Stacked fixes to clear the remaining red CI checks on \`main\` that pre-dated
the #2412 lockfile-cascade fix. Each one verified locally before commit.
1. **Build V3 (ubuntu/macos/windows)** — \`graph-edge-writer.ts\` did a static
\`await import('better-sqlite3')\` which forces tsc to resolve the package's
types at build time. \`better-sqlite3\` is in \`optionalDependencies\` (so
CI doesn't install it) — type resolution failed with TS2307 on every
platform. Routed the module name through a variable so the static analyzer
stops trying to resolve it; runtime presence is still gated by the
existing try/catch.
2. **Static regression guards (#2267)** — \`scripts/smoke-workflows-yaml.mjs\`
crashed with \`SyntaxError: The requested module 'js-yaml' does not provide
an export named 'default'\` after js-yaml dropped the synthetic default
from its package exports. Switched to \`import * as yaml from 'js-yaml'\`.
3. **Tool description discoverability (ADR-112)** — two MCP tools regressed
the no-guidance baseline (count went from 0 → 2):
- \`metaharness_bench\` had no Use-when / Prefer / Pair-with hint
- \`testgen_tdd_repair\` had \"Use when …\" in a *later* string
fragment of a concatenated description, which the audit regex
(single-quoted-literal-only) misses
Added explicit \"Use when …\" guidance to the first fragment of each.
Audit now reports 340/340 tools with guidance.
4. **witness verify precondition smoke (#1880)** — Root \`package-lock.json\`
drifted: \`agentdb@3.0.0-alpha.16\` in lock vs \`^3.0.0-alpha.17\` in
package.json (same root cause as #2412 but for the npm lockfile, not the
pnpm one fixed last release). Every job that runs \`npm ci\` was failing
at install. Regenerated via \`npm install --package-lock-only\`. Verified:
\`npm ci --dry-run --legacy-peer-deps\` now exits 0.
5. **Supply-chain audit (#2046)** — \`plugins/ruflo-graph-intelligence\` had
1 HIGH/CRITICAL unaccepted direct-dep finding:
- \`ws@8.20.1\` pulled by \`sublinear-time-solver\` (GHSA-96hv-2xvq-fx4p,
memory exhaustion DoS) — bumped root override \`ws >=8.18.4\` →
\`>=8.21.0\` and added the same override to the plugin's own
package.json so it propagates through the plugin's own npm install
- \`@claude-flow/cli\` peerDep surfaces every HIGH transitive in cli's
own tree inside the plugin's audit report — added a tracked,
expiring accepted-finding (cli ships its own audit pipeline on
every publish; the plugin doesn't redistribute cli's tree).
Audit now reports \`OK: no hard-fail findings\`.
Verified locally:
- \`npm run build\` in v3/@claude-flow/cli: clean
- \`node scripts/smoke-workflows-yaml.mjs\`: exit 0, 53 workflows parsed
- \`node scripts/audit-tool-descriptions.mjs\`: 340/340 with guidance, OK
- \`npm ci --dry-run --legacy-peer-deps\` at repo root: exit 0
- \`node scripts/audit-supply-chain.mjs\`: OK, no hard-fail findings
Co-Authored-By: RuFlo <ruv@ruv.net>
ruv