network-ai 5.13.3 → 5.14.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "network-ai",
-  "version": "5.13.3",
-  "description": "AI agent orchestration framework for TypeScript/Node.js - 29 adapters (LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Computer Use, OpenAI Agents SDK, Vertex AI, Pydantic AI, Browser Agent, Hermes, Orchestrator, RLM + streaming variants). Built-in CLI, security, swarm intelligence, real-time streaming, and agentic workflow patterns.",
+  "version": "5.14.0",
+  "description": "AI agent orchestration framework for TypeScript/Node.js - 32 adapters (LangChain, AutoGen, CrewAI, OpenAI Assistants, OpenAI Responses, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Computer Use, Claude Agent SDK, OpenAI Agents SDK, Vertex AI, Gemini, Pydantic AI, Browser Agent, Hermes, Orchestrator, RLM + streaming variants). Built-in CLI, security, swarm intelligence, real-time streaming, and agentic workflow patterns.",
   "homepage": "https://network-ai.org",
   "main": "dist/index.js",
   "module": "dist/esm/index.js",
@@ -73,7 +73,8 @@
     "socket:check": "node scripts/socket-check.js",
     "socket:check:local": "node scripts/socket-check.js --local",
     "codeql:check": "node scripts/codeql-check.js",
-    "clawhub:check": "node scripts/clawhub-check.js"
+    "clawhub:check": "node scripts/clawhub-check.js",
+    "clawhub:publish": "node scripts/clawhub-publish.js"
   },
   "keywords": [
     "ai-agents",
@@ -126,9 +127,9 @@
     "python": ">=3.9"
   },
   "devDependencies": {
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.0.1",
     "dotenv": "^17.4.2",
-    "openai": "^6.44.0",
+    "openai": "^6.45.0",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.3"
   },

package/scripts/blackboard.py

@@ -1,12 +1,19 @@
 #!/usr/bin/env python3
 # SECURITY: This script makes NO network calls and spawns NO subprocesses.
 # All I/O is local file operations only:
-#   READS:  swarm-blackboard.md, data/pending_changes/<id>.json
-#   WRITES: swarm-blackboard.md, data/pending_changes/<id>.json
+#   READS:  <data_dir>/swarm-blackboard.md, <data_dir>/pending_changes/<id>.json,
+#           <data_dir>/.blackboard.lock
+#   WRITES: <data_dir>/swarm-blackboard.md, <data_dir>/pending_changes/<id>.json,
+#           <data_dir>/.blackboard.lock
+#   where <data_dir> is "data/" by default, or "data/<env>/" when NETWORK_AI_ENV
+#   is set or --env is passed (env in: dev|st|sit|qa|sandbox|preprod|prod). This
+#   only changes WHICH data/ subdirectory is used — no path outside the project
+#   root is ever read or written (see the --path check below).
 # --path controls the blackboard file path only and is validated against the project
 # root directory; paths outside the project directory are rejected (CWE-22).
-# Lock files and pending-change files always resolve from the global data/ directory
-# regardless of --path; only the main blackboard file path is affected by --path.
+# Lock files and pending-change files always resolve from the active env-scoped
+# data directory regardless of --path; only the main blackboard file path is
+# affected by --path.
 # Imports used: argparse, json, os, re, sys, time, hashlib, datetime, pathlib,
 #               typing, contextlib, fcntl (Unix file-lock only, no network use)
 # No imports of: requests, socket, subprocess, urllib, http, ssl, ftplib, smtplib

