mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-03 18:47:18 +09:00
ruv
7307d1d86a
Every @claude-flow/* leaf still on X.Y.Z-alpha.N moves to its stable X.Y.Z (3.0.0, cli-core 3.7.0, the two plugins 1.0.0), matching the public train's move to stable at 3.7.0. @claude-flow/embeddings is deliberately excluded: its registry `latest` (3.0.0-alpha.45) was built from a branch not on main, and publishing from main would drop 139 exported names. Validated before publish: - API surface: each package's main build compared against its published `latest` tarball (files, exports/bin keys, exported names). All 18 are equal-or-superset; no export removed. - Every package builds; ~7.8k tests across 17 suites pass (cli-core has no suite of its own and is exercised through the CLI's). Packaging fixes made along the way: - publishConfig.tag v3alpha/alpha removed so stable versions land on `latest` rather than only the legacy channel tag. - `files` allowlists (dist + README) on the 7 packages that had none. Their published tarballs shipped local runtime state: .claude-flow daemon logs and pids, settings.json, .swarm/memory.db, headless-worker prompt logs. A secret scan of every affected published version found no credentials. mcp shrinks from 335 files to 70, and no longer ships the .claude/ helpers copy that #3411 concerned. - plugins/providers/testing pointed every `types` condition at a nonexistent `.d.js` file; now `.d.ts`, so consumer type resolution works. - Removed three subpath exports whose targets were never built (plugins ./examples/*, performance ./benchmarks/*); they could only throw ERR_MODULE_NOT_FOUND. - Intra-leaf ranges normalised to ^<stable>, including a `file:../security` and a `workspace:*` devDependency that npm publish would ship verbatim. Security: harden attention toSQL against injection (plugins) The 13 attention SQL builders interpolated caller-supplied vectors and config values into SQL that AttentionExecutor executes. TypeScript types do not exist at runtime, so a string element could break out of the quoted vector literal. Every interpolated value is now proven finite-numeric or boolean. A differential run of 195 legitimate inputs across all 13 mechanisms produced byte-identical SQL; the new test fails 11/13 on the original code (which emitted DROP TABLE for 5 payloads) and passes 13/13. Co-Authored-By: RuFlo <ruv@ruv.net>
65 lines
1.4 KiB
JSON
65 lines
1.4 KiB
JSON
{
|
|
"name": "@claude-flow/testing",
|
|
"version": "3.0.0",
|
|
"type": "module",
|
|
"description": "Testing module - TDD London School framework, test utilities, fixtures, and mock services for V3 Claude-Flow",
|
|
"main": "dist/index.js",
|
|
"types": "dist/index.d.ts",
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"import": "./dist/index.js"
|
|
},
|
|
"./helpers": {
|
|
"types": "./dist/helpers/index.d.ts",
|
|
"import": "./dist/helpers/index.js"
|
|
},
|
|
"./fixtures": {
|
|
"types": "./dist/fixtures/index.d.ts",
|
|
"import": "./dist/fixtures/index.js"
|
|
},
|
|
"./mocks": {
|
|
"types": "./dist/mocks/index.d.ts",
|
|
"import": "./dist/mocks/index.js"
|
|
},
|
|
"./setup": {
|
|
"types": "./dist/setup.d.ts",
|
|
"import": "./dist/setup.js"
|
|
}
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"README.md"
|
|
],
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"test": "vitest run",
|
|
"typecheck": "tsc --noEmit"
|
|
},
|
|
"keywords": [
|
|
"claude-flow",
|
|
"testing",
|
|
"vitest",
|
|
"tdd",
|
|
"london-school",
|
|
"mocks",
|
|
"fixtures"
|
|
],
|
|
"peerDependencies": {
|
|
"@claude-flow/memory": "^3.0.0",
|
|
"@claude-flow/shared": "^3.0.0",
|
|
"@claude-flow/swarm": "^3.0.0",
|
|
"vitest": ">=4.0.16"
|
|
},
|
|
"devDependencies": {
|
|
"@claude-flow/memory": "^3.0.0",
|
|
"@claude-flow/shared": "^3.0.0",
|
|
"@claude-flow/swarm": "^3.0.0",
|
|
"typescript": "^5.3.0",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"publishConfig": {
|
|
"access": "public"
|
|
}
|
|
}
|