admin/ruflo
1
0 Fork 0
mirror of https://github.com/ruvnet/ruflo.git synced 2026-10-23 03:47:00 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
745dfbe32756c62db3c686c53661b2ec57c74d4f
ruflo/package.json
T
rUv 745dfbe327 fix(security): dedup better-sqlite3 to patched 12.9.0 across dependency tree (#2736) (#2746) 
* fix(security): dedup better-sqlite3 to patched 12.9.0 across dependency tree

Fixes #2736 (defense-in-depth mitigation).

SQLite's documented WAL-Reset Bug (sqlite.org/wal.html §11) is a race
between overlapping checkpoint operations and a WAL-resetting commit
that can make a later checkpoint skip a committed transaction, silently
losing acknowledged writes and/or corrupting index/table structure.
Affects SQLite 3.7.0-3.51.2; fixed in 3.51.3, backported to 3.44.6 and
3.50.7.

agentdb's own published dependency floor (`better-sqlite3@^11.8.1`,
confirmed in this tree resolving to 11.10.0, which bundles vulnerable
SQLite 3.49.2) created a mixed-engine tree alongside this repo's own
direct dependency on better-sqlite3 12.9.0 (patched SQLite 3.53.0, via
v3/@claude-flow/memory). Multiple concurrent connections (daemon, MCP
servers, CLI invocations) issuing wal_checkpoint(PASSIVE) after every
memory-bridge store is exactly the race precondition this bug requires.

This forces a single deduplicated better-sqlite3 build tree-wide via
pnpm overrides, pinned to the exact version this repo's own
@claude-flow/memory package already depends on directly (12.9.0,
bundling patched SQLite 3.53.0) — no new version to vet, just true
deduplication of agentdb's nested resolution into the already-patched
copy.

Changes (following this repo's existing #2112-lesson override
convention — multiple package.json files, each consumed a different
way):
- v3/package.json: pnpm.overrides (the v3 pnpm workspace root — this
  is where agentdb's better-sqlite3@11.10.0 actually lived pre-fix)
- v3/@claude-flow/cli/package.json: npm-style overrides (effective
  when @claude-flow/cli is npm-installed standalone via npx)
- package.json (root "claude-flow" umbrella): bumped the existing
  ">=12.8.0" override to an exact "12.9.0" pin, AND added a
  pnpm.overrides block — the bare "overrides" key alone is silently
  ignored by pnpm (only read by npm), so the pre-existing override was
  a no-op for local `pnpm install` at repo root despite being present
  in package.json for a while
- ruflo/package.json: bumped ">=12.8.0" to exact "12.9.0" (npm-style,
  effective for `npx ruflo@latest`)
- v3/pnpm-lock.yaml, pnpm-lock.yaml: regenerated via `pnpm install`

Verification:
- `pnpm why -r better-sqlite3` (v3/) and `pnpm why better-sqlite3`
  (root): exactly one resolved version, 12.9.0, everywhere
- Confirmed via realpath resolution (not hoisted symlink) from each of
  the 4 installed agentdb versions' own on-disk directories
  (1.6.1, 2.0.0-alpha.3.4, 2.0.0-alpha.3.7, 3.0.0-alpha.17) that each
  now binds the same deduplicated better-sqlite3@12.9.0 copy
- `db.prepare('select sqlite_version()').get()` from that binding
  returns 3.53.0 (>= 3.51.3 patched floor)
- v3/@claude-flow/memory test suite: 438/442 passing; the 4 failures
  are pre-existing Windows path-separator and perf-threshold issues
  unrelated to SQLite (none of the failing test files touch
  better-sqlite3/sqlite at all)

Not fixed here (upstream, out of reach from this repo):
- agentdb's own published package.json floor (`^11.8.1`) is
  unchanged — this override is a same-repo mitigation, not a fix to
  agentdb itself. agentdb needs the same bump upstream.

Not touched here (explicitly out of scope, separate/riskier change):
- The wal_checkpoint(PASSIVE)-after-every-store pattern in
  memory-bridge.ts (#2558) is left as-is; the issue calls that
  "defense-in-depth" / optional, and dedup alone removes the
  mixed-engine race precondition regardless.

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(deps): regenerate package-lock.json for better-sqlite3 dedup override

package.json pins the better-sqlite3 override to 12.9.0 (patched,
fixes the WAL-reset bug) but package-lock.json still resolved a stray
top-level better-sqlite3@12.10.0 and was missing the nested
better-sqlite3@12.9.0 entries under @claude-flow/memory, agentdb, and
agentic-flow — causing npm ci to fail in CI with "Missing:
better-sqlite3@12.9.0 from lock file".

