Adds a 'Standalone use (without the Ruflo CLI)' section to each
module's README right after Installation, with copy-pasteable
recipes verified against the published artifacts (fresh `npm install`
clean room, no patched dist, exit 0 for every example).
Recipes:
@claude-flow/memory (@3.0.0-alpha.16)
1. HNSWIndex — add 3 vectors, search top-2, no other deps
2. ControllerRegistry + injected AgentDB — proves the v3
governance layer works on a caller-owned AgentDB instance
(the agentdb injection field added in #2019)
@claude-flow/embeddings
1. MockEmbeddingService + cosineSimilarity — embed + compare
without network calls
2. Provider swap snippet showing OpenAI / Transformers / etc.
keep the same API surface
@claude-flow/security (@3.0.0-alpha.7)
1. InputValidator.validate(EmailSchema) +
new PasswordHasher({ rounds: 12 }) +
createCredentialGenerator().generateApiKey() — three of the
OWASP top 10 in ~15 lines
2. createDevelopmentExecutor — git through the allowlist gate;
createProjectPathValidator — refuses `../` traversal with
errors[] surfaced
Bugs uncovered by running the recipes against live npm:
- `embed()` returns { embedding, tokens, ... }, not a raw Float32Array
(recipe destructures `.embedding`).
- createPasswordHasher(rounds: number) accepts a NUMBER, not a
config object (passing `{ rounds: 12 }` made config.rounds nest
into `{ rounds: 12 }` and bcryptjs threw 'Illegal arguments:
string, object'). Switched recipe to `new PasswordHasher(...)`.
- generateCredentials() does NOT generate API keys — that lives
on `CredentialGenerator.generateApiKey(prefix)`. Recipe now
uses createCredentialGenerator().generateApiKey().
- PathValidator result is { isValid, errors[], ... }, not
{ valid, error }. Recipe matches the real shape.
Not included — @claude-flow/neural standalone recipe:
@claude-flow/neural@3.0.0-alpha.8 currently fails on fresh
install because @ruvector/sona@0.1.6 is an empty publish (only
README + package.json — no index.js, no native bins).
@ruvector/sona@0.1.5 had full content (index.js + 7 platform
bins), so this is a regression in the latest sona release that
blocks the entire neural package from loading.
Rather than ship a broken recipe, the neural README gains a
'Known issue' callout pointing at @ruvector/sona@0.1.6. Fix
path: republish @ruvector/sona with content or pin
@claude-flow/neural to @ruvector/sona@^0.1.5 in its next bump.
Co-Authored-By: RuFlo <ruv@ruv.net>
1. SQL injection: Convert all 9 string-interpolated queries in
memory-initializer.ts to parameterized queries (db.prepare/bind)
Closes#1030
2. Preinstall hook: Remove no-op preinstall script and package.json entry
that triggered supply chain concern
3. SECURITY.md: Add vulnerability disclosure policy with supported
versions, reporting process, and safe harbor statement
4. SafeExecutor: Remove npx from default command allowlist to prevent
arbitrary package execution via safe executor
5. Cleanup command: Add `cleanup` command for removing project artifacts
(.claude/, .swarm/, data/, etc.) with --dry-run default and --force
to execute. Addresses uninstall documentation gap
Published as v3.5.40. All fixes verified in Docker.
Closes#1375
ruv