package.json

{
  "name": "@roarpeng/graphflow",
  "version": "2.2.0",
  "publishConfig": {
    "access": "public"
  },
  "files": [
    "dist",
    "wasm",
    "scripts/safe-postinstall.cjs",
    "plugin.json",
    "mcp.json",
    "cordis.patch.yml",
    "dsh",
    "opencode",
    "web",
    "skills",
    "src/surfaces/trae-skill",
    "src/surfaces/trae-rules",
    "src/surfaces/cursor-rules",
    "src/surfaces/antigravity-rules",
    "src/surfaces/copilot-instructions",
    "README.md",
    "README.zh.md",
    "LICENSE",
    "CHANGELOG.md",
    "docs/TESTING-1.27.0.md",
    "AGENTS.md",
    "CLAUDE.md",
    "scripts/cross-platform-check.mjs"
  ],
  "packageManager": "npm@10.9.2",
  "workspaces": [
    "packages/*"
  ],
  "engines": {
    "node": ">=20",
    "npm": ">=10"
  },
  "description": "Local-first memory & context harness for coding agents",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
  "exports": {
    ".": {
      "types": "./dist/index.d.ts",
      "default": "./dist/index.js"
    },
    "./dsh": "./dsh/plugin.mjs",
    "./dsh/package.json": "./package.json",
    "./web": "./web/plugin.mjs",
    "./client": "./dsh/client.js",
    "./package.json": "./package.json"
  },
  "bin": {
    "graphflow": "dist/surfaces/cli/index.js",
    "graphflow-mcp": "dist/surfaces/mcp/server.js"
  },
  "directories": {
    "doc": "docs"
  },
  "scripts": {
    "postinstall": "node scripts/safe-postinstall.cjs",
    "prepublishOnly": "npm run build",
    "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",
    "wasm:download": "node scripts/bundle-wasm-grammars.cjs",
    "test": "vitest run",
    "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",
    "test:watch": "vitest",
    "start": "tsx src/surfaces/cli/index.ts",
    "start:mcp": "tsx src/surfaces/mcp/server.ts",
    "benchmark": "tsx benchmarks/run-token-benchmark.ts",
    "benchmark:skills": "tsx benchmarks/run-skill-ab-benchmark.ts",
    "benchmark:ab": "tsx benchmarks/run-skill-ab.ts",
    "benchmark:memory": "tsx benchmarks/run-memory-ab.ts",
    "benchmark:retrieval": "tsx benchmarks/run-retrieval-eval.ts",
    "benchmark:comprehensive": "tsx benchmarks/run-comprehensive-bench.ts",
    "benchmark:independent": "tsx benchmarks/run-independent-bench.ts",
    "benchmark:swe-bench": "tsx benchmarks/run-swe-bench-eval.ts",
    "benchmark:swe-bench-real": "tsx benchmarks/run-swe-bench-real.ts",
    "benchmark:swe-bench-agent": "tsx benchmarks/run-swe-bench-agent.ts",
    "benchmark:plugin-ab": "tsx benchmarks/run-plugin-ab.ts",
    "benchmark:real-task-ab": "tsx benchmarks/run-real-task-ab.ts",
    "bench:retrieval": "tsx benchmarks/run-retrieval-eval.ts",
    "bench:token": "tsx benchmarks/run-token-benchmark.ts",
    "bench:skill-ab": "tsx benchmarks/run-skill-ab-benchmark.ts && tsx benchmarks/run-skill-ab.ts",
    "bench:memory": "tsx benchmarks/run-memory-ab.ts",
    "bench:all": "npm run bench:retrieval && npm run bench:token && npm run bench:skill-ab && npm run bench:memory",
    "proof:flywheel": "tsx benchmarks/run-flywheel-proof.ts",
    "dataset:retrieval": "tsx benchmarks/export-retrieval-dataset.ts",
    "backfill:episodes": "node scripts/backfill-episodes.cjs",
    "lint": "eslint .",
    "build:extension": "npm --prefix vscode-extension run build",
    "test:extension": "npm --prefix vscode-extension run test:runtime",
    "package:extension": "npm --prefix vscode-extension run package",
    "sync:surfaces": "node scripts/sync-surfaces.cjs",
    "ci": "npm run lint && npm run build && npm test && npm run build:extension && npm run test:extension",
    "gate:release": "node scripts/release-gates.cjs",
    "gate:eff-agent": "node packages/efficiency-agent/scripts/release-gate.mjs",
    "security:audit": "node scripts/security-audit.cjs",
    "test:coverage": "vitest run --coverage",
    "prepare": "node scripts/prepare-hook.cjs",
    "benchmark:eff": "tsx benchmarks/run-eff-bench.ts",
    "benchmark:real": "tsx benchmarks/run-real-ab.ts"
  },
  "lint-staged": {
