skills/ruvnet__ruflo
1
0
Fork 0
mirror of https://github.com/ruvnet/ruflo.git synced 2026-09-14 14:01:28 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
docs/chatgpt-plugin-reference
ruvnet__ruflo/v3/@claude-flow/guidance/package.json
T
rUv 402b701a9d fix(security): ADR-165 Phase 1 — close 5 critical CVEs + refresh registry + audit CI gate (#2508) 
* fix(security): ADR-165 Phase 1 — close all critical CVEs, refresh registry, add CI gate

Closes ADR-165 Phase 1. Both workspaces pass `npm audit --audit-level=critical`.

## Before (2026-06-29)

| Workspace | Critical | High | Moderate | Total |
|-----------|----------|------|----------|-------|
| Root      | **1**    | 6    | 31       | 38    |
| v3        | **4**    | 33   | 57       | 97    |

## After

| Workspace | Critical | High | Moderate | Total |
|-----------|----------|------|----------|-------|
| Root      | **0**    | 0    | 31       | 31    |
| v3        | **0**    | 27   | 58       | 88    |

All 5 critical advisories closed (vitest GHSA-5xrq, handlebars prototype-pollution,
protobufjs constructor-pollution, plus 2 more in v3). 12 of 39 high advisories
closed via overrides; the remaining 27 v3 highs are deeper transitive chains
that would require breaking-change major bumps — flagged for ADR-165 Phase 2.

## Changes

### Root workspace overrides (package.json)

- `vitest`: `^1.0.0` → `^3.2.6` (closes critical GHSA-5xrq CVSS 9.8)
- `hono`: `>=4.11.4` → `>=4.12.25` (closes 6 hono advisories)
- `undici`: `>=7.18.0` → `>=8.5.0` (closes 7 undici advisories — bumps the
  stale pin that ADR-165 flagged as still-in-vulnerable-range)
- `vite`: `>=6.4.6` → `>=8.0.16` (closes 2 vite advisories)
- NEW `@grpc/grpc-js`: `>=1.14.4`
- NEW `form-data`: `>=4.0.6`
- NEW `http-proxy-middleware`: `>=3.0.7`
- `@hono/node-server`: `>=1.19.10` → `>=1.19.14`

### v3 workspace overrides (v3/package.json + pnpm.overrides)

- `vitest`: `^4.0.16` → `^4.1.0` (and `@vitest/coverage-v8` matched)
- Top-level + pnpm overrides: `handlebars: >=4.7.9`, `protobufjs: >=8.6.0`
- 27 sub-package `package.json` updated to `vitest ^4.1.0`

### CVE registry refresh (v3/@claude-flow/security/src/CVE-REMEDIATION.ts)

Rewritten from 5 stale Jan-2026 entries to 16 total: 15 fixed, 1 open
(ADR165-OPEN-01 — PII pipeline wiring per ADR-164 §6.1 not yet on
dispatch-layer). `SECURITY_SUMMARY` is now computed dynamically from the
registry; `validateRemediation()` correctly returns `allFixed: false`
with 1 issue. ADR-165 §5 flagged this as THE Phase 2 priority — now closed.

### New CI gate

`.github/workflows/cve-audit.yml`:
- `audit-root` — `npm audit --audit-level=critical` in root, blocking
- `audit-v3` — same in v3, blocking
- `audit-high-report` — warn-only summary on high-severity drift
- Triggers: PR, push to main, daily cron

### ADR-165 §9 evidence ledger addendum

Captures AFTER-remediation `npm audit --json` metadata for both workspaces.
The diff between BEFORE (already in §9) and AFTER makes Phase 1 verifiable.

Also CORRECTED one prior surprise in §9: the `validate-input.ts` in
`mcp-tools/` is NOT a 9-line shim. It's 269 lines of real implementation.
(That was an inaccurate findings note from the initial audit.)

