mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-09-14 14:01:28 +08:00
rUv
745dfbe327
* fix(security): dedup better-sqlite3 to patched 12.9.0 across dependency tree Fixes #2736 (defense-in-depth mitigation). SQLite's documented WAL-Reset Bug (sqlite.org/wal.html §11) is a race between overlapping checkpoint operations and a WAL-resetting commit that can make a later checkpoint skip a committed transaction, silently losing acknowledged writes and/or corrupting index/table structure. Affects SQLite 3.7.0-3.51.2; fixed in 3.51.3, backported to 3.44.6 and 3.50.7. agentdb's own published dependency floor (`better-sqlite3@^11.8.1`, confirmed in this tree resolving to 11.10.0, which bundles vulnerable SQLite 3.49.2) created a mixed-engine tree alongside this repo's own direct dependency on better-sqlite3 12.9.0 (patched SQLite 3.53.0, via v3/@claude-flow/memory). Multiple concurrent connections (daemon, MCP servers, CLI invocations) issuing wal_checkpoint(PASSIVE) after every memory-bridge store is exactly the race precondition this bug requires. This forces a single deduplicated better-sqlite3 build tree-wide via pnpm overrides, pinned to the exact version this repo's own @claude-flow/memory package already depends on directly (12.9.0, bundling patched SQLite 3.53.0) — no new version to vet, just true deduplication of agentdb's nested resolution into the already-patched copy. Changes (following this repo's existing #2112-lesson override convention — multiple package.json files, each consumed a different way): - v3/package.json: pnpm.overrides (the v3 pnpm workspace root — this is where agentdb's better-sqlite3@11.10.0 actually lived pre-fix) - v3/@claude-flow/cli/package.json: npm-style overrides (effective when @claude-flow/cli is npm-installed standalone via npx) - package.json (root "claude-flow" umbrella): bumped the existing ">=12.8.0" override to an exact "12.9.0" pin, AND added a pnpm.overrides block — the bare "overrides" key alone is silently ignored by pnpm (only read by npm), so the pre-existing override was a no-op for local `pnpm install` at repo root despite being present in package.json for a while - ruflo/package.json: bumped ">=12.8.0" to exact "12.9.0" (npm-style, effective for `npx ruflo@latest`) - v3/pnpm-lock.yaml, pnpm-lock.yaml: regenerated via `pnpm install` Verification: - `pnpm why -r better-sqlite3` (v3/) and `pnpm why better-sqlite3` (root): exactly one resolved version, 12.9.0, everywhere - Confirmed via realpath resolution (not hoisted symlink) from each of the 4 installed agentdb versions' own on-disk directories (1.6.1, 2.0.0-alpha.3.4, 2.0.0-alpha.3.7, 3.0.0-alpha.17) that each now binds the same deduplicated better-sqlite3@12.9.0 copy - `db.prepare('select sqlite_version()').get()` from that binding returns 3.53.0 (>= 3.51.3 patched floor) - v3/@claude-flow/memory test suite: 438/442 passing; the 4 failures are pre-existing Windows path-separator and perf-threshold issues unrelated to SQLite (none of the failing test files touch better-sqlite3/sqlite at all) Not fixed here (upstream, out of reach from this repo): - agentdb's own published package.json floor (`^11.8.1`) is unchanged — this override is a same-repo mitigation, not a fix to agentdb itself. agentdb needs the same bump upstream. Not touched here (explicitly out of scope, separate/riskier change): - The wal_checkpoint(PASSIVE)-after-every-store pattern in memory-bridge.ts (#2558) is left as-is; the issue calls that "defense-in-depth" / optional, and dedup alone removes the mixed-engine race precondition regardless. Co-Authored-By: RuFlo <ruv@ruv.net> * fix(deps): regenerate package-lock.json for better-sqlite3 dedup override package.json pins the better-sqlite3 override to 12.9.0 (patched, fixes the WAL-reset bug) but package-lock.json still resolved a stray top-level better-sqlite3@12.10.0 and was missing the nested better-sqlite3@12.9.0 entries under @claude-flow/memory, agentdb, and agentic-flow — causing npm ci to fail in CI with "Missing: better-sqlite3@12.9.0 from lock file". Co-Authored-By: RuFlo <ruv@ruv.net> * fix(deps): restore better-sqlite3 as direct root optionalDependency The #2736 dedup fix pinned better-sqlite3 to 12.9.0 via a pure "overrides" entry (no direct dependency), which removed the top-level hoisted node_modules/better-sqlite3 that used to exist under the looser ">=12.8.0" override. That silently broke the "graph schema smoke (ADR-130 P1)" CI job: its "npm rebuild better-sqlite3" step (and graph-edge-writer.ts's bare `await import('better-sqlite3')`, which Node resolves by walking up node_modules from the importing file) had nothing at the root to rebuild/resolve, so _openDb() failed closed and insertGraphEdge() silently returned false — 8/22 assertions failing. Restoring the direct optionalDependency (matching what this file already had historically, before the override-only refactor) gives npm a concrete anchor to hoist a single deduplicated copy back to root node_modules, preserving the override's version pin while keeping the graph-edge-writer's resolution path intact. Regenerated package-lock.json accordingly. Verified locally: `npm rebuild better-sqlite3` now