admin/ruflo
1
0 Fork 0
mirror of https://github.com/ruvnet/ruflo.git synced 2026-11-09 14:04:06 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
4efb421e33f3204d8421e2407a3aaa4e08f2edfc
ruflo/package.json
T
rUvandr 1b31914579 feat(ruflo-rure): new reverse-engineering plugin, Phase 1 (JS/Electron static analysis) (#4396) 
* docs(ruflo-rure): ADR-0001 scope/dual-use policy, ADR-0002 Phase 1 architecture

Fixes #4395 (part 1 — research/planning phase)

Co-Authored-By: RuFlo <ruv@ruv.net>

* feat(ruflo-rure): Phase 1 implementation — JS/Electron static analysis

Implements the plugin scaffold (manifest, skill, command, agent, smoke
test, benchmark) and the three Phase 1 MCP tools per ADR-0001/0002:

- rure_extract_asar: resource-capped .asar extraction via @electron/asar,
  checking the archive header's declared size/file count before writing
  anything (decompression-bomb guard).
- rure_analyze_js_app: TypeScript-compiler-API-based static analysis —
  import/export graph, Electron process-boundary detection (ipcMain/
  ipcRenderer/contextBridge, require("electron"), nodeIntegration flags),
  every finding evidence-sourced to file + line range.
- rure_find_feature: deterministic lexical/structural feature search,
  explicitly not semantic/LLM matching.

Every extracted string is routed through the AIDefence content gate
before being returned; flagged content is redacted, never dropped
silently. Parses only — never executes analyzed code, independently
verified by scripts/smoke.mjs grepping the real source (comments
stripped first, so the doc comment describing the property can't trip
its own check).

27 new tests, all passing. Typecheck clean. Tool-description audit
(ADR-112) clean. Benchmark: ~3.6k-18k files/s on a synthetic Electron
bundle (plugins/ruflo-rure/scripts/benchmark.ts).

Trust tier: experimental. Marketplace/directory submission is a
separate, explicit decision, not part of this change (ADR-0001).

Part of #4395.

Co-Authored-By: RuFlo <ruv@ruv.net>

* feat(console): add ruflo-rure to the plugin map (devtools section)

Every plugin directory needs a line in PLUGIN_MAP or the console's own
plugin-coverage test fails. ruflo-rure lands in devtools, same section
as the other inspection/analysis plugins (ruflo-browser, ruflo-jujutsu,
ruflo-testgen).

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(ruflo-rure): fix CI failures — real deps, capability-brain classification

Three real bugs surfaced by PR #4396's CI, not flakes:

- typescript was only a devDependency of @claude-flow/cli, but
  src/rure/ts-walk.ts needs it at runtime. Moved to dependencies.
  (CI: "Cannot find package 'typescript'" in a from-source install.)
- @claude-flow/aidefence was never declared as a dependency of
  @claude-flow/cli at all (only resolvable locally via monorepo
  hoisting), so the AIDefence gate silently no-op'd in CI's isolated
  install. Added as an optionalDependency, matching the existing
  graceful-degradation code path and the browser_act precedent this
  also fixes.
- capability-brain.ts classified every registered MCP tool into a
  domain by prefix; the three new rure_* tools had no domain, so
  guidance-brain.test.ts's "classifies every live registered tool"
  assertion failed. Added a 'reverse-engineering' domain (experimental
  maturity, matching ADR-0001's trust tier) and its package-owner
  lookup entry.

All 35 rure + guidance-brain tests pass; typecheck clean;
audit-tool-descriptions and audit-cli-mcp-tools clean.

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(ruflo-rure): revert @claude-flow/aidefence optionalDependency, mock it in tests instead

Reverts the optionalDependency added in 2570cf39d — it's on the #2561
forbidden-heavy-optionalDependencies list (CI's "Enforce CLI + ruflo
optionalDependencies budget" guard caught it): adding it back to
@claude-flow/cli regresses the cold `npx -y @claude-flow/cli@alpha
--version` startup time that #2561 fixed.

gateWithAIDefence's dynamic import was always meant to be speculative
— present only if something else in the install graph happens to pull
it in, same as the existing (unexported) copy in
browser-intent-tools.ts, which never declares it as a dependency
either. The real fix for "my tests need deterministic flagging
behavior" is mocking the module boundary, not forcing the real
optional package to be installed. Both rure-aidefence-gate.test.ts and
rure-tools.test.ts now vi.mock('@claude-flow/aidefence', ...), matching
the precedent in issue-2670-security-defend.test.ts. Added one more
test asserting graceful pass-through (not a thrown error) when the
module genuinely isn't resolvable.