### §7.3 research items resolved

- `protobufjs` v3 chain confirmed gone after override pins
- `handlebars` v3 chain confirmed not user-reachable on the workflow path
  (toolchain-only; override sufficient)
- `validate-input.ts` confirmed real implementation, not a shim (registry
  entry corrected)
- CORS surface check: no `cors()` / `app.use(cors` call sites — the hono
  CORS-wildcard advisory is not exploitable on the current server
- ADR-164 §6.1 PII pipeline NOT wired in current agentbbs dispatch —
  recorded as ADR165-OPEN-01 (Phase 3 work)

## Gates (all PASS)

- `npm audit --audit-level=critical` root: exit 0 (was non-zero)
- `npm audit --audit-level=critical` v3:   exit 0 (was non-zero)
- vitest suites: 105/109 pass (4 skip-conditional — same as before)
- ADR-112 audit: 352/352 tools with guidance
- business-pods smoke: 11/11 PASS
- agentbbs smoke: 8/8 PASS
- agenticow smoke: 8/8 PASS
- cli build: clean (tsc)

## Phase 2+ deferred

The 27 v3 high-severity advisories that remain are transitive chains with
no patched-in-range version. ADR-165 §6 Phase 2 picks these up after the
`cve-watch.yml` automation in §6 lands (NEW PR — not in scope here).

Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01WbBa4nccx5aGhXphoHxcni

* chore(lock): regen v3/pnpm-lock.yaml after override updates (PR #2508 CI fix)

PR #2508 added handlebars + protobufjs to v3 overrides + bumped vitest pin,
but v3/pnpm-lock.yaml wasn't regenerated. CI surfaced
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on every install step.

Same pattern as the previous lockfile-drift fixes on PR #2500 and #2503.

* fix(ci): cve-audit.yml jq-only + regen witness manifests for #1609 marker drift

Two PR #2508 CI failures fixed:

1. Static-regression-guard tripped on cve-audit.yml line 52: the static
   YAML strict-parser sees `if high > 0:` inside the `run: |` block as
   a YAML block-mapping key indicator. Refactored all 3 inline-python
   blocks to use jq (preinstalled on ubuntu-latest) — no embedded
   `if x > 0:` lines, so the YAML guard passes.

2. Witness marker drift smoke flagged fix-marker #1609 — the Phase 1
   vitest bump (4.0.16 → 4.1.0) drifted the cited marker string in
   v3/@claude-flow/aidefence/package.json. Updated `marker` field in
   all 3 platform manifests + `desc` to reference ADR-165 Phase 1, then
   re-signed via plugins/ruflo-core/scripts/witness/regen.mjs.