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(deps): restore better-sqlite3 as direct root optionalDependency

The #2736 dedup fix pinned better-sqlite3 to 12.9.0 via a pure
"overrides" entry (no direct dependency), which removed the top-level
hoisted node_modules/better-sqlite3 that used to exist under the
looser ">=12.8.0" override. That silently broke the "graph schema
smoke (ADR-130 P1)" CI job: its "npm rebuild better-sqlite3" step
(and graph-edge-writer.ts's bare `await import('better-sqlite3')`,
which Node resolves by walking up node_modules from the importing
file) had nothing at the root to rebuild/resolve, so _openDb() failed
closed and insertGraphEdge() silently returned false — 8/22 assertions
failing.

Restoring the direct optionalDependency (matching what this file
already had historically, before the override-only refactor) gives
npm a concrete anchor to hoist a single deduplicated copy back to
root node_modules, preserving the override's version pin while
keeping the graph-edge-writer's resolution path intact. Regenerated
package-lock.json accordingly.

Verified locally: `npm rebuild better-sqlite3` now finds and rebuilds
the root copy, and a direct insertGraphEdge() call against a real
better-sqlite3 handle returns true.

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(deps): resync v3/pnpm-lock.yaml specifier after merging main

Merging main (which carries #2748's direct better-sqlite3 dependency
on @claude-flow/cli) forward into this branch left the recorded
lockfile specifier at the pre-override "^12.9.0" while this branch's
own overrides.better-sqlite3 pin ("12.9.0", exact) is now the
effective spec pnpm resolves against — a one-line drift causing
`pnpm install --frozen-lockfile` to fail across the whole v3-ci.yml
matrix. Regenerated to match.

Co-Authored-By: RuFlo <ruv@ruv.net>

* fix(memory): force WAL checkpoint before close in graph-edge-writer

The "graph schema smoke (ADR-130 P1)" CI job started failing
deterministically on Linux runners after the better-sqlite3 dedup
(this branch) pinned a single 12.9.0 build tree-wide: TEST 2/3
insert-then-reread assertions found embedding_ref/source_id undefined
immediately after _resetBridgeDb() closed the write connection.

_resetBridgeDb()'s close() relied on SQLite's implicit "last
connection close" PASSIVE auto-checkpoint to flush the WAL into the
main file before a same-process sql.js reader re-reads the raw file.
That's best-effort, not guaranteed synchronous, and evidently more
prone to leaving data in the WAL under Linux CI's I/O/lock timing than
on Windows (did not reproduce locally). Not a correctness regression
in 12.9.0 itself — a latent timing assumption the dedup made newly
observable by changing which exact build backs every connection.

Force a blocking `wal_checkpoint(TRUNCATE)` before close so the main
file always reflects committed writes before any other reader (same
process or otherwise) touches it, regardless of platform timing.

