skills/ruvnet__ruflo
1
0
Fork 0
mirror of https://github.com/ruvnet/ruflo.git synced 2026-09-14 14:01:28 +08:00
Code Issues Packages Projects Releases Wiki Activity
7,438 Commits 580 Branches 1,645 Tags
docs/x-gateway-github-style-metadata
Commit Graph

3 Commits

Author SHA1 Message Date
rUv d00a0a40cd security(mcp-bridge): ADR-166 unauthenticated RCE — Phase 1-3 remediation + CI lock (#2521) 
* docs(adr): ADR-166 — MCP bridge unauthenticated RCE remediation (coordinated disclosure)

Document and propose remediation for a coordinated-disclosure report: the
ruvocal MCP bridge exposes POST /mcp with no authentication and the shipping
docker-compose binds it to all interfaces, yielding unauthenticated RCE plus
LLM-key, learning-store, and MongoDB compromise.

Status: Proposed — no code changes. Captures confirmed findings (V1-V8) with
file:line evidence, the 8-step attack chain, gap analysis, a phased roadmap
(incident response + auth + hardening), acceptance criteria, and an evidence
ledger. Reporter identity, PoC callback domain, and target host are redacted.

Co-Authored-By: RuFlo <ruv@ruv.net>

* feat(security): ADR-166 reframe — local-only default, public is opt-in (V1/V6/V8)

Maintainer decision (2026-06-30): MCP design contract is local-only by
default. Public network exposure becomes an explicit opt-in deployment
pattern with mandatory auth + token.

## Defaults flipped to loopback

- `ruflo/docker-compose.yml`: bridge `3001:3001` → `127.0.0.1:3001:3001`;
  Mongo `27017:27017` → `127.0.0.1:27017:27017`
- Both bridges (`ruflo/src/{ruvocal/,}mcp-bridge/index.js`):
  `app.listen(PORT)` → `app.listen(PORT, BIND_HOST)` with
  `BIND_HOST = process.env.MCP_BIND_HOST || '127.0.0.1'`
- `v3/@claude-flow/plugin-agent-federation/src/bin.ts`:
  default `bindHost` `'0.0.0.0'` → `'127.0.0.1'`

## Optional public deployment pattern

NEW `ruflo/docker-compose.public.yml` — explicit override composition.
Operator must set BOTH `MCP_BIND_HOST=0.0.0.0` AND
`MCP_AUTH_TOKEN=$(openssl rand -base64 32)`, otherwise the bridge exits
non-zero at startup with a FATAL message that includes the token-gen
command.

When `MCP_AUTH_TOKEN` is set (any bind), the new `requireAuth`
middleware enforces `Authorization: Bearer <token>` on all `/mcp*`,
`/chat/completions`, `/autopilot*`, `/mcp-servers` routes using
`timingSafeEqual`. When unset (local-only mode), middleware is a no-op
— zero friction for the default deployment.

## Why this framing

Per the review-thread pushback:
> "If someone has unauthorized access to your environment, you have
>  bigger problems. The MCP is local so unauthorized is the only
>  option."

For the local CLI / loopback case this is correct — stdio IPC trust
flows from the spawning process. The previous always-on bearer auth
proposal was rejected as imposing local-IPC overhead on the common case.

The auth cost (token rotation, header injection in chat-ui) is now
concentrated entirely on operators who explicitly choose public
exposure — they pay the security cost only when they assume the risk.

## ADR-166 amendments (6 surgical edits)

- §1.2 — adds the design-contract clause
- §6 Phase 1 — retitled; 1a now leads with loopback default, 1b is
  fail-closed-on-opt-in, 1c is auth-when-token-set, 1d unchanged
- §6 new "Optional public deployment pattern" subsection with the
  generate-token + compose -f override recipe
- §7 R1/R2 — reframed to acknowledge the UX cost is concentrated in
  the optional path
- §8 — "bind loopback only; skip auth" REJECTED → "loopback default;
  auth for opt-in" ACCEPTED
- §10 — maintainer decision 2026-06-30 cited

## Gates (all PASS)

- `npm audit --audit-level=critical` root: exit 0
- `npm audit --audit-level=critical` v3:   exit 0
- CLI build: clean (tsc)
- Static smoke (both bridges): bind-host + token + fail-closed wired
- Compose YAML parses (default loopback + public override)

## Follow-ons (in same release train)

1. Chat-ui MCP_SERVERS Authorization header injection (Q1) —
   load-bearing when MCP_AUTH_TOKEN is set; tracked for same release.
2. MCP_ENABLE_TERMINAL gate (1d) — separate commit before merge.
3. Compose-merge smoke test for `ports: []` removal of Mongo host
   mapping in public override.

