Files
ruflo/package.json
T
ruv d09a0e4cbd fix(ci): 5 CI failures — Build V3, Static guards, ADR-112, witness verify, supply-chain audit
Stacked fixes to clear the remaining red CI checks on \`main\` that pre-dated
the #2412 lockfile-cascade fix. Each one verified locally before commit.

1. **Build V3 (ubuntu/macos/windows)** — \`graph-edge-writer.ts\` did a static
   \`await import('better-sqlite3')\` which forces tsc to resolve the package's
   types at build time. \`better-sqlite3\` is in \`optionalDependencies\` (so
   CI doesn't install it) — type resolution failed with TS2307 on every
   platform. Routed the module name through a variable so the static analyzer
   stops trying to resolve it; runtime presence is still gated by the
   existing try/catch.

2. **Static regression guards (#2267)** — \`scripts/smoke-workflows-yaml.mjs\`
   crashed with \`SyntaxError: The requested module 'js-yaml' does not provide
   an export named 'default'\` after js-yaml dropped the synthetic default
   from its package exports. Switched to \`import * as yaml from 'js-yaml'\`.

3. **Tool description discoverability (ADR-112)** — two MCP tools regressed
   the no-guidance baseline (count went from 0 → 2):
     - \`metaharness_bench\` had no Use-when / Prefer / Pair-with hint
     - \`testgen_tdd_repair\` had \"Use when …\" in a *later* string
       fragment of a concatenated description, which the audit regex
       (single-quoted-literal-only) misses
   Added explicit \"Use when …\" guidance to the first fragment of each.
   Audit now reports 340/340 tools with guidance.

4. **witness verify precondition smoke (#1880)** — Root \`package-lock.json\`
   drifted: \`agentdb@3.0.0-alpha.16\` in lock vs \`^3.0.0-alpha.17\` in
   package.json (same root cause as #2412 but for the npm lockfile, not the
   pnpm one fixed last release). Every job that runs \`npm ci\` was failing
   at install. Regenerated via \`npm install --package-lock-only\`. Verified:
   \`npm ci --dry-run --legacy-peer-deps\` now exits 0.

5. **Supply-chain audit (#2046)** — \`plugins/ruflo-graph-intelligence\` had
   1 HIGH/CRITICAL unaccepted direct-dep finding:
     - \`ws@8.20.1\` pulled by \`sublinear-time-solver\` (GHSA-96hv-2xvq-fx4p,
       memory exhaustion DoS) — bumped root override \`ws >=8.18.4\` →
       \`>=8.21.0\` and added the same override to the plugin's own
       package.json so it propagates through the plugin's own npm install
     - \`@claude-flow/cli\` peerDep surfaces every HIGH transitive in cli's
       own tree inside the plugin's audit report — added a tracked,
       expiring accepted-finding (cli ships its own audit pipeline on
       every publish; the plugin doesn't redistribute cli's tree).
   Audit now reports \`OK: no hard-fail findings\`.

Verified locally:
  - \`npm run build\` in v3/@claude-flow/cli: clean
  - \`node scripts/smoke-workflows-yaml.mjs\`: exit 0, 53 workflows parsed
  - \`node scripts/audit-tool-descriptions.mjs\`: 340/340 with guidance, OK
  - \`npm ci --dry-run --legacy-peer-deps\` at repo root: exit 0
  - \`node scripts/audit-supply-chain.mjs\`: OK, no hard-fail findings