Co-Authored-By: RuFlo <ruv@ruv.net>
2026-07-20 18:43:04 -04:00

193 lines
5.5 KiB
JSON
Raw Blame History

{
"name": "claude-flow",
"version": "3.32.8",
"description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
"main": "dist/index.js",
"type": "module",
"bin": {
"claude-flow": "bin/cli.js"
},
"homepage": "https://github.com/ruvnet/claude-flow#readme",
"bugs": {
"url": "https://github.com/ruvnet/claude-flow/issues",
"email": "support@ruv.io"
},
"funding": {
"type": "github",
"url": "https://github.com/sponsors/ruvnet"
},
"files": [
"bin/**",
"v3/@claude-flow/cli/bin/**",
"v3/@claude-flow/cli/dist/**/*.js",
"v3/@claude-flow/cli/dist/**/*.d.ts",
"!v3/@claude-flow/cli/dist/**/*.map",
"v3/@claude-flow/cli/package.json",
"v3/@claude-flow/cli/catalog-manifest.json",
"v3/@claude-flow/shared/dist/**/*.js",
"v3/@claude-flow/shared/dist/**/*.d.ts",
"!v3/@claude-flow/shared/dist/**/*.map",
"v3/@claude-flow/shared/package.json",
"v3/@claude-flow/guidance/dist/**/*.js",
"v3/@claude-flow/guidance/dist/**/*.d.ts",
"!v3/@claude-flow/guidance/dist/**/*.map",
"v3/@claude-flow/guidance/package.json",
".claude-plugin/**",
".claude/**",
"!.claude/**/*.db",
"!.claude/**/*.map",
"!.claude/worktrees/**",
"!.claude/projects/**",
"!.claude/scheduled_tasks.lock",
"!.claude/sessions/**",
"README.md",
"LICENSE"
],
"scripts": {
"dev": "tsx watch src/index.ts",
"build": "tsc",
"build:ts": "cd v3/@claude-flow/cli && npm run build || true",
"prepublishOnly": "node scripts/prepare-root-publish.mjs",
"test": "vitest",
"test:ui": "vitest --ui",
"test:security": "vitest run v3/__tests__/security/",
"lint": "cd v3/@claude-flow/cli && npm run lint || true",
"security:audit": "npm audit --audit-level high",
"security:fix": "npm audit fix",
"security:test": "npm run test:security",
"v3:domains": "npm run build:domains",
"v3:swarm": "npm run start:swarm",
"v3:security": "npm run security:audit && npm run security:test"
},
"dependencies": {
"@claude-flow/cli-core": "3.7.0-alpha.5",
"@claude-flow/mcp": "3.0.0-alpha.9",
"@claude-flow/neural": "3.0.0-alpha.9",
"@claude-flow/shared": "3.0.0-alpha.8",
"@noble/ed25519": "2.3.0",
"@ruvector/rabitq-wasm": "0.1.0",
"semver": "7.7.3",
"zod": "3.25.76"
},
"optionalDependencies": {
"@claude-flow/codex": "^3.0.1",
"@claude-flow/plugin-gastown-bridge": "^0.1.3",
"@ruvector/attention": "^0.1.3",
"@ruvector/core": "^0.1.30",
"@ruvector/router": "^0.1.30",
"@ruvector/router-linux-x64-gnu": "^0.1.30",
"@ruvector/sona": "^0.1.5",
"agentdb": "^3.0.0-alpha.17",
"agentic-flow": "^2.0.14",
"better-sqlite3": "12.9.0"
},
"overrides": {
"ruvector": "^0.2.27",
"better-sqlite3": "12.9.0",
"js-yaml": ">=4.3.0",
"hono": ">=4.12.25",
"@ruvector/rvf-wasm": "0.1.5",
"@hono/node-server": ">=1.19.14",
"flatted": ">=3.4.0",
"tar": ">=7.5.11",
"picomatch": ">=4.0.3",
"path-to-regexp": ">=8.2.1",
"undici": ">=8.5.0",
"minimatch": ">=10.0.0",
"@isaacs/brace-expansion": ">=5.0.1",
"cacache": ">=20.0.0",
"make-fetch-happen": ">=15.0.0",
"express-rate-limit": ">=8.4.1",
"express": ">=4.22.2",
"qs": ">=6.15.2",
"protobufjs": ">=8.2.0",
"uuid": ">=14.0.0",
"@opentelemetry/core": ">=2.8.0",
"@opentelemetry/resources": ">=2.8.0",
"@opentelemetry/sdk-trace-base": ">=2.8.0",
"@opentelemetry/sdk-node": ">=0.220.0",
"@opentelemetry/auto-instrumentations-node": ">=0.75.0",
"@opentelemetry/exporter-prometheus": ">=0.220.0",
"@opentelemetry/exporter-trace-otlp-grpc": ">=0.220.0",
"@opentelemetry/exporter-trace-otlp-http": ">=0.220.0",
"@opentelemetry/exporter-trace-otlp-proto": ">=0.220.0",
"@opentelemetry/otlp-exporter-base": ">=0.220.0",
"@opentelemetry/otlp-grpc-exporter-base": ">=0.220.0",
"@opentelemetry/otlp-transformer": ">=0.220.0",
"axios": ">=1.13.2",
"fast-uri": ">=3.1.0",
"vite": ">=8.0.16",
"ws": ">=8.21.0",
"@grpc/grpc-js": ">=1.14.4",
"form-data": ">=4.0.6",
"http-proxy-middleware": ">=3.0.7",
"@ruvector/ruvllm": ">=2.6.0"
},
"devDependencies": {
"@openai/codex": "^0.98.0",
"@types/bcrypt": "^5.0.2",
"@types/node": "^20.0.0",
"eslint": "^8.0.0",
"tsx": "^4.21.0",
"typescript": "^5.0.0",
"vitest": "^3.2.6"
},
"pnpm": {
"overrides": {
"better-sqlite3": "12.9.0"
}
},
"engines": {
"node": ">=20.0.0"
},
"repository": {
"type": "git",
"url": "https://github.com/ruvnet/claude-flow.git"
},
"keywords": [
"ruvflow",
"claude",
"claude-code",
"anthropic",
"ai",
"ai-agents",
"multi-agent",
"agent-orchestration",
"swarm-intelligence",
"swarm",
"mcp",
"model-context-protocol",
"llm",
"large-language-model",
"gpt",
"chatgpt",
"automation",
"workflow",
"orchestration",
"cli",
"developer-tools",
"devtools",
"coding-assistant",
"code-generation",
"enterprise",
"vector-database",
"embeddings",
"machine-learning",
"neural-network",
"hive-mind",
"distributed-systems",
"consensus",
"self-learning"
],
"author": {
"name": "RuvNet",
"email": "ruv@ruv.io",
"url": "https://ruv.io"
},
"license": "MIT",
"publishConfig": {
"access": "public",
"tag": "latest"
}
}
Reference in new issue View Git Blame Copy Permalink