Repository navigation
lean-agentic 0.3.3: agentdb ^3.6.0 (optional), lockfile, CI - #4
Merged
Merged
Conversation
agentdb 1.x pulled @xenova/transformers -> onnxruntime-web/onnx-proto/
protobufjs, plus sharp and zod 3: 8 high advisories reaching every
lean-agentic user. agentdb 3.6.0 drops that chain (npm audit --omit=dev: 0).
- agentdb is only used by the MCP server's agentdb_* tools and the
stats://agentdb resource. Those paths now live in mcp/agentdb-tools.js,
load agentdb lazily via dynamic import (3.x is ESM-only) and return a
structured "install agentdb" result when it is missing.
- Ported to the agentdb 3.x API: createDatabase returns a better-sqlite3
style handle (exec/prepare().run/get/all), EmbeddingService takes a config
and exposes embedPassage/embedQuery, similarity via WASMVectorSearch.
The 0.3.2 code failed on every call ("db.run is not a function").
- Embeddings default to transformers.js (all-MiniLM-L6-v2, 384d);
LEAN_AGENTIC_EMBEDDINGS=mock uses AgentDB's offline embeddings.
- agentdb moves to optionalDependencies; engines stays >=18 (agentdb itself
needs >=20.9, the fallback covers older Node).
- Real-import tests against agentdb 3.6.0 for every agentdb code path,
plus the MCP server routing and the missing-agentdb fallback.
- npm test runs the agentdb suite and the passing theorem suites;
performance-theorems (a pre-existing WASM aliasing failure) moves to
test:perf.
- Commit npm/lean-agentic/package-lock.json so audits are reproducible.
- Add CI: npm build/test/audit on Node 20 and 22, cargo test on the crates
that compile (leanr-elab, leanr-eval-lite, runtime do not yet).
- MCP server reports the package version instead of a hardcoded 0.3.0.
Co-Authored-By: claude-flow <ruv@ruv.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the
lean-agenticnpm package fromagentdb ^1.5.5toagentdb ^3.6.0and releases 0.3.3.Why: agentdb 1.x pulls
@xenova/transformers→onnxruntime-web/onnx-proto/protobufjs, plussharpandzod3. That is 8 high advisories reaching every lean-agentic user (npm audit --omit=devon a freshlean-agentic@0.3.2install). agentdb 3.6.0 drops that chain, and the same audit on this branch's lockfile reports 0 vulnerabilities.Changes
agentdb_*tools and thestats://agentdbresource touch agentdb (src/agentdb-integration*.js, the CLI and the examples never import it). Those paths move tomcp/agentdb-tools.jsand are ported to the 3.x API: a better-sqlite3-stylecreateDatabasehandle,EmbeddingService(config)withembedPassage/embedQuery, andWASMVectorSearch.cosineSimilarity. In 0.3.2 every agentdb tool failed withdb.run is not a function.optionalDependenciesand loaded lazily withimport(), since 3.x is ESM-only. If it is missing, the tools return a structured "install agentdb" result instead of throwing.enginesstays>=18; agentdb itself needs>=20.9.LEAN_AGENTIC_EMBEDDINGS=mockswitches to agentdb's deterministic offline embeddings.npm testnow runs these plus the passing theorem suites.performance-theoremsfails on main with a WASM "recursive use of an object" error, so it moves tonpm run test:perf.npm/lean-agentic/package-lock.jsonis now committed. The root.gitignoreignored all lockfiles, so this adds a narrow negation for this one.npm audit --omit=dev --audit-level=highand pack dry-run on Node 20 and 22. A second job runscargo teston the 7 crates that compile.leanr-elab,leanr-eval-liteandruntimedo not compile on main and are left out.0.3.0.Not changed
package.json(unnamed, so not published) still listsagentdb ^1.3.10.dist/node.jsprintsInitializing Lean-Agentic WASM...to stdout, which pollutes the MCP stdio stream. Fixing it needs a dist rebuild, so it is left out of this PR.The published file list differs from 0.3.2 only by
mcp/agentdb-tools.js.🤖 Generated with claude-flow