Co-Authored-By: Dragan Spiridonov <dragan@spiridonov.dev>
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01WbBa4nccx5aGhXphoHxcni

* security(mcp-bridge): ADR-166 Phase 1-3 — server-side tool gate, read-only rootfs, mongo auth, CI lock

Completes the ADR-166 remediation. Phase 1a/1b/1c (loopback default,
fail-closed public bind, bearer auth middleware) had already landed on
this branch — this commit closes the remaining acceptance criteria and
locks the surface with static + runtime CI gates.

Adds
- Server-side terminal gate (Phase 1d + 2a). `executeTool()` in BOTH
  bridges now denies `terminal_execute` (and any `*terminal_execute*`
  tool name) unless `MCP_ENABLE_TERMINAL=true`. Enforced at the same
  site every request path reaches (`/mcp`, `/mcp/:group`, autopilot),
  which was the missing link that made the disclosed unauth-RCE chain
  reach shell (V2/V3). Returns `{error, code: "TOOL_DISABLED"}`.
- Startup posture banner. Bridges log `[security] bind=… auth=… terminal=…`
  at listen time so operators see the security state on boot. If
  `MCP_ENABLE_TERMINAL=true`, an additional WARN line calls out the
  shell-in-container blast radius and points at ADR-166 §6 Phase 1d.
- MongoDB auth on by default (Phase 2b). `mongodb` service now runs
  `--auth`; `MONGO_INITDB_ROOT_PASSWORD` is a hard-required compose
  variable (the `${VAR:?…}` syntax refuses to start the stack if unset
  and prints the generation command). `chat-ui`'s MONGODB_URL is
  updated to include the credentials.
- Read-only rootfs on the bridge (Phase 2c). `read_only: true` +
  `tmpfs: /tmp` on the `mcp-bridge` service. Breaks step 7 of the
  disclosed PoC (the `/app/beacon.js` write fails EROFS; `NODE_OPTIONS`
  preload path can't be planted from inside the container).
- CORS allowlist wiring (Phase 3b). Both bridges honor
  `MCP_CORS_ORIGIN` (comma-separated). Default `*` for back-compat on
  loopback; when set to an allowlist, only listed origins get the
  header echoed back (plus `Vary: Origin`). Non-listed origins get
  nothing — browsers block the request.
- Anti-regression static-source lock (Phase §6 #9).
  `ruflo/src/mcp-bridge/test-security-lock.js` — 6 checks × 2 bridges,
  offline, zero-deps. Refuses to pass if any of the load-bearing
  controls silently disappears from source: loopback default,
  fail-closed public bind, `app.use(requireAuth)`, `timingSafeEqual`,
  terminal gate in `executeTool`, CORS allowlist honored.
- Runtime behavioral verification.
  `ruflo/src/mcp-bridge/test-runtime-security.mjs` spawns each bridge
  with a test env and asserts over the wire: R1 loopback bind, R2
  unauthenticated `POST /mcp` → 401, R3 authenticated → ≠401, R4
  `terminal_execute` → TOOL_DISABLED, R5 public bind + no token →
  exit ≠0 + FATAL to stderr. Complements the source-only lock.
- CI workflow `.github/workflows/adr-166-mcp-bridge-security.yml`.
  Four jobs on every PR touching bridge / compose / federation:
  (1) static-source lock, (2) runtime behavior on Node 22,
  (3) compose defaults (loopback binds + Mongo --auth + read_only),
  (4) plugin-agent-federation `bindHost` default is 127.0.0.1.

ADR update
- `ADR-166` status: Proposed → Accepted (Phase 0-3 shipped).
- Reporter acknowledgement pinned to the ADR authors block (name held
  until GHSA + CVE are published; will be credited by name there).
- §9.1 post-remediation table added — each of the 9 acceptance
  criteria mapped to the verification method and result.

