mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-09-14 14:01:28 +08:00
ruv
f08318f2c7
With #2267's YAML break gone and the pnpm-lock refreshed, the 25 newly- visible failures collapsed to 3 genuinely-independent audit failures. Fixing all three. #2046 — Supply-chain audit (1 unaccepted critical CVE) Vitest <4.1.0 UI server arbitrary-file-read/exec (GHSA-5xrq-8626-4rwp, CVSS 9.8) was unaccepted in v3/@claude-flow/browser. • Bumped `vitest` spec from ^4.0.16 → ^4.1.0 in browser package.json. • Refreshed the workspace pnpm-lock. • Standalone-publish package-lock.json carries workspace:* refs that `npm install` can't resolve in isolation, so I added a time-boxed (expires 2026-09-02) accepted-findings entry citing the limited exposure (devDependency + UI-server-only attack vector) and pinning the next workspace-coordinated lockfile rebuild as the trigger to remove it. Tracking: ruflo#2270. ADR-112 — Tool description discoverability (2 missing "Use when …") • hooks_task-completed: added "Use when native TaskUpdate is wrong because the runtime also needs to record the outcome as a learning signal and emit the standard pipeline event". • hooks_intelligence_unified-stats: added "Use when calling the four narrow aggregators one at a time is wrong because cross-store drift goes silent — this tool surfaces it in the `consistency` block". 327/327 tools now pass; baseline stays at 0. #1921 — Hook-command install safety (4 missing invariants) Both #1951 and #1989 fixes were silently retired by #2196's statusline delegation refactor. Updated scripts/audit-fix-invariants.mjs to track the new reality without dropping coverage: • #1951 (marketplaces/ruflo) — substring became `path.join(home, '.claude', 'plugins', 'marketplaces', 'ruflo', …)` which the literal substring check couldn't see. Switched to a regex form that matches the path.join breakup. • #1989 (SQLite magic-bytes + page-count clamp) — superseded entirely by #2196's delegation pattern: statusline-generator no longer reads raw memory.db bytes; it shells out to `hooks-statusline --json` which queries AgentDB via the typed SDK. The regression vector is closed by ARCHITECTURE. Replaced the two #1989 invariants with one #2196 invariant that locks in the delegation pattern, so a future refactor that reintroduces raw-bytes reading is caught BEFORE the SQLite magic check would be relevant. Audit-script convention says "do NOT delete without confirming the regression is impossible by another mechanism" — this is the documented confirmation. 37 invariants, all present. Local: all 3 audits + the 2 new regression smokes pass. Co-Authored-By: RuFlo <ruv@ruv.net>
82 lines
2.5 KiB
JSON
82 lines
2.5 KiB
JSON
{
|
|
"name": "@claude-flow/browser",
|
|
"version": "3.0.0-alpha.4",
|
|
"description": "Browser automation for AI agents - integrates agent-browser with claude-flow swarms",
|
|
"type": "module",
|
|
"main": "dist/index.js",
|
|
"types": "dist/index.d.ts",
|
|
"exports": {
|
|
".": "./dist/index.js",
|
|
"./mcp-tools": "./dist/mcp-tools/index.js",
|
|
"./skill": "./dist/skill/index.js",
|
|
"./agent": "./dist/agent/index.js"
|
|
},
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"dev": "tsc --watch",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:e2e": "vitest run tests/e2e",
|
|
"lint": "eslint src/",
|
|
"typecheck": "tsc --noEmit",
|
|
"postinstall": "node -e \"const{execSync}=require('child_process');try{execSync('agent-browser --version',{stdio:'ignore'});}catch{console.log('\\n📦 Installing agent-browser globally...');try{execSync('npm install -g agent-browser@latest',{stdio:'inherit'});console.log('✅ agent-browser installed successfully!');}catch(e){console.log('⚠️ Could not install agent-browser globally. Run manually:\\n npm install -g agent-browser@latest');}}\""
|
|
},
|
|
"dependencies": {
|
|
"agent-browser": "^0.27.0",
|
|
"agentic-flow": "^2.0.13",
|
|
"zod": "^3.22.4"
|
|
},
|
|
"overrides": {
|
|
"@opentelemetry/sdk-node": ">=0.218.0",
|
|
"@opentelemetry/auto-instrumentations-node": ">=0.75.0",
|
|
"@opentelemetry/exporter-prometheus": ">=0.217.0",
|
|
"@opentelemetry/core": "1.25.1",
|
|
"@opentelemetry/resources": "1.25.1",
|
|
"@opentelemetry/sdk-trace-base": "1.25.1",
|
|
"axios": ">=1.13.2",
|
|
"fast-uri": ">=3.1.0",
|
|
"hono": ">=4.11.4",
|
|
"@hono/node-server": ">=1.19.10",
|
|
"path-to-regexp": ">=8.2.1",
|
|
"undici": ">=7.18.0",
|
|
"minimatch": ">=10.0.0",
|
|
"@isaacs/brace-expansion": ">=5.0.1",
|
|
"picomatch": ">=4.0.3",
|
|
"flatted": ">=3.4.0",
|
|
"tar": ">=7.5.11",
|
|
"cacache": ">=20.0.0",
|
|
"make-fetch-happen": ">=15.0.0",
|
|
"express-rate-limit": ">=8.4.1",
|
|
"protobufjs": ">=7.5.5",
|
|
"vite": ">=6.4.6",
|
|
"ws": ">=8.18.4"
|
|
},
|
|
"peerDependencies": {
|
|
"@claude-flow/cli": ">=3.5.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^20.10.0",
|
|
"typescript": "^5.3.0",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"keywords": [
|
|
"browser",
|
|
"automation",
|
|
"ai-agent",
|
|
"claude-flow",
|
|
"playwright",
|
|
"web-scraping",
|
|
"testing"
|
|
],
|
|
"author": "ruvnet",
|
|
"license": "MIT",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/ruvnet/claude-flow.git",
|
|
"directory": "v3/@claude-flow/browser"
|
|
},
|
|
"engines": {
|
|
"node": ">=18.0.0"
|
|
}
|
|
}
|