mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-03 02:27:38 +09:00
rUvandr
d8832d5512
toml@3.0.0 was declared as a direct dependency in three manifests (root package.json, @claude-flow/cli, @claude-flow/codex) but never imported anywhere in the codebase — @iarna/toml is the TOML parser actually used (e.g. @claude-flow/codex/src/dual-mode/orchestrator.ts). Confirmed via a real consumer install (`npm install ruflo@3.59.8` in a scratch project) that toml reaches end users through this unused dependency, carrying two unpatched high-severity advisories with no non-breaking fix available: - GHSA-82x6-q7mm-w9cf (Uncontrolled Recursion) - GHSA-v5mp-jgw5-2x6j (Prototype Pollution via __proto__ key-path desynchronization) Since the dependency is dead weight, removing it is strictly safer than bumping to a breaking major version of a package nothing calls. Co-authored-by: r <r@x>
118 lines
2.8 KiB
JSON
118 lines
2.8 KiB
JSON
{
|
|
"name": "@claude-flow/codex",
|
|
"version": "3.0.5",
|
|
"description": "Codex CLI integration for Ruflo (claude-flow) - OpenAI Codex platform adapter",
|
|
"type": "module",
|
|
"main": "./dist/index.js",
|
|
"types": "./dist/index.d.ts",
|
|
"bin": {
|
|
"claude-flow-codex": "dist/cli.js"
|
|
},
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"import": "./dist/index.js",
|
|
"require": "./dist/index.js",
|
|
"default": "./dist/index.js"
|
|
},
|
|
"./generators": {
|
|
"types": "./dist/generators/index.d.ts",
|
|
"import": "./dist/generators/index.js",
|
|
"require": "./dist/generators/index.js"
|
|
},
|
|
"./templates": {
|
|
"types": "./dist/templates/index.d.ts",
|
|
"import": "./dist/templates/index.js",
|
|
"require": "./dist/templates/index.js"
|
|
},
|
|
"./migrations": {
|
|
"types": "./dist/migrations/index.d.ts",
|
|
"import": "./dist/migrations/index.js",
|
|
"require": "./dist/migrations/index.js"
|
|
},
|
|
"./dual-mode": {
|
|
"types": "./dist/dual-mode/index.d.ts",
|
|
"import": "./dist/dual-mode/index.js",
|
|
"require": "./dist/dual-mode/index.js"
|
|
},
|
|
"./loop": {
|
|
"types": "./dist/loop/index.d.ts",
|
|
"import": "./dist/loop/index.js",
|
|
"require": "./dist/loop/index.js"
|
|
},
|
|
"./worktrees": {
|
|
"types": "./dist/worktrees/index.d.ts",
|
|
"import": "./dist/worktrees/index.js",
|
|
"require": "./dist/worktrees/index.js"
|
|
},
|
|
"./harness": {
|
|
"types": "./dist/harness/index.d.ts",
|
|
"import": "./dist/harness/index.js",
|
|
"require": "./dist/harness/index.js"
|
|
}
|
|
},
|
|
"files": [
|
|
"dist",
|
|
".agents/skills"
|
|
],
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"dev": "tsc --watch",
|
|
"lint": "eslint src --ext .ts",
|
|
"test": "vitest",
|
|
"prepublishOnly": "npm run build"
|
|
},
|
|
"keywords": [
|
|
"codex",
|
|
"openai",
|
|
"claude-flow",
|
|
"coflow",
|
|
"agents",
|
|
"skills",
|
|
"AGENTS.md",
|
|
"agentic-ai"
|
|
],
|
|
"author": "rUv",
|
|
"license": "MIT",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/ruvnet/ruflo.git",
|
|
"directory": "v3/@claude-flow/codex"
|
|
},
|
|
"homepage": "https://github.com/ruvnet/ruflo#readme",
|
|
"bugs": {
|
|
"url": "https://github.com/ruvnet/ruflo/issues"
|
|
},
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"peerDependencies": {
|
|
"@claude-flow/cli": "^3.0.0"
|
|
},
|
|
"peerDependenciesMeta": {
|
|
"@claude-flow/cli": {
|
|
"optional": true
|
|
}
|
|
},
|
|
"dependencies": {
|
|
"commander": "^12.0.0",
|
|
"fs-extra": "^11.2.0",
|
|
"chalk": "^5.3.0",
|
|
"inquirer": "^9.2.0",
|
|
"yaml": "^2.4.0",
|
|
"@iarna/toml": "^2.2.5",
|
|
"@claude-flow/security": "^3.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/fs-extra": "^11.0.4",
|
|
"@types/node": "^20.0.0",
|
|
"typescript": "^5.4.0",
|
|
"vitest": "^4.1.0",
|
|
"eslint": "^8.57.0"
|
|
},
|
|
"publishConfig": {
|
|
"access": "public",
|
|
"tag": "latest"
|
|
}
|
|
}
|