package/scripts/clawhub-publish.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+/**
+ * clawhub-publish.js — ClawHub skill publisher for network-ai
+ *
+ * ClawHub CLI v0.23+ detects package.json in the repo root and refuses
+ * `clawhub skill publish .` ("This looks like a plugin"). This script works
+ * around that by staging the 12 bundle files into a temp directory (no
+ * package.json) and publishing from there.
+ *
+ * Usage:   node scripts/clawhub-publish.js [--dry-run] [--changelog "text"]
+ *          npm run clawhub:publish
+ *          npm run clawhub:publish -- --dry-run
+ *          npm run clawhub:publish -- --changelog "my changelog text"
+ *
+ * The version, slug, and name are read from skill.json automatically.
+ * Source provenance (repo / commit / ref) is read from git automatically.
+ * Exit: 0 = published   1 = error
+ */
+
+'use strict';
+
+const fs   = require('fs');
+const os   = require('os');
+const path = require('path');
+const { execSync, spawnSync } = require('child_process');
+
+const ROOT = path.join(__dirname, '..');
+
+// ── Files to stage (must match clawhub-check.js ALLOW_FILES) ─────────────────
+const STAGE_FILES = [
+  '.clawhubignore',
+  '.clawignore',
+  'SKILL.md',
+  'requirements.txt',
+  'skill.json',
+  'swarm-blackboard.md',
+  'scripts/blackboard.py',
+  'scripts/check_permission.py',
+  'scripts/context_manager.py',
+  'scripts/revoke_token.py',
+  'scripts/swarm_guard.py',
+  'scripts/validate_token.py',
+];
+
+const SKILL_NAME = 'Network-AI';
+const SKILL_SLUG = 'network-ai';
+
+const c = {
+  reset: '\x1b[0m', bold: '\x1b[1m', red: '\x1b[31m',
+  green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
+};
+
+// ── Parse CLI args ────────────────────────────────────────────────────────────
+const args = process.argv.slice(2);
+const dryRun   = args.includes('--dry-run');
+const clIdx    = args.indexOf('--changelog');
+const changelog = clIdx !== -1 ? args[clIdx + 1] : undefined;
+
+// ── Read version from skill.json ──────────────────────────────────────────────
+const skillJson = JSON.parse(fs.readFileSync(path.join(ROOT, 'skill.json'), 'utf8'));
+const version   = skillJson.version;
+if (!version) { console.error(`${c.red}skill.json missing "version"${c.reset}`); process.exit(1); }
+
+// ── Read git provenance ───────────────────────────────────────────────────────
+function git(cmd) {
+  try { return execSync(`git -C "${ROOT}" ${cmd}`, { stdio: ['pipe','pipe','pipe'] }).toString().trim(); }
+  catch { return undefined; }
+}
+const sourceCommit = git('rev-parse --short HEAD');
+const sourceRef    = git('describe --tags --exact-match HEAD') ? `refs/tags/${git('describe --tags --exact-match HEAD')}` : git('rev-parse --abbrev-ref HEAD');
+const remoteUrl    = git('remote get-url origin') || '';
+const repoMatch    = remoteUrl.match(/github\.com[:/](.+?)(?:\.git)?$/);
+const sourceRepo   = repoMatch ? repoMatch[1] : undefined;
+
+// ── Create staging directory ──────────────────────────────────────────────────
+const stage = path.join(os.tmpdir(), 'network-ai-skill-publish');
+if (fs.existsSync(stage)) fs.rmSync(stage, { recursive: true });
+fs.mkdirSync(stage);
+fs.mkdirSync(path.join(stage, 'scripts'));
+
+for (const rel of STAGE_FILES) {
+  const src = path.join(ROOT, rel);
+  const dst = path.join(stage, rel);
+  if (fs.existsSync(src)) {
+    fs.copyFileSync(src, dst);
+  } else {
+    console.warn(`${c.gray}  skipped (not found): ${rel}${c.reset}`);
+  }
+}
+
+// ── Build clawhub command ─────────────────────────────────────────────────────
+// NOTE: spawnSync(..., { shell: true }) does NOT auto-quote array elements —
+// any argument containing a space is split into multiple shell tokens by
+// cmd.exe, which the clawhub CLI then rejects as extra positional arguments.
+// quoteArg() wraps any element that needs it so it survives the shell hop.
+function quoteArg(arg) {
+  const str = String(arg);
+  if (str === '' || /[\s"()&|<>^]/.test(str)) {
+    return `"${str.replace(/"/g, '\\"')}"`;
+  }
+  return str;
+}
+
+const cmd = ['clawhub', 'skill', 'publish', stage,
+  '--slug',    SKILL_SLUG,
+  '--name',    SKILL_NAME,
+  '--version', version,
+  '--tags',    'latest',
+];
+if (changelog)    cmd.push('--changelog',      changelog);
+if (sourceRepo)   cmd.push('--source-repo',    sourceRepo);
+if (sourceCommit) cmd.push('--source-commit',  sourceCommit);
+if (sourceRef)    cmd.push('--source-ref',     sourceRef);
+if (dryRun)       cmd.push('--dry-run');
+
+console.log(`\n${c.bold}ClawHub Skill Publish${c.reset}`);
+console.log(`${'─'.repeat(50)}`);
+console.log(`  Skill  : ${SKILL_NAME}  (${SKILL_SLUG})`);
+console.log(`  Version: ${version}${dryRun ? '  [dry-run]' : ''}`);
+console.log(`  Commit : ${sourceCommit || '(unknown)'}`);
+console.log(`  Ref    : ${sourceRef    || '(unknown)'}`);
+console.log(`  Staged : ${STAGE_FILES.length} files → ${stage}`);
+console.log(`${'─'.repeat(50)}\n`);
+
+// ── Publish ───────────────────────────────────────────────────────────────────
+const quotedCmd = process.platform === 'win32' ? cmd.map(quoteArg) : cmd;
+const result = spawnSync('npx', quotedCmd, { cwd: ROOT, stdio: 'inherit', shell: true });
+
+// ── Cleanup ───────────────────────────────────────────────────────────────────
+fs.rmSync(stage, { recursive: true });
+
+if (result.status !== 0) {
+  console.error(`\n${c.red}✖ publish failed (exit ${result.status})${c.reset}`);
+  process.exit(result.status ?? 1);
+}
+console.log(`\n${c.green}✔ Published ${SKILL_SLUG}@${version}${c.reset}\n`);

package/socket.json

@@ -124,7 +124,7 @@
       },
       {
         "path": "adapters/adapter-registry.ts",
-        "reason": "Intentional — adapter-registry re-exports all 29 adapters; Socket.dev's import-graph analysis flags it because it transitively references adapters that use fetch. No direct HTTP calls are made here."
+        "reason": "Intentional — adapter-registry re-exports all 32 adapters; Socket.dev's import-graph analysis flags it because it transitively references adapters that use fetch. No direct HTTP calls are made here."
       },
       {
         "path": "dist/adapters/adapter-registry.js",