Co-Authored-By: RuFlo <ruv@ruv.net>
2026-06-25 18:18:19 -04:00

170 lines
4.7 KiB
JSON

{
"name": "claude-flow",
"version": "3.14.2",
"description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
"main": "dist/index.js",
"type": "module",
"bin": {
"claude-flow": "./bin/cli.js"
},
"homepage": "https://github.com/ruvnet/claude-flow#readme",
"bugs": {
"url": "https://github.com/ruvnet/claude-flow/issues",
"email": "support@ruv.io"
},
"funding": {
"type": "github",
"url": "https://github.com/sponsors/ruvnet"
},
"files": [
"bin/**",
"v3/@claude-flow/cli/bin/**",
"v3/@claude-flow/cli/dist/**/*.js",
"v3/@claude-flow/cli/dist/**/*.d.ts",
"!v3/@claude-flow/cli/dist/**/*.map",
"v3/@claude-flow/cli/package.json",
"v3/@claude-flow/shared/dist/**/*.js",
"v3/@claude-flow/shared/dist/**/*.d.ts",
"!v3/@claude-flow/shared/dist/**/*.map",
"v3/@claude-flow/shared/package.json",
"v3/@claude-flow/guidance/dist/**/*.js",
"v3/@claude-flow/guidance/dist/**/*.d.ts",
"!v3/@claude-flow/guidance/dist/**/*.map",
"v3/@claude-flow/guidance/package.json",
".claude-plugin/**",
".claude/**",
"!.claude/**/*.db",
"!.claude/**/*.map",
"README.md",
"LICENSE"
],
"scripts": {
"dev": "tsx watch src/index.ts",
"build": "tsc",
"build:ts": "cd v3/@claude-flow/cli && npm run build || true",
"test": "vitest",
"test:ui": "vitest --ui",
"test:security": "vitest run v3/__tests__/security/",
"lint": "cd v3/@claude-flow/cli && npm run lint || true",
"security:audit": "npm audit --audit-level high",
"security:fix": "npm audit fix",
"security:test": "npm run test:security",
"v3:domains": "npm run build:domains",
"v3:swarm": "npm run start:swarm",
"v3:security": "npm run security:audit && npm run security:test"
},
"dependencies": {
"@claude-flow/cli-core": "3.7.0-alpha.5",
"@claude-flow/mcp": "3.0.0-alpha.9",
"@claude-flow/neural": "3.0.0-alpha.9",
"@claude-flow/shared": "3.0.0-alpha.8",
"@noble/ed25519": "2.3.0",
"@ruvector/rabitq-wasm": "0.1.0",
"semver": "7.7.3",
"zod": "3.25.76"
},
"optionalDependencies": {
"@claude-flow/codex": "^3.0.0-alpha.8",
"@claude-flow/plugin-gastown-bridge": "^0.1.3",
"@ruvector/attention": "^0.1.3",
"@ruvector/core": "^0.1.30",
"@ruvector/router": "^0.1.30",
"@ruvector/router-linux-x64-gnu": "^0.1.30",
"@ruvector/sona": "^0.1.5",
"agentdb": "^3.0.0-alpha.17",
"agentic-flow": "^2.0.14"
},
"overrides": {
"ruvector": "^0.2.27",
"better-sqlite3": ">=12.8.0",
"hono": ">=4.11.4",
"@ruvector/rvf-wasm": "0.1.5",
"@hono/node-server": ">=1.19.10",
"flatted": ">=3.4.0",
"tar": ">=7.5.11",
"picomatch": ">=4.0.3",
"path-to-regexp": ">=8.2.1",
"undici": ">=7.18.0",
"minimatch": ">=10.0.0",
"@isaacs/brace-expansion": ">=5.0.1",
"cacache": ">=20.0.0",
"make-fetch-happen": ">=15.0.0",
"express-rate-limit": ">=8.4.1",
"express": ">=4.22.2",
"qs": ">=6.15.2",
"protobufjs": ">=8.2.0",
"uuid": ">=14.0.0",
"@opentelemetry/core": "1.25.1",
"@opentelemetry/resources": "1.25.1",
"@opentelemetry/sdk-trace-base": "1.25.1",
"@opentelemetry/sdk-node": ">=0.218.0",
"@opentelemetry/auto-instrumentations-node": ">=0.75.0",
"@opentelemetry/exporter-prometheus": ">=0.217.0",
"axios": ">=1.13.2",
"fast-uri": ">=3.1.0",
"vite": ">=6.4.6",
"ws": ">=8.21.0"
},
"devDependencies": {
"@openai/codex": "^0.98.0",
"@types/bcrypt": "^5.0.2",
"@types/node": "^20.0.0",
"eslint": "^8.0.0",
"tsx": "^4.21.0",
"typescript": "^5.0.0",
"vitest": "^1.0.0"
},
"engines": {
"node": ">=20.0.0"
},
"repository": {
"type": "git",
"url": "https://github.com/ruvnet/claude-flow.git"
},
"keywords": [
"ruvflow",
"claude",
"claude-code",
"anthropic",
"ai",
"ai-agents",
"multi-agent",
"agent-orchestration",
"swarm-intelligence",
"swarm",
"mcp",
"model-context-protocol",
"llm",
"large-language-model",
"gpt",
"chatgpt",
"automation",
"workflow",
"orchestration",
"cli",
"developer-tools",
"devtools",
"coding-assistant",
"code-generation",
"enterprise",
"vector-database",
"embeddings",
"machine-learning",
"neural-network",
"hive-mind",
"distributed-systems",
"consensus",
"self-learning"
],
"author": {
"name": "RuvNet",
"email": "ruv@ruv.io",
"url": "https://ruv.io"
},
"license": "MIT",
"publishConfig": {
"access": "public",
"tag": "latest"
}
}