36/36 rure + guidance-brain tests pass; typecheck clean; CLI
optionalDependencies back to 12 (budget 13), no forbidden entries.

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(ruflo-rure): alias typescript/@electron/asar in the isolated analyze-command test

analyze-json-output.test.ts runs analyzeCommand in a fully isolated temp
directory (scrubbed PATH/HOME/TMPDIR, no real node_modules reachable),
resolving only the handful of packages it explicitly aliases to this
package's own resolved paths (vitest, semver, bcryptjs, zod, plus the
cli-core/security source trees). The capability-brain / mcp-tools
registry analyzeCommand transitively loads now reaches rure-tools.ts,
so the same treatment is needed for its two real dependencies:
typescript (compiler API, src/rure/ts-walk.ts) and @electron/asar
(src/rure/extract-asar.ts) — both aliased to requireHere.resolve(...),
matching the existing zod/semver/bcryptjs pattern exactly. This is the
sanctioned mechanism this test already uses for a dependency it
genuinely needs to execute; it's unrelated to the heavy-package
absence assertions earlier in the same file (ruvector, agentic-flow,
@huggingface/transformers, etc.), which stay untouched.

20/20 analyze-json-output tests pass; full rure + guidance-brain suite
(56 tests) passes alongside it in the same run.

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(ruflo-rure): memoize the aidefence module resolution, make gateAll sequential

CI's "Test V3 Packages" job reproducibly failed exactly one test —
gateAll's "preserves order and length across mixed benign/flagged
input" — twice, while every other mock-dependent test in the same file
passed both times. gateAll was the only caller that resolves
@claude-flow/aidefence via several concurrent gateWithAIDefence calls
(Promise.all over the input array); every other test calls it once.
In CI, @claude-flow/aidefence is genuinely absent from node_modules
(confirmed by this job's own "@claude-flow/aidefence not loadable"
log line elsewhere in the same run) — unlike this dev environment,
where it's pnpm-hoisted and physically present, just mocked over.

Fix: memoize the dynamic import behind a single shared promise, so
concurrent callers all await the same resolution attempt instead of
each firing their own against a module vi.mock has to intercept
without a real file backing it. Also made gateAll sequential as
defense in depth — gating is cheap, and there's no reason multiple
calls need to race the first-ever resolution attempt at all.

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(ruflo-rure): add @electron/asar to the root package.json for CI's Test Suite job

Root CI's "Test Suite" job never installs v3/'s own pnpm workspace —
it runs `npm ci` at repo root only, then runs vitest from repo root
against v3/@claude-flow/cli/__tests__/*. Module resolution for those
test files walks up from v3/@claude-flow/cli (no node_modules there in
this job) through v3/ (also none) to the repo root's node_modules,
which is why `typescript` already resolved (already a root
devDependency, for an unrelated reason) while `@electron/asar` did
not (never referenced anywhere in the root tree before this).

Added @electron/asar to the root dependencies, matching how zod/ws
are already placed there for the same reason, and regenerated
package-lock.json. The regen also synced two pieces of real,
pre-existing lockfile staleness this surfaced: the recorded root
version (3.58.0, several releases behind the actual 3.59.17) and a
leftover `toml` dependency entry (removed from package.json before
this PR, but never swept from the lockfile until this install).

Verified against CI's actual invocation shape: `node
node_modules/vitest/vitest.mjs run v3/@claude-flow/cli/__tests__/rure-*`
from repo root, not just the v3-workspace-scoped `npx vitest run` I'd
been using to verify until now.

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(ruflo-rure): lazy-load the TypeScript compiler instead of a top-level import

ts-walk.ts statically imported `typescript` at module scope. Since
rure-tools.ts is registered into mcp-client.ts's shared tool list, every
CLI invocation loaded the full TypeScript compiler into memory at
startup, not just commands that use ruRE — the same failure shape as the
#2561 cold-start regression (@claude-flow/aidefence).

This also explains three straight CI failures on the exact same file
(mods-cli-bin.test.ts, which exec's the built CLI's `init` through
execFileSync): the heavier startup made it the most likely victim of the
repo's known tinypool worker-crash flake under CI's resource limits.

