mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-09 14:04:06 +09:00
Reuven
d5dbfa4b92
The pre-bash PreToolUse hook in .claude/helpers/hook-handler.cjs is a security gate that refuses dangerous commands. In 3.6.30 it read the wrong stdin field (`toolInput` object instead of `toolInput.command` string), `.toLowerCase()` threw TypeError, the global safety-timer try/catch swallowed it, and the handler printed misleading "[OK] Command validated" while exiting 0 — letting `rm -rf /` through. The bind-the-string fix already landed in alpha.39 via #1944. This commit adds: 1. Belt-and-suspenders defensive coding — wrap with String(... || '') so any future regression that re-binds command to null/undefined/an object can no longer throw and silently exit 0. 2. New dedicated CI job `pre-bash-hook-smoke` (#2017) that drives real Claude-Code-shaped PreToolUse JSON into BOTH handler copies and fails on any of: - dangerous command + exit 0 (the security bypass) - "[OK] Command validated" on a dangerous input (misleading log) - "[WARN] Hook X encountered an error" anywhere (silent-swallow) Wired into witness-verify's needs:, so the gate now blocks publish. 3. Path filters extended: '**/.claude/helpers/hook-handler.cjs' triggers the smoke whenever either handler copy changes. Cases covered: dangerous rm -rf /, fork-bomb, format c:, null command field (defensive), empty payload, snake_case tool_input.command shape (the exact #2017 reproduction), innocuous ls -la. Ships as 3.7.0-alpha.40 to all three packages.
159 lines
4.3 KiB
JSON
159 lines
4.3 KiB
JSON
{
|
|
"name": "claude-flow",
|
|
"version": "3.7.0-alpha.40",
|
|
"description": "Ruflo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
|
|
"main": "dist/index.js",
|
|
"type": "module",
|
|
"bin": {
|
|
"claude-flow": "./bin/cli.js"
|
|
},
|
|
"homepage": "https://github.com/ruvnet/claude-flow#readme",
|
|
"bugs": {
|
|
"url": "https://github.com/ruvnet/claude-flow/issues",
|
|
"email": "support@ruv.io"
|
|
},
|
|
"funding": {
|
|
"type": "github",
|
|
"url": "https://github.com/sponsors/ruvnet"
|
|
},
|
|
"files": [
|
|
"bin/**",
|
|
"v3/@claude-flow/cli/bin/**",
|
|
"v3/@claude-flow/cli/dist/**/*.js",
|
|
"v3/@claude-flow/cli/dist/**/*.d.ts",
|
|
"!v3/@claude-flow/cli/dist/**/*.map",
|
|
"v3/@claude-flow/cli/package.json",
|
|
"v3/@claude-flow/shared/dist/**/*.js",
|
|
"v3/@claude-flow/shared/dist/**/*.d.ts",
|
|
"!v3/@claude-flow/shared/dist/**/*.map",
|
|
"v3/@claude-flow/shared/package.json",
|
|
"v3/@claude-flow/guidance/dist/**/*.js",
|
|
"v3/@claude-flow/guidance/dist/**/*.d.ts",
|
|
"!v3/@claude-flow/guidance/dist/**/*.map",
|
|
"v3/@claude-flow/guidance/package.json",
|
|
".claude-plugin/**",
|
|
".claude/**",
|
|
"!.claude/**/*.db",
|
|
"!.claude/**/*.map",
|
|
"README.md",
|
|
"LICENSE"
|
|
],
|
|
"scripts": {
|
|
"dev": "tsx watch src/index.ts",
|
|
"build": "tsc",
|
|
"build:ts": "cd v3/@claude-flow/cli && npm run build || true",
|
|
"test": "vitest",
|
