mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-09 05:35:21 +09:00
ruv
7307d1d86a
Every @claude-flow/* leaf still on X.Y.Z-alpha.N moves to its stable X.Y.Z (3.0.0, cli-core 3.7.0, the two plugins 1.0.0), matching the public train's move to stable at 3.7.0. @claude-flow/embeddings is deliberately excluded: its registry `latest` (3.0.0-alpha.45) was built from a branch not on main, and publishing from main would drop 139 exported names. Validated before publish: - API surface: each package's main build compared against its published `latest` tarball (files, exports/bin keys, exported names). All 18 are equal-or-superset; no export removed. - Every package builds; ~7.8k tests across 17 suites pass (cli-core has no suite of its own and is exercised through the CLI's). Packaging fixes made along the way: - publishConfig.tag v3alpha/alpha removed so stable versions land on `latest` rather than only the legacy channel tag. - `files` allowlists (dist + README) on the 7 packages that had none. Their published tarballs shipped local runtime state: .claude-flow daemon logs and pids, settings.json, .swarm/memory.db, headless-worker prompt logs. A secret scan of every affected published version found no credentials. mcp shrinks from 335 files to 70, and no longer ships the .claude/ helpers copy that #3411 concerned. - plugins/providers/testing pointed every `types` condition at a nonexistent `.d.js` file; now `.d.ts`, so consumer type resolution works. - Removed three subpath exports whose targets were never built (plugins ./examples/*, performance ./benchmarks/*); they could only throw ERR_MODULE_NOT_FOUND. - Intra-leaf ranges normalised to ^<stable>, including a `file:../security` and a `workspace:*` devDependency that npm publish would ship verbatim. Security: harden attention toSQL against injection (plugins) The 13 attention SQL builders interpolated caller-supplied vectors and config values into SQL that AttentionExecutor executes. TypeScript types do not exist at runtime, so a string element could break out of the quoted vector literal. Every interpolated value is now proven finite-numeric or boolean. A differential run of 195 legitimate inputs across all 13 mechanisms produced byte-identical SQL; the new test fails 11/13 on the original code (which emitted DROP TABLE for 5 payloads) and passes 13/13. Co-Authored-By: RuFlo <ruv@ruv.net>
31 lines
606 B
JSON
31 lines
606 B
JSON
{
|
|
"name": "@claude-flow/deployment",
|
|
"version": "3.0.0",
|
|
"type": "module",
|
|
"description": "Deployment module - Release management, CI/CD, versioning",
|
|
"main": "dist/index.js",
|
|
"types": "dist/index.d.ts",
|
|
"exports": {
|
|
".": "./dist/index.js"
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"README.md"
|
|
],
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"test": "vitest run",
|
|
"release": "semantic-release"
|
|
},
|
|
"dependencies": {
|
|
"@claude-flow/shared": "^3.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"semantic-release": "^25.0.2",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"publishConfig": {
|
|
"access": "public"
|
|
}
|
|
}
|