruflo /plugin install ruflo-swarm@ruflo /plugin install ruflo-rag-memory@ruflo /plugin install ruflo-neural-trader@ruflo ``` This adds slash commands and agent definitions. `ruflo-core` (installed above) does register its own MCP server on install — its tools are callable as `mcp__plugin_ruflo-core_ruflo__*` (e.g. `mcp__plugin_ruflo-core_ruflo__memory_store`), not the bare `memory_store`/`swarm_init`/`agent_spawn` names the CLI-track scaffold uses. Other plugins generally don't ship their own MCP server. For the full loop with the CLI-track tool names, use Path B below. 🔌 All 35 plugins #### Core & Orchestration | Plugin | What it does | |--------|-------------| | [**ruflo-core**](plugins/ruflo-core/README.md) | Foundation — server, health checks, plugin discovery | | [**ruflo-swarm**](plugins/ruflo-swarm/README.md) | Coordinate multiple agents as a team | | [**ruflo-autopilot**](plugins/ruflo-autopilot/README.md) | Let agents run autonomously in a loop | | [**ruflo-loop-workers**](plugins/ruflo-loop-workers/README.md) | Schedule background tasks on a timer | | [**ruflo-workflows**](plugins/ruflo-workflows/README.md) | Reusable multi-step task templates | | [**ruflo-federation**](plugins/ruflo-federation/README.md) | Agents on different machines collaborate securely | #### Memory & Knowledge | Plugin | What it does | |--------|-------------| | [**ruflo-agentdb**](plugins/ruflo-agentdb/README.md) | Fast vector database for agent memory | | [**ruflo-rag-memory**](plugins/ruflo-rag-memory/README.md) | Smart retrieval — hybrid search, graph hops, diversity ranking | | [**ruflo-rvf**](plugins/ruflo-rvf/README.md) | Save and restore agent memory across sessions | | [**ruflo-ruvector**](plugins/ruflo-ruvector/README.md) | [`ruvector`](https://npmjs.com/package/ruvector) — GPU-accelerated search, Graph RAG, 103 tools | | [**ruflo-knowledge-graph**](plugins/ruflo-knowledge-graph/README.md) | Build and traverse entity relationship maps | #### Intelligence & Learning | Plugin | What it does | |--------|-------------| | [**ruflo-intelligence**](plugins/ruflo-intelligence/README.md) | Agents learn from past successes and get smarter | | [**ruflo-graph-intelligence**](plugins/ruflo-graph-intelligence/) | Sublinear graph reasoning — PageRank, delta updates, complexity-aware execution (ADR-123) | | [**ruflo-daa**](plugins/ruflo-daa/README.md) | Dynamic agent behavior and cognitive patterns | | [**ruflo-ruvllm**](plugins/ruflo-ruvllm/README.md) | Run local LLMs (Ollama, etc.) with smart routing | | [**ruflo-goals**](plugins/ruflo-goals/README.md) | Break big goals into plans and track progress | #### Code Quality & Testing | Plugin | What it does | |--------|-------------| | [**ruflo-testgen**](plugins/ruflo-testgen/README.md) | Find missing tests and generate them automatically | | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright | | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers | | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically | #### Security & Compliance | Plugin | What it does | |--------|-------------| | [**ruflo-security-audit**](plugins/ruflo-security-audit/README.md) | Scan for vulnerabilities and CVEs | | [**ruflo-aidefence**](plugins/ruflo-aidefence/README.md) | Block prompt injection, detect PII, safety scanning | #### Architecture & Methodology | Plugin | What it does | |--------|-------------| | [**ruflo-adr**](plugins/ruflo-adr/README.md) | Track architecture decisions with a living record | | [**ruflo-ddd**](plugins/ruflo-ddd/README.md) | Scaffold domain-driven design — contexts, aggregates, events | | [**ruflo-sparc**](plugins/ruflo-sparc/README.md) | Guided 5-phase development methodology with quality gates | | [**ruflo-metaharness**](plugins/ruflo-metaharness/README.md) | Grade your agent setup, scan tool configs for security risks, and track changes over time ([guide](docs/metaharness-user-guide.md)) | | [**ruflo-arena**](plugins/ruflo-arena/README.md) | Competitive ruliology — pit agent strategies against each other in tournaments, hill-climb and co-evolve the winners (ADR-147/148) | #### DevOps & Observability | Plugin | What it does | |--------|-------------| | [**ruflo-migrations**](plugins/ruflo-migrations/README.md) | Manage database schema changes safely | | [**ruflo-observability**](plugins/ruflo-observability/README.md) | Structured logs, traces, and metrics in one place | | [**ruflo-cost-tracker**](plugins/ruflo-cost-tracker/README.md) | Track token usage, set budgets, get cost alerts | #### Extensibility | Plugin | What it does | |--------|-------------| | [**ruflo-agent**](plugins/ruflo-agent/README.md) | Run agents — local WASM sandbox (rvagent) + Anthropic Claude Managed Agents (cloud) | | [**ruflo-plugin-creator**](plugins/ruflo-plugin-creator/README.md) | Scaffold, validate, and publish your own plugins | #### Domain-Specific | Plugin | What it does | |--------|-------------| | [**ruflo-iot-cognitum**](plugins/ruflo-iot-cognitum/README.md) | IoT device management — trust scoring, anomaly detection, fleets | | [**ruflo-neural-trader**](plugins/ruflo-neural-trader/README.md) | [`neural-trader`](https://npmjs.com/package/neural-trader) — AI trading with 4 agents, backtesting, 112+ tools | | [**ruflo-market-data**](plugins/ruflo-market-data/README.md) | Ingest market data, vectorize OHLCV, detect patterns | ### CLI Install **macOS / Linux / WSL / Git-Bash:** ```bash # One-line install (POSIX shells only — see Windows note below) curl -fsSL https://cdn.jsdelivr.net/gh/ruvnet/ruflo@main/scripts/install.sh | bash ``` **All platforms (including native Windows PowerShell / cmd):** ```bash # Interactive setup wizard — runs identically on every platform npx ruflo@latest init wizard # Quick non-interactive init # npx ruflo@latest init # Or install globally npm install -g ruflo@latest ``` > 💡 **Windows users:** the `curl ... | bash` form needs a POSIX shell (Git-Bash, WSL, MSYS). The `npx ruflo@latest init wizard` line works natively in PowerShell and cmd. If you hit an `'bash' is not recognized` error, use the `npx` line instead — both end up running the same init flow. ### MCP Server ```bash # Add Ruflo as an MCP server in Claude Code claude mcp add claude-flow -- npx ruflo@latest mcp start ``` --- ## What You Get | Capability | Description | |------------|-------------| | **100+ Agents** | Specialized agents for coding, testing, security, docs, architecture | | **Comms Layer** | Zero-trust federation — agents across machines/orgs discover, authenticate, and exchange work securely | | **Swarm Coordination** | Hierarchical, mesh, and adaptive topologies with consensus | | **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning | | **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) | | **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) | | **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins | | **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing | | **Security** | AIDefence, input validation, CVE remediation, path traversal prevention | | <img src="docs/assets/readme/icons/federation.svg" width="28" height