finds and rebuilds the root copy, and a direct insertGraphEdge() call against a real better-sqlite3 handle returns true. Co-Authored-By: RuFlo <ruv@ruv.net> * fix(deps): resync v3/pnpm-lock.yaml specifier after merging main Merging main (which carries #2748's direct better-sqlite3 dependency on @claude-flow/cli) forward into this branch left the recorded lockfile specifier at the pre-override "^12.9.0" while this branch's own overrides.better-sqlite3 pin ("12.9.0", exact) is now the effective spec pnpm resolves against — a one-line drift causing `pnpm install --frozen-lockfile` to fail across the whole v3-ci.yml matrix. Regenerated to match. Co-Authored-By: RuFlo <ruv@ruv.net> * fix(memory): force WAL checkpoint before close in graph-edge-writer The "graph schema smoke (ADR-130 P1)" CI job started failing deterministically on Linux runners after the better-sqlite3 dedup (this branch) pinned a single 12.9.0 build tree-wide: TEST 2/3 insert-then-reread assertions found embedding_ref/source_id undefined immediately after _resetBridgeDb() closed the write connection. _resetBridgeDb()'s close() relied on SQLite's implicit "last connection close" PASSIVE auto-checkpoint to flush the WAL into the main file before a same-process sql.js reader re-reads the raw file. That's best-effort, not guaranteed synchronous, and evidently more prone to leaving data in the WAL under Linux CI's I/O/lock timing than on Windows (did not reproduce locally). Not a correctness regression in 12.9.0 itself — a latent timing assumption the dedup made newly observable by changing which exact build backs every connection. Force a blocking `wal_checkpoint(TRUNCATE)` before close so the main file always reflects committed writes before any other reader (same process or otherwise) touches it, regardless of platform timing. Co-Authored-By: RuFlo <ruv@ruv.net>
85 lines
3.2 KiB
JSON
85 lines
3.2 KiB
JSON
{
|
|
"name": "@claude-flow/v3-monorepo",
|
|
"version": "3.0.0-alpha.1",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Claude Flow V3 - Modular AI Agent Coordination System",
|
|
"workspaces": [
|
|
"@claude-flow/*",
|
|
"claude-flow"
|
|
],
|
|
"scripts": {
|
|
"build": "pnpm -r build",
|
|
"test": "vitest run",
|
|
"test:unit": "vitest run __tests__/unit",
|
|
"test:integration": "vitest run __tests__/integration",
|
|
"test:integration:watch": "vitest watch __tests__/integration",
|
|
"test:integration:memory": "vitest run __tests__/integration/memory-integration.test.ts",
|
|
"test:integration:swarm": "vitest run __tests__/integration/swarm-integration.test.ts",
|
|
"test:integration:mcp": "vitest run __tests__/integration/mcp-integration.test.ts",
|
|
"test:integration:plugin": "vitest run __tests__/integration/plugin-integration.test.ts",
|
|
"test:integration:workflow": "vitest run __tests__/integration/workflow-integration.test.ts",
|
|
"test:coverage": "vitest run --coverage",
|
|
"test:coverage:integration": "vitest run __tests__/integration --coverage",
|
|
"test:security": "pnpm --filter @claude-flow/security test",
|
|
"test:memory": "pnpm --filter @claude-flow/memory test",
|
|
"test:swarm": "pnpm --filter @claude-flow/swarm test",
|
|
"bench": "pnpm --filter @claude-flow/performance bench",
|
|
"bench:attention": "pnpm --filter @claude-flow/performance bench:attention",
|
|
"typecheck": "pnpm -r typecheck",
|
|
"clean": "rm -rf node_modules @claude-flow/*/node_modules claude-flow/node_modules",
|
|
"publish:dry": "pnpm --filter claude-flow publish --dry-run --tag v3alpha --no-git-checks",
|
|
"publish:v3alpha": "pnpm --filter claude-flow publish --tag v3alpha --no-git-checks",
|
|
"version:patch": "pnpm -r exec npm version patch",
|
|
"version:minor": "pnpm -r exec npm version minor",
|
|
"version:major": "pnpm -r exec npm version major",
|
|
"bun:install": "bun install",
|
|
"bun:build": "bun run --filter '*' build",
|
|
"bun:test": "bun test",
|
|
"bun:dev": "bun run --watch src/index.ts",
|
|
"bun:publish:dry": "cd claude-flow && bun publish --dry-run --tag v3alpha",
|
|
"bun:publish:v3alpha": "cd claude-flow && bun publish --tag v3alpha"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^20.0.0",
|
|
"@vitest/coverage-v8": "^4.1.0",
|
|
"typescript": "^5.9.3",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"engines": {
|
|
"node": ">=20.0.0",
|
|
"pnpm": ">=8.0.0"
|
|
},
|
|
"packageManager": "pnpm@8.15.0",
|
|
"dependencies": {
|
|
"semantic-release": "25.0.2"
|
|
},
|
|
"overrides": {
|
|
"handlebars": ">=4.7.9",
|
|
"protobufjs": ">=8.6.0"
|
|
},
|
|
"pnpm": {
|
|
"neverBuiltDependencies": [
|
|
"onnxruntime-node",
|
|
"sharp"
|
|
],
|
|
"overrides": {
|
|
"@ruvector/gnn": "0.1.25",
|
|
"@ruvector/gnn-linux-x64-gnu": "0.1.25",
|
|
"vitest": ">=4.1.0",
|
|
"@vitest/coverage-v8": ">=4.1.0",
|
|
"handlebars": ">=4.7.9",
|
|
"protobufjs": ">=8.6.0",
|
|
"@ruvector/ruvllm": ">=2.6.0",
|
|
"js-yaml": ">=4.3.0",
|
|
"express": ">=4.22.2",
|
|
"qs": ">=6.15.2",
|
|
"@opentelemetry/core": ">=2.8.0",
|
|
"@opentelemetry/resources": ">=2.8.0",
|
|
"@opentelemetry/sdk-trace-base": ">=2.8.0",
|
|
"@opentelemetry/sdk-node": ">=0.220.0",
|
|
"better-sqlite3": "12.9.0"
|
|
}
|
|
}
|
|
}
|