claude-flow

Completes the dream-cycle #2783 ADR-320 recommendation: Composition Inspector (v3.32.15) + ChannelGuard (this release).

Added

ruflo security channel-scan — deterministic (no LLM) inter-agent message scanner. arXiv 2607.19430: individually-safe LLM agents propagate injection payloads through inter-agent message channels; per-message safety checks pass at each hop. ChannelGuard closes the gap by scanning content at the routing boundary.

Four attack signatures:

1. Injection-phrase — shared 16-phrase catalog with composition-scan (new src/security/injection-catalog.ts; a phrase added there strengthens both surfaces).
2. Role-shift — system: / assistant: / user: markers appearing INSIDE the message body (start-of-message preambles allowed).
3. Encoded-payload — long base64/hex runs that could hide obfuscated instructions.
4. Zero-width/bidi unicode — U+200B, U+200C, U+200D, U+FEFF, U+202A-E, U+2066-9 — zero legitimate use in agent messages.

Usage:

ruflo security channel-scan -m "…message text…"
ruflo security channel-scan --message-file ./inbox/msg-1234.txt

Exit codes: 0 safe, 2 flagged — shell-integration friendly (channel-scan && forward skips flagged messages).

Verification

• Regression tests: 9/9 for ChannelGuard, 6/6 for Composition Inspector, 15/15 total.
• E2E on malicious message → 5 findings across 3 signature categories.
• E2E on benign handoff → SAFE, 0 findings.

Upgrade

npx ruflo@latest --version   # → 3.32.16

Refs: dream-cycle #2783.