mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-10 06:23:28 +09:00
ruv
f84273308a
Iter 30 closed the HIGH 'no-policy' finding. Iter 31 closes the LOW
'unpinned-deps' finding — the last one. Ruflo's MCP threat-model is
now CLEAN (zero non-info findings).
THE 8 DEPS (caret → exact, matched to actually-installed versions)
@claude-flow/cli-core ^3.7.0-alpha.5 → 3.7.0-alpha.5
@claude-flow/mcp ^3.0.0-alpha.8 → 3.0.0-alpha.8
@claude-flow/neural ^3.0.0-alpha.8 → 3.0.0-alpha.9 (root) /
^3.0.0-alpha.9 → 3.0.0-alpha.9 (cli)
(also resolved a cross-package version drift)
@claude-flow/shared ^3.0.0-alpha.7 → 3.0.0-alpha.7
@noble/ed25519 ^2.1.0 → 2.3.0
@ruvector/rabitq-wasm ^0.1.0 → 0.1.0
semver ^7.6.0 → 7.7.3
zod ^3.22.4 → 3.25.76
Each pin matches the version the lockfile already resolves to, so no
behavioral change at install time — purely a stricter declaration of
intent. Future deps must be updated explicitly via PR rather than
silently absorbing a caret-range minor bump.
MEASURED IMPACT vs pre-iter-30 baseline
Pre-iter-30 Post-iter-30 Post-iter-31
worst severity HIGH LOW INFO ("clean")
threat-model verdict high clean clean
findings count 2 1 0
L7 governance partial FULL FULL
toolSafety score 100 100 100
WHY EXACT NOT TILDE
Tilde (~X.Y.Z) is fine for absorbing patches when the upstream cadence
is well-understood; metaharness@~0.1.11 is a good example (5 releases
in 2.7h on 2026-06-15 — patches expected). For ruflo's INTERNAL
@claude-flow/* packages, these get bumped in lockstep via the release
process — exact pinning catches accidental drift between the root
package.json and v3/@claude-flow/cli/package.json (which DID drift on
@claude-flow/neural pre-iter-31). Exact pins make the lockstep
explicit.
ROLLBACK
If a caret range turns out to have been load-bearing somewhere, revert
this commit: `git revert HEAD`. The lockfile (which has been the
actual reproducibility mechanism all along) doesn't change.
FLEET STATE — all measurements verified post-iter-31:
threat-model: clean (verdict)
mcp-scan: 0 findings
oia L7: full
smoke: 36/36
meta-smoke: 33/33 plugins
3 audits: clean
The self-improvement loop completed:
iter 7 → oia-audit infrastructure detects the HIGH
iter 27 → the dispatch fix unmasked it (was silently degrading)
iter 30 → mcp-policy.json closed the HIGH
iter 31 → exact pins closed the LOW
iter 31 → threat-model = clean
This is ADR-150 in operation: instrumentation found problems, the same
instrumentation guided the fix, problems went away. End-to-end.
Co-Authored-By: RuFlo <ruv@ruv.net>
170 lines
4.7 KiB
JSON
170 lines
4.7 KiB
JSON
{
|
|
"name": "claude-flow",
|
|
"version": "3.11.0",
|
|
"description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
|
|
"main": "dist/index.js",
|
|
"type": "module",
|
|
"bin": {
|
|
"claude-flow": "./bin/cli.js"
|
|
},
|
|
"homepage": "https://github.com/ruvnet/claude-flow#readme",
|
|
"bugs": {
|
|
"url": "https://github.com/ruvnet/claude-flow/issues",
|
|
"email": "support@ruv.io"
|
|
},
|
|
"funding": {
|
|
"type": "github",
|
|
"url": "https://github.com/sponsors/ruvnet"
|
|
},
|
|
"files": [
|
|
"bin/**",
|
|
"v3/@claude-flow/cli/bin/**",
|
|
"v3/@claude-flow/cli/dist/**/*.js",
|
|
"v3/@claude-flow/cli/dist/**/*.d.ts",
|
|
"!v3/@claude-flow/cli/dist/**/*.map",
|
|
"v3/@claude-flow/cli/package.json",
|
|
"v3/@claude-flow/shared/dist/**/*.js",
|
|
"v3/@claude-flow/shared/dist/**/*.d.ts",
|
|
"!v3/@claude-flow/shared/dist/**/*.map",
|
|
"v3/@claude-flow/shared/package.json",
|
|
"v3/@claude-flow/guidance/dist/**/*.js",
|
|
"v3/@claude-flow/guidance/dist/**/*.d.ts",
|
|
"!v3/@claude-flow/guidance/dist/**/*.map",
|
|