|
"test:ui": "vitest --ui",
|
|
"test:security": "vitest run v3/__tests__/security/",
|
|
"lint": "cd v3/@claude-flow/cli && npm run lint || true",
|
|
"security:audit": "npm audit --audit-level high",
|
|
"security:fix": "npm audit fix",
|
|
"security:test": "npm run test:security",
|
|
"v3:domains": "npm run build:domains",
|
|
"v3:swarm": "npm run start:swarm",
|
|
"v3:security": "npm run security:audit && npm run security:test"
|
|
},
|
|
"dependencies": {
|
|
"@claude-flow/cli-core": "^3.7.0-alpha.5",
|
|
"@claude-flow/mcp": "^3.0.0-alpha.8",
|
|
"@claude-flow/neural": "^3.0.0-alpha.8",
|
|
"@claude-flow/shared": "^3.0.0-alpha.7",
|
|
"@noble/ed25519": "^2.1.0",
|
|
"@ruvector/rabitq-wasm": "^0.1.0",
|
|
"semver": "^7.6.0",
|
|
"zod": "^3.22.4"
|
|
},
|
|
"optionalDependencies": {
|
|
"@claude-flow/codex": "^3.0.0-alpha.8",
|
|
"@claude-flow/plugin-gastown-bridge": "^0.1.3",
|
|
"@ruvector/attention": "^0.1.3",
|
|
"@ruvector/core": "^0.1.30",
|
|
"@ruvector/router": "^0.1.30",
|
|
"@ruvector/router-linux-x64-gnu": "^0.1.30",
|
|
"@ruvector/sona": "^0.1.5",
|
|
"agentdb": "^3.0.0-alpha.9",
|
|
"agentic-flow": "^2.0.7"
|
|
},
|
|
"overrides": {
|
|
"hono": ">=4.11.4",
|
|
"@ruvector/rvf-wasm": "0.1.5",
|
|
"@hono/node-server": ">=1.19.10",
|
|
"flatted": ">=3.4.0",
|
|
"tar": ">=7.5.11",
|
|
"picomatch": ">=4.0.3",
|
|
"path-to-regexp": ">=8.2.1",
|
|
"undici": ">=7.18.0",
|
|
"minimatch": ">=10.0.0",
|
|
"@isaacs/brace-expansion": ">=5.0.1",
|
|
"cacache": ">=20.0.0",
|
|
"make-fetch-happen": ">=15.0.0",
|
|
"express-rate-limit": ">=8.4.1",
|
|
"protobufjs": ">=7.5.5",
|
|
"uuid": ">=14.0.0",
|
|
"@opentelemetry/core": "1.25.1",
|
|
"@opentelemetry/resources": "1.25.1",
|
|
"@opentelemetry/sdk-trace-base": "1.25.1"
|
|
},
|
|
"devDependencies": {
|
|
"@openai/codex": "^0.98.0",
|
|
"@types/bcrypt": "^5.0.2",
|
|
"@types/node": "^20.0.0",
|
|
"eslint": "^8.0.0",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "^5.0.0",
|
|
"vitest": "^1.0.0"
|
|
},
|
|
"engines": {
|
|
"node": ">=20.0.0"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/ruvnet/claude-flow.git"
|
|
},
|
|
"keywords": [
|
|
"ruvflow",
|
|
"claude",
|
|
"claude-code",
|
|
"anthropic",
|
|
"ai",
|
|
"ai-agents",
|
|
"multi-agent",
|
|
"agent-orchestration",
|
|
"swarm-intelligence",
|
|
"swarm",
|
|
"mcp",
|
|
"model-context-protocol",
|
|
"llm",
|
|
"large-language-model",
|
|
"gpt",
|
|
"chatgpt",
|
|
"automation",
|
|
"workflow",
|
|
"orchestration",
|
|
"cli",
|
|
"developer-tools",
|
|
"devtools",
|
|
"coding-assistant",
|
|
"code-generation",
|
|
"enterprise",
|
|
"vector-database",
|
|
"embeddings",
|
|
"machine-learning",
|
|
"neural-network",
|
|
"hive-mind",
|
|
"distributed-systems",
|
|
"consensus",
|
|
"self-learning"
|
|
],
|
|
"author": {
|
|
"name": "RuvNet",
|
|
"email": "ruv@ruv.io",
|
|
"url": "https://ruv.io"
|
|
},
|
|
"license": "MIT",
|
|
"publishConfig": {
|
|
"access": "public",
|
|
"tag": "latest"
|
|
}
|
|
}
|