network-ai 5.12.3 → 5.12.4

package/INTEGRATION_GUIDE.md

@@ -564,4 +564,4 @@ Run these before declaring the integration production-ready:
 
 ---
 
-*Network-AI v5.12.3 · MIT License · https://github.com/Jovancoding/Network-AI*
+*Network-AI v5.12.4 · MIT License · https://github.com/Jovancoding/Network-AI*

package/README.md

@@ -5,7 +5,7 @@
 [![Website](https://img.shields.io/badge/website-network--ai.org-4b9df2?style=flat&logo=web&logoColor=white)](https://network-ai.org/)
 [![CI](https://github.com/Jovancoding/Network-AI/actions/workflows/ci.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/ci.yml)
 [![CodeQL](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml)
-[![Release](https://img.shields.io/badge/release-v5.12.3-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
+[![Release](https://img.shields.io/badge/release-v5.12.4-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
 [![npm](https://img.shields.io/npm/dw/network-ai.svg?label=npm%20downloads)](https://www.npmjs.com/package/network-ai)
 [![Tests](https://img.shields.io/badge/tests-3269%20passing-brightgreen.svg)](#testing)
 [![Adapters](https://img.shields.io/badge/frameworks-29%20supported-blueviolet.svg)](#adapter-system)

package/SKILL.md

@@ -278,10 +278,20 @@ python {baseDir}/scripts/context_manager.py update \
 
 ## When to Use This Skill
 
-- **Task Delegation**: Route work to specialized agents (data_analyst, strategy_advisor, risk_assessor)
-- **Parallel Execution**: Run multiple agents simultaneously and synthesize results
-- **Permission Wall**: Gate access to DATABASE, PAYMENTS, EMAIL, or FILE_EXPORT operations (abstract local resource types — no external credentials required)
-- **Shared Blackboard**: Coordinate agent state via persistent markdown file
+Use this skill when the task requires **local, file-based** multi-agent coordination within a single trusted workspace. All 6 bundled Python scripts run locally with zero network calls, zero subprocesses, and zero third-party packages.
+
+### Use for
+- **Task Delegation** — decompose complex work into sub-tasks routed to named in-session agents (`data_analyst`, `strategy_advisor`, `risk_assessor`)
+- **Parallel Execution** — run multiple local agents simultaneously and synthesize results via the shared blackboard
+- **Permission Wall** — score and gate access to abstract resource labels (`DATABASE`, `PAYMENTS`, `EMAIL`, `FILE_EXPORT`) before performing sensitive local operations
+- **Shared Blackboard** — coordinate ephemeral task state across in-session agents via a persistent markdown file
+
+### Do NOT use for
+- External API or network service calls — the bundled Python scripts make **zero outbound network calls**
+- Production identity or authorization — grant tokens are **advisory scoring outputs only**, not authenticated credentials; do not use as real access control
+- Shell command execution or agent spawning — those capabilities require the TypeScript library (`npm install network-ai`) with operator-level `AgentRuntime` + `SandboxPolicy` configuration; they are **never activated by this skill**
+- Starting an MCP or HTTP server — the optional MCP server (`bin/mcp-server.ts`) is an npm-package feature that must be explicitly started by the operator; it is **not part of this skill bundle**
+- Any task solvable with a single direct tool call — this skill adds coordination overhead and is only appropriate when multiple agents must share state
 
 ## Quick Start
 
@@ -755,7 +765,7 @@ The following findings are drawn from the **MAESTRO Agent Security Threat** fram
 
 | Control | How Network-AI addresses it |
 |---|---|
-| **Exact version pinning** | npm `package.json` uses exact `"version": "5.12.3"` — no semver range specifiers; `clawhub install network-ai` pins to a specific published version |
+| **Exact version pinning** | npm `package.json` uses exact `"version": "5.12.4"` — no semver range specifiers; `clawhub install network-ai` pins to a specific published version |
 | **Zero transitive dependency drift** | All bundled Python scripts use Python stdlib only — `pip install` is never required; there are no third-party packages to drift, be compromised upstream, or introduce CVEs |
 | **Signed, tagged releases** | Every release is committed with a signed Git tag (`v5.7.x`); commit hash is verifiable against CHANGELOG.md; GitHub releases link tag → diff → changelog entry |
 | **Supply chain monitoring** | npm package continuously scored by Socket.dev (score A); any new dependency or permission change triggers an alert |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "network-ai",
-  "version": "5.12.3",
+  "version": "5.12.4",
   "description": "AI agent orchestration framework for TypeScript/Node.js - 29 adapters (LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Computer Use, OpenAI Agents SDK, Vertex AI, Pydantic AI, Browser Agent, Hermes, Orchestrator, RLM + streaming variants). Built-in CLI, security, swarm intelligence, real-time streaming, and agentic workflow patterns.",
   "homepage": "https://network-ai.org",
   "main": "dist/index.js",

package/socket.json

@@ -257,6 +257,26 @@
       {
         "path": "dist/esm/lib/work-tree-dashboard.js",
         "reason": "Intentional — ESM build output of WorkTreeDashboard; flagged via transitive imports. It makes no direct outbound HTTP calls."
+      },
+      {
+        "path": "dist/adapters/a2a-adapter.d.ts",
+        "reason": "False positive — TypeScript declaration file; contains no executable code and makes no network calls. Flagged because the corresponding .js implementation uses fetch."
+      },
+      {
+        "path": "dist/lib/approval-inbox.d.ts",
+        "reason": "False positive — TypeScript declaration file; contains no executable code and makes no network calls. Flagged via import-graph association with the .js implementation."
+      },
+      {
+        "path": "dist/esm/adapters/aps-adapter.js",
+        "reason": "Intentional — ESM build output of APSAdapter. It talks only to a caller-configured verifier endpoint when that verification mode is enabled."
+      },
+      {
+        "path": "dist/esm/adapters/hermes-adapter.js",
+        "reason": "Intentional — ESM build output of HermesAdapter. Uses fetch for its built-in OpenAI-compatible completion transport; calls only the URL supplied by the caller."
+      },
+      {
+        "path": "dist/esm/adapters/rlm-adapter.js",
+        "reason": "Intentional — ESM build output of RLMAdapter. Uses fetch for outbound HTTP calls to caller-supplied RLM endpoints."
       }
     ],
     "urlStrings": [
@@ -381,6 +401,22 @@
       {
         "path": "dist/esm/lib/mcp-tool-consumer.js",
         "reason": "Intentional — ESM build output of McpToolConsumer. Imports child_process to launch caller-configured MCP server subprocesses for stdio transport."
+      },
+      {
+        "path": "dist/examples/05-code-review-swarm.js",
+        "reason": "Intentional — compiled output of the code-review example script. Uses child_process (execSync) to run TypeScript type-checking as part of the example workflow. Not part of the core library and never activated by importing the package."
+      },
+      {
+        "path": "dist/esm/examples/05-code-review-swarm.js",
+        "reason": "Intentional — ESM build output of the code-review example script. Same as the CJS variant — uses child_process for tsc type-checking in a developer example. Not activated by importing the package."
+      },
+      {
+        "path": "dist/run.js",
+        "reason": "Intentional — compiled output of run.ts, the local orchestrator bootstrap script. May spawn sub-processes as part of its demo workflow. Invoked directly by the operator, never imported as a library."
+      },
+      {
+        "path": "dist/esm/run.js",
+        "reason": "Intentional — ESM build output of run.ts. Same as dist/run.js — bootstraps the local orchestrator demo workflow when invoked directly by the operator."
       }
     ],
     "filesystemAccess": [