Fix: import type-only `typescript` for AST types, and lazy-load the real
module (memoized) inside analyzeModuleSource, matching the pattern
already used by aidefence-gate.ts and extract-asar.ts. This makes
analyzeModuleSource/analyzeJsApp/findFeature async; updated their two
call sites in rure-tools.ts and the benchmark script, plus the test
files's call sites.

Verified: `node bin/cli.js --version` succeeds with node_modules/typescript
physically removed (previously would have crashed), confirming the
compiler is no longer loaded on every invocation.

Co-Authored-By: RuFlo <ruv@ruv.net>

---------

Co-authored-by: r <r@x>
2026-10-22 17:45:55 -04:00

229 lines
6.5 KiB
JSON
Raw Blame History

{
"name": "claude-flow",
"version": "3.59.17",
"workspaces": [
"v3/@claude-flow/codex",
"v3/@claude-flow/mcp",
"v3/@claude-flow/plugin-agent-federation",
"v3/@claude-flow/security"
],
"description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
"main": "dist/index.js",
"type": "module",
"bin": {
"claude-flow": "bin/cli.js"
},
"homepage": "https://github.com/ruvnet/claude-flow#readme",
"bugs": {
"url": "https://github.com/ruvnet/claude-flow/issues",
"email": "support@ruv.io"
},
"funding": {
"type": "github",
"url": "https://github.com/sponsors/ruvnet"
},
"files": [
"bin/**",
"v3/@claude-flow/cli/bin/**",
"v3/@claude-flow/cli/dist/**/*.js",
"v3/@claude-flow/cli/dist/**/*.d.ts",
"!v3/@claude-flow/cli/dist/**/*.map",
"v3/@claude-flow/cli/package.json",
"v3/@claude-flow/cli/catalog-manifest.json",
"v3/@claude-flow/cli/templates/**",
"v3/@claude-flow/shared/dist/**/*.js",
"v3/@claude-flow/shared/dist/**/*.d.ts",
"!v3/@claude-flow/shared/dist/**/*.map",
"v3/@claude-flow/shared/package.json",
"v3/@claude-flow/guidance/dist/**/*.js",
"v3/@claude-flow/guidance/dist/**/*.d.ts",
"!v3/@claude-flow/guidance/dist/**/*.map",
"v3/@claude-flow/guidance/package.json",
".claude-plugin/**",
".claude/**",
"!.claude/**/*.db",
"!.claude/**/*.map",
"!.claude/worktrees/**",
"!.claude/projects/**",
"!.claude/scheduled_tasks.lock",
"!.claude/sessions/**",
"README.md",
"LICENSE"
],
"scripts": {
"dev": "tsx watch src/index.ts",
"build": "tsc",
"build:ts": "cd v3/@claude-flow/cli && npm run build || true",
"prepublishOnly": "node scripts/prepare-root-publish.mjs",
"test": "vitest",
"e2e": "node scripts/e2e/host-matrix.mjs",
"e2e:live": "RUFLO_E2E_LIVE=1 node scripts/e2e/host-matrix.mjs --live",
"test:ui": "vitest --ui",
"test:security": "vitest run v3/__tests__/security/",
"lint": "cd v3/@claude-flow/cli && npm run lint || true",
"security:audit": "npm audit --audit-level high",
"security:fix": "npm audit fix",
"security:test": "npm run test:security",
"v3:domains": "npm run build:domains",
"v3:swarm": "npm run start:swarm",
"v3:security": "npm run security:audit && npm run security:test"
},
"dependencies": {
"@claude-flow/cli-core": "3.7.5",
"@claude-flow/codex": "3.0.5",
"@claude-flow/mcp": "3.1.1",
"@claude-flow/neural": "3.0.0",
"@claude-flow/plugin-agent-federation": "1.0.1",
"@claude-flow/security": "3.0.5",
"@claude-flow/shared": "3.0.5",
"@electron/asar": "^4.3.1",
"@iarna/toml": "^2.2.5",
"@noble/ed25519": "2.3.0",
"@ruvector/rabitq-wasm": "0.1.0",
"ajv": "^8.20.0",
"bcryptjs": "^3.0.3",
"chalk": "^5.3.0",