Co-Authored-By: RuFlo <ruv@ruv.net>
2026-06-29 22:41:24 -04:00

199 lines
4.9 KiB
JSON
Raw Permalink Blame History

{
"name": "@claude-flow/guidance",
"version": "3.0.0-alpha.4",
"description": "Guidance Control Plane - Compiles, retrieves, enforces, and evolves guidance rules for Claude Code sessions",
"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"types": "./dist/index.d.ts",
"import": "./dist/index.js"
},
"./compiler": {
"types": "./dist/compiler.d.ts",
"import": "./dist/compiler.js"
},
"./retriever": {
"types": "./dist/retriever.d.ts",
"import": "./dist/retriever.js"
},
"./gates": {
"types": "./dist/gates.d.ts",
"import": "./dist/gates.js"
},
"./hooks": {
"types": "./dist/hooks.d.ts",
"import": "./dist/hooks.js"
},
"./ledger": {
"types": "./dist/ledger.d.ts",
"import": "./dist/ledger.js"
},
"./optimizer": {
"types": "./dist/optimizer.d.ts",
"import": "./dist/optimizer.js"
},
"./headless": {
"types": "./dist/headless.d.ts",
"import": "./dist/headless.js"
},
"./persistence": {
"types": "./dist/persistence.d.ts",
"import": "./dist/persistence.js"
},
"./gateway": {
"types": "./dist/gateway.d.ts",
"import": "./dist/gateway.js"
},
"./manifest-validator": {
"types": "./dist/manifest-validator.d.ts",
"import": "./dist/manifest-validator.js"
},
"./proof": {
"types": "./dist/proof.d.ts",
"import": "./dist/proof.js"
},
"./memory-gate": {
"types": "./dist/memory-gate.d.ts",
"import": "./dist/memory-gate.js"
},
"./coherence": {
"types": "./dist/coherence.d.ts",
"import": "./dist/coherence.js"
},
"./artifacts": {
"types": "./dist/artifacts.d.ts",
"import": "./dist/artifacts.js"
},
"./capabilities": {
"types": "./dist/capabilities.d.ts",
"import": "./dist/capabilities.js"
},
"./evolution": {
"types": "./dist/evolution.d.ts",
"import": "./dist/evolution.js"
},
"./conformance-kit": {
"types": "./dist/conformance-kit.d.ts",
"import": "./dist/conformance-kit.js"
},
"./ruvbot-integration": {
"types": "./dist/ruvbot-integration.d.ts",
"import": "./dist/ruvbot-integration.js"
},
"./trust": {
"types": "./dist/trust.d.ts",
"import": "./dist/trust.js"
},
"./truth-anchors": {
"types": "./dist/truth-anchors.d.ts",
"import": "./dist/truth-anchors.js"
},
"./uncertainty": {
"types": "./dist/uncertainty.d.ts",
"import": "./dist/uncertainty.js"
},
"./temporal": {
"types": "./dist/temporal.d.ts",
"import": "./dist/temporal.js"
},
"./authority": {
"types": "./dist/authority.d.ts",
"import": "./dist/authority.js"
},
"./adversarial": {
"types": "./dist/adversarial.d.ts",
"import": "./dist/adversarial.js"
},
"./meta-governance": {
"types": "./dist/meta-governance.d.ts",
"import": "./dist/meta-governance.js"
},
"./continue-gate": {
"types": "./dist/continue-gate.d.ts",
"import": "./dist/continue-gate.js"
},
"./wasm-kernel": {
"types": "./dist/wasm-kernel.d.ts",
"import": "./dist/wasm-kernel.js"
},
"./generators": {
"types": "./dist/generators.d.ts",
"import": "./dist/generators.js"
},
"./analyzer": {
"types": "./dist/analyzer.d.ts",
"import": "./dist/analyzer.js"
}
},
"files": [
"dist",
"wasm-pkg"
],
"scripts": {
"build": "tsc -p tsconfig.json",
"clean": "rm -rf dist",
"test": "vitest run",
"test:watch": "vitest watch",
"test:coverage": "vitest run --coverage",
"typecheck": "tsc --noEmit"
},
"dependencies": {
"@claude-flow/hooks": "^3.0.0-alpha.7",
"@claude-flow/memory": "^3.0.0-alpha.2",
"@claude-flow/shared": "^3.0.0-alpha.1"
},
"devDependencies": {
"@types/node": "^20.10.0",
"typescript": "^5.3.0",
"vitest": "^4.1.0"
},
"engines": {
"node": ">=20.0.0"
},
"keywords": [
"claude-flow",
"claude-code",
"claude",
"anthropic",
"ai-agent",
"ai-governance",
"agent-governance",
"guidance",
"control-plane",
"policy-enforcement",
"enforcement-gates",
"proof-chain",
"trust-system",
"long-horizon",
"autonomous-agent",
"claude-md",
"CLAUDE.md",
"memory-governance",
"adversarial-defense",
"prompt-injection",
"wasm",
"ruvbot",
"ruv",
"ai-safety",
"agent-orchestration",
"multi-agent",
"code-generation",
"llm-governance",
"mcp",
"model-context-protocol"
],
"author": "Claude Flow Team",
"license": "MIT",
"repository": {
"type": "git",
"url": "https://github.com/ruvnet/claude-flow.git",
"directory": "v3/@claude-flow/guidance"
},
"publishConfig": {
"access": "public",
"tag": "v3alpha"
}
}
Reference in New Issue View Git Blame Copy Permalink