    "*.ts": "eslint --fix"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/Roarpeng/GraphFlow.git"
  },
  "keywords": [
    "memory-harness",
    "context-harness",
    "local-first",
    "mcp",
    "knowledge-graph",
    "coding-agents",
    "cursor",
    "claude-code",
    "dsh-plugin",
    "deepseek-harness",
    "dsh",
    "dsh-plugins",
    "deepseek-harness-plugin",
    "cordis",
    "cordis-plugin"
  ],
  "dsh": {
    "plugin": true,
    "kind": "server",
    "bundle": {
      "patch": "./cordis.patch.yml"
    },
    "client": {
      "platform": "web",
      "inject": [
        "@deepseek-ai/dsh-api-session-controller",
        "@deepseek-ai/dsh-client-connection",
        "@deepseek-ai/dsh-client-ui-renderer"
      ]
    }
  },
  "author": "Roarpeng",
  "license": "Apache-2.0",
  "bugs": {
    "url": "https://github.com/Roarpeng/GraphFlow/issues"
  },
  "homepage": "https://github.com/Roarpeng/GraphFlow#readme",
  "devDependencies": {
    "@emnapi/core": "^1.11.1",
    "@emnapi/runtime": "^1.11.1",
    "@types/better-sqlite3": "^7.6.13",
    "@types/node": "^25.9.1",
    "@typescript-eslint/eslint-plugin": "^8.60.0",
    "@typescript-eslint/parser": "^8.60.0",
    "@vitest/coverage-v8": "^3.2.6",
    "eslint": "^10.4.0",
    "husky": "^9.1.7",
    "lint-staged": "^16.4.0",
    "pino-pretty": "^13.1.3",
    "prettier": "^3.8.3",
    "tree-sitter-wasms": "^0.1.13",
    "tsx": "^4.22.3",
    "typescript": "^6.0.3",
    "vitest": "^3.2.6"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.30.0",
    "ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "gpt-tokenizer": "^3.4.0",
    "pino": "^10.3.1",
    "web-tree-sitter": "^0.25.10"
  },
  "optionalDependencies": {
    "@firecrawl/anydoc": "^0.1.7",
    "@huggingface/transformers": "^4.3.0",
    "better-sqlite3": "^12.10.0",
    "typescript": "^6.0.3"
  },
  "overrides": {
    "hono": "^4.13.10",
    "@hono/node-server": "^1.19.15",
    "body-parser": "^2.3.0",
    "fast-uri": "^3.1.7",
    "ip-address": "^10.7.2",
    "qs": "^6.16.0"
  },
  "overridesComment": "Pinned past advisories in transitive deps. Six were non-breaking and lifted npm audit to zero: hono (cross-request data disclosure / ReDoS / SSRF-adjacent parser issues), @hono/node-server (Windows path traversal via encoded backslash), body-parser (DoS when an invalid limit silently disables size enforcement), fast-uri (host confusion and SSRF), ip-address (SSRF via octet and IPv6 misclassification), qs (array-limit bypass, DoS). The only remaining route was @huggingface/transformers 3.x -> 4.3.0, which pulls sharp 0.35.5 and clears the libvips/libheif CVEs; verified against the exact API surface used in src/learning/embeddings.ts (pipeline, env.cacheDir, env.remoteHost).",
  "disclosure": {
    "cloud": true,
    "network": [
      "https://api.deepseek.com",
      "https://api.openai.com",
      "https://api.anthropic.com",
      "https://dashscope.aliyuncs.com",
      "https://ark.cn-beijing.volces.com",
      "https://huggingface.co"
    ],
    "offline_mode": true,
    "api_keys": [
      {
        "env": "DEEPSEEK_API_KEY",
        "storage": "file-0600"
      },
      {
        "env": "OPENAI_API_KEY",
        "storage": "file-0600"
      },
      {
        "env": "ANTHROPIC_API_KEY",
        "storage": "file-0600"
      },
      {
        "env": "DASHSCOPE_API_KEY",
        "storage": "file-0600"
      },
      {
        "env": "ARK_API_KEY",
        "storage": "file-0600"
      }
    ],
    "permissions": {
      "filesystem": "read workspace sources; write graphflow-out/, .graphflow/, .graphflow-cache/ in the workspace; global config ~/.graphflow.config.json (0600)",
      "network": "LLM provider APIs listed in disclosure.network, only when a provider is configured; huggingface.co only for the first semantic-embedding model download (mirrorable via HF_ENDPOINT; embeddingProvider 'fnv' avoids it entirely); indexing/context/compression need no network",
      "environment": "read provider API keys from environment variables (disclosure.api_keys); no environment writes"
    },
    "jurisdiction": []
  }
}