admin/ruflo
1
0 Fork 0
mirror of https://github.com/ruvnet/ruflo.git synced 2026-11-03 10:37:24 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
fix/console-cli-cold-start
ruflo/v3/@claude-flow/cli-core
T
History
ruv 7307d1d86a chore(release): move 18 internal leaf packages from alpha to stable semver 
Every @claude-flow/* leaf still on X.Y.Z-alpha.N moves to its stable X.Y.Z
(3.0.0, cli-core 3.7.0, the two plugins 1.0.0), matching the public train's
move to stable at 3.7.0. @claude-flow/embeddings is deliberately excluded:
its registry `latest` (3.0.0-alpha.45) was built from a branch not on main,
and publishing from main would drop 139 exported names.

Validated before publish:
- API surface: each package's main build compared against its published
  `latest` tarball (files, exports/bin keys, exported names). All 18 are
  equal-or-superset; no export removed.
- Every package builds; ~7.8k tests across 17 suites pass (cli-core has no
  suite of its own and is exercised through the CLI's).

Packaging fixes made along the way:
- publishConfig.tag v3alpha/alpha removed so stable versions land on
  `latest` rather than only the legacy channel tag.
- `files` allowlists (dist + README) on the 7 packages that had none. Their
  published tarballs shipped local runtime state: .claude-flow daemon logs
  and pids, settings.json, .swarm/memory.db, headless-worker prompt logs.
  A secret scan of every affected published version found no credentials.
  mcp shrinks from 335 files to 70, and no longer ships the .claude/
  helpers copy that #3411 concerned.
- plugins/providers/testing pointed every `types` condition at a
  nonexistent `.d.js` file; now `.d.ts`, so consumer type resolution works.
- Removed three subpath exports whose targets were never built (plugins
  ./examples/*, performance ./benchmarks/*); they could only throw
  ERR_MODULE_NOT_FOUND.
- Intra-leaf ranges normalised to ^<stable>, including a `file:../security`
  and a `workspace:*` devDependency that npm publish would ship verbatim.

Security: harden attention toSQL against injection (plugins)
The 13 attention SQL builders interpolated caller-supplied vectors and
config values into SQL that AttentionExecutor executes. TypeScript types do
not exist at runtime, so a string element could break out of the quoted
vector literal. Every interpolated value is now proven finite-numeric or
boolean. A differential run of 195 legitimate inputs across all 13
mechanisms produced byte-identical SQL; the new test fails 11/13 on the
original code (which emitted DROP TABLE for 5 payloads) and passes 13/13.

Co-Authored-By: RuFlo <ruv@ruv.net>
2026-09-28 16:54:24 -04:00
..
scripts
feat(cli-core): split cli into cli-core (lite) + cli (umbrella) — alpha.5 (#1764)
2026-05-05 13:44:01 -04:00
src
dream(security): #3384 add PATH/search-path family to validateEnv() denylist (evaluated, ACCEPT-scoped) (#3385)
2026-09-26 10:07:43 -05:00
MIGRATION.md
feat(cli-core): split cli into cli-core (lite) + cli (umbrella) — alpha.5 (#1764)
2026-05-05 13:44:01 -04:00
package.json
chore(release): move 18 internal leaf packages from alpha to stable semver
2026-09-28 16:54:24 -04:00
README.md
release(alpha.43+44): pin neural→sona@0.1.5, republish modules w/ standalone READMEs, add npm download badges everywhere (#2022)
2026-05-16 16:46:34 -04:00
tsconfig.json
feat(cli-core): split cli into cli-core (lite) + cli (umbrella) — alpha.5 (#1764)
2026-05-05 13:44:01 -04:00

README.md

@claude-flow/cli-core

npm version npm downloads License: MIT

Status: alpha (pre-release). Tracking ADR-100. Don't depend on this in production yet.

Lightweight core CLI surface for Claude Flow — memory + hooks commands only. Designed to load fast on a cold npx cache so plugin skills don't race Claude Code's 30 second MCP-startup timeout.

Why a separate package?

Issue #1748 #3 documented a silent failure mode for new users: npx claude-flow@latest mcp start from a cold npx cache regularly exceeds 30 seconds (1.8 MB / 999 files), Claude Code's MCP startup timeout fires, zero tools register, and the user observes "Ruflo is broken — no MCP tools available."

@claude-flow/cli-core is a ≤250 KB packed subset containing only what plugin skills actually call: memory store/list/retrieve/search/delete/init and the hooks family (route, model-outcome, post-edit, pre-task, etc.). On a cold cache, npx @claude-flow/cli-core@alpha memory store ... should complete in under 5 seconds — well under the timeout.

Install

# Pre-release alpha
npm install @claude-flow/cli-core@alpha

# Or just npx-invoke directly from a plugin Bash block
npx @claude-flow/cli-core@alpha memory store --key x --value 1 --namespace patterns

What's included

Category Commands
memory store, list, retrieve, search, delete, init, migrate, stats, configure, cleanup, compress, export, import
hooks route, pre-task, post-task, pre-edit, post-edit, pre-command, post-command, model-outcome, model-route, model-stats, worker-*, intelligence_*, plus 12 background-worker dispatchers

What's NOT included (use @claude-flow/cli for these)

  • swarm, hive-mind, agent, task, coordination — multi-agent orchestration
  • neural, embeddings, intelligence — full ML surface
  • federation, claims, aidefence — cross-installation features
  • browser, wasm, rvf — sandbox + browser automation
  • init, migrate, doctor, daemon, deployment — lifecycle management
  • performance, security, providers, plugins, config — admin surface

For any of these, install @claude-flow/cli@alpha (the metapackage that re-exports cli-core and lazy-loads everything else).

Compatibility

@claude-flow/cli-core@3.7.0-alpha.x ships in lockstep with @claude-flow/cli@3.7.0-alpha.x. Once promoted from alpha → latest, the two packages will continue to share the major.minor line.

Verification

# Cold cache test — clear npx cache first
rm -rf ~/.npm/_npx
time npx @claude-flow/cli-core@alpha memory store --key smoke --value test --namespace test
# Expected: <5 seconds wall-time on typical broadband

Documentation

License

MIT

Reference in new issue View Git Blame Copy Permalink