"v3/@claude-flow/guidance/package.json",
|
|
".claude-plugin/**",
|
|
".claude/**",
|
|
"!.claude/**/*.db",
|
|
"!.claude/**/*.map",
|
|
"README.md",
|
|
"LICENSE"
|
|
],
|
|
"scripts": {
|
|
"dev": "tsx watch src/index.ts",
|
|
"build": "tsc",
|
|
"build:ts": "cd v3/@claude-flow/cli && npm run build || true",
|
|
"test": "vitest",
|
|
"test:ui": "vitest --ui",
|
|
"test:security": "vitest run v3/__tests__/security/",
|
|
"lint": "cd v3/@claude-flow/cli && npm run lint || true",
|
|
"security:audit": "npm audit --audit-level high",
|
|
"security:fix": "npm audit fix",
|
|
"security:test": "npm run test:security",
|
|
"v3:domains": "npm run build:domains",
|
|
"v3:swarm": "npm run start:swarm",
|
|
"v3:security": "npm run security:audit && npm run security:test"
|
|
},
|
|
"dependencies": {
|
|
"@claude-flow/cli-core": "3.7.0-alpha.5",
|
|
"@claude-flow/mcp": "3.0.0-alpha.8",
|
|
"@claude-flow/neural": "3.0.0-alpha.9",
|
|
"@claude-flow/shared": "3.0.0-alpha.7",
|
|
"@noble/ed25519": "2.3.0",
|
|
"@ruvector/rabitq-wasm": "0.1.0",
|
|
"semver": "7.7.3",
|
|
"zod": "3.25.76"
|
|
},
|
|
"optionalDependencies": {
|
|
"@claude-flow/codex": "^3.0.0-alpha.8",
|
|
"@claude-flow/plugin-gastown-bridge": "^0.1.3",
|
|
"@ruvector/attention": "^0.1.3",
|
|
"@ruvector/core": "^0.1.30",
|
|
"@ruvector/router": "^0.1.30",
|
|
"@ruvector/router-linux-x64-gnu": "^0.1.30",
|
|
"@ruvector/sona": "^0.1.5",
|
|
"agentdb": "^3.0.0-alpha.16",
|
|
"agentic-flow": "^2.0.13"
|
|
},
|
|
"overrides": {
|
|
"ruvector": "^0.2.27",
|
|
"better-sqlite3": ">=12.8.0",
|
|
"hono": ">=4.11.4",
|
|
"@ruvector/rvf-wasm": "0.1.5",
|
|
"@hono/node-server": ">=1.19.10",
|
|
"flatted": ">=3.4.0",
|
|
"tar": ">=7.5.11",
|
|
"picomatch": ">=4.0.3",
|
|
"path-to-regexp": ">=8.2.1",
|
|
"undici": ">=7.18.0",
|
|
"minimatch": ">=10.0.0",
|
|
"@isaacs/brace-expansion": ">=5.0.1",
|
|
"cacache": ">=20.0.0",
|
|
"make-fetch-happen": ">=15.0.0",
|
|
"express-rate-limit": ">=8.4.1",
|
|
"express": ">=4.22.2",
|
|
"qs": ">=6.15.2",
|
|
"protobufjs": ">=8.2.0",
|
|
"uuid": ">=14.0.0",
|
|
"@opentelemetry/core": "1.25.1",
|
|
"@opentelemetry/resources": "1.25.1",
|
|
"@opentelemetry/sdk-trace-base": "1.25.1",
|
|
"@opentelemetry/sdk-node": ">=0.218.0",
|
|
"@opentelemetry/auto-instrumentations-node": ">=0.75.0",
|
|
"@opentelemetry/exporter-prometheus": ">=0.217.0",
|
|
"axios": ">=1.13.2",
|
|
"fast-uri": ">=3.1.0",
|
|
"vite": ">=6.4.6",
|
|
"ws": ">=8.18.4"
|
|
},
|
|
"devDependencies": {
|
|
"@openai/codex": "^0.98.0",
|
|
"@types/bcrypt": "^5.0.2",
|
|
"@types/node": "^20.0.0",
|
|
"eslint": "^8.0.0",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "^5.0.0",
|
|
"vitest": "^1.0.0"
|
|
},
|
|
"engines": {
|
|
"node": ">=20.0.0"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/ruvnet/claude-flow.git"
|
|
},
|
|
"keywords": [
|
|
"ruvflow",
|
|
"claude",
|
|
"claude-code",
|
|
"anthropic",
|
|
"ai",
|
|
"ai-agents",
|
|
"multi-agent",
|
|
"agent-orchestration",
|
|
"swarm-intelligence",
|
|
"swarm",
|
|
"mcp",
|
|
"model-context-protocol",
|
|
"llm",
|
|
"large-language-model",
|
|
"gpt",
|
|
"chatgpt",
|
|
"automation",
|
|
"workflow",
|
|
"orchestration",
|
|
"cli",
|
|
"developer-tools",
|
|
"devtools",
|
|
"coding-assistant",
|
|
"code-generation",
|
|
"enterprise",
|
|
"vector-database",
|
|
"embeddings",
|
|
"machine-learning",
|
|
"neural-network",
|
|
"hive-mind",
|
|
"distributed-systems",
|
|
"consensus",
|
|
"self-learning"
|
|
],
|
|
"author": {
|
|
"name": "RuvNet",
|
|
"email": "ruv@ruv.io",
|
|
"url": "https://ruv.io"
|
|
},
|
|
"license": "MIT",
|
|
"publishConfig": {
|
|
"access": "public",
|
|
"tag": "latest"
|
|
}
|
|
}
|