mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-09 22:13:39 +09:00
rUvandClaude
1bd734e272
* dream(security): #TBD bind ADR-377 caller-identity verification into live authorizeMcpTool chokepoint (evaluated, ACCEPT-with-caveats)
authorizeMcpTool() trusted the plain, unsigned CLAUDE_FLOW_PRINCIPAL_ID env
var as caller identity with zero verification (OWASP ASI07-class gap).
ADR-377 Phase 3 already implemented Ed25519 issueInvocationToken/
verifyInvocationToken but never wired it into a live dispatch path.
Binds the two: DualModeOrchestrator mints a per-worker signed
InvocationToken at spawn (worker-lifetime TTL, wildcard tool scope --
disclosed reduction from the primitive's original per-call design);
authorizeMcpTool verifies it before trusting identity, failing closed on
missing/forged/expired tokens. Off by default (CLAUDE_FLOW_MCP_CALLER_AUTH).
6 new deterministic Vitest scenarios plus an independent adversarial
critique (fresh session, verdict CONFIRMED-SAFE-WITH-CAVEATS) are recorded
in docs/dream-cycle/dream-gist-2026-08-26.md. Darwin skipped (scope
mismatch -- binary crypto gate, no tunable parameter space).
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_015bfVASxkNXKpZbMSLhVU1L
* fix(ci): register ADR-377 Phase 3 caller-identity env vars as known escape hatches
CLAUDE_FLOW_MCP_CALLER_PUBKEY and CLAUDE_FLOW_MCP_INVOCATION_TOKEN
(DualModeOrchestrator's per-worker Ed25519 credential pair, read by
resolveMcpCallerIdentity()) weren't registered in
audit-env-var-precedence.mjs's KNOWN_ESCAPE_HATCHES, so the audit flagged
CLAUDE_FLOW_MCP_CALLER_PUBKEY as a real violation (exit 1). Same no-CLI-flag
reasoning as the existing CLAUDE_FLOW_PRINCIPAL_ID entry: these are
credentials minted into a spawned worker's own environment, not a value
any caller should be able to select via a flag.
Verified: audit-env-var-precedence.mjs now exits 0. policy-runtime.test.ts
still 18/18.
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01RYP825phHMjPRmmjkcAWpq
* fix(ci): regenerate root package-lock.json for codex's new @claude-flow/security dep
The CI Test Suite job runs plain `npm ci` at repo root (no v3 pnpm
install step), so it resolves workspace deps strictly from
package-lock.json — not from v3/pnpm-lock.yaml, which this PR had
already updated. codex/package.json's new @claude-flow/security
dependency was missing from package-lock.json's codex entry, so CI's
npm ci never linked it and every dual-mode test importing
orchestrator.ts failed with "Cannot find package '@claude-flow/security'".
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01RYP825phHMjPRmmjkcAWpq
* fix(ci): build @claude-flow/security before Test Suite runs it
Complements d492ea835 (codex's package-lock.json entry) rather than
duplicating it: that commit fixed `npm ci` not *linking*
@claude-flow/security for codex at all ("Cannot find package"); this
fixes the fact that even where it IS linked (codex now, @claude-flow/cli
already), nothing builds its dist/ before tests run, so importers hit
ERR_MODULE_NOT_FOUND on dist/index.js instead.
This was already a known, pre-existing gap for @claude-flow/cli:
v3/@claude-flow/cli/__tests__/policy-runtime.test.ts has carried a
scripts/ci-test-baseline.txt entry for exactly this reason since before
this PR existed. dual-mode.test.ts and dual-mode-stdin-2947.test.ts
(added by the caller-identity candidate on this branch) newly trip the
same gap in @claude-flow/codex, confirmed by diffing main's own Test
Suite ratchet failures (3, pre-existing, unrelated oauth/publisher
plugin tests) against this branch's (5: the same 3 plus these 2). Adding
new files to ci-test-baseline.txt to paper over this is explicitly
forbidden by that file's own header ("Never add entries to make a
regression green"), and gutting the tests to avoid the import would
remove real coverage of the orchestrator/security integration point.
Real fix: build @claude-flow/security before "Run all tests", using its
own existing `npm run build` (tsc && verify-oauth-exports.mjs). Verified
locally end-to-end by removing both dist/ and the stale
tsconfig.tsbuildinfo (simulating a fresh CI checkout, since both are
gitignored) -- the build step produces a full dist/, both new codex test
files pass, and (bonus, explicitly allowed by the baseline file's own
"remove entries when fixed" rule) the pre-existing policy-runtime.test.ts
baseline entry is now consistently green too, so it's removed here.
Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_015bfVASxkNXKpZbMSLhVU1L
---------
Co-authored-by: Claude <noreply@anthropic.com>
119 lines
2.9 KiB
JSON
119 lines
2.9 KiB
JSON
{
|
|
"name": "@claude-flow/codex",
|
|
"version": "3.0.3",
|
|
"description": "Codex CLI integration for Ruflo (claude-flow) - OpenAI Codex platform adapter",
|
|
"type": "module",
|
|
"main": "./dist/index.js",
|
|
"types": "./dist/index.d.ts",
|
|
"bin": {
|
|
"claude-flow-codex": "dist/cli.js"
|
|
},
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"import": "./dist/index.js",
|
|
"require": "./dist/index.js",
|
|
"default": "./dist/index.js"
|
|
},
|
|
"./generators": {
|
|
"types": "./dist/generators/index.d.ts",
|
|
"import": "./dist/generators/index.js",
|
|
"require": "./dist/generators/index.js"
|
|
},
|
|
"./templates": {
|
|
"types": "./dist/templates/index.d.ts",
|
|
"import": "./dist/templates/index.js",
|
|
"require": "./dist/templates/index.js"
|
|
},
|
|
"./migrations": {
|
|
"types": "./dist/migrations/index.d.ts",
|
|
"import": "./dist/migrations/index.js",
|
|
"require": "./dist/migrations/index.js"
|
|
},
|
|
"./dual-mode": {
|
|
"types": "./dist/dual-mode/index.d.ts",
|
|
"import": "./dist/dual-mode/index.js",
|
|
"require": "./dist/dual-mode/index.js"
|
|
},
|
|
"./loop": {
|
|
"types": "./dist/loop/index.d.ts",
|
|
"import": "./dist/loop/index.js",
|
|
"require": "./dist/loop/index.js"
|
|
},
|
|
"./worktrees": {
|
|
"types": "./dist/worktrees/index.d.ts",
|
|
"import": "./dist/worktrees/index.js",
|
|
"require": "./dist/worktrees/index.js"
|
|
},
|
|
"./harness": {
|
|
"types": "./dist/harness/index.d.ts",
|
|
"import": "./dist/harness/index.js",
|
|
"require": "./dist/harness/index.js"
|
|
}
|
|
},
|
|
"files": [
|
|
"dist",
|
|
".agents/skills"
|
|
],
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"dev": "tsc --watch",
|
|
"lint": "eslint src --ext .ts",
|
|
"test": "vitest",
|
|
"prepublishOnly": "npm run build"
|
|
},
|
|
"keywords": [
|
|
"codex",
|
|
"openai",
|
|
"claude-flow",
|
|
"coflow",
|
|
"agents",
|
|
"skills",
|
|
"AGENTS.md",
|
|
"agentic-ai"
|
|
],
|
|
"author": "rUv",
|
|
"license": "MIT",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/ruvnet/ruflo.git",
|
|
"directory": "v3/@claude-flow/codex"
|
|
},
|
|
"homepage": "https://github.com/ruvnet/ruflo#readme",
|
|
"bugs": {
|
|
"url": "https://github.com/ruvnet/ruflo/issues"
|
|
},
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"peerDependencies": {
|
|
"@claude-flow/cli": "^3.0.0"
|
|
},
|
|
"peerDependenciesMeta": {
|
|
"@claude-flow/cli": {
|
|
"optional": true
|
|
}
|
|
},
|
|
"dependencies": {
|
|
"commander": "^12.0.0",
|
|
"fs-extra": "^11.2.0",
|
|
"chalk": "^5.3.0",
|
|
"inquirer": "^9.2.0",
|
|
"yaml": "^2.4.0",
|
|
"toml": "^3.0.0",
|
|
"@iarna/toml": "^2.2.5",
|
|
"@claude-flow/security": "3.0.0-alpha.14"
|
|
},
|
|
"devDependencies": {
|
|
"@types/fs-extra": "^11.0.4",
|
|
"@types/node": "^20.0.0",
|
|
"typescript": "^5.4.0",
|
|
"vitest": "^4.1.0",
|
|
"eslint": "^8.57.0"
|
|
},
|
|
"publishConfig": {
|
|
"access": "public",
|
|
"tag": "latest"
|
|
}
|
|
}
|