mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-05 19:47:19 +09:00
ruv
7307d1d86a
Every @claude-flow/* leaf still on X.Y.Z-alpha.N moves to its stable X.Y.Z (3.0.0, cli-core 3.7.0, the two plugins 1.0.0), matching the public train's move to stable at 3.7.0. @claude-flow/embeddings is deliberately excluded: its registry `latest` (3.0.0-alpha.45) was built from a branch not on main, and publishing from main would drop 139 exported names. Validated before publish: - API surface: each package's main build compared against its published `latest` tarball (files, exports/bin keys, exported names). All 18 are equal-or-superset; no export removed. - Every package builds; ~7.8k tests across 17 suites pass (cli-core has no suite of its own and is exercised through the CLI's). Packaging fixes made along the way: - publishConfig.tag v3alpha/alpha removed so stable versions land on `latest` rather than only the legacy channel tag. - `files` allowlists (dist + README) on the 7 packages that had none. Their published tarballs shipped local runtime state: .claude-flow daemon logs and pids, settings.json, .swarm/memory.db, headless-worker prompt logs. A secret scan of every affected published version found no credentials. mcp shrinks from 335 files to 70, and no longer ships the .claude/ helpers copy that #3411 concerned. - plugins/providers/testing pointed every `types` condition at a nonexistent `.d.js` file; now `.d.ts`, so consumer type resolution works. - Removed three subpath exports whose targets were never built (plugins ./examples/*, performance ./benchmarks/*); they could only throw ERR_MODULE_NOT_FOUND. - Intra-leaf ranges normalised to ^<stable>, including a `file:../security` and a `workspace:*` devDependency that npm publish would ship verbatim. Security: harden attention toSQL against injection (plugins) The 13 attention SQL builders interpolated caller-supplied vectors and config values into SQL that AttentionExecutor executes. TypeScript types do not exist at runtime, so a string element could break out of the quoted vector literal. Every interpolated value is now proven finite-numeric or boolean. A differential run of 195 legitimate inputs across all 13 mechanisms produced byte-identical SQL; the new test fails 11/13 on the original code (which emitted DROP TABLE for 5 payloads) and passes 13/13. Co-Authored-By: RuFlo <ruv@ruv.net>
58 lines
1.7 KiB
JSON
58 lines
1.7 KiB
JSON
{
|
|
"name": "@claude-flow/cli-core",
|
|
"version": "3.7.0",
|
|
"description": "Lightweight core CLI surface for Claude Flow — memory + hooks commands only. Designed to load fast on cold npx cache (<5s) so plugin skills don't race the 30s MCP-startup timeout. The full @claude-flow/cli metapackage lazy-loads everything else on top of this core.",
|
|
"type": "module",
|
|
"main": "dist/src/index.js",
|
|
"types": "dist/src/index.d.ts",
|
|
"bin": {
|
|
"claude-flow-core": "dist/src/index.js"
|
|
},
|
|
"exports": {
|
|
".": "./dist/src/index.js",
|
|
"./output": "./dist/src/output.js",
|
|
"./types": "./dist/src/types.js",
|
|
"./memory": "./dist/src/memory/backend.js",
|
|
"./memory/json-backend": "./dist/src/memory/json-backend.js",
|
|
"./commands/memory": "./dist/src/commands/memory.js",
|
|
"./mcp-tools": "./dist/src/mcp-tools/index.js",
|
|
"./mcp-tools/types": "./dist/src/mcp-tools/types.js",
|
|
"./mcp-tools/validate-input": "./dist/src/mcp-tools/validate-input.js",
|
|
"./mcp-tools/memory-defs": "./dist/src/mcp-tools/memory-defs.js",
|
|
"./mcp-tools/hooks-defs": "./dist/src/mcp-tools/hooks-defs.js"
|
|
},
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"test": "vitest run"
|
|
},
|
|
"files": [
|
|
"dist/",
|
|
"README.md",
|
|
"LICENSE"
|
|
],
|
|
"keywords": [
|
|
"claude-flow",
|
|
"cli",
|
|
"core",
|
|
"lite",
|
|
"lazy-load",
|
|
"mcp",
|
|
"memory",
|
|
"hooks"
|
|
],
|
|
"author": {
|
|
"name": "ruvnet",
|
|
"url": "https://github.com/ruvnet"
|
|
},
|
|
"license": "MIT",
|
|
"homepage": "https://github.com/ruvnet/ruflo",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/ruvnet/ruflo.git",
|
|
"directory": "v3/@claude-flow/cli-core"
|
|
},
|
|
"publishConfig": {
|
|
"access": "public"
|
|
}
|
|
}
|