Dragan Spiridonov b48c2668d7 fix(security): pin deps and rebrand claude-flow to ruflo for supply chain safety ...

Socket.dev flagged runtime `npx -y @claude-flow/cli@latest` as a supply chain
risk. This commit pins all unpinned dependencies, switches runtime CLI calls
to `ruflo@3.5.18`, and adds backward-compat detection for both package names.

- Pin @claude-flow/guidance and @claude-flow/browser to exact 3.0.0-alpha.1
- .mcp.json: ruflo@3.5.18 (eliminates @latest auto-install vector)
- cfCliArgs() and detect.ts: ruflo-first with claude-flow fallback
- settings-merge.ts and .claude/settings.json: ruflo + claude-flow permissions
- Governance files: TODO(ruflo-rebrand) for blocked @ruflo/guidance migration
- CLAUDE.md, helpers, scripts: updated CLI references to npx ruflo

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-17 14:25:51 +00:00

..

devcontainer.json

config updates

2026-03-11 07:21:52 +00:00

install-tools.sh

fix(security): pin deps and rebrand claude-flow to ruflo for supply chain safety

2026-03-17 14:25:51 +00:00

installation-report.md

feat(v3.3.4): Comprehensive QE platform with cross-phase memory, hooks, and 96 new tests (#216)

2026-01-29 17:29:33 +01:00

monitor-memory.sh

chore: Initial release v1.0.0

2025-09-30 19:59:56 +00:00

setup-memory.sh

devcontainer update

2025-11-01 19:02:10 +00:00

test-setup.sh

chore: Initial release v1.0.0

2025-09-30 19:59:56 +00:00