Local verification (2026-06-30, before push)
- `node test-security-lock.js`         → 12/12 ✅ (6 × 2 bridges)
- `node test-runtime-security.mjs`     → 12/12 ✅ (R1-R5b × 2 bridges)

Explicitly deferred to a follow-up
- §6 Phase 3a (scoped per-backend env allowlist). Requires enumerating
  every backend's key requirements first; #6 in §9.1 acceptance is
  flagged ⏳ deferred rather than ✅.
- §7 Q1 (chat-ui → bridge token transport). Recommend Docker secret +
  nginx-injected header; unblocked by this commit but not landed here.
- §7 Q2 (npx/CLI bridge path shares the gate). Confirmed the source
  file exercised here IS the shipping one; the CLI code path also
  imports `app.use(requireAuth)` because it re-exports the same
  `main()`. Explicit CLI-path CI check to follow.

Contributor thanks
- The external security researcher (name held until embargo lifts)
  produced a full 8-step PoC + video that made the chain concrete
  end-to-end. Without step 5 (AgentDB pattern-store poisoning) we
  would have shipped only the network fix and skipped Phase 0c
  (audit + purge the learning store) which patched code alone does
  not cover.
- Dragan Spiridonov, co-author of ADR-166.

Co-Authored-By: RuFlo <ruv@ruv.net>

---------

Co-authored-by: Dragan Spiridonov <spiridonovdragan@gmail.com>
Co-authored-by: Dragan Spiridonov <dragan@spiridonov.dev>
 2026-07-01 10:31:21 -04:00
rUv 15664e0727 fix: v3.5.5-v3.5.7 platform parity, branding, stdin timeout (#1301) 
* fix: v3.5.5–v3.5.7 platform parity, branding, stdin timeout, settings completeness

Covers three releases published to npm:

v3.5.5 — Complete branding sweep
- Replace all "Claude Flow V3" with "RuFlo V3" across 30+ CLI source and helper files
- Fix Windows PS1 daemon manager, BAT wrapper, statusline branding
- Fix config.yaml header, CAPABILITIES.md, JSDoc, SQL schema comments

v3.5.6 — Platform parity and settings completeness
- Fix macOS daemon death on terminal close (SIGHUP handler in foreground mode)
- Fix Windows daemon spawn (shell:true, windowsHide:true, no detached flag)
- Fix PID file write order (write after child.unref() + 100ms delay)
- Add 4 missing hooks to settings-generator: PostToolUse:Bash, PreToolUse:Write|Edit|MultiEdit, SubagentEnd, Notification
- Rename "Worker Daemon" to "RuFlo Daemon"

v3.5.7 — Hook stdin timeout fix
- Replace `for await` stdin with event-based + 500ms timeout in hook-handler.cjs
- Prevents hanging when Claude Code leaves stdin in ambiguous state (not TTY, not pipe)
- Update helpers-generator.ts template with same fix

Also:
- Add Nginx reverse proxy service to ruflo docker-compose for Chat UI branding
- Update ADR-060: 13/24 items fixed, all P0/P1 resolved

Co-Authored-By: claude-flow <ruv@ruv.net>

* fix: update pnpm-lock.yaml for agentic-flow dependency

The lockfile specifiers were out of sync with @claude-flow/cli/package.json
after agentic-flow was added, causing CI frozen-lockfile failures.

Co-Authored-By: claude-flow <ruv@ruv.net>
 2026-03-05 15:26:17 -05:00
rUv 29d52dfc22 feat(ruflo): add RuFlo Chat UI with ruvocal fork, MCP bridge, and Docker setup 
Adds the complete RuFlo Chat UI system based on a SvelteKit fork (ruvocal)
of HuggingFace Chat UI with custom branding, RVF document store replacing
MongoDB, MCP bridge with 200+ tools, animated RuFloUniverse welcome screen,
and Docker Compose orchestration.

Key changes:
- RVF JSON document store with ObjectId cross-package compatibility fix
- MCP bridge proxy (Express) supporting Gemini, OpenAI, and tool execution
- RuFlo branding: Logo, favicons, welcome animation, centered dot cluster
- URL safety patch for Docker-internal HTTP service names
- CORS fix via relative PUBLIC_ORIGIN asset paths

Co-Authored-By: claude-flow <ruv@ruv.net>
 2026-03-05 18:01:09 +00:00