"commander": "^12.0.0",
"cors": "^2.8.5",
"fs-extra": "^11.2.0",
"express": ">=4.22.2",
"express-rate-limit": ">=8.4.1",
"fast-uri": "^3.1.6",
"helmet": "^7.2.0",
"inquirer": "^9.2.0",
"semver": "7.7.3",
"ws": ">=8.21.0",
"yaml": "^2.8.0",
"zod": "3.25.76"
},
"optionalDependencies": {
"@napi-rs/keyring": "1.3.0",
"@claude-flow/plugin-gastown-bridge": "^0.1.3",
"@ruvector/attention": "^0.1.3",
"@ruvector/core": "^0.1.30",
"@ruvector/router": "^0.1.31",
"@ruvector/router-linux-x64-gnu": "^0.1.31",
"@ruvector/sona": "^0.1.5",
"agentdb": "^3.0.0-alpha.20",
"agentic-flow": "^2.0.14",
"better-sqlite3": "12.9.0"
},
"overrides": {
"ruvector": "^0.2.27",
"better-sqlite3": "12.9.0",
"js-yaml": ">=4.3.0",
"hono": ">=4.13.2",
"@ruvector/rvf-wasm": "0.1.5",
"@ruvector/rvf": "0.3.4",
"@hono/node-server": ">=2.1.1",
"flatted": ">=3.4.0",
"tar": ">=7.5.11",
"picomatch": ">=4.0.3",
"path-to-regexp": ">=8.2.1",
"undici": ">=8.10.0",
"minimatch": ">=10.0.0",
"@isaacs/brace-expansion": ">=5.0.1",
"cacache": ">=20.0.0",
"make-fetch-happen": ">=15.0.0",
"express-rate-limit": ">=8.4.1",
"express": ">=4.22.2",
"tinypool": ">=2.1.2",
"qs": ">=6.15.2",
"protobufjs": ">=8.7.2",
"uuid": ">=14.0.0",
"@opentelemetry/core": ">=2.8.0",
"@opentelemetry/resources": ">=2.8.0",
"@opentelemetry/sdk-trace-base": ">=2.8.0",
"@opentelemetry/sdk-node": ">=0.220.0",
"@opentelemetry/auto-instrumentations-node": ">=0.75.0",
"@opentelemetry/exporter-prometheus": ">=0.220.0",
"@opentelemetry/exporter-trace-otlp-grpc": ">=0.220.0",
"@opentelemetry/exporter-trace-otlp-http": ">=0.220.0",
"@opentelemetry/exporter-trace-otlp-proto": ">=0.220.0",
"@opentelemetry/otlp-exporter-base": ">=0.220.0",
"@opentelemetry/otlp-grpc-exporter-base": ">=0.220.0",
"@opentelemetry/otlp-transformer": ">=0.220.0",
"axios": ">=1.19.0",
"fast-uri": "$fast-uri",
"vite": ">=8.0.16",
"ws": ">=8.21.0",
"@grpc/grpc-js": ">=1.14.4",
"form-data": ">=4.0.6",
"http-proxy-middleware": ">=3.0.7",
"@ruvector/ruvllm": ">=2.6.0"
},
"devDependencies": {
"@openai/codex": "^0.98.0",
"@types/bcrypt": "^5.0.2",
"@types/node": "^20.0.0",
"esbuild": "^0.27.2",
"eslint": "^8.0.0",
"tsx": "^4.21.0",
"typescript": "^5.0.0",
"vitest": "^3.2.6"
},
"pnpm": {
"overrides": {
"better-sqlite3": "12.9.0"
}
},
"engines": {
"node": ">=20.0.0"
},
"repository": {
"type": "git",
"url": "git+https://github.com/ruvnet/claude-flow.git"
},
"keywords": [
"ruvflow",
"claude",
"claude-code",
"anthropic",
"ai",
"ai-agents",
"multi-agent",
"agent-orchestration",
"swarm-intelligence",
"swarm",
"mcp",
"model-context-protocol",
"llm",
"large-language-model",
"gpt",
"chatgpt",
"automation",
"workflow",
"orchestration",
"cli",
"developer-tools",
"devtools",
"coding-assistant",
"code-generation",
"enterprise",
"vector-database",
"embeddings",
"machine-learning",
"neural-network",
"hive-mind",
"distributed-systems",
"consensus",
"self-learning"
],
"author": "RuvNet <ruv@ruv.io> (https://ruv.io)",
"license": "MIT",
"publishConfig": {
"access": "public",
"tag": "latest"
},
"bundleDependencies": [
"@claude-flow/codex",
"@claude-flow/mcp",
"@claude-flow/plugin-agent-federation",
"@claude-flow/security"
],
"directories": {
"doc": "docs",
"test": "tests"
}
}
Reference in new issue View Git